diff --git a/lib/src/modules/dotnet/tests/testdata/0224ad9739f5fa64a2a63e23ef6a0e3152020fc7964243fc845cad499d11f9ab.out b/lib/src/modules/dotnet/tests/testdata/0224ad9739f5fa64a2a63e23ef6a0e3152020fc7964243fc845cad499d11f9ab.out index e61d2c5b5..e7dfa181a 100644 --- a/lib/src/modules/dotnet/tests/testdata/0224ad9739f5fa64a2a63e23ef6a0e3152020fc7964243fc845cad499d11f9ab.out +++ b/lib/src/modules/dotnet/tests/testdata/0224ad9739f5fa64a2a63e23ef6a0e3152020fc7964243fc845cad499d11f9ab.out @@ -13,20 +13,20 @@ number_of_field_offsets: 0 typelib: "286e82a5-8e28-4288-b175-0099b68f4880" streams: - name: "#-" - offset: 2840 - size: 1917 + offset: 0xb18 + size: 0x77d - name: "#Strings" - offset: 4757 - size: 2012 + offset: 0x1295 + size: 0x7dc - name: "#US" - offset: 6769 - size: 669 + offset: 0x1a71 + size: 0x29d - name: "#GUID" - offset: 7438 - size: 21 + offset: 0x1d0e + size: 0x15 - name: "#Blob" - offset: 7459 - size: 984 + offset: 0x1d23 + size: 0x3d8 guids: - "d56eef0e-b964-4c2b-8e58-30441730866d" constants: diff --git a/lib/src/modules/dotnet/tests/testdata/0885cff80dd6e14559c6429a89d724d9f5553a34e0716a660376728b8987c61b.out b/lib/src/modules/dotnet/tests/testdata/0885cff80dd6e14559c6429a89d724d9f5553a34e0716a660376728b8987c61b.out index f750f3e36..40689ef8a 100644 --- a/lib/src/modules/dotnet/tests/testdata/0885cff80dd6e14559c6429a89d724d9f5553a34e0716a660376728b8987c61b.out +++ b/lib/src/modules/dotnet/tests/testdata/0885cff80dd6e14559c6429a89d724d9f5553a34e0716a660376728b8987c61b.out @@ -12,20 +12,20 @@ number_of_constants: 1 number_of_field_offsets: 0 streams: - name: "#~" - offset: 38924 - size: 23096 + offset: 0x980c + size: 0x5a38 - name: "#Strings" - offset: 62020 - size: 57788 + offset: 0xf244 + size: 0xe1bc - name: "#US" - offset: 119808 - size: 8300 + offset: 0x1d400 + size: 0x206c - name: "#GUID" - offset: 128108 - size: 16 + offset: 0x1f46c + size: 0x10 - name: "#Blob" - offset: 128124 - size: 7552 + offset: 0x1f47c + size: 0x1d80 guids: - "62c64791-ab4b-42b5-9dd0-8811aa8e6454" constants: @@ -151,11 +151,11 @@ assembly_refs: build_number: 0 revision_number: 0 resources: - - offset: 135680 - length: 267652 + - offset: 0x21200 + length: 0x41584 name: "TurboPing.g.resources" - - offset: 403336 - length: 180 + - offset: 0x62788 + length: 0xb4 name: "AppGame.Properties.Resources.resources" classes: - fullname: "Register Plugin MethodInvokableCallback.GetGroup" diff --git a/lib/src/modules/dotnet/tests/testdata/4a8e3e00ce7fd88da587fbb187e07985a2f69fe1b94f3a83cfbba4e4104c2b26.out b/lib/src/modules/dotnet/tests/testdata/4a8e3e00ce7fd88da587fbb187e07985a2f69fe1b94f3a83cfbba4e4104c2b26.out index 7c38f6114..1dff7974c 100644 --- a/lib/src/modules/dotnet/tests/testdata/4a8e3e00ce7fd88da587fbb187e07985a2f69fe1b94f3a83cfbba4e4104c2b26.out +++ b/lib/src/modules/dotnet/tests/testdata/4a8e3e00ce7fd88da587fbb187e07985a2f69fe1b94f3a83cfbba4e4104c2b26.out @@ -12,20 +12,20 @@ number_of_constants: 0 number_of_field_offsets: 0 streams: - name: "#~" - offset: 1592 - size: 1856 + offset: 0x638 + size: 0x740 - name: "#Strings" - offset: 3448 - size: 1768 + offset: 0xd78 + size: 0x6e8 - name: "#US" - offset: 5216 - size: 184 + offset: 0x1460 + size: 0xb8 - name: "#GUID" - offset: 5400 - size: 16 + offset: 0x1518 + size: 0x10 - name: "#Blob" - offset: 5416 - size: 884 + offset: 0x1528 + size: 0x374 guids: - "4699c8b3-49a5-4441-8da7-5f947f0d3891" assembly: diff --git a/lib/src/modules/dotnet/tests/testdata/605ebe5b5f4b94e1a73e0ad1162bd542e5cb948d1a4ea5a575a14d6b9d6ee849.out b/lib/src/modules/dotnet/tests/testdata/605ebe5b5f4b94e1a73e0ad1162bd542e5cb948d1a4ea5a575a14d6b9d6ee849.out index fac07097d..73648963a 100644 --- a/lib/src/modules/dotnet/tests/testdata/605ebe5b5f4b94e1a73e0ad1162bd542e5cb948d1a4ea5a575a14d6b9d6ee849.out +++ b/lib/src/modules/dotnet/tests/testdata/605ebe5b5f4b94e1a73e0ad1162bd542e5cb948d1a4ea5a575a14d6b9d6ee849.out @@ -13,20 +13,20 @@ number_of_field_offsets: 0 typelib: "63ca6b3c-208c-47ef-9294-fbc91c947d15" streams: - name: "#~" - offset: 3736 - size: 19848 + offset: 0xe98 + size: 0x4d88 - name: "#Strings" - offset: 23584 - size: 10520 + offset: 0x5c20 + size: 0x2918 - name: "#US" - offset: 34104 - size: 8 + offset: 0x8538 + size: 0x8 - name: "#GUID" - offset: 34112 - size: 16 + offset: 0x8540 + size: 0x10 - name: "#Blob" - offset: 34128 - size: 2804 + offset: 0x8550 + size: 0xaf4 guids: - "5bd514fb-7c75-4e0c-b827-7d125a564ae9" assembly: diff --git a/lib/src/modules/dotnet/tests/testdata/6d72a599724c4ff367b2c00b48030a62d286de5493c25c000a00f5fbc6e7b746.out b/lib/src/modules/dotnet/tests/testdata/6d72a599724c4ff367b2c00b48030a62d286de5493c25c000a00f5fbc6e7b746.out index 6b990735b..11af14922 100644 --- a/lib/src/modules/dotnet/tests/testdata/6d72a599724c4ff367b2c00b48030a62d286de5493c25c000a00f5fbc6e7b746.out +++ b/lib/src/modules/dotnet/tests/testdata/6d72a599724c4ff367b2c00b48030a62d286de5493c25c000a00f5fbc6e7b746.out @@ -11,494 +11,494 @@ number_of_constants: 0 number_of_field_offsets: 0 streams: - name: "#~" - offset: 79516 - size: 32524 + offset: 0x1369c + size: 0x7f0c - name: "#Strings" - offset: 112040 - size: 47880 + offset: 0x1b5a8 + size: 0xbb08 - name: "#US" - offset: 159920 - size: 260 + offset: 0x270b0 + size: 0x104 - name: "#GUID" - offset: 160180 - size: 16 + offset: 0x271b4 + size: 0x10 - name: "#Blob" - offset: 160196 - size: 6332 + offset: 0x271c4 + size: 0x18bc - name: "#GUID" - offset: 166528 - size: 16 + offset: 0x28a80 + size: 0x10 - name: "#Strings" - offset: 166544 - size: 4 + offset: 0x28a90 + size: 0x4 - name: "#Blob" - offset: 166548 - size: 4 + offset: 0x28a94 + size: 0x4 - name: "#Schema" - offset: 166552 - size: 4 + offset: 0x28a98 + size: 0x4 - name: "#DarksProtector" - offset: 166556 - size: 4 + offset: 0x28a9c + size: 0x4 - name: "" - offset: 166560 - size: 4 + offset: 0x28aa0 + size: 0x4 - name: "BoobiesProtector" - offset: 166564 - size: 4 + offset: 0x28aa4 + size: 0x4 - name: "" - offset: 166568 - size: 4 + offset: 0x28aa8 + size: 0x4 - name: "#lolProtector" - offset: 166572 - size: 4 + offset: 0x28aac + size: 0x4 - name: "" - offset: 166576 - size: 4 + offset: 0x28ab0 + size: 0x4 - name: "#CursedSheepV3" - offset: 166580 - size: 4 + offset: 0x28ab4 + size: 0x4 - name: "" - offset: 166584 - size: 4 + offset: 0x28ab8 + size: 0x4 - name: "#BootyProtector" - offset: 166588 - size: 4 + offset: 0x28abc + size: 0x4 - name: "" - offset: 166592 - size: 4 + offset: 0x28ac0 + size: 0x4 - name: "#VmProtect" - offset: 166596 - size: 4 + offset: 0x28ac4 + size: 0x4 - name: "" - offset: 166600 - size: 4 + offset: 0x28ac8 + size: 0x4 - name: "Hot-Steamy-Cum" - offset: 166604 - size: 4 + offset: 0x28acc + size: 0x4 - name: "" - offset: 166608 - size: 4 + offset: 0x28ad0 + size: 0x4 - name: "Stop-Decompiling" - offset: 166612 - size: 4 + offset: 0x28ad4 + size: 0x4 - name: "" - offset: 166616 - size: 4 + offset: 0x28ad8 + size: 0x4 - name: "Fucking-Imbread" - offset: 166620 - size: 4 + offset: 0x28adc + size: 0x4 - name: "" - offset: 166624 - size: 4 + offset: 0x28ae0 + size: 0x4 - name: "Stop-Cracking-Me" - offset: 166628 - size: 4 + offset: 0x28ae4 + size: 0x4 - name: "" - offset: 166632 - size: 4 + offset: 0x28ae8 + size: 0x4 - name: "Pheonix-Protector" - offset: 166636 - size: 4 + offset: 0x28aec + size: 0x4 - name: "#DarksProtector" - offset: 166640 - size: 4 + offset: 0x28af0 + size: 0x4 - name: "" - offset: 166644 - size: 4 + offset: 0x28af4 + size: 0x4 - name: "BoobiesProtector" - offset: 166648 - size: 4 + offset: 0x28af8 + size: 0x4 - name: "" - offset: 166652 - size: 4 + offset: 0x28afc + size: 0x4 - name: "#lolProtector" - offset: 166656 - size: 4 + offset: 0x28b00 + size: 0x4 - name: "" - offset: 166660 - size: 4 + offset: 0x28b04 + size: 0x4 - name: "#CursedSheepV3" - offset: 166664 - size: 4 + offset: 0x28b08 + size: 0x4 - name: "" - offset: 166668 - size: 4 + offset: 0x28b0c + size: 0x4 - name: "#BootyProtector" - offset: 166672 - size: 4 + offset: 0x28b10 + size: 0x4 - name: "" - offset: 166676 - size: 4 + offset: 0x28b14 + size: 0x4 - name: "#VmProtect" - offset: 166680 - size: 4 + offset: 0x28b18 + size: 0x4 - name: "" - offset: 166684 - size: 4 + offset: 0x28b1c + size: 0x4 - name: "Hot-Steamy-Cum" - offset: 166688 - size: 4 + offset: 0x28b20 + size: 0x4 - name: "" - offset: 166692 - size: 4 + offset: 0x28b24 + size: 0x4 - name: "Stop-Decompiling" - offset: 166696 - size: 4 + offset: 0x28b28 + size: 0x4 - name: "" - offset: 166700 - size: 4 + offset: 0x28b2c + size: 0x4 - name: "Fucking-Imbread" - offset: 166704 - size: 4 + offset: 0x28b30 + size: 0x4 - name: "" - offset: 166708 - size: 4 + offset: 0x28b34 + size: 0x4 - name: "Stop-Cracking-Me" - offset: 166712 - size: 4 + offset: 0x28b38 + size: 0x4 - name: "" - offset: 166716 - size: 4 + offset: 0x28b3c + size: 0x4 - name: "Pheonix-Protector" - offset: 166720 - size: 4 + offset: 0x28b40 + size: 0x4 - name: "#DarksProtector" - offset: 166724 - size: 4 + offset: 0x28b44 + size: 0x4 - name: "" - offset: 166728 - size: 4 + offset: 0x28b48 + size: 0x4 - name: "BoobiesProtector" - offset: 166732 - size: 4 + offset: 0x28b4c + size: 0x4 - name: "" - offset: 166736 - size: 4 + offset: 0x28b50 + size: 0x4 - name: "#lolProtector" - offset: 166740 - size: 4 + offset: 0x28b54 + size: 0x4 - name: "" - offset: 166744 - size: 4 + offset: 0x28b58 + size: 0x4 - name: "#CursedSheepV3" - offset: 166748 - size: 4 + offset: 0x28b5c + size: 0x4 - name: "" - offset: 166752 - size: 4 + offset: 0x28b60 + size: 0x4 - name: "#BootyProtector" - offset: 166756 - size: 4 + offset: 0x28b64 + size: 0x4 - name: "" - offset: 166760 - size: 4 + offset: 0x28b68 + size: 0x4 - name: "#VmProtect" - offset: 166764 - size: 4 + offset: 0x28b6c + size: 0x4 - name: "" - offset: 166768 - size: 4 + offset: 0x28b70 + size: 0x4 - name: "Hot-Steamy-Cum" - offset: 166772 - size: 4 + offset: 0x28b74 + size: 0x4 - name: "" - offset: 166776 - size: 4 + offset: 0x28b78 + size: 0x4 - name: "Stop-Decompiling" - offset: 166780 - size: 4 + offset: 0x28b7c + size: 0x4 - name: "" - offset: 166784 - size: 4 + offset: 0x28b80 + size: 0x4 - name: "Fucking-Imbread" - offset: 166788 - size: 4 + offset: 0x28b84 + size: 0x4 - name: "" - offset: 166792 - size: 4 + offset: 0x28b88 + size: 0x4 - name: "Stop-Cracking-Me" - offset: 166796 - size: 4 + offset: 0x28b8c + size: 0x4 - name: "" - offset: 166800 - size: 4 + offset: 0x28b90 + size: 0x4 - name: "Pheonix-Protector" - offset: 166804 - size: 4 + offset: 0x28b94 + size: 0x4 - name: "#DarksProtector" - offset: 166808 - size: 4 + offset: 0x28b98 + size: 0x4 - name: "" - offset: 166812 - size: 4 + offset: 0x28b9c + size: 0x4 - name: "BoobiesProtector" - offset: 166816 - size: 4 + offset: 0x28ba0 + size: 0x4 - name: "" - offset: 166820 - size: 4 + offset: 0x28ba4 + size: 0x4 - name: "#lolProtector" - offset: 166824 - size: 4 + offset: 0x28ba8 + size: 0x4 - name: "" - offset: 166828 - size: 4 + offset: 0x28bac + size: 0x4 - name: "#CursedSheepV3" - offset: 166832 - size: 4 + offset: 0x28bb0 + size: 0x4 - name: "" - offset: 166836 - size: 4 + offset: 0x28bb4 + size: 0x4 - name: "#BootyProtector" - offset: 166840 - size: 4 + offset: 0x28bb8 + size: 0x4 - name: "" - offset: 166844 - size: 4 + offset: 0x28bbc + size: 0x4 - name: "#VmProtect" - offset: 166848 - size: 4 + offset: 0x28bc0 + size: 0x4 - name: "" - offset: 166852 - size: 4 + offset: 0x28bc4 + size: 0x4 - name: "Hot-Steamy-Cum" - offset: 166856 - size: 4 + offset: 0x28bc8 + size: 0x4 - name: "" - offset: 166860 - size: 4 + offset: 0x28bcc + size: 0x4 - name: "Stop-Decompiling" - offset: 166864 - size: 4 + offset: 0x28bd0 + size: 0x4 - name: "" - offset: 166868 - size: 4 + offset: 0x28bd4 + size: 0x4 - name: "Fucking-Imbread" - offset: 166872 - size: 4 + offset: 0x28bd8 + size: 0x4 - name: "" - offset: 166876 - size: 4 + offset: 0x28bdc + size: 0x4 - name: "Stop-Cracking-Me" - offset: 166880 - size: 4 + offset: 0x28be0 + size: 0x4 - name: "" - offset: 166884 - size: 4 + offset: 0x28be4 + size: 0x4 - name: "Pheonix-Protector" - offset: 166888 - size: 4 + offset: 0x28be8 + size: 0x4 - name: "#DarksProtector" - offset: 166892 - size: 4 + offset: 0x28bec + size: 0x4 - name: "" - offset: 166896 - size: 4 + offset: 0x28bf0 + size: 0x4 - name: "BoobiesProtector" - offset: 166900 - size: 4 + offset: 0x28bf4 + size: 0x4 - name: "" - offset: 166904 - size: 4 + offset: 0x28bf8 + size: 0x4 - name: "#lolProtector" - offset: 166908 - size: 4 + offset: 0x28bfc + size: 0x4 - name: "" - offset: 166912 - size: 4 + offset: 0x28c00 + size: 0x4 - name: "#CursedSheepV3" - offset: 166916 - size: 4 + offset: 0x28c04 + size: 0x4 - name: "" - offset: 166920 - size: 4 + offset: 0x28c08 + size: 0x4 - name: "#BootyProtector" - offset: 166924 - size: 4 + offset: 0x28c0c + size: 0x4 - name: "" - offset: 166928 - size: 4 + offset: 0x28c10 + size: 0x4 - name: "#VmProtect" - offset: 166932 - size: 4 + offset: 0x28c14 + size: 0x4 - name: "" - offset: 166936 - size: 4 + offset: 0x28c18 + size: 0x4 - name: "Hot-Steamy-Cum" - offset: 166940 - size: 4 + offset: 0x28c1c + size: 0x4 - name: "" - offset: 166944 - size: 4 + offset: 0x28c20 + size: 0x4 - name: "Stop-Decompiling" - offset: 166948 - size: 4 + offset: 0x28c24 + size: 0x4 - name: "" - offset: 166952 - size: 4 + offset: 0x28c28 + size: 0x4 - name: "Fucking-Imbread" - offset: 166956 - size: 4 + offset: 0x28c2c + size: 0x4 - name: "" - offset: 166960 - size: 4 + offset: 0x28c30 + size: 0x4 - name: "Stop-Cracking-Me" - offset: 166964 - size: 4 + offset: 0x28c34 + size: 0x4 - name: "" - offset: 166968 - size: 4 + offset: 0x28c38 + size: 0x4 - name: "Pheonix-Protector" - offset: 166972 - size: 4 + offset: 0x28c3c + size: 0x4 - name: "" - offset: 166976 - size: 4 + offset: 0x28c40 + size: 0x4 - name: "Stop-Decompiling" - offset: 166980 - size: 4 + offset: 0x28c44 + size: 0x4 - name: "" - offset: 166984 - size: 4 + offset: 0x28c48 + size: 0x4 - name: "Fucking-Imbread" - offset: 166988 - size: 4 + offset: 0x28c4c + size: 0x4 - name: "" - offset: 166992 - size: 4 + offset: 0x28c50 + size: 0x4 - name: "Stop-Cracking-Me" - offset: 166996 - size: 4 + offset: 0x28c54 + size: 0x4 - name: "" - offset: 167000 - size: 4 + offset: 0x28c58 + size: 0x4 - name: "" - offset: 167004 - size: 4 + offset: 0x28c5c + size: 0x4 - name: "Stop-Decompiling" - offset: 167008 - size: 4 + offset: 0x28c60 + size: 0x4 - name: "" - offset: 167012 - size: 4 + offset: 0x28c64 + size: 0x4 - name: "Fucking-Imbread" - offset: 167016 - size: 4 + offset: 0x28c68 + size: 0x4 - name: "" - offset: 167020 - size: 4 + offset: 0x28c6c + size: 0x4 - name: "Stop-Cracking-Me" - offset: 167024 - size: 4 + offset: 0x28c70 + size: 0x4 - name: "" - offset: 167028 - size: 4 + offset: 0x28c74 + size: 0x4 - name: "" - offset: 167032 - size: 4 + offset: 0x28c78 + size: 0x4 - name: "Stop-Decompiling" - offset: 167036 - size: 4 + offset: 0x28c7c + size: 0x4 - name: "" - offset: 167040 - size: 4 + offset: 0x28c80 + size: 0x4 - name: "Fucking-Imbread" - offset: 167044 - size: 4 + offset: 0x28c84 + size: 0x4 - name: "" - offset: 167048 - size: 4 + offset: 0x28c88 + size: 0x4 - name: "Stop-Cracking-Me" - offset: 167052 - size: 4 + offset: 0x28c8c + size: 0x4 - name: "" - offset: 167056 - size: 4 + offset: 0x28c90 + size: 0x4 - name: "" - offset: 167060 - size: 4 + offset: 0x28c94 + size: 0x4 - name: "Stop-Decompiling" - offset: 167064 - size: 4 + offset: 0x28c98 + size: 0x4 - name: "" - offset: 167068 - size: 4 + offset: 0x28c9c + size: 0x4 - name: "Fucking-Imbread" - offset: 167072 - size: 4 + offset: 0x28ca0 + size: 0x4 - name: "" - offset: 167076 - size: 4 + offset: 0x28ca4 + size: 0x4 - name: "Stop-Cracking-Me" - offset: 167080 - size: 4 + offset: 0x28ca8 + size: 0x4 - name: "" - offset: 167084 - size: 4 + offset: 0x28cac + size: 0x4 - name: "" - offset: 167088 - size: 4 + offset: 0x28cb0 + size: 0x4 - name: "Stop-Decompiling" - offset: 167092 - size: 4 + offset: 0x28cb4 + size: 0x4 - name: "" - offset: 167096 - size: 4 + offset: 0x28cb8 + size: 0x4 - name: "Fucking-Imbread" - offset: 167100 - size: 4 + offset: 0x28cbc + size: 0x4 - name: "" - offset: 167104 - size: 4 + offset: 0x28cc0 + size: 0x4 - name: "Stop-Cracking-Me" - offset: 167108 - size: 4 + offset: 0x28cc4 + size: 0x4 - name: "" - offset: 167112 - size: 4 + offset: 0x28cc8 + size: 0x4 - name: "" - offset: 167116 - size: 4 + offset: 0x28ccc + size: 0x4 - name: "Stop-Decompiling" - offset: 167120 - size: 4 + offset: 0x28cd0 + size: 0x4 - name: "" - offset: 167124 - size: 4 + offset: 0x28cd4 + size: 0x4 - name: "Fucking-Imbread" - offset: 167128 - size: 4 + offset: 0x28cd8 + size: 0x4 - name: "" - offset: 167132 - size: 4 + offset: 0x28cdc + size: 0x4 - name: "Stop-Cracking-Me" - offset: 167136 - size: 4 + offset: 0x28ce0 + size: 0x4 - name: "" - offset: 167140 - size: 4 + offset: 0x28ce4 + size: 0x4 - name: "" - offset: 167144 - size: 4 + offset: 0x28ce8 + size: 0x4 - name: "Stop-Decompiling" - offset: 167148 - size: 4 + offset: 0x28cec + size: 0x4 - name: "" - offset: 167152 - size: 4 + offset: 0x28cf0 + size: 0x4 - name: "Fucking-Imbread" - offset: 167156 - size: 4 + offset: 0x28cf4 + size: 0x4 - name: "" - offset: 167160 - size: 4 + offset: 0x28cf8 + size: 0x4 - name: "Stop-Cracking-Me" - offset: 167164 - size: 4 + offset: 0x28cfc + size: 0x4 - name: "" - offset: 167168 - size: 4 + offset: 0x28d00 + size: 0x4 guids: - "c6fcb421-e1b3-43a7-b9dd-0d013b9c3d93" user_strings: diff --git a/lib/src/modules/dotnet/tests/testdata/86a1e48cfc843eabfe1b468ef9358c1068950f849c612ab808225b359db0bb8c.out b/lib/src/modules/dotnet/tests/testdata/86a1e48cfc843eabfe1b468ef9358c1068950f849c612ab808225b359db0bb8c.out index 654d06b32..8d981797e 100644 --- a/lib/src/modules/dotnet/tests/testdata/86a1e48cfc843eabfe1b468ef9358c1068950f849c612ab808225b359db0bb8c.out +++ b/lib/src/modules/dotnet/tests/testdata/86a1e48cfc843eabfe1b468ef9358c1068950f849c612ab808225b359db0bb8c.out @@ -12,20 +12,20 @@ number_of_constants: 40 number_of_field_offsets: 0 streams: - name: "#~" - offset: 808 - size: 1140 + offset: 0x328 + size: 0x474 - name: "#Strings" - offset: 1948 - size: 1460 + offset: 0x79c + size: 0x5b4 - name: "#US" - offset: 3408 - size: 4 + offset: 0xd50 + size: 0x4 - name: "#GUID" - offset: 3412 - size: 16 + offset: 0xd54 + size: 0x10 - name: "#Blob" - offset: 3428 - size: 5520 + offset: 0xd64 + size: 0x1590 guids: - "4d7cadc0-d2a5-4306-9b14-94e13aa44464" constants: diff --git a/lib/src/modules/dotnet/tests/testdata/88d0d0692e675cd5fafb57db4f940e98d03e054ca2b88ef5a41f72b5787841b3.out b/lib/src/modules/dotnet/tests/testdata/88d0d0692e675cd5fafb57db4f940e98d03e054ca2b88ef5a41f72b5787841b3.out index 3da3a7eaf..77a76010a 100644 --- a/lib/src/modules/dotnet/tests/testdata/88d0d0692e675cd5fafb57db4f940e98d03e054ca2b88ef5a41f72b5787841b3.out +++ b/lib/src/modules/dotnet/tests/testdata/88d0d0692e675cd5fafb57db4f940e98d03e054ca2b88ef5a41f72b5787841b3.out @@ -12,20 +12,20 @@ number_of_constants: 0 number_of_field_offsets: 0 streams: - name: "#~" - offset: 190176 - size: 86528 + offset: 0x2e6e0 + size: 0x15200 - name: "#Strings" - offset: 276704 - size: 64692 + offset: 0x438e0 + size: 0xfcb4 - name: "#US" - offset: 341396 - size: 4 + offset: 0x53594 + size: 0x4 - name: "#GUID" - offset: 341400 - size: 288 + offset: 0x53598 + size: 0x120 - name: "#Blob" - offset: 341688 - size: 33952 + offset: 0x536b8 + size: 0x84a0 guids: - "e28280e2-8480-80e2-88e2-8083e28088e2" - "80e28780-e288-8a80-e280-85e28087e280" diff --git a/lib/src/modules/dotnet/tests/testdata/984750efd1cb94e5ca7b366863af2092af954dad65df534bff603b9afcb49cd4.out b/lib/src/modules/dotnet/tests/testdata/984750efd1cb94e5ca7b366863af2092af954dad65df534bff603b9afcb49cd4.out index e4d32dd05..7ce40ee5f 100644 --- a/lib/src/modules/dotnet/tests/testdata/984750efd1cb94e5ca7b366863af2092af954dad65df534bff603b9afcb49cd4.out +++ b/lib/src/modules/dotnet/tests/testdata/984750efd1cb94e5ca7b366863af2092af954dad65df534bff603b9afcb49cd4.out @@ -12,20 +12,20 @@ number_of_constants: 0 number_of_field_offsets: 0 streams: - name: "#~" - offset: 9608 - size: 6780 + offset: 0x2588 + size: 0x1a7c - name: "#Strings" - offset: 16388 - size: 6952 + offset: 0x4004 + size: 0x1b28 - name: "#US" - offset: 23340 - size: 1608 + offset: 0x5b2c + size: 0x648 - name: "#GUID" - offset: 24948 - size: 16 + offset: 0x6174 + size: 0x10 - name: "#Blob" - offset: 24964 - size: 4904 + offset: 0x6184 + size: 0x1328 guids: - "eb073d6d-392a-46fb-a695-d2b5b539fcfc" assembly: @@ -51,8 +51,8 @@ assembly_refs: build_number: 0 revision_number: 0 resources: - - offset: 8348 - length: 1022 + - offset: 0x209c + length: 0x3fe name: "FxResources.System.Net.NameResolution.SR.resources" classes: - fullname: "Microsoft.CodeAnalysis.EmbeddedAttribute" diff --git a/lib/src/modules/dotnet/tests/testdata/aa45a3468107612a58c6a348ec183961e411e056c31877cfb680f84e16c4fbb4.out b/lib/src/modules/dotnet/tests/testdata/aa45a3468107612a58c6a348ec183961e411e056c31877cfb680f84e16c4fbb4.out index b46ed1110..a2dad07c4 100644 --- a/lib/src/modules/dotnet/tests/testdata/aa45a3468107612a58c6a348ec183961e411e056c31877cfb680f84e16c4fbb4.out +++ b/lib/src/modules/dotnet/tests/testdata/aa45a3468107612a58c6a348ec183961e411e056c31877cfb680f84e16c4fbb4.out @@ -12,20 +12,20 @@ number_of_constants: 0 number_of_field_offsets: 1 streams: - name: "#~" - offset: 1256 - size: 792 + offset: 0x4e8 + size: 0x318 - name: "#Strings" - offset: 2048 - size: 1176 + offset: 0x800 + size: 0x498 - name: "#US" - offset: 3224 - size: 664 + offset: 0xc98 + size: 0x298 - name: "#GUID" - offset: 3888 - size: 16 + offset: 0xf30 + size: 0x10 - name: "#Blob" - offset: 3904 - size: 532 + offset: 0xf40 + size: 0x214 guids: - "2ae3fb54-b89f-4b7e-96f8-72495b36c61a" assembly: diff --git a/lib/src/modules/dotnet/tests/testdata/efb93998279f5611e54d713b4de05a7ea44a67e95240b2a3b539fcc319aec0b6.out b/lib/src/modules/dotnet/tests/testdata/efb93998279f5611e54d713b4de05a7ea44a67e95240b2a3b539fcc319aec0b6.out index bc2fbe49e..4d1d28b68 100644 --- a/lib/src/modules/dotnet/tests/testdata/efb93998279f5611e54d713b4de05a7ea44a67e95240b2a3b539fcc319aec0b6.out +++ b/lib/src/modules/dotnet/tests/testdata/efb93998279f5611e54d713b4de05a7ea44a67e95240b2a3b539fcc319aec0b6.out @@ -13,20 +13,20 @@ number_of_field_offsets: 0 typelib: "b25af9bc-af68-4ae2-886f-af4da29c02e3" streams: - name: "#-" - offset: 3842720 - size: 32728 + offset: 0x3aa2a0 + size: 0x7fd8 - name: "#Strings" - offset: 3875448 - size: 55680 + offset: 0x3b2278 + size: 0xd980 - name: "#US" - offset: 3931128 - size: 15584 + offset: 0x3bfbf8 + size: 0x3ce0 - name: "#GUID" - offset: 3946712 - size: 16 + offset: 0x3c38d8 + size: 0x10 - name: "#Blob" - offset: 3946728 - size: 18400 + offset: 0x3c38e8 + size: 0x47e0 guids: - "192000d2-c73b-4e8a-9de4-ad8ef81e2428" constants: @@ -138,23 +138,23 @@ resources: - name: "costura.system.diagnostics.diagnosticsource.dll.compressed" - name: "costura.metadata" - name: "VVd53efa6b4e4V78fa63c3f07b92f2ee" - - offset: 299660 - length: 1503760 + - offset: 0x4928c + length: 0x16f210 name: "a746b0269f55fa8e6bb0277151d5be55.resources" - - offset: 1803424 - length: 1968528 + - offset: 0x1b84a0 + length: 0x1e0990 name: "" - - offset: 3771956 - length: 24119 + - offset: 0x398e34 + length: 0x5e37 name: "ٻ" - - offset: 3796080 - length: 22327 + - offset: 0x39ec70 + length: 0x5737 name: "ٺ" - - offset: 3818412 - length: 24072 + - offset: 0x3a43ac + length: 0x5e08 name: " " - - offset: 3842488 - length: 123 + - offset: 0x3aa1b8 + length: 0x7b name: "ٸ" classes: - fullname: "d670ae11ff92998e7fa0f1f02132419c.Pbc07ea03P9fd5ePe42635dPcf664a20" diff --git a/lib/src/modules/dotnet/tests/testdata/types2.dll.out b/lib/src/modules/dotnet/tests/testdata/types2.dll.out index 6383207bb..a95fb490e 100644 --- a/lib/src/modules/dotnet/tests/testdata/types2.dll.out +++ b/lib/src/modules/dotnet/tests/testdata/types2.dll.out @@ -12,20 +12,20 @@ number_of_constants: 0 number_of_field_offsets: 0 streams: - name: "#~" - offset: 708 - size: 216 + offset: 0x2c4 + size: 0xd8 - name: "#Strings" - offset: 924 - size: 100 + offset: 0x39c + size: 0x64 - name: "#US" - offset: 1024 - size: 8 + offset: 0x400 + size: 0x8 - name: "#GUID" - offset: 1032 - size: 16 + offset: 0x408 + size: 0x10 - name: "#Blob" - offset: 1048 - size: 172 + offset: 0x418 + size: 0xac guids: - "de63c758-8c65-4928-b244-b60ad6cdb2a0" classes: diff --git a/lib/src/modules/pe/tests/testdata/00a1067fc96eb2c1d440bb5b44b32f43b9900fdd3a65c985d65a63b8f1535ef5.out b/lib/src/modules/pe/tests/testdata/00a1067fc96eb2c1d440bb5b44b32f43b9900fdd3a65c985d65a63b8f1535ef5.out index 32ebbfb19..a2d4db8e7 100644 --- a/lib/src/modules/pe/tests/testdata/00a1067fc96eb2c1d440bb5b44b32f43b9900fdd3a65c985d65a63b8f1535ef5.out +++ b/lib/src/modules/pe/tests/testdata/00a1067fc96eb2c1d440bb5b44b32f43b9900fdd3a65c985d65a63b8f1535ef5.out @@ -17,25 +17,25 @@ opthdr_magic: IMAGE_NT_OPTIONAL_HDR64_MAGIC characteristics: 0x23 # RELOCS_STRIPPED | EXECUTABLE_IMAGE | LARGE_ADDRESS_AWARE dll_characteristics: 0x8120 # HIGH_ENTROPY_VA | NX_COMPAT | TERMINAL_SERVER_AWARE timestamp: 1527751881 # 2018-05-31 07:31:21 UTC -image_base: 5368709120 +image_base: 0x140000000 checksum: 121515 -base_of_code: 4096 -entry_point: 2376 -entry_point_raw: 5448 -section_alignment: 4096 -file_alignment: 512 -loader_flags: 0 -size_of_optional_header: 240 -size_of_code: 40960 -size_of_initialized_data: 48640 -size_of_uninitialized_data: 0 -size_of_image: 102400 -size_of_headers: 1024 -size_of_stack_reserve: 1048576 -size_of_stack_commit: 4096 -size_of_heap_reserve: 1048576 -size_of_heap_commit: 4096 -pointer_to_symbol_table: 0 +base_of_code: 0x1000 +entry_point: 0x948 +entry_point_raw: 0x1548 +section_alignment: 0x1000 +file_alignment: 0x200 +loader_flags: 0x0 +size_of_optional_header: 0xf0 +size_of_code: 0xa000 +size_of_initialized_data: 0xbe00 +size_of_uninitialized_data: 0x0 +size_of_image: 0x19000 +size_of_headers: 0x400 +size_of_stack_reserve: 0x100000 +size_of_stack_commit: 0x1000 +size_of_heap_reserve: 0x100000 +size_of_heap_commit: 0x1000 +pointer_to_symbol_table: 0x0 win32_version_value: 0 number_of_symbols: 0 number_of_rva_and_sizes: 16 @@ -49,8 +49,8 @@ number_of_delayed_imports: 0 number_of_exports: 0 number_of_signatures: 1 rich_signature: - offset: 128 - length: 112 + offset: 0x80 + length: 0x70 key: 1468968837 raw_data: "\xc1\xce\xe0\x04\x85\xaf\x8eW\x85\xaf\x8eW\x85\xaf\x8eW13\x7fW\x81\xaf\x8eW13}W\xfd\xaf\x8eW13|W\x88\xaf\x8eW\xbe\xf1\x8dV\x82\xaf\x8eW\xbe\xf1\x8bV\x99\xaf\x8eW\xbe\xf1\x8aV\x97\xaf\x8eW\x8c\xd7\x1dW\x86\xaf\x8eW\x85\xaf\x8fW\xd9\xaf\x8eW\x12\xf1\x8bV\x87\xaf\x8eW\x17\xf1qW\x84\xaf\x8eW\x85\xaf\x19W\x84\xaf\x8eW\x12\xf1\x8cV\x84\xaf\x8eW" clear_data: "DanS\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb4\x9c\xf1\x00\x04\x00\x00\x00\xb4\x9c\xf3\x00x\x00\x00\x00\xb4\x9c\xf2\x00\r\x00\x00\x00;^\x03\x01\x07\x00\x00\x00;^\x05\x01\x1c\x00\x00\x00;^\x04\x01\x12\x00\x00\x00\tx\x93\x00\x03\x00\x00\x00\x00\x00\x01\x00\\\x00\x00\x00\x97^\x05\x01\x02\x00\x00\x00\x92^\xff\x00\x01\x00\x00\x00\x00\x00\x97\x00\x01\x00\x00\x00\x97^\x02\x01\x01\x00\x00\x00" @@ -95,117 +95,117 @@ pdb_path: "D:\\MyProject\\StreetPlayer\\ExtraProgram\\KillPot\\x64\\Release\\Kil sections: - name: ".text" full_name: ".text" - characteristics: 1610612768 - raw_data_size: 40960 - raw_data_offset: 1024 - virtual_address: 4096 - virtual_size: 40464 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0x60000020 # SECTION_MEM_READ | SECTION_MEM_WRITE | SECTION_SCALE_INDEX + raw_data_size: 0xa000 + raw_data_offset: 0x400 + virtual_address: 0x1000 + virtual_size: 0x9e10 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".rdata" full_name: ".rdata" - characteristics: 1073741888 - raw_data_size: 35840 - raw_data_offset: 41984 - virtual_address: 45056 - virtual_size: 35448 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0x40000040 + raw_data_size: 0x8c00 + raw_data_offset: 0xa400 + virtual_address: 0xb000 + virtual_size: 0x8a78 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".data" full_name: ".data" - characteristics: 3221225536 - raw_data_size: 2560 - raw_data_offset: 77824 - virtual_address: 81920 - virtual_size: 7112 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0xc0000040 + raw_data_size: 0xa00 + raw_data_offset: 0x13000 + virtual_address: 0x14000 + virtual_size: 0x1bc8 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".pdata" full_name: ".pdata" - characteristics: 1073741888 - raw_data_size: 3072 - raw_data_offset: 80384 - virtual_address: 90112 - virtual_size: 3036 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0x40000040 + raw_data_size: 0xc00 + raw_data_offset: 0x13a00 + virtual_address: 0x16000 + virtual_size: 0xbdc + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".gfids" full_name: ".gfids" - characteristics: 1073741888 - raw_data_size: 512 - raw_data_offset: 83456 - virtual_address: 94208 - virtual_size: 160 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0x40000040 + raw_data_size: 0x200 + raw_data_offset: 0x14600 + virtual_address: 0x17000 + virtual_size: 0xa0 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".rsrc" full_name: ".rsrc" - characteristics: 1073741888 - raw_data_size: 2048 - raw_data_offset: 83968 - virtual_address: 98304 - virtual_size: 2008 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0x40000040 + raw_data_size: 0x800 + raw_data_offset: 0x14800 + virtual_address: 0x18000 + virtual_size: 0x7d8 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 data_directories: - - virtual_address: 0 - size: 0 - - virtual_address: 78516 - size: 40 - - virtual_address: 98304 - size: 2008 - - virtual_address: 90112 - size: 3036 - - virtual_address: 86016 - size: 6072 - - virtual_address: 0 - size: 0 - - virtual_address: 74880 - size: 84 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 74976 - size: 148 - - virtual_address: 0 - size: 0 - - virtual_address: 45056 - size: 584 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x132b4 + size: 0x28 + - virtual_address: 0x18000 + size: 0x7d8 + - virtual_address: 0x16000 + size: 0xbdc + - virtual_address: 0x15000 + size: 0x17b8 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x12480 + size: 0x54 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x124e0 + size: 0x94 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0xb000 + size: 0x248 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 resource_timestamp: 0 # 1970-01-01 00:00:00 UTC resource_version: major: 0 minor: 0 resources: - - length: 899 - rva: 99408 - offset: 85072 + - length: 0x383 + rva: 0x18450 + offset: 0x14c50 type: RESOURCE_TYPE_MANIFEST id: 1 language: 1033 - - length: 987 - rva: 98416 - offset: 84080 + - length: 0x3db + rva: 0x18070 + offset: 0x14870 type: RESOURCE_TYPE_MANIFEST id: 1 language: 1042 @@ -214,149 +214,149 @@ import_details: number_of_functions: 72 functions: - name: "OpenProcess" - rva: 45056 + rva: 0xb000 - name: "TerminateProcess" - rva: 45064 + rva: 0xb008 - name: "GetExitCodeProcess" - rva: 45072 + rva: 0xb010 - name: "CloseHandle" - rva: 45080 + rva: 0xb018 - name: "CreateToolhelp32Snapshot" - rva: 45088 + rva: 0xb020 - name: "Process32FirstW" - rva: 45096 + rva: 0xb028 - name: "Process32NextW" - rva: 45104 + rva: 0xb030 - name: "Module32FirstW" - rva: 45112 + rva: 0xb038 - name: "Module32NextW" - rva: 45120 + rva: 0xb040 - name: "RtlCaptureContext" - rva: 45128 + rva: 0xb048 - name: "RtlLookupFunctionEntry" - rva: 45136 + rva: 0xb050 - name: "RtlVirtualUnwind" - rva: 45144 + rva: 0xb058 - name: "UnhandledExceptionFilter" - rva: 45152 + rva: 0xb060 - name: "SetUnhandledExceptionFilter" - rva: 45160 + rva: 0xb068 - name: "GetCurrentProcess" - rva: 45168 + rva: 0xb070 - name: "IsProcessorFeaturePresent" - rva: 45176 + rva: 0xb078 - name: "QueryPerformanceCounter" - rva: 45184 + rva: 0xb080 - name: "GetCurrentProcessId" - rva: 45192 + rva: 0xb088 - name: "GetCurrentThreadId" - rva: 45200 + rva: 0xb090 - name: "GetSystemTimeAsFileTime" - rva: 45208 + rva: 0xb098 - name: "InitializeSListHead" - rva: 45216 + rva: 0xb0a0 - name: "IsDebuggerPresent" - rva: 45224 + rva: 0xb0a8 - name: "GetStartupInfoW" - rva: 45232 + rva: 0xb0b0 - name: "GetModuleHandleW" - rva: 45240 + rva: 0xb0b8 - name: "RtlUnwindEx" - rva: 45248 + rva: 0xb0c0 - name: "GetLastError" - rva: 45256 + rva: 0xb0c8 - name: "SetLastError" - rva: 45264 + rva: 0xb0d0 - name: "EnterCriticalSection" - rva: 45272 + rva: 0xb0d8 - name: "LeaveCriticalSection" - rva: 45280 + rva: 0xb0e0 - name: "DeleteCriticalSection" - rva: 45288 + rva: 0xb0e8 - name: "InitializeCriticalSectionAndSpinCount" - rva: 45296 + rva: 0xb0f0 - name: "TlsAlloc" - rva: 45304 + rva: 0xb0f8 - name: "TlsGetValue" - rva: 45312 + rva: 0xb100 - name: "TlsSetValue" - rva: 45320 + rva: 0xb108 - name: "TlsFree" - rva: 45328 + rva: 0xb110 - name: "FreeLibrary" - rva: 45336 + rva: 0xb118 - name: "GetProcAddress" - rva: 45344 + rva: 0xb120 - name: "LoadLibraryExW" - rva: 45352 + rva: 0xb128 - name: "GetStdHandle" - rva: 45360 + rva: 0xb130 - name: "WriteFile" - rva: 45368 + rva: 0xb138 - name: "GetModuleFileNameW" - rva: 45376 + rva: 0xb140 - name: "MultiByteToWideChar" - rva: 45384 + rva: 0xb148 - name: "WideCharToMultiByte" - rva: 45392 + rva: 0xb150 - name: "ExitProcess" - rva: 45400 + rva: 0xb158 - name: "GetModuleHandleExW" - rva: 45408 + rva: 0xb160 - name: "GetACP" - rva: 45416 + rva: 0xb168 - name: "HeapFree" - rva: 45424 + rva: 0xb170 - name: "HeapAlloc" - rva: 45432 + rva: 0xb178 - name: "FindClose" - rva: 45440 + rva: 0xb180 - name: "FindFirstFileExW" - rva: 45448 + rva: 0xb188 - name: "FindNextFileW" - rva: 45456 + rva: 0xb190 - name: "IsValidCodePage" - rva: 45464 + rva: 0xb198 - name: "GetOEMCP" - rva: 45472 + rva: 0xb1a0 - name: "GetCPInfo" - rva: 45480 + rva: 0xb1a8 - name: "GetCommandLineA" - rva: 45488 + rva: 0xb1b0 - name: "GetCommandLineW" - rva: 45496 + rva: 0xb1b8 - name: "GetEnvironmentStringsW" - rva: 45504 + rva: 0xb1c0 - name: "FreeEnvironmentStringsW" - rva: 45512 + rva: 0xb1c8 - name: "LCMapStringW" - rva: 45520 + rva: 0xb1d0 - name: "SetStdHandle" - rva: 45528 + rva: 0xb1d8 - name: "GetFileType" - rva: 45536 + rva: 0xb1e0 - name: "GetStringTypeW" - rva: 45544 + rva: 0xb1e8 - name: "GetProcessHeap" - rva: 45552 + rva: 0xb1f0 - name: "HeapSize" - rva: 45560 + rva: 0xb1f8 - name: "HeapReAlloc" - rva: 45568 + rva: 0xb200 - name: "FlushFileBuffers" - rva: 45576 + rva: 0xb208 - name: "GetConsoleCP" - rva: 45584 + rva: 0xb210 - name: "GetConsoleMode" - rva: 45592 + rva: 0xb218 - name: "SetFilePointerEx" - rva: 45600 + rva: 0xb220 - name: "WriteConsoleW" - rva: 45608 + rva: 0xb228 - name: "CreateFileW" - rva: 45616 + rva: 0xb230 - name: "RaiseException" - rva: 45624 + rva: 0xb238 is_signed: true signatures: - subject: "/C=KR/ST=Jeju-do/L=Jeju-si/O=Kakao corp./CN=Kakao corp." @@ -459,5 +459,5 @@ signatures: not_before: 1356048000 # 2012-12-21 00:00:00 UTC not_after: 1609372799 # 2020-12-30 23:59:59 UTC overlay: - offset: 86016 - size: 6072 \ No newline at end of file + offset: 0x15000 + size: 0x17b8 \ No newline at end of file diff --git a/lib/src/modules/pe/tests/testdata/04ac6dd0c1cc33a49962ee0f3222597104f54a75683a5adee235401778279818.out b/lib/src/modules/pe/tests/testdata/04ac6dd0c1cc33a49962ee0f3222597104f54a75683a5adee235401778279818.out index 413d8c63d..fc9aac8e2 100644 --- a/lib/src/modules/pe/tests/testdata/04ac6dd0c1cc33a49962ee0f3222597104f54a75683a5adee235401778279818.out +++ b/lib/src/modules/pe/tests/testdata/04ac6dd0c1cc33a49962ee0f3222597104f54a75683a5adee235401778279818.out @@ -17,26 +17,26 @@ opthdr_magic: IMAGE_NT_OPTIONAL_HDR32_MAGIC characteristics: 0x102 # EXECUTABLE_IMAGE | MACHINE_32BIT dll_characteristics: 0x8140 # DYNAMIC_BASE | NX_COMPAT | TERMINAL_SERVER_AWARE timestamp: 1626863112 # 2021-07-21 10:25:12 UTC -image_base: 4194304 +image_base: 0x400000 checksum: 0 -base_of_code: 4096 -base_of_data: 53248 -entry_point: 2976 -entry_point_raw: 6048 -section_alignment: 4096 -file_alignment: 512 -loader_flags: 0 -size_of_optional_header: 224 -size_of_code: 47104 -size_of_initialized_data: 32768 -size_of_uninitialized_data: 0 -size_of_image: 90112 -size_of_headers: 1024 -size_of_stack_reserve: 1048576 -size_of_stack_commit: 4096 -size_of_heap_reserve: 1048576 -size_of_heap_commit: 4096 -pointer_to_symbol_table: 0 +base_of_code: 0x1000 +base_of_data: 0xd000 +entry_point: 0xba0 +entry_point_raw: 0x17a0 +section_alignment: 0x1000 +file_alignment: 0x200 +loader_flags: 0x0 +size_of_optional_header: 0xe0 +size_of_code: 0xb800 +size_of_initialized_data: 0x8000 +size_of_uninitialized_data: 0x0 +size_of_image: 0x16000 +size_of_headers: 0x400 +size_of_stack_reserve: 0x100000 +size_of_stack_commit: 0x1000 +size_of_heap_reserve: 0x100000 +size_of_heap_commit: 0x1000 +pointer_to_symbol_table: 0x0 win32_version_value: 0 number_of_symbols: 0 number_of_rva_and_sizes: 16 @@ -50,8 +50,8 @@ number_of_delayed_imports: 1 number_of_exports: 0 number_of_signatures: 0 rich_signature: - offset: 128 - length: 96 + offset: 0x80 + length: 0x60 key: 2144685205 raw_data: "\xd1-\xbb,\x95L\xd5\x7f\x95L\xd5\x7f\x95L\xd5\x7f\x81\'\xd6~\x9fL\xd5\x7f\x81\'\xd0~\x19L\xd5\x7f\x81\'\xd1~\x87L\xd5\x7f\x81\'\xd4~\x96L\xd5\x7f\xc79\xd1~\x84L\xd5\x7f\xc79\xd6~\x84L\xd5\x7f\xc79\xd0~\xbdL\xd5\x7f\x95L\xd4\x7f\xc3L\xd5\x7f\xcd9\xd0~\x94L\xd5\x7f\xcd9\xd7~\x94L\xd5\x7f" clear_data: "DanS\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x14k\x03\x01\n\x00\x00\x00\x14k\x05\x01\x8c\x00\x00\x00\x14k\x04\x01\x12\x00\x00\x00\x14k\x01\x01\x03\x00\x00\x00Ru\x04\x01\x11\x00\x00\x00Ru\x03\x01\x11\x00\x00\x00Ru\x05\x01(\x00\x00\x00\x00\x00\x01\x00V\x00\x00\x00Xu\x05\x01\x01\x00\x00\x00Xu\x02\x01\x01\x00\x00\x00" @@ -89,232 +89,232 @@ rich_signature: sections: - name: ".text" full_name: ".text" - characteristics: 1610612768 - raw_data_size: 47104 - raw_data_offset: 1024 - virtual_address: 4096 - virtual_size: 46792 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0x60000020 # SECTION_MEM_READ | SECTION_MEM_WRITE | SECTION_SCALE_INDEX + raw_data_size: 0xb800 + raw_data_offset: 0x400 + virtual_address: 0x1000 + virtual_size: 0xb6c8 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".rdata" full_name: ".rdata" - characteristics: 1073741888 - raw_data_size: 23552 - raw_data_offset: 48128 - virtual_address: 53248 - virtual_size: 23284 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0x40000040 + raw_data_size: 0x5c00 + raw_data_offset: 0xbc00 + virtual_address: 0xd000 + virtual_size: 0x5af4 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".data" full_name: ".data" - characteristics: 3221225536 - raw_data_size: 2560 - raw_data_offset: 71680 - virtual_address: 77824 - virtual_size: 4828 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0xc0000040 + raw_data_size: 0xa00 + raw_data_offset: 0x11800 + virtual_address: 0x13000 + virtual_size: 0x12dc + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".reloc" full_name: ".reloc" - characteristics: 1107296320 - raw_data_size: 4096 - raw_data_offset: 74240 - virtual_address: 86016 - virtual_size: 3700 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0x42000040 + raw_data_size: 0x1000 + raw_data_offset: 0x12200 + virtual_address: 0x15000 + virtual_size: 0xe74 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 data_directories: - - virtual_address: 0 - size: 0 - - virtual_address: 74920 - size: 40 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 86016 - size: 3700 - - virtual_address: 73020 - size: 28 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 53728 - size: 64 - - virtual_address: 0 - size: 0 - - virtual_address: 53248 - size: 280 - - virtual_address: 74804 - size: 64 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x124a8 + size: 0x28 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x15000 + size: 0xe74 + - virtual_address: 0x11d3c + size: 0x1c + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0xd1e0 + size: 0x40 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0xd000 + size: 0x118 + - virtual_address: 0x12434 + size: 0x40 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 import_details: - library_name: "KERNEL32.dll" number_of_functions: 69 functions: - name: "RaiseException" - rva: 53248 + rva: 0xd000 - name: "GetLastError" - rva: 53252 + rva: 0xd004 - name: "GetSystemInfo" - rva: 53256 + rva: 0xd008 - name: "VirtualProtect" - rva: 53260 + rva: 0xd00c - name: "VirtualQuery" - rva: 53264 + rva: 0xd010 - name: "FreeLibrary" - rva: 53268 + rva: 0xd014 - name: "GetModuleHandleW" - rva: 53272 + rva: 0xd018 - name: "GetProcAddress" - rva: 53276 + rva: 0xd01c - name: "LoadLibraryExA" - rva: 53280 + rva: 0xd020 - name: "QueryPerformanceCounter" - rva: 53284 + rva: 0xd024 - name: "GetCurrentProcessId" - rva: 53288 + rva: 0xd028 - name: "GetCurrentThreadId" - rva: 53292 + rva: 0xd02c - name: "GetSystemTimeAsFileTime" - rva: 53296 + rva: 0xd030 - name: "InitializeSListHead" - rva: 53300 + rva: 0xd034 - name: "IsDebuggerPresent" - rva: 53304 + rva: 0xd038 - name: "UnhandledExceptionFilter" - rva: 53308 + rva: 0xd03c - name: "SetUnhandledExceptionFilter" - rva: 53312 + rva: 0xd040 - name: "GetStartupInfoW" - rva: 53316 + rva: 0xd044 - name: "IsProcessorFeaturePresent" - rva: 53320 + rva: 0xd048 - name: "GetCurrentProcess" - rva: 53324 + rva: 0xd04c - name: "TerminateProcess" - rva: 53328 + rva: 0xd050 - name: "WriteConsoleW" - rva: 53332 + rva: 0xd054 - name: "RtlUnwind" - rva: 53336 + rva: 0xd058 - name: "SetLastError" - rva: 53340 + rva: 0xd05c - name: "EnterCriticalSection" - rva: 53344 + rva: 0xd060 - name: "LeaveCriticalSection" - rva: 53348 + rva: 0xd064 - name: "DeleteCriticalSection" - rva: 53352 + rva: 0xd068 - name: "InitializeCriticalSectionAndSpinCount" - rva: 53356 + rva: 0xd06c - name: "TlsAlloc" - rva: 53360 + rva: 0xd070 - name: "TlsGetValue" - rva: 53364 + rva: 0xd074 - name: "TlsSetValue" - rva: 53368 + rva: 0xd078 - name: "TlsFree" - rva: 53372 + rva: 0xd07c - name: "LoadLibraryExW" - rva: 53376 + rva: 0xd080 - name: "GetStdHandle" - rva: 53380 + rva: 0xd084 - name: "WriteFile" - rva: 53384 + rva: 0xd088 - name: "GetModuleFileNameW" - rva: 53388 + rva: 0xd08c - name: "ExitProcess" - rva: 53392 + rva: 0xd090 - name: "GetModuleHandleExW" - rva: 53396 + rva: 0xd094 - name: "GetCommandLineA" - rva: 53400 + rva: 0xd098 - name: "GetCommandLineW" - rva: 53404 + rva: 0xd09c - name: "HeapAlloc" - rva: 53408 + rva: 0xd0a0 - name: "HeapFree" - rva: 53412 + rva: 0xd0a4 - name: "FindClose" - rva: 53416 + rva: 0xd0a8 - name: "FindFirstFileExW" - rva: 53420 + rva: 0xd0ac - name: "FindNextFileW" - rva: 53424 + rva: 0xd0b0 - name: "IsValidCodePage" - rva: 53428 + rva: 0xd0b4 - name: "GetACP" - rva: 53432 + rva: 0xd0b8 - name: "GetOEMCP" - rva: 53436 + rva: 0xd0bc - name: "GetCPInfo" - rva: 53440 + rva: 0xd0c0 - name: "MultiByteToWideChar" - rva: 53444 + rva: 0xd0c4 - name: "WideCharToMultiByte" - rva: 53448 + rva: 0xd0c8 - name: "GetEnvironmentStringsW" - rva: 53452 + rva: 0xd0cc - name: "FreeEnvironmentStringsW" - rva: 53456 + rva: 0xd0d0 - name: "SetEnvironmentVariableW" - rva: 53460 + rva: 0xd0d4 - name: "SetStdHandle" - rva: 53464 + rva: 0xd0d8 - name: "GetFileType" - rva: 53468 + rva: 0xd0dc - name: "GetStringTypeW" - rva: 53472 + rva: 0xd0e0 - name: "CompareStringW" - rva: 53476 + rva: 0xd0e4 - name: "LCMapStringW" - rva: 53480 + rva: 0xd0e8 - name: "GetProcessHeap" - rva: 53484 + rva: 0xd0ec - name: "HeapSize" - rva: 53488 + rva: 0xd0f0 - name: "HeapReAlloc" - rva: 53492 + rva: 0xd0f4 - name: "FlushFileBuffers" - rva: 53496 + rva: 0xd0f8 - name: "GetConsoleOutputCP" - rva: 53500 + rva: 0xd0fc - name: "GetConsoleMode" - rva: 53504 + rva: 0xd100 - name: "SetFilePointerEx" - rva: 53508 + rva: 0xd104 - name: "CreateFileW" - rva: 53512 + rva: 0xd108 - name: "CloseHandle" - rva: 53516 + rva: 0xd10c - name: "DecodePointer" - rva: 53520 + rva: 0xd110 delayed_import_details: - library_name: "USER32.dll" number_of_functions: 2 functions: - name: "MessageBeep" - rva: 80000 + rva: 0x13880 - name: "MessageBoxA" - rva: 80004 + rva: 0x13884 is_signed: false overlay: - offset: 0 - size: 0 \ No newline at end of file + offset: 0x0 + size: 0x0 \ No newline at end of file diff --git a/lib/src/modules/pe/tests/testdata/079a472d22290a94ebb212aa8015cdc8dd28a968c6b4d3b88acdd58ce2d3b885.out b/lib/src/modules/pe/tests/testdata/079a472d22290a94ebb212aa8015cdc8dd28a968c6b4d3b88acdd58ce2d3b885.out index ea096b8c9..95431c57e 100644 --- a/lib/src/modules/pe/tests/testdata/079a472d22290a94ebb212aa8015cdc8dd28a968c6b4d3b88acdd58ce2d3b885.out +++ b/lib/src/modules/pe/tests/testdata/079a472d22290a94ebb212aa8015cdc8dd28a968c6b4d3b88acdd58ce2d3b885.out @@ -17,28 +17,28 @@ opthdr_magic: IMAGE_NT_OPTIONAL_HDR32_MAGIC characteristics: 0x2102 # EXECUTABLE_IMAGE | MACHINE_32BIT | DLL dll_characteristics: 0x140 # DYNAMIC_BASE | NX_COMPAT timestamp: 1528213185 # 2018-06-05 15:39:45 UTC -image_base: 268435456 +image_base: 0x10000000 checksum: 82308 -base_of_code: 4096 -base_of_data: 12288 -entry_point: 2605 -entry_point_raw: 5677 +base_of_code: 0x1000 +base_of_data: 0x3000 +entry_point: 0xa2d +entry_point_raw: 0x162d dll_name: "CUSTPROF.dll" export_timestamp: 1528213185 # 2018-06-05 15:39:45 UTC -section_alignment: 4096 -file_alignment: 512 -loader_flags: 0 -size_of_optional_header: 224 -size_of_code: 4608 -size_of_initialized_data: 5120 -size_of_uninitialized_data: 0 -size_of_image: 28672 -size_of_headers: 1024 -size_of_stack_reserve: 1048576 -size_of_stack_commit: 4096 -size_of_heap_reserve: 4096 -size_of_heap_commit: 4096 -pointer_to_symbol_table: 0 +section_alignment: 0x1000 +file_alignment: 0x200 +loader_flags: 0x0 +size_of_optional_header: 0xe0 +size_of_code: 0x1200 +size_of_initialized_data: 0x1400 +size_of_uninitialized_data: 0x0 +size_of_image: 0x7000 +size_of_headers: 0x400 +size_of_stack_reserve: 0x100000 +size_of_stack_commit: 0x1000 +size_of_heap_reserve: 0x1000 +size_of_heap_commit: 0x1000 +pointer_to_symbol_table: 0x0 win32_version_value: 0 number_of_symbols: 0 number_of_rva_and_sizes: 16 @@ -87,8 +87,8 @@ version_info_list: - key: "OriginalFilename" value: "CUSTPROF.DLL" rich_signature: - offset: 128 - length: 96 + offset: 0x80 + length: 0x60 key: 157631266 raw_data: "f\"\x0bZ\"Ce\t\"Ce\t\"Ce\t9\xde\xf9\t!Ce\t9\xde\xfb\t#Ce\t9\xde\xcf\t)Ce\tM5\xce\t!Ce\t+;\xf6\t Ce\t\"Cd\t\x0eCe\t9\xde\xce\t&Ce\t9\xde\xfe\t#Ce\t9\xde\xff\t#Ce\t9\xde\xf8\t#Ce\t" clear_data: "DanS\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1b\x9d\x9c\x00\x03\x00\x00\x00\x1b\x9d\x9e\x00\x01\x00\x00\x00\x1b\x9d\xaa\x00\x0b\x00\x00\x00ov\xab\x00\x03\x00\x00\x00\tx\x93\x00\x02\x00\x00\x00\x00\x00\x01\x00,\x00\x00\x00\x1b\x9d\xab\x00\x04\x00\x00\x00\x1b\x9d\x9b\x00\x01\x00\x00\x00\x1b\x9d\x9a\x00\x01\x00\x00\x00\x1b\x9d\x9d\x00\x01\x00\x00\x00" @@ -127,106 +127,106 @@ pdb_path: "D:\\workspace\\2018_R9_RelBld\\target\\checkout\\custprof\\Release\\c sections: - name: ".text" full_name: ".text" - characteristics: 1610612768 - raw_data_size: 4608 - raw_data_offset: 1024 - virtual_address: 4096 - virtual_size: 4524 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0x60000020 # SECTION_MEM_READ | SECTION_MEM_WRITE | SECTION_SCALE_INDEX + raw_data_size: 0x1200 + raw_data_offset: 0x400 + virtual_address: 0x1000 + virtual_size: 0x11ac + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".rdata" full_name: ".rdata" - characteristics: 1073741888 - raw_data_size: 2048 - raw_data_offset: 5632 - virtual_address: 12288 - virtual_size: 1777 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0x40000040 + raw_data_size: 0x800 + raw_data_offset: 0x1600 + virtual_address: 0x3000 + virtual_size: 0x6f1 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".data" full_name: ".data" - characteristics: 3221225536 - raw_data_size: 512 - raw_data_offset: 7680 - virtual_address: 16384 - virtual_size: 916 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0xc0000040 + raw_data_size: 0x200 + raw_data_offset: 0x1e00 + virtual_address: 0x4000 + virtual_size: 0x394 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".rsrc" full_name: ".rsrc" - characteristics: 1073741888 - raw_data_size: 1536 - raw_data_offset: 8192 - virtual_address: 20480 - virtual_size: 1468 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0x40000040 + raw_data_size: 0x600 + raw_data_offset: 0x2000 + virtual_address: 0x5000 + virtual_size: 0x5bc + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".reloc" full_name: ".reloc" - characteristics: 1107296320 - raw_data_size: 1024 - raw_data_offset: 9728 - virtual_address: 24576 - virtual_size: 524 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0x42000040 + raw_data_size: 0x400 + raw_data_offset: 0x2600 + virtual_address: 0x6000 + virtual_size: 0x20c + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 data_directories: - - virtual_address: 13904 - size: 161 - - virtual_address: 12980 - size: 60 - - virtual_address: 20480 - size: 1468 - - virtual_address: 0 - size: 0 - - virtual_address: 10752 - size: 6048 - - virtual_address: 24576 - size: 508 - - virtual_address: 12480 - size: 28 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 12552 - size: 64 - - virtual_address: 0 - size: 0 - - virtual_address: 12288 - size: 160 - - virtual_address: 12860 - size: 64 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 + - virtual_address: 0x3650 + size: 0xa1 + - virtual_address: 0x32b4 + size: 0x3c + - virtual_address: 0x5000 + size: 0x5bc + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x2a00 + size: 0x17a0 + - virtual_address: 0x6000 + size: 0x1fc + - virtual_address: 0x30c0 + size: 0x1c + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x3108 + size: 0x40 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x3000 + size: 0xa0 + - virtual_address: 0x323c + size: 0x40 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 resource_timestamp: 0 # 1970-01-01 00:00:00 UTC resource_version: major: 4 minor: 0 resources: - - length: 958 - rva: 20640 - offset: 8352 + - length: 0x3be + rva: 0x50a0 + offset: 0x20a0 type: RESOURCE_TYPE_VERSION id: 1 language: 1033 - - length: 346 - rva: 21600 - offset: 9312 + - length: 0x15a + rva: 0x5460 + offset: 0x2460 type: RESOURCE_TYPE_MANIFEST id: 2 language: 1033 @@ -235,127 +235,127 @@ import_details: number_of_functions: 16 functions: - name: "_crt_debugger_hook" - rva: 12380 + rva: 0x305c - name: "_except_handler4_common" - rva: 12384 + rva: 0x3060 - name: "_onexit" - rva: 12388 + rva: 0x3064 - name: "_lock" - rva: 12392 + rva: 0x3068 - name: "__dllonexit" - rva: 12396 + rva: 0x306c - name: "_unlock" - rva: 12400 + rva: 0x3070 - name: "__clean_type_info_names_internal" - rva: 12404 + rva: 0x3074 - name: "__CppXcptFilter" - rva: 12408 + rva: 0x3078 - name: "_amsg_exit" - rva: 12412 + rva: 0x307c - name: "_initterm_e" - rva: 12416 + rva: 0x3080 - name: "_initterm" - rva: 12420 + rva: 0x3084 - name: "_encoded_null" - rva: 12424 + rva: 0x3088 - name: "_malloc_crt" - rva: 12428 + rva: 0x308c - name: "malloc" - rva: 12432 + rva: 0x3090 - name: "memcpy" - rva: 12436 + rva: 0x3094 - name: "free" - rva: 12440 + rva: 0x3098 - library_name: "KERNEL32.dll" number_of_functions: 22 functions: - name: "Sleep" - rva: 12288 + rva: 0x3000 - name: "LoadLibraryA" - rva: 12292 + rva: 0x3004 - name: "GetLastError" - rva: 12296 + rva: 0x3008 - name: "FreeLibrary" - rva: 12300 + rva: 0x300c - name: "GetProcAddress" - rva: 12304 + rva: 0x3010 - name: "LocalFree" - rva: 12308 + rva: 0x3014 - name: "LocalAlloc" - rva: 12312 + rva: 0x3018 - name: "IsDebuggerPresent" - rva: 12316 + rva: 0x301c - name: "SetUnhandledExceptionFilter" - rva: 12320 + rva: 0x3020 - name: "UnhandledExceptionFilter" - rva: 12324 + rva: 0x3024 - name: "GetCurrentProcess" - rva: 12328 + rva: 0x3028 - name: "TerminateProcess" - rva: 12332 + rva: 0x302c - name: "GetSystemTimeAsFileTime" - rva: 12336 + rva: 0x3030 - name: "GetCurrentProcessId" - rva: 12340 + rva: 0x3034 - name: "GetCurrentThreadId" - rva: 12344 + rva: 0x3038 - name: "GetTickCount" - rva: 12348 + rva: 0x303c - name: "EncodePointer" - rva: 12352 + rva: 0x3040 - name: "DecodePointer" - rva: 12356 + rva: 0x3044 - name: "InterlockedExchange" - rva: 12360 + rva: 0x3048 - name: "RaiseException" - rva: 12364 + rva: 0x304c - name: "InterlockedCompareExchange" - rva: 12368 + rva: 0x3050 - name: "QueryPerformanceCounter" - rva: 12372 + rva: 0x3054 delayed_import_details: - library_name: "QDB.dll" number_of_functions: 6 functions: - name: "ord116" ordinal: 116 - rva: 16408 + rva: 0x4018 - name: "ord102" ordinal: 102 - rva: 16412 + rva: 0x401c - name: "ord95" ordinal: 95 - rva: 16416 + rva: 0x4020 - name: "ord105" ordinal: 105 - rva: 16420 + rva: 0x4024 - name: "ord103" ordinal: 103 - rva: 16424 + rva: 0x4028 - name: "ord34" ordinal: 34 - rva: 16428 + rva: 0x402c export_details: - name: "CP_PutItem" ordinal: 200 - rva: 4204 - offset: 1132 + rva: 0x106c + offset: 0x46c - name: "CP_GetItem" ordinal: 201 - rva: 4414 - offset: 1342 + rva: 0x113e + offset: 0x53e - name: "CP_DelItem" ordinal: 202 - rva: 4096 - offset: 1024 + rva: 0x1000 + offset: 0x400 - name: "CP_GetTaxMap" ordinal: 203 - rva: 4186 - offset: 1114 + rva: 0x105a + offset: 0x45a - name: "_DllMain@12" ordinal: 204 - rva: 4624 - offset: 1552 + rva: 0x1210 + offset: 0x610 is_signed: true signatures: - subject: "/C=US/ST=California/L=Menlo Park/O=Quicken, Inc./OU=Operations/CN=Quicken, Inc." @@ -457,5 +457,5 @@ signatures: not_before: 1356048000 # 2012-12-21 00:00:00 UTC not_after: 1609372799 # 2020-12-30 23:59:59 UTC overlay: - offset: 10752 - size: 6048 \ No newline at end of file + offset: 0x2a00 + size: 0x17a0 \ No newline at end of file diff --git a/lib/src/modules/pe/tests/testdata/0885cff80dd6e14559c6429a89d724d9f5553a34e0716a660376728b8987c61b.out b/lib/src/modules/pe/tests/testdata/0885cff80dd6e14559c6429a89d724d9f5553a34e0716a660376728b8987c61b.out index 5f55e4f98..9d2d03e92 100644 --- a/lib/src/modules/pe/tests/testdata/0885cff80dd6e14559c6429a89d724d9f5553a34e0716a660376728b8987c61b.out +++ b/lib/src/modules/pe/tests/testdata/0885cff80dd6e14559c6429a89d724d9f5553a34e0716a660376728b8987c61b.out @@ -17,26 +17,26 @@ opthdr_magic: IMAGE_NT_OPTIONAL_HDR32_MAGIC characteristics: 0x22 # EXECUTABLE_IMAGE | LARGE_ADDRESS_AWARE dll_characteristics: 0x8560 # HIGH_ENTROPY_VA | DYNAMIC_BASE | NX_COMPAT | NO_SEH | TERMINAL_SERVER_AWARE timestamp: 2609937470 # 2052-09-14 14:37:50 UTC -image_base: 4194304 +image_base: 0x400000 checksum: 0 -base_of_code: 8192 -base_of_data: 417792 -entry_point: 403759 -entry_point_raw: 411439 -section_alignment: 8192 -file_alignment: 512 -loader_flags: 0 -size_of_optional_header: 224 -size_of_code: 403253 -size_of_initialized_data: 9034 -size_of_uninitialized_data: 0 -size_of_image: 442368 -size_of_headers: 512 -size_of_stack_reserve: 1048576 -size_of_stack_commit: 4096 -size_of_heap_reserve: 1048576 -size_of_heap_commit: 4096 -pointer_to_symbol_table: 0 +base_of_code: 0x2000 +base_of_data: 0x66000 +entry_point: 0x6292f +entry_point_raw: 0x6472f +section_alignment: 0x2000 +file_alignment: 0x200 +loader_flags: 0x0 +size_of_optional_header: 0xe0 +size_of_code: 0x62735 +size_of_initialized_data: 0x234a +size_of_uninitialized_data: 0x0 +size_of_image: 0x6c000 +size_of_headers: 0x200 +size_of_stack_reserve: 0x100000 +size_of_stack_commit: 0x1000 +size_of_heap_reserve: 0x100000 +size_of_heap_commit: 0x1000 +pointer_to_symbol_table: 0x0 win32_version_value: 0 number_of_symbols: 0 number_of_rva_and_sizes: 19 @@ -87,96 +87,96 @@ version_info_list: sections: - name: ".text" full_name: ".text" - characteristics: 1610612768 - raw_data_size: 403456 - raw_data_offset: 512 - virtual_address: 8192 - virtual_size: 403253 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0x60000020 # SECTION_MEM_READ | SECTION_MEM_WRITE | SECTION_SCALE_INDEX + raw_data_size: 0x62800 + raw_data_offset: 0x200 + virtual_address: 0x2000 + virtual_size: 0x62735 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".rsrc" full_name: ".rsrc" - characteristics: 1073741888 - raw_data_size: 9216 - raw_data_offset: 403968 - virtual_address: 417792 - virtual_size: 9022 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0x40000040 + raw_data_size: 0x2400 + raw_data_offset: 0x62a00 + virtual_address: 0x66000 + virtual_size: 0x233e + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".reloc" full_name: ".reloc" - characteristics: 1073741888 - raw_data_size: 512 - raw_data_offset: 413184 - virtual_address: 434176 - virtual_size: 12 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0x40000040 + raw_data_size: 0x200 + raw_data_offset: 0x64e00 + virtual_address: 0x6a000 + virtual_size: 0xc + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 data_directories: - - virtual_address: 0 - size: 0 - - virtual_address: 411196 - size: 0 - - virtual_address: 417792 - size: 9022 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 434176 - size: 12 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 8192 - size: 8 - - virtual_address: 0 - size: 0 - - virtual_address: 8200 - size: 0 - - virtual_address: 0 - size: 0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x6463c + size: 0x0 + - virtual_address: 0x66000 + size: 0x233e + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x6a000 + size: 0xc + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x2000 + size: 0x8 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x2008 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 resource_timestamp: 0 # 1970-01-01 00:00:00 UTC resource_version: major: 0 minor: 0 resources: - - length: 4264 - rva: 418096 - offset: 404272 + - length: 0x10a8 + rva: 0x66130 + offset: 0x62b30 type: RESOURCE_TYPE_ICON id: 1 language: 0 - - length: 20 - rva: 422360 - offset: 408536 + - length: 0x14 + rva: 0x671d8 + offset: 0x63bd8 type: RESOURCE_TYPE_GROUP_ICON id: 32512 language: 0 - - length: 868 - rva: 422380 - offset: 408556 + - length: 0x364 + rva: 0x671ec + offset: 0x63bec type: RESOURCE_TYPE_VERSION id: 1 language: 0 - - length: 3566 - rva: 423248 - offset: 409424 + - length: 0xdee + rva: 0x67550 + offset: 0x63f50 type: RESOURCE_TYPE_MANIFEST id: 1 language: 0 @@ -185,8 +185,8 @@ import_details: number_of_functions: 1 functions: - name: "_CorExeMain" - rva: 8192 + rva: 0x2000 is_signed: false overlay: - offset: 0 - size: 0 \ No newline at end of file + offset: 0x0 + size: 0x0 \ No newline at end of file diff --git a/lib/src/modules/pe/tests/testdata/09e7d832320e51bcc80b9aecde2a4135267a9b0156642a9596a62e85c9998cc9.out b/lib/src/modules/pe/tests/testdata/09e7d832320e51bcc80b9aecde2a4135267a9b0156642a9596a62e85c9998cc9.out index d33d58c09..8896dae5a 100644 --- a/lib/src/modules/pe/tests/testdata/09e7d832320e51bcc80b9aecde2a4135267a9b0156642a9596a62e85c9998cc9.out +++ b/lib/src/modules/pe/tests/testdata/09e7d832320e51bcc80b9aecde2a4135267a9b0156642a9596a62e85c9998cc9.out @@ -17,26 +17,26 @@ opthdr_magic: IMAGE_NT_OPTIONAL_HDR32_MAGIC characteristics: 0x2022 # EXECUTABLE_IMAGE | LARGE_ADDRESS_AWARE | DLL dll_characteristics: 0x8540 # DYNAMIC_BASE | NX_COMPAT | NO_SEH | TERMINAL_SERVER_AWARE timestamp: 3665045795 # 2086-02-20 12:16:35 UTC -image_base: 268435456 +image_base: 0x10000000 checksum: 0 -base_of_code: 8192 -base_of_data: 16384 -entry_point: 2726 -entry_point_raw: 10406 -section_alignment: 8192 -file_alignment: 512 -loader_flags: 0 -size_of_optional_header: 224 -size_of_code: 2560 -size_of_initialized_data: 2048 -size_of_uninitialized_data: 0 -size_of_image: 32768 -size_of_headers: 512 -size_of_stack_reserve: 1048576 -size_of_stack_commit: 4096 -size_of_heap_reserve: 1048576 -size_of_heap_commit: 4096 -pointer_to_symbol_table: 0 +base_of_code: 0x2000 +base_of_data: 0x4000 +entry_point: 0xaa6 +entry_point_raw: 0x28a6 +section_alignment: 0x2000 +file_alignment: 0x200 +loader_flags: 0x0 +size_of_optional_header: 0xe0 +size_of_code: 0xa00 +size_of_initialized_data: 0x800 +size_of_uninitialized_data: 0x0 +size_of_image: 0x8000 +size_of_headers: 0x200 +size_of_stack_reserve: 0x100000 +size_of_stack_commit: 0x1000 +size_of_heap_reserve: 0x100000 +size_of_heap_commit: 0x1000 +pointer_to_symbol_table: 0x0 win32_version_value: 0 number_of_symbols: 0 number_of_rva_and_sizes: 16 @@ -84,78 +84,78 @@ version_info_list: sections: - name: ".text" full_name: ".text" - characteristics: 1610612768 - raw_data_size: 2560 - raw_data_offset: 512 - virtual_address: 8192 - virtual_size: 2220 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0x60000020 # SECTION_MEM_READ | SECTION_MEM_WRITE | SECTION_SCALE_INDEX + raw_data_size: 0xa00 + raw_data_offset: 0x200 + virtual_address: 0x2000 + virtual_size: 0x8ac + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".rsrc" full_name: ".rsrc" - characteristics: 1073741888 - raw_data_size: 1536 - raw_data_offset: 3072 - virtual_address: 16384 - virtual_size: 1128 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0x40000040 + raw_data_size: 0x600 + raw_data_offset: 0xc00 + virtual_address: 0x4000 + virtual_size: 0x468 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".reloc" full_name: ".reloc" - characteristics: 1107296320 - raw_data_size: 512 - raw_data_offset: 4608 - virtual_address: 24576 - virtual_size: 12 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0x42000040 + raw_data_size: 0x200 + raw_data_offset: 0x1200 + virtual_address: 0x6000 + virtual_size: 0xc + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 data_directories: - - virtual_address: 0 - size: 0 - - virtual_address: 10324 - size: 79 - - virtual_address: 16384 - size: 1128 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 24576 - size: 12 - - virtual_address: 10296 - size: 28 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 8192 - size: 8 - - virtual_address: 0 - size: 0 - - virtual_address: 8200 - size: 72 - - virtual_address: 0 - size: 0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x2854 + size: 0x4f + - virtual_address: 0x4000 + size: 0x468 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x6000 + size: 0xc + - virtual_address: 0x2838 + size: 0x1c + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x2000 + size: 0x8 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x2008 + size: 0x48 + - virtual_address: 0x0 + size: 0x0 resource_timestamp: 0 # 1970-01-01 00:00:00 UTC resource_version: major: 0 minor: 0 resources: - - length: 1036 - rva: 16472 - offset: 3160 + - length: 0x40c + rva: 0x4058 + offset: 0xc58 type: RESOURCE_TYPE_VERSION id: 1 language: 0 @@ -164,8 +164,8 @@ import_details: number_of_functions: 1 functions: - name: "_CorDllMain" - rva: 8192 + rva: 0x2000 is_signed: false overlay: - offset: 0 - size: 0 \ No newline at end of file + offset: 0x0 + size: 0x0 \ No newline at end of file diff --git a/lib/src/modules/pe/tests/testdata/0ba6042247d90a187919dd88dc2d55cd882c80e5afc511c4f7b2e0e193968f7f.out b/lib/src/modules/pe/tests/testdata/0ba6042247d90a187919dd88dc2d55cd882c80e5afc511c4f7b2e0e193968f7f.out index a85bfce43..61c251dbf 100644 --- a/lib/src/modules/pe/tests/testdata/0ba6042247d90a187919dd88dc2d55cd882c80e5afc511c4f7b2e0e193968f7f.out +++ b/lib/src/modules/pe/tests/testdata/0ba6042247d90a187919dd88dc2d55cd882c80e5afc511c4f7b2e0e193968f7f.out @@ -17,26 +17,26 @@ opthdr_magic: IMAGE_NT_OPTIONAL_HDR32_MAGIC characteristics: 0x10f # RELOCS_STRIPPED | EXECUTABLE_IMAGE | LINE_NUMS_STRIPPED | LOCAL_SYMS_STRIPPED | MACHINE_32BIT dll_characteristics: 0x8000 # TERMINAL_SERVER_AWARE timestamp: 998081829 # 2001-08-17 20:57:09 UTC -image_base: 16777216 +image_base: 0x1000000 checksum: 0 -base_of_code: 28672 -base_of_data: 36864 -entry_point: 7552 -entry_point_raw: 35200 -section_alignment: 4096 -file_alignment: 512 -loader_flags: 0 -size_of_optional_header: 224 -size_of_code: 106496 -size_of_initialized_data: 4096 -size_of_uninitialized_data: 24576 -size_of_image: 40960 -size_of_headers: 4096 -size_of_stack_reserve: 262144 -size_of_stack_commit: 4096 -size_of_heap_reserve: 1048576 -size_of_heap_commit: 4096 -pointer_to_symbol_table: 0 +base_of_code: 0x7000 +base_of_data: 0x9000 +entry_point: 0x1d80 +entry_point_raw: 0x8980 +section_alignment: 0x1000 +file_alignment: 0x200 +loader_flags: 0x0 +size_of_optional_header: 0xe0 +size_of_code: 0x1a000 +size_of_initialized_data: 0x1000 +size_of_uninitialized_data: 0x6000 +size_of_image: 0xa000 +size_of_headers: 0x1000 +size_of_stack_reserve: 0x40000 +size_of_stack_commit: 0x1000 +size_of_heap_reserve: 0x100000 +size_of_heap_commit: 0x1000 +pointer_to_symbol_table: 0x0 win32_version_value: 0 number_of_symbols: 0 number_of_rva_and_sizes: 16 @@ -76,8 +76,8 @@ version_info_list: - key: "ProductVersion" value: "5.1.2600.0" rich_signature: - offset: 128 - length: 64 + offset: 0x80 + length: 0x40 key: 2970887405 raw_data: "\xa9Ez\xe2\xed$\x14\xb1\xed$\x14\xb1\xed$\x14\xb1\x17\x07T\xb1\xef$\x14\xb1\xed$\x15\xb1\xa0$\x14\xb1\x17\x07\r\xb1\xe6$\x14\xb1z\x07Q\xb1\xec$\x14\xb17\x07\x08\xb1\xf9$\x14\xb1\x17\x07)\xb1\xec$\x14\xb1" clear_data: "DanS\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xfa#@\x00\x02\x00\x00\x00\x00\x00\x01\x00M\x00\x00\x00\xfa#\x19\x00\x0b\x00\x00\x00\x97#E\x00\x01\x00\x00\x00\xda#\x1c\x00\x14\x00\x00\x00\xfa#=\x00\x01\x00\x00\x00" @@ -103,83 +103,83 @@ rich_signature: sections: - name: "UPX0" full_name: "UPX0" - characteristics: 3758096512 - raw_data_size: 0 - raw_data_offset: 1024 - virtual_address: 4096 - virtual_size: 24576 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0xe0000080 + raw_data_size: 0x0 + raw_data_offset: 0x400 + virtual_address: 0x1000 + virtual_size: 0x6000 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: "UPX1" full_name: "UPX1" - characteristics: 3758096448 - raw_data_size: 7168 - raw_data_offset: 1024 - virtual_address: 28672 - virtual_size: 8192 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0xe0000040 + raw_data_size: 0x1c00 + raw_data_offset: 0x400 + virtual_address: 0x7000 + virtual_size: 0x2000 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".rsrc" full_name: ".rsrc" - characteristics: 3221225536 - raw_data_size: 1536 - raw_data_offset: 8192 - virtual_address: 36864 - virtual_size: 4096 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0xc0000040 + raw_data_size: 0x600 + raw_data_offset: 0x2000 + virtual_address: 0x9000 + virtual_size: 0x1000 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 data_directories: - - virtual_address: 0 - size: 0 - - virtual_address: 37944 - size: 356 - - virtual_address: 36864 - size: 1080 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x9438 + size: 0x164 + - virtual_address: 0x9000 + size: 0x438 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 resource_timestamp: 0 # 1970-01-01 00:00:00 UTC resource_version: major: 0 minor: 0 resources: - - length: 4628 - rva: 21560 + - length: 0x1214 + rva: 0x5438 type: RESOURCE_TYPE_MESSAGETABLE id: 1 language: 1033 - - length: 916 - rva: 37028 - offset: 8356 + - length: 0x394 + rva: 0x90a4 + offset: 0x20a4 type: RESOURCE_TYPE_VERSION id: 1 language: 1033 @@ -188,39 +188,39 @@ import_details: number_of_functions: 6 functions: - name: "LoadLibraryA" - rva: 38064 + rva: 0x94b0 - name: "GetProcAddress" - rva: 38068 + rva: 0x94b4 - name: "VirtualProtect" - rva: 38072 + rva: 0x94b8 - name: "VirtualAlloc" - rva: 38076 + rva: 0x94bc - name: "VirtualFree" - rva: 38080 + rva: 0x94c0 - name: "ExitProcess" - rva: 38084 + rva: 0x94c4 - library_name: "msvcrt.dll" number_of_functions: 1 functions: - name: "putc" - rva: 38092 + rva: 0x94cc - library_name: "MSWSOCK.dll" number_of_functions: 1 functions: - name: "s_perror" - rva: 38100 + rva: 0x94d4 - library_name: "USER32.dll" number_of_functions: 1 functions: - name: "CharNextExA" - rva: 38108 + rva: 0x94dc - library_name: "WS2_32.dll" number_of_functions: 1 functions: - name: "sendto" ordinal: 20 - rva: 38116 + rva: 0x94e4 is_signed: false overlay: - offset: 0 - size: 0 \ No newline at end of file + offset: 0x0 + size: 0x0 \ No newline at end of file diff --git a/lib/src/modules/pe/tests/testdata/111aeddc6a6dbf64b28cb565aa12af9ee3cc0a56ce31e4da0068cf6b474c3288.out b/lib/src/modules/pe/tests/testdata/111aeddc6a6dbf64b28cb565aa12af9ee3cc0a56ce31e4da0068cf6b474c3288.out index a08daecd5..fee42e42e 100644 --- a/lib/src/modules/pe/tests/testdata/111aeddc6a6dbf64b28cb565aa12af9ee3cc0a56ce31e4da0068cf6b474c3288.out +++ b/lib/src/modules/pe/tests/testdata/111aeddc6a6dbf64b28cb565aa12af9ee3cc0a56ce31e4da0068cf6b474c3288.out @@ -17,26 +17,26 @@ opthdr_magic: IMAGE_NT_OPTIONAL_HDR32_MAGIC characteristics: 0x10f # RELOCS_STRIPPED | EXECUTABLE_IMAGE | LINE_NUMS_STRIPPED | LOCAL_SYMS_STRIPPED | MACHINE_32BIT dll_characteristics: 0x8000 # TERMINAL_SERVER_AWARE timestamp: 998098977 # 2001-08-18 01:42:57 UTC -image_base: 16777216 +image_base: 0x1000000 checksum: 330575 -base_of_code: 4096 -base_of_data: 40960 -entry_point: 20062 -entry_point_raw: 23134 -section_alignment: 4096 -file_alignment: 512 -loader_flags: 0 -size_of_optional_header: 224 -size_of_code: 34816 -size_of_initialized_data: 246272 -size_of_uninitialized_data: 0 -size_of_image: 294912 -size_of_headers: 1024 -size_of_stack_reserve: 262144 -size_of_stack_commit: 4096 -size_of_heap_reserve: 1048576 -size_of_heap_commit: 4096 -pointer_to_symbol_table: 0 +base_of_code: 0x1000 +base_of_data: 0xa000 +entry_point: 0x4e5e +entry_point_raw: 0x5a5e +section_alignment: 0x1000 +file_alignment: 0x200 +loader_flags: 0x0 +size_of_optional_header: 0xe0 +size_of_code: 0x8800 +size_of_initialized_data: 0x3c200 +size_of_uninitialized_data: 0x0 +size_of_image: 0x48000 +size_of_headers: 0x400 +size_of_stack_reserve: 0x40000 +size_of_stack_commit: 0x1000 +size_of_heap_reserve: 0x100000 +size_of_heap_commit: 0x1000 +pointer_to_symbol_table: 0x0 win32_version_value: 0 number_of_symbols: 0 number_of_rva_and_sizes: 16 @@ -76,8 +76,8 @@ version_info_list: - key: "ProductVersion" value: "9.29.1962.0" rich_signature: - offset: 128 - length: 56 + offset: 0x80 + length: 0x38 key: 2278776681 raw_data: "->\xbd\xd4i_\xd3\x87i_\xd3\x87i_\xd3\x87\x93|\xca\x87d_\xd3\x87i_\xd2\x87\x17_\xd3\x87\xfe|\x96\x87h_\xd3\x87\xb3|\xcf\x87q_\xd3\x87\x93|\xee\x87h_\xd3\x87" clear_data: "DanS\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xfa#\x19\x00\r\x00\x00\x00\x00\x00\x01\x00~\x00\x00\x00\x97#E\x00\x01\x00\x00\x00\xda#\x1c\x00\x18\x00\x00\x00\xfa#=\x00\x01\x00\x00\x00" @@ -101,258 +101,258 @@ pdb_path: "wextract.pdb" sections: - name: ".text" full_name: ".text" - characteristics: 1610612768 - raw_data_size: 34816 - raw_data_offset: 1024 - virtual_address: 4096 - virtual_size: 34330 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0x60000020 # SECTION_MEM_READ | SECTION_MEM_WRITE | SECTION_SCALE_INDEX + raw_data_size: 0x8800 + raw_data_offset: 0x400 + virtual_address: 0x1000 + virtual_size: 0x861a + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".data" full_name: ".data" - characteristics: 3221225536 - raw_data_size: 1024 - raw_data_offset: 35840 - virtual_address: 40960 - virtual_size: 7140 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0xc0000040 + raw_data_size: 0x400 + raw_data_offset: 0x8c00 + virtual_address: 0xa000 + virtual_size: 0x1be4 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".rsrc" full_name: ".rsrc" - characteristics: 1073741888 - raw_data_size: 245248 - raw_data_offset: 36864 - virtual_address: 49152 - virtual_size: 245760 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0x40000040 + raw_data_size: 0x3be00 + raw_data_offset: 0x9000 + virtual_address: 0xc000 + virtual_size: 0x3c000 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 data_directories: - - virtual_address: 0 - size: 0 - - virtual_address: 35504 - size: 140 - - virtual_address: 49152 - size: 245128 - - virtual_address: 0 - size: 0 - - virtual_address: 282112 - size: 5976 - - virtual_address: 0 - size: 0 - - virtual_address: 4624 - size: 28 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 4096 - size: 528 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x8ab0 + size: 0x8c + - virtual_address: 0xc000 + size: 0x3bd88 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x44e00 + size: 0x1758 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x1210 + size: 0x1c + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x1000 + size: 0x210 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 resource_timestamp: 1773781709 # 2026-03-17 21:08:29 UTC resource_version: major: 4 minor: 0 resources: - - length: 11802 - rva: 51104 - offset: 38816 + - length: 0x2e1a + rva: 0xc7a0 + offset: 0x97a0 id: 3001 language: 1033 type_string: "A\x00V\x00I\x00" - - length: 744 - rva: 62908 - offset: 50620 + - length: 0x2e8 + rva: 0xf5bc + offset: 0xc5bc type: RESOURCE_TYPE_ICON id: 1 language: 1033 - - length: 296 - rva: 63652 - offset: 51364 + - length: 0x128 + rva: 0xf8a4 + offset: 0xc8a4 type: RESOURCE_TYPE_ICON id: 2 language: 1033 - - length: 716 - rva: 63948 - offset: 51660 + - length: 0x2cc + rva: 0xf9cc + offset: 0xc9cc type: RESOURCE_TYPE_DIALOG id: 2001 language: 1033 - - length: 394 - rva: 64664 - offset: 52376 + - length: 0x18a + rva: 0xfc98 + offset: 0xcc98 type: RESOURCE_TYPE_DIALOG id: 2002 language: 1033 - - length: 320 - rva: 65060 - offset: 52772 + - length: 0x140 + rva: 0xfe24 + offset: 0xce24 type: RESOURCE_TYPE_DIALOG id: 2003 language: 1033 - - length: 406 - rva: 65380 - offset: 53092 + - length: 0x196 + rva: 0xff64 + offset: 0xcf64 type: RESOURCE_TYPE_DIALOG id: 2004 language: 1033 - - length: 270 - rva: 65788 - offset: 53500 + - length: 0x10e + rva: 0x100fc + offset: 0xd0fc type: RESOURCE_TYPE_DIALOG id: 2005 language: 1033 - - length: 250 - rva: 66060 - offset: 53772 + - length: 0xfa + rva: 0x1020c + offset: 0xd20c type: RESOURCE_TYPE_DIALOG id: 2006 language: 1033 - - length: 140 - rva: 66312 - offset: 54024 + - length: 0x8c + rva: 0x10308 + offset: 0xd308 type: RESOURCE_TYPE_STRING id: 63 language: 1033 - - length: 1312 - rva: 66452 - offset: 54164 + - length: 0x520 + rva: 0x10394 + offset: 0xd394 type: RESOURCE_TYPE_STRING id: 76 language: 1033 - - length: 1484 - rva: 67764 - offset: 55476 + - length: 0x5cc + rva: 0x108b4 + offset: 0xd8b4 type: RESOURCE_TYPE_STRING id: 77 language: 1033 - - length: 1200 - rva: 69248 - offset: 56960 + - length: 0x4b0 + rva: 0x10e80 + offset: 0xde80 type: RESOURCE_TYPE_STRING id: 80 language: 1033 - - length: 1098 - rva: 70448 - offset: 58160 + - length: 0x44a + rva: 0x11330 + offset: 0xe330 type: RESOURCE_TYPE_STRING id: 83 language: 1033 - - length: 974 - rva: 71548 - offset: 59260 + - length: 0x3ce + rva: 0x1177c + offset: 0xe77c type: RESOURCE_TYPE_STRING id: 85 language: 1033 - - length: 30 - rva: 72524 - offset: 60236 + - length: 0x1e + rva: 0x11b4c + offset: 0xeb4c type: RESOURCE_TYPE_RCDATA language: 1033 name_string: "A\x00D\x00M\x00Q\x00C\x00M\x00D\x00" - - length: 220645 - rva: 72556 - offset: 60268 + - length: 0x35de5 + rva: 0x11b6c + offset: 0xeb6c type: RESOURCE_TYPE_RCDATA language: 1033 name_string: "C\x00A\x00B\x00I\x00N\x00E\x00T\x00" - - length: 4 - rva: 293204 - offset: 280916 + - length: 0x4 + rva: 0x47954 + offset: 0x44954 type: RESOURCE_TYPE_RCDATA language: 1033 name_string: "E\x00X\x00T\x00R\x00A\x00C\x00T\x00O\x00P\x00T\x00" - - length: 36 - rva: 293208 - offset: 280920 + - length: 0x24 + rva: 0x47958 + offset: 0x44958 type: RESOURCE_TYPE_RCDATA language: 1033 name_string: "F\x00I\x00L\x00E\x00S\x00I\x00Z\x00E\x00S\x00" - - length: 7 - rva: 293244 - offset: 280956 + - length: 0x7 + rva: 0x4797c + offset: 0x4497c type: RESOURCE_TYPE_RCDATA language: 1033 name_string: "F\x00I\x00N\x00I\x00S\x00H\x00M\x00S\x00G\x00" - - length: 7 - rva: 293252 - offset: 280964 + - length: 0x7 + rva: 0x47984 + offset: 0x44984 type: RESOURCE_TYPE_RCDATA language: 1033 name_string: "L\x00I\x00C\x00E\x00N\x00S\x00E\x00" - - length: 4 - rva: 293260 - offset: 280972 + - length: 0x4 + rva: 0x4798c + offset: 0x4498c type: RESOURCE_TYPE_RCDATA language: 1033 name_string: "P\x00A\x00C\x00K\x00I\x00N\x00S\x00T\x00S\x00P\x00A\x00C\x00E\x00" - - length: 7 - rva: 293264 - offset: 280976 + - length: 0x7 + rva: 0x47990 + offset: 0x44990 type: RESOURCE_TYPE_RCDATA language: 1033 name_string: "P\x00O\x00S\x00T\x00R\x00U\x00N\x00P\x00R\x00O\x00G\x00R\x00A\x00M\x00" - - length: 4 - rva: 293272 - offset: 280984 + - length: 0x4 + rva: 0x47998 + offset: 0x44998 type: RESOURCE_TYPE_RCDATA language: 1033 name_string: "R\x00E\x00B\x00O\x00O\x00T\x00" - - length: 15 - rva: 293276 - offset: 280988 + - length: 0xf + rva: 0x4799c + offset: 0x4499c type: RESOURCE_TYPE_RCDATA language: 1033 name_string: "R\x00U\x00N\x00P\x00R\x00O\x00G\x00R\x00A\x00M\x00" - - length: 4 - rva: 293292 - offset: 281004 + - length: 0x4 + rva: 0x479ac + offset: 0x449ac type: RESOURCE_TYPE_RCDATA language: 1033 name_string: "S\x00H\x00O\x00W\x00W\x00I\x00N\x00D\x00O\x00W\x00" - - length: 22 - rva: 293296 - offset: 281008 + - length: 0x16 + rva: 0x479b0 + offset: 0x449b0 type: RESOURCE_TYPE_RCDATA language: 1033 name_string: "T\x00I\x00T\x00L\x00E\x00" - - length: 7 - rva: 293320 - offset: 281032 + - length: 0x7 + rva: 0x479c8 + offset: 0x449c8 type: RESOURCE_TYPE_RCDATA language: 1033 name_string: "U\x00P\x00R\x00O\x00M\x00P\x00T\x00" - - length: 30 - rva: 293328 - offset: 281040 + - length: 0x1e + rva: 0x479d0 + offset: 0x449d0 type: RESOURCE_TYPE_RCDATA language: 1033 name_string: "U\x00S\x00R\x00Q\x00C\x00M\x00D\x00" - - length: 34 - rva: 293360 - offset: 281072 + - length: 0x22 + rva: 0x479f0 + offset: 0x449f0 type: RESOURCE_TYPE_GROUP_ICON id: 3000 language: 1033 - - length: 884 - rva: 293396 - offset: 281108 + - length: 0x374 + rva: 0x47a14 + offset: 0x44a14 type: RESOURCE_TYPE_VERSION id: 1 language: 1033 @@ -361,273 +361,273 @@ import_details: number_of_functions: 14 functions: - name: "FreeSid" - rva: 4096 + rva: 0x1000 - name: "AllocateAndInitializeSid" - rva: 4100 + rva: 0x1004 - name: "EqualSid" - rva: 4104 + rva: 0x1008 - name: "GetTokenInformation" - rva: 4108 + rva: 0x100c - name: "OpenProcessToken" - rva: 4112 + rva: 0x1010 - name: "AdjustTokenPrivileges" - rva: 4116 + rva: 0x1014 - name: "LookupPrivilegeValueA" - rva: 4120 + rva: 0x1018 - name: "RegCloseKey" - rva: 4124 + rva: 0x101c - name: "RegDeleteValueA" - rva: 4128 + rva: 0x1020 - name: "RegOpenKeyExA" - rva: 4132 + rva: 0x1024 - name: "RegSetValueExA" - rva: 4136 + rva: 0x1028 - name: "RegQueryValueExA" - rva: 4140 + rva: 0x102c - name: "RegCreateKeyExA" - rva: 4144 + rva: 0x1030 - name: "RegQueryInfoKeyA" - rva: 4148 + rva: 0x1034 - library_name: "KERNEL32.dll" number_of_functions: 76 functions: - name: "LocalFree" - rva: 4172 + rva: 0x104c - name: "LocalAlloc" - rva: 4176 + rva: 0x1050 - name: "GetLastError" - rva: 4180 + rva: 0x1054 - name: "GetCurrentProcess" - rva: 4184 + rva: 0x1058 - name: "GetModuleFileNameA" - rva: 4188 + rva: 0x105c - name: "lstrlenA" - rva: 4192 + rva: 0x1060 - name: "GetSystemDirectoryA" - rva: 4196 + rva: 0x1064 - name: "RemoveDirectoryA" - rva: 4200 + rva: 0x1068 - name: "FindClose" - rva: 4204 + rva: 0x106c - name: "FindNextFileA" - rva: 4208 + rva: 0x1070 - name: "DeleteFileA" - rva: 4212 + rva: 0x1074 - name: "SetFileAttributesA" - rva: 4216 + rva: 0x1078 - name: "lstrcmpA" - rva: 4220 + rva: 0x107c - name: "FindFirstFileA" - rva: 4224 + rva: 0x1080 - name: "lstrcatA" - rva: 4228 + rva: 0x1084 - name: "lstrcpyA" - rva: 4232 + rva: 0x1088 - name: "_lclose" - rva: 4236 + rva: 0x108c - name: "_llseek" - rva: 4240 + rva: 0x1090 - name: "_lopen" - rva: 4244 + rva: 0x1094 - name: "WritePrivateProfileStringA" - rva: 4248 + rva: 0x1098 - name: "GetWindowsDirectoryA" - rva: 4252 + rva: 0x109c - name: "CreateDirectoryA" - rva: 4256 + rva: 0x10a0 - name: "GetFileAttributesA" - rva: 4260 + rva: 0x10a4 - name: "ExpandEnvironmentStringsA" - rva: 4264 + rva: 0x10a8 - name: "IsDBCSLeadByte" - rva: 4268 + rva: 0x10ac - name: "GetShortPathNameA" - rva: 4272 + rva: 0x10b0 - name: "GetPrivateProfileStringA" - rva: 4276 + rva: 0x10b4 - name: "GetPrivateProfileIntA" - rva: 4280 + rva: 0x10b8 - name: "lstrcmpiA" - rva: 4284 + rva: 0x10bc - name: "GetProcAddress" - rva: 4288 + rva: 0x10c0 - name: "GlobalUnlock" - rva: 4292 + rva: 0x10c4 - name: "GlobalLock" - rva: 4296 + rva: 0x10c8 - name: "GlobalAlloc" - rva: 4300 + rva: 0x10cc - name: "FreeResource" - rva: 4304 + rva: 0x10d0 - name: "CloseHandle" - rva: 4308 + rva: 0x10d4 - name: "LoadResource" - rva: 4312 + rva: 0x10d8 - name: "SizeofResource" - rva: 4316 + rva: 0x10dc - name: "FindResourceA" - rva: 4320 + rva: 0x10e0 - name: "ReadFile" - rva: 4324 + rva: 0x10e4 - name: "WriteFile" - rva: 4328 + rva: 0x10e8 - name: "SetFilePointer" - rva: 4332 + rva: 0x10ec - name: "SetFileTime" - rva: 4336 + rva: 0x10f0 - name: "LocalFileTimeToFileTime" - rva: 4340 + rva: 0x10f4 - name: "DosDateTimeToFileTime" - rva: 4344 + rva: 0x10f8 - name: "SetCurrentDirectoryA" - rva: 4348 + rva: 0x10fc - name: "GetTempFileNameA" - rva: 4352 + rva: 0x1100 - name: "ExitProcess" - rva: 4356 + rva: 0x1104 - name: "CreateFileA" - rva: 4360 + rva: 0x1108 - name: "LoadLibraryExA" - rva: 4364 + rva: 0x110c - name: "lstrcpynA" - rva: 4368 + rva: 0x1110 - name: "GetVolumeInformationA" - rva: 4372 + rva: 0x1114 - name: "FormatMessageA" - rva: 4376 + rva: 0x1118 - name: "GetCurrentDirectoryA" - rva: 4380 + rva: 0x111c - name: "GetVersionExA" - rva: 4384 + rva: 0x1120 - name: "GetExitCodeProcess" - rva: 4388 + rva: 0x1124 - name: "WaitForSingleObject" - rva: 4392 + rva: 0x1128 - name: "CreateProcessA" - rva: 4396 + rva: 0x112c - name: "GetTempPathA" - rva: 4400 + rva: 0x1130 - name: "GetSystemInfo" - rva: 4404 + rva: 0x1134 - name: "CreateMutexA" - rva: 4408 + rva: 0x1138 - name: "SetEvent" - rva: 4412 + rva: 0x113c - name: "CreateEventA" - rva: 4416 + rva: 0x1140 - name: "CreateThread" - rva: 4420 + rva: 0x1144 - name: "ResetEvent" - rva: 4424 + rva: 0x1148 - name: "TerminateThread" - rva: 4428 + rva: 0x114c - name: "GetDriveTypeA" - rva: 4432 + rva: 0x1150 - name: "GetModuleHandleA" - rva: 4436 + rva: 0x1154 - name: "GetStartupInfoA" - rva: 4440 + rva: 0x1158 - name: "GetCommandLineA" - rva: 4444 + rva: 0x115c - name: "LockResource" - rva: 4448 + rva: 0x1160 - name: "LoadLibraryA" - rva: 4452 + rva: 0x1164 - name: "GetDiskFreeSpaceA" - rva: 4456 + rva: 0x1168 - name: "MulDiv" - rva: 4460 + rva: 0x116c - name: "EnumResourceLanguagesA" - rva: 4464 + rva: 0x1170 - name: "FreeLibrary" - rva: 4468 + rva: 0x1174 - name: "GlobalFree" - rva: 4472 + rva: 0x1178 - library_name: "GDI32.dll" number_of_functions: 1 functions: - name: "GetDeviceCaps" - rva: 4164 + rva: 0x1044 - library_name: "USER32.dll" number_of_functions: 31 functions: - name: "ExitWindowsEx" - rva: 4480 + rva: 0x1180 - name: "wsprintfA" - rva: 4484 + rva: 0x1184 - name: "CharNextA" - rva: 4488 + rva: 0x1188 - name: "CharUpperA" - rva: 4492 + rva: 0x118c - name: "CharPrevA" - rva: 4496 + rva: 0x1190 - name: "SetWindowLongA" - rva: 4500 + rva: 0x1194 - name: "GetWindowLongA" - rva: 4504 + rva: 0x1198 - name: "CallWindowProcA" - rva: 4508 + rva: 0x119c - name: "DispatchMessageA" - rva: 4512 + rva: 0x11a0 - name: "MsgWaitForMultipleObjects" - rva: 4516 + rva: 0x11a4 - name: "PeekMessageA" - rva: 4520 + rva: 0x11a8 - name: "SendMessageA" - rva: 4524 + rva: 0x11ac - name: "SetWindowPos" - rva: 4528 + rva: 0x11b0 - name: "ReleaseDC" - rva: 4532 + rva: 0x11b4 - name: "GetDC" - rva: 4536 + rva: 0x11b8 - name: "GetWindowRect" - rva: 4540 + rva: 0x11bc - name: "SendDlgItemMessageA" - rva: 4544 + rva: 0x11c0 - name: "GetDlgItem" - rva: 4548 + rva: 0x11c4 - name: "SetForegroundWindow" - rva: 4552 + rva: 0x11c8 - name: "SetWindowTextA" - rva: 4556 + rva: 0x11cc - name: "MessageBoxA" - rva: 4560 + rva: 0x11d0 - name: "DialogBoxIndirectParamA" - rva: 4564 + rva: 0x11d4 - name: "ShowWindow" - rva: 4568 + rva: 0x11d8 - name: "EnableWindow" - rva: 4572 + rva: 0x11dc - name: "GetDlgItemTextA" - rva: 4576 + rva: 0x11e0 - name: "EndDialog" - rva: 4580 + rva: 0x11e4 - name: "GetDesktopWindow" - rva: 4584 + rva: 0x11e8 - name: "MessageBeep" - rva: 4588 + rva: 0x11ec - name: "SetDlgItemTextA" - rva: 4592 + rva: 0x11f0 - name: "LoadStringA" - rva: 4596 + rva: 0x11f4 - name: "GetSystemMetrics" - rva: 4600 + rva: 0x11f8 - library_name: "COMCTL32.dll" number_of_functions: 1 functions: - name: "ord17" ordinal: 17 - rva: 4156 + rva: 0x103c - library_name: "VERSION.dll" number_of_functions: 3 functions: - name: "GetFileVersionInfoA" - rva: 4608 + rva: 0x1200 - name: "VerQueryValueA" - rva: 4612 + rva: 0x1204 - name: "GetFileVersionInfoSizeA" - rva: 4616 + rva: 0x1208 is_signed: true signatures: - subject: "/C=US/ST=Washington/L=Redmond/O=Microsoft Corporation/OU=MOPR/CN=Microsoft Corporation" @@ -730,5 +730,5 @@ signatures: not_before: 1158368687 # 2006-09-16 01:04:47 UTC not_after: 1568530800 # 2019-09-15 07:00:00 UTC overlay: - offset: 282112 - size: 5976 \ No newline at end of file + offset: 0x44e00 + size: 0x1758 \ No newline at end of file diff --git a/lib/src/modules/pe/tests/testdata/130f9b2e65bfceae8d9e7cbe205471fc8ee34c3d9996f77baa3c3ab47a3b3068.out b/lib/src/modules/pe/tests/testdata/130f9b2e65bfceae8d9e7cbe205471fc8ee34c3d9996f77baa3c3ab47a3b3068.out index d3ca25930..0514f1bef 100644 --- a/lib/src/modules/pe/tests/testdata/130f9b2e65bfceae8d9e7cbe205471fc8ee34c3d9996f77baa3c3ab47a3b3068.out +++ b/lib/src/modules/pe/tests/testdata/130f9b2e65bfceae8d9e7cbe205471fc8ee34c3d9996f77baa3c3ab47a3b3068.out @@ -17,25 +17,25 @@ opthdr_magic: IMAGE_NT_OPTIONAL_HDR64_MAGIC characteristics: 0x22 # EXECUTABLE_IMAGE | LARGE_ADDRESS_AWARE dll_characteristics: 0x1e0 # HIGH_ENTROPY_VA | DYNAMIC_BASE | FORCE_INTEGRITY | NX_COMPAT timestamp: 1556010297 # 2019-04-23 09:04:57 UTC -image_base: 5368709120 +image_base: 0x140000000 checksum: 250178 -base_of_code: 4096 -entry_point: 199792 -entry_point_raw: 524400 -section_alignment: 4096 -file_alignment: 512 -loader_flags: 0 -size_of_optional_header: 240 -size_of_code: 154112 -size_of_initialized_data: 368640 -size_of_uninitialized_data: 0 -size_of_image: 540672 -size_of_headers: 1024 -size_of_stack_reserve: 1048576 -size_of_stack_commit: 4096 -size_of_heap_reserve: 1048576 -size_of_heap_commit: 4096 -pointer_to_symbol_table: 0 +base_of_code: 0x1000 +entry_point: 0x30c70 +entry_point_raw: 0x80070 +section_alignment: 0x1000 +file_alignment: 0x200 +loader_flags: 0x0 +size_of_optional_header: 0xf0 +size_of_code: 0x25a00 +size_of_initialized_data: 0x5a000 +size_of_uninitialized_data: 0x0 +size_of_image: 0x84000 +size_of_headers: 0x400 +size_of_stack_reserve: 0x100000 +size_of_stack_commit: 0x1000 +size_of_heap_reserve: 0x100000 +size_of_heap_commit: 0x1000 +pointer_to_symbol_table: 0x0 win32_version_value: 0 number_of_symbols: 0 number_of_rva_and_sizes: 16 @@ -72,8 +72,8 @@ version_info_list: - key: "OriginalFilename" value: "ZAM.exe" rich_signature: - offset: 128 - length: 112 + offset: 0x80 + length: 0x70 key: 3033202844 raw_data: "\xd8a\xa5\xe7\x9c\x00\xcb\xb4\x9c\x00\xcb\xb4\x9c\x00\xcb\xb4\x95xL\xb4\x9b\x00\xcb\xb4\x95x^\xb4\x9f\x00\xcb\xb4`wp\xb4\x9d\x00\xcb\xb4`ww\xb4\x9f\x00\xcb\xb4\x9c\x00\xca\xb4\x02\x00\xcb\xb4\x95xX\xb4\x99\x00\xcb\xb4\x95xH\xb4\x9f\x00\xcb\xb4\xbb\xc6\x04\xb4\x9d\x00\xcb\xb4\xbb\xc6\x05\xb4\x82\x00\xcb\xb4\xbb\xc6\x02\xb4\x9d\x00\xcb\xb4\x9c\x00\\\xb4\x9d\x00\xcb\xb4\xbb\xc6\x07\xb4\x9d\x00\xcb\xb4" clear_data: "DanS\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\tx\x87\x00\x07\x00\x00\x00\tx\x95\x00\x03\x00\x00\x00\xfcw\xbb\x00\x01\x00\x00\x00\xfcw\xbc\x00\x03\x00\x00\x00\x00\x00\x01\x00\x9e\x00\x00\x00\tx\x93\x00\x05\x00\x00\x00\tx\x83\x00\x03\x00\x00\x00\'\xc6\xcf\x00\x01\x00\x00\x00\'\xc6\xce\x00\x1e\x00\x00\x00\'\xc6\xc9\x00\x01\x00\x00\x00\x00\x00\x97\x00\x01\x00\x00\x00\'\xc6\xcc\x00\x01\x00\x00\x00" @@ -118,144 +118,144 @@ pdb_path: "Z:\\Zemana\\Projects\\AMSDKCore\\Driver\\zam64.pdb" sections: - name: ".text" full_name: ".text" - characteristics: 1744830496 - raw_data_size: 139264 - raw_data_offset: 1024 - virtual_address: 4096 - virtual_size: 138837 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0x68000020 # SECTION_MEM_READ | SECTION_MEM_WRITE | SECTION_SCALE_INDEX + raw_data_size: 0x22000 + raw_data_offset: 0x400 + virtual_address: 0x1000 + virtual_size: 0x21e55 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".hook" full_name: ".hook" - characteristics: 3892314144 - raw_data_size: 2560 - raw_data_offset: 140288 - virtual_address: 143360 - virtual_size: 2495 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0xe8000020 # SECTION_MEM_READ | SECTION_MEM_WRITE | SECTION_SCALE_INDEX + raw_data_size: 0xa00 + raw_data_offset: 0x22400 + virtual_address: 0x23000 + virtual_size: 0x9bf + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".rdata" full_name: ".rdata" - characteristics: 1207959616 - raw_data_size: 19456 - raw_data_offset: 142848 - virtual_address: 147456 - virtual_size: 19272 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0x48000040 + raw_data_size: 0x4c00 + raw_data_offset: 0x22e00 + virtual_address: 0x24000 + virtual_size: 0x4b48 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".data" full_name: ".data" - characteristics: 3355443264 - raw_data_size: 27136 - raw_data_offset: 162304 - virtual_address: 167936 - virtual_size: 343944 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0xc8000040 + raw_data_size: 0x6a00 + raw_data_offset: 0x27a00 + virtual_address: 0x29000 + virtual_size: 0x53f88 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".pdata" full_name: ".pdata" - characteristics: 1207959616 - raw_data_size: 3072 - raw_data_offset: 189440 - virtual_address: 512000 - virtual_size: 2640 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0x48000040 + raw_data_size: 0xc00 + raw_data_offset: 0x2e400 + virtual_address: 0x7d000 + virtual_size: 0xa50 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: "PAGE" full_name: "PAGE" - characteristics: 1610612768 - raw_data_size: 7168 - raw_data_offset: 192512 - virtual_address: 516096 - virtual_size: 6727 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0x60000020 # SECTION_MEM_READ | SECTION_MEM_WRITE | SECTION_SCALE_INDEX + raw_data_size: 0x1c00 + raw_data_offset: 0x2f000 + virtual_address: 0x7e000 + virtual_size: 0x1a47 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: "INIT" full_name: "INIT" - characteristics: 3791650848 - raw_data_size: 5120 - raw_data_offset: 199680 - virtual_address: 524288 - virtual_size: 4996 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0xe2000020 # SECTION_MEM_READ | SECTION_MEM_WRITE | SECTION_SCALE_INDEX + raw_data_size: 0x1400 + raw_data_offset: 0x30c00 + virtual_address: 0x80000 + virtual_size: 0x1384 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".rsrc" full_name: ".rsrc" - characteristics: 1107296320 - raw_data_size: 1024 - raw_data_offset: 204800 - virtual_address: 532480 - virtual_size: 840 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0x42000040 + raw_data_size: 0x400 + raw_data_offset: 0x32000 + virtual_address: 0x82000 + virtual_size: 0x348 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".reloc" full_name: ".reloc" - characteristics: 1107296320 - raw_data_size: 1024 - raw_data_offset: 205824 - virtual_address: 536576 - virtual_size: 564 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0x42000040 + raw_data_size: 0x400 + raw_data_offset: 0x32400 + virtual_address: 0x83000 + virtual_size: 0x234 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 data_directories: - - virtual_address: 0 - size: 0 - - virtual_address: 524444 - size: 60 - - virtual_address: 532480 - size: 840 - - virtual_address: 512000 - size: 2640 - - virtual_address: 206848 - size: 19616 - - virtual_address: 536576 - size: 112 - - virtual_address: 148720 - size: 56 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 162976 - size: 112 - - virtual_address: 0 - size: 0 - - virtual_address: 147456 - size: 1256 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x8009c + size: 0x3c + - virtual_address: 0x82000 + size: 0x348 + - virtual_address: 0x7d000 + size: 0xa50 + - virtual_address: 0x32800 + size: 0x4ca0 + - virtual_address: 0x83000 + size: 0x70 + - virtual_address: 0x244f0 + size: 0x38 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x27ca0 + size: 0x70 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x24000 + size: 0x4e8 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 resource_timestamp: 0 # 1970-01-01 00:00:00 UTC resource_version: major: 0 minor: 0 resources: - - length: 744 - rva: 532576 - offset: 204896 + - length: 0x2e8 + rva: 0x82060 + offset: 0x32060 type: RESOURCE_TYPE_VERSION id: 1 language: 1033 @@ -264,318 +264,318 @@ import_details: number_of_functions: 19 functions: - name: "FltRegisterFilter" - rva: 147456 + rva: 0x24000 - name: "FltUnregisterFilter" - rva: 147464 + rva: 0x24008 - name: "FltStartFiltering" - rva: 147472 + rva: 0x24010 - name: "FltAllocatePoolAlignedWithTag" - rva: 147480 + rva: 0x24018 - name: "FltFreePoolAlignedWithTag" - rva: 147488 + rva: 0x24020 - name: "FltGetFileNameInformation" - rva: 147496 + rva: 0x24028 - name: "FltReleaseFileNameInformation" - rva: 147504 + rva: 0x24030 - name: "FltParseFileNameInformation" - rva: 147512 + rva: 0x24038 - name: "FltReadFile" - rva: 147520 + rva: 0x24040 - name: "FltQueryInformationFile" - rva: 147528 + rva: 0x24048 - name: "FltCancelFileOpen" - rva: 147536 + rva: 0x24050 - name: "FltAllocateContext" - rva: 147544 + rva: 0x24058 - name: "FltSetStreamHandleContext" - rva: 147552 + rva: 0x24060 - name: "FltGetStreamHandleContext" - rva: 147560 + rva: 0x24068 - name: "FltReleaseContext" - rva: 147568 + rva: 0x24070 - name: "FltCreateCommunicationPort" - rva: 147576 + rva: 0x24078 - name: "FltCloseCommunicationPort" - rva: 147584 + rva: 0x24080 - name: "FltSendMessage" - rva: 147592 + rva: 0x24088 - name: "FltBuildDefaultSecurityDescriptor" - rva: 147600 + rva: 0x24090 - library_name: "ntoskrnl.exe" number_of_functions: 136 functions: - name: "strstr" - rva: 147616 + rva: 0x240a0 - name: "wcsstr" - rva: 147624 + rva: 0x240a8 - name: "RtlInitUnicodeString" - rva: 147632 + rva: 0x240b0 - name: "RtlCopyUnicodeString" - rva: 147640 + rva: 0x240b8 - name: "DbgPrint" - rva: 147648 + rva: 0x240c0 - name: "RtlGetVersion" - rva: 147656 + rva: 0x240c8 - name: "KeDelayExecutionThread" - rva: 147664 + rva: 0x240d0 - name: "ExAllocatePoolWithTag" - rva: 147672 + rva: 0x240d8 - name: "ExFreePoolWithTag" - rva: 147680 + rva: 0x240e0 - name: "ProbeForRead" - rva: 147688 + rva: 0x240e8 - name: "ObReferenceObjectByHandle" - rva: 147696 + rva: 0x240f0 - name: "ObfDereferenceObject" - rva: 147704 + rva: 0x240f8 - name: "ZwCreateFile" - rva: 147712 + rva: 0x24100 - name: "ZwClose" - rva: 147720 + rva: 0x24108 - name: "RtlUpperString" - rva: 147728 + rva: 0x24110 - name: "RtlUpcaseUnicodeString" - rva: 147736 + rva: 0x24118 - name: "PsGetCurrentProcessId" - rva: 147744 + rva: 0x24120 - name: "ZwOpenProcess" - rva: 147752 + rva: 0x24128 - name: "PsLookupProcessByProcessId" - rva: 147760 + rva: 0x24130 - name: "ObQueryNameString" - rva: 147768 + rva: 0x24138 - name: "FsRtlIsNameInExpression" - rva: 147776 + rva: 0x24140 - name: "PsGetProcessImageFileName" - rva: 147784 + rva: 0x24148 - name: "ZwQueryInformationProcess" - rva: 147792 + rva: 0x24150 - name: "__C_specific_handler" - rva: 147800 + rva: 0x24158 - name: "strchr" - rva: 147808 + rva: 0x24160 - name: "RtlAppendUnicodeToString" - rva: 147816 + rva: 0x24168 - name: "KeInitializeSemaphore" - rva: 147824 + rva: 0x24170 - name: "KeReleaseSemaphore" - rva: 147832 + rva: 0x24178 - name: "KeWaitForSingleObject" - rva: 147840 + rva: 0x24180 - name: "KeAcquireSpinLockRaiseToDpc" - rva: 147848 + rva: 0x24188 - name: "KeReleaseSpinLock" - rva: 147856 + rva: 0x24190 - name: "PsCreateSystemThread" - rva: 147864 + rva: 0x24198 - name: "PsTerminateSystemThread" - rva: 147872 + rva: 0x241a0 - name: "ZwQueryInformationFile" - rva: 147880 + rva: 0x241a8 - name: "ZwWriteFile" - rva: 147888 + rva: 0x241b0 - name: "PsGetCurrentThreadId" - rva: 147896 + rva: 0x241b8 - name: "ZwDeleteFile" - rva: 147904 + rva: 0x241c0 - name: "_vsnprintf" - rva: 147912 + rva: 0x241c8 - name: "PsThreadType" - rva: 147920 + rva: 0x241d0 - name: "PsSetCreateProcessNotifyRoutine" - rva: 147928 + rva: 0x241d8 - name: "PsGetProcessSessionId" - rva: 147936 + rva: 0x241e0 - name: "RtlAppendUnicodeStringToString" - rva: 147944 + rva: 0x241e8 - name: "ZwDeleteValueKey" - rva: 147952 + rva: 0x241f0 - name: "ZwSetValueKey" - rva: 147960 + rva: 0x241f8 - name: "towupper" - rva: 147968 + rva: 0x24200 - name: "RtlIntegerToUnicodeString" - rva: 147976 + rva: 0x24208 - name: "KeInitializeEvent" - rva: 147984 + rva: 0x24210 - name: "KeSetEvent" - rva: 147992 + rva: 0x24218 - name: "KeAcquireSpinLockAtDpcLevel" - rva: 148000 + rva: 0x24220 - name: "KeReleaseSpinLockFromDpcLevel" - rva: 148008 + rva: 0x24228 - name: "MmProbeAndLockPages" - rva: 148016 + rva: 0x24230 - name: "IoAllocateIrp" - rva: 148024 + rva: 0x24238 - name: "IoAllocateMdl" - rva: 148032 + rva: 0x24240 - name: "IofCallDriver" - rva: 148040 + rva: 0x24248 - name: "IoFreeIrp" - rva: 148048 + rva: 0x24250 - name: "IoFreeMdl" - rva: 148056 + rva: 0x24258 - name: "IoGetDeviceObjectPointer" - rva: 148064 + rva: 0x24260 - name: "IoGetRelatedDeviceObject" - rva: 148072 + rva: 0x24268 - name: "ObCloseHandle" - rva: 148080 + rva: 0x24270 - name: "ObfReferenceObject" - rva: 148088 + rva: 0x24278 - name: "ZwSetInformationFile" - rva: 148096 + rva: 0x24280 - name: "ZwReadFile" - rva: 148104 + rva: 0x24288 - name: "ZwOpenSymbolicLinkObject" - rva: 148112 + rva: 0x24290 - name: "ZwQuerySymbolicLinkObject" - rva: 148120 + rva: 0x24298 - name: "IoCreateFileSpecifyDeviceObjectHint" - rva: 148128 + rva: 0x242a0 - name: "IoGetDeviceAttachmentBaseRef" - rva: 148136 + rva: 0x242a8 - name: "FsRtlGetFileSize" - rva: 148144 + rva: 0x242b0 - name: "ZwQuerySystemInformation" - rva: 148152 + rva: 0x242b8 - name: "IoFileObjectType" - rva: 148160 + rva: 0x242c0 - name: "KeReadStateEvent" - rva: 148168 + rva: 0x242c8 - name: "ExQueueWorkItem" - rva: 148176 + rva: 0x242d0 - name: "ExGetPreviousMode" - rva: 148184 + rva: 0x242d8 - name: "MmGetSystemRoutineAddress" - rva: 148192 + rva: 0x242e0 - name: "NtOpenProcess" - rva: 148200 + rva: 0x242e8 - name: "ZwCreateEvent" - rva: 148208 + rva: 0x242f0 - name: "ZwWaitForSingleObject" - rva: 148216 + rva: 0x242f8 - name: "ZwSetEvent" - rva: 148224 + rva: 0x24300 - name: "NtQuerySystemInformation" - rva: 148232 + rva: 0x24308 - name: "ExEventObjectType" - rva: 148240 + rva: 0x24310 - name: "NtBuildNumber" - rva: 148248 + rva: 0x24318 - name: "ZwDeleteKey" - rva: 148256 + rva: 0x24320 - name: "ObReferenceObjectByName" - rva: 148264 + rva: 0x24328 - name: "IoDriverObjectType" - rva: 148272 + rva: 0x24330 - name: "MmIsDriverVerifying" - rva: 148280 + rva: 0x24338 - name: "IofCompleteRequest" - rva: 148288 + rva: 0x24340 - name: "IoCreateSymbolicLink" - rva: 148296 + rva: 0x24348 - name: "IoDeleteDevice" - rva: 148304 + rva: 0x24350 - name: "IoDeleteSymbolicLink" - rva: 148312 + rva: 0x24358 - name: "RtlSetDaclSecurityDescriptor" - rva: 148320 + rva: 0x24360 - name: "MmMapLockedPagesSpecifyCache" - rva: 148328 + rva: 0x24368 - name: "PsGetProcessId" - rva: 148336 + rva: 0x24370 - name: "IoThreadToProcess" - rva: 148344 + rva: 0x24378 - name: "PsGetCurrentProcessSessionId" - rva: 148352 + rva: 0x24380 - name: "ZwTerminateProcess" - rva: 148360 + rva: 0x24388 - name: "KeStackAttachProcess" - rva: 148368 + rva: 0x24390 - name: "KeUnstackDetachProcess" - rva: 148376 + rva: 0x24398 - name: "ZwOpenThread" - rva: 148384 + rva: 0x243a0 - name: "PsProcessType" - rva: 148392 + rva: 0x243a8 - name: "ExInterlockedInsertHeadList" - rva: 148400 + rva: 0x243b0 - name: "ExInterlockedRemoveHeadList" - rva: 148408 + rva: 0x243b8 - name: "CmRegisterCallback" - rva: 148416 + rva: 0x243c0 - name: "CmUnRegisterCallback" - rva: 148424 + rva: 0x243c8 - name: "RtlCreateRegistryKey" - rva: 148432 + rva: 0x243d0 - name: "ZwOpenKey" - rva: 148440 + rva: 0x243d8 - name: "ZwEnumerateKey" - rva: 148448 + rva: 0x243e0 - name: "ZwQueryKey" - rva: 148456 + rva: 0x243e8 - name: "ZwQueryValueKey" - rva: 148464 + rva: 0x243f0 - name: "RtlUnicodeStringToAnsiString" - rva: 148472 + rva: 0x243f8 - name: "RtlFreeAnsiString" - rva: 148480 + rva: 0x24400 - name: "ProbeForWrite" - rva: 148488 + rva: 0x24408 - name: "PsSetLoadImageNotifyRoutine" - rva: 148496 + rva: 0x24410 - name: "PsRemoveLoadImageNotifyRoutine" - rva: 148504 + rva: 0x24418 - name: "PsGetProcessSectionBaseAddress" - rva: 148512 + rva: 0x24420 - name: "MmSystemRangeStart" - rva: 148520 + rva: 0x24428 - name: "KeBugCheckEx" - rva: 148528 + rva: 0x24430 - name: "IoCreateDevice" - rva: 148536 + rva: 0x24438 - name: "ObOpenObjectByPointer" - rva: 148544 + rva: 0x24440 - name: "ZwSetSecurityObject" - rva: 148552 + rva: 0x24448 - name: "IoDeviceObjectType" - rva: 148560 + rva: 0x24450 - name: "_snwprintf" - rva: 148568 + rva: 0x24458 - name: "RtlLengthSecurityDescriptor" - rva: 148576 + rva: 0x24460 - name: "SeCaptureSecurityDescriptor" - rva: 148584 + rva: 0x24468 - name: "RtlCreateSecurityDescriptor" - rva: 148592 + rva: 0x24470 - name: "RtlAbsoluteToSelfRelativeSD" - rva: 148600 + rva: 0x24478 - name: "IoIsWdmVersionAvailable" - rva: 148608 + rva: 0x24480 - name: "SeExports" - rva: 148616 + rva: 0x24488 - name: "wcschr" - rva: 148624 + rva: 0x24490 - name: "_wcsnicmp" - rva: 148632 + rva: 0x24498 - name: "RtlLengthSid" - rva: 148640 + rva: 0x244a0 - name: "RtlAddAccessAllowedAce" - rva: 148648 + rva: 0x244a8 - name: "RtlGetSaclSecurityDescriptor" - rva: 148656 + rva: 0x244b0 - name: "RtlGetDaclSecurityDescriptor" - rva: 148664 + rva: 0x244b8 - name: "RtlGetGroupSecurityDescriptor" - rva: 148672 + rva: 0x244c0 - name: "RtlGetOwnerSecurityDescriptor" - rva: 148680 + rva: 0x244c8 - name: "ZwCreateKey" - rva: 148688 + rva: 0x244d0 - name: "RtlFreeUnicodeString" - rva: 148696 + rva: 0x244d8 is_signed: true signatures: - subject: "/businessCategory=Private Organization/serialNumber=460726/jurisdictionC=US/jurisdictionST=Idaho/C=US/ST=Idaho/L=Boise/streetAddress=702 W Idaho Street Suite 1100/O=WATCHDOGDEVELOPMENT.COM, LLC/CN=WATCHDOGDEVELOPMENT.COM, LLC" @@ -811,5 +811,5 @@ signatures: not_before: 1278020215 # 2010-07-01 21:36:55 UTC not_after: 1751406415 # 2025-07-01 21:46:55 UTC overlay: - offset: 206848 - size: 19616 \ No newline at end of file + offset: 0x32800 + size: 0x4ca0 \ No newline at end of file diff --git a/lib/src/modules/pe/tests/testdata/14f558c1c38193cd1f2fb10d643ccca8450ddef9007c3d1e8594ddf36d64b03a.out b/lib/src/modules/pe/tests/testdata/14f558c1c38193cd1f2fb10d643ccca8450ddef9007c3d1e8594ddf36d64b03a.out index 1d0f45966..4fa866ff0 100644 --- a/lib/src/modules/pe/tests/testdata/14f558c1c38193cd1f2fb10d643ccca8450ddef9007c3d1e8594ddf36d64b03a.out +++ b/lib/src/modules/pe/tests/testdata/14f558c1c38193cd1f2fb10d643ccca8450ddef9007c3d1e8594ddf36d64b03a.out @@ -17,26 +17,26 @@ opthdr_magic: IMAGE_NT_OPTIONAL_HDR32_MAGIC characteristics: 0x10f # RELOCS_STRIPPED | EXECUTABLE_IMAGE | LINE_NUMS_STRIPPED | LOCAL_SYMS_STRIPPED | MACHINE_32BIT dll_characteristics: 0x0 timestamp: 1210394606 # 2008-05-10 04:43:26 UTC -image_base: 4194304 +image_base: 0x400000 checksum: 0 -base_of_code: 4096 -base_of_data: 20480 -entry_point: 4101 -entry_point_raw: 4101 -section_alignment: 4096 -file_alignment: 4096 -loader_flags: 0 -size_of_optional_header: 224 -size_of_code: 16384 -size_of_initialized_data: 110592 -size_of_uninitialized_data: 0 -size_of_image: 131072 -size_of_headers: 4096 -size_of_stack_reserve: 1048576 -size_of_stack_commit: 4096 -size_of_heap_reserve: 1048576 -size_of_heap_commit: 4096 -pointer_to_symbol_table: 0 +base_of_code: 0x1000 +base_of_data: 0x5000 +entry_point: 0x1005 +entry_point_raw: 0x1005 +section_alignment: 0x1000 +file_alignment: 0x1000 +loader_flags: 0x0 +size_of_optional_header: 0xe0 +size_of_code: 0x4000 +size_of_initialized_data: 0x1b000 +size_of_uninitialized_data: 0x0 +size_of_image: 0x20000 +size_of_headers: 0x1000 +size_of_stack_reserve: 0x100000 +size_of_stack_commit: 0x1000 +size_of_heap_reserve: 0x100000 +size_of_heap_commit: 0x1000 +pointer_to_symbol_table: 0x0 win32_version_value: 0 number_of_symbols: 0 number_of_rva_and_sizes: 16 @@ -50,8 +50,8 @@ number_of_delayed_imports: 0 number_of_exports: 0 number_of_signatures: 0 rich_signature: - offset: 128 - length: 72 + offset: 0x80 + length: 0x48 key: 665814258 raw_data: "\xb6\xe5\xc1t\xf2\x84\xaf\'\xf2\x84\xaf\'\xf2\x84\xaf\'\x9d\x9b\xa4\'\xf3\x84\xaf\'\x9d\x9b\xa5\'\xe8\x84\xaf\'q\x98\xa1\'\xfe\x84\xaf\'\xf2\x84\xae\'\xd5\x84\xaf\'\x08\xa7\xb6\'\xf1\x84\xaf\'\xf4\xa7\xa4\'\xf0\x84\xaf\'5\x82\xa9\'\xf3\x84\xaf\'" clear_data: "DanS\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00o\x1f\x0b\x00\x01\x00\x00\x00o\x1f\n\x00\x1a\x00\x00\x00\x83\x1c\x0e\x00\x0c\x00\x00\x00\x00\x00\x01\x00\'\x00\x00\x00\xfa#\x19\x00\x03\x00\x00\x00\x06#\x0b\x00\x02\x00\x00\x00\xc7\x06\x06\x00\x01\x00\x00\x00" @@ -80,82 +80,82 @@ rich_signature: sections: - name: ".text" full_name: ".text" - characteristics: 1610612768 - raw_data_size: 16384 - raw_data_offset: 4096 - virtual_address: 4096 - virtual_size: 13742 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0x60000020 # SECTION_MEM_READ | SECTION_MEM_WRITE | SECTION_SCALE_INDEX + raw_data_size: 0x4000 + raw_data_offset: 0x1000 + virtual_address: 0x1000 + virtual_size: 0x35ae + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".rdata" full_name: ".rdata" - characteristics: 1073741888 - raw_data_size: 4096 - raw_data_offset: 20480 - virtual_address: 20480 - virtual_size: 1952 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0x40000040 + raw_data_size: 0x1000 + raw_data_offset: 0x5000 + virtual_address: 0x5000 + virtual_size: 0x7a0 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".data" full_name: ".data" - characteristics: 3221225536 - raw_data_size: 12288 - raw_data_offset: 24576 - virtual_address: 24576 - virtual_size: 10716 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0xc0000040 + raw_data_size: 0x3000 + raw_data_offset: 0x6000 + virtual_address: 0x6000 + virtual_size: 0x29dc + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".rsrc" full_name: ".rsrc" - characteristics: 1073741888 - raw_data_size: 94208 - raw_data_offset: 36864 - virtual_address: 36864 - virtual_size: 92456 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0x40000040 + raw_data_size: 0x17000 + raw_data_offset: 0x9000 + virtual_address: 0x9000 + virtual_size: 0x16928 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 data_directories: - - virtual_address: 0 - size: 0 - - virtual_address: 21556 - size: 40 - - virtual_address: 36864 - size: 92456 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 20480 - size: 156 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x5434 + size: 0x28 + - virtual_address: 0x9000 + size: 0x16928 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x5000 + size: 0x9c + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 is_signed: false overlay: - offset: 131072 - size: 899819 \ No newline at end of file + offset: 0x20000 + size: 0xdbaeb \ No newline at end of file diff --git a/lib/src/modules/pe/tests/testdata/1e435fea9ced78bd31ae8320a894df290cdf8a262ba1b50c9b116caa26983145.out b/lib/src/modules/pe/tests/testdata/1e435fea9ced78bd31ae8320a894df290cdf8a262ba1b50c9b116caa26983145.out index 86f808258..c5ecfed49 100644 --- a/lib/src/modules/pe/tests/testdata/1e435fea9ced78bd31ae8320a894df290cdf8a262ba1b50c9b116caa26983145.out +++ b/lib/src/modules/pe/tests/testdata/1e435fea9ced78bd31ae8320a894df290cdf8a262ba1b50c9b116caa26983145.out @@ -17,28 +17,28 @@ opthdr_magic: IMAGE_NT_OPTIONAL_HDR32_MAGIC characteristics: 0x2102 # EXECUTABLE_IMAGE | MACHINE_32BIT | DLL dll_characteristics: 0x0 timestamp: 1231923061 # 2009-01-14 08:51:01 UTC -image_base: 268435456 +image_base: 0x10000000 checksum: 336327 -base_of_code: 4096 -base_of_data: 176128 -entry_point: 114418 -entry_point_raw: 114418 +base_of_code: 0x1000 +base_of_data: 0x2b000 +entry_point: 0x1bef2 +entry_point_raw: 0x1bef2 dll_name: "Core.DLL" export_timestamp: 1231923061 # 2009-01-14 08:51:01 UTC -section_alignment: 4096 -file_alignment: 4096 -loader_flags: 0 -size_of_optional_header: 224 -size_of_code: 172032 -size_of_initialized_data: 94208 -size_of_uninitialized_data: 0 -size_of_image: 278528 -size_of_headers: 4096 -size_of_stack_reserve: 1048576 -size_of_stack_commit: 4096 -size_of_heap_reserve: 1048576 -size_of_heap_commit: 4096 -pointer_to_symbol_table: 0 +section_alignment: 0x1000 +file_alignment: 0x1000 +loader_flags: 0x0 +size_of_optional_header: 0xe0 +size_of_code: 0x2a000 +size_of_initialized_data: 0x17000 +size_of_uninitialized_data: 0x0 +size_of_image: 0x44000 +size_of_headers: 0x1000 +size_of_stack_reserve: 0x100000 +size_of_stack_commit: 0x1000 +size_of_heap_reserve: 0x100000 +size_of_heap_commit: 0x1000 +pointer_to_symbol_table: 0x0 win32_version_value: 0 number_of_symbols: 0 number_of_rva_and_sizes: 16 @@ -78,8 +78,8 @@ version_info_list: - key: "ProductVersion" value: "1.0.9.0" rich_signature: - offset: 128 - length: 96 + offset: 0x80 + length: 0x60 key: 3002618938 raw_data: "~5\x96\xe1:T\xf8\xb2:T\xf8\xb2:T\xf8\xb2\xf9[\xa5\xb26T\xf8\xb2\x1d\x92\x85\xb2#T\xf8\xb2\xf9[\xa7\xb29T\xf8\xb2\x1d\x92\x83\xb2=T\xf8\xb2:T\xf9\xb2\xdaT\xf8\xb2\x1d\x92\x95\xb2\xb3T\xf8\xb2\x1d\x92\x96\xb2vT\xf8\xb2\x1d\x92\x82\xb2;T\xf8\xb2\x1d\x92\x84\xb2;T\xf8\xb2\x1d\x92\x80\xb2;T\xf8\xb2" clear_data: "DanS\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xc3\x0f]\x00\x0c\x00\x00\x00\'\xc6}\x00\x19\x00\x00\x00\xc3\x0f_\x00\x03\x00\x00\x00\'\xc6{\x00\x07\x00\x00\x00\x00\x00\x01\x00\xe0\x00\x00\x00\'\xc6m\x00\x89\x00\x00\x00\'\xc6n\x00L\x00\x00\x00\'\xc6z\x00\x01\x00\x00\x00\'\xc6|\x00\x01\x00\x00\x00\'\xc6x\x00\x01\x00\x00\x00" @@ -118,118 +118,118 @@ pdb_path: "d:\\Projects\\astroburn\\bin\\Release\\Core.pdb" sections: - name: ".text" full_name: ".text" - characteristics: 1610612768 - raw_data_size: 172032 - raw_data_offset: 4096 - virtual_address: 4096 - virtual_size: 171809 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0x60000020 # SECTION_MEM_READ | SECTION_MEM_WRITE | SECTION_SCALE_INDEX + raw_data_size: 0x2a000 + raw_data_offset: 0x1000 + virtual_address: 0x1000 + virtual_size: 0x29f21 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".rdata" full_name: ".rdata" - characteristics: 1073741888 - raw_data_size: 36864 - raw_data_offset: 176128 - virtual_address: 176128 - virtual_size: 33009 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0x40000040 + raw_data_size: 0x9000 + raw_data_offset: 0x2b000 + virtual_address: 0x2b000 + virtual_size: 0x80f1 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".data" full_name: ".data" - characteristics: 3221225536 - raw_data_size: 12288 - raw_data_offset: 212992 - virtual_address: 212992 - virtual_size: 17508 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0xc0000040 + raw_data_size: 0x3000 + raw_data_offset: 0x34000 + virtual_address: 0x34000 + virtual_size: 0x4464 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".rsrc" full_name: ".rsrc" - characteristics: 1073741888 - raw_data_size: 28672 - raw_data_offset: 225280 - virtual_address: 233472 - virtual_size: 27580 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0x40000040 + raw_data_size: 0x7000 + raw_data_offset: 0x37000 + virtual_address: 0x39000 + virtual_size: 0x6bbc + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".reloc" full_name: ".reloc" - characteristics: 1107296320 - raw_data_size: 16384 - raw_data_offset: 253952 - virtual_address: 262144 - virtual_size: 14054 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0x42000040 + raw_data_size: 0x4000 + raw_data_offset: 0x3e000 + virtual_address: 0x40000 + virtual_size: 0x36e6 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 data_directories: - - virtual_address: 208976 - size: 161 - - virtual_address: 203892 - size: 200 - - virtual_address: 233472 - size: 27580 - - virtual_address: 0 - size: 0 - - virtual_address: 270336 - size: 4272 - - virtual_address: 262144 - size: 9872 - - virtual_address: 177008 - size: 28 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 189480 - size: 64 - - virtual_address: 0 - size: 0 - - virtual_address: 176128 - size: 796 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 + - virtual_address: 0x33050 + size: 0xa1 + - virtual_address: 0x31c74 + size: 0xc8 + - virtual_address: 0x39000 + size: 0x6bbc + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x42000 + size: 0x10b0 + - virtual_address: 0x40000 + size: 0x2690 + - virtual_address: 0x2b370 + size: 0x1c + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x2e428 + size: 0x40 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x2b000 + size: 0x31c + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 resource_timestamp: 0 # 1970-01-01 00:00:00 UTC resource_version: major: 4 minor: 0 resources: - - length: 26340 - rva: 233792 - offset: 225600 + - length: 0x66e4 + rva: 0x39140 + offset: 0x37140 id: 1 language: 1049 type_string: "T\x00Y\x00P\x00E\x00L\x00I\x00B\x00" - - length: 40 - rva: 260132 - offset: 251940 + - length: 0x28 + rva: 0x3f824 + offset: 0x3d824 type: RESOURCE_TYPE_STRING id: 7 language: 1049 - - length: 792 - rva: 260172 - offset: 251980 + - length: 0x318 + rva: 0x3f84c + offset: 0x3d84c type: RESOURCE_TYPE_VERSION id: 1 language: 1049 - - length: 86 - rva: 260964 - offset: 252772 + - length: 0x56 + rva: 0x3fb64 + offset: 0x3db64 type: RESOURCE_TYPE_MANIFEST id: 2 language: 1033 @@ -238,448 +238,448 @@ import_details: number_of_functions: 44 functions: - name: "StarBurn_SetFastReadTOC" - rva: 176668 + rva: 0x2b21c - name: "StarBurn_CdvdBurnerGrabber_GetSpeeds" - rva: 176672 + rva: 0x2b220 - name: "StarBurn_CdvdBurnerGrabber_SetSpeeds" - rva: 176676 + rva: 0x2b224 - name: "StarBurn_Destroy" - rva: 176680 + rva: 0x2b228 - name: "StarBurn_CdvdBurnerGrabber_ProbeSupportedWriteModes" - rva: 176684 + rva: 0x2b22c - name: "StarBurn_CdvdBurnerGrabber_GetAdvancedSupportedMediaFormats" - rva: 176688 + rva: 0x2b230 - name: "StarBurn_CdvdBurnerGrabber_TrackAtOnceFromFile" - rva: 176692 + rva: 0x2b234 - name: "StarBurn_CdvdBurnerGrabber_GetBUP" - rva: 176696 + rva: 0x2b238 - name: "StarBurn_CdvdBurnerGrabber_SetBUP" - rva: 176700 + rva: 0x2b23c - name: "StarBurn_CdvdBurnerGrabber_SendOPC" - rva: 176704 + rva: 0x2b240 - name: "StarBurn_GetFastReadTOC" - rva: 176708 + rva: 0x2b244 - name: "StarBurn_CdvdBurnerGrabber_GetLastTrack" - rva: 176712 + rva: 0x2b248 - name: "StarBurn_CdvdBurnerGrabber_GrabTrack" - rva: 176716 + rva: 0x2b24c - name: "StarBurn_CdvdBurnerGrabber_CreateExEx" - rva: 176720 + rva: 0x2b250 - name: "StarBurn_UDF2_ImpVolumeCreate" - rva: 176724 + rva: 0x2b254 - name: "StarBurn_UDF2_ImpVolumeImport" - rva: 176728 + rva: 0x2b258 - name: "StarBurn_CdvdBurnerGrabber_Lock" - rva: 176732 + rva: 0x2b25c - name: "StarBurn_CdvdBurnerGrabber_Blank" - rva: 176736 + rva: 0x2b260 - name: "StarBurn_CdvdBurnerGrabber_Release" - rva: 176740 + rva: 0x2b264 - name: "StarBurn_CdvdBurnerGrabber_Eject" - rva: 176744 + rva: 0x2b268 - name: "StarBurn_UpStartEx" - rva: 176748 + rva: 0x2b26c - name: "StarBurn_DownShut" - rva: 176752 + rva: 0x2b270 - name: "StarBurn_UDF2_DirectoryRootCreate" - rva: 176756 + rva: 0x2b274 - name: "StarBurn_CdvdBurnerGrabber_GetTOCInformation" - rva: 176760 + rva: 0x2b278 - name: "StarBurn_CdvdBurnerGrabber_GetDiscFileSystem" - rva: 176764 + rva: 0x2b27c - name: "StarBurn_CdvdBurnerGrabber_GetInsertedDiscType" - rva: 176768 + rva: 0x2b280 - name: "StarBurn_CdvdBurnerGrabber_TestUnitReady" - rva: 176772 + rva: 0x2b284 - name: "StarBurn_GetDeviceNameByDeviceAddress" - rva: 176776 + rva: 0x2b288 - name: "StarBurn_CdvdBurnerGrabber_GetDeviceInformation" - rva: 176780 + rva: 0x2b28c - name: "StarBurn_CdvdBurnerGrabber_GetTrackInformation" - rva: 176784 + rva: 0x2b290 - name: "StarBurn_CdvdBurnerGrabber_ExecuteGeneric" - rva: 176788 + rva: 0x2b294 - name: "StarBurn_CdvdBurnerGrabber_Read10" - rva: 176792 + rva: 0x2b298 - name: "StarBurn_CdvdBurnerGrabber_Cancel" - rva: 176796 + rva: 0x2b29c - name: "StarBurn_CdvdBurnerGrabber_ReadCooked" - rva: 176800 + rva: 0x2b2a0 - name: "StarBurn_CdvdBurnerGrabber_TrackAtOnceFromPipeEx" - rva: 176804 + rva: 0x2b2a4 - name: "StarBurn_CdvdBurnerGrabber_CloseSession" - rva: 176808 + rva: 0x2b2a8 - name: "StarBurn_CdvdBurnerGrabber_DiscBasicInformation_Create" - rva: 176812 + rva: 0x2b2ac - name: "StarBurn_CdvdBurnerGrabber_DiscBasicInformation_Destroy" - rva: 176816 + rva: 0x2b2b0 - name: "StarBurn_CdvdBurnerGrabber_Read" - rva: 176820 + rva: 0x2b2b4 - name: "StarBurn_GetAudioFileStreamSizeInUCHARs" - rva: 176824 + rva: 0x2b2b8 - name: "StarBurn_CdvdBurnerGrabber_Create" - rva: 176828 + rva: 0x2b2bc - name: "StarBurn_CdvdBurnerGrabber_CreateEx" - rva: 176832 + rva: 0x2b2c0 - name: "StarBurn_FindDevice" - rva: 176836 + rva: 0x2b2c4 - name: "StarBurn_IsAudioFileSupported" - rva: 176840 + rva: 0x2b2c8 - library_name: "imgengine.dll" number_of_functions: 7 functions: - name: "ord6" ordinal: 6 - rva: 176868 + rva: 0x2b2e4 - name: "ord4" ordinal: 4 - rva: 176872 + rva: 0x2b2e8 - name: "ord2" ordinal: 2 - rva: 176876 + rva: 0x2b2ec - name: "ord8" ordinal: 8 - rva: 176880 + rva: 0x2b2f0 - name: "ord3" ordinal: 3 - rva: 176884 + rva: 0x2b2f4 - name: "ord7" ordinal: 7 - rva: 176888 + rva: 0x2b2f8 - name: "ord5" ordinal: 5 - rva: 176892 + rva: 0x2b2fc - library_name: "GrabHlp.dll" number_of_functions: 1 functions: - name: "ord1" ordinal: 1 - rva: 176188 + rva: 0x2b03c - library_name: "KERNEL32.dll" number_of_functions: 100 functions: - name: "HeapDestroy" - rva: 176196 + rva: 0x2b044 - name: "HeapCreate" - rva: 176200 + rva: 0x2b048 - name: "ExitProcess" - rva: 176204 + rva: 0x2b04c - name: "GetStdHandle" - rva: 176208 + rva: 0x2b050 - name: "GetModuleFileNameA" - rva: 176212 + rva: 0x2b054 - name: "GetCPInfo" - rva: 176216 + rva: 0x2b058 - name: "GetACP" - rva: 176220 + rva: 0x2b05c - name: "GetOEMCP" - rva: 176224 + rva: 0x2b060 - name: "IsValidCodePage" - rva: 176228 + rva: 0x2b064 - name: "HeapSize" - rva: 176232 + rva: 0x2b068 - name: "LCMapStringA" - rva: 176236 + rva: 0x2b06c - name: "LCMapStringW" - rva: 176240 + rva: 0x2b070 - name: "Sleep" - rva: 176244 + rva: 0x2b074 - name: "SetHandleCount" - rva: 176248 + rva: 0x2b078 - name: "GetFileType" - rva: 176252 + rva: 0x2b07c - name: "GetStartupInfoA" - rva: 176256 + rva: 0x2b080 - name: "CreateFileA" - rva: 176260 + rva: 0x2b084 - name: "FlushFileBuffers" - rva: 176264 + rva: 0x2b088 - name: "WriteConsoleW" - rva: 176268 + rva: 0x2b08c - name: "GetConsoleOutputCP" - rva: 176272 + rva: 0x2b090 - name: "WriteConsoleA" - rva: 176276 + rva: 0x2b094 - name: "SetStdHandle" - rva: 176280 + rva: 0x2b098 - name: "GetDriveTypeA" - rva: 176284 + rva: 0x2b09c - name: "GetCurrentDirectoryA" - rva: 176288 + rva: 0x2b0a0 - name: "GetLocaleInfoA" - rva: 176292 + rva: 0x2b0a4 - name: "GetStringTypeW" - rva: 176296 + rva: 0x2b0a8 - name: "GetStringTypeA" - rva: 176300 + rva: 0x2b0ac - name: "LoadLibraryA" - rva: 176304 + rva: 0x2b0b0 - name: "InterlockedExchange" - rva: 176308 + rva: 0x2b0b4 - name: "GetConsoleMode" - rva: 176312 + rva: 0x2b0b8 - name: "GetConsoleCP" - rva: 176316 + rva: 0x2b0bc - name: "SetFilePointer" - rva: 176320 + rva: 0x2b0c0 - name: "GetCurrentProcessId" - rva: 176324 + rva: 0x2b0c4 - name: "GetTickCount" - rva: 176328 + rva: 0x2b0c8 - name: "QueryPerformanceCounter" - rva: 176332 + rva: 0x2b0cc - name: "GetEnvironmentStringsW" - rva: 176336 + rva: 0x2b0d0 - name: "FreeEnvironmentStringsW" - rva: 176340 + rva: 0x2b0d4 - name: "GetEnvironmentStrings" - rva: 176344 + rva: 0x2b0d8 - name: "GetCurrentProcess" - rva: 176348 + rva: 0x2b0dc - name: "MultiByteToWideChar" - rva: 176352 + rva: 0x2b0e0 - name: "GetVolumeInformationW" - rva: 176356 + rva: 0x2b0e4 - name: "lstrlenA" - rva: 176360 + rva: 0x2b0e8 - name: "QueryDosDeviceA" - rva: 176364 + rva: 0x2b0ec - name: "CloseHandle" - rva: 176368 + rva: 0x2b0f0 - name: "WaitForSingleObject" - rva: 176372 + rva: 0x2b0f4 - name: "lstrlenW" - rva: 176376 + rva: 0x2b0f8 - name: "RaiseException" - rva: 176380 + rva: 0x2b0fc - name: "InitializeCriticalSection" - rva: 176384 + rva: 0x2b100 - name: "DeleteCriticalSection" - rva: 176388 + rva: 0x2b104 - name: "SizeofResource" - rva: 176392 + rva: 0x2b108 - name: "LockResource" - rva: 176396 + rva: 0x2b10c - name: "LoadResource" - rva: 176400 + rva: 0x2b110 - name: "FindResourceW" - rva: 176404 + rva: 0x2b114 - name: "FindResourceExW" - rva: 176408 + rva: 0x2b118 - name: "GetLastError" - rva: 176412 + rva: 0x2b11c - name: "LocalFree" - rva: 176416 + rva: 0x2b120 - name: "LocalAlloc" - rva: 176420 + rva: 0x2b124 - name: "FreeLibrary" - rva: 176424 + rva: 0x2b128 - name: "GetProcAddress" - rva: 176428 + rva: 0x2b12c - name: "LoadLibraryW" - rva: 176432 + rva: 0x2b130 - name: "EnterCriticalSection" - rva: 176436 + rva: 0x2b134 - name: "LeaveCriticalSection" - rva: 176440 + rva: 0x2b138 - name: "lstrcmpiW" - rva: 176444 + rva: 0x2b13c - name: "InterlockedIncrement" - rva: 176448 + rva: 0x2b140 - name: "InterlockedDecrement" - rva: 176452 + rva: 0x2b144 - name: "GetModuleFileNameW" - rva: 176456 + rva: 0x2b148 - name: "LoadLibraryExW" - rva: 176460 + rva: 0x2b14c - name: "GetModuleHandleW" - rva: 176464 + rva: 0x2b150 - name: "WideCharToMultiByte" - rva: 176468 + rva: 0x2b154 - name: "SetThreadLocale" - rva: 176472 + rva: 0x2b158 - name: "GetThreadLocale" - rva: 176476 + rva: 0x2b15c - name: "VirtualFree" - rva: 176480 + rva: 0x2b160 - name: "VirtualAlloc" - rva: 176484 + rva: 0x2b164 - name: "WriteFile" - rva: 176488 + rva: 0x2b168 - name: "CreateThread" - rva: 176492 + rva: 0x2b16c - name: "CreatePipe" - rva: 176496 + rva: 0x2b170 - name: "DeleteFileW" - rva: 176500 + rva: 0x2b174 - name: "CreateFileW" - rva: 176504 + rva: 0x2b178 - name: "HeapAlloc" - rva: 176508 + rva: 0x2b17c - name: "GetProcessHeap" - rva: 176512 + rva: 0x2b180 - name: "SetCurrentDirectoryW" - rva: 176516 + rva: 0x2b184 - name: "TerminateProcess" - rva: 176520 + rva: 0x2b188 - name: "UnhandledExceptionFilter" - rva: 176524 + rva: 0x2b18c - name: "SetUnhandledExceptionFilter" - rva: 176528 + rva: 0x2b190 - name: "IsDebuggerPresent" - rva: 176532 + rva: 0x2b194 - name: "RtlUnwind" - rva: 176536 + rva: 0x2b198 - name: "HeapFree" - rva: 176540 + rva: 0x2b19c - name: "HeapReAlloc" - rva: 176544 + rva: 0x2b1a0 - name: "GetFullPathNameW" - rva: 176548 + rva: 0x2b1a4 - name: "GetSystemTimeAsFileTime" - rva: 176552 + rva: 0x2b1a8 - name: "GetCurrentThreadId" - rva: 176556 + rva: 0x2b1ac - name: "GetCommandLineA" - rva: 176560 + rva: 0x2b1b0 - name: "GetVersionExA" - rva: 176564 + rva: 0x2b1b4 - name: "GetModuleHandleA" - rva: 176568 + rva: 0x2b1b8 - name: "TlsGetValue" - rva: 176572 + rva: 0x2b1bc - name: "TlsAlloc" - rva: 176576 + rva: 0x2b1c0 - name: "TlsSetValue" - rva: 176580 + rva: 0x2b1c4 - name: "TlsFree" - rva: 176584 + rva: 0x2b1c8 - name: "SetLastError" - rva: 176588 + rva: 0x2b1cc - name: "FreeEnvironmentStringsA" - rva: 176592 + rva: 0x2b1d0 - library_name: "USER32.dll" number_of_functions: 4 functions: - name: "CharLowerBuffW" - rva: 176848 + rva: 0x2b2d0 - name: "MessageBoxW" - rva: 176852 + rva: 0x2b2d4 - name: "UnregisterClassA" - rva: 176856 + rva: 0x2b2d8 - name: "CharNextW" - rva: 176860 + rva: 0x2b2dc - library_name: "ADVAPI32.dll" number_of_functions: 14 functions: - name: "RegSetValueExW" - rva: 176128 + rva: 0x2b000 - name: "UnregisterTraceGuids" - rva: 176132 + rva: 0x2b004 - name: "TraceEvent" - rva: 176136 + rva: 0x2b008 - name: "RegDeleteKeyW" - rva: 176140 + rva: 0x2b00c - name: "RegDeleteValueW" - rva: 176144 + rva: 0x2b010 - name: "RegCloseKey" - rva: 176148 + rva: 0x2b014 - name: "RegCreateKeyExW" - rva: 176152 + rva: 0x2b018 - name: "RegOpenKeyExW" - rva: 176156 + rva: 0x2b01c - name: "RegQueryInfoKeyW" - rva: 176160 + rva: 0x2b020 - name: "RegEnumKeyExW" - rva: 176164 + rva: 0x2b024 - name: "GetTraceEnableFlags" - rva: 176168 + rva: 0x2b028 - name: "GetTraceEnableLevel" - rva: 176172 + rva: 0x2b02c - name: "GetTraceLoggerHandle" - rva: 176176 + rva: 0x2b030 - name: "RegisterTraceGuidsW" - rva: 176180 + rva: 0x2b034 - library_name: "ole32.dll" number_of_functions: 5 functions: - name: "CoTaskMemRealloc" - rva: 176900 + rva: 0x2b304 - name: "CoCreateInstance" - rva: 176904 + rva: 0x2b308 - name: "CoTaskMemFree" - rva: 176908 + rva: 0x2b30c - name: "StringFromGUID2" - rva: 176912 + rva: 0x2b310 - name: "CoTaskMemAlloc" - rva: 176916 + rva: 0x2b314 - library_name: "SHELL32.dll" number_of_functions: 1 functions: - name: "SHGetDiskFreeSpaceExW" - rva: 176660 + rva: 0x2b214 - library_name: "OLEAUT32.dll" number_of_functions: 14 functions: - name: "VarBstrCmp" ordinal: 314 - rva: 176600 + rva: 0x2b1d8 - name: "SysFreeString" ordinal: 6 - rva: 176604 + rva: 0x2b1dc - name: "VariantClear" ordinal: 9 - rva: 176608 + rva: 0x2b1e0 - name: "SysAllocStringLen" ordinal: 4 - rva: 176612 + rva: 0x2b1e4 - name: "SysAllocString" ordinal: 2 - rva: 176616 + rva: 0x2b1e8 - name: "SysAllocStringByteLen" ordinal: 150 - rva: 176620 + rva: 0x2b1ec - name: "SysStringByteLen" ordinal: 149 - rva: 176624 + rva: 0x2b1f0 - name: "SysStringLen" ordinal: 7 - rva: 176628 + rva: 0x2b1f4 - name: "VarUI4FromStr" ordinal: 277 - rva: 176632 + rva: 0x2b1f8 - name: "LoadRegTypeLib" ordinal: 162 - rva: 176636 + rva: 0x2b1fc - name: "LoadTypeLib" ordinal: 161 - rva: 176640 + rva: 0x2b200 - name: "UnRegisterTypeLib" ordinal: 186 - rva: 176644 + rva: 0x2b204 - name: "RegisterTypeLib" ordinal: 163 - rva: 176648 + rva: 0x2b208 - name: "VarBstrCat" ordinal: 313 - rva: 176652 + rva: 0x2b20c export_details: - name: "DllCanUnloadNow" ordinal: 1 - rva: 53184 - offset: 53184 + rva: 0xcfc0 + offset: 0xcfc0 - name: "DllGetClassObject" ordinal: 2 - rva: 56096 - offset: 56096 + rva: 0xdb20 + offset: 0xdb20 - name: "DllRegisterServer" ordinal: 3 - rva: 56416 - offset: 56416 + rva: 0xdc60 + offset: 0xdc60 - name: "DllUnregisterServer" ordinal: 4 - rva: 56432 - offset: 56432 + rva: 0xdc70 + offset: 0xdc70 is_signed: true signatures: - subject: "/C=KN/postalCode=KN/ST=Nevis/L=Charlestown/streetAddress=Main Street,Charlestown/O=Disk Software Ltd/CN=Disk Software Ltd" @@ -763,5 +763,5 @@ signatures: not_before: 1070496000 # 2003-12-04 00:00:00 UTC not_after: 1386115199 # 2013-12-03 23:59:59 UTC overlay: - offset: 270336 - size: 4272 \ No newline at end of file + offset: 0x42000 + size: 0x10b0 \ No newline at end of file diff --git a/lib/src/modules/pe/tests/testdata/23e72ce7e9cdbc80c0095484ebeb02f56b21e48fd67044e69e7a2ae76db631e5.out b/lib/src/modules/pe/tests/testdata/23e72ce7e9cdbc80c0095484ebeb02f56b21e48fd67044e69e7a2ae76db631e5.out index 367bb199b..b60afd9ef 100644 --- a/lib/src/modules/pe/tests/testdata/23e72ce7e9cdbc80c0095484ebeb02f56b21e48fd67044e69e7a2ae76db631e5.out +++ b/lib/src/modules/pe/tests/testdata/23e72ce7e9cdbc80c0095484ebeb02f56b21e48fd67044e69e7a2ae76db631e5.out @@ -17,27 +17,27 @@ opthdr_magic: IMAGE_NT_OPTIONAL_HDR64_MAGIC characteristics: 0x2022 # EXECUTABLE_IMAGE | LARGE_ADDRESS_AWARE | DLL dll_characteristics: 0x4160 # HIGH_ENTROPY_VA | DYNAMIC_BASE | NX_COMPAT | GUARD_CF timestamp: 1827812126 # 2027-12-03 05:35:26 UTC -image_base: 6442450944 +image_base: 0x180000000 checksum: 57102 -base_of_code: 4096 -entry_point: 1920 -entry_point_raw: 4992 +base_of_code: 0x1000 +entry_point: 0x780 +entry_point_raw: 0x1380 dll_name: "mtxex.dll" export_timestamp: 1827812126 # 2027-12-03 05:35:26 UTC -section_alignment: 4096 -file_alignment: 512 -loader_flags: 0 -size_of_optional_header: 240 -size_of_code: 3584 -size_of_initialized_data: 6144 -size_of_uninitialized_data: 0 -size_of_image: 28672 -size_of_headers: 1024 -size_of_stack_reserve: 262144 -size_of_stack_commit: 4096 -size_of_heap_reserve: 1048576 -size_of_heap_commit: 4096 -pointer_to_symbol_table: 0 +section_alignment: 0x1000 +file_alignment: 0x200 +loader_flags: 0x0 +size_of_optional_header: 0xf0 +size_of_code: 0xe00 +size_of_initialized_data: 0x1800 +size_of_uninitialized_data: 0x0 +size_of_image: 0x7000 +size_of_headers: 0x400 +size_of_stack_reserve: 0x40000 +size_of_stack_commit: 0x1000 +size_of_heap_reserve: 0x100000 +size_of_heap_commit: 0x1000 +pointer_to_symbol_table: 0x0 win32_version_value: 0 number_of_symbols: 0 number_of_rva_and_sizes: 16 @@ -77,8 +77,8 @@ version_info_list: - key: "ProductVersion" value: "10.0.17763.1" rich_signature: - offset: 128 - length: 80 + offset: 0x80 + length: 0x50 key: 3360243275 raw_data: "\x0f_\'\x9bK>I\xc8K>I\xc8K>I\xc8.XJ\xc9I>I\xc8.XM\xc9A>I\xc8K>H\xc8W>I\xc8.XH\xc9N>I\xc8.XI\xc9J>I\xc8.XA\xc9I>I\xc8.X\xb6\xc8J>I\xc8.XK\xc9J>I\xc8" clear_data: "DanS\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00ef\x03\x01\x02\x00\x00\x00ef\x04\x01\n\x00\x00\x00\x00\x00\x01\x00\x1c\x00\x00\x00ef\x01\x01\x05\x00\x00\x00ef\x00\x01\x01\x00\x00\x00ef\x08\x01\x02\x00\x00\x00ef\xff\x00\x01\x00\x00\x00ef\x02\x01\x01\x00\x00\x00" @@ -111,111 +111,111 @@ pdb_path: "mtxex.pdb" sections: - name: ".text" full_name: ".text" - characteristics: 1610612768 - raw_data_size: 3584 - raw_data_offset: 1024 - virtual_address: 4096 - virtual_size: 3408 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0x60000020 # SECTION_MEM_READ | SECTION_MEM_WRITE | SECTION_SCALE_INDEX + raw_data_size: 0xe00 + raw_data_offset: 0x400 + virtual_address: 0x1000 + virtual_size: 0xd50 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".rdata" full_name: ".rdata" - characteristics: 1073741888 - raw_data_size: 2560 - raw_data_offset: 4608 - virtual_address: 8192 - virtual_size: 2510 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0x40000040 + raw_data_size: 0xa00 + raw_data_offset: 0x1200 + virtual_address: 0x2000 + virtual_size: 0x9ce + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".data" full_name: ".data" - characteristics: 3221225536 - raw_data_size: 512 - raw_data_offset: 7168 - virtual_address: 12288 - virtual_size: 1504 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0xc0000040 + raw_data_size: 0x200 + raw_data_offset: 0x1c00 + virtual_address: 0x3000 + virtual_size: 0x5e0 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".pdata" full_name: ".pdata" - characteristics: 1073741888 - raw_data_size: 512 - raw_data_offset: 7680 - virtual_address: 16384 - virtual_size: 264 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0x40000040 + raw_data_size: 0x200 + raw_data_offset: 0x1e00 + virtual_address: 0x4000 + virtual_size: 0x108 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".rsrc" full_name: ".rsrc" - characteristics: 1073741888 - raw_data_size: 1024 - raw_data_offset: 8192 - virtual_address: 20480 - virtual_size: 984 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0x40000040 + raw_data_size: 0x400 + raw_data_offset: 0x2000 + virtual_address: 0x5000 + virtual_size: 0x3d8 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".reloc" full_name: ".reloc" - characteristics: 1107296320 - raw_data_size: 512 - raw_data_offset: 9216 - virtual_address: 24576 - virtual_size: 28 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0x42000040 + raw_data_size: 0x200 + raw_data_offset: 0x2400 + virtual_address: 0x6000 + virtual_size: 0x1c + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 data_directories: - - virtual_address: 9728 - size: 220 - - virtual_address: 9948 - size: 60 - - virtual_address: 20480 - size: 984 - - virtual_address: 16384 - size: 264 - - virtual_address: 0 - size: 0 - - virtual_address: 24576 - size: 28 - - virtual_address: 8816 - size: 84 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 8208 - size: 264 - - virtual_address: 0 - size: 0 - - virtual_address: 8472 - size: 208 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 + - virtual_address: 0x2600 + size: 0xdc + - virtual_address: 0x26dc + size: 0x3c + - virtual_address: 0x5000 + size: 0x3d8 + - virtual_address: 0x4000 + size: 0x108 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x6000 + size: 0x1c + - virtual_address: 0x2270 + size: 0x54 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x2010 + size: 0x108 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x2118 + size: 0xd0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 resource_timestamp: 0 # 1970-01-01 00:00:00 UTC resource_version: major: 0 minor: 0 resources: - - length: 888 - rva: 20576 - offset: 8288 + - length: 0x378 + rva: 0x5060 + offset: 0x2060 type: RESOURCE_TYPE_VERSION id: 1 language: 1033 @@ -224,74 +224,74 @@ import_details: number_of_functions: 6 functions: - name: "__C_specific_handler" - rva: 8624 + rva: 0x21b0 - name: "_XcptFilter" - rva: 8632 + rva: 0x21b8 - name: "_initterm" - rva: 8640 + rva: 0x21c0 - name: "malloc" - rva: 8648 + rva: 0x21c8 - name: "free" - rva: 8656 + rva: 0x21d0 - name: "_amsg_exit" - rva: 8664 + rva: 0x21d8 - library_name: "KERNEL32.dll" number_of_functions: 18 functions: - name: "LoadLibraryExW" - rva: 8472 + rva: 0x2118 - name: "TerminateProcess" - rva: 8480 + rva: 0x2120 - name: "GetCurrentProcess" - rva: 8488 + rva: 0x2128 - name: "SetUnhandledExceptionFilter" - rva: 8496 + rva: 0x2130 - name: "UnhandledExceptionFilter" - rva: 8504 + rva: 0x2138 - name: "RtlVirtualUnwind" - rva: 8512 + rva: 0x2140 - name: "RtlLookupFunctionEntry" - rva: 8520 + rva: 0x2148 - name: "RtlCaptureContext" - rva: 8528 + rva: 0x2150 - name: "GetTickCount" - rva: 8536 + rva: 0x2158 - name: "GetSystemTimeAsFileTime" - rva: 8544 + rva: 0x2160 - name: "GetCurrentThreadId" - rva: 8552 + rva: 0x2168 - name: "GetLastError" - rva: 8560 + rva: 0x2170 - name: "DisableThreadLibraryCalls" - rva: 8568 + rva: 0x2178 - name: "GetProcAddress" - rva: 8576 + rva: 0x2180 - name: "FreeLibrary" - rva: 8584 + rva: 0x2188 - name: "QueryPerformanceCounter" - rva: 8592 + rva: 0x2190 - name: "Sleep" - rva: 8600 + rva: 0x2198 - name: "GetCurrentProcessId" - rva: 8608 + rva: 0x21a0 export_details: - name: "DllGetClassObject" ordinal: 1 - rva: 4144 - offset: 1072 + rva: 0x1030 + offset: 0x430 - name: "GetObjectContext" ordinal: 2 - rva: 9853 + rva: 0x267d forward_name: "COMSVCS.GetObjectContext" - name: "MTSCreateActivity" ordinal: 3 - rva: 9896 + rva: 0x26a8 forward_name: "COMSVCS.MTSCreateActivity" - name: "SafeRef" ordinal: 4 - rva: 9930 + rva: 0x26ca forward_name: "COMSVCS.SafeRef" is_signed: false overlay: - offset: 0 - size: 0 \ No newline at end of file + offset: 0x0 + size: 0x0 \ No newline at end of file diff --git a/lib/src/modules/pe/tests/testdata/2775d97f8bdb3311ace960a42eee35dbec84b9d71a6abbacb26c14e83f5897e4.out b/lib/src/modules/pe/tests/testdata/2775d97f8bdb3311ace960a42eee35dbec84b9d71a6abbacb26c14e83f5897e4.out index 7f6e88bd9..0f14723d0 100644 --- a/lib/src/modules/pe/tests/testdata/2775d97f8bdb3311ace960a42eee35dbec84b9d71a6abbacb26c14e83f5897e4.out +++ b/lib/src/modules/pe/tests/testdata/2775d97f8bdb3311ace960a42eee35dbec84b9d71a6abbacb26c14e83f5897e4.out @@ -17,26 +17,26 @@ opthdr_magic: IMAGE_NT_OPTIONAL_HDR32_MAGIC characteristics: 0x10f # RELOCS_STRIPPED | EXECUTABLE_IMAGE | LINE_NUMS_STRIPPED | LOCAL_SYMS_STRIPPED | MACHINE_32BIT dll_characteristics: 0x0 timestamp: 1524722207 # 2018-04-26 05:56:47 UTC -image_base: 4194304 +image_base: 0x400000 checksum: 0 -base_of_code: 1024 -base_of_data: 2560 -entry_point: 1024 -entry_point_raw: 1024 -section_alignment: 512 -file_alignment: 512 -loader_flags: 0 -size_of_optional_header: 224 -size_of_code: 1536 -size_of_initialized_data: 2048 -size_of_uninitialized_data: 0 -size_of_image: 4608 -size_of_headers: 1024 -size_of_stack_reserve: 1048576 -size_of_stack_commit: 4096 -size_of_heap_reserve: 1048576 -size_of_heap_commit: 4096 -pointer_to_symbol_table: 0 +base_of_code: 0x400 +base_of_data: 0xa00 +entry_point: 0x400 +entry_point_raw: 0x400 +section_alignment: 0x200 +file_alignment: 0x200 +loader_flags: 0x0 +size_of_optional_header: 0xe0 +size_of_code: 0x600 +size_of_initialized_data: 0x800 +size_of_uninitialized_data: 0x0 +size_of_image: 0x1200 +size_of_headers: 0x400 +size_of_stack_reserve: 0x100000 +size_of_stack_commit: 0x1000 +size_of_heap_reserve: 0x100000 +size_of_heap_commit: 0x1000 +pointer_to_symbol_table: 0x0 win32_version_value: 0 number_of_symbols: 0 number_of_rva_and_sizes: 16 @@ -50,8 +50,8 @@ number_of_delayed_imports: 6 number_of_exports: 0 number_of_signatures: 0 rich_signature: - offset: 128 - length: 48 + offset: 0x80 + length: 0x30 key: 2308599217 raw_data: "\xf5\x0c\xf4\xda\xb1m\x9a\x89\xb1m\x9a\x89\xb1m\x9a\x89\xb1m\x9a\x89\xb3m\x9a\x89\xd3r\x89\x89\xb2m\x9a\x89\xb1m\x9b\x89\xafm\x9a\x89Yr\x91\x89\xb5m\x9a\x89" clear_data: "DanS\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x00\x00b\x1f\x13\x00\x03\x00\x00\x00\x00\x00\x01\x00\x1e\x00\x00\x00\xe8\x1f\x0b\x00\x04\x00\x00\x00" @@ -71,161 +71,161 @@ rich_signature: sections: - name: ".text" full_name: ".text" - characteristics: 1610612768 - raw_data_size: 1536 - raw_data_offset: 1024 - virtual_address: 1024 - virtual_size: 1419 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0x60000020 # SECTION_MEM_READ | SECTION_MEM_WRITE | SECTION_SCALE_INDEX + raw_data_size: 0x600 + raw_data_offset: 0x400 + virtual_address: 0x400 + virtual_size: 0x58b + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".rdata" full_name: ".rdata" - characteristics: 1073741888 - raw_data_size: 1536 - raw_data_offset: 2560 - virtual_address: 2560 - virtual_size: 1108 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0x40000040 + raw_data_size: 0x600 + raw_data_offset: 0xa00 + virtual_address: 0xa00 + virtual_size: 0x454 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".data" full_name: ".data" - characteristics: 3221225536 - raw_data_size: 512 - raw_data_offset: 4096 - virtual_address: 4096 - virtual_size: 252 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0xc0000040 + raw_data_size: 0x200 + raw_data_offset: 0x1000 + virtual_address: 0x1000 + virtual_size: 0xfc + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 data_directories: - - virtual_address: 0 - size: 0 - - virtual_address: 3268 - size: 40 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 2560 - size: 72 - - virtual_address: 2732 - size: 224 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0xcc4 + size: 0x28 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0xa00 + size: 0x48 + - virtual_address: 0xaac + size: 0xe0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 import_details: - library_name: "KERNEL32.dll" number_of_functions: 17 functions: - name: "GetModuleHandleA" - rva: 2560 + rva: 0xa00 - name: "ReadFile" - rva: 2564 + rva: 0xa04 - name: "GetStdHandle" - rva: 2568 + rva: 0xa08 - name: "CloseHandle" - rva: 2572 + rva: 0xa0c - name: "SetThreadPriority" - rva: 2576 + rva: 0xa10 - name: "CreateThread" - rva: 2580 + rva: 0xa14 - name: "WriteFile" - rva: 2584 + rva: 0xa18 - name: "WaitForSingleObject" - rva: 2588 + rva: 0xa1c - name: "CreateEventA" - rva: 2592 + rva: 0xa20 - name: "Sleep" - rva: 2596 + rva: 0xa24 - name: "GetProcAddress" - rva: 2600 + rva: 0xa28 - name: "FreeLibrary" - rva: 2604 + rva: 0xa2c - name: "LocalAlloc" - rva: 2608 + rva: 0xa30 - name: "InterlockedExchange" - rva: 2612 + rva: 0xa34 - name: "RaiseException" - rva: 2616 + rva: 0xa38 - name: "GetLastError" - rva: 2620 + rva: 0xa3c - name: "LoadLibraryA" - rva: 2624 + rva: 0xa40 delayed_import_details: - library_name: "USER32.dll" number_of_functions: 2 functions: - name: "CreateMenu" - rva: 4268 + rva: 0x10ac - name: "DestroyMenu" - rva: 4272 + rva: 0x10b0 - library_name: "GDI32.dll" number_of_functions: 2 functions: - name: "DeleteObject" - rva: 4256 + rva: 0x10a0 - name: "CreateBitmap" - rva: 4260 + rva: 0x10a4 - library_name: "ADVAPI32.dll" number_of_functions: 3 functions: - name: "RegOpenKeyExA" - rva: 4228 + rva: 0x1084 - name: "RegCloseKey" - rva: 4232 + rva: 0x1088 - name: "RegQueryValueExA" - rva: 4236 + rva: 0x108c - library_name: "ole32.dll" number_of_functions: 1 functions: - name: "OleInitialize" - rva: 4300 + rva: 0x10cc - library_name: "COMCTL32.dll" number_of_functions: 2 functions: - name: "ord17" ordinal: 17 - rva: 4244 + rva: 0x1094 - name: "InitCommonControlsEx" - rva: 4248 + rva: 0x1098 - library_name: "WS2_32.dll" number_of_functions: 4 functions: - name: "WSAStartup" ordinal: 115 - rva: 4280 + rva: 0x10b8 - name: "closesocket" ordinal: 3 - rva: 4284 + rva: 0x10bc - name: "connect" ordinal: 4 - rva: 4288 + rva: 0x10c0 - name: "socket" ordinal: 23 - rva: 4292 + rva: 0x10c4 is_signed: false overlay: - offset: 0 - size: 0 \ No newline at end of file + offset: 0x0 + size: 0x0 \ No newline at end of file diff --git a/lib/src/modules/pe/tests/testdata/29eeeecf2c458ea3da1ce9d6d54742c0fad490cb2165f371f53b61941eedf072.out b/lib/src/modules/pe/tests/testdata/29eeeecf2c458ea3da1ce9d6d54742c0fad490cb2165f371f53b61941eedf072.out index 6f038eb5a..96d68f813 100644 --- a/lib/src/modules/pe/tests/testdata/29eeeecf2c458ea3da1ce9d6d54742c0fad490cb2165f371f53b61941eedf072.out +++ b/lib/src/modules/pe/tests/testdata/29eeeecf2c458ea3da1ce9d6d54742c0fad490cb2165f371f53b61941eedf072.out @@ -17,26 +17,26 @@ opthdr_magic: IMAGE_NT_OPTIONAL_HDR32_MAGIC characteristics: 0x102 # EXECUTABLE_IMAGE | MACHINE_32BIT dll_characteristics: 0x8140 # DYNAMIC_BASE | NX_COMPAT | TERMINAL_SERVER_AWARE timestamp: 1621233906 # 2021-05-17 06:45:06 UTC -image_base: 16777216 +image_base: 0x1000000 checksum: 462075 -base_of_code: 4096 -base_of_data: 348160 -entry_point: 311950 -entry_point_raw: 315022 -section_alignment: 4096 -file_alignment: 512 -loader_flags: 0 -size_of_optional_header: 224 -size_of_code: 340480 -size_of_initialized_data: 119808 -size_of_uninitialized_data: 0 -size_of_image: 479232 -size_of_headers: 1024 -size_of_stack_reserve: 262144 -size_of_stack_commit: 8192 -size_of_heap_reserve: 1048576 -size_of_heap_commit: 4096 -pointer_to_symbol_table: 0 +base_of_code: 0x1000 +base_of_data: 0x55000 +entry_point: 0x4c28e +entry_point_raw: 0x4ce8e +section_alignment: 0x1000 +file_alignment: 0x200 +loader_flags: 0x0 +size_of_optional_header: 0xe0 +size_of_code: 0x53200 +size_of_initialized_data: 0x1d400 +size_of_uninitialized_data: 0x0 +size_of_image: 0x75000 +size_of_headers: 0x400 +size_of_stack_reserve: 0x40000 +size_of_stack_commit: 0x2000 +size_of_heap_reserve: 0x100000 +size_of_heap_commit: 0x1000 +pointer_to_symbol_table: 0x0 win32_version_value: 0 number_of_symbols: 0 number_of_rva_and_sizes: 32 @@ -79,8 +79,8 @@ version_info_list: - key: "ProductVersion" value: "2, 7, 0, 601" rich_signature: - offset: 128 - length: 88 + offset: 0x80 + length: 0x58 key: 1852233515 raw_data: "o\xb6\x08=+\xd7fn+\xd7fn+\xd7fn\x0c\x11\x1bn!\xd7fn\x0c\x11\x1dn/\xd7fn\x0c\x11\x0bnb\xd7fnr\xf4un:\xd7fn+\xd7gn\x82\xd6fn\x0c\x11\x08n\x15\xd7fn\x0c\x11\x18n*\xd7fn\x0c\x11\x1an*\xd7fn\x0c\x11\x1en*\xd7fn" clear_data: "DanS\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\'\xc6}\x00\n\x00\x00\x00\'\xc6{\x00\x04\x00\x00\x00\'\xc6m\x00I\x00\x00\x00Y#\x13\x00\x11\x00\x00\x00\x00\x00\x01\x00\xa9\x01\x00\x00\'\xc6n\x00>\x00\x00\x00\'\xc6~\x00\x01\x00\x00\x00\'\xc6|\x00\x01\x00\x00\x00\'\xc6x\x00\x01\x00\x00\x00" @@ -116,526 +116,526 @@ pdb_path: "FileTest.pdb" sections: - name: ".text" full_name: ".text" - characteristics: 1610612768 - raw_data_size: 340480 - raw_data_offset: 1024 - virtual_address: 4096 - virtual_size: 340336 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0x60000020 # SECTION_MEM_READ | SECTION_MEM_WRITE | SECTION_SCALE_INDEX + raw_data_size: 0x53200 + raw_data_offset: 0x400 + virtual_address: 0x1000 + virtual_size: 0x53170 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".data" full_name: ".data" - characteristics: 3221225536 - raw_data_size: 40960 - raw_data_offset: 341504 - virtual_address: 348160 - virtual_size: 42620 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0xc0000040 + raw_data_size: 0xa000 + raw_data_offset: 0x53600 + virtual_address: 0x55000 + virtual_size: 0xa67c + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".tls" full_name: ".tls" - characteristics: 3221225536 - raw_data_size: 512 - raw_data_offset: 382464 - virtual_address: 393216 - virtual_size: 9 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0xc0000040 + raw_data_size: 0x200 + raw_data_offset: 0x5d600 + virtual_address: 0x60000 + virtual_size: 0x9 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".rsrc" full_name: ".rsrc" - characteristics: 1073741888 - raw_data_size: 58880 - raw_data_offset: 382976 - virtual_address: 397312 - virtual_size: 58696 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0x40000040 + raw_data_size: 0xe600 + raw_data_offset: 0x5d800 + virtual_address: 0x61000 + virtual_size: 0xe548 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".reloc" full_name: ".reloc" - characteristics: 1107296320 - raw_data_size: 17408 - raw_data_offset: 441856 - virtual_address: 458752 - virtual_size: 17402 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0x42000040 + raw_data_size: 0x4400 + raw_data_offset: 0x6be00 + virtual_address: 0x70000 + virtual_size: 0x43fa + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 data_directories: - - virtual_address: 0 - size: 0 - - virtual_address: 336228 - size: 220 - - virtual_address: 397312 - size: 58696 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 458752 - size: 14104 - - virtual_address: 5600 - size: 28 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 206256 - size: 24 - - virtual_address: 206184 - size: 64 - - virtual_address: 0 - size: 0 - - virtual_address: 4096 - size: 1452 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x52164 + size: 0xdc + - virtual_address: 0x61000 + size: 0xe548 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x70000 + size: 0x3718 + - virtual_address: 0x15e0 + size: 0x1c + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x325b0 + size: 0x18 + - virtual_address: 0x32568 + size: 0x40 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x1000 + size: 0x5ac + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 resource_timestamp: 0 # 1970-01-01 00:00:00 UTC resource_version: major: 0 minor: 0 resources: - - length: 2 - rva: 450448 - offset: 436112 + - length: 0x2 + rva: 0x6df90 + offset: 0x6a790 id: 106 language: 1033 type_string: "A\x00F\x00X\x00_\x00D\x00I\x00A\x00L\x00O\x00G\x00_\x00L\x00A\x00Y\x00O\x00U\x00T\x00" - - length: 2 - rva: 450440 - offset: 436104 + - length: 0x2 + rva: 0x6df88 + offset: 0x6a788 id: 107 language: 1033 type_string: "A\x00F\x00X\x00_\x00D\x00I\x00A\x00L\x00O\x00G\x00_\x00L\x00A\x00Y\x00O\x00U\x00T\x00" - - length: 2 - rva: 450464 - offset: 436128 + - length: 0x2 + rva: 0x6dfa0 + offset: 0x6a7a0 id: 111 language: 1033 type_string: "A\x00F\x00X\x00_\x00D\x00I\x00A\x00L\x00O\x00G\x00_\x00L\x00A\x00Y\x00O\x00U\x00T\x00" - - length: 2 - rva: 450456 - offset: 436120 + - length: 0x2 + rva: 0x6df98 + offset: 0x6a798 id: 112 language: 1033 type_string: "A\x00F\x00X\x00_\x00D\x00I\x00A\x00L\x00O\x00G\x00_\x00L\x00A\x00Y\x00O\x00U\x00T\x00" - - length: 2 - rva: 450432 - offset: 436096 + - length: 0x2 + rva: 0x6df80 + offset: 0x6a780 id: 114 language: 1033 type_string: "A\x00F\x00X\x00_\x00D\x00I\x00A\x00L\x00O\x00G\x00_\x00L\x00A\x00Y\x00O\x00U\x00T\x00" - - length: 1640 - rva: 402864 - offset: 388528 + - length: 0x668 + rva: 0x625b0 + offset: 0x5edb0 type: RESOURCE_TYPE_ICON id: 1 language: 0 - - length: 296 - rva: 404504 - offset: 390168 + - length: 0x128 + rva: 0x62c18 + offset: 0x5f418 type: RESOURCE_TYPE_ICON id: 2 language: 0 - - length: 744 - rva: 404800 - offset: 390464 + - length: 0x2e8 + rva: 0x62d40 + offset: 0x5f540 type: RESOURCE_TYPE_ICON id: 3 language: 0 - - length: 1384 - rva: 405544 - offset: 391208 + - length: 0x568 + rva: 0x63028 + offset: 0x5f828 type: RESOURCE_TYPE_ICON id: 4 language: 0 - - length: 2216 - rva: 406928 - offset: 392592 + - length: 0x8a8 + rva: 0x63590 + offset: 0x5fd90 type: RESOURCE_TYPE_ICON id: 5 language: 0 - - length: 3752 - rva: 409144 - offset: 394808 + - length: 0xea8 + rva: 0x63e38 + offset: 0x60638 type: RESOURCE_TYPE_ICON id: 6 language: 0 - - length: 296 - rva: 412992 - offset: 398656 + - length: 0x128 + rva: 0x64d40 + offset: 0x61540 type: RESOURCE_TYPE_ICON id: 7 language: 0 - - length: 1384 - rva: 413288 - offset: 398952 + - length: 0x568 + rva: 0x64e68 + offset: 0x61668 type: RESOURCE_TYPE_ICON id: 8 language: 0 - - length: 296 - rva: 414712 - offset: 400376 + - length: 0x128 + rva: 0x653f8 + offset: 0x61bf8 type: RESOURCE_TYPE_ICON id: 9 language: 0 - - length: 1384 - rva: 415008 - offset: 400672 + - length: 0x568 + rva: 0x65520 + offset: 0x61d20 type: RESOURCE_TYPE_ICON id: 10 language: 0 - - length: 296 - rva: 416432 - offset: 402096 + - length: 0x128 + rva: 0x65ab0 + offset: 0x622b0 type: RESOURCE_TYPE_ICON id: 11 language: 0 - - length: 1384 - rva: 416728 - offset: 402392 + - length: 0x568 + rva: 0x65bd8 + offset: 0x623d8 type: RESOURCE_TYPE_ICON id: 12 language: 0 - - length: 296 - rva: 418152 - offset: 403816 + - length: 0x128 + rva: 0x66168 + offset: 0x62968 type: RESOURCE_TYPE_ICON id: 13 language: 0 - - length: 1384 - rva: 418448 - offset: 404112 + - length: 0x568 + rva: 0x66290 + offset: 0x62a90 type: RESOURCE_TYPE_ICON id: 14 language: 0 - - length: 1128 - rva: 419872 - offset: 405536 + - length: 0x468 + rva: 0x66820 + offset: 0x63020 type: RESOURCE_TYPE_ICON id: 15 language: 0 - - length: 248 - rva: 421912 - offset: 407576 + - length: 0xf8 + rva: 0x67018 + offset: 0x63818 type: RESOURCE_TYPE_MENU id: 123 language: 1033 - - length: 164 - rva: 422160 - offset: 407824 + - length: 0xa4 + rva: 0x67110 + offset: 0x63910 type: RESOURCE_TYPE_MENU id: 129 language: 1033 - - length: 648 - rva: 422328 - offset: 407992 + - length: 0x288 + rva: 0x671b8 + offset: 0x639b8 type: RESOURCE_TYPE_MENU id: 139 language: 1033 - - length: 312 - rva: 422976 - offset: 408640 + - length: 0x138 + rva: 0x67440 + offset: 0x63c40 type: RESOURCE_TYPE_MENU id: 141 language: 1033 - - length: 136 - rva: 423288 - offset: 408952 + - length: 0x88 + rva: 0x67578 + offset: 0x63d78 type: RESOURCE_TYPE_MENU id: 144 language: 1033 - - length: 128 - rva: 423584 - offset: 409248 + - length: 0x80 + rva: 0x676a0 + offset: 0x63ea0 type: RESOURCE_TYPE_MENU id: 145 language: 1033 - - length: 156 - rva: 423424 - offset: 409088 + - length: 0x9c + rva: 0x67600 + offset: 0x63e00 type: RESOURCE_TYPE_MENU id: 146 language: 1033 - - length: 1320 - rva: 423896 - offset: 409560 + - length: 0x528 + rva: 0x677d8 + offset: 0x63fd8 type: RESOURCE_TYPE_DIALOG id: 102 language: 1033 - - length: 1940 - rva: 425216 - offset: 410880 + - length: 0x794 + rva: 0x67d00 + offset: 0x64500 type: RESOURCE_TYPE_DIALOG id: 103 language: 1033 - - length: 2464 - rva: 427160 - offset: 412824 + - length: 0x9a0 + rva: 0x68498 + offset: 0x64c98 type: RESOURCE_TYPE_DIALOG id: 104 language: 1033 - - length: 1450 - rva: 429624 - offset: 415288 + - length: 0x5aa + rva: 0x68e38 + offset: 0x65638 type: RESOURCE_TYPE_DIALOG id: 105 language: 1033 - - length: 2368 - rva: 441136 - offset: 426800 + - length: 0x940 + rva: 0x6bb30 + offset: 0x68330 type: RESOURCE_TYPE_DIALOG id: 106 language: 1033 - - length: 2172 - rva: 431080 - offset: 416744 + - length: 0x87c + rva: 0x693e8 + offset: 0x65be8 type: RESOURCE_TYPE_DIALOG id: 107 language: 1033 - - length: 1076 - rva: 433256 - offset: 418920 + - length: 0x434 + rva: 0x69c68 + offset: 0x66468 type: RESOURCE_TYPE_DIALOG id: 108 language: 1033 - - length: 928 - rva: 434336 - offset: 420000 + - length: 0x3a0 + rva: 0x6a0a0 + offset: 0x668a0 type: RESOURCE_TYPE_DIALOG id: 109 language: 1033 - - length: 764 - rva: 435264 - offset: 420928 + - length: 0x2fc + rva: 0x6a440 + offset: 0x66c40 type: RESOURCE_TYPE_DIALOG id: 110 language: 1033 - - length: 1112 - rva: 436032 - offset: 421696 + - length: 0x458 + rva: 0x6a740 + offset: 0x66f40 type: RESOURCE_TYPE_DIALOG id: 111 language: 1033 - - length: 1544 - rva: 437144 - offset: 422808 + - length: 0x608 + rva: 0x6ab98 + offset: 0x67398 type: RESOURCE_TYPE_DIALOG id: 112 language: 1033 - - length: 644 - rva: 438688 - offset: 424352 + - length: 0x284 + rva: 0x6b1a0 + offset: 0x679a0 type: RESOURCE_TYPE_DIALOG id: 113 language: 1033 - - length: 1500 - rva: 444944 - offset: 430608 + - length: 0x5dc + rva: 0x6ca10 + offset: 0x69210 type: RESOURCE_TYPE_DIALOG id: 114 language: 1033 - - length: 240 - rva: 449536 - offset: 435200 + - length: 0xf0 + rva: 0x6dc00 + offset: 0x6a400 type: RESOURCE_TYPE_DIALOG id: 118 language: 1033 - - length: 266 - rva: 439336 - offset: 425000 + - length: 0x10a + rva: 0x6b428 + offset: 0x67c28 type: RESOURCE_TYPE_DIALOG id: 119 language: 1033 - - length: 452 - rva: 439608 - offset: 425272 + - length: 0x1c4 + rva: 0x6b538 + offset: 0x67d38 type: RESOURCE_TYPE_DIALOG id: 124 language: 1033 - - length: 532 - rva: 440064 - offset: 425728 + - length: 0x214 + rva: 0x6b700 + offset: 0x67f00 type: RESOURCE_TYPE_DIALOG id: 128 language: 1033 - - length: 180 - rva: 423712 - offset: 409376 + - length: 0xb4 + rva: 0x67720 + offset: 0x63f20 type: RESOURCE_TYPE_DIALOG id: 132 language: 1033 - - length: 530 - rva: 440600 - offset: 426264 + - length: 0x212 + rva: 0x6b918 + offset: 0x68118 type: RESOURCE_TYPE_DIALOG id: 133 language: 1033 - - length: 214 - rva: 443504 - offset: 429168 + - length: 0xd6 + rva: 0x6c470 + offset: 0x68c70 type: RESOURCE_TYPE_DIALOG id: 137 language: 1033 - - length: 466 - rva: 443720 - offset: 429384 + - length: 0x1d2 + rva: 0x6c548 + offset: 0x68d48 type: RESOURCE_TYPE_DIALOG id: 138 language: 1033 - - length: 312 - rva: 444192 - offset: 429856 + - length: 0x138 + rva: 0x6c720 + offset: 0x68f20 type: RESOURCE_TYPE_DIALOG id: 140 language: 1033 - - length: 438 - rva: 444504 - offset: 430168 + - length: 0x1b6 + rva: 0x6c858 + offset: 0x69058 type: RESOURCE_TYPE_DIALOG id: 143 language: 1033 - - length: 798 - rva: 446448 - offset: 432112 + - length: 0x31e + rva: 0x6cff0 + offset: 0x697f0 type: RESOURCE_TYPE_DIALOG id: 144 language: 1033 - - length: 826 - rva: 447248 - offset: 432912 + - length: 0x33a + rva: 0x6d310 + offset: 0x69b10 type: RESOURCE_TYPE_DIALOG id: 145 language: 1033 - - length: 806 - rva: 448080 - offset: 433744 + - length: 0x326 + rva: 0x6d650 + offset: 0x69e50 type: RESOURCE_TYPE_DIALOG id: 146 language: 1033 - - length: 648 - rva: 448888 - offset: 434552 + - length: 0x288 + rva: 0x6d978 + offset: 0x6a178 type: RESOURCE_TYPE_DIALOG id: 147 language: 1033 - - length: 62 - rva: 455944 - offset: 441608 + - length: 0x3e + rva: 0x6f508 + offset: 0x6bd08 type: RESOURCE_TYPE_STRING id: 10 language: 1033 - - length: 968 - rva: 450472 - offset: 436136 + - length: 0x3c8 + rva: 0x6dfa8 + offset: 0x6a7a8 type: RESOURCE_TYPE_STRING id: 251 language: 1033 - - length: 702 - rva: 451440 - offset: 437104 + - length: 0x2be + rva: 0x6e370 + offset: 0x6ab70 type: RESOURCE_TYPE_STRING id: 252 language: 1033 - - length: 1066 - rva: 452144 - offset: 437808 + - length: 0x42a + rva: 0x6e630 + offset: 0x6ae30 type: RESOURCE_TYPE_STRING id: 253 language: 1033 - - length: 710 - rva: 453216 - offset: 438880 + - length: 0x2c6 + rva: 0x6ea60 + offset: 0x6b260 type: RESOURCE_TYPE_STRING id: 254 language: 1033 - - length: 1444 - rva: 453928 - offset: 439592 + - length: 0x5a4 + rva: 0x6ed28 + offset: 0x6b528 type: RESOURCE_TYPE_STRING id: 255 language: 1033 - - length: 568 - rva: 455376 - offset: 441040 + - length: 0x238 + rva: 0x6f2d0 + offset: 0x6bad0 type: RESOURCE_TYPE_STRING id: 256 language: 1033 - - length: 8 - rva: 401072 - offset: 386736 + - length: 0x8 + rva: 0x61eb0 + offset: 0x5e6b0 type: RESOURCE_TYPE_ACCELERATOR id: 121 language: 0 - - length: 90 - rva: 412896 - offset: 398560 + - length: 0x5a + rva: 0x64ce0 + offset: 0x614e0 type: RESOURCE_TYPE_GROUP_ICON id: 101 language: 0 - - length: 34 - rva: 414672 - offset: 400336 + - length: 0x22 + rva: 0x653d0 + offset: 0x61bd0 type: RESOURCE_TYPE_GROUP_ICON id: 125 language: 0 - - length: 34 - rva: 416392 - offset: 402056 + - length: 0x22 + rva: 0x65a88 + offset: 0x62288 type: RESOURCE_TYPE_GROUP_ICON id: 126 language: 0 - - length: 34 - rva: 418112 - offset: 403776 + - length: 0x22 + rva: 0x66140 + offset: 0x62940 type: RESOURCE_TYPE_GROUP_ICON id: 127 language: 0 - - length: 34 - rva: 419832 - offset: 405496 + - length: 0x22 + rva: 0x667f8 + offset: 0x62ff8 type: RESOURCE_TYPE_GROUP_ICON id: 140 language: 0 - - length: 20 - rva: 421000 - offset: 406664 + - length: 0x14 + rva: 0x66c88 + offset: 0x63488 type: RESOURCE_TYPE_GROUP_ICON id: 143 language: 0 - - length: 888 - rva: 421024 - offset: 406688 + - length: 0x378 + rva: 0x66ca0 + offset: 0x634a0 type: RESOURCE_TYPE_VERSION id: 1 language: 1033 - - length: 1779 - rva: 401080 - offset: 386744 + - length: 0x6f3 + rva: 0x61eb8 + offset: 0x5e6b8 type: RESOURCE_TYPE_MANIFEST id: 1 language: 0 - - length: 282 - rva: 450144 - offset: 435808 + - length: 0x11a + rva: 0x6de60 + offset: 0x6a660 type: 240 id: 103 language: 1033 - - length: 363 - rva: 449776 - offset: 435440 + - length: 0x16b + rva: 0x6dcf0 + offset: 0x6a4f0 type: 240 id: 104 language: 1033 @@ -644,740 +644,740 @@ import_details: number_of_functions: 35 functions: - name: "GetUserNameW" - rva: 4096 + rva: 0x1000 - name: "OpenProcessToken" - rva: 4100 + rva: 0x1004 - name: "OpenThreadToken" - rva: 4104 + rva: 0x1008 - name: "RegCloseKey" - rva: 4108 + rva: 0x100c - name: "RegQueryValueExW" - rva: 4112 + rva: 0x1010 - name: "RegOpenKeyExW" - rva: 4116 + rva: 0x1014 - name: "GetSidSubAuthority" - rva: 4120 + rva: 0x1018 - name: "GetSidIdentifierAuthority" - rva: 4124 + rva: 0x101c - name: "GetSidSubAuthorityCount" - rva: 4128 + rva: 0x1020 - name: "GetTokenInformation" - rva: 4132 + rva: 0x1024 - name: "LookupPrivilegeNameW" - rva: 4136 + rva: 0x1028 - name: "AdjustTokenPrivileges" - rva: 4140 + rva: 0x102c - name: "LookupPrivilegeValueW" - rva: 4144 + rva: 0x1030 - name: "FreeSid" - rva: 4148 + rva: 0x1034 - name: "SetTokenInformation" - rva: 4152 + rva: 0x1038 - name: "AllocateAndInitializeSid" - rva: 4156 + rva: 0x103c - name: "RegSetValueExW" - rva: 4160 + rva: 0x1040 - name: "CopySid" - rva: 4164 + rva: 0x1044 - name: "GetLengthSid" - rva: 4168 + rva: 0x1048 - name: "InitializeAcl" - rva: 4172 + rva: 0x104c - name: "AddAccessAllowedAce" - rva: 4176 + rva: 0x1050 - name: "AddAccessDeniedAce" - rva: 4180 + rva: 0x1054 - name: "AddAuditAccessAce" - rva: 4184 + rva: 0x1058 - name: "GetAce" - rva: 4188 + rva: 0x105c - name: "LookupAccountSidW" - rva: 4192 + rva: 0x1060 - name: "LookupAccountNameW" - rva: 4196 + rva: 0x1064 - name: "SetSecurityDescriptorSacl" - rva: 4200 + rva: 0x1068 - name: "SetSecurityDescriptorDacl" - rva: 4204 + rva: 0x106c - name: "SetSecurityDescriptorGroup" - rva: 4208 + rva: 0x1070 - name: "SetSecurityDescriptorOwner" - rva: 4212 + rva: 0x1074 - name: "InitializeSecurityDescriptor" - rva: 4216 + rva: 0x1078 - name: "GetSecurityDescriptorSacl" - rva: 4220 + rva: 0x107c - name: "GetSecurityDescriptorDacl" - rva: 4224 + rva: 0x1080 - name: "GetSecurityDescriptorGroup" - rva: 4228 + rva: 0x1084 - name: "GetSecurityDescriptorOwner" - rva: 4232 + rva: 0x1088 - library_name: "KERNEL32.dll" number_of_functions: 85 functions: - name: "InitializeCriticalSection" - rva: 4312 + rva: 0x10d8 - name: "LockResource" - rva: 4316 + rva: 0x10dc - name: "LoadResource" - rva: 4320 + rva: 0x10e0 - name: "FindResourceW" - rva: 4324 + rva: 0x10e4 - name: "DeleteCriticalSection" - rva: 4328 + rva: 0x10e8 - name: "WaitForSingleObject" - rva: 4332 + rva: 0x10ec - name: "CreateEventW" - rva: 4336 + rva: 0x10f0 - name: "WaitForMultipleObjects" - rva: 4340 + rva: 0x10f4 - name: "LeaveCriticalSection" - rva: 4344 + rva: 0x10f8 - name: "EnterCriticalSection" - rva: 4348 + rva: 0x10fc - name: "GetCurrentProcess" - rva: 4352 + rva: 0x1100 - name: "GetCurrentThread" - rva: 4356 + rva: 0x1104 - name: "GetProcessHeap" - rva: 4360 + rva: 0x1108 - name: "HeapReAlloc" - rva: 4364 + rva: 0x110c - name: "MultiByteToWideChar" - rva: 4368 + rva: 0x1110 - name: "SetCurrentDirectoryW" - rva: 4372 + rva: 0x1114 - name: "CreateDirectoryW" - rva: 4376 + rva: 0x1118 - name: "GetOverlappedResult" - rva: 4380 + rva: 0x111c - name: "LockFile" - rva: 4384 + rva: 0x1120 - name: "UnlockFile" - rva: 4388 + rva: 0x1124 - name: "SetFilePointer" - rva: 4392 + rva: 0x1128 - name: "SetEndOfFile" - rva: 4396 + rva: 0x112c - name: "MoveFileExW" - rva: 4400 + rva: 0x1130 - name: "GetFileAttributesW" - rva: 4404 + rva: 0x1134 - name: "FlushFileBuffers" - rva: 4408 + rva: 0x1138 - name: "DeleteFileW" - rva: 4412 + rva: 0x113c - name: "OpenProcess" - rva: 4416 + rva: 0x1140 - name: "GlobalFree" - rva: 4420 + rva: 0x1144 - name: "GlobalUnlock" - rva: 4424 + rva: 0x1148 - name: "GlobalLock" - rva: 4428 + rva: 0x114c - name: "GlobalAlloc" - rva: 4432 + rva: 0x1150 - name: "GlobalReAlloc" - rva: 4436 + rva: 0x1154 - name: "GlobalSize" - rva: 4440 + rva: 0x1158 - name: "LoadLibraryW" - rva: 4444 + rva: 0x115c - name: "FreeLibrary" - rva: 4448 + rva: 0x1160 - name: "EnumResourceNamesW" - rva: 4452 + rva: 0x1164 - name: "SetEvent" - rva: 4456 + rva: 0x1168 - name: "CreateThread" - rva: 4460 + rva: 0x116c - name: "GetModuleFileNameW" - rva: 4464 + rva: 0x1170 - name: "GetFileTime" - rva: 4468 + rva: 0x1174 - name: "VirtualAlloc" - rva: 4472 + rva: 0x1178 - name: "SetFileTime" - rva: 4476 + rva: 0x117c - name: "VirtualFree" - rva: 4480 + rva: 0x1180 - name: "GetTickCount" - rva: 4484 + rva: 0x1184 - name: "ReadFile" - rva: 4488 + rva: 0x1188 - name: "HeapAlloc" - rva: 4492 + rva: 0x118c - name: "LocalFileTimeToFileTime" - rva: 4496 + rva: 0x1190 - name: "SystemTimeToFileTime" - rva: 4500 + rva: 0x1194 - name: "InterlockedExchange" - rva: 4504 + rva: 0x1198 - name: "Sleep" - rva: 4508 + rva: 0x119c - name: "InterlockedCompareExchange" - rva: 4512 + rva: 0x11a0 - name: "GetStartupInfoW" - rva: 4516 + rva: 0x11a4 - name: "OutputDebugStringA" - rva: 4520 + rva: 0x11a8 - name: "RtlUnwind" - rva: 4524 + rva: 0x11ac - name: "SetUnhandledExceptionFilter" - rva: 4528 + rva: 0x11b0 - name: "GetModuleHandleA" - rva: 4532 + rva: 0x11b4 - name: "QueryPerformanceCounter" - rva: 4536 + rva: 0x11b8 - name: "GetCurrentThreadId" - rva: 4540 + rva: 0x11bc - name: "GetCurrentProcessId" - rva: 4544 + rva: 0x11c0 - name: "TerminateProcess" - rva: 4548 + rva: 0x11c4 - name: "UnhandledExceptionFilter" - rva: 4552 + rva: 0x11c8 - name: "GetVersionExW" - rva: 4556 + rva: 0x11cc - name: "FormatMessageW" - rva: 4560 + rva: 0x11d0 - name: "GetSystemTimeAsFileTime" - rva: 4564 + rva: 0x11d4 - name: "FreeResource" - rva: 4568 + rva: 0x11d8 - name: "SizeofResource" - rva: 4572 + rva: 0x11dc - name: "WideCharToMultiByte" - rva: 4576 + rva: 0x11e0 - name: "WriteFile" - rva: 4580 + rva: 0x11e4 - name: "HeapFree" - rva: 4584 + rva: 0x11e8 - name: "CloseHandle" - rva: 4588 + rva: 0x11ec - name: "GetModuleHandleW" - rva: 4592 + rva: 0x11f0 - name: "GetProcAddress" - rva: 4596 + rva: 0x11f4 - name: "SetLastError" - rva: 4600 + rva: 0x11f8 - name: "GetFileSize" - rva: 4604 + rva: 0x11fc - name: "DeviceIoControl" - rva: 4608 + rva: 0x1200 - name: "GetLastError" - rva: 4612 + rva: 0x1204 - name: "GetCurrentDirectoryW" - rva: 4616 + rva: 0x1208 - name: "CreateFileW" - rva: 4620 + rva: 0x120c - name: "EnumTimeFormatsW" - rva: 4624 + rva: 0x1210 - name: "EnumDateFormatsW" - rva: 4628 + rva: 0x1214 - name: "FileTimeToLocalFileTime" - rva: 4632 + rva: 0x1218 - name: "FileTimeToSystemTime" - rva: 4636 + rva: 0x121c - name: "GetTimeFormatW" - rva: 4640 + rva: 0x1220 - name: "GetDateFormatW" - rva: 4644 + rva: 0x1224 - name: "GetLocaleInfoW" - rva: 4648 + rva: 0x1228 - library_name: "GDI32.dll" number_of_functions: 11 functions: - name: "TextOutW" - rva: 4264 + rva: 0x10a8 - name: "GetTextExtentPoint32W" - rva: 4268 + rva: 0x10ac - name: "SetTextAlign" - rva: 4272 + rva: 0x10b0 - name: "SetBkColor" - rva: 4276 + rva: 0x10b4 - name: "ExtTextOutW" - rva: 4280 + rva: 0x10b8 - name: "SetTextColor" - rva: 4284 + rva: 0x10bc - name: "CreateFontIndirectW" - rva: 4288 + rva: 0x10c0 - name: "GetStockObject" - rva: 4292 + rva: 0x10c4 - name: "SelectObject" - rva: 4296 + rva: 0x10c8 - name: "GetTextMetricsW" - rva: 4300 + rva: 0x10cc - name: "GetObjectW" - rva: 4304 + rva: 0x10d0 - library_name: "USER32.dll" number_of_functions: 107 functions: - name: "GetTopWindow" - rva: 4676 + rva: 0x1244 - name: "GetDlgItemTextW" - rva: 4680 + rva: 0x1248 - name: "CloseClipboard" - rva: 4684 + rva: 0x124c - name: "SetClipboardData" - rva: 4688 + rva: 0x1250 - name: "EmptyClipboard" - rva: 4692 + rva: 0x1254 - name: "OpenClipboard" - rva: 4696 + rva: 0x1258 - name: "ClientToScreen" - rva: 4700 + rva: 0x125c - name: "GetFocus" - rva: 4704 + rva: 0x1260 - name: "IsWindowVisible" - rva: 4708 + rva: 0x1264 - name: "EnableMenuItem" - rva: 4712 + rva: 0x1268 - name: "GetSubMenu" - rva: 4716 + rva: 0x126c - name: "ScreenToClient" - rva: 4720 + rva: 0x1270 - name: "GetDlgItemInt" - rva: 4724 + rva: 0x1274 - name: "GetClipboardData" - rva: 4728 + rva: 0x1278 - name: "IsClipboardFormatAvailable" - rva: 4732 + rva: 0x127c - name: "ReleaseDC" - rva: 4736 + rva: 0x1280 - name: "GetDC" - rva: 4740 + rva: 0x1284 - name: "SetScrollInfo" - rva: 4744 + rva: 0x1288 - name: "ShowCaret" - rva: 4748 + rva: 0x128c - name: "SetCaretPos" - rva: 4752 + rva: 0x1290 - name: "CreateCaret" - rva: 4756 + rva: 0x1294 - name: "DestroyCaret" - rva: 4760 + rva: 0x1298 - name: "GetClassNameW" - rva: 4764 + rva: 0x129c - name: "ReleaseCapture" - rva: 4768 + rva: 0x12a0 - name: "GetTabbedTextExtentW" - rva: 4772 + rva: 0x12a4 - name: "SetCapture" - rva: 4776 + rva: 0x12a8 - name: "GetScrollInfo" - rva: 4780 + rva: 0x12ac - name: "EndPaint" - rva: 4784 + rva: 0x12b0 - name: "TabbedTextOutW" - rva: 4788 + rva: 0x12b4 - name: "IntersectRect" - rva: 4792 + rva: 0x12b8 - name: "BeginPaint" - rva: 4796 + rva: 0x12bc - name: "DefWindowProcW" - rva: 4800 + rva: 0x12c0 - name: "RegisterClassExW" - rva: 4804 + rva: 0x12c4 - name: "LoadCursorW" - rva: 4808 + rva: 0x12c8 - name: "GetClassInfoExW" - rva: 4812 + rva: 0x12cc - name: "LoadImageW" - rva: 4816 + rva: 0x12d0 - name: "LoadMenuW" - rva: 4820 + rva: 0x12d4 - name: "TrackPopupMenu" - rva: 4824 + rva: 0x12d8 - name: "SetForegroundWindow" - rva: 4828 + rva: 0x12dc - name: "LoadAcceleratorsW" - rva: 4832 + rva: 0x12e0 - name: "CreateDialogParamW" - rva: 4836 + rva: 0x12e4 - name: "ShowWindow" - rva: 4840 + rva: 0x12e8 - name: "IsWindow" - rva: 4844 + rva: 0x12ec - name: "TranslateAcceleratorW" - rva: 4848 + rva: 0x12f0 - name: "TranslateMessage" - rva: 4852 + rva: 0x12f4 - name: "IsWindowEnabled" - rva: 4856 + rva: 0x12f8 - name: "GetClientRect" - rva: 4860 + rva: 0x12fc - name: "LoadStringA" - rva: 4864 + rva: 0x1300 - name: "CreateWindowExW" - rva: 4868 + rva: 0x1304 - name: "HideCaret" - rva: 4872 + rva: 0x1308 - name: "GetWindow" - rva: 4876 + rva: 0x130c - name: "CreateCursor" - rva: 4880 + rva: 0x1310 - name: "SetCursor" - rva: 4884 + rva: 0x1314 - name: "CallWindowProcW" - rva: 4888 + rva: 0x1318 - name: "CreateDialogIndirectParamW" - rva: 4892 + rva: 0x131c - name: "SendDlgItemMessageA" - rva: 4896 + rva: 0x1320 - name: "DialogBoxIndirectParamW" - rva: 4900 + rva: 0x1324 - name: "FillRect" - rva: 4904 + rva: 0x1328 - name: "DeleteMenu" - rva: 4908 + rva: 0x132c - name: "MessageBeep" - rva: 4912 + rva: 0x1330 - name: "DrawTextExW" - rva: 4916 + rva: 0x1334 - name: "BeginDeferWindowPos" - rva: 4920 + rva: 0x1338 - name: "DeferWindowPos" - rva: 4924 + rva: 0x133c - name: "EndDeferWindowPos" - rva: 4928 + rva: 0x1340 - name: "LoadIconW" - rva: 4932 + rva: 0x1344 - name: "DispatchMessageW" - rva: 4936 + rva: 0x1348 - name: "DestroyAcceleratorTable" - rva: 4940 + rva: 0x134c - name: "GetParent" - rva: 4944 + rva: 0x1350 - name: "IsDialogMessageW" - rva: 4948 + rva: 0x1354 - name: "GetAsyncKeyState" - rva: 4952 + rva: 0x1358 - name: "DestroyWindow" - rva: 4956 + rva: 0x135c - name: "GetCursorPos" - rva: 4960 + rva: 0x1360 - name: "GetActiveWindow" - rva: 4964 + rva: 0x1364 - name: "PtInRect" - rva: 4968 + rva: 0x1368 - name: "GetSystemMenu" - rva: 4972 + rva: 0x136c - name: "GetMenuItemCount" - rva: 4976 + rva: 0x1370 - name: "GetMenuItemInfoW" - rva: 4980 + rva: 0x1374 - name: "LoadStringW" - rva: 4984 + rva: 0x1378 - name: "InsertMenuW" - rva: 4988 + rva: 0x137c - name: "MapDialogRect" - rva: 4992 + rva: 0x1380 - name: "GetSystemMetrics" - rva: 4996 + rva: 0x1384 - name: "SystemParametersInfoW" - rva: 5000 + rva: 0x1388 - name: "KillTimer" - rva: 5004 + rva: 0x138c - name: "SetWindowPos" - rva: 5008 + rva: 0x1390 - name: "GetWindowRect" - rva: 5012 + rva: 0x1394 - name: "InvalidateRect" - rva: 5016 + rva: 0x1398 - name: "CheckDlgButton" - rva: 5020 + rva: 0x139c - name: "SetWindowTextA" - rva: 5024 + rva: 0x13a0 - name: "SetDlgItemTextW" - rva: 5028 + rva: 0x13a4 - name: "GetWindowTextLengthW" - rva: 5032 + rva: 0x13a8 - name: "SetFocus" - rva: 5036 + rva: 0x13ac - name: "GetWindowTextA" - rva: 5040 + rva: 0x13b0 - name: "GetWindowTextW" - rva: 5044 + rva: 0x13b4 - name: "IsDlgButtonChecked" - rva: 5048 + rva: 0x13b8 - name: "EnableWindow" - rva: 5052 + rva: 0x13bc - name: "CharUpperW" - rva: 5056 + rva: 0x13c0 - name: "DialogBoxParamW" - rva: 5060 + rva: 0x13c4 - name: "SetWindowTextW" - rva: 5064 + rva: 0x13c8 - name: "EndDialog" - rva: 5068 + rva: 0x13cc - name: "GetDlgItem" - rva: 5072 + rva: 0x13d0 - name: "PostMessageW" - rva: 5076 + rva: 0x13d4 - name: "GetWindowLongW" - rva: 5080 + rva: 0x13d8 - name: "SetWindowLongW" - rva: 5084 + rva: 0x13dc - name: "SendMessageW" - rva: 5088 + rva: 0x13e0 - name: "IsCharAlphaW" - rva: 5092 + rva: 0x13e4 - name: "GetMessageW" - rva: 5096 + rva: 0x13e8 - name: "SetTimer" - rva: 5100 + rva: 0x13ec - library_name: "msvcrt.dll" number_of_functions: 52 functions: - name: "_controlfp" - rva: 5136 + rva: 0x1410 - name: "?terminate@@YAXXZ" - rva: 5140 + rva: 0x1414 - name: "_wcsnicmp" - rva: 5144 + rva: 0x1418 - name: "wcsstr" - rva: 5148 + rva: 0x141c - name: "_wcsicmp" - rva: 5152 + rva: 0x1420 - name: "_vsnwprintf" - rva: 5156 + rva: 0x1424 - name: "_wcsrev" - rva: 5160 + rva: 0x1428 - name: "memset" - rva: 5164 + rva: 0x142c - name: "isxdigit" - rva: 5168 + rva: 0x1430 - name: "memcpy" - rva: 5172 + rva: 0x1434 - name: "wcschr" - rva: 5176 + rva: 0x1438 - name: "_vsnprintf" - rva: 5180 + rva: 0x143c - name: "??0exception@@QAE@ABQBD@Z" - rva: 5184 + rva: 0x1440 - name: "wcstoul" - rva: 5188 + rva: 0x1444 - name: "wcsncmp" - rva: 5192 + rva: 0x1448 - name: "?what@exception@@UBEPBDXZ" - rva: 5196 + rva: 0x144c - name: "??1exception@@UAE@XZ" - rva: 5200 + rva: 0x1450 - name: "??0exception@@QAE@ABV0@@Z" - rva: 5204 + rva: 0x1454 - name: "_CxxThrowException" - rva: 5208 + rva: 0x1458 - name: "??0exception@@QAE@XZ" - rva: 5212 + rva: 0x145c - name: "wcsrchr" - rva: 5216 + rva: 0x1460 - name: "rand" - rva: 5220 + rva: 0x1464 - name: "srand" - rva: 5224 + rva: 0x1468 - name: "toupper" - rva: 5228 + rva: 0x146c - name: "memmove" - rva: 5232 + rva: 0x1470 - name: "isalpha" - rva: 5236 + rva: 0x1474 - name: "__wargv" - rva: 5240 + rva: 0x1478 - name: "__argc" - rva: 5244 + rva: 0x147c - name: "__CxxFrameHandler" - rva: 5248 + rva: 0x1480 - name: "_errno" - rva: 5252 + rva: 0x1484 - name: "free" - rva: 5256 + rva: 0x1488 - name: "_onexit" - rva: 5260 + rva: 0x148c - name: "_lock" - rva: 5264 + rva: 0x1490 - name: "__dllonexit" - rva: 5268 + rva: 0x1494 - name: "_unlock" - rva: 5272 + rva: 0x1498 - name: "??1type_info@@UAE@XZ" - rva: 5276 + rva: 0x149c - name: "__set_app_type" - rva: 5280 + rva: 0x14a0 - name: "__p__fmode" - rva: 5284 + rva: 0x14a4 - name: "__p__commode" - rva: 5288 + rva: 0x14a8 - name: "_adjust_fdiv" - rva: 5292 + rva: 0x14ac - name: "__setusermatherr" - rva: 5296 + rva: 0x14b0 - name: "_amsg_exit" - rva: 5300 + rva: 0x14b4 - name: "_initterm" - rva: 5304 + rva: 0x14b8 - name: "_wcmdln" - rva: 5308 + rva: 0x14bc - name: "exit" - rva: 5312 + rva: 0x14c0 - name: "_XcptFilter" - rva: 5316 + rva: 0x14c4 - name: "_exit" - rva: 5320 + rva: 0x14c8 - name: "_cexit" - rva: 5324 + rva: 0x14cc - name: "__wgetmainargs" - rva: 5328 + rva: 0x14d0 - name: "malloc" - rva: 5332 + rva: 0x14d4 - name: "_callnewh" - rva: 5336 + rva: 0x14d8 - name: "wcstol" - rva: 5340 + rva: 0x14dc - library_name: "COMCTL32.dll" number_of_functions: 5 functions: - name: "CreatePropertySheetPageW" - rva: 4240 + rva: 0x1090 - name: "ord17" ordinal: 17 - rva: 4244 + rva: 0x1094 - name: "ImageList_ReplaceIcon" - rva: 4248 + rva: 0x1098 - name: "ImageList_Create" - rva: 4252 + rva: 0x109c - name: "PropertySheetW" - rva: 4256 + rva: 0x10a0 - library_name: "ntdll.dll" number_of_functions: 49 functions: - name: "RtlCreateUnicodeString" - rva: 5348 + rva: 0x14e4 - name: "RtlFreeUnicodeString" - rva: 5352 + rva: 0x14e8 - name: "NtOpenDirectoryObject" - rva: 5356 + rva: 0x14ec - name: "RtlDecompressBuffer" - rva: 5360 + rva: 0x14f0 - name: "NtDeviceIoControlFile" - rva: 5364 + rva: 0x14f4 - name: "RtlReAllocateHeap" - rva: 5368 + rva: 0x14f8 - name: "NtOpenSymbolicLinkObject" - rva: 5372 + rva: 0x14fc - name: "NtQuerySymbolicLinkObject" - rva: 5376 + rva: 0x1500 - name: "NtCreateSymbolicLinkObject" - rva: 5380 + rva: 0x1504 - name: "NtQuerySecurityObject" - rva: 5384 + rva: 0x1508 - name: "NtSetEaFile" - rva: 5388 + rva: 0x150c - name: "NtQueryEaFile" - rva: 5392 + rva: 0x1510 - name: "NtQueryVolumeInformationFile" - rva: 5396 + rva: 0x1514 - name: "NtSetVolumeInformationFile" - rva: 5400 + rva: 0x1518 - name: "RtlCompareUnicodeString" - rva: 5404 + rva: 0x151c - name: "NtQuerySystemInformation" - rva: 5408 + rva: 0x1520 - name: "NtQueryInformationProcess" - rva: 5412 + rva: 0x1524 - name: "NtDeleteFile" - rva: 5416 + rva: 0x1528 - name: "NtSetInformationFile" - rva: 5420 + rva: 0x152c - name: "RtlAllocateAndInitializeSid" - rva: 5424 + rva: 0x1530 - name: "RtlLengthSid" - rva: 5428 + rva: 0x1534 - name: "RtlCreateAcl" - rva: 5432 + rva: 0x1538 - name: "RtlAddAccessAllowedAce" - rva: 5436 + rva: 0x153c - name: "RtlSetDaclSecurityDescriptor" - rva: 5440 + rva: 0x1540 - name: "RtlFreeSid" - rva: 5444 + rva: 0x1544 - name: "NtOpenProcessToken" - rva: 5448 + rva: 0x1548 - name: "NtQueryInformationToken" - rva: 5452 + rva: 0x154c - name: "RtlAllocateHeap" - rva: 5456 + rva: 0x1550 - name: "RtlCreateSecurityDescriptor" - rva: 5460 + rva: 0x1554 - name: "RtlSetOwnerSecurityDescriptor" - rva: 5464 + rva: 0x1558 - name: "NtSetSecurityObject" - rva: 5468 + rva: 0x155c - name: "RtlFreeHeap" - rva: 5472 + rva: 0x1560 - name: "NtFsControlFile" - rva: 5476 + rva: 0x1564 - name: "NtQueryAttributesFile" - rva: 5480 + rva: 0x1568 - name: "NtQueryDirectoryFile" - rva: 5484 + rva: 0x156c - name: "NtQueryInformationFile" - rva: 5488 + rva: 0x1570 - name: "NtMapViewOfSection" - rva: 5492 + rva: 0x1574 - name: "NtCreateSection" - rva: 5496 + rva: 0x1578 - name: "NtOpenSection" - rva: 5500 + rva: 0x157c - name: "NtUnmapViewOfSection" - rva: 5504 + rva: 0x1580 - name: "NtUnlockFile" - rva: 5508 + rva: 0x1584 - name: "NtLockFile" - rva: 5512 + rva: 0x1588 - name: "NtWriteFile" - rva: 5516 + rva: 0x158c - name: "NtReadFile" - rva: 5520 + rva: 0x1590 - name: "RtlNtStatusToDosError" - rva: 5524 + rva: 0x1594 - name: "NtOpenFile" - rva: 5528 + rva: 0x1598 - name: "RtlInitUnicodeString" - rva: 5532 + rva: 0x159c - name: "NtCreateFile" - rva: 5536 + rva: 0x15a0 - name: "NtClose" - rva: 5540 + rva: 0x15a4 - library_name: "SHELL32.dll" number_of_functions: 4 functions: - name: "SHGetMalloc" - rva: 4656 + rva: 0x1230 - name: "SHGetPathFromIDListW" - rva: 4660 + rva: 0x1234 - name: "SHBrowseForFolderW" - rva: 4664 + rva: 0x1238 - name: "ShellExecuteW" - rva: 4668 + rva: 0x123c - library_name: "comdlg32.dll" number_of_functions: 2 functions: - name: "GetSaveFileNameW" - rva: 5124 + rva: 0x1404 - name: "GetOpenFileNameW" - rva: 5128 + rva: 0x1408 - library_name: "VERSION.dll" number_of_functions: 3 functions: - name: "GetFileVersionInfoW" - rva: 5108 + rva: 0x13f4 - name: "GetFileVersionInfoSizeW" - rva: 5112 + rva: 0x13f8 - name: "VerQueryValueW" - rva: 5116 + rva: 0x13fc is_signed: false overlay: - offset: 0 - size: 0 \ No newline at end of file + offset: 0x0 + size: 0x0 \ No newline at end of file diff --git a/lib/src/modules/pe/tests/testdata/2d80c403b5c50f8bbacb65f58e7a19f272c62d1889216b7a6f1141571ec12649.out b/lib/src/modules/pe/tests/testdata/2d80c403b5c50f8bbacb65f58e7a19f272c62d1889216b7a6f1141571ec12649.out index 4952c98a8..481eb099e 100644 --- a/lib/src/modules/pe/tests/testdata/2d80c403b5c50f8bbacb65f58e7a19f272c62d1889216b7a6f1141571ec12649.out +++ b/lib/src/modules/pe/tests/testdata/2d80c403b5c50f8bbacb65f58e7a19f272c62d1889216b7a6f1141571ec12649.out @@ -17,28 +17,28 @@ opthdr_magic: IMAGE_NT_OPTIONAL_HDR32_MAGIC characteristics: 0x230e # EXECUTABLE_IMAGE | LINE_NUMS_STRIPPED | LOCAL_SYMS_STRIPPED | MACHINE_32BIT | DEBUG_STRIPPED | DLL dll_characteristics: 0x0 timestamp: 1274346651 # 2010-05-20 09:10:51 UTC -image_base: 268435456 +image_base: 0x10000000 checksum: 0 -base_of_code: 40960 -base_of_data: 49152 -entry_point: 6256 -entry_point_raw: 46704 +base_of_code: 0xa000 +base_of_data: 0xc000 +entry_point: 0x1870 +entry_point_raw: 0xb670 dll_name: "socks55.dll" export_timestamp: 1274346651 # 2010-05-20 09:10:51 UTC -section_alignment: 4096 -file_alignment: 512 -loader_flags: 0 -size_of_optional_header: 224 -size_of_code: 8192 -size_of_initialized_data: 4096 -size_of_uninitialized_data: 36864 -size_of_image: 53248 -size_of_headers: 4096 -size_of_stack_reserve: 2097152 -size_of_stack_commit: 4096 -size_of_heap_reserve: 1048576 -size_of_heap_commit: 4096 -pointer_to_symbol_table: 0 +section_alignment: 0x1000 +file_alignment: 0x200 +loader_flags: 0x0 +size_of_optional_header: 0xe0 +size_of_code: 0x2000 +size_of_initialized_data: 0x1000 +size_of_uninitialized_data: 0x9000 +size_of_image: 0xd000 +size_of_headers: 0x1000 +size_of_stack_reserve: 0x200000 +size_of_stack_commit: 0x1000 +size_of_heap_reserve: 0x100000 +size_of_heap_commit: 0x1000 +pointer_to_symbol_table: 0x0 win32_version_value: 0 number_of_symbols: 0 number_of_rva_and_sizes: 16 @@ -54,217 +54,217 @@ number_of_signatures: 0 sections: - name: "3j70umia" full_name: "3j70umia" - characteristics: 3758096512 - raw_data_size: 0 - raw_data_offset: 512 - virtual_address: 4096 - virtual_size: 36864 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0xe0000080 + raw_data_size: 0x0 + raw_data_offset: 0x200 + virtual_address: 0x1000 + virtual_size: 0x9000 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: "3752hxsy" full_name: "3752hxsy" - characteristics: 3758096448 - raw_data_size: 6656 - raw_data_offset: 512 - virtual_address: 40960 - virtual_size: 8192 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0xe0000040 + raw_data_size: 0x1a00 + raw_data_offset: 0x200 + virtual_address: 0xa000 + virtual_size: 0x2000 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: "3806yjxd" full_name: "3806yjxd" - characteristics: 3221225536 - raw_data_size: 1536 - raw_data_offset: 7168 - virtual_address: 49152 - virtual_size: 4096 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0xc0000040 + raw_data_size: 0x600 + raw_data_offset: 0x1c00 + virtual_address: 0xc000 + virtual_size: 0x1000 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 data_directories: - - virtual_address: 49504 - size: 864 - - virtual_address: 49152 - size: 352 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 50368 - size: 12 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 + - virtual_address: 0xc160 + size: 0x360 + - virtual_address: 0xc000 + size: 0x160 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0xc4c0 + size: 0xc + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 import_details: - library_name: "KERNEL32.DLL" number_of_functions: 5 functions: - name: "LoadLibraryA" - rva: 49272 + rva: 0xc078 - name: "GetProcAddress" - rva: 49276 + rva: 0xc07c - name: "VirtualProtect" - rva: 49280 + rva: 0xc080 - name: "VirtualAlloc" - rva: 49284 + rva: 0xc084 - name: "VirtualFree" - rva: 49288 + rva: 0xc088 - library_name: "ADVAPI32.DLL" number_of_functions: 1 functions: - name: "RegCloseKey" - rva: 49296 + rva: 0xc090 - library_name: "msvcrt.dll" number_of_functions: 1 functions: - name: "_iob" - rva: 49304 + rva: 0xc098 - library_name: "USER32.dll" number_of_functions: 1 functions: - name: "wsprintfA" - rva: 49312 + rva: 0xc0a0 - library_name: "WSOCK32.DLL" number_of_functions: 1 functions: - name: "bind" - rva: 49320 + rva: 0xc0a8 export_details: - name: "AcceptThread@4" ordinal: 1 - rva: 7308 + rva: 0x1c8c - name: "AuthLogin" ordinal: 2 - rva: 24660 + rva: 0x6054 - name: "AuthPass" ordinal: 3 - rva: 24772 + rva: 0x60c4 - name: "CreateConnectStruct" ordinal: 4 - rva: 4571 + rva: 0x11db - name: "Get_Reg_SZ" ordinal: 5 - rva: 8023 + rva: 0x1f57 - name: "Socks5Accept" ordinal: 6 - rva: 7102 + rva: 0x1bbe - name: "Socks5Auth" ordinal: 7 - rva: 6747 + rva: 0x1a5b - name: "Socks5CmdIsSupported" ordinal: 8 - rva: 5438 + rva: 0x153e - name: "Socks5GetCmd" ordinal: 9 - rva: 6111 + rva: 0x17df - name: "Socks5SendCode" ordinal: 10 - rva: 5135 + rva: 0x140f - name: "Socks5ServConnect" ordinal: 11 - rva: 5201 + rva: 0x1451 - name: "SocksPipe@4" ordinal: 12 - rva: 4836 + rva: 0x12e4 - name: "Write_REG_SZ" ordinal: 13 - rva: 10062 + rva: 0x274e - name: "_malloc" ordinal: 14 - rva: 4541 + rva: 0x11bd - name: "add_system_direcroty" ordinal: 15 - rva: 8713 + rva: 0x2209 - name: "autostart_bot" ordinal: 16 - rva: 9087 + rva: 0x237f - name: "copy_autoinf" ordinal: 17 - rva: 10246 + rva: 0x2806 - name: "copy_filez" ordinal: 18 - rva: 11372 + rva: 0x2c6c - name: "create_thread" ordinal: 19 - rva: 4480 + rva: 0x1180 - name: "filetyt" ordinal: 20 - rva: 10011 + rva: 0x271b - name: "get_dword" ordinal: 21 - rva: 11164 + rva: 0x2b9c - name: "hDllInstance" ordinal: 22 - rva: 24724 + rva: 0x6094 - name: "mutex_check" ordinal: 23 - rva: 10774 + rva: 0x2a16 - name: "name_exe" ordinal: 24 - rva: 24740 + rva: 0x60a4 - name: "rot13" ordinal: 25 - rva: 7974 + rva: 0x1f26 - name: "rot13c" ordinal: 26 - rva: 7684 + rva: 0x1e04 - name: "run_another@4" ordinal: 27 - rva: 11944 + rva: 0x2ea8 - name: "run_flash@4" ordinal: 28 - rva: 11503 + rva: 0x2cef - name: "run_process@4" ordinal: 29 - rva: 10848 + rva: 0x2a60 - name: "run_reestr@4" ordinal: 30 - rva: 10680 + rva: 0x29b8 - name: "socks5_exec" ordinal: 31 - rva: 5502 + rva: 0x157e - name: "sread" ordinal: 32 - rva: 4749 + rva: 0x128d - name: "sss_rans" ordinal: 33 - rva: 9378 + rva: 0x24a2 - name: "swrite" ordinal: 34 - rva: 4662 + rva: 0x1236 - name: "xproxy_th@4" ordinal: 35 - rva: 8224 + rva: 0x2020 - name: "xsocks5" ordinal: 36 - rva: 8824 + rva: 0x2278 - name: "xstrchr" ordinal: 37 - rva: 7640 + rva: 0x1dd8 is_signed: false overlay: - offset: 0 - size: 0 \ No newline at end of file + offset: 0x0 + size: 0x0 \ No newline at end of file diff --git a/lib/src/modules/pe/tests/testdata/2e9c671b8a0411f2b397544b368c44d7f095eb395779de0ad1ac946914dfa34c.out b/lib/src/modules/pe/tests/testdata/2e9c671b8a0411f2b397544b368c44d7f095eb395779de0ad1ac946914dfa34c.out index 6a0db2c36..af66baf36 100644 --- a/lib/src/modules/pe/tests/testdata/2e9c671b8a0411f2b397544b368c44d7f095eb395779de0ad1ac946914dfa34c.out +++ b/lib/src/modules/pe/tests/testdata/2e9c671b8a0411f2b397544b368c44d7f095eb395779de0ad1ac946914dfa34c.out @@ -17,25 +17,25 @@ opthdr_magic: IMAGE_NT_OPTIONAL_HDR64_MAGIC characteristics: 0x2f # RELOCS_STRIPPED | EXECUTABLE_IMAGE | LINE_NUMS_STRIPPED | LOCAL_SYMS_STRIPPED | LARGE_ADDRESS_AWARE dll_characteristics: 0x0 timestamp: 0 # 1970-01-01 00:00:00 UTC -image_base: 4194304 +image_base: 0x400000 checksum: 138527 -base_of_code: 4096 -entry_point: 56256 -entry_point_raw: 59328 -section_alignment: 4096 -file_alignment: 512 -loader_flags: 0 -size_of_optional_header: 240 -size_of_code: 63952 -size_of_initialized_data: 4900 -size_of_uninitialized_data: 15744 -size_of_image: 122880 -size_of_headers: 1024 -size_of_stack_reserve: 16777216 -size_of_stack_commit: 4096 -size_of_heap_reserve: 1048576 -size_of_heap_commit: 4096 -pointer_to_symbol_table: 84480 +base_of_code: 0x1000 +entry_point: 0xdbc0 +entry_point_raw: 0xe7c0 +section_alignment: 0x1000 +file_alignment: 0x200 +loader_flags: 0x0 +size_of_optional_header: 0xf0 +size_of_code: 0xf9d0 +size_of_initialized_data: 0x1324 +size_of_uninitialized_data: 0x3d80 +size_of_image: 0x1e000 +size_of_headers: 0x400 +size_of_stack_reserve: 0x1000000 +size_of_stack_commit: 0x1000 +size_of_heap_reserve: 0x100000 +size_of_heap_commit: 0x1000 +pointer_to_symbol_table: 0x14a00 win32_version_value: 0 number_of_symbols: 0 number_of_rva_and_sizes: 16 @@ -51,164 +51,164 @@ number_of_signatures: 2 sections: - name: ".text" full_name: ".text" - characteristics: 1610612768 - raw_data_size: 64000 - raw_data_offset: 1024 - virtual_address: 4096 - virtual_size: 63952 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0x60000020 # SECTION_MEM_READ | SECTION_MEM_WRITE | SECTION_SCALE_INDEX + raw_data_size: 0xfa00 + raw_data_offset: 0x400 + virtual_address: 0x1000 + virtual_size: 0xf9d0 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".data" full_name: ".data" - characteristics: 3221225536 - raw_data_size: 5120 - raw_data_offset: 65024 - virtual_address: 69632 - virtual_size: 4900 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0xc0000040 + raw_data_size: 0x1400 + raw_data_offset: 0xfe00 + virtual_address: 0x11000 + virtual_size: 0x1324 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".bss" full_name: ".bss" - characteristics: 3221225600 - raw_data_size: 0 - raw_data_offset: 0 - virtual_address: 77824 - virtual_size: 15744 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0xc0000080 + raw_data_size: 0x0 + raw_data_offset: 0x0 + virtual_address: 0x13000 + virtual_size: 0x3d80 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".CRT" full_name: ".CRT" - characteristics: 33554432 - raw_data_size: 512 - raw_data_offset: 70144 - virtual_address: 94208 - virtual_size: 8 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0x2000000 + raw_data_size: 0x200 + raw_data_offset: 0x11200 + virtual_address: 0x17000 + virtual_size: 0x8 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".idata" full_name: ".idata" - characteristics: 3221225536 - raw_data_size: 4608 - raw_data_offset: 70656 - virtual_address: 98304 - virtual_size: 4488 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0xc0000040 + raw_data_size: 0x1200 + raw_data_offset: 0x11400 + virtual_address: 0x18000 + virtual_size: 0x1188 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".rsrc" full_name: ".rsrc" - characteristics: 3221225536 - raw_data_size: 8704 - raw_data_offset: 75264 - virtual_address: 106496 - virtual_size: 8464 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0xc0000040 + raw_data_size: 0x2200 + raw_data_offset: 0x12600 + virtual_address: 0x1a000 + virtual_size: 0x2110 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: "/4" full_name: ".gnu_debuglink" - characteristics: 33554432 - raw_data_size: 512 - raw_data_offset: 83968 - virtual_address: 118784 - virtual_size: 20 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0x2000000 + raw_data_size: 0x200 + raw_data_offset: 0x14800 + virtual_address: 0x1d000 + virtual_size: 0x14 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 data_directories: - - virtual_address: 0 - size: 0 - - virtual_address: 98304 - size: 160 - - virtual_address: 106496 - size: 8464 - - virtual_address: 0 - size: 0 - - virtual_address: 84504 - size: 13392 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 99472 - size: 1008 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x18000 + size: 0xa0 + - virtual_address: 0x1a000 + size: 0x2110 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x14a18 + size: 0x3450 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x18490 + size: 0x3f0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 resource_timestamp: 0 # 1970-01-01 00:00:00 UTC resource_version: major: 0 minor: 0 resources: - - length: 296 - rva: 107056 - offset: 75824 + - length: 0x128 + rva: 0x1a230 + offset: 0x12830 type: RESOURCE_TYPE_ICON id: 1 language: 0 - - length: 1384 - rva: 107352 - offset: 76120 + - length: 0x568 + rva: 0x1a358 + offset: 0x12958 type: RESOURCE_TYPE_ICON id: 2 language: 0 - - length: 744 - rva: 108736 - offset: 77504 + - length: 0x2e8 + rva: 0x1a8c0 + offset: 0x12ec0 type: RESOURCE_TYPE_ICON id: 3 language: 0 - - length: 2216 - rva: 109480 - offset: 78248 + - length: 0x8a8 + rva: 0x1aba8 + offset: 0x131a8 type: RESOURCE_TYPE_ICON id: 4 language: 0 - - length: 998 - rva: 111696 - offset: 80464 + - length: 0x3e6 + rva: 0x1b450 + offset: 0x13a50 type: RESOURCE_TYPE_DIALOG language: 2055 name_string: "U\x00N\x00I\x00N\x00S\x00T\x00D\x00L\x00G\x00" - - length: 642 - rva: 112696 - offset: 81464 + - length: 0x282 + rva: 0x1b838 + offset: 0x13e38 type: RESOURCE_TYPE_DIALOG language: 2055 name_string: "U\x00N\x00I\x00N\x00S\x00T\x00R\x00E\x00P\x00A\x00I\x00R\x00" - - length: 62 - rva: 113340 - offset: 82108 + - length: 0x3e + rva: 0x1babc + offset: 0x140bc type: RESOURCE_TYPE_GROUP_ICON language: 0 name_string: "M\x00A\x00I\x00N\x00I\x00C\x00O\x00N\x00" - - length: 1555 - rva: 113404 - offset: 82172 + - length: 0x613 + rva: 0x1bafc + offset: 0x140fc type: RESOURCE_TYPE_MANIFEST id: 1 language: 2055 @@ -217,261 +217,261 @@ import_details: number_of_functions: 4 functions: - name: "RegCloseKey" - rva: 99472 + rva: 0x18490 - name: "RegDeleteKeyA" - rva: 99480 + rva: 0x18498 - name: "RegOpenKeyExA" - rva: 99488 + rva: 0x184a0 - name: "RegQueryValueExA" - rva: 99496 + rva: 0x184a8 - library_name: "comctl32.dll" number_of_functions: 1 functions: - name: "InitCommonControls" - rva: 99512 + rva: 0x184b8 - library_name: "gdi32.dll" number_of_functions: 5 functions: - name: "CreateFontA" - rva: 99528 + rva: 0x184c8 - name: "CreateSolidBrush" - rva: 99536 + rva: 0x184d0 - name: "DeleteObject" - rva: 99544 + rva: 0x184d8 - name: "SetBkColor" - rva: 99552 + rva: 0x184e0 - name: "SetTextColor" - rva: 99560 + rva: 0x184e8 - library_name: "kernel32.dll" number_of_functions: 83 functions: - name: "AddVectoredExceptionHandler" - rva: 99576 + rva: 0x184f8 - name: "CloseHandle" - rva: 99584 + rva: 0x18500 - name: "CreateDirectoryA" - rva: 99592 + rva: 0x18508 - name: "CreateEventA" - rva: 99600 + rva: 0x18510 - name: "CreateFileA" - rva: 99608 + rva: 0x18518 - name: "CreateThread" - rva: 99616 + rva: 0x18520 - name: "DeleteCriticalSection" - rva: 99624 + rva: 0x18528 - name: "DeleteFileA" - rva: 99632 + rva: 0x18530 - name: "EnterCriticalSection" - rva: 99640 + rva: 0x18538 - name: "EnumResourceLanguagesA" - rva: 99648 + rva: 0x18540 - name: "EnumResourceNamesA" - rva: 99656 + rva: 0x18548 - name: "EnumResourceTypesA" - rva: 99664 + rva: 0x18550 - name: "ExitProcess" - rva: 99672 + rva: 0x18558 - name: "ExitThread" - rva: 99680 + rva: 0x18560 - name: "FileTimeToDosDateTime" - rva: 99688 + rva: 0x18568 - name: "FileTimeToLocalFileTime" - rva: 99696 + rva: 0x18570 - name: "FindClose" - rva: 99704 + rva: 0x18578 - name: "FindFirstFileA" - rva: 99712 + rva: 0x18580 - name: "FindNextFileA" - rva: 99720 + rva: 0x18588 - name: "FindResourceA" - rva: 99728 + rva: 0x18590 - name: "FindResourceExA" - rva: 99736 + rva: 0x18598 - name: "FreeLibrary" - rva: 99744 + rva: 0x185a0 - name: "FreeResource" - rva: 99752 + rva: 0x185a8 - name: "GetCommandLineA" - rva: 99760 + rva: 0x185b0 - name: "GetConsoleMode" - rva: 99768 + rva: 0x185b8 - name: "GetConsoleOutputCP" - rva: 99776 + rva: 0x185c0 - name: "GetCurrentProcess" - rva: 99784 + rva: 0x185c8 - name: "GetCurrentProcessId" - rva: 99792 + rva: 0x185d0 - name: "GetCurrentThreadId" - rva: 99800 + rva: 0x185d8 - name: "GetEnvironmentVariableA" - rva: 99808 + rva: 0x185e0 - name: "GetFileAttributesA" - rva: 99816 + rva: 0x185e8 - name: "GetFileType" - rva: 99824 + rva: 0x185f0 - name: "GetLastError" - rva: 99832 + rva: 0x185f8 - name: "GetModuleFileNameA" - rva: 99840 + rva: 0x18600 - name: "GetModuleHandleA" - rva: 99848 + rva: 0x18608 - name: "GetPrivateProfileIntA" - rva: 99856 + rva: 0x18610 - name: "GetPrivateProfileStringA" - rva: 99864 + rva: 0x18618 - name: "GetProcAddress" - rva: 99872 + rva: 0x18620 - name: "GetProcessHeap" - rva: 99880 + rva: 0x18628 - name: "GetStartupInfoA" - rva: 99888 + rva: 0x18630 - name: "GetStdHandle" - rva: 99896 + rva: 0x18638 - name: "GetTempFileNameA" - rva: 99904 + rva: 0x18640 - name: "GetTempPathA" - rva: 99912 + rva: 0x18648 - name: "GetThreadPriority" - rva: 99920 + rva: 0x18650 - name: "GetTickCount" - rva: 99928 + rva: 0x18658 - name: "GetVersionExA" - rva: 99936 + rva: 0x18660 - name: "GetWindowsDirectoryA" - rva: 99944 + rva: 0x18668 - name: "HeapAlloc" - rva: 99952 + rva: 0x18670 - name: "HeapFree" - rva: 99960 + rva: 0x18678 - name: "InitializeCriticalSection" - rva: 99968 + rva: 0x18680 - name: "LeaveCriticalSection" - rva: 99976 + rva: 0x18688 - name: "LoadLibraryA" - rva: 99984 + rva: 0x18690 - name: "LoadResource" - rva: 99992 + rva: 0x18698 - name: "LocalAlloc" - rva: 100000 + rva: 0x186a0 - name: "LocalFree" - rva: 100008 + rva: 0x186a8 - name: "LockResource" - rva: 100016 + rva: 0x186b0 - name: "MoveFileA" - rva: 100024 + rva: 0x186b8 - name: "MultiByteToWideChar" - rva: 100032 + rva: 0x186c0 - name: "ReadFile" - rva: 100040 + rva: 0x186c8 - name: "ReadProcessMemory" - rva: 100048 + rva: 0x186d0 - name: "RemoveDirectoryA" - rva: 100056 + rva: 0x186d8 - name: "ResetEvent" - rva: 100064 + rva: 0x186e0 - name: "ResumeThread" - rva: 100072 + rva: 0x186e8 - name: "SetCurrentDirectoryA" - rva: 100080 + rva: 0x186f0 - name: "SetEvent" - rva: 100088 + rva: 0x186f8 - name: "SetFilePointer" - rva: 100096 + rva: 0x18700 - name: "SetLastError" - rva: 100104 + rva: 0x18708 - name: "SetThreadPriority" - rva: 100112 + rva: 0x18710 - name: "SizeofResource" - rva: 100120 + rva: 0x18718 - name: "Sleep" - rva: 100128 + rva: 0x18720 - name: "SuspendThread" - rva: 100136 + rva: 0x18728 - name: "TerminateThread" - rva: 100144 + rva: 0x18730 - name: "TlsAlloc" - rva: 100152 + rva: 0x18738 - name: "TlsGetValue" - rva: 100160 + rva: 0x18740 - name: "TlsSetValue" - rva: 100168 + rva: 0x18748 - name: "TryEnterCriticalSection" - rva: 100176 + rva: 0x18750 - name: "VirtualQuery" - rva: 100184 + rva: 0x18758 - name: "WaitForSingleObject" - rva: 100192 + rva: 0x18760 - name: "WideCharToMultiByte" - rva: 100200 + rva: 0x18768 - name: "WinExec" - rva: 100208 + rva: 0x18770 - name: "WriteFile" - rva: 100216 + rva: 0x18778 - name: "_lclose" - rva: 100224 + rva: 0x18780 - name: "_lopen" - rva: 100232 + rva: 0x18788 - library_name: "ole32.dll" number_of_functions: 3 functions: - name: "CoCreateInstance" - rva: 100248 + rva: 0x18798 - name: "OleInitialize" - rva: 100256 + rva: 0x187a0 - name: "OleUninitialize" - rva: 100264 + rva: 0x187a8 - library_name: "oleaut32.dll" number_of_functions: 3 functions: - name: "SysAllocStringLen" - rva: 100280 + rva: 0x187b8 - name: "SysFreeString" - rva: 100288 + rva: 0x187c0 - name: "SysReAllocStringLen" - rva: 100296 + rva: 0x187c8 - library_name: "user32.dll" number_of_functions: 20 functions: - name: "CharLowerBuffW" - rva: 100312 + rva: 0x187d8 - name: "CharPrevA" - rva: 100320 + rva: 0x187e0 - name: "CharUpperA" - rva: 100328 + rva: 0x187e8 - name: "CharUpperBuffW" - rva: 100336 + rva: 0x187f0 - name: "DialogBoxParamA" - rva: 100344 + rva: 0x187f8 - name: "DispatchMessageA" - rva: 100352 + rva: 0x18800 - name: "EndDialog" - rva: 100360 + rva: 0x18808 - name: "FindWindowA" - rva: 100368 + rva: 0x18810 - name: "GetDesktopWindow" - rva: 100376 + rva: 0x18818 - name: "GetSysColor" - rva: 100384 + rva: 0x18820 - name: "GetSystemMetrics" - rva: 100392 + rva: 0x18828 - name: "GetWindowRect" - rva: 100400 + rva: 0x18830 - name: "MessageBeep" - rva: 100408 + rva: 0x18838 - name: "MessageBoxA" - rva: 100416 + rva: 0x18840 - name: "MoveWindow" - rva: 100424 + rva: 0x18848 - name: "PeekMessageA" - rva: 100432 + rva: 0x18850 - name: "PostMessageA" - rva: 100440 + rva: 0x18858 - name: "SendDlgItemMessageA" - rva: 100448 + rva: 0x18860 - name: "SetDlgItemTextA" - rva: 100456 + rva: 0x18868 - name: "TranslateMessage" - rva: 100464 + rva: 0x18870 is_signed: true signatures: - subject: "/C=CH/ST=Bern/L=Bolligen/O=Ghisler Software GmbH/OU=Development/CN=Ghisler Software GmbH" @@ -671,5 +671,5 @@ signatures: not_before: 1452556800 # 2016-01-12 00:00:00 UTC not_after: 1925942399 # 2031-01-11 23:59:59 UTC overlay: - offset: 84480 - size: 13416 \ No newline at end of file + offset: 0x14a00 + size: 0x3468 \ No newline at end of file diff --git a/lib/src/modules/pe/tests/testdata/3df167b04c52b47ae634b8114671ad3b7bf4e8af62a38a3d4bc0903f474ae2d9.out b/lib/src/modules/pe/tests/testdata/3df167b04c52b47ae634b8114671ad3b7bf4e8af62a38a3d4bc0903f474ae2d9.out index 43b15f4e9..5ff17f6ef 100644 --- a/lib/src/modules/pe/tests/testdata/3df167b04c52b47ae634b8114671ad3b7bf4e8af62a38a3d4bc0903f474ae2d9.out +++ b/lib/src/modules/pe/tests/testdata/3df167b04c52b47ae634b8114671ad3b7bf4e8af62a38a3d4bc0903f474ae2d9.out @@ -17,26 +17,26 @@ opthdr_magic: 0 characteristics: 0x102 # EXECUTABLE_IMAGE | MACHINE_32BIT dll_characteristics: 0x8140 # DYNAMIC_BASE | NX_COMPAT | TERMINAL_SERVER_AWARE timestamp: 1496750700 # 2017-06-06 12:05:00 UTC -image_base: 4194304 +image_base: 0x400000 checksum: 612191 -base_of_code: 4096 -base_of_data: 385024 -entry_point: 238919 -entry_point_raw: 241991 -section_alignment: 4096 -file_alignment: 512 -loader_flags: 0 -size_of_optional_header: 224 -size_of_code: 378368 -size_of_initialized_data: 173568 -size_of_uninitialized_data: 0 -size_of_image: 585728 -size_of_headers: 1024 -size_of_stack_reserve: 1048576 -size_of_stack_commit: 4096 -size_of_heap_reserve: 1048576 -size_of_heap_commit: 4096 -pointer_to_symbol_table: 0 +base_of_code: 0x1000 +base_of_data: 0x5e000 +entry_point: 0x3a547 +entry_point_raw: 0x3b147 +section_alignment: 0x1000 +file_alignment: 0x200 +loader_flags: 0x0 +size_of_optional_header: 0xe0 +size_of_code: 0x5c600 +size_of_initialized_data: 0x2a600 +size_of_uninitialized_data: 0x0 +size_of_image: 0x8f000 +size_of_headers: 0x400 +size_of_stack_reserve: 0x100000 +size_of_stack_commit: 0x1000 +size_of_heap_reserve: 0x100000 +size_of_heap_commit: 0x1000 +pointer_to_symbol_table: 0x0 win32_version_value: 0 number_of_symbols: 0 number_of_rva_and_sizes: 16 @@ -76,8 +76,8 @@ version_info_list: - key: "ProductVersion" value: "1, 0, 0, 1090" rich_signature: - offset: 128 - length: 96 + offset: 0x80 + length: 0x60 key: 2151320631 raw_data: "s\xedT\xd37\x8c:\x807\x8c:\x807\x8c:\x80\x8a\xc3\xac\x804\x8c:\x80>\xf4\xaf\x80*\x8c:\x80>\xf4\xb9\x80\x84\x8c:\x80>\xf4\xbe\x80l\x8c:\x80\x10JW\x800\x8c:\x80\x10JA\x80\x10\x8c:\x807\x8c;\x80\xb4\x8d:\x80>\xf4\xb0\x80\x1c\x8c:\x80)\xde\xae\x806\x8c:\x80>\xf4\xab\x806\x8c:\x80" clear_data: "DanS\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xbdO\x96\x00\x03\x00\x00\x00\tx\x95\x00\x1d\x00\x00\x00\tx\x83\x00\xb3\x00\x00\x00\tx\x84\x00[\x00\x00\x00\'\xc6m\x00\x07\x00\x00\x00\'\xc6{\x00\'\x00\x00\x00\x00\x00\x01\x00\x83\x01\x00\x00\tx\x8a\x00+\x00\x00\x00\x1eR\x94\x00\x01\x00\x00\x00\tx\x91\x00\x01\x00\x00\x00" @@ -116,244 +116,244 @@ pdb_path: "C:\\vmagent_new\\bin\\joblist\\170654\\out\\Release\\SecurityProxy.pd sections: - name: ".text" full_name: ".text" - characteristics: 1610612768 - raw_data_size: 378368 - raw_data_offset: 1024 - virtual_address: 4096 - virtual_size: 377904 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0x60000020 # SECTION_MEM_READ | SECTION_MEM_WRITE | SECTION_SCALE_INDEX + raw_data_size: 0x5c600 + raw_data_offset: 0x400 + virtual_address: 0x1000 + virtual_size: 0x5c430 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".rdata" full_name: ".rdata" - characteristics: 1073741888 - raw_data_size: 75264 - raw_data_offset: 379392 - virtual_address: 385024 - virtual_size: 74756 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0x40000040 + raw_data_size: 0x12600 + raw_data_offset: 0x5ca00 + virtual_address: 0x5e000 + virtual_size: 0x12404 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".data" full_name: ".data" - characteristics: 3221225536 - raw_data_size: 17920 - raw_data_offset: 454656 - virtual_address: 462848 - virtual_size: 32840 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0xc0000040 + raw_data_size: 0x4600 + raw_data_offset: 0x6f000 + virtual_address: 0x71000 + virtual_size: 0x8048 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".rsrc" full_name: ".rsrc" - characteristics: 1073741888 - raw_data_size: 50688 - raw_data_offset: 472576 - virtual_address: 499712 - virtual_size: 50248 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0x40000040 + raw_data_size: 0xc600 + raw_data_offset: 0x73600 + virtual_address: 0x7a000 + virtual_size: 0xc448 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".reloc" full_name: ".reloc" - characteristics: 1107296320 - raw_data_size: 29696 - raw_data_offset: 523264 - virtual_address: 552960 - virtual_size: 29502 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0x42000040 + raw_data_size: 0x7400 + raw_data_offset: 0x7fc00 + virtual_address: 0x87000 + virtual_size: 0x733e + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 data_directories: - - virtual_address: 0 - size: 0 - - virtual_address: 453236 - size: 300 - - virtual_address: 499712 - size: 50248 - - virtual_address: 0 - size: 0 - - virtual_address: 553624 - size: 13768 - - virtual_address: 552960 - size: 22324 - - virtual_address: 387200 - size: 28 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 418904 - size: 64 - - virtual_address: 0 - size: 0 - - virtual_address: 385024 - size: 1204 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x6ea74 + size: 0x12c + - virtual_address: 0x7a000 + size: 0xc448 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x87298 + size: 0x35c8 + - virtual_address: 0x87000 + size: 0x5734 + - virtual_address: 0x5e880 + size: 0x1c + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x66458 + size: 0x40 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x5e000 + size: 0x4b4 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 resource_timestamp: 0 # 1970-01-01 00:00:00 UTC resource_version: major: 4 minor: 0 resources: - - length: 744 - rva: 501144 - offset: 474008 + - length: 0x2e8 + rva: 0x7a598 + offset: 0x73b98 type: RESOURCE_TYPE_ICON id: 1 language: 2052 - - length: 296 - rva: 501888 - offset: 474752 + - length: 0x128 + rva: 0x7a880 + offset: 0x73e80 type: RESOURCE_TYPE_ICON id: 2 language: 2052 - - length: 3752 - rva: 502184 - offset: 475048 + - length: 0xea8 + rva: 0x7a9a8 + offset: 0x73fa8 type: RESOURCE_TYPE_ICON id: 3 language: 2052 - - length: 2216 - rva: 505936 - offset: 478800 + - length: 0x8a8 + rva: 0x7b850 + offset: 0x74e50 type: RESOURCE_TYPE_ICON id: 4 language: 2052 - - length: 1384 - rva: 508152 - offset: 481016 + - length: 0x568 + rva: 0x7c0f8 + offset: 0x756f8 type: RESOURCE_TYPE_ICON id: 5 language: 2052 - - length: 9640 - rva: 509536 - offset: 482400 + - length: 0x25a8 + rva: 0x7c660 + offset: 0x75c60 type: RESOURCE_TYPE_ICON id: 6 language: 2052 - - length: 4264 - rva: 519176 - offset: 492040 + - length: 0x10a8 + rva: 0x7ec08 + offset: 0x78208 type: RESOURCE_TYPE_ICON id: 7 language: 2052 - - length: 1128 - rva: 523440 - offset: 496304 + - length: 0x468 + rva: 0x7fcb0 + offset: 0x792b0 type: RESOURCE_TYPE_ICON id: 8 language: 2052 - - length: 744 - rva: 524568 - offset: 497432 + - length: 0x2e8 + rva: 0x80118 + offset: 0x79718 type: RESOURCE_TYPE_ICON id: 9 language: 2052 - - length: 296 - rva: 525312 - offset: 498176 + - length: 0x128 + rva: 0x80400 + offset: 0x79a00 type: RESOURCE_TYPE_ICON id: 10 language: 2052 - - length: 3752 - rva: 525608 - offset: 498472 + - length: 0xea8 + rva: 0x80528 + offset: 0x79b28 type: RESOURCE_TYPE_ICON id: 11 language: 2052 - - length: 2216 - rva: 529360 - offset: 502224 + - length: 0x8a8 + rva: 0x813d0 + offset: 0x7a9d0 type: RESOURCE_TYPE_ICON id: 12 language: 2052 - - length: 1384 - rva: 531576 - offset: 504440 + - length: 0x568 + rva: 0x81c78 + offset: 0x7b278 type: RESOURCE_TYPE_ICON id: 13 language: 2052 - - length: 9640 - rva: 532960 - offset: 505824 + - length: 0x25a8 + rva: 0x821e0 + offset: 0x7b7e0 type: RESOURCE_TYPE_ICON id: 14 language: 2052 - - length: 4264 - rva: 542600 - offset: 515464 + - length: 0x10a8 + rva: 0x84788 + offset: 0x7dd88 type: RESOURCE_TYPE_ICON id: 15 language: 2052 - - length: 1128 - rva: 546864 - offset: 519728 + - length: 0x468 + rva: 0x85830 + offset: 0x7ee30 type: RESOURCE_TYPE_ICON id: 16 language: 2052 - - length: 80 - rva: 547992 - offset: 520856 + - length: 0x50 + rva: 0x85c98 + offset: 0x7f298 type: RESOURCE_TYPE_MENU id: 109 language: 2052 - - length: 308 - rva: 548072 - offset: 520936 + - length: 0x134 + rva: 0x85ce8 + offset: 0x7f2e8 type: RESOURCE_TYPE_DIALOG id: 103 language: 2052 - - length: 84 - rva: 548380 - offset: 521244 + - length: 0x54 + rva: 0x85e1c + offset: 0x7f41c type: RESOURCE_TYPE_STRING id: 7 language: 2052 - - length: 16 - rva: 548464 - offset: 521328 + - length: 0x10 + rva: 0x85e70 + offset: 0x7f470 type: RESOURCE_TYPE_ACCELERATOR id: 109 language: 2052 - - length: 128 - rva: 548480 - offset: 521344 + - length: 0x80 + rva: 0x85e80 + offset: 0x7f480 type: RESOURCE_TYPE_RCDATA id: 864 language: 1033 - - length: 118 - rva: 548608 - offset: 521472 + - length: 0x76 + rva: 0x85f00 + offset: 0x7f500 type: RESOURCE_TYPE_GROUP_ICON id: 107 language: 2052 - - length: 118 - rva: 548728 - offset: 521592 + - length: 0x76 + rva: 0x85f78 + offset: 0x7f578 type: RESOURCE_TYPE_GROUP_ICON id: 108 language: 2052 - - length: 764 - rva: 548848 - offset: 521712 + - length: 0x2fc + rva: 0x85ff0 + offset: 0x7f5f0 type: RESOURCE_TYPE_VERSION id: 1 language: 2052 - - length: 346 - rva: 549612 - offset: 522476 + - length: 0x15a + rva: 0x862ec + offset: 0x7f8ec type: RESOURCE_TYPE_MANIFEST id: 1 language: 1033 @@ -362,632 +362,632 @@ import_details: number_of_functions: 153 functions: - name: "GlobalUnlock" - rva: 385120 + rva: 0x5e060 - name: "TerminateProcess" - rva: 385124 + rva: 0x5e064 - name: "MulDiv" - rva: 385128 + rva: 0x5e068 - name: "lstrcmpW" - rva: 385132 + rva: 0x5e06c - name: "SetFileAttributesW" - rva: 385136 + rva: 0x5e070 - name: "DeleteFileW" - rva: 385140 + rva: 0x5e074 - name: "GetFileSize" - rva: 385144 + rva: 0x5e078 - name: "ReadFile" - rva: 385148 + rva: 0x5e07c - name: "CreateToolhelp32Snapshot" - rva: 385152 + rva: 0x5e080 - name: "Process32FirstW" - rva: 385156 + rva: 0x5e084 - name: "Process32NextW" - rva: 385160 + rva: 0x5e088 - name: "GlobalFree" - rva: 385164 + rva: 0x5e08c - name: "OpenThread" - rva: 385168 + rva: 0x5e090 - name: "CreateFileMappingW" - rva: 385172 + rva: 0x5e094 - name: "GetModuleHandleExW" - rva: 385176 + rva: 0x5e098 - name: "lstrcpynW" - rva: 385180 + rva: 0x5e09c - name: "InterlockedCompareExchange" - rva: 385184 + rva: 0x5e0a0 - name: "GetLogicalDriveStringsW" - rva: 385188 + rva: 0x5e0a4 - name: "GetFileSizeEx" - rva: 385192 + rva: 0x5e0a8 - name: "CreateFileA" - rva: 385196 + rva: 0x5e0ac - name: "FindFirstFileW" - rva: 385200 + rva: 0x5e0b0 - name: "FindNextFileW" - rva: 385204 + rva: 0x5e0b4 - name: "FindClose" - rva: 385208 + rva: 0x5e0b8 - name: "RemoveDirectoryW" - rva: 385212 + rva: 0x5e0bc - name: "GetLongPathNameW" - rva: 385216 + rva: 0x5e0c0 - name: "IsBadReadPtr" - rva: 385220 + rva: 0x5e0c4 - name: "DeviceIoControl" - rva: 385224 + rva: 0x5e0c8 - name: "HeapAlloc" - rva: 385228 + rva: 0x5e0cc - name: "GetProcessHeap" - rva: 385232 + rva: 0x5e0d0 - name: "HeapFree" - rva: 385236 + rva: 0x5e0d4 - name: "LocalFree" - rva: 385240 + rva: 0x5e0d8 - name: "SystemTimeToFileTime" - rva: 385244 + rva: 0x5e0dc - name: "SetFilePointerEx" - rva: 385248 + rva: 0x5e0e0 - name: "GetLocalTime" - rva: 385252 + rva: 0x5e0e4 - name: "SetUnhandledExceptionFilter" - rva: 385256 + rva: 0x5e0e8 - name: "VirtualProtect" - rva: 385260 + rva: 0x5e0ec - name: "GetThreadLocale" - rva: 385264 + rva: 0x5e0f0 - name: "SetThreadLocale" - rva: 385268 + rva: 0x5e0f4 - name: "SetErrorMode" - rva: 385272 + rva: 0x5e0f8 - name: "LoadLibraryExW" - rva: 385276 + rva: 0x5e0fc - name: "lstrcmpiW" - rva: 385280 + rva: 0x5e100 - name: "GetModuleHandleW" - rva: 385284 + rva: 0x5e104 - name: "WriteConsoleW" - rva: 385288 + rva: 0x5e108 - name: "GetConsoleOutputCP" - rva: 385292 + rva: 0x5e10c - name: "WriteConsoleA" - rva: 385296 + rva: 0x5e110 - name: "GetModuleHandleA" - rva: 385300 + rva: 0x5e114 - name: "SetStdHandle" - rva: 385304 + rva: 0x5e118 - name: "FlushFileBuffers" - rva: 385308 + rva: 0x5e11c - name: "GetLocaleInfoW" - rva: 385312 + rva: 0x5e120 - name: "GetConsoleMode" - rva: 385316 + rva: 0x5e124 - name: "GetConsoleCP" - rva: 385320 + rva: 0x5e128 - name: "IsValidLocale" - rva: 385324 + rva: 0x5e12c - name: "EnumSystemLocalesA" - rva: 385328 + rva: 0x5e130 - name: "GetLocaleInfoA" - rva: 385332 + rva: 0x5e134 - name: "GetUserDefaultLCID" - rva: 385336 + rva: 0x5e138 - name: "GlobalLock" - rva: 385340 + rva: 0x5e13c - name: "GetStringTypeA" - rva: 385344 + rva: 0x5e140 - name: "InitializeCriticalSectionAndSpinCount" - rva: 385348 + rva: 0x5e144 - name: "QueryPerformanceCounter" - rva: 385352 + rva: 0x5e148 - name: "GetStartupInfoA" - rva: 385356 + rva: 0x5e14c - name: "GetFileType" - rva: 385360 + rva: 0x5e150 - name: "SetHandleCount" - rva: 385364 + rva: 0x5e154 - name: "GetEnvironmentStringsW" - rva: 385368 + rva: 0x5e158 - name: "FreeEnvironmentStringsW" - rva: 385372 + rva: 0x5e15c - name: "IsValidCodePage" - rva: 385376 + rva: 0x5e160 - name: "GetOEMCP" - rva: 385380 + rva: 0x5e164 - name: "GetACP" - rva: 385384 + rva: 0x5e168 - name: "GetModuleFileNameA" - rva: 385388 + rva: 0x5e16c - name: "GetStdHandle" - rva: 385392 + rva: 0x5e170 - name: "HeapCreate" - rva: 385396 + rva: 0x5e174 - name: "GetStringTypeW" - rva: 385400 + rva: 0x5e178 - name: "LCMapStringW" - rva: 385404 + rva: 0x5e17c - name: "LCMapStringA" - rva: 385408 + rva: 0x5e180 - name: "GetCPInfo" - rva: 385412 + rva: 0x5e184 - name: "RtlUnwind" - rva: 385416 + rva: 0x5e188 - name: "GetStartupInfoW" - rva: 385420 + rva: 0x5e18c - name: "IsDebuggerPresent" - rva: 385424 + rva: 0x5e190 - name: "UnhandledExceptionFilter" - rva: 385428 + rva: 0x5e194 - name: "CreateThread" - rva: 385432 + rva: 0x5e198 - name: "ExitThread" - rva: 385436 + rva: 0x5e19c - name: "TlsFree" - rva: 385440 + rva: 0x5e1a0 - name: "DeleteAtom" - rva: 385444 + rva: 0x5e1a4 - name: "FindAtomW" - rva: 385448 + rva: 0x5e1a8 - name: "TlsAlloc" - rva: 385452 + rva: 0x5e1ac - name: "GlobalAlloc" - rva: 385456 + rva: 0x5e1b0 - name: "CreateProcessW" - rva: 385460 + rva: 0x5e1b4 - name: "Sleep" - rva: 385464 + rva: 0x5e1b8 - name: "CreateEventW" - rva: 385468 + rva: 0x5e1bc - name: "SetEvent" - rva: 385472 + rva: 0x5e1c0 - name: "SetCurrentDirectoryW" - rva: 385476 + rva: 0x5e1c4 - name: "GetCurrentDirectoryW" - rva: 385480 + rva: 0x5e1c8 - name: "GetTickCount" - rva: 385484 + rva: 0x5e1cc - name: "WriteFile" - rva: 385488 + rva: 0x5e1d0 - name: "OutputDebugStringW" - rva: 385492 + rva: 0x5e1d4 - name: "CreateFileW" - rva: 385496 + rva: 0x5e1d8 - name: "lstrlenW" - rva: 385500 + rva: 0x5e1dc - name: "CreateMutexW" - rva: 385504 + rva: 0x5e1e0 - name: "MoveFileExW" - rva: 385508 + rva: 0x5e1e4 - name: "GetCommandLineW" - rva: 385512 + rva: 0x5e1e8 - name: "ExitProcess" - rva: 385516 + rva: 0x5e1ec - name: "WaitForSingleObject" - rva: 385520 + rva: 0x5e1f0 - name: "OpenProcess" - rva: 385524 + rva: 0x5e1f4 - name: "GetCurrentProcessId" - rva: 385528 + rva: 0x5e1f8 - name: "FreeLibrary" - rva: 385532 + rva: 0x5e1fc - name: "GetProcAddress" - rva: 385536 + rva: 0x5e200 - name: "RaiseException" - rva: 385540 + rva: 0x5e204 - name: "SetLastError" - rva: 385544 + rva: 0x5e208 - name: "FlushViewOfFile" - rva: 385548 + rva: 0x5e20c - name: "FlushInstructionCache" - rva: 385552 + rva: 0x5e210 - name: "GetCurrentProcess" - rva: 385556 + rva: 0x5e214 - name: "GetCurrentThreadId" - rva: 385560 + rva: 0x5e218 - name: "WideCharToMultiByte" - rva: 385564 + rva: 0x5e21c - name: "FindResourceExW" - rva: 385568 + rva: 0x5e220 - name: "FindResourceW" - rva: 385572 + rva: 0x5e224 - name: "LoadResource" - rva: 385576 + rva: 0x5e228 - name: "LockResource" - rva: 385580 + rva: 0x5e22c - name: "SizeofResource" - rva: 385584 + rva: 0x5e230 - name: "GetLastError" - rva: 385588 + rva: 0x5e234 - name: "MultiByteToWideChar" - rva: 385592 + rva: 0x5e238 - name: "lstrlenA" - rva: 385596 + rva: 0x5e23c - name: "LeaveCriticalSection" - rva: 385600 + rva: 0x5e240 - name: "EnterCriticalSection" - rva: 385604 + rva: 0x5e244 - name: "DeleteCriticalSection" - rva: 385608 + rva: 0x5e248 - name: "OpenFileMappingW" - rva: 385612 + rva: 0x5e24c - name: "SetFilePointer" - rva: 385616 + rva: 0x5e250 - name: "MapViewOfFile" - rva: 385620 + rva: 0x5e254 - name: "SetEndOfFile" - rva: 385624 + rva: 0x5e258 - name: "CloseHandle" - rva: 385628 + rva: 0x5e25c - name: "UnmapViewOfFile" - rva: 385632 + rva: 0x5e260 - name: "ReleaseMutex" - rva: 385636 + rva: 0x5e264 - name: "AddAtomW" - rva: 385640 + rva: 0x5e268 - name: "GetAtomNameW" - rva: 385644 + rva: 0x5e26c - name: "TlsSetValue" - rva: 385648 + rva: 0x5e270 - name: "TlsGetValue" - rva: 385652 + rva: 0x5e274 - name: "GetSystemTime" - rva: 385656 + rva: 0x5e278 - name: "FormatMessageW" - rva: 385660 + rva: 0x5e27c - name: "LocalFileTimeToFileTime" - rva: 385664 + rva: 0x5e280 - name: "GetSystemTimeAsFileTime" - rva: 385668 + rva: 0x5e284 - name: "InterlockedExchange" - rva: 385672 + rva: 0x5e288 - name: "HeapSize" - rva: 385676 + rva: 0x5e28c - name: "HeapReAlloc" - rva: 385680 + rva: 0x5e290 - name: "HeapDestroy" - rva: 385684 + rva: 0x5e294 - name: "VirtualAlloc" - rva: 385688 + rva: 0x5e298 - name: "VirtualFree" - rva: 385692 + rva: 0x5e29c - name: "IsProcessorFeaturePresent" - rva: 385696 + rva: 0x5e2a0 - name: "LoadLibraryA" - rva: 385700 + rva: 0x5e2a4 - name: "GetPrivateProfileIntW" - rva: 385704 + rva: 0x5e2a8 - name: "GetPrivateProfileStringW" - rva: 385708 + rva: 0x5e2ac - name: "LoadLibraryW" - rva: 385712 + rva: 0x5e2b0 - name: "InterlockedIncrement" - rva: 385716 + rva: 0x5e2b4 - name: "InterlockedDecrement" - rva: 385720 + rva: 0x5e2b8 - name: "InitializeCriticalSection" - rva: 385724 + rva: 0x5e2bc - name: "GetModuleFileNameW" - rva: 385728 + rva: 0x5e2c0 - library_name: "USER32.dll" number_of_functions: 57 functions: - name: "SetWindowPos" - rva: 385888 + rva: 0x5e360 - name: "GetMessageW" - rva: 385892 + rva: 0x5e364 - name: "TranslateMessage" - rva: 385896 + rva: 0x5e368 - name: "DispatchMessageW" - rva: 385900 + rva: 0x5e36c - name: "CharNextW" - rva: 385904 + rva: 0x5e370 - name: "SendMessageW" - rva: 385908 + rva: 0x5e374 - name: "GetClientRect" - rva: 385912 + rva: 0x5e378 - name: "IsRectEmpty" - rva: 385916 + rva: 0x5e37c - name: "GetDesktopWindow" - rva: 385920 + rva: 0x5e380 - name: "SendNotifyMessageW" - rva: 385924 + rva: 0x5e384 - name: "IsWindow" - rva: 385928 + rva: 0x5e388 - name: "IsWindowVisible" - rva: 385932 + rva: 0x5e38c - name: "SendMessageTimeoutW" - rva: 385936 + rva: 0x5e390 - name: "DestroyAcceleratorTable" - rva: 385940 + rva: 0x5e394 - name: "ReleaseDC" - rva: 385944 + rva: 0x5e398 - name: "GetDC" - rva: 385948 + rva: 0x5e39c - name: "InvalidateRect" - rva: 385952 + rva: 0x5e3a0 - name: "InvalidateRgn" - rva: 385956 + rva: 0x5e3a4 - name: "PostQuitMessage" - rva: 385960 + rva: 0x5e3a8 - name: "RegisterClassExW" - rva: 385964 + rva: 0x5e3ac - name: "GetClassInfoExW" - rva: 385968 + rva: 0x5e3b0 - name: "UnregisterClassA" - rva: 385972 + rva: 0x5e3b4 - name: "GetWindowThreadProcessId" - rva: 385976 + rva: 0x5e3b8 - name: "FindWindowExW" - rva: 385980 + rva: 0x5e3bc - name: "FindWindowW" - rva: 385984 + rva: 0x5e3c0 - name: "FillRect" - rva: 385988 + rva: 0x5e3c4 - name: "LoadCursorW" - rva: 385992 + rva: 0x5e3c8 - name: "DefWindowProcW" - rva: 385996 + rva: 0x5e3cc - name: "DestroyWindow" - rva: 386000 + rva: 0x5e3d0 - name: "ReleaseCapture" - rva: 386004 + rva: 0x5e3d4 - name: "SetWindowLongW" - rva: 386008 + rva: 0x5e3d8 - name: "GetWindowLongW" - rva: 386012 + rva: 0x5e3dc - name: "CreateWindowExW" - rva: 386016 + rva: 0x5e3e0 - name: "CallWindowProcW" - rva: 386020 + rva: 0x5e3e4 - name: "ShowWindow" - rva: 386024 + rva: 0x5e3e8 - name: "MessageBoxW" - rva: 386028 + rva: 0x5e3ec - name: "RegisterWindowMessageW" - rva: 386032 + rva: 0x5e3f0 - name: "GetWindowTextLengthW" - rva: 386036 + rva: 0x5e3f4 - name: "GetWindowTextW" - rva: 386040 + rva: 0x5e3f8 - name: "SetWindowTextW" - rva: 386044 + rva: 0x5e3fc - name: "BeginPaint" - rva: 386048 + rva: 0x5e400 - name: "EndPaint" - rva: 386052 + rva: 0x5e404 - name: "IsChild" - rva: 386056 + rva: 0x5e408 - name: "GetFocus" - rva: 386060 + rva: 0x5e40c - name: "SetFocus" - rva: 386064 + rva: 0x5e410 - name: "GetWindow" - rva: 386068 + rva: 0x5e414 - name: "GetDlgItem" - rva: 386072 + rva: 0x5e418 - name: "GetClassNameW" - rva: 386076 + rva: 0x5e41c - name: "GetSysColor" - rva: 386080 + rva: 0x5e420 - name: "SetCapture" - rva: 386084 + rva: 0x5e424 - name: "RedrawWindow" - rva: 386088 + rva: 0x5e428 - name: "CreateAcceleratorTableW" - rva: 386092 + rva: 0x5e42c - name: "ClientToScreen" - rva: 386096 + rva: 0x5e430 - name: "GetParent" - rva: 386100 + rva: 0x5e434 - name: "ScreenToClient" - rva: 386104 + rva: 0x5e438 - name: "MoveWindow" - rva: 386108 + rva: 0x5e43c - name: "UpdateWindow" - rva: 386112 + rva: 0x5e440 - library_name: "GDI32.dll" number_of_functions: 10 functions: - name: "DeleteObject" - rva: 385068 + rva: 0x5e02c - name: "CreateSolidBrush" - rva: 385072 + rva: 0x5e030 - name: "CreateCompatibleDC" - rva: 385076 + rva: 0x5e034 - name: "CreateCompatibleBitmap" - rva: 385080 + rva: 0x5e038 - name: "SelectObject" - rva: 385084 + rva: 0x5e03c - name: "GetDeviceCaps" - rva: 385088 + rva: 0x5e040 - name: "BitBlt" - rva: 385092 + rva: 0x5e044 - name: "DeleteDC" - rva: 385096 + rva: 0x5e048 - name: "GetStockObject" - rva: 385100 + rva: 0x5e04c - name: "GetObjectW" - rva: 385104 + rva: 0x5e050 - library_name: "ADVAPI32.dll" number_of_functions: 10 functions: - name: "RegQueryValueExW" - rva: 385024 + rva: 0x5e000 - name: "RegDeleteValueW" - rva: 385028 + rva: 0x5e004 - name: "RegCreateKeyExW" - rva: 385032 + rva: 0x5e008 - name: "RegSetValueExW" - rva: 385036 + rva: 0x5e00c - name: "RegOpenKeyExW" - rva: 385040 + rva: 0x5e010 - name: "RegEnumKeyExW" - rva: 385044 + rva: 0x5e014 - name: "RegQueryInfoKeyW" - rva: 385048 + rva: 0x5e018 - name: "RegCloseKey" - rva: 385052 + rva: 0x5e01c - name: "RegDeleteKeyW" - rva: 385056 + rva: 0x5e020 - name: "RegQueryValueExA" - rva: 385060 + rva: 0x5e024 - library_name: "SHELL32.dll" number_of_functions: 4 functions: - name: "SHGetSpecialFolderPathW" - rva: 385808 + rva: 0x5e310 - name: "ShellExecuteW" - rva: 385812 + rva: 0x5e314 - name: "ord165" ordinal: 165 - rva: 385816 + rva: 0x5e318 - name: "SHGetFolderPathW" - rva: 385820 + rva: 0x5e31c - library_name: "ole32.dll" number_of_functions: 15 functions: - name: "CLSIDFromString" - rva: 386152 + rva: 0x5e468 - name: "CLSIDFromProgID" - rva: 386156 + rva: 0x5e46c - name: "OleInitialize" - rva: 386160 + rva: 0x5e470 - name: "CoTaskMemFree" - rva: 386164 + rva: 0x5e474 - name: "CoTaskMemRealloc" - rva: 386168 + rva: 0x5e478 - name: "CoTaskMemAlloc" - rva: 386172 + rva: 0x5e47c - name: "CoInitialize" - rva: 386176 + rva: 0x5e480 - name: "CoUninitialize" - rva: 386180 + rva: 0x5e484 - name: "CreateStreamOnHGlobal" - rva: 386184 + rva: 0x5e488 - name: "CoUnmarshalInterface" - rva: 386188 + rva: 0x5e48c - name: "StringFromGUID2" - rva: 386192 + rva: 0x5e490 - name: "OleLockRunning" - rva: 386196 + rva: 0x5e494 - name: "CoGetClassObject" - rva: 386200 + rva: 0x5e498 - name: "OleUninitialize" - rva: 386204 + rva: 0x5e49c - name: "CoCreateInstance" - rva: 386208 + rva: 0x5e4a0 - library_name: "OLEAUT32.dll" number_of_functions: 13 functions: - name: "SysStringByteLen" ordinal: 149 - rva: 385744 + rva: 0x5e2d0 - name: "VariantCopy" ordinal: 10 - rva: 385748 + rva: 0x5e2d4 - name: "SysStringLen" ordinal: 7 - rva: 385752 + rva: 0x5e2d8 - name: "OleCreateFontIndirect" ordinal: 420 - rva: 385756 + rva: 0x5e2dc - name: "LoadRegTypeLib" ordinal: 162 - rva: 385760 + rva: 0x5e2e0 - name: "SysAllocStringByteLen" ordinal: 150 - rva: 385764 + rva: 0x5e2e4 - name: "SysAllocStringLen" ordinal: 4 - rva: 385768 + rva: 0x5e2e8 - name: "VariantClear" ordinal: 9 - rva: 385772 + rva: 0x5e2ec - name: "SysAllocString" ordinal: 2 - rva: 385776 + rva: 0x5e2f0 - name: "SysFreeString" ordinal: 6 - rva: 385780 + rva: 0x5e2f4 - name: "VarUI4FromStr" ordinal: 277 - rva: 385784 + rva: 0x5e2f8 - name: "VariantInit" ordinal: 8 - rva: 385788 + rva: 0x5e2fc - name: "LoadTypeLib" ordinal: 161 - rva: 385792 + rva: 0x5e300 - library_name: "SHLWAPI.dll" number_of_functions: 14 functions: - name: "PathRemoveExtensionW" - rva: 385828 + rva: 0x5e324 - name: "StrToIntW" - rva: 385832 + rva: 0x5e328 - name: "PathAppendW" - rva: 385836 + rva: 0x5e32c - name: "PathCombineW" - rva: 385840 + rva: 0x5e330 - name: "PathIsDirectoryW" - rva: 385844 + rva: 0x5e334 - name: "PathRemoveFileSpecW" - rva: 385848 + rva: 0x5e338 - name: "PathIsPrefixW" - rva: 385852 + rva: 0x5e33c - name: "PathRemoveBackslashW" - rva: 385856 + rva: 0x5e340 - name: "PathCanonicalizeW" - rva: 385860 + rva: 0x5e344 - name: "PathIsRootW" - rva: 385864 + rva: 0x5e348 - name: "StrStrIW" - rva: 385868 + rva: 0x5e34c - name: "PathFindFileNameW" - rva: 385872 + rva: 0x5e350 - name: "PathAddBackslashW" - rva: 385876 + rva: 0x5e354 - name: "PathFileExistsW" - rva: 385880 + rva: 0x5e358 - library_name: "OLEACC.dll" number_of_functions: 1 functions: - name: "LresultFromObject" - rva: 385736 + rva: 0x5e2c8 - library_name: "IMM32.dll" number_of_functions: 1 functions: - name: "ImmDisableIME" - rva: 385112 + rva: 0x5e058 - library_name: "urlmon.dll" number_of_functions: 2 functions: - name: "ObtainUserAgentString" - rva: 386216 + rva: 0x5e4a8 - name: "UrlMkSetSessionOption" - rva: 386220 + rva: 0x5e4ac - library_name: "WININET.dll" number_of_functions: 3 functions: - name: "InternetSetCookieW" - rva: 386136 + rva: 0x5e458 - name: "InternetSetOptionW" - rva: 386140 + rva: 0x5e45c - name: "InternetSetCookieExW" - rva: 386144 + rva: 0x5e460 - library_name: "PSAPI.DLL" number_of_functions: 1 functions: - name: "GetModuleFileNameExW" - rva: 385800 + rva: 0x5e308 - library_name: "VERSION.dll" number_of_functions: 3 functions: - name: "GetFileVersionInfoSizeW" - rva: 386120 + rva: 0x5e448 - name: "GetFileVersionInfoW" - rva: 386124 + rva: 0x5e44c - name: "VerQueryValueW" - rva: 386128 + rva: 0x5e450 is_signed: false signatures: - subject: "/C=CN/ST=Beijing/L=Beijing/O=Qihoo 360 Software (Beijing) Company Limited/OU=Tech. Dev. Dept./CN=Qihoo 360 Software (Beijing) Company Limited" @@ -1187,5 +1187,5 @@ signatures: not_before: 1452556800 # 2016-01-12 00:00:00 UTC not_after: 1925942399 # 2031-01-11 23:59:59 UTC overlay: - offset: 552960 - size: 14432 \ No newline at end of file + offset: 0x87000 + size: 0x3860 \ No newline at end of file diff --git a/lib/src/modules/pe/tests/testdata/468052beb89bfb145169920f647472753c45756d672bee7fffed75279ed9c20a.out b/lib/src/modules/pe/tests/testdata/468052beb89bfb145169920f647472753c45756d672bee7fffed75279ed9c20a.out index d8ca93118..3d304eb65 100644 --- a/lib/src/modules/pe/tests/testdata/468052beb89bfb145169920f647472753c45756d672bee7fffed75279ed9c20a.out +++ b/lib/src/modules/pe/tests/testdata/468052beb89bfb145169920f647472753c45756d672bee7fffed75279ed9c20a.out @@ -17,25 +17,25 @@ opthdr_magic: IMAGE_NT_OPTIONAL_HDR64_MAGIC characteristics: 0x22 # EXECUTABLE_IMAGE | LARGE_ADDRESS_AWARE dll_characteristics: 0xc160 # HIGH_ENTROPY_VA | DYNAMIC_BASE | NX_COMPAT | GUARD_CF | TERMINAL_SERVER_AWARE timestamp: 93198170 # 1972-12-14 16:22:50 UTC -image_base: 140700201713664 +image_base: 0x7ff7518b0000 checksum: 115556 -base_of_code: 4096 -entry_point: 17024 -entry_point_raw: 20096 -section_alignment: 4096 -file_alignment: 512 -loader_flags: 0 -size_of_optional_header: 240 -size_of_code: 26112 -size_of_initialized_data: 23040 -size_of_uninitialized_data: 0 -size_of_image: 69632 -size_of_headers: 1024 -size_of_stack_reserve: 524288 -size_of_stack_commit: 16384 -size_of_heap_reserve: 1048576 -size_of_heap_commit: 4096 -pointer_to_symbol_table: 0 +base_of_code: 0x1000 +entry_point: 0x4280 +entry_point_raw: 0x4e80 +section_alignment: 0x1000 +file_alignment: 0x200 +loader_flags: 0x0 +size_of_optional_header: 0xf0 +size_of_code: 0x6600 +size_of_initialized_data: 0x5a00 +size_of_uninitialized_data: 0x0 +size_of_image: 0x11000 +size_of_headers: 0x400 +size_of_stack_reserve: 0x80000 +size_of_stack_commit: 0x4000 +size_of_heap_reserve: 0x100000 +size_of_heap_commit: 0x1000 +pointer_to_symbol_table: 0x0 win32_version_value: 0 number_of_symbols: 0 number_of_rva_and_sizes: 16 @@ -49,8 +49,8 @@ number_of_delayed_imports: 0 number_of_exports: 0 number_of_signatures: 0 rich_signature: - offset: 128 - length: 80 + offset: 0x80 + length: 0x50 key: 4190983425 raw_data: "E4\xa3\xaa\x01U\xcd\xf9\x01U\xcd\xf9\x01U\xcd\xf9\x15>\xcc\xf8\x03U\xcd\xf9\x15>\xce\xf8\x03U\xcd\xf9\x08-^\xf9:U\xcd\xf9\x01U\xcc\xf9\x95U\xcd\xf9\x15>\xc0\xf8\rU\xcd\xf9\x15>\xc9\xf8\rU\xcd\xf9\x15>2\xf9\x00U\xcd\xf9\x15>\xcf\xf8\x00U\xcd\xf9" clear_data: "DanS\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x14k\x01\x01\x02\x00\x00\x00\x14k\x03\x01\x02\x00\x00\x00\tx\x93\x00;\x00\x00\x00\x00\x00\x01\x00\x94\x00\x00\x00\x14k\r\x01\x0c\x00\x00\x00\x14k\x04\x01\x0c\x00\x00\x00\x14k\xff\x00\x01\x00\x00\x00\x14k\x02\x01\x01\x00\x00\x00" @@ -82,724 +82,724 @@ rich_signature: sections: - name: ".text" full_name: ".text" - characteristics: 1610612768 - raw_data_size: 26112 - raw_data_offset: 1024 - virtual_address: 4096 - virtual_size: 25981 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0x60000020 # SECTION_MEM_READ | SECTION_MEM_WRITE | SECTION_SCALE_INDEX + raw_data_size: 0x6600 + raw_data_offset: 0x400 + virtual_address: 0x1000 + virtual_size: 0x657d + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".rdata" full_name: ".rdata" - characteristics: 1073741888 - raw_data_size: 14848 - raw_data_offset: 27136 - virtual_address: 32768 - virtual_size: 14562 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0x40000040 + raw_data_size: 0x3a00 + raw_data_offset: 0x6a00 + virtual_address: 0x8000 + virtual_size: 0x38e2 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".data" full_name: ".data" - characteristics: 3221225536 - raw_data_size: 512 - raw_data_offset: 41984 - virtual_address: 49152 - virtual_size: 2184 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0xc0000040 + raw_data_size: 0x200 + raw_data_offset: 0xa400 + virtual_address: 0xc000 + virtual_size: 0x888 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".pdata" full_name: ".pdata" - characteristics: 1073741888 - raw_data_size: 2048 - raw_data_offset: 42496 - virtual_address: 53248 - virtual_size: 1692 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0x40000040 + raw_data_size: 0x800 + raw_data_offset: 0xa600 + virtual_address: 0xd000 + virtual_size: 0x69c + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".didat" full_name: ".didat" - characteristics: 3221225536 - raw_data_size: 512 - raw_data_offset: 44544 - virtual_address: 57344 - virtual_size: 48 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0xc0000040 + raw_data_size: 0x200 + raw_data_offset: 0xae00 + virtual_address: 0xe000 + virtual_size: 0x30 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".rsrc" full_name: ".rsrc" - characteristics: 1073741888 - raw_data_size: 2560 - raw_data_offset: 45056 - virtual_address: 61440 - virtual_size: 2080 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0x40000040 + raw_data_size: 0xa00 + raw_data_offset: 0xb000 + virtual_address: 0xf000 + virtual_size: 0x820 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".reloc" full_name: ".reloc" - characteristics: 1107296320 - raw_data_size: 512 - raw_data_offset: 47616 - virtual_address: 65536 - virtual_size: 108 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0x42000040 + raw_data_size: 0x200 + raw_data_offset: 0xba00 + virtual_address: 0x10000 + virtual_size: 0x6c + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 data_directories: - - virtual_address: 0 - size: 0 - - virtual_address: 41696 - size: 620 - - virtual_address: 61440 - size: 2080 - - virtual_address: 53248 - size: 1692 - - virtual_address: 48128 - size: 9232 - - virtual_address: 65536 - size: 108 - - virtual_address: 37168 - size: 84 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 33168 - size: 280 - - virtual_address: 0 - size: 0 - - virtual_address: 33584 - size: 1248 - - virtual_address: 41432 - size: 64 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0xa2e0 + size: 0x26c + - virtual_address: 0xf000 + size: 0x820 + - virtual_address: 0xd000 + size: 0x69c + - virtual_address: 0xbc00 + size: 0x2410 + - virtual_address: 0x10000 + size: 0x6c + - virtual_address: 0x9130 + size: 0x54 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x8190 + size: 0x118 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x8330 + size: 0x4e0 + - virtual_address: 0xa1d8 + size: 0x40 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 resource_timestamp: 0 # 1970-01-01 00:00:00 UTC resource_version: major: 31648 minor: 41354 resources: - - length: 8388035 - rva: 2017157120 + - length: 0x7ffdc3 + rva: 0x783b6000 type: RESOURCE_TYPE_MENU - - length: 32765 - rva: 2710207280 + - length: 0x7ffd + rva: 0xa18a7b30 type: 0 - - length: 32765 - rva: 2710513710 + - length: 0x7ffd + rva: 0xa18f282e type: 162480 - - length: 858783744 - rva: 2147328394 + - length: 0x33300000 + rva: 0x7ffda18a type: RESOURCE_TYPE_RCDATA - - length: 32765 - rva: 3291296560 + - length: 0x7ffd + rva: 0xc42d3330 type: 0 - - length: 32765 - rva: 3279436080 + - length: 0x7ffd + rva: 0xc3783930 type: 1486848 - - length: 16843009 - rva: 4294967295 + - length: 0x1010101 + rva: 0xffffffff type: 1552384 - - length: 32765 - rva: 2710209520 + - length: 0x7ffd + rva: 0xa18a83f0 type: 1139792 - - length: 32765 - rva: 2710207936 + - length: 0x7ffd + rva: 0xa18a7dc0 type: 1065552 - - length: 32765 - rva: 2711135136 + - length: 0x7ffd + rva: 0xa198a3a0 type: 1383992 - - length: 32765 - rva: 2710513710 + - length: 0x7ffd + rva: 0xa18f282e type: 1036020 - - length: 255 - rva: 4294967295 + - length: 0xff + rva: 0xffffffff type: 1818587694 - - length: 32765 - rva: 2748010640 + - length: 0x7ffd + rva: 0xa3cb5090 type: 1685353280 - - length: 8388036 - rva: 758329344 + - length: 0x7ffdc4 + rva: 0x2d333000 type: RESOURCE_TYPE_CURSOR - - length: 8388035 - rva: 2017157120 + - length: 0x7ffdc3 + rva: 0x783b6000 type: RESOURCE_TYPE_MENU - - length: 32765 - rva: 2710513710 + - length: 0x7ffd + rva: 0xa18f282e type: 84832 - - length: 858783744 - rva: 2147328394 + - length: 0x33300000 + rva: 0x7ffda18a type: RESOURCE_TYPE_RCDATA - - length: 32765 - rva: 3291296560 + - length: 0x7ffd + rva: 0xc42d3330 type: 0 - - length: 32765 - rva: 3291412832 + - length: 0x7ffd + rva: 0xc42ef960 type: 842240 - - length: 6292015 - rva: 715974112 + - length: 0x60022f + rva: 0x2aace5e0 type: 918528 - - length: 32765 - rva: 2710209520 + - length: 0x7ffd + rva: 0xa18a83f0 type: 657648 - - length: 32765 - rva: 2710207936 + - length: 0x7ffd + rva: 0xa18a7dc0 type: 565216 - - length: 32765 - rva: 2710513710 + - length: 0x7ffd + rva: 0xa18f282e type: 544016 - - length: 255 - rva: 4294967295 + - length: 0xff + rva: 0xffffffff type: 1818587694 - - length: 32765 - rva: 2748010640 + - length: 0x7ffd + rva: 0xa3cb5090 type: 1685353280 - - length: 32765 - rva: 2748010640 + - length: 0x7ffd + rva: 0xa3cb5090 type: 1685353280 - - length: 1011875840 - rva: 2147337080 - - length: 8388035 - rva: 2017157120 + - length: 0x3c500000 + rva: 0x7ffdc378 + - length: 0x7ffdc3 + rva: 0x783b6000 type: RESOURCE_TYPE_MENU - - length: 32765 - rva: 2710207280 + - length: 0x7ffd + rva: 0xa18a7b30 type: 0 - - length: 32765 - rva: 2710513710 + - length: 0x7ffd + rva: 0xa18f282e type: 30240 - - length: 858783744 - rva: 2147328394 + - length: 0x33300000 + rva: 0x7ffda18a type: RESOURCE_TYPE_RCDATA - - length: 32765 - rva: 3291296560 + - length: 0x7ffd + rva: 0xc42d3330 type: 0 - - length: 32765 - rva: 2748010640 + - length: 0x7ffd + rva: 0xa3cb5090 type: 1317376 - - length: 1048576 - rva: 1129727304 + - length: 0x100000 + rva: 0x43564548 type: 1220608 - - length: 32765 - rva: 2710207936 + - length: 0x7ffd + rva: 0xa18a7dc0 type: 37664 - - length: 32765 - rva: 2710513710 + - length: 0x7ffd + rva: 0xa18f282e type: 29568 - - length: 3 - rva: 9460301 + - length: 0x3 + rva: 0x905a4d type: 1150506 - - length: 255 - rva: 4294967295 + - length: 0xff + rva: 0xffffffff type: 1818587694 - - length: 8388035 - rva: 2017157120 + - length: 0x7ffdc3 + rva: 0x783b6000 type: RESOURCE_TYPE_MENU - - length: 32765 - rva: 2710513710 + - length: 0x7ffd + rva: 0xa18f282e type: 281824 - - length: 858783744 - rva: 2147328394 + - length: 0x33300000 + rva: 0x7ffda18a type: RESOURCE_TYPE_RCDATA - - length: 32765 - rva: 3291296560 + - length: 0x7ffd + rva: 0xc42d3330 type: 0 - - length: 512 - rva: 1482752 + - length: 0x200 + rva: 0x16a000 type: 397312 - - length: 32765 - rva: 2710209520 + - length: 0x7ffd + rva: 0xa18a83f0 type: 304216 - - length: 32765 - rva: 2710207936 + - length: 0x7ffd + rva: 0xa18a7dc0 type: 303936 - - length: 32765 - rva: 2710513710 + - length: 0x7ffd + rva: 0xa18f282e type: 290940 - - length: 255 - rva: 4294967295 + - length: 0xff + rva: 0xffffffff type: 1818587694 - - length: 32765 - rva: 3139972256 + - length: 0x7ffd + rva: 0xbb282ca0 type: 0 - - length: 32765 - rva: 2956636536 + - length: 0x7ffd + rva: 0xb03ab178 type: 0 - - length: 32765 - rva: 2710207392 - - length: 8388001 - rva: 2323357696 + - length: 0x7ffd + rva: 0xa18a7ba0 + - length: 0x7ffda1 + rva: 0x8a7ba000 type: 49710 - - length: 8388035 - rva: 2017157120 + - length: 0x7ffdc3 + rva: 0x783b6000 type: RESOURCE_TYPE_MENU - - length: 32765 - rva: 2710207280 + - length: 0x7ffd + rva: 0xa18a7b30 type: 0 - - length: 32765 - rva: 2710513710 + - length: 0x7ffd + rva: 0xa18f282e type: 336462347 - - length: 32765 - rva: 2710513710 + - length: 0x7ffd + rva: 0xa18f282e type: 5136 - - length: 858783744 - rva: 2147328394 + - length: 0x33300000 + rva: 0x7ffda18a type: RESOURCE_TYPE_RCDATA - - length: 32765 - rva: 3291296560 + - length: 0x7ffd + rva: 0xc42d3330 type: 0 - - length: 32765 - rva: 2710207936 + - length: 0x7ffd + rva: 0xa18a7dc0 type: 8208 - - length: 32765 - rva: 2710513710 + - length: 0x7ffd + rva: 0xa18f282e type: 4059 - - length: 3 - rva: 9460301 + - length: 0x3 + rva: 0x905a4d type: 5224 - - length: 32765 - rva: 2748890144 + - length: 0x7ffd + rva: 0xa3d8bc20 type: 1720 - - length: 32765 - rva: 2748010640 + - length: 0x7ffd + rva: 0xa3cb5090 type: 432 - - length: 255 - rva: 4294967295 + - length: 0xff + rva: 0xffffffff type: 1818587694 - - length: 32765 - rva: 2748028970 + - length: 0x7ffd + rva: 0xa3cb982a type: 32 - - length: 8388035 - rva: 2017157120 + - length: 0x7ffdc3 + rva: 0x783b6000 type: RESOURCE_TYPE_MENU - - length: 300057105 - rva: 1868869061 + - length: 0x11e28211 + rva: 0x6f64adc5 type: 336462347 - - length: 32765 - rva: 2710513710 + - length: 0x7ffd + rva: 0xa18f282e type: 152160 - - length: 858783744 - rva: 2147328394 + - length: 0x33300000 + rva: 0x7ffda18a type: RESOURCE_TYPE_RCDATA - - length: 32765 - rva: 3291296560 + - length: 0x7ffd + rva: 0xc42d3330 type: 0 - - length: 32765 - rva: 2710209520 + - length: 0x7ffd + rva: 0xa18a83f0 type: 169432 - - length: 32765 - rva: 2710207936 + - length: 0x7ffd + rva: 0xa18a7dc0 type: 169152 - - length: 32765 - rva: 3291161680 + - length: 0x7ffd + rva: 0xc42b2450 type: 188872 - - length: 32765 - rva: 2710513710 + - length: 0x7ffd + rva: 0xa18f282e type: 152283 - - length: 32765 - rva: 3125756855 + - length: 0x7ffd + rva: 0xba4f43b7 type: 35214 - - length: 255 - rva: 4294967295 + - length: 0xff + rva: 0xffffffff type: 1818587694 - - length: 775946240 - rva: 1073741824 + - length: 0x2e400000 + rva: 0x40000000 type: 290431350 - - length: 8388035 - rva: 2017157120 + - length: 0x7ffdc3 + rva: 0x783b6000 type: RESOURCE_TYPE_MENU - - length: 32765 - rva: 2710513710 + - length: 0x7ffd + rva: 0xa18f282e type: 139968 - - length: 858783744 - rva: 2147328394 + - length: 0x33300000 + rva: 0x7ffda18a type: RESOURCE_TYPE_RCDATA - - length: 32765 - rva: 3291296560 + - length: 0x7ffd + rva: 0xc42d3330 type: 0 - - length: 32765 - rva: 2710207936 + - length: 0x7ffd + rva: 0xa18a7dc0 type: 391776 - - length: 32765 - rva: 3291161680 + - length: 0x7ffd + rva: 0xc42b2450 type: 447088 - - length: 32765 - rva: 2710513710 + - length: 0x7ffd + rva: 0xa18f282e type: 378395 - - length: 255 - rva: 4294967295 + - length: 0xff + rva: 0xffffffff type: 1818587694 - - length: 32765 - rva: 3291161680 + - length: 0x7ffd + rva: 0xc42b2450 type: 1080325235 - - length: 32765 - rva: 2748010640 + - length: 0x7ffd + rva: 0xa3cb5090 type: 1685353280 - - length: 32765 - rva: 2748010640 + - length: 0x7ffd + rva: 0xa3cb5090 type: 1685353280 - - length: 32765 - rva: 2748010640 + - length: 0x7ffd + rva: 0xa3cb5090 type: 1852798053 - - length: 32765 - rva: 2748010640 + - length: 0x7ffd + rva: 0xa3cb5090 type: 1818851136 - - length: 32765 - rva: 3291161680 + - length: 0x7ffd + rva: 0xc42b2450 type: 1081370223 - - length: 32765 - rva: 3291161680 + - length: 0x7ffd + rva: 0xc42b2450 type: 1081370223 - - length: 32765 - rva: 2748010640 + - length: 0x7ffd + rva: 0xa3cb5090 type: 1952870259 - - length: 32765 - rva: 3291161680 + - length: 0x7ffd + rva: 0xc42b2450 type: 1081370223 - - length: 32765 - rva: 2748010640 + - length: 0x7ffd + rva: 0xa3cb5090 type: 1818323059 - - length: 32765 - rva: 3291161680 + - length: 0x7ffd + rva: 0xc42b2450 type: 1081370223 - - length: 32765 - rva: 3291161680 + - length: 0x7ffd + rva: 0xc42b2450 type: 1081370223 - - length: 32765 - rva: 3291161680 + - length: 0x7ffd + rva: 0xc42b2450 type: 1081370223 - - length: 32765 - rva: 3291161680 + - length: 0x7ffd + rva: 0xc42b2450 type: 1081370223 - - length: 32765 - rva: 2748010640 + - length: 0x7ffd + rva: 0xa3cb5090 type: 1853321070 - - length: 32765 - rva: 3291161680 + - length: 0x7ffd + rva: 0xc42b2450 type: 1081370223 - - length: 32765 - rva: 2748010640 + - length: 0x7ffd + rva: 0xa3cb5090 type: 1952870259 - - length: 32765 - rva: 2748010640 + - length: 0x7ffd + rva: 0xa3cb5090 type: 1886602342 - - length: 32765 - rva: 2748010640 + - length: 0x7ffd + rva: 0xa3cb5090 type: 1952870259 - - length: 32765 - rva: 3291161680 + - length: 0x7ffd + rva: 0xc42b2450 type: 1081370223 - - length: 32765 - rva: 2748010640 + - length: 0x7ffd + rva: 0xa3cb5090 type: 1952870259 - - length: 32765 - rva: 3291161680 + - length: 0x7ffd + rva: 0xc42b2450 type: 1081370223 - - length: 32765 - rva: 3291161680 + - length: 0x7ffd + rva: 0xc42b2450 type: 1078211439 - - length: 32765 - rva: 3291161680 + - length: 0x7ffd + rva: 0xc42b2450 type: 1078211439 - - length: 32765 - rva: 2748010640 + - length: 0x7ffd + rva: 0xa3cb5090 type: 1144221545 - - length: 32765 - rva: 2748010640 + - length: 0x7ffd + rva: 0xa3cb5090 type: 1919247465 - - length: 32765 - rva: 2748010640 + - length: 0x7ffd + rva: 0xa3cb5090 type: 1919251570 - - length: 805306495 - rva: 4257445953 - - length: 32765 - rva: 2710207392 + - length: 0x3000007f + rva: 0xfdc37841 + - length: 0x7ffd + rva: 0xa18a7ba0 type: RESOURCE_TYPE_FONTDIR - - length: 32765 - rva: 2710207392 + - length: 0x7ffd + rva: 0xa18a7ba0 type: RESOURCE_TYPE_FONT - - length: 858783744 - rva: 2147328394 + - length: 0x33300000 + rva: 0x7ffda18a type: RESOURCE_TYPE_RCDATA - - length: 858783744 - rva: 2147328394 + - length: 0x33300000 + rva: 0x7ffda18a type: RESOURCE_TYPE_RCDATA - - length: 32765 - rva: 2710207392 + - length: 0x7ffd + rva: 0xa18a7ba0 type: RESOURCE_TYPE_FONT - - length: 858783744 - rva: 2147328394 + - length: 0x33300000 + rva: 0x7ffda18a type: RESOURCE_TYPE_RCDATA - - length: 858783744 - rva: 2147328394 + - length: 0x33300000 + rva: 0x7ffda18a type: RESOURCE_TYPE_RCDATA - - length: 858783744 - rva: 2147328394 + - length: 0x33300000 + rva: 0x7ffda18a type: RESOURCE_TYPE_RCDATA - - length: 32765 - rva: 2710207392 + - length: 0x7ffd + rva: 0xa18a7ba0 type: RESOURCE_TYPE_DIALOG - - length: 32765 - rva: 2710207392 + - length: 0x7ffd + rva: 0xa18a7ba0 type: RESOURCE_TYPE_FONT - - length: 32765 - rva: 2710207392 + - length: 0x7ffd + rva: 0xa18a7ba0 type: RESOURCE_TYPE_FONT - - length: 32765 - rva: 2710207392 + - length: 0x7ffd + rva: 0xa18a7ba0 type: RESOURCE_TYPE_FONT - - length: 32765 - rva: 2710207392 + - length: 0x7ffd + rva: 0xa18a7ba0 type: RESOURCE_TYPE_FONT - - length: 858783744 - rva: 2147328394 + - length: 0x33300000 + rva: 0x7ffda18a type: RESOURCE_TYPE_ACCELERATOR - - length: 858783744 - rva: 2147328394 + - length: 0x33300000 + rva: 0x7ffda18a type: RESOURCE_TYPE_RCDATA - - length: 8388036 - rva: 758329344 + - length: 0x7ffdc4 + rva: 0x2d333000 type: 13 - - length: 8388036 - rva: 758329344 + - length: 0x7ffdc4 + rva: 0x2d333000 type: 15 - - length: 8388036 - rva: 758329344 + - length: 0x7ffdc4 + rva: 0x2d333000 type: 15 - - length: 8388036 - rva: 758329344 + - length: 0x7ffdc4 + rva: 0x2d333000 type: 15 - - length: 8388036 - rva: 758329344 + - length: 0x7ffdc4 + rva: 0x2d333000 type: 15 - - length: 32765 - rva: 2710207392 + - length: 0x7ffd + rva: 0xa18a7ba0 type: RESOURCE_TYPE_DIALOG - - length: 32765 - rva: 2710207392 + - length: 0x7ffd + rva: 0xa18a7ba0 type: RESOURCE_TYPE_FONT - - length: 32765 - rva: 2710207392 + - length: 0x7ffd + rva: 0xa18a7ba0 type: RESOURCE_TYPE_FONT - - length: 32765 - rva: 2710207392 + - length: 0x7ffd + rva: 0xa18a7ba0 type: RESOURCE_TYPE_FONT - - length: 32765 - rva: 2710207392 + - length: 0x7ffd + rva: 0xa18a7ba0 type: RESOURCE_TYPE_FONT - - length: 858783744 - rva: 2147328394 + - length: 0x33300000 + rva: 0x7ffda18a type: RESOURCE_TYPE_ACCELERATOR - - length: 858783744 - rva: 2147328394 + - length: 0x33300000 + rva: 0x7ffda18a type: RESOURCE_TYPE_RCDATA - - length: 8388036 - rva: 758329344 + - length: 0x7ffdc4 + rva: 0x2d333000 type: 13 - - length: 8388036 - rva: 758329344 + - length: 0x7ffdc4 + rva: 0x2d333000 type: 15 - - length: 8388036 - rva: 758329344 + - length: 0x7ffdc4 + rva: 0x2d333000 type: 15 - - length: 8388036 - rva: 758329344 + - length: 0x7ffdc4 + rva: 0x2d333000 type: 15 - - length: 8388036 - rva: 758329344 + - length: 0x7ffdc4 + rva: 0x2d333000 type: 15 - - length: 8388035 - rva: 2017157120 + - length: 0x7ffdc3 + rva: 0x783b6000 type: RESOURCE_TYPE_MENU - - length: 32765 - rva: 2710513710 + - length: 0x7ffd + rva: 0xa18f282e type: 12960 - - length: 858783744 - rva: 2147328394 + - length: 0x33300000 + rva: 0x7ffda18a type: RESOURCE_TYPE_RCDATA - - length: 32765 - rva: 3291296560 + - length: 0x7ffd + rva: 0xc42d3330 type: 0 - - length: 32765 - rva: 2710209520 + - length: 0x7ffd + rva: 0xa18a83f0 type: 345272 - - length: 32765 - rva: 2710207936 + - length: 0x7ffd + rva: 0xa18a7dc0 type: 300064 - - length: 32765 - rva: 3291412832 + - length: 0x7ffd + rva: 0xc42ef960 type: 448752 - - length: 32765 - rva: 2710513710 + - length: 0x7ffd + rva: 0xa18f282e type: 293427 - - length: 255 - rva: 4294967295 + - length: 0xff + rva: 0xffffffff type: 1818587694 - - length: 32765 - rva: 2748010640 + - length: 0x7ffd + rva: 0xa3cb5090 type: 1685353280 - - length: 32765 - rva: 3279438320 + - length: 0x7ffd + rva: 0xc37841f0 type: 1091704238 - - length: 1 - rva: 1610618142 - - length: 8388035 - rva: 2017157120 + - length: 0x1 + rva: 0x6000151e + - length: 0x7ffdc3 + rva: 0x783b6000 type: RESOURCE_TYPE_MENU - - length: 32765 - rva: 2710513710 + - length: 0x7ffd + rva: 0xa18f282e type: 112432 - - length: 858783744 - rva: 2147328394 + - length: 0x33300000 + rva: 0x7ffda18a type: RESOURCE_TYPE_RCDATA - - length: 32765 - rva: 3291296560 + - length: 0x7ffd + rva: 0xc42d3330 type: 0 - - length: 32765 - rva: 2710207936 + - length: 0x7ffd + rva: 0xa18a7dc0 type: 120944 - - length: 32765 - rva: 2710513710 + - length: 0x7ffd + rva: 0xa18f282e type: 113027 - - length: 32765 - rva: 3125107174 + - length: 0x7ffd + rva: 0xba4559e6 type: 32118 - - length: 32765 - rva: 3126205896 + - length: 0x7ffd + rva: 0xba561dc8 type: 1824 - - length: 32765 - rva: 3125756855 + - length: 0x7ffd + rva: 0xba4f43b7 type: 11504 - - length: 3 - rva: 9460301 + - length: 0x3 + rva: 0x905a4d type: 1032 - - length: 255 - rva: 4294967295 + - length: 0xff + rva: 0xffffffff type: 1818587694 - - length: 8388035 - rva: 2017157120 + - length: 0x7ffdc3 + rva: 0x783b6000 type: RESOURCE_TYPE_MENU - - length: 32765 - rva: 2710513710 + - length: 0x7ffd + rva: 0xa18f282e type: 111008 - - length: 858783744 - rva: 2147328394 + - length: 0x33300000 + rva: 0x7ffda18a type: RESOURCE_TYPE_RCDATA - - length: 32765 - rva: 3291296560 + - length: 0x7ffd + rva: 0xc42d3330 type: 0 - - length: 32765 - rva: 2748010640 + - length: 0x7ffd + rva: 0xa3cb5090 type: 1961984 - - length: 32765 - rva: 2710207936 + - length: 0x7ffd + rva: 0xa18a7dc0 type: 1472496 - - length: 32765 - rva: 3291161680 + - length: 0x7ffd + rva: 0xc42b2450 type: 1698140 - - length: 32765 - rva: 2710513710 + - length: 0x7ffd + rva: 0xa18f282e type: 1399868 - - length: 255 - rva: 4294967295 + - length: 0xff + rva: 0xffffffff type: 1818587694 - - length: 4210805 - rva: 1883465070 + - length: 0x404075 + rva: 0x7043656e type: 60670 - - length: 4210805 - rva: 1883465070 + - length: 0x404075 + rva: 0x7043656e type: 15789823 - - length: 32765 - rva: 2748010640 + - length: 0x7ffd + rva: 0xa3cb5090 type: 1685353280 - - length: 32765 - rva: 2748010640 + - length: 0x7ffd + rva: 0xa3cb5090 type: 1685353280 - - length: 32765 - rva: 2748010640 + - length: 0x7ffd + rva: 0xa3cb5090 type: 1685353280 - - length: 32765 - rva: 3291161680 + - length: 0x7ffd + rva: 0xc42b2450 type: 1080325235 - - length: 32765 - rva: 2748010640 + - length: 0x7ffd + rva: 0xa3cb5090 type: 1685353280 - - length: 32765 - rva: 3291161680 + - length: 0x7ffd + rva: 0xc42b2450 type: 1080325235 - - length: 32765 - rva: 2748010640 + - length: 0x7ffd + rva: 0xa3cb5090 type: 1685353280 - - length: 32765 - rva: 2748010640 + - length: 0x7ffd + rva: 0xa3cb5090 type: 1685353280 - - length: 536871039 - rva: 4255373500 - - length: 8388035 - rva: 2017157120 + - length: 0x2000007f + rva: 0xfda3d8bc + - length: 0x7ffdc3 + rva: 0x783b6000 type: 258 - - length: 8388036 - rva: 758329344 + - length: 0x7ffdc4 + rva: 0x2d333000 type: 288 - - length: 32765 - rva: 3279436256 + - length: 0x7ffd + rva: 0xc37839e0 type: 46080 - - length: 32765 - rva: 3279436384 + - length: 0x7ffd + rva: 0xc3783a60 type: 45184 - - length: 32765 - rva: 3279436128 + - length: 0x7ffd + rva: 0xc3783960 type: 17920 - - length: 8388001 - rva: 2323357696 + - length: 0x7ffda1 + rva: 0x8a7ba000 type: RESOURCE_TYPE_FONT - - length: 805306495 - rva: 4255222395 + - length: 0x3000007f + rva: 0xfda18a7b type: 65280 - - length: 32765 - rva: 3279436000 + - length: 0x7ffd + rva: 0xc37838e0 type: 61440 - - length: 32765 - rva: 3279436000 + - length: 0x7ffd + rva: 0xc37838e0 type: 0 - - length: 127 - rva: 4257492275 + - length: 0x7f + rva: 0xfdc42d33 type: 63488 - - length: 8388035 - rva: 2017095680 + - length: 0x7ffdc3 + rva: 0x783a7000 type: 18176 - - length: 825504358 - rva: 942956902 + - length: 0x31343266 + rva: 0x38346166 type: 0 - - length: 32765 - rva: 3291161680 + - length: 0x7ffd + rva: 0xc42b2450 type: 63488 - - length: 32765 - rva: 3279436512 + - length: 0x7ffd + rva: 0xc3783ae0 type: 16960 - - length: 8388001 - rva: 2323357696 + - length: 0x7ffda1 + rva: 0x8a7ba000 type: 128 - - length: 32765 - rva: 3279436640 + - length: 0x7ffd + rva: 0xc3783b60 type: 4096 is_signed: false overlay: - offset: 48128 - size: 303828 \ No newline at end of file + offset: 0xbc00 + size: 0x4a2d4 \ No newline at end of file diff --git a/lib/src/modules/pe/tests/testdata/55cfd3bcea1aa352b4687c4d45bdcfea184ce9b58320891a2d72d4ec93766f14.out b/lib/src/modules/pe/tests/testdata/55cfd3bcea1aa352b4687c4d45bdcfea184ce9b58320891a2d72d4ec93766f14.out index 79a54d4e9..3fd0a7dd9 100644 --- a/lib/src/modules/pe/tests/testdata/55cfd3bcea1aa352b4687c4d45bdcfea184ce9b58320891a2d72d4ec93766f14.out +++ b/lib/src/modules/pe/tests/testdata/55cfd3bcea1aa352b4687c4d45bdcfea184ce9b58320891a2d72d4ec93766f14.out @@ -17,26 +17,26 @@ opthdr_magic: IMAGE_NT_OPTIONAL_HDR32_MAGIC characteristics: 0x103 # RELOCS_STRIPPED | EXECUTABLE_IMAGE | MACHINE_32BIT dll_characteristics: 0x400 # NO_SEH timestamp: 1162198621 # 2006-10-30 08:57:01 UTC -image_base: 4194304 +image_base: 0x400000 checksum: 0 -base_of_code: 292 -base_of_data: 296 -entry_point: 292 -entry_point_raw: 292 -section_alignment: 4 -file_alignment: 4 -loader_flags: 0 -size_of_optional_header: 224 -size_of_code: 4 -size_of_initialized_data: 0 -size_of_uninitialized_data: 0 -size_of_image: 296 -size_of_headers: 292 -size_of_stack_reserve: 1048576 -size_of_stack_commit: 4096 -size_of_heap_reserve: 1048576 -size_of_heap_commit: 4096 -pointer_to_symbol_table: 0 +base_of_code: 0x124 +base_of_data: 0x128 +entry_point: 0x124 +entry_point_raw: 0x124 +section_alignment: 0x4 +file_alignment: 0x4 +loader_flags: 0x0 +size_of_optional_header: 0xe0 +size_of_code: 0x4 +size_of_initialized_data: 0x0 +size_of_uninitialized_data: 0x0 +size_of_image: 0x128 +size_of_headers: 0x124 +size_of_stack_reserve: 0x100000 +size_of_stack_commit: 0x1000 +size_of_heap_reserve: 0x100000 +size_of_heap_commit: 0x1000 +pointer_to_symbol_table: 0x0 win32_version_value: 0 number_of_symbols: 0 number_of_rva_and_sizes: 16 @@ -52,49 +52,49 @@ number_of_signatures: 0 sections: - name: ".text" full_name: ".text" - characteristics: 1610612768 - raw_data_size: 4 - raw_data_offset: 292 - virtual_address: 292 - virtual_size: 4 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0x60000020 # SECTION_MEM_READ | SECTION_MEM_WRITE | SECTION_SCALE_INDEX + raw_data_size: 0x4 + raw_data_offset: 0x124 + virtual_address: 0x124 + virtual_size: 0x4 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 data_directories: - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 is_signed: false overlay: - offset: 0 - size: 0 \ No newline at end of file + offset: 0x0 + size: 0x0 \ No newline at end of file diff --git a/lib/src/modules/pe/tests/testdata/616095160dd4b1556848907729606d0de3cfa34938eb76a1412c49a9082962ee.out b/lib/src/modules/pe/tests/testdata/616095160dd4b1556848907729606d0de3cfa34938eb76a1412c49a9082962ee.out index c04fc6e80..a5a6579d4 100644 --- a/lib/src/modules/pe/tests/testdata/616095160dd4b1556848907729606d0de3cfa34938eb76a1412c49a9082962ee.out +++ b/lib/src/modules/pe/tests/testdata/616095160dd4b1556848907729606d0de3cfa34938eb76a1412c49a9082962ee.out @@ -17,25 +17,25 @@ opthdr_magic: IMAGE_NT_OPTIONAL_HDR64_MAGIC characteristics: 0x22 # EXECUTABLE_IMAGE | LARGE_ADDRESS_AWARE dll_characteristics: 0x8140 # DYNAMIC_BASE | NX_COMPAT | TERMINAL_SERVER_AWARE timestamp: 1642150359 # 2022-01-14 08:52:39 UTC -image_base: 5368709120 +image_base: 0x140000000 checksum: 119600 -base_of_code: 4096 -entry_point: 11840 -entry_point_raw: 14912 -section_alignment: 4096 -file_alignment: 512 -loader_flags: 0 -size_of_optional_header: 240 -size_of_code: 63488 -size_of_initialized_data: 28672 -size_of_uninitialized_data: 0 -size_of_image: 114688 -size_of_headers: 1024 -size_of_stack_reserve: 1048576 -size_of_stack_commit: 4096 -size_of_heap_reserve: 1048576 -size_of_heap_commit: 4096 -pointer_to_symbol_table: 0 +base_of_code: 0x1000 +entry_point: 0x2e40 +entry_point_raw: 0x3a40 +section_alignment: 0x1000 +file_alignment: 0x200 +loader_flags: 0x0 +size_of_optional_header: 0xf0 +size_of_code: 0xf800 +size_of_initialized_data: 0x7000 +size_of_uninitialized_data: 0x0 +size_of_image: 0x1c000 +size_of_headers: 0x400 +size_of_stack_reserve: 0x100000 +size_of_stack_commit: 0x1000 +size_of_heap_reserve: 0x100000 +size_of_heap_commit: 0x1000 +pointer_to_symbol_table: 0x0 win32_version_value: 0 number_of_symbols: 0 number_of_rva_and_sizes: 16 @@ -86,8 +86,8 @@ version_info_list: - key: "ProductVersion" value: "7.1.1.0" rich_signature: - offset: 128 - length: 72 + offset: 0x80 + length: 0x48 key: 3573433955 raw_data: "\'\'\x90\x87cF\xfe\xd4cF\xfe\xd4cF\xfe\xd4\xf0\x08f\xd4gF\xfe\xd4x\xdbU\xd4GF\xfe\xd4x\xdb`\xd4iF\xfe\xd4j>m\xd4fF\xfe\xd4cF\xff\xd4\x04F\xfe\xd4x\xdbT\xd4\xefF\xfe\xd4x\xdbc\xd4bF\xfe\xd4" clear_data: "DanS\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x93N\x98\x00\x04\x00\x00\x00\x1b\x9d\xab\x00$\x00\x00\x00\x1b\x9d\x9e\x00\n\x00\x00\x00\tx\x93\x00\x05\x00\x00\x00\x00\x00\x01\x00g\x00\x00\x00\x1b\x9d\xaa\x00\x8c\x00\x00\x00\x1b\x9d\x9d\x00\x01\x00\x00\x00" @@ -116,123 +116,123 @@ rich_signature: sections: - name: ".text" full_name: ".text" - characteristics: 1610612768 - raw_data_size: 63488 - raw_data_offset: 1024 - virtual_address: 4096 - virtual_size: 63294 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0x60000020 # SECTION_MEM_READ | SECTION_MEM_WRITE | SECTION_SCALE_INDEX + raw_data_size: 0xf800 + raw_data_offset: 0x400 + virtual_address: 0x1000 + virtual_size: 0xf73e + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".rdata" full_name: ".rdata" - characteristics: 1073741888 - raw_data_size: 15360 - raw_data_offset: 64512 - virtual_address: 69632 - virtual_size: 15080 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0x40000040 + raw_data_size: 0x3c00 + raw_data_offset: 0xfc00 + virtual_address: 0x11000 + virtual_size: 0x3ae8 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".data" full_name: ".data" - characteristics: 3221225536 - raw_data_size: 6144 - raw_data_offset: 79872 - virtual_address: 86016 - virtual_size: 14788 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0xc0000040 + raw_data_size: 0x1800 + raw_data_offset: 0x13800 + virtual_address: 0x15000 + virtual_size: 0x39c4 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".pdata" full_name: ".pdata" - characteristics: 1073741888 - raw_data_size: 3584 - raw_data_offset: 86016 - virtual_address: 102400 - virtual_size: 3120 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0x40000040 + raw_data_size: 0xe00 + raw_data_offset: 0x15000 + virtual_address: 0x19000 + virtual_size: 0xc30 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".rsrc" full_name: ".rsrc" - characteristics: 1073741888 - raw_data_size: 2560 - raw_data_offset: 89600 - virtual_address: 106496 - virtual_size: 2126 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0x40000040 + raw_data_size: 0xa00 + raw_data_offset: 0x15e00 + virtual_address: 0x1a000 + virtual_size: 0x84e + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".reloc" full_name: ".reloc" - characteristics: 1107296320 - raw_data_size: 1024 - raw_data_offset: 92160 - virtual_address: 110592 - virtual_size: 860 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0x42000040 + raw_data_size: 0x400 + raw_data_offset: 0x16800 + virtual_address: 0x1b000 + virtual_size: 0x35c + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 data_directories: - - virtual_address: 0 - size: 0 - - virtual_address: 82352 - size: 40 - - virtual_address: 106496 - size: 2126 - - virtual_address: 102400 - size: 3120 - - virtual_address: 93184 - size: 6456 - - virtual_address: 110592 - size: 436 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 69632 - size: 696 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x141b0 + size: 0x28 + - virtual_address: 0x1a000 + size: 0x84e + - virtual_address: 0x19000 + size: 0xc30 + - virtual_address: 0x16c00 + size: 0x1938 + - virtual_address: 0x1b000 + size: 0x1b4 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x11000 + size: 0x2b8 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 resource_timestamp: 0 # 1970-01-01 00:00:00 UTC resource_version: major: 4 minor: 0 resources: - - length: 800 - rva: 106680 - offset: 89784 + - length: 0x320 + rva: 0x1a0b8 + offset: 0x15eb8 type: RESOURCE_TYPE_VERSION id: 1 language: 1031 - - length: 796 - rva: 107480 - offset: 90584 + - length: 0x31c + rva: 0x1a3d8 + offset: 0x161d8 type: RESOURCE_TYPE_VERSION id: 1 language: 1033 - - length: 346 - rva: 108276 - offset: 91380 + - length: 0x15a + rva: 0x1a6f4 + offset: 0x164f4 type: RESOURCE_TYPE_MANIFEST id: 1 language: 1033 @@ -241,177 +241,177 @@ import_details: number_of_functions: 86 functions: - name: "FindClose" - rva: 69632 + rva: 0x11000 - name: "GetModuleFileNameA" - rva: 69640 + rva: 0x11008 - name: "HeapAlloc" - rva: 69648 + rva: 0x11010 - name: "GetLastError" - rva: 69656 + rva: 0x11018 - name: "HeapFree" - rva: 69664 + rva: 0x11020 - name: "GetFullPathNameA" - rva: 69672 + rva: 0x11028 - name: "EnterCriticalSection" - rva: 69680 + rva: 0x11030 - name: "LeaveCriticalSection" - rva: 69688 + rva: 0x11038 - name: "FileTimeToSystemTime" - rva: 69696 + rva: 0x11040 - name: "FileTimeToLocalFileTime" - rva: 69704 + rva: 0x11048 - name: "GetDriveTypeA" - rva: 69712 + rva: 0x11050 - name: "FindFirstFileExA" - rva: 69720 + rva: 0x11058 - name: "GetProcAddress" - rva: 69728 + rva: 0x11060 - name: "GetModuleHandleW" - rva: 69736 + rva: 0x11068 - name: "ExitProcess" - rva: 69744 + rva: 0x11070 - name: "DecodePointer" - rva: 69752 + rva: 0x11078 - name: "GetCommandLineA" - rva: 69760 + rva: 0x11080 - name: "RtlUnwindEx" - rva: 69768 + rva: 0x11088 - name: "SetHandleCount" - rva: 69776 + rva: 0x11090 - name: "GetStdHandle" - rva: 69784 + rva: 0x11098 - name: "InitializeCriticalSectionAndSpinCount" - rva: 69792 + rva: 0x110a0 - name: "GetFileType" - rva: 69800 + rva: 0x110a8 - name: "GetStartupInfoW" - rva: 69808 + rva: 0x110b0 - name: "DeleteCriticalSection" - rva: 69816 + rva: 0x110b8 - name: "UnhandledExceptionFilter" - rva: 69824 + rva: 0x110c0 - name: "SetUnhandledExceptionFilter" - rva: 69832 + rva: 0x110c8 - name: "IsDebuggerPresent" - rva: 69840 + rva: 0x110d0 - name: "RtlVirtualUnwind" - rva: 69848 + rva: 0x110d8 - name: "RtlLookupFunctionEntry" - rva: 69856 + rva: 0x110e0 - name: "RtlCaptureContext" - rva: 69864 + rva: 0x110e8 - name: "EncodePointer" - rva: 69872 + rva: 0x110f0 - name: "TerminateProcess" - rva: 69880 + rva: 0x110f8 - name: "GetCurrentProcess" - rva: 69888 + rva: 0x11100 - name: "WriteFile" - rva: 69896 + rva: 0x11108 - name: "GetModuleFileNameW" - rva: 69904 + rva: 0x11110 - name: "HeapSetInformation" - rva: 69912 + rva: 0x11118 - name: "GetVersion" - rva: 69920 + rva: 0x11120 - name: "HeapCreate" - rva: 69928 + rva: 0x11128 - name: "GetDriveTypeW" - rva: 69936 + rva: 0x11130 - name: "WideCharToMultiByte" - rva: 69944 + rva: 0x11138 - name: "GetConsoleCP" - rva: 69952 + rva: 0x11140 - name: "GetConsoleMode" - rva: 69960 + rva: 0x11148 - name: "FlushFileBuffers" - rva: 69968 + rva: 0x11150 - name: "Sleep" - rva: 69976 + rva: 0x11158 - name: "CloseHandle" - rva: 69984 + rva: 0x11160 - name: "GetFileInformationByHandle" - rva: 69992 + rva: 0x11168 - name: "PeekNamedPipe" - rva: 70000 + rva: 0x11170 - name: "CreateFileA" - rva: 70008 + rva: 0x11178 - name: "GetCurrentDirectoryW" - rva: 70016 + rva: 0x11180 - name: "GetCPInfo" - rva: 70024 + rva: 0x11188 - name: "GetACP" - rva: 70032 + rva: 0x11190 - name: "GetOEMCP" - rva: 70040 + rva: 0x11198 - name: "IsValidCodePage" - rva: 70048 + rva: 0x111a0 - name: "FlsGetValue" - rva: 70056 + rva: 0x111a8 - name: "FlsSetValue" - rva: 70064 + rva: 0x111b0 - name: "FlsFree" - rva: 70072 + rva: 0x111b8 - name: "SetLastError" - rva: 70080 + rva: 0x111c0 - name: "GetCurrentThreadId" - rva: 70088 + rva: 0x111c8 - name: "FlsAlloc" - rva: 70096 + rva: 0x111d0 - name: "LCMapStringW" - rva: 70104 + rva: 0x111d8 - name: "MultiByteToWideChar" - rva: 70112 + rva: 0x111e0 - name: "SetFilePointer" - rva: 70120 + rva: 0x111e8 - name: "LoadLibraryW" - rva: 70128 + rva: 0x111f0 - name: "FreeEnvironmentStringsW" - rva: 70136 + rva: 0x111f8 - name: "GetEnvironmentStringsW" - rva: 70144 + rva: 0x11200 - name: "QueryPerformanceCounter" - rva: 70152 + rva: 0x11208 - name: "GetTickCount" - rva: 70160 + rva: 0x11210 - name: "GetCurrentProcessId" - rva: 70168 + rva: 0x11218 - name: "GetSystemTimeAsFileTime" - rva: 70176 + rva: 0x11220 - name: "CompareStringW" - rva: 70184 + rva: 0x11228 - name: "SetEnvironmentVariableA" - rva: 70192 + rva: 0x11230 - name: "WriteConsoleW" - rva: 70200 + rva: 0x11238 - name: "SetStdHandle" - rva: 70208 + rva: 0x11240 - name: "HeapReAlloc" - rva: 70216 + rva: 0x11248 - name: "SetEndOfFile" - rva: 70224 + rva: 0x11250 - name: "GetProcessHeap" - rva: 70232 + rva: 0x11258 - name: "ReadFile" - rva: 70240 + rva: 0x11260 - name: "GetTimeZoneInformation" - rva: 70248 + rva: 0x11268 - name: "GetStringTypeW" - rva: 70256 + rva: 0x11270 - name: "HeapSize" - rva: 70264 + rva: 0x11278 - name: "CreateFileW" - rva: 70272 + rva: 0x11280 - name: "SetEnvironmentVariableW" - rva: 70280 + rva: 0x11288 - name: "GetExitCodeProcess" - rva: 70288 + rva: 0x11290 - name: "WaitForSingleObject" - rva: 70296 + rva: 0x11298 - name: "CreateProcessA" - rva: 70304 + rva: 0x112a0 - name: "GetFileAttributesA" - rva: 70312 + rva: 0x112a8 is_signed: true signatures: - subject: "/C=DE/ST=Bayern/L=Geretsried/O=Quality First Software GmbH/serialNumber=HRB 140833/CN=Quality First Software GmbH/businessCategory=Private Organization/jurisdictionL=München/jurisdictionST=Bayern/jurisdictionC=DE" @@ -513,5 +513,5 @@ signatures: not_before: 1573671005 # 2019-11-13 18:50:05 UTC not_after: 2046970205 # 2034-11-12 18:50:05 UTC overlay: - offset: 93184 - size: 6456 \ No newline at end of file + offset: 0x16c00 + size: 0x1938 \ No newline at end of file diff --git a/lib/src/modules/pe/tests/testdata/6758569a317d95008a9a5641376335c737bc0900393f89f93b8f3c9a265dc790.out b/lib/src/modules/pe/tests/testdata/6758569a317d95008a9a5641376335c737bc0900393f89f93b8f3c9a265dc790.out index 76c58d0d9..aa706eefd 100644 --- a/lib/src/modules/pe/tests/testdata/6758569a317d95008a9a5641376335c737bc0900393f89f93b8f3c9a265dc790.out +++ b/lib/src/modules/pe/tests/testdata/6758569a317d95008a9a5641376335c737bc0900393f89f93b8f3c9a265dc790.out @@ -17,26 +17,26 @@ opthdr_magic: IMAGE_NT_OPTIONAL_HDR32_MAGIC characteristics: 0x30f # RELOCS_STRIPPED | EXECUTABLE_IMAGE | LINE_NUMS_STRIPPED | LOCAL_SYMS_STRIPPED | MACHINE_32BIT | DEBUG_STRIPPED dll_characteristics: 0x540 # DYNAMIC_BASE | NX_COMPAT | NO_SEH timestamp: 1655157631 # 2022-06-13 22:00:31 UTC -image_base: 4194304 +image_base: 0x400000 checksum: 340992 -base_of_code: 4096 -base_of_data: 24576 -entry_point: 1648 -entry_point_raw: 4720 -section_alignment: 4096 -file_alignment: 512 -loader_flags: 0 -size_of_optional_header: 224 -size_of_code: 17920 -size_of_initialized_data: 271872 -size_of_uninitialized_data: 36352 -size_of_image: 344064 -size_of_headers: 1024 -size_of_stack_reserve: 2097152 -size_of_stack_commit: 4096 -size_of_heap_reserve: 1048576 -size_of_heap_commit: 4096 -pointer_to_symbol_table: 0 +base_of_code: 0x1000 +base_of_data: 0x6000 +entry_point: 0x670 +entry_point_raw: 0x1270 +section_alignment: 0x1000 +file_alignment: 0x200 +loader_flags: 0x0 +size_of_optional_header: 0xe0 +size_of_code: 0x4600 +size_of_initialized_data: 0x42600 +size_of_uninitialized_data: 0x8e00 +size_of_image: 0x54000 +size_of_headers: 0x400 +size_of_stack_reserve: 0x200000 +size_of_stack_commit: 0x1000 +size_of_heap_reserve: 0x100000 +size_of_heap_commit: 0x1000 +pointer_to_symbol_table: 0x0 win32_version_value: 0 number_of_symbols: 0 number_of_rva_and_sizes: 16 @@ -52,261 +52,261 @@ number_of_signatures: 1 sections: - name: ".text" full_name: ".text" - characteristics: 1613758496 - raw_data_size: 17920 - raw_data_offset: 1024 - virtual_address: 4096 - virtual_size: 17512 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0x60300020 # SECTION_MEM_READ | SECTION_MEM_WRITE | SECTION_SCALE_INDEX + raw_data_size: 0x4600 + raw_data_offset: 0x400 + virtual_address: 0x1000 + virtual_size: 0x4468 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".data" full_name: ".data" - characteristics: 3224371264 - raw_data_size: 512 - raw_data_offset: 18944 - virtual_address: 24576 - virtual_size: 48 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0xc0300040 + raw_data_size: 0x200 + raw_data_offset: 0x4a00 + virtual_address: 0x6000 + virtual_size: 0x30 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".rdata" full_name: ".rdata" - characteristics: 1076887616 - raw_data_size: 2048 - raw_data_offset: 19456 - virtual_address: 28672 - virtual_size: 1584 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0x40300040 + raw_data_size: 0x800 + raw_data_offset: 0x4c00 + virtual_address: 0x7000 + virtual_size: 0x630 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".bss" full_name: ".bss" - characteristics: 3224371328 - raw_data_size: 0 - raw_data_offset: 0 - virtual_address: 32768 - virtual_size: 36352 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0xc0300080 + raw_data_size: 0x0 + raw_data_offset: 0x0 + virtual_address: 0x8000 + virtual_size: 0x8e00 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".idata" full_name: ".idata" - characteristics: 3224371264 - raw_data_size: 2560 - raw_data_offset: 21504 - virtual_address: 69632 - virtual_size: 2096 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0xc0300040 + raw_data_size: 0xa00 + raw_data_offset: 0x5400 + virtual_address: 0x11000 + virtual_size: 0x830 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".rsrc" full_name: ".rsrc" - characteristics: 3224371264 - raw_data_size: 266752 - raw_data_offset: 24064 - virtual_address: 73728 - virtual_size: 266504 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0xc0300040 + raw_data_size: 0x41200 + raw_data_offset: 0x5e00 + virtual_address: 0x12000 + virtual_size: 0x41108 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 data_directories: - - virtual_address: 0 - size: 0 - - virtual_address: 69632 - size: 2096 - - virtual_address: 73728 - size: 266504 - - virtual_address: 0 - size: 0 - - virtual_address: 290816 - size: 1760 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 70060 - size: 308 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x11000 + size: 0x830 + - virtual_address: 0x12000 + size: 0x41108 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x47000 + size: 0x6e0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x111ac + size: 0x134 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 resource_timestamp: 0 # 1970-01-01 00:00:00 UTC resource_version: major: 0 minor: 0 resources: - - length: 1128 - rva: 75064 - offset: 25400 + - length: 0x468 + rva: 0x12538 + offset: 0x6338 type: RESOURCE_TYPE_ICON id: 1 language: 1024 - - length: 2440 - rva: 76192 - offset: 26528 + - length: 0x988 + rva: 0x129a0 + offset: 0x67a0 type: RESOURCE_TYPE_ICON id: 2 language: 1024 - - length: 4264 - rva: 78632 - offset: 28968 + - length: 0x10a8 + rva: 0x13328 + offset: 0x7128 type: RESOURCE_TYPE_ICON id: 3 language: 1024 - - length: 9640 - rva: 82896 - offset: 33232 + - length: 0x25a8 + rva: 0x143d0 + offset: 0x81d0 type: RESOURCE_TYPE_ICON id: 4 language: 1024 - - length: 16936 - rva: 92536 - offset: 42872 + - length: 0x4228 + rva: 0x16978 + offset: 0xa778 type: RESOURCE_TYPE_ICON id: 5 language: 1024 - - length: 26600 - rva: 109472 - offset: 59808 + - length: 0x67e8 + rva: 0x1aba0 + offset: 0xe9a0 type: RESOURCE_TYPE_ICON id: 6 language: 1024 - - length: 38056 - rva: 136072 - offset: 86408 + - length: 0x94a8 + rva: 0x21388 + offset: 0x15188 type: RESOURCE_TYPE_ICON id: 7 language: 1024 - - length: 52008 - rva: 174128 - offset: 124464 + - length: 0xcb28 + rva: 0x2a830 + offset: 0x1e630 type: RESOURCE_TYPE_ICON id: 8 language: 1024 - - length: 67624 - rva: 226136 - offset: 176472 + - length: 0x10828 + rva: 0x37358 + offset: 0x2b158 type: RESOURCE_TYPE_ICON id: 9 language: 1024 - - length: 43190 - rva: 293760 - offset: 244096 + - length: 0xa8b6 + rva: 0x47b80 + offset: 0x3b980 type: RESOURCE_TYPE_ICON id: 10 language: 1024 - - length: 6 - rva: 336952 - offset: 287288 + - length: 0x6 + rva: 0x52438 + offset: 0x46238 type: RESOURCE_TYPE_RCDATA id: 2 language: 1024 - - length: 2 - rva: 336960 - offset: 287296 + - length: 0x2 + rva: 0x52440 + offset: 0x46240 type: RESOURCE_TYPE_RCDATA id: 8 language: 1024 - - length: 10 - rva: 336968 - offset: 287304 + - length: 0xa + rva: 0x52448 + offset: 0x46248 type: RESOURCE_TYPE_RCDATA id: 10 language: 1024 - - length: 18 - rva: 336984 - offset: 287320 + - length: 0x12 + rva: 0x52458 + offset: 0x46258 type: RESOURCE_TYPE_RCDATA id: 14 language: 1024 - - length: 24 - rva: 337008 - offset: 287344 + - length: 0x18 + rva: 0x52470 + offset: 0x46270 type: RESOURCE_TYPE_RCDATA id: 15 language: 1024 - - length: 2601 - rva: 337032 - offset: 287368 + - length: 0xa29 + rva: 0x52488 + offset: 0x46288 type: RESOURCE_TYPE_RCDATA id: 16 language: 1024 - - length: 2 - rva: 339640 - offset: 289976 + - length: 0x2 + rva: 0x52eb8 + offset: 0x46cb8 type: RESOURCE_TYPE_RCDATA id: 18 language: 1024 - - length: 4 - rva: 339648 - offset: 289984 + - length: 0x4 + rva: 0x52ec0 + offset: 0x46cc0 type: RESOURCE_TYPE_RCDATA id: 20 language: 1024 - - length: 26 - rva: 339656 - offset: 289992 + - length: 0x1a + rva: 0x52ec8 + offset: 0x46cc8 type: RESOURCE_TYPE_RCDATA id: 21 language: 1024 - - length: 44 - rva: 339688 - offset: 290024 + - length: 0x2c + rva: 0x52ee8 + offset: 0x46ce8 type: RESOURCE_TYPE_RCDATA id: 22 language: 1024 - - length: 2 - rva: 339736 - offset: 290072 + - length: 0x2 + rva: 0x52f18 + offset: 0x46d18 type: RESOURCE_TYPE_RCDATA id: 30 language: 1024 - - length: 50 - rva: 339744 - offset: 290080 + - length: 0x32 + rva: 0x52f20 + offset: 0x46d20 type: RESOURCE_TYPE_RCDATA id: 101 language: 1024 - - length: 115 - rva: 339800 - offset: 290136 + - length: 0x73 + rva: 0x52f58 + offset: 0x46d58 type: RESOURCE_TYPE_RCDATA id: 102 language: 1024 - - length: 53 - rva: 339920 - offset: 290256 + - length: 0x35 + rva: 0x52fd0 + offset: 0x46dd0 type: RESOURCE_TYPE_RCDATA id: 103 language: 1024 - - length: 104 - rva: 339976 - offset: 290312 + - length: 0x68 + rva: 0x53008 + offset: 0x46e08 type: RESOURCE_TYPE_RCDATA id: 104 language: 1024 - - length: 146 - rva: 340080 - offset: 290416 + - length: 0x92 + rva: 0x53070 + offset: 0x46e70 type: RESOURCE_TYPE_GROUP_ICON id: 1 language: 1024 @@ -315,151 +315,151 @@ import_details: number_of_functions: 4 functions: - name: "RegCloseKey" - rva: 70064 + rva: 0x111b0 - name: "RegEnumKeyExA" - rva: 70068 + rva: 0x111b4 - name: "RegOpenKeyExA" - rva: 70072 + rva: 0x111b8 - name: "RegQueryValueExA" - rva: 70076 + rva: 0x111bc - library_name: "KERNEL32.dll" number_of_functions: 23 functions: - name: "CloseHandle" - rva: 70088 + rva: 0x111c8 - name: "CreateMutexA" - rva: 70092 + rva: 0x111cc - name: "CreateProcessA" - rva: 70096 + rva: 0x111d0 - name: "ExitProcess" - rva: 70100 + rva: 0x111d4 - name: "FindResourceExA" - rva: 70104 + rva: 0x111d8 - name: "FormatMessageA" - rva: 70108 + rva: 0x111dc - name: "GetCommandLineA" - rva: 70112 + rva: 0x111e0 - name: "GetCurrentDirectoryA" - rva: 70116 + rva: 0x111e4 - name: "GetCurrentProcess" - rva: 70120 + rva: 0x111e8 - name: "GetEnvironmentVariableA" - rva: 70124 + rva: 0x111ec - name: "GetExitCodeProcess" - rva: 70128 + rva: 0x111f0 - name: "GetLastError" - rva: 70132 + rva: 0x111f4 - name: "GetModuleFileNameA" - rva: 70136 + rva: 0x111f8 - name: "GetModuleHandleA" - rva: 70140 + rva: 0x111fc - name: "GetProcAddress" - rva: 70144 + rva: 0x11200 - name: "GlobalMemoryStatusEx" - rva: 70148 + rva: 0x11204 - name: "LoadResource" - rva: 70152 + rva: 0x11208 - name: "LocalFree" - rva: 70156 + rva: 0x1120c - name: "LockResource" - rva: 70160 + rva: 0x11210 - name: "SetEnvironmentVariableA" - rva: 70164 + rva: 0x11214 - name: "SetLastError" - rva: 70168 + rva: 0x11218 - name: "SetUnhandledExceptionFilter" - rva: 70172 + rva: 0x1121c - name: "WaitForSingleObject" - rva: 70176 + rva: 0x11220 - library_name: "msvcrt.dll" number_of_functions: 38 functions: - name: "__getmainargs" - rva: 70188 + rva: 0x1122c - name: "__p__environ" - rva: 70192 + rva: 0x11230 - name: "__p__fmode" - rva: 70196 + rva: 0x11234 - name: "__set_app_type" - rva: 70200 + rva: 0x11238 - name: "_cexit" - rva: 70204 + rva: 0x1123c - name: "_chdir" - rva: 70208 + rva: 0x11240 - name: "_close" - rva: 70212 + rva: 0x11244 - name: "_findclose" - rva: 70216 + rva: 0x11248 - name: "_findfirst" - rva: 70220 + rva: 0x1124c - name: "_findnext" - rva: 70224 + rva: 0x11250 - name: "_iob" - rva: 70228 + rva: 0x11254 - name: "_itoa" - rva: 70232 + rva: 0x11258 - name: "_onexit" - rva: 70236 + rva: 0x1125c - name: "_open" - rva: 70240 + rva: 0x11260 - name: "_read" - rva: 70244 + rva: 0x11264 - name: "_setmode" - rva: 70248 + rva: 0x11268 - name: "_stat" - rva: 70252 + rva: 0x1126c - name: "atexit" - rva: 70256 + rva: 0x11270 - name: "atoi" - rva: 70260 + rva: 0x11274 - name: "fclose" - rva: 70264 + rva: 0x11278 - name: "fopen" - rva: 70268 + rva: 0x1127c - name: "fprintf" - rva: 70272 + rva: 0x11280 - name: "fwrite" - rva: 70276 + rva: 0x11284 - name: "memset" - rva: 70280 + rva: 0x11288 - name: "printf" - rva: 70284 + rva: 0x1128c - name: "puts" - rva: 70288 + rva: 0x11290 - name: "signal" - rva: 70292 + rva: 0x11294 - name: "strcat" - rva: 70296 + rva: 0x11298 - name: "strchr" - rva: 70300 + rva: 0x1129c - name: "strcmp" - rva: 70304 + rva: 0x112a0 - name: "strcpy" - rva: 70308 + rva: 0x112a4 - name: "strlen" - rva: 70312 + rva: 0x112a8 - name: "strncat" - rva: 70316 + rva: 0x112ac - name: "strncpy" - rva: 70320 + rva: 0x112b0 - name: "strpbrk" - rva: 70324 + rva: 0x112b4 - name: "strrchr" - rva: 70328 + rva: 0x112b8 - name: "strstr" - rva: 70332 + rva: 0x112bc - name: "strtok" - rva: 70336 + rva: 0x112c0 - library_name: "SHELL32.DLL" number_of_functions: 1 functions: - name: "ShellExecuteA" - rva: 70348 + rva: 0x112cc - library_name: "USER32.dll" number_of_functions: 1 functions: - name: "MessageBoxA" - rva: 70360 + rva: 0x112d8 is_signed: true signatures: - subject: "/C=DE/L=Berlin/O=Open Source/OU=JSIDPlay2/CN=JSIDPlay2" @@ -502,5 +502,5 @@ signatures: not_before: 1655157631 # 2022-06-13 22:00:31 UTC not_after: 1686693631 # 2023-06-13 22:00:31 UTC overlay: - offset: 290816 - size: 1760 \ No newline at end of file + offset: 0x47000 + size: 0x6e0 \ No newline at end of file diff --git a/lib/src/modules/pe/tests/testdata/6c2abf4b80a87e63eee2996e5cea8f004d49ec0c1806080fa72e960529cba14c.out b/lib/src/modules/pe/tests/testdata/6c2abf4b80a87e63eee2996e5cea8f004d49ec0c1806080fa72e960529cba14c.out index 517c77a84..8fe1e86f7 100644 --- a/lib/src/modules/pe/tests/testdata/6c2abf4b80a87e63eee2996e5cea8f004d49ec0c1806080fa72e960529cba14c.out +++ b/lib/src/modules/pe/tests/testdata/6c2abf4b80a87e63eee2996e5cea8f004d49ec0c1806080fa72e960529cba14c.out @@ -17,25 +17,25 @@ opthdr_magic: IMAGE_NT_OPTIONAL_HDR64_MAGIC characteristics: 0x30e # EXECUTABLE_IMAGE | LINE_NUMS_STRIPPED | LOCAL_SYMS_STRIPPED | MACHINE_32BIT | DEBUG_STRIPPED dll_characteristics: 0x0 timestamp: 0 # 1970-01-01 00:00:00 UTC -image_base: 0 +image_base: 0x0 checksum: 30022 -base_of_code: 576 -entry_point: 1050 -entry_point_raw: 1050 -section_alignment: 32 -file_alignment: 32 -loader_flags: 0 -size_of_optional_header: 240 -size_of_code: 0 -size_of_initialized_data: 0 -size_of_uninitialized_data: 0 -size_of_image: 1984 -size_of_headers: 576 -size_of_stack_reserve: 0 -size_of_stack_commit: 0 -size_of_heap_reserve: 0 -size_of_heap_commit: 0 -pointer_to_symbol_table: 1984 +base_of_code: 0x240 +entry_point: 0x41a +entry_point_raw: 0x41a +section_alignment: 0x20 +file_alignment: 0x20 +loader_flags: 0x0 +size_of_optional_header: 0xf0 +size_of_code: 0x0 +size_of_initialized_data: 0x0 +size_of_uninitialized_data: 0x0 +size_of_image: 0x7c0 +size_of_headers: 0x240 +size_of_stack_reserve: 0x0 +size_of_stack_commit: 0x0 +size_of_heap_reserve: 0x0 +size_of_heap_commit: 0x0 +pointer_to_symbol_table: 0x7c0 win32_version_value: 0 number_of_symbols: 0 number_of_rva_and_sizes: 16 @@ -52,71 +52,71 @@ pdb_path: "2AC71AF3-A338-495C-834E-977A6DD5C6FD" sections: - name: ".text" full_name: ".text" - characteristics: 1610612768 - raw_data_size: 1184 - raw_data_offset: 576 - virtual_address: 576 - virtual_size: 1184 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0x60000020 # SECTION_MEM_READ | SECTION_MEM_WRITE | SECTION_SCALE_INDEX + raw_data_size: 0x4a0 + raw_data_offset: 0x240 + virtual_address: 0x240 + virtual_size: 0x4a0 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".data" full_name: ".data" - characteristics: 3758096480 - raw_data_size: 96 - raw_data_offset: 1760 - virtual_address: 1760 - virtual_size: 128 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0xe0000060 # SECTION_MEM_READ | SECTION_MEM_WRITE | SECTION_SCALE_INDEX + raw_data_size: 0x60 + raw_data_offset: 0x6e0 + virtual_address: 0x6e0 + virtual_size: 0x80 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".debug" full_name: ".debug" - characteristics: 1644167264 - raw_data_size: 96 - raw_data_offset: 1888 - virtual_address: 1888 - virtual_size: 85 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0x62000060 # SECTION_MEM_READ | SECTION_MEM_WRITE | SECTION_SCALE_INDEX + raw_data_size: 0x60 + raw_data_offset: 0x760 + virtual_address: 0x760 + virtual_size: 0x55 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 data_directories: - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 1888 - size: 85 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x760 + size: 0x55 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 is_signed: false overlay: - offset: 1984 - size: 4 \ No newline at end of file + offset: 0x7c0 + size: 0x4 \ No newline at end of file diff --git a/lib/src/modules/pe/tests/testdata/6d3bbd6f3b6e11d83526c08e3ccdf0663afed2728226ad5ec6707d4dd7d2e64e.out b/lib/src/modules/pe/tests/testdata/6d3bbd6f3b6e11d83526c08e3ccdf0663afed2728226ad5ec6707d4dd7d2e64e.out index cfa02dec8..2af6ecc7d 100644 --- a/lib/src/modules/pe/tests/testdata/6d3bbd6f3b6e11d83526c08e3ccdf0663afed2728226ad5ec6707d4dd7d2e64e.out +++ b/lib/src/modules/pe/tests/testdata/6d3bbd6f3b6e11d83526c08e3ccdf0663afed2728226ad5ec6707d4dd7d2e64e.out @@ -17,25 +17,25 @@ opthdr_magic: IMAGE_NT_OPTIONAL_HDR64_MAGIC characteristics: 0x22 # EXECUTABLE_IMAGE | LARGE_ADDRESS_AWARE dll_characteristics: 0x8560 # HIGH_ENTROPY_VA | DYNAMIC_BASE | NX_COMPAT | NO_SEH | TERMINAL_SERVER_AWARE timestamp: 1712829193 # 2024-04-11 09:53:13 UTC -image_base: 5368709120 +image_base: 0x140000000 checksum: 36819 -base_of_code: 8192 -entry_point: 0 -entry_point_raw: 0 -section_alignment: 8192 -file_alignment: 512 -loader_flags: 0 -size_of_optional_header: 240 -size_of_code: 2560 -size_of_initialized_data: 2048 -size_of_uninitialized_data: 0 -size_of_image: 24576 -size_of_headers: 512 -size_of_stack_reserve: 4194304 -size_of_stack_commit: 16384 -size_of_heap_reserve: 1048576 -size_of_heap_commit: 8192 -pointer_to_symbol_table: 0 +base_of_code: 0x2000 +entry_point: 0x0 +entry_point_raw: 0x0 +section_alignment: 0x2000 +file_alignment: 0x200 +loader_flags: 0x0 +size_of_optional_header: 0xf0 +size_of_code: 0xa00 +size_of_initialized_data: 0x800 +size_of_uninitialized_data: 0x0 +size_of_image: 0x6000 +size_of_headers: 0x200 +size_of_stack_reserve: 0x400000 +size_of_stack_commit: 0x4000 +size_of_heap_reserve: 0x100000 +size_of_heap_commit: 0x2000 +pointer_to_symbol_table: 0x0 win32_version_value: 0 number_of_symbols: 0 number_of_rva_and_sizes: 16 @@ -87,73 +87,73 @@ pdb_path: "D:\\BuildAgent\\work\\31f27687fbb308be\\nCrunch.TaskRunner\\46.x64\\o sections: - name: ".text" full_name: ".text" - characteristics: 1610612768 - raw_data_size: 2560 - raw_data_offset: 512 - virtual_address: 8192 - virtual_size: 2260 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0x60000020 # SECTION_MEM_READ | SECTION_MEM_WRITE | SECTION_SCALE_INDEX + raw_data_size: 0xa00 + raw_data_offset: 0x200 + virtual_address: 0x2000 + virtual_size: 0x8d4 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".rsrc" full_name: ".rsrc" - characteristics: 1073741888 - raw_data_size: 2048 - raw_data_offset: 3072 - virtual_address: 16384 - virtual_size: 1624 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0x40000040 + raw_data_size: 0x800 + raw_data_offset: 0xc00 + virtual_address: 0x4000 + virtual_size: 0x658 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 data_directories: - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 16384 - size: 1624 - - virtual_address: 0 - size: 0 - - virtual_address: 5120 - size: 9064 - - virtual_address: 0 - size: 0 - - virtual_address: 10140 - size: 28 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 8192 - size: 72 - - virtual_address: 0 - size: 0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x4000 + size: 0x658 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x1400 + size: 0x2368 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x279c + size: 0x1c + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x2000 + size: 0x48 + - virtual_address: 0x0 + size: 0x0 resource_timestamp: 0 # 1970-01-01 00:00:00 UTC resource_version: major: 0 minor: 0 resources: - - length: 968 - rva: 16528 - offset: 3216 + - length: 0x3c8 + rva: 0x4090 + offset: 0xc90 type: RESOURCE_TYPE_VERSION id: 1 language: 0 - - length: 490 - rva: 17512 - offset: 4200 + - length: 0x1ea + rva: 0x4468 + offset: 0x1068 type: RESOURCE_TYPE_MANIFEST id: 1 language: 0 @@ -295,5 +295,5 @@ signatures: not_before: 1659312000 # 2022-08-01 00:00:00 UTC not_after: 1952035199 # 2031-11-09 23:59:59 UTC overlay: - offset: 5120 - size: 9064 \ No newline at end of file + offset: 0x1400 + size: 0x2368 \ No newline at end of file diff --git a/lib/src/modules/pe/tests/testdata/70211a3f90376bbc61f49c22a63075d1d4ddd53f0aefa976216c46e6ba39a9f4.out b/lib/src/modules/pe/tests/testdata/70211a3f90376bbc61f49c22a63075d1d4ddd53f0aefa976216c46e6ba39a9f4.out index fc4adc295..676ddfa03 100644 --- a/lib/src/modules/pe/tests/testdata/70211a3f90376bbc61f49c22a63075d1d4ddd53f0aefa976216c46e6ba39a9f4.out +++ b/lib/src/modules/pe/tests/testdata/70211a3f90376bbc61f49c22a63075d1d4ddd53f0aefa976216c46e6ba39a9f4.out @@ -17,25 +17,25 @@ opthdr_magic: IMAGE_NT_OPTIONAL_HDR64_MAGIC characteristics: 0x22 # EXECUTABLE_IMAGE | LARGE_ADDRESS_AWARE dll_characteristics: 0x0 timestamp: 1459189242 # 2016-03-28 18:20:42 UTC -image_base: 65536 +image_base: 0x10000 checksum: 81108 -base_of_code: 4096 -entry_point: 23652 -entry_point_raw: 36964 -section_alignment: 4096 -file_alignment: 512 -loader_flags: 0 -size_of_optional_header: 240 -size_of_code: 21504 -size_of_initialized_data: 5632 -size_of_uninitialized_data: 0 -size_of_image: 45056 -size_of_headers: 1024 -size_of_stack_reserve: 262144 -size_of_stack_commit: 4096 -size_of_heap_reserve: 1048576 -size_of_heap_commit: 4096 -pointer_to_symbol_table: 0 +base_of_code: 0x1000 +entry_point: 0x5c64 +entry_point_raw: 0x9064 +section_alignment: 0x1000 +file_alignment: 0x200 +loader_flags: 0x0 +size_of_optional_header: 0xf0 +size_of_code: 0x5400 +size_of_initialized_data: 0x1600 +size_of_uninitialized_data: 0x0 +size_of_image: 0xb000 +size_of_headers: 0x400 +size_of_stack_reserve: 0x40000 +size_of_stack_commit: 0x1000 +size_of_heap_reserve: 0x100000 +size_of_heap_commit: 0x1000 +pointer_to_symbol_table: 0x0 win32_version_value: 0 number_of_symbols: 0 number_of_rva_and_sizes: 16 @@ -72,8 +72,8 @@ version_info_list: - key: "ProductVersion" value: "3.0" rich_signature: - offset: 128 - length: 72 + offset: 0x80 + length: 0x48 key: 4259651297 raw_data: "\xa5\x7f\x8b\xae\xe1\x1e\xe5\xfd\xe1\x1e\xe5\xfd\xe1\x1e\xe5\xfd\xe1\x1e\xe4\xfd\xb5\x1e\xe5\xfd\xe8fv\xfd\xe4\x1e\xe5\xfd\xe8fp\xfd\xe2\x1e\xe5\xfd\xe8ff\xfd\xe4\x1e\xe5\xfd\xe8fl\xfd\xea\x1e\xe5\xfd\xe8fq\xfd\xe0\x1e\xe5\xfd\xe8ft\xfd\xe0\x1e\xe5\xfd" clear_data: "DanS\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00T\x00\x00\x00\tx\x93\x00\x05\x00\x00\x00\tx\x95\x00\x03\x00\x00\x00\tx\x83\x00\x05\x00\x00\x00\tx\x89\x00\x0b\x00\x00\x00\tx\x94\x00\x01\x00\x00\x00\tx\x91\x00\x01\x00\x00\x00" @@ -103,122 +103,122 @@ pdb_path: "d:\\projects\\processhacker2\\kprocesshacker\\bin\\amd64\\kprocesshac sections: - name: ".text" full_name: ".text" - characteristics: 1744830496 - raw_data_size: 4096 - raw_data_offset: 1024 - virtual_address: 4096 - virtual_size: 4000 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0x68000020 # SECTION_MEM_READ | SECTION_MEM_WRITE | SECTION_SCALE_INDEX + raw_data_size: 0x1000 + raw_data_offset: 0x400 + virtual_address: 0x1000 + virtual_size: 0xfa0 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".rdata" full_name: ".rdata" - characteristics: 1207959616 - raw_data_size: 2560 - raw_data_offset: 5120 - virtual_address: 8192 - virtual_size: 2516 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0x48000040 + raw_data_size: 0xa00 + raw_data_offset: 0x1400 + virtual_address: 0x2000 + virtual_size: 0x9d4 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".data" full_name: ".data" - characteristics: 3355443264 - raw_data_size: 512 - raw_data_offset: 7680 - virtual_address: 12288 - virtual_size: 728 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0xc8000040 + raw_data_size: 0x200 + raw_data_offset: 0x1e00 + virtual_address: 0x3000 + virtual_size: 0x2d8 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".pdata" full_name: ".pdata" - characteristics: 1207959616 - raw_data_size: 1024 - raw_data_offset: 8192 - virtual_address: 16384 - virtual_size: 564 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0x48000040 + raw_data_size: 0x400 + raw_data_offset: 0x2000 + virtual_address: 0x4000 + virtual_size: 0x234 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: "PAGE" full_name: "PAGE" - characteristics: 1610612768 - raw_data_size: 14336 - raw_data_offset: 9216 - virtual_address: 20480 - virtual_size: 13902 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0x60000020 # SECTION_MEM_READ | SECTION_MEM_WRITE | SECTION_SCALE_INDEX + raw_data_size: 0x3800 + raw_data_offset: 0x2400 + virtual_address: 0x5000 + virtual_size: 0x364e + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: "INIT" full_name: "INIT" - characteristics: 3791650848 - raw_data_size: 3072 - raw_data_offset: 23552 - virtual_address: 36864 - virtual_size: 2720 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0xe2000020 # SECTION_MEM_READ | SECTION_MEM_WRITE | SECTION_SCALE_INDEX + raw_data_size: 0xc00 + raw_data_offset: 0x5c00 + virtual_address: 0x9000 + virtual_size: 0xaa0 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".rsrc" full_name: ".rsrc" - characteristics: 1107296320 - raw_data_size: 1024 - raw_data_offset: 26624 - virtual_address: 40960 - virtual_size: 760 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0x42000040 + raw_data_size: 0x400 + raw_data_offset: 0x6800 + virtual_address: 0xa000 + virtual_size: 0x2f8 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 data_directories: - - virtual_address: 0 - size: 0 - - virtual_address: 36996 - size: 60 - - virtual_address: 40960 - size: 760 - - virtual_address: 16384 - size: 564 - - virtual_address: 27648 - size: 17560 - - virtual_address: 0 - size: 0 - - virtual_address: 8880 - size: 28 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 8192 - size: 680 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x9084 + size: 0x3c + - virtual_address: 0xa000 + size: 0x2f8 + - virtual_address: 0x4000 + size: 0x234 + - virtual_address: 0x6c00 + size: 0x4498 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x22b0 + size: 0x1c + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x2000 + size: 0x2a8 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 resource_timestamp: 0 # 1970-01-01 00:00:00 UTC resource_version: major: 0 minor: 0 resources: - - length: 664 - rva: 41056 - offset: 26720 + - length: 0x298 + rva: 0xa060 + offset: 0x6860 type: RESOURCE_TYPE_VERSION id: 1 language: 1033 @@ -227,174 +227,174 @@ import_details: number_of_functions: 73 functions: - name: "SePrivilegeCheck" - rva: 8280 + rva: 0x2058 - name: "ZwOpenKey" - rva: 8288 + rva: 0x2060 - name: "ProbeForRead" - rva: 8296 + rva: 0x2068 - name: "RtlGetVersion" - rva: 8304 + rva: 0x2070 - name: "PsProcessType" - rva: 8312 + rva: 0x2078 - name: "ObOpenObjectByName" - rva: 8320 + rva: 0x2080 - name: "ObGetObjectType" - rva: 8328 + rva: 0x2088 - name: "PsReleaseProcessExitSynchronization" - rva: 8336 + rva: 0x2090 - name: "ZwQueryObject" - rva: 8344 + rva: 0x2098 - name: "RtlEqualUnicodeString" - rva: 8352 + rva: 0x20a0 - name: "KeUnstackDetachProcess" - rva: 8360 + rva: 0x20a8 - name: "ExEnumHandleTable" - rva: 8368 + rva: 0x20b0 - name: "ObQueryNameString" - rva: 8376 + rva: 0x20b8 - name: "IoFileObjectType" - rva: 8384 + rva: 0x20c0 - name: "IoDriverObjectType" - rva: 8392 + rva: 0x20c8 - name: "ExfUnblockPushLock" - rva: 8400 + rva: 0x20d0 - name: "ObReferenceObjectByHandle" - rva: 8408 + rva: 0x20d8 - name: "PsAcquireProcessExitSynchronization" - rva: 8416 + rva: 0x20e0 - name: "PsInitialSystemProcess" - rva: 8424 + rva: 0x20e8 - name: "ObSetHandleAttributes" - rva: 8432 + rva: 0x20f0 - name: "ZwQueryInformationProcess" - rva: 8440 + rva: 0x20f8 - name: "ObfDereferenceObject" - rva: 8448 + rva: 0x2100 - name: "ExAllocatePoolWithQuotaTag" - rva: 8456 + rva: 0x2108 - name: "ZwQueryInformationThread" - rva: 8464 + rva: 0x2110 - name: "ObOpenObjectByPointer" - rva: 8472 + rva: 0x2118 - name: "KeStackAttachProcess" - rva: 8480 + rva: 0x2120 - name: "PsLookupProcessByProcessId" - rva: 8488 + rva: 0x2128 - name: "PsJobType" - rva: 8496 + rva: 0x2130 - name: "PsReferencePrimaryToken" - rva: 8504 + rva: 0x2138 - name: "SeTokenObjectType" - rva: 8512 + rva: 0x2140 - name: "IoCreateDevice" - rva: 8520 + rva: 0x2148 - name: "PsGetProcessJob" - rva: 8528 + rva: 0x2150 - name: "PsLookupProcessThreadByCid" - rva: 8536 + rva: 0x2158 - name: "ZwTerminateProcess" - rva: 8544 + rva: 0x2160 - name: "PsDereferencePrimaryToken" - rva: 8552 + rva: 0x2168 - name: "IoThreadToProcess" - rva: 8560 + rva: 0x2170 - name: "RtlWalkFrameChain" - rva: 8568 + rva: 0x2178 - name: "KeInitializeApc" - rva: 8576 + rva: 0x2180 - name: "KeSetEvent" - rva: 8584 + rva: 0x2188 - name: "KeInsertQueueApc" - rva: 8592 + rva: 0x2190 - name: "KeWaitForSingleObject" - rva: 8600 + rva: 0x2198 - name: "PsThreadType" - rva: 8608 + rva: 0x21a0 - name: "PsLookupThreadByThreadId" - rva: 8616 + rva: 0x21a8 - name: "ZwQuerySystemInformation" - rva: 8624 + rva: 0x21b0 - name: "ZwQueryVirtualMemory" - rva: 8632 + rva: 0x21b8 - name: "ExReleaseFastMutex" - rva: 8640 + rva: 0x21c0 - name: "ExAcquireFastMutex" - rva: 8648 + rva: 0x21c8 - name: "ZwReadFile" - rva: 8656 + rva: 0x21d0 - name: "MmHighestUserAddress" - rva: 8664 + rva: 0x21d8 - name: "SeLocateProcessImageName" - rva: 8672 + rva: 0x21e0 - name: "KeDelayExecutionThread" - rva: 8680 + rva: 0x21e8 - name: "ZwCreateFile" - rva: 8688 + rva: 0x21f0 - name: "RtlRandomEx" - rva: 8696 + rva: 0x21f8 - name: "ZwQueryInformationFile" - rva: 8704 + rva: 0x2200 - name: "MmUnmapLockedPages" - rva: 8712 + rva: 0x2208 - name: "ExRaiseStatus" - rva: 8720 + rva: 0x2210 - name: "MmMapLockedPagesSpecifyCache" - rva: 8728 + rva: 0x2218 - name: "MmProbeAndLockPages" - rva: 8736 + rva: 0x2220 - name: "MmUnlockPages" - rva: 8744 + rva: 0x2228 - name: "MmIsAddressValid" - rva: 8752 + rva: 0x2230 - name: "KeBugCheckEx" - rva: 8760 + rva: 0x2238 - name: "PsGetCurrentProcessId" - rva: 8768 + rva: 0x2240 - name: "IofCompleteRequest" - rva: 8776 + rva: 0x2248 - name: "ZwClose" - rva: 8784 + rva: 0x2250 - name: "ZwQueryValueKey" - rva: 8792 + rva: 0x2258 - name: "KeInitializeEvent" - rva: 8800 + rva: 0x2260 - name: "ProbeForWrite" - rva: 8808 + rva: 0x2268 - name: "IoDeleteDevice" - rva: 8816 + rva: 0x2270 - name: "RtlInitUnicodeString" - rva: 8824 + rva: 0x2278 - name: "ExFreePoolWithTag" - rva: 8832 + rva: 0x2280 - name: "IoGetCurrentProcess" - rva: 8840 + rva: 0x2288 - name: "ExAllocatePoolWithTag" - rva: 8848 + rva: 0x2290 - name: "__C_specific_handler" - rva: 8856 + rva: 0x2298 - library_name: "ksecdd.sys" number_of_functions: 10 functions: - name: "BCryptCreateHash" - rva: 8192 + rva: 0x2000 - name: "BCryptDestroyKey" - rva: 8200 + rva: 0x2008 - name: "BCryptImportKeyPair" - rva: 8208 + rva: 0x2010 - name: "BCryptCloseAlgorithmProvider" - rva: 8216 + rva: 0x2018 - name: "BCryptVerifySignature" - rva: 8224 + rva: 0x2020 - name: "BCryptFinishHash" - rva: 8232 + rva: 0x2028 - name: "BCryptHashData" - rva: 8240 + rva: 0x2030 - name: "BCryptDestroyHash" - rva: 8248 + rva: 0x2038 - name: "BCryptOpenAlgorithmProvider" - rva: 8256 + rva: 0x2040 - name: "BCryptGetProperty" - rva: 8264 + rva: 0x2048 is_signed: true signatures: - subject: "/C=AU/ST=New South Wales/L=Sydney/O=Wen Jia Liu/CN=Wen Jia Liu" @@ -630,5 +630,5 @@ signatures: not_before: 1452168000 # 2016-01-07 12:00:00 UTC not_after: 1925553600 # 2031-01-07 12:00:00 UTC overlay: - offset: 27648 - size: 17560 \ No newline at end of file + offset: 0x6c00 + size: 0x4498 \ No newline at end of file diff --git a/lib/src/modules/pe/tests/testdata/7aa3e6d7b3f2fcab5c9432cb6d8db094cc1df1b4ed11ff7a386662c4914a1eb3.out b/lib/src/modules/pe/tests/testdata/7aa3e6d7b3f2fcab5c9432cb6d8db094cc1df1b4ed11ff7a386662c4914a1eb3.out index 576681eac..81acb187c 100644 --- a/lib/src/modules/pe/tests/testdata/7aa3e6d7b3f2fcab5c9432cb6d8db094cc1df1b4ed11ff7a386662c4914a1eb3.out +++ b/lib/src/modules/pe/tests/testdata/7aa3e6d7b3f2fcab5c9432cb6d8db094cc1df1b4ed11ff7a386662c4914a1eb3.out @@ -17,26 +17,26 @@ opthdr_magic: IMAGE_NT_OPTIONAL_HDR32_MAGIC characteristics: 0x1ce # EXECUTABLE_IMAGE | LINE_NUMS_STRIPPED | LOCAL_SYMS_STRIPPED | BYTES_REVERSED_LO | MACHINE_32BIT dll_characteristics: 0x0 timestamp: 1556274489 # 2019-04-26 10:28:09 UTC -image_base: 4194304 +image_base: 0x400000 checksum: 235297 -base_of_code: 4096 -base_of_data: 180224 -entry_point: 5040 -entry_point_raw: 5040 -section_alignment: 4096 -file_alignment: 4096 -loader_flags: 0 -size_of_optional_header: 224 -size_of_code: 176128 -size_of_initialized_data: 8192 -size_of_uninitialized_data: 0 -size_of_image: 188416 -size_of_headers: 4096 -size_of_stack_reserve: 1048576 -size_of_stack_commit: 4096 -size_of_heap_reserve: 1048576 -size_of_heap_commit: 4096 -pointer_to_symbol_table: 0 +base_of_code: 0x1000 +base_of_data: 0x2c000 +entry_point: 0x13b0 +entry_point_raw: 0x13b0 +section_alignment: 0x1000 +file_alignment: 0x1000 +loader_flags: 0x0 +size_of_optional_header: 0xe0 +size_of_code: 0x2b000 +size_of_initialized_data: 0x2000 +size_of_uninitialized_data: 0x0 +size_of_image: 0x2e000 +size_of_headers: 0x1000 +size_of_stack_reserve: 0x100000 +size_of_stack_commit: 0x1000 +size_of_heap_reserve: 0x100000 +size_of_heap_commit: 0x1000 +pointer_to_symbol_table: 0x0 win32_version_value: 0 number_of_symbols: 0 number_of_rva_and_sizes: 16 @@ -70,8 +70,8 @@ version_info_list: - key: "OriginalFilename" value: "Kawaii-Unicorn.exe" rich_signature: - offset: 128 - length: 40 + offset: 0x80 + length: 0x28 key: 2291662385 raw_data: "u\x9f\xf9\xdb1\xfe\x97\x881\xfe\x97\x881\xfe\x97\x88\xb2\xe2\x99\x880\xfe\x97\x88~\xdc\x9e\x880\xfe\x97\x88\x07\xd8\x9a\x880\xfe\x97\x88" clear_data: "DanS\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x83\x1c\x0e\x00\x01\x00\x00\x00O\"\t\x00\x01\x00\x00\x006&\r\x00\x01\x00\x00\x00" @@ -88,88 +88,88 @@ rich_signature: sections: - name: ".text" full_name: ".text" - characteristics: 1610612949 - raw_data_size: 176128 - raw_data_offset: 4096 - virtual_address: 4096 - virtual_size: 172840 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0x600000d5 # SECTION_NO_PAD | SECTION_CNT_INITIALIZED_DATA | SECTION_CNT_UNINITIALIZED_DATA | SECTION_LNK_OTHER | SECTION_LNK_INFO | SECTION_LNK_REMOVE | SECTION_NO_DEFER_SPEC_EXC | SECTION_ALIGN_1BYTES | SECTION_ALIGN_2BYTES | SECTION_ALIGN_4BYTES | SECTION_ALIGN_8BYTES | SECTION_ALIGN_16BYTES | SECTION_ALIGN_32BYTES | SECTION_ALIGN_64BYTES | SECTION_ALIGN_128BYTES | SECTION_ALIGN_256BYTES | SECTION_ALIGN_512BYTES | SECTION_ALIGN_1024BYTES | SECTION_ALIGN_2048BYTES | SECTION_ALIGN_4096BYTES | SECTION_ALIGN_8192BYTES | SECTION_ALIGN_MASK | SECTION_LNK_NRELOC_OVFL | SECTION_MEM_DISCARDABLE | SECTION_MEM_NOT_CACHED | SECTION_MEM_NOT_PAGED | SECTION_MEM_SHARED | SECTION_MEM_EXECUTE | SECTION_MEM_WRITE + raw_data_size: 0x2b000 + raw_data_offset: 0x1000 + virtual_address: 0x1000 + virtual_size: 0x2a328 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".data" full_name: ".data" - characteristics: 3221225536 - raw_data_size: 4096 - raw_data_offset: 192000 - virtual_address: 180224 - virtual_size: 2592 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0xc0000040 + raw_data_size: 0x1000 + raw_data_offset: 0x2ee00 + virtual_address: 0x2c000 + virtual_size: 0xa20 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".rsrc" full_name: ".rsrc" - characteristics: 1073741888 - raw_data_size: 4096 - raw_data_offset: 184320 - virtual_address: 184320 - virtual_size: 2292 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0x40000040 + raw_data_size: 0x1000 + raw_data_offset: 0x2d000 + virtual_address: 0x2d000 + virtual_size: 0x8f4 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 data_directories: - - virtual_address: 0 - size: 0 - - virtual_address: 175700 - size: 40 - - virtual_address: 184320 - size: 2292 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 552 - size: 32 - - virtual_address: 4096 - size: 260 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x2ae54 + size: 0x28 + - virtual_address: 0x2d000 + size: 0x8f4 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x228 + size: 0x20 + - virtual_address: 0x1000 + size: 0x104 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 resource_timestamp: 1547296057 # 2019-01-12 12:27:37 UTC resource_version: major: 0 minor: 0 resources: - - length: 48 - rva: 185220 - offset: 185220 + - length: 0x30 + rva: 0x2d384 + offset: 0x2d384 type: RESOURCE_TYPE_GROUP_ICON id: 1 language: 0 - - length: 564 - rva: 184656 - offset: 184656 + - length: 0x234 + rva: 0x2d150 + offset: 0x2d150 type: RESOURCE_TYPE_VERSION id: 1 language: 2052 is_signed: false overlay: - offset: 0 - size: 0 \ No newline at end of file + offset: 0x0 + size: 0x0 \ No newline at end of file diff --git a/lib/src/modules/pe/tests/testdata/7bd1de9bcd32c628d326e7647645c6df8c1ed548b36888e95f8a5b581fc4b35e.out b/lib/src/modules/pe/tests/testdata/7bd1de9bcd32c628d326e7647645c6df8c1ed548b36888e95f8a5b581fc4b35e.out index 9b00afbd0..e7dd56901 100644 --- a/lib/src/modules/pe/tests/testdata/7bd1de9bcd32c628d326e7647645c6df8c1ed548b36888e95f8a5b581fc4b35e.out +++ b/lib/src/modules/pe/tests/testdata/7bd1de9bcd32c628d326e7647645c6df8c1ed548b36888e95f8a5b581fc4b35e.out @@ -17,27 +17,27 @@ opthdr_magic: IMAGE_NT_OPTIONAL_HDR64_MAGIC characteristics: 0x2022 # EXECUTABLE_IMAGE | LARGE_ADDRESS_AWARE | DLL dll_characteristics: 0x160 # HIGH_ENTROPY_VA | DYNAMIC_BASE | NX_COMPAT timestamp: 1709628808 # 2024-03-05 08:53:28 UTC -image_base: 6442450944 +image_base: 0x180000000 checksum: 59800 -base_of_code: 4096 -entry_point: 1024 -entry_point_raw: 4096 +base_of_code: 0x1000 +entry_point: 0x400 +entry_point_raw: 0x1000 dll_name: "vcruntime140_1.dll" export_timestamp: 4294967295 # 2106-02-07 06:28:15 UTC -section_alignment: 4096 -file_alignment: 512 -loader_flags: 0 -size_of_optional_header: 240 -size_of_code: 1024 -size_of_initialized_data: 5632 -size_of_uninitialized_data: 0 -size_of_image: 24576 -size_of_headers: 1024 -size_of_stack_reserve: 1048576 -size_of_stack_commit: 4096 -size_of_heap_reserve: 1048576 -size_of_heap_commit: 4096 -pointer_to_symbol_table: 0 +section_alignment: 0x1000 +file_alignment: 0x200 +loader_flags: 0x0 +size_of_optional_header: 0xf0 +size_of_code: 0x400 +size_of_initialized_data: 0x1600 +size_of_uninitialized_data: 0x0 +size_of_image: 0x6000 +size_of_headers: 0x400 +size_of_stack_reserve: 0x100000 +size_of_stack_commit: 0x1000 +size_of_heap_reserve: 0x100000 +size_of_heap_commit: 0x1000 +pointer_to_symbol_table: 0x0 win32_version_value: 0 number_of_symbols: 0 number_of_rva_and_sizes: 16 @@ -77,8 +77,8 @@ version_info_list: - key: "ProductVersion" value: "1.0.0.1" rich_signature: - offset: 128 - length: 72 + offset: 0x80 + length: 0x48 key: 3048884457 raw_data: "\xad)\xd4\xe6\xe9H\xba\xb5\xe9H\xba\xb5\xe9H\xba\xb5\xa20\xbb\xb4\xecH\xba\xb5\xe9H\xbb\xb5\xe3H\xba\xb5\x84\xc9\xbe\xb4\xe8H\xba\xb5\x84\xc9\xba\xb4\xe8H\xba\xb5\x84\xc9E\xb5\xe8H\xba\xb5\xe9H-\xb5\xe8H\xba\xb5\x84\xc9\xb8\xb4\xe8H\xba\xb5" clear_data: "DanS\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00Kx\x01\x01\x05\x00\x00\x00\x00\x00\x01\x00\n\x00\x00\x00m\x81\x04\x01\x01\x00\x00\x00m\x81\x00\x01\x01\x00\x00\x00m\x81\xff\x00\x01\x00\x00\x00\x00\x00\x97\x00\x01\x00\x00\x00m\x81\x02\x01\x01\x00\x00\x00" @@ -107,106 +107,106 @@ rich_signature: sections: - name: ".text" full_name: ".text" - characteristics: 1610612768 - raw_data_size: 1024 - raw_data_offset: 1024 - virtual_address: 4096 - virtual_size: 602 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0x60000020 # SECTION_MEM_READ | SECTION_MEM_WRITE | SECTION_SCALE_INDEX + raw_data_size: 0x400 + raw_data_offset: 0x400 + virtual_address: 0x1000 + virtual_size: 0x25a + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".rdata" full_name: ".rdata" - characteristics: 1073741888 - raw_data_size: 3072 - raw_data_offset: 2048 - virtual_address: 8192 - virtual_size: 2862 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0x40000040 + raw_data_size: 0xc00 + raw_data_offset: 0x800 + virtual_address: 0x2000 + virtual_size: 0xb2e + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".data" full_name: ".data" - characteristics: 3221225536 - raw_data_size: 512 - raw_data_offset: 5120 - virtual_address: 12288 - virtual_size: 104 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0xc0000040 + raw_data_size: 0x200 + raw_data_offset: 0x1400 + virtual_address: 0x3000 + virtual_size: 0x68 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".pdata" full_name: ".pdata" - characteristics: 1073741888 - raw_data_size: 512 - raw_data_offset: 5632 - virtual_address: 16384 - virtual_size: 36 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0x40000040 + raw_data_size: 0x200 + raw_data_offset: 0x1600 + virtual_address: 0x4000 + virtual_size: 0x24 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".rsrc" full_name: ".rsrc" - characteristics: 1073741888 - raw_data_size: 1536 - raw_data_offset: 6144 - virtual_address: 20480 - virtual_size: 1360 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0x40000040 + raw_data_size: 0x600 + raw_data_offset: 0x1800 + virtual_address: 0x5000 + virtual_size: 0x550 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 data_directories: - - virtual_address: 10560 - size: 140 - - virtual_address: 10700 - size: 60 - - virtual_address: 20480 - size: 1360 - - virtual_address: 16384 - size: 36 - - virtual_address: 7680 - size: 1432 - - virtual_address: 0 - size: 0 - - virtual_address: 10144 - size: 28 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 8192 - size: 96 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 + - virtual_address: 0x2940 + size: 0x8c + - virtual_address: 0x29cc + size: 0x3c + - virtual_address: 0x5000 + size: 0x550 + - virtual_address: 0x4000 + size: 0x24 + - virtual_address: 0x1e00 + size: 0x598 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x27a0 + size: 0x1c + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x2000 + size: 0x60 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 resource_timestamp: 0 # 1970-01-01 00:00:00 UTC resource_version: major: 0 minor: 0 resources: - - length: 816 - rva: 20640 - offset: 6304 + - length: 0x330 + rva: 0x50a0 + offset: 0x18a0 type: RESOURCE_TYPE_VERSION id: 1 language: 1033 - - length: 381 - rva: 21456 - offset: 7120 + - length: 0x17d + rva: 0x53d0 + offset: 0x1bd0 type: RESOURCE_TYPE_MANIFEST id: 2 language: 1033 @@ -215,41 +215,41 @@ import_details: number_of_functions: 1 functions: - name: "PathStripPathW" - rva: 8272 + rva: 0x2050 - library_name: "KERNEL32.dll" number_of_functions: 9 functions: - name: "GetModuleHandleA" - rva: 8192 + rva: 0x2000 - name: "lstrcatW" - rva: 8200 + rva: 0x2008 - name: "GetSystemDirectoryW" - rva: 8208 + rva: 0x2010 - name: "VirtualProtect" - rva: 8216 + rva: 0x2018 - name: "FreeLibrary" - rva: 8224 + rva: 0x2020 - name: "GetModuleFileNameW" - rva: 8232 + rva: 0x2028 - name: "LoadLibraryW" - rva: 8240 + rva: 0x2030 - name: "GetProcAddress" - rva: 8248 + rva: 0x2038 - name: "lstrcmpW" - rva: 8256 + rva: 0x2040 export_details: - name: "__CxxFrameHandler4" ordinal: 1 - rva: 4140 - offset: 1068 + rva: 0x102c + offset: 0x42c - name: "__NLG_Dispatch2" ordinal: 2 - rva: 4148 - offset: 1076 + rva: 0x1034 + offset: 0x434 - name: "__NLG_Return2" ordinal: 3 - rva: 4156 - offset: 1084 + rva: 0x103c + offset: 0x43c is_signed: true signatures: - subject: "/C=JP/O=R2R/CN=R2R" @@ -291,5 +291,5 @@ signatures: not_before: 1609426800 # 2020-12-31 15:00:00 UTC not_after: 4102326000 # 2099-12-30 15:00:00 UTC overlay: - offset: 7680 - size: 1432 \ No newline at end of file + offset: 0x1e00 + size: 0x598 \ No newline at end of file diff --git a/lib/src/modules/pe/tests/testdata/8970b83310e030f7b7191ed1329433bcf8a4f574e66f2d39bca5a4360c1dac96.out b/lib/src/modules/pe/tests/testdata/8970b83310e030f7b7191ed1329433bcf8a4f574e66f2d39bca5a4360c1dac96.out index 5aa1130d7..cd7128330 100644 --- a/lib/src/modules/pe/tests/testdata/8970b83310e030f7b7191ed1329433bcf8a4f574e66f2d39bca5a4360c1dac96.out +++ b/lib/src/modules/pe/tests/testdata/8970b83310e030f7b7191ed1329433bcf8a4f574e66f2d39bca5a4360c1dac96.out @@ -17,26 +17,26 @@ opthdr_magic: IMAGE_NT_OPTIONAL_HDR32_MAGIC characteristics: 0xa18e # EXECUTABLE_IMAGE | LINE_NUMS_STRIPPED | LOCAL_SYMS_STRIPPED | BYTES_REVERSED_LO | MACHINE_32BIT | DLL | BYTES_REVERSED_HI dll_characteristics: 0x1 timestamp: 708992537 # 1992-06-19 22:22:17 UTC -image_base: 4194304 +image_base: 0x400000 checksum: 1738518 -base_of_code: 4096 -base_of_data: 12288 -entry_point: 4980 -entry_point_raw: 8052 -section_alignment: 4096 -file_alignment: 512 -loader_flags: 0 -size_of_optional_header: 224 -size_of_code: 4096 -size_of_initialized_data: 1688576 -size_of_uninitialized_data: 0 -size_of_image: 1712128 -size_of_headers: 1024 -size_of_stack_reserve: 0 -size_of_stack_commit: 0 -size_of_heap_reserve: 1048576 -size_of_heap_commit: 4096 -pointer_to_symbol_table: 0 +base_of_code: 0x1000 +base_of_data: 0x3000 +entry_point: 0x1374 +entry_point_raw: 0x1f74 +section_alignment: 0x1000 +file_alignment: 0x200 +loader_flags: 0x0 +size_of_optional_header: 0xe0 +size_of_code: 0x1000 +size_of_initialized_data: 0x19c400 +size_of_uninitialized_data: 0x0 +size_of_image: 0x1a2000 +size_of_headers: 0x400 +size_of_stack_reserve: 0x0 +size_of_stack_commit: 0x0 +size_of_heap_reserve: 0x100000 +size_of_heap_commit: 0x1000 +pointer_to_symbol_table: 0x0 win32_version_value: 0 number_of_symbols: 0 number_of_rva_and_sizes: 16 @@ -75,2631 +75,2631 @@ version_info_list: sections: - name: "CODE" full_name: "CODE" - characteristics: 1610612768 - raw_data_size: 4096 - raw_data_offset: 1024 - virtual_address: 4096 - virtual_size: 3980 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0x60000020 # SECTION_MEM_READ | SECTION_MEM_WRITE | SECTION_SCALE_INDEX + raw_data_size: 0x1000 + raw_data_offset: 0x400 + virtual_address: 0x1000 + virtual_size: 0xf8c + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: "DATA" full_name: "DATA" - characteristics: 3221225536 - raw_data_size: 512 - raw_data_offset: 5120 - virtual_address: 8192 - virtual_size: 160 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0xc0000040 + raw_data_size: 0x200 + raw_data_offset: 0x1400 + virtual_address: 0x2000 + virtual_size: 0xa0 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: "BSS" full_name: "BSS" - characteristics: 3221225472 - raw_data_size: 0 - raw_data_offset: 5632 - virtual_address: 12288 - virtual_size: 1769 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0xc0000000 + raw_data_size: 0x0 + raw_data_offset: 0x1600 + virtual_address: 0x3000 + virtual_size: 0x6e9 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".idata" full_name: ".idata" - characteristics: 3221225536 - raw_data_size: 1024 - raw_data_offset: 5632 - virtual_address: 16384 - virtual_size: 702 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0xc0000040 + raw_data_size: 0x400 + raw_data_offset: 0x1600 + virtual_address: 0x4000 + virtual_size: 0x2be + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".reloc" full_name: ".reloc" - characteristics: 1342177344 - raw_data_size: 512 - raw_data_offset: 6656 - virtual_address: 20480 - virtual_size: 424 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0x50000040 + raw_data_size: 0x200 + raw_data_offset: 0x1a00 + virtual_address: 0x5000 + virtual_size: 0x1a8 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".rsrc" full_name: ".rsrc" - characteristics: 1342177344 - raw_data_size: 1686528 - raw_data_offset: 7168 - virtual_address: 24576 - virtual_size: 1686228 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0x50000040 + raw_data_size: 0x19bc00 + raw_data_offset: 0x1c00 + virtual_address: 0x6000 + virtual_size: 0x19bad4 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 data_directories: - - virtual_address: 0 - size: 0 - - virtual_address: 16384 - size: 702 - - virtual_address: 24576 - size: 512 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 20480 - size: 424 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x4000 + size: 0x2be + - virtual_address: 0x6000 + size: 0x200 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x5000 + size: 0x1a8 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 resource_timestamp: 884693288 # 1998-01-13 12:08:08 UTC resource_version: major: 0 minor: 0 resources: - - length: 11264 - rva: 49888 - offset: 32480 + - length: 0x2c00 + rva: 0xc2e0 + offset: 0x7ee0 language: 19 type_string: "A\x00V\x00I\x00" name_string: "A\x00N\x00I\x00M\x00A\x00T\x00I\x00O\x00N\x00_\x00B\x00U\x00S\x00Y\x00_\x00S\x00M\x00A\x00L\x00L\x00" - - length: 7168 - rva: 61152 - offset: 43744 + - length: 0x1c00 + rva: 0xeee0 + offset: 0xaae0 language: 19 type_string: "A\x00V\x00I\x00" name_string: "F\x00I\x00R\x00E\x00" - - length: 10240 - rva: 68320 - offset: 50912 + - length: 0x2800 + rva: 0x10ae0 + offset: 0xc6e0 language: 19 type_string: "A\x00V\x00I\x00" name_string: "G\x00E\x00A\x00R\x00S\x00" - - length: 13824 - rva: 78560 - offset: 61152 + - length: 0x3600 + rva: 0x132e0 + offset: 0xeee0 language: 19 type_string: "A\x00V\x00I\x00" name_string: "R\x00E\x00C\x00O\x00V\x00E\x00R\x00" - - length: 20992 - rva: 92384 - offset: 74976 + - length: 0x5200 + rva: 0x168e0 + offset: 0x124e0 language: 19 type_string: "A\x00V\x00I\x00" name_string: "S\x00C\x00H\x00E\x00D\x00P\x00R\x00O\x00G\x00R\x00E\x00S\x00S\x00" - - length: 20992 - rva: 113376 - offset: 95968 + - length: 0x5200 + rva: 0x1bae0 + offset: 0x176e0 language: 19 type_string: "A\x00V\x00I\x00" name_string: "S\x00E\x00A\x00R\x00C\x00H\x00" - - length: 29184 - rva: 134368 - offset: 116960 + - length: 0x7200 + rva: 0x20ce0 + offset: 0x1c8e0 language: 19 type_string: "A\x00V\x00I\x00" name_string: "S\x00E\x00A\x00R\x00C\x00H\x00C\x00L\x00B\x00T\x00N\x00F\x00A\x00C\x00E\x00" - - length: 12800 - rva: 163552 - offset: 146144 + - length: 0x3200 + rva: 0x27ee0 + offset: 0x23ae0 language: 19 type_string: "A\x00V\x00I\x00" name_string: "S\x00W\x00I\x00R\x00L\x00" - - length: 20 - rva: 176352 - offset: 158944 + - length: 0x14 + rva: 0x2b0e0 + offset: 0x26ce0 language: 19 type_string: "M\x00A\x00D\x00" name_string: "C\x00A\x00L\x00I\x00B\x00R\x00A\x00T\x00E\x00" - - length: 451084 - rva: 176372 - offset: 158964 + - length: 0x6e20c + rva: 0x2b0f4 + offset: 0x26cf4 language: 19 type_string: "M\x00A\x00D\x00" name_string: "E\x00X\x00C\x00E\x00P\x00T\x00" - - length: 308 - rva: 627456 - offset: 610048 + - length: 0x134 + rva: 0x99300 + offset: 0x94f00 type: RESOURCE_TYPE_CURSOR id: 1 language: 19 - - length: 308 - rva: 627764 - offset: 610356 + - length: 0x134 + rva: 0x99434 + offset: 0x95034 type: RESOURCE_TYPE_CURSOR id: 2 language: 19 - - length: 308 - rva: 628072 - offset: 610664 + - length: 0x134 + rva: 0x99568 + offset: 0x95168 type: RESOURCE_TYPE_CURSOR id: 3 language: 19 - - length: 308 - rva: 628380 - offset: 610972 + - length: 0x134 + rva: 0x9969c + offset: 0x9529c type: RESOURCE_TYPE_CURSOR id: 4 language: 19 - - length: 308 - rva: 628688 - offset: 611280 + - length: 0x134 + rva: 0x997d0 + offset: 0x953d0 type: RESOURCE_TYPE_CURSOR id: 5 language: 19 - - length: 308 - rva: 628996 - offset: 611588 + - length: 0x134 + rva: 0x99904 + offset: 0x95504 type: RESOURCE_TYPE_CURSOR id: 6 language: 19 - - length: 308 - rva: 629304 - offset: 611896 + - length: 0x134 + rva: 0x99a38 + offset: 0x95638 type: RESOURCE_TYPE_CURSOR id: 7 language: 19 - - length: 748 - rva: 629612 - offset: 612204 + - length: 0x2ec + rva: 0x99b6c + offset: 0x9576c type: RESOURCE_TYPE_CURSOR id: 8 language: 19 - - length: 748 - rva: 630360 - offset: 612952 + - length: 0x2ec + rva: 0x99e58 + offset: 0x95a58 type: RESOURCE_TYPE_CURSOR id: 9 language: 19 - - length: 748 - rva: 631108 - offset: 613700 + - length: 0x2ec + rva: 0x9a144 + offset: 0x95d44 type: RESOURCE_TYPE_CURSOR id: 10 language: 19 - - length: 748 - rva: 631856 - offset: 614448 + - length: 0x2ec + rva: 0x9a430 + offset: 0x96030 type: RESOURCE_TYPE_CURSOR id: 11 language: 19 - - length: 308 - rva: 632604 - offset: 615196 + - length: 0x134 + rva: 0x9a71c + offset: 0x9631c type: RESOURCE_TYPE_CURSOR id: 12 language: 19 - - length: 308 - rva: 632912 - offset: 615504 + - length: 0x134 + rva: 0x9a850 + offset: 0x96450 type: RESOURCE_TYPE_CURSOR id: 13 language: 19 - - length: 308 - rva: 633220 - offset: 615812 + - length: 0x134 + rva: 0x9a984 + offset: 0x96584 type: RESOURCE_TYPE_CURSOR id: 14 language: 19 - - length: 748 - rva: 633528 - offset: 616120 + - length: 0x2ec + rva: 0x9aab8 + offset: 0x966b8 type: RESOURCE_TYPE_CURSOR id: 15 language: 19 - - length: 748 - rva: 634276 - offset: 616868 + - length: 0x2ec + rva: 0x9ada4 + offset: 0x969a4 type: RESOURCE_TYPE_CURSOR id: 16 language: 19 - - length: 748 - rva: 635024 - offset: 617616 + - length: 0x2ec + rva: 0x9b090 + offset: 0x96c90 type: RESOURCE_TYPE_CURSOR id: 17 language: 19 - - length: 748 - rva: 635772 - offset: 618364 + - length: 0x2ec + rva: 0x9b37c + offset: 0x96f7c type: RESOURCE_TYPE_CURSOR id: 18 language: 19 - - length: 748 - rva: 636520 - offset: 619112 + - length: 0x2ec + rva: 0x9b668 + offset: 0x97268 type: RESOURCE_TYPE_CURSOR id: 19 language: 19 - - length: 748 - rva: 637268 - offset: 619860 + - length: 0x2ec + rva: 0x9b954 + offset: 0x97554 type: RESOURCE_TYPE_CURSOR id: 20 language: 19 - - length: 308 - rva: 638016 - offset: 620608 + - length: 0x134 + rva: 0x9bc40 + offset: 0x97840 type: RESOURCE_TYPE_CURSOR id: 21 language: 19 - - length: 464 - rva: 638324 - offset: 620916 + - length: 0x1d0 + rva: 0x9bd74 + offset: 0x97974 type: RESOURCE_TYPE_BITMAP language: 19 name_string: "B\x00B\x00A\x00B\x00O\x00R\x00T\x00" - - length: 484 - rva: 638788 - offset: 621380 + - length: 0x1e4 + rva: 0x9bf44 + offset: 0x97b44 type: RESOURCE_TYPE_BITMAP language: 19 name_string: "B\x00B\x00A\x00L\x00L\x00" - - length: 464 - rva: 639272 - offset: 621864 + - length: 0x1d0 + rva: 0x9c128 + offset: 0x97d28 type: RESOURCE_TYPE_BITMAP language: 19 name_string: "B\x00B\x00C\x00A\x00N\x00C\x00E\x00L\x00" - - length: 464 - rva: 639736 - offset: 622328 + - length: 0x1d0 + rva: 0x9c2f8 + offset: 0x97ef8 type: RESOURCE_TYPE_BITMAP language: 19 name_string: "B\x00B\x00C\x00L\x00O\x00S\x00E\x00" - - length: 464 - rva: 640200 - offset: 622792 + - length: 0x1d0 + rva: 0x9c4c8 + offset: 0x980c8 type: RESOURCE_TYPE_BITMAP language: 19 name_string: "B\x00B\x00H\x00E\x00L\x00P\x00" - - length: 464 - rva: 640664 - offset: 623256 + - length: 0x1d0 + rva: 0x9c698 + offset: 0x98298 type: RESOURCE_TYPE_BITMAP language: 19 name_string: "B\x00B\x00I\x00G\x00N\x00O\x00R\x00E\x00" - - length: 464 - rva: 641128 - offset: 623720 + - length: 0x1d0 + rva: 0x9c868 + offset: 0x98468 type: RESOURCE_TYPE_BITMAP language: 19 name_string: "B\x00B\x00N\x00O\x00" - - length: 464 - rva: 641592 - offset: 624184 + - length: 0x1d0 + rva: 0x9ca38 + offset: 0x98638 type: RESOURCE_TYPE_BITMAP language: 19 name_string: "B\x00B\x00O\x00K\x00" - - length: 464 - rva: 642056 - offset: 624648 + - length: 0x1d0 + rva: 0x9cc08 + offset: 0x98808 type: RESOURCE_TYPE_BITMAP language: 19 name_string: "B\x00B\x00R\x00E\x00T\x00R\x00Y\x00" - - length: 464 - rva: 642520 - offset: 625112 + - length: 0x1d0 + rva: 0x9cdd8 + offset: 0x989d8 type: RESOURCE_TYPE_BITMAP language: 19 name_string: "B\x00B\x00Y\x00E\x00S\x00" - - length: 232 - rva: 642984 - offset: 625576 + - length: 0xe8 + rva: 0x9cfa8 + offset: 0x98ba8 type: RESOURCE_TYPE_BITMAP language: 19 name_string: "B\x00L\x00A\x00N\x00K\x00_\x001\x006\x00X\x001\x006\x00" - - length: 192 - rva: 643216 - offset: 625808 + - length: 0xc0 + rva: 0x9d090 + offset: 0x98c90 type: RESOURCE_TYPE_BITMAP language: 19 name_string: "C\x00D\x00R\x00O\x00M\x00" - - length: 224 - rva: 643408 - offset: 626000 + - length: 0xe0 + rva: 0x9d150 + offset: 0x98d50 type: RESOURCE_TYPE_BITMAP language: 19 name_string: "C\x00L\x00O\x00S\x00E\x00D\x00F\x00O\x00L\x00D\x00E\x00R\x00" - - length: 224 - rva: 643632 - offset: 626224 + - length: 0xe0 + rva: 0x9d230 + offset: 0x98e30 type: RESOURCE_TYPE_BITMAP language: 19 name_string: "C\x00U\x00R\x00R\x00E\x00N\x00T\x00F\x00O\x00L\x00D\x00E\x00R\x00" - - length: 224 - rva: 643856 - offset: 626448 + - length: 0xe0 + rva: 0x9d310 + offset: 0x98f10 type: RESOURCE_TYPE_BITMAP language: 19 name_string: "E\x00X\x00E\x00C\x00U\x00T\x00A\x00B\x00L\x00E\x00" - - length: 192 - rva: 644080 - offset: 626672 + - length: 0xc0 + rva: 0x9d3f0 + offset: 0x98ff0 type: RESOURCE_TYPE_BITMAP language: 19 name_string: "F\x00L\x00O\x00P\x00P\x00Y\x00" - - length: 192 - rva: 644272 - offset: 626864 + - length: 0xc0 + rva: 0x9d4b0 + offset: 0x990b0 type: RESOURCE_TYPE_BITMAP language: 19 name_string: "H\x00A\x00R\x00D\x00" - - length: 3112 - rva: 644464 - offset: 627056 + - length: 0xc28 + rva: 0x9d570 + offset: 0x99170 type: RESOURCE_TYPE_BITMAP language: 19 name_string: "I\x00C\x00O\x00N\x00C\x00R\x00I\x00T\x00I\x00C\x00A\x00L\x003\x002\x00X\x003\x002\x00" - - length: 3112 - rva: 647576 - offset: 630168 + - length: 0xc28 + rva: 0x9e198 + offset: 0x99d98 type: RESOURCE_TYPE_BITMAP language: 19 name_string: "I\x00C\x00O\x00N\x00F\x00A\x00I\x00R\x003\x002\x00X\x003\x002\x00" - - length: 3112 - rva: 650688 - offset: 633280 + - length: 0xc28 + rva: 0x9edc0 + offset: 0x9a9c0 type: RESOURCE_TYPE_BITMAP language: 19 name_string: "I\x00C\x00O\x00N\x00G\x00O\x00O\x00D\x003\x002\x00X\x003\x002\x00" - - length: 3114 - rva: 653800 - offset: 636392 + - length: 0xc2a + rva: 0x9f9e8 + offset: 0x9b5e8 type: RESOURCE_TYPE_BITMAP language: 19 name_string: "I\x00C\x00O\x00N\x00I\x00N\x00F\x00O\x00R\x00M\x00A\x00T\x00I\x00O\x00N\x003\x002\x00X\x003\x002\x00" - - length: 2826 - rva: 656916 - offset: 639508 + - length: 0xb0a + rva: 0xa0614 + offset: 0x9c214 type: RESOURCE_TYPE_BITMAP language: 19 name_string: "I\x00C\x00O\x00N\x00W\x00A\x00R\x00N\x00I\x00N\x00G\x003\x001\x00X\x002\x009\x00" - - length: 808 - rva: 659744 - offset: 642336 + - length: 0x328 + rva: 0xa1120 + offset: 0x9cd20 type: RESOURCE_TYPE_BITMAP language: 19 name_string: "I\x00M\x00G\x00_\x00C\x00H\x00E\x00C\x00K\x00B\x00O\x00X\x00_\x001\x006\x00X\x001\x006\x00" - - length: 808 - rva: 660552 - offset: 643144 + - length: 0x328 + rva: 0xa1448 + offset: 0x9d048 type: RESOURCE_TYPE_BITMAP language: 19 name_string: "I\x00M\x00G\x00_\x00C\x00H\x00E\x00C\x00K\x00E\x00D\x00B\x00O\x00X\x00_\x001\x006\x00X\x001\x006\x00" - - length: 808 - rva: 661360 - offset: 643952 + - length: 0x328 + rva: 0xa1770 + offset: 0x9d370 type: RESOURCE_TYPE_BITMAP language: 19 name_string: "I\x00M\x00G\x00_\x00M\x00I\x00N\x00U\x00S\x00_\x001\x006\x00X\x001\x006\x00" - - length: 808 - rva: 662168 - offset: 644760 + - length: 0x328 + rva: 0xa1a98 + offset: 0x9d698 type: RESOURCE_TYPE_BITMAP language: 19 name_string: "I\x00M\x00G\x00_\x00P\x00L\x00U\x00S\x00_\x001\x006\x00X\x001\x006\x00" - - length: 4600 - rva: 662976 - offset: 645568 + - length: 0x11f8 + rva: 0xa1dc0 + offset: 0x9d9c0 type: RESOURCE_TYPE_BITMAP language: 19 name_string: "I\x00N\x00C\x00I\x00N\x00I\x00M\x00A\x00G\x00E\x00" - - length: 224 - rva: 667576 - offset: 650168 + - length: 0xe0 + rva: 0xa2fb8 + offset: 0x9ebb8 type: RESOURCE_TYPE_BITMAP language: 19 name_string: "K\x00N\x00O\x00W\x00N\x00F\x00I\x00L\x00E\x00" - - length: 4136 - rva: 667800 - offset: 650392 + - length: 0x1028 + rva: 0xa3098 + offset: 0x9ec98 type: RESOURCE_TYPE_BITMAP language: 19 name_string: "M\x00E\x00I\x00B\x00I\x00G\x00" - - length: 1064 - rva: 671936 - offset: 654528 + - length: 0x428 + rva: 0xa40c0 + offset: 0x9fcc0 type: RESOURCE_TYPE_BITMAP language: 19 name_string: "M\x00E\x00I\x00C\x00A\x00N\x00T\x00C\x00O\x00N\x00T\x00I\x00N\x00U\x00E\x00" - - length: 1064 - rva: 673000 - offset: 655592 + - length: 0x428 + rva: 0xa44e8 + offset: 0xa00e8 type: RESOURCE_TYPE_BITMAP language: 19 name_string: "M\x00E\x00I\x00C\x00L\x00O\x00S\x00E\x00" - - length: 1064 - rva: 674064 - offset: 656656 + - length: 0x428 + rva: 0xa4910 + offset: 0xa0510 type: RESOURCE_TYPE_BITMAP language: 19 name_string: "M\x00E\x00I\x00C\x00O\x00N\x00T\x00I\x00N\x00U\x00E\x00" - - length: 4136 - rva: 675128 - offset: 657720 + - length: 0x1028 + rva: 0xa4d38 + offset: 0xa0938 type: RESOURCE_TYPE_BITMAP language: 19 name_string: "M\x00E\x00I\x00P\x00L\x00W\x00A\x00I\x00T\x00" - - length: 1064 - rva: 679264 - offset: 661856 + - length: 0x428 + rva: 0xa5d60 + offset: 0xa1960 type: RESOURCE_TYPE_BITMAP language: 19 name_string: "M\x00E\x00I\x00P\x00R\x00I\x00N\x00T\x00" - - length: 1064 - rva: 680328 - offset: 662920 + - length: 0x428 + rva: 0xa6188 + offset: 0xa1d88 type: RESOURCE_TYPE_BITMAP language: 19 name_string: "M\x00E\x00I\x00R\x00E\x00S\x00T\x00A\x00R\x00T\x00" - - length: 1064 - rva: 681392 - offset: 663984 + - length: 0x428 + rva: 0xa65b0 + offset: 0xa21b0 type: RESOURCE_TYPE_BITMAP language: 19 name_string: "M\x00E\x00I\x00S\x00A\x00V\x00E\x00" - - length: 1064 - rva: 682456 - offset: 665048 + - length: 0x428 + rva: 0xa69d8 + offset: 0xa25d8 type: RESOURCE_TYPE_BITMAP language: 19 name_string: "M\x00E\x00I\x00S\x00E\x00N\x00D\x00" - - length: 4136 - rva: 683520 - offset: 666112 + - length: 0x1028 + rva: 0xa6e00 + offset: 0xa2a00 type: RESOURCE_TYPE_BITMAP language: 19 name_string: "M\x00E\x00I\x00S\x00E\x00N\x00D\x003\x002\x00" - - length: 1064 - rva: 687656 - offset: 670248 + - length: 0x428 + rva: 0xa7e28 + offset: 0xa3a28 type: RESOURCE_TYPE_BITMAP language: 19 name_string: "M\x00E\x00I\x00S\x00H\x00O\x00W\x00" - - length: 3112 - rva: 688720 - offset: 671312 + - length: 0xc28 + rva: 0xa8250 + offset: 0xa3e50 type: RESOURCE_TYPE_BITMAP language: 19 name_string: "M\x00O\x00D\x00E\x00I\x00M\x00A\x00G\x00E\x00" - - length: 192 - rva: 691832 - offset: 674424 + - length: 0xc0 + rva: 0xa8e78 + offset: 0xa4a78 type: RESOURCE_TYPE_BITMAP language: 19 name_string: "N\x00E\x00T\x00W\x00O\x00R\x00K\x00" - - length: 3112 - rva: 692024 - offset: 674616 + - length: 0xc28 + rva: 0xa8f38 + offset: 0xa4b38 type: RESOURCE_TYPE_BITMAP language: 19 name_string: "N\x00E\x00W\x00F\x00I\x00L\x00E\x00P\x00A\x00T\x00T\x00E\x00R\x00N\x00I\x00M\x00A\x00G\x00E\x00" - - length: 3112 - rva: 695136 - offset: 677728 + - length: 0xc28 + rva: 0xa9b60 + offset: 0xa5760 type: RESOURCE_TYPE_BITMAP language: 19 name_string: "N\x00E\x00W\x00I\x00N\x00C\x00E\x00X\x00C\x00F\x00O\x00L\x00D\x00E\x00R\x00I\x00M\x00A\x00G\x00E\x00" - - length: 224 - rva: 698248 - offset: 680840 + - length: 0xe0 + rva: 0xaa788 + offset: 0xa6388 type: RESOURCE_TYPE_BITMAP language: 19 name_string: "O\x00P\x00E\x00N\x00F\x00O\x00L\x00D\x00E\x00R\x00" - - length: 3112 - rva: 698472 - offset: 681064 + - length: 0xc28 + rva: 0xaa868 + offset: 0xa6468 type: RESOURCE_TYPE_BITMAP language: 19 name_string: "O\x00P\x00T\x00I\x00O\x00N\x00S\x00I\x00M\x00A\x00G\x00E\x00" - - length: 80 - rva: 701584 - offset: 684176 + - length: 0x50 + rva: 0xab490 + offset: 0xa7090 type: RESOURCE_TYPE_BITMAP language: 19 name_string: "P\x00B\x00_\x00D\x00I\x00S\x00A\x00B\x00L\x00E\x00D\x00_\x00E\x00M\x00P\x00T\x00Y\x00" - - length: 80 - rva: 701664 - offset: 684256 + - length: 0x50 + rva: 0xab4e0 + offset: 0xa70e0 type: RESOURCE_TYPE_BITMAP language: 19 name_string: "P\x00B\x00_\x00D\x00I\x00S\x00A\x00B\x00L\x00E\x00D\x00_\x00E\x00M\x00P\x00T\x00Y\x00_\x00E\x00D\x00G\x00E\x00" - - length: 80 - rva: 701744 - offset: 684336 + - length: 0x50 + rva: 0xab530 + offset: 0xa7130 type: RESOURCE_TYPE_BITMAP language: 19 name_string: "P\x00B\x00_\x00D\x00I\x00S\x00A\x00B\x00L\x00E\x00D\x00_\x00F\x00I\x00L\x00L\x00E\x00D\x00" - - length: 80 - rva: 701824 - offset: 684416 + - length: 0x50 + rva: 0xab580 + offset: 0xa7180 type: RESOURCE_TYPE_BITMAP language: 19 name_string: "P\x00B\x00_\x00D\x00I\x00S\x00A\x00B\x00L\x00E\x00D\x00_\x00F\x00I\x00L\x00L\x00E\x00D\x00_\x00E\x00D\x00G\x00E\x00" - - length: 120 - rva: 701904 - offset: 684496 + - length: 0x78 + rva: 0xab5d0 + offset: 0xa71d0 type: RESOURCE_TYPE_BITMAP language: 19 name_string: "P\x00G\x00B\x00R\x00_\x00B\x00A\x00R\x00R\x00I\x00G\x00H\x00T\x00E\x00D\x00G\x00E\x002\x000\x00" - - length: 122 - rva: 702024 - offset: 684616 + - length: 0x7a + rva: 0xab648 + offset: 0xa7248 type: RESOURCE_TYPE_BITMAP language: 19 name_string: "P\x00G\x00B\x00R\x00_\x00C\x00O\x00N\x00T\x00A\x00I\x00N\x00E\x00R\x00E\x00M\x00P\x00T\x00Y\x002\x000\x00" - - length: 122 - rva: 702148 - offset: 684740 + - length: 0x7a + rva: 0xab6c4 + offset: 0xa72c4 type: RESOURCE_TYPE_BITMAP language: 19 name_string: "P\x00G\x00B\x00R\x00_\x00C\x00O\x00N\x00T\x00A\x00I\x00N\x00E\x00R\x00F\x00I\x00L\x00L\x00E\x00D\x002\x000\x00" - - length: 122 - rva: 702272 - offset: 684864 + - length: 0x7a + rva: 0xab740 + offset: 0xa7340 type: RESOURCE_TYPE_BITMAP language: 19 name_string: "P\x00G\x00B\x00R\x00_\x00C\x00O\x00N\x00T\x00A\x00I\x00N\x00E\x00R\x00L\x00E\x00F\x00T\x00E\x00D\x00G\x00E\x00E\x00M\x00P\x00T\x00Y\x002\x000\x00" - - length: 122 - rva: 702396 - offset: 684988 + - length: 0x7a + rva: 0xab7bc + offset: 0xa73bc type: RESOURCE_TYPE_BITMAP language: 19 name_string: "P\x00G\x00B\x00R\x00_\x00C\x00O\x00N\x00T\x00A\x00I\x00N\x00E\x00R\x00L\x00E\x00F\x00T\x00E\x00D\x00G\x00E\x00F\x00I\x00L\x00L\x00E\x00D\x002\x000\x00" - - length: 122 - rva: 702520 - offset: 685112 + - length: 0x7a + rva: 0xab838 + offset: 0xa7438 type: RESOURCE_TYPE_BITMAP language: 19 name_string: "P\x00G\x00B\x00R\x00_\x00C\x00O\x00N\x00T\x00A\x00I\x00N\x00E\x00R\x00R\x00I\x00G\x00H\x00T\x00E\x00D\x00G\x00E\x00E\x00M\x00P\x00T\x00Y\x002\x000\x00" - - length: 120 - rva: 702644 - offset: 685236 + - length: 0x78 + rva: 0xab8b4 + offset: 0xa74b4 type: RESOURCE_TYPE_BITMAP language: 19 name_string: "P\x00G\x00B\x00R\x00_\x00C\x00O\x00N\x00T\x00A\x00I\x00N\x00E\x00R\x00R\x00I\x00G\x00H\x00T\x00E\x00D\x00G\x00E\x00F\x00I\x00L\x00L\x00E\x00D\x002\x000\x00" - - length: 808 - rva: 702764 - offset: 685356 + - length: 0x328 + rva: 0xab92c + offset: 0xa752c type: RESOURCE_TYPE_BITMAP language: 19 name_string: "P\x00M\x00_\x00I\x00M\x00G\x00_\x00A\x00R\x00R\x00O\x00W\x00_\x001\x006\x00X\x001\x006\x00" - - length: 808 - rva: 703572 - offset: 686164 + - length: 0x328 + rva: 0xabc54 + offset: 0xa7854 type: RESOURCE_TYPE_BITMAP language: 19 name_string: "P\x00M\x00_\x00I\x00M\x00G\x00_\x00B\x00U\x00L\x00L\x00E\x00T\x00_\x001\x006\x00X\x001\x006\x00" - - length: 3112 - rva: 704380 - offset: 686972 + - length: 0xc28 + rva: 0xabf7c + offset: 0xa7b7c type: RESOURCE_TYPE_BITMAP language: 19 name_string: "P\x00M\x00_\x00I\x00M\x00G\x00_\x00D\x00E\x00P\x00E\x00N\x00D\x00S\x00_\x003\x002\x00X\x003\x002\x00" - - length: 808 - rva: 707492 - offset: 690084 + - length: 0x328 + rva: 0xacba4 + offset: 0xa87a4 type: RESOURCE_TYPE_BITMAP language: 19 name_string: "P\x00M\x00_\x00I\x00M\x00G\x00_\x00I\x00N\x00F\x00O\x00_\x001\x006\x00X\x001\x006\x00" - - length: 808 - rva: 708300 - offset: 690892 + - length: 0x328 + rva: 0xacecc + offset: 0xa8acc type: RESOURCE_TYPE_BITMAP language: 19 name_string: "P\x00M\x00_\x00I\x00M\x00G\x00_\x00P\x00R\x00I\x00H\x00E\x00L\x00P\x00_\x001\x006\x00X\x001\x006\x00" - - length: 808 - rva: 709108 - offset: 691700 + - length: 0x328 + rva: 0xad1f4 + offset: 0xa8df4 type: RESOURCE_TYPE_BITMAP language: 19 name_string: "P\x00M\x00_\x00I\x00M\x00G\x00_\x00U\x00N\x00K\x00N\x00O\x00W\x00N\x00_\x001\x006\x00X\x001\x006\x00" - - length: 232 - rva: 709916 - offset: 692508 + - length: 0xe8 + rva: 0xad51c + offset: 0xa911c type: RESOURCE_TYPE_BITMAP language: 19 name_string: "P\x00R\x00E\x00V\x00I\x00E\x00W\x00G\x00L\x00Y\x00P\x00H\x00" - - length: 192 - rva: 710148 - offset: 692740 + - length: 0xc0 + rva: 0xad604 + offset: 0xa9204 type: RESOURCE_TYPE_BITMAP language: 19 name_string: "R\x00A\x00M\x00" - - length: 3112 - rva: 710340 - offset: 692932 + - length: 0xc28 + rva: 0xad6c4 + offset: 0xa92c4 type: RESOURCE_TYPE_BITMAP language: 19 name_string: "R\x00E\x00G\x00C\x00L\x00E\x00A\x00N\x00E\x00X\x00C\x00L\x00U\x00D\x00E\x00I\x00M\x00A\x00G\x00E\x00" - - length: 3112 - rva: 713452 - offset: 696044 + - length: 0xc28 + rva: 0xae2ec + offset: 0xa9eec type: RESOURCE_TYPE_BITMAP language: 19 name_string: "S\x00C\x00H\x00E\x00D\x00U\x00L\x00E\x00_\x00I\x00M\x00A\x00G\x00E\x00" - - length: 3112 - rva: 716564 - offset: 699156 + - length: 0xc28 + rva: 0xaef14 + offset: 0xaab14 type: RESOURCE_TYPE_BITMAP language: 19 name_string: "S\x00E\x00A\x00R\x00C\x00H\x00C\x00A\x00N\x00C\x00E\x00L\x00L\x00E\x00D\x00I\x00M\x00A\x00G\x00E\x00" - - length: 3112 - rva: 719676 - offset: 702268 + - length: 0xc28 + rva: 0xafb3c + offset: 0xab73c type: RESOURCE_TYPE_BITMAP language: 19 name_string: "S\x00E\x00A\x00R\x00C\x00H\x00C\x00O\x00M\x00P\x00L\x00E\x00T\x00E\x00I\x00M\x00A\x00G\x00E\x00" - - length: 23056 - rva: 722788 - offset: 705380 + - length: 0x5a10 + rva: 0xb0764 + offset: 0xac364 type: RESOURCE_TYPE_BITMAP language: 19 name_string: "S\x00M\x00D\x00I\x00A\x00L\x00O\x00G\x00_\x00B\x00U\x00T\x00T\x00O\x00N\x00" - - length: 27442 - rva: 745844 - offset: 728436 + - length: 0x6b32 + rva: 0xb6174 + offset: 0xb1d74 type: RESOURCE_TYPE_BITMAP language: 19 name_string: "S\x00M\x00D\x00I\x00A\x00L\x00O\x00G\x00_\x00B\x00U\x00T\x00T\x00O\x00N\x00_\x002\x005\x00" - - length: 29020 - rva: 773288 - offset: 755880 + - length: 0x715c + rva: 0xbcca8 + offset: 0xb88a8 type: RESOURCE_TYPE_BITMAP language: 19 name_string: "S\x00M\x00D\x00I\x00A\x00L\x00O\x00G\x00_\x00B\x00U\x00T\x00T\x00O\x00N\x00_\x00D\x00E\x00F\x00A\x00U\x00L\x00T\x00" - - length: 34542 - rva: 802308 - offset: 784900 + - length: 0x86ee + rva: 0xc3e04 + offset: 0xbfa04 type: RESOURCE_TYPE_BITMAP language: 19 name_string: "S\x00M\x00D\x00I\x00A\x00L\x00O\x00G\x00_\x00B\x00U\x00T\x00T\x00O\x00N\x00_\x00D\x00E\x00F\x00A\x00U\x00L\x00T\x00_\x002\x005\x00" - - length: 32212 - rva: 836852 - offset: 819444 + - length: 0x7dd4 + rva: 0xcc4f4 + offset: 0xc80f4 type: RESOURCE_TYPE_BITMAP language: 19 name_string: "S\x00M\x00D\x00I\x00A\x00L\x00O\x00G\x00_\x00B\x00U\x00T\x00T\x00O\x00N\x00_\x00L\x00O\x00N\x00G\x00" - - length: 38342 - rva: 869064 - offset: 851656 + - length: 0x95c6 + rva: 0xd42c8 + offset: 0xcfec8 type: RESOURCE_TYPE_BITMAP language: 19 name_string: "S\x00M\x00D\x00I\x00A\x00L\x00O\x00G\x00_\x00B\x00U\x00T\x00T\x00O\x00N\x00_\x00L\x00O\x00N\x00G\x00_\x002\x005\x00" - - length: 9762 - rva: 907408 - offset: 890000 + - length: 0x2622 + rva: 0xdd890 + offset: 0xd9490 type: RESOURCE_TYPE_BITMAP language: 19 name_string: "S\x00M\x00D\x00I\x00A\x00L\x00O\x00G\x00_\x00C\x00L\x00O\x00S\x00E\x00" - - length: 9762 - rva: 917172 - offset: 899764 + - length: 0x2622 + rva: 0xdfeb4 + offset: 0xdbab4 type: RESOURCE_TYPE_BITMAP language: 19 name_string: "S\x00M\x00D\x00I\x00A\x00L\x00O\x00G\x00_\x00C\x00L\x00O\x00S\x00E\x00_\x00C\x00O\x00M\x00B\x00O\x00" - - length: 184 - rva: 926936 - offset: 909528 + - length: 0xb8 + rva: 0xe24d8 + offset: 0xde0d8 type: RESOURCE_TYPE_BITMAP language: 19 name_string: "S\x00M\x00D\x00I\x00A\x00L\x00O\x00G\x00_\x00F\x00O\x00O\x00T\x00E\x00R\x00" - - length: 29272 - rva: 927120 - offset: 909712 + - length: 0x7258 + rva: 0xe2590 + offset: 0xde190 type: RESOURCE_TYPE_BITMAP language: 19 name_string: "S\x00M\x00D\x00I\x00A\x00L\x00O\x00G\x00_\x00F\x00O\x00O\x00T\x00E\x00R\x00_\x00L\x00E\x00F\x00T\x00" - - length: 242 - rva: 956392 - offset: 938984 + - length: 0xf2 + rva: 0xe97e8 + offset: 0xe53e8 type: RESOURCE_TYPE_BITMAP language: 19 name_string: "S\x00M\x00D\x00I\x00A\x00L\x00O\x00G\x00_\x00H\x00E\x00A\x00D\x00E\x00R\x00" - - length: 3114 - rva: 956636 - offset: 939228 + - length: 0xc2a + rva: 0xe98dc + offset: 0xe54dc type: RESOURCE_TYPE_BITMAP language: 19 name_string: "S\x00M\x00D\x00I\x00A\x00L\x00O\x00G\x00_\x00L\x00O\x00G\x00O\x00_\x00A\x00N\x00A\x00L\x00Y\x00S\x00I\x00S\x00" - - length: 3114 - rva: 959752 - offset: 942344 + - length: 0xc2a + rva: 0xea508 + offset: 0xe6108 type: RESOURCE_TYPE_BITMAP language: 19 name_string: "S\x00M\x00D\x00I\x00A\x00L\x00O\x00G\x00_\x00L\x00O\x00G\x00O\x00_\x00E\x00X\x00C\x00L\x00A\x00M\x00A\x00T\x00I\x00O\x00N\x00" - - length: 3114 - rva: 962868 - offset: 945460 + - length: 0xc2a + rva: 0xeb134 + offset: 0xe6d34 type: RESOURCE_TYPE_BITMAP language: 19 name_string: "S\x00M\x00D\x00I\x00A\x00L\x00O\x00G\x00_\x00L\x00O\x00G\x00O\x00_\x00Q\x00U\x00E\x00S\x00T\x00I\x00O\x00N\x00" - - length: 3114 - rva: 965984 - offset: 948576 + - length: 0xc2a + rva: 0xebd60 + offset: 0xe7960 type: RESOURCE_TYPE_BITMAP language: 19 name_string: "S\x00M\x00D\x00I\x00A\x00L\x00O\x00G\x00_\x00L\x00O\x00G\x00O\x00_\x00R\x00E\x00S\x00T\x00A\x00R\x00T\x00" - - length: 3114 - rva: 969100 - offset: 951692 + - length: 0xc2a + rva: 0xec98c + offset: 0xe858c type: RESOURCE_TYPE_BITMAP language: 19 name_string: "S\x00M\x00D\x00I\x00A\x00L\x00O\x00G\x00_\x00L\x00O\x00G\x00O\x00_\x00W\x00R\x00E\x00N\x00C\x00H\x00" - - length: 6306 - rva: 972216 - offset: 954808 + - length: 0x18a2 + rva: 0xed5b8 + offset: 0xe91b8 type: RESOURCE_TYPE_BITMAP language: 19 name_string: "S\x00M\x00D\x00I\x00A\x00L\x00O\x00G\x00_\x00M\x00I\x00N\x00I\x00M\x00I\x00Z\x00E\x00" - - length: 808 - rva: 978524 - offset: 961116 + - length: 0x328 + rva: 0xeee5c + offset: 0xeaa5c type: RESOURCE_TYPE_BITMAP language: 19 name_string: "S\x00T\x00A\x00T\x00U\x00S\x00_\x00C\x00A\x00N\x00C\x00E\x00L\x00E\x00D\x00" - - length: 808 - rva: 979332 - offset: 961924 + - length: 0x328 + rva: 0xef184 + offset: 0xead84 type: RESOURCE_TYPE_BITMAP language: 19 name_string: "S\x00T\x00A\x00T\x00U\x00S\x00_\x00C\x00O\x00M\x00P\x00L\x00E\x00T\x00E\x00" - - length: 808 - rva: 980140 - offset: 962732 + - length: 0x328 + rva: 0xef4ac + offset: 0xeb0ac type: RESOURCE_TYPE_BITMAP language: 19 name_string: "S\x00T\x00A\x00T\x00U\x00S\x00_\x00P\x00E\x00N\x00D\x00I\x00N\x00G\x00" - - length: 808 - rva: 980948 - offset: 963540 + - length: 0x328 + rva: 0xef7d4 + offset: 0xeb3d4 type: RESOURCE_TYPE_BITMAP language: 19 name_string: "S\x00T\x00A\x00T\x00U\x00S\x00_\x00S\x00K\x00I\x00P\x00P\x00E\x00D\x00" - - length: 808 - rva: 981756 - offset: 964348 + - length: 0x328 + rva: 0xefafc + offset: 0xeb6fc type: RESOURCE_TYPE_BITMAP language: 19 name_string: "S\x00T\x00A\x00T\x00U\x00S\x00_\x00T\x00E\x00S\x00T\x00I\x00N\x00G\x00" - - length: 808 - rva: 982564 - offset: 965156 + - length: 0x328 + rva: 0xefe24 + offset: 0xeba24 type: RESOURCE_TYPE_BITMAP language: 19 name_string: "S\x00T\x00A\x00T\x00U\x00S\x00_\x00W\x00A\x00R\x00N\x00I\x00N\x00G\x00" - - length: 808 - rva: 983372 - offset: 965964 + - length: 0x328 + rva: 0xf014c + offset: 0xebd4c type: RESOURCE_TYPE_BITMAP language: 19 name_string: "S\x00T\x00A\x00T\x00U\x00S\x00_\x00W\x00O\x00R\x00K\x00D\x00O\x00N\x00E\x00" - - length: 1050 - rva: 984180 - offset: 966772 + - length: 0x41a + rva: 0xf0474 + offset: 0xec074 type: RESOURCE_TYPE_BITMAP language: 19 name_string: "S\x00T\x00R\x00O\x00K\x00E\x00G\x00R\x00E\x00E\x00N\x00C\x00H\x00E\x00C\x00K\x00" - - length: 1050 - rva: 985232 - offset: 967824 + - length: 0x41a + rva: 0xf0890 + offset: 0xec490 type: RESOURCE_TYPE_BITMAP language: 19 name_string: "S\x00T\x00R\x00O\x00K\x00E\x00R\x00E\x00D\x00X\x00" - - length: 224 - rva: 986284 - offset: 968876 + - length: 0xe0 + rva: 0xf0cac + offset: 0xec8ac type: RESOURCE_TYPE_BITMAP language: 19 name_string: "U\x00N\x00K\x00N\x00O\x00W\x00N\x00F\x00I\x00L\x00E\x00" - - length: 3304 - rva: 986508 - offset: 969100 + - length: 0xce8 + rva: 0xf0d8c + offset: 0xec98c type: RESOURCE_TYPE_BITMAP language: 19 name_string: "V\x00T\x00_\x00C\x00H\x00E\x00C\x00K\x00_\x00D\x00A\x00R\x00K\x00" - - length: 3304 - rva: 989812 - offset: 972404 + - length: 0xce8 + rva: 0xf1a74 + offset: 0xed674 type: RESOURCE_TYPE_BITMAP language: 19 name_string: "V\x00T\x00_\x00C\x00H\x00E\x00C\x00K\x00_\x00L\x00I\x00G\x00H\x00T\x00" - - length: 3304 - rva: 993116 - offset: 975708 + - length: 0xce8 + rva: 0xf275c + offset: 0xee35c type: RESOURCE_TYPE_BITMAP language: 19 name_string: "V\x00T\x00_\x00F\x00L\x00A\x00T\x00" - - length: 616 - rva: 996420 - offset: 979012 + - length: 0x268 + rva: 0xf3444 + offset: 0xef044 type: RESOURCE_TYPE_BITMAP language: 19 name_string: "V\x00T\x00_\x00M\x00O\x00V\x00E\x00A\x00L\x00L\x00" - - length: 616 - rva: 997036 - offset: 979628 + - length: 0x268 + rva: 0xf36ac + offset: 0xef2ac type: RESOURCE_TYPE_BITMAP language: 19 name_string: "V\x00T\x00_\x00M\x00O\x00V\x00E\x00E\x00W\x00" - - length: 616 - rva: 997652 - offset: 980244 + - length: 0x268 + rva: 0xf3914 + offset: 0xef514 type: RESOURCE_TYPE_BITMAP language: 19 name_string: "V\x00T\x00_\x00M\x00O\x00V\x00E\x00N\x00S\x00" - - length: 3304 - rva: 998268 - offset: 980860 + - length: 0xce8 + rva: 0xf3b7c + offset: 0xef77c type: RESOURCE_TYPE_BITMAP language: 19 name_string: "V\x00T\x00_\x00T\x00I\x00C\x00K\x00_\x00D\x00A\x00R\x00K\x00" - - length: 3304 - rva: 1001572 - offset: 984164 + - length: 0xce8 + rva: 0xf4864 + offset: 0xf0464 type: RESOURCE_TYPE_BITMAP language: 19 name_string: "V\x00T\x00_\x00T\x00I\x00C\x00K\x00_\x00L\x00I\x00G\x00H\x00T\x00" - - length: 3368 - rva: 1004876 - offset: 987468 + - length: 0xd28 + rva: 0xf554c + offset: 0xf114c type: RESOURCE_TYPE_BITMAP language: 19 name_string: "V\x00T\x00_\x00U\x00T\x00I\x00L\x00I\x00T\x00I\x00E\x00S\x00" - - length: 19242 - rva: 1008244 - offset: 990836 + - length: 0x4b2a + rva: 0xf6274 + offset: 0xf1e74 type: RESOURCE_TYPE_BITMAP language: 19 name_string: "V\x00T\x00_\x00X\x00P\x00" - - length: 294 - rva: 1027488 - offset: 1010080 + - length: 0x126 + rva: 0xfada0 + offset: 0xf69a0 type: RESOURCE_TYPE_BITMAP language: 19 name_string: "V\x00T\x00_\x00X\x00P\x00B\x00U\x00T\x00T\x00O\x00N\x00M\x00I\x00N\x00U\x00S\x00" - - length: 294 - rva: 1027784 - offset: 1010376 + - length: 0x126 + rva: 0xfaec8 + offset: 0xf6ac8 type: RESOURCE_TYPE_BITMAP language: 19 name_string: "V\x00T\x00_\x00X\x00P\x00B\x00U\x00T\x00T\x00O\x00N\x00P\x00L\x00U\x00S\x00" - - length: 872 - rva: 1028080 - offset: 1010672 + - length: 0x368 + rva: 0xfaff0 + offset: 0xf6bf0 type: RESOURCE_TYPE_ICON id: 1 language: 19 - - length: 82 - rva: 1028952 - offset: 1011544 + - length: 0x52 + rva: 0xfb358 + offset: 0xf6f58 type: RESOURCE_TYPE_DIALOG language: 19 name_string: "D\x00L\x00G\x00T\x00E\x00M\x00P\x00L\x00A\x00T\x00E\x00" - - length: 82 - rva: 1029036 - offset: 1011628 + - length: 0x52 + rva: 0xfb3ac + offset: 0xf6fac type: RESOURCE_TYPE_DIALOG language: 19 name_string: "T\x00E\x00X\x00T\x00F\x00I\x00L\x00E\x00D\x00L\x00G\x00" - - length: 640 - rva: 1029120 - offset: 1011712 + - length: 0x280 + rva: 0xfb400 + offset: 0xf7000 type: RESOURCE_TYPE_STRING id: 3867 language: 19 - - length: 340 - rva: 1029760 - offset: 1012352 + - length: 0x154 + rva: 0xfb680 + offset: 0xf7280 type: RESOURCE_TYPE_STRING id: 3868 language: 19 - - length: 728 - rva: 1030100 - offset: 1012692 + - length: 0x2d8 + rva: 0xfb7d4 + offset: 0xf73d4 type: RESOURCE_TYPE_STRING id: 3869 language: 19 - - length: 588 - rva: 1030828 - offset: 1013420 + - length: 0x24c + rva: 0xfbaac + offset: 0xf76ac type: RESOURCE_TYPE_STRING id: 3870 language: 19 - - length: 712 - rva: 1031416 - offset: 1014008 + - length: 0x2c8 + rva: 0xfbcf8 + offset: 0xf78f8 type: RESOURCE_TYPE_STRING id: 3871 language: 19 - - length: 590 - rva: 1032128 - offset: 1014720 + - length: 0x24e + rva: 0xfbfc0 + offset: 0xf7bc0 type: RESOURCE_TYPE_STRING id: 3872 language: 19 - - length: 378 - rva: 1032720 - offset: 1015312 + - length: 0x17a + rva: 0xfc210 + offset: 0xf7e10 type: RESOURCE_TYPE_STRING id: 3873 language: 19 - - length: 1174 - rva: 1033100 - offset: 1015692 + - length: 0x496 + rva: 0xfc38c + offset: 0xf7f8c type: RESOURCE_TYPE_STRING id: 3874 language: 19 - - length: 1730 - rva: 1034276 - offset: 1016868 + - length: 0x6c2 + rva: 0xfc824 + offset: 0xf8424 type: RESOURCE_TYPE_STRING id: 3875 language: 19 - - length: 2902 - rva: 1036008 - offset: 1018600 + - length: 0xb56 + rva: 0xfcee8 + offset: 0xf8ae8 type: RESOURCE_TYPE_STRING id: 3876 language: 19 - - length: 1722 - rva: 1038912 - offset: 1021504 + - length: 0x6ba + rva: 0xfda40 + offset: 0xf9640 type: RESOURCE_TYPE_STRING id: 3877 language: 19 - - length: 1266 - rva: 1040636 - offset: 1023228 + - length: 0x4f2 + rva: 0xfe0fc + offset: 0xf9cfc type: RESOURCE_TYPE_STRING id: 3878 language: 19 - - length: 916 - rva: 1041904 - offset: 1024496 + - length: 0x394 + rva: 0xfe5f0 + offset: 0xfa1f0 type: RESOURCE_TYPE_STRING id: 3879 language: 19 - - length: 1816 - rva: 1042820 - offset: 1025412 + - length: 0x718 + rva: 0xfe984 + offset: 0xfa584 type: RESOURCE_TYPE_STRING id: 3880 language: 19 - - length: 2238 - rva: 1044636 - offset: 1027228 + - length: 0x8be + rva: 0xff09c + offset: 0xfac9c type: RESOURCE_TYPE_STRING id: 3881 language: 19 - - length: 2496 - rva: 1046876 - offset: 1029468 + - length: 0x9c0 + rva: 0xff95c + offset: 0xfb55c type: RESOURCE_TYPE_STRING id: 3882 language: 19 - - length: 1884 - rva: 1049372 - offset: 1031964 + - length: 0x75c + rva: 0x10031c + offset: 0xfbf1c type: RESOURCE_TYPE_STRING id: 3883 language: 19 - - length: 1746 - rva: 1051256 - offset: 1033848 + - length: 0x6d2 + rva: 0x100a78 + offset: 0xfc678 type: RESOURCE_TYPE_STRING id: 3884 language: 19 - - length: 1154 - rva: 1053004 - offset: 1035596 + - length: 0x482 + rva: 0x10114c + offset: 0xfcd4c type: RESOURCE_TYPE_STRING id: 3885 language: 19 - - length: 802 - rva: 1054160 - offset: 1036752 + - length: 0x322 + rva: 0x1015d0 + offset: 0xfd1d0 type: RESOURCE_TYPE_STRING id: 3886 language: 19 - - length: 722 - rva: 1054964 - offset: 1037556 + - length: 0x2d2 + rva: 0x1018f4 + offset: 0xfd4f4 type: RESOURCE_TYPE_STRING id: 3887 language: 19 - - length: 2782 - rva: 1055688 - offset: 1038280 + - length: 0xade + rva: 0x101bc8 + offset: 0xfd7c8 type: RESOURCE_TYPE_STRING id: 3888 language: 19 - - length: 4110 - rva: 1058472 - offset: 1041064 + - length: 0x100e + rva: 0x1026a8 + offset: 0xfe2a8 type: RESOURCE_TYPE_STRING id: 3889 language: 19 - - length: 3864 - rva: 1062584 - offset: 1045176 + - length: 0xf18 + rva: 0x1036b8 + offset: 0xff2b8 type: RESOURCE_TYPE_STRING id: 3890 language: 19 - - length: 598 - rva: 1066448 - offset: 1049040 + - length: 0x256 + rva: 0x1045d0 + offset: 0x1001d0 type: RESOURCE_TYPE_STRING id: 3891 language: 19 - - length: 1074 - rva: 1067048 - offset: 1049640 + - length: 0x432 + rva: 0x104828 + offset: 0x100428 type: RESOURCE_TYPE_STRING id: 3892 language: 19 - - length: 918 - rva: 1068124 - offset: 1050716 + - length: 0x396 + rva: 0x104c5c + offset: 0x10085c type: RESOURCE_TYPE_STRING id: 3893 language: 19 - - length: 1268 - rva: 1069044 - offset: 1051636 + - length: 0x4f4 + rva: 0x104ff4 + offset: 0x100bf4 type: RESOURCE_TYPE_STRING id: 3894 language: 19 - - length: 1796 - rva: 1070312 - offset: 1052904 + - length: 0x704 + rva: 0x1054e8 + offset: 0x1010e8 type: RESOURCE_TYPE_STRING id: 3895 language: 19 - - length: 1640 - rva: 1072108 - offset: 1054700 + - length: 0x668 + rva: 0x105bec + offset: 0x1017ec type: RESOURCE_TYPE_STRING id: 3896 language: 19 - - length: 1370 - rva: 1073748 - offset: 1056340 + - length: 0x55a + rva: 0x106254 + offset: 0x101e54 type: RESOURCE_TYPE_STRING id: 3897 language: 19 - - length: 1156 - rva: 1075120 - offset: 1057712 + - length: 0x484 + rva: 0x1067b0 + offset: 0x1023b0 type: RESOURCE_TYPE_STRING id: 3898 language: 19 - - length: 1158 - rva: 1076276 - offset: 1058868 + - length: 0x486 + rva: 0x106c34 + offset: 0x102834 type: RESOURCE_TYPE_STRING id: 3899 language: 19 - - length: 1040 - rva: 1077436 - offset: 1060028 + - length: 0x410 + rva: 0x1070bc + offset: 0x102cbc type: RESOURCE_TYPE_STRING id: 3900 language: 19 - - length: 1302 - rva: 1078476 - offset: 1061068 + - length: 0x516 + rva: 0x1074cc + offset: 0x1030cc type: RESOURCE_TYPE_STRING id: 3901 language: 19 - - length: 1204 - rva: 1079780 - offset: 1062372 + - length: 0x4b4 + rva: 0x1079e4 + offset: 0x1035e4 type: RESOURCE_TYPE_STRING id: 3902 language: 19 - - length: 1004 - rva: 1080984 - offset: 1063576 + - length: 0x3ec + rva: 0x107e98 + offset: 0x103a98 type: RESOURCE_TYPE_STRING id: 3903 language: 19 - - length: 818 - rva: 1081988 - offset: 1064580 + - length: 0x332 + rva: 0x108284 + offset: 0x103e84 type: RESOURCE_TYPE_STRING id: 3904 language: 19 - - length: 2018 - rva: 1082808 - offset: 1065400 + - length: 0x7e2 + rva: 0x1085b8 + offset: 0x1041b8 type: RESOURCE_TYPE_STRING id: 3905 language: 19 - - length: 964 - rva: 1084828 - offset: 1067420 + - length: 0x3c4 + rva: 0x108d9c + offset: 0x10499c type: RESOURCE_TYPE_STRING id: 3906 language: 19 - - length: 970 - rva: 1085792 - offset: 1068384 + - length: 0x3ca + rva: 0x109160 + offset: 0x104d60 type: RESOURCE_TYPE_STRING id: 3907 language: 19 - - length: 1516 - rva: 1086764 - offset: 1069356 + - length: 0x5ec + rva: 0x10952c + offset: 0x10512c type: RESOURCE_TYPE_STRING id: 3908 language: 19 - - length: 1664 - rva: 1088280 - offset: 1070872 + - length: 0x680 + rva: 0x109b18 + offset: 0x105718 type: RESOURCE_TYPE_STRING id: 3909 language: 19 - - length: 1744 - rva: 1089944 - offset: 1072536 + - length: 0x6d0 + rva: 0x10a198 + offset: 0x105d98 type: RESOURCE_TYPE_STRING id: 3910 language: 19 - - length: 1992 - rva: 1091688 - offset: 1074280 + - length: 0x7c8 + rva: 0x10a868 + offset: 0x106468 type: RESOURCE_TYPE_STRING id: 3911 language: 19 - - length: 1800 - rva: 1093680 - offset: 1076272 + - length: 0x708 + rva: 0x10b030 + offset: 0x106c30 type: RESOURCE_TYPE_STRING id: 3912 language: 19 - - length: 1234 - rva: 1095480 - offset: 1078072 + - length: 0x4d2 + rva: 0x10b738 + offset: 0x107338 type: RESOURCE_TYPE_STRING id: 3913 language: 19 - - length: 1306 - rva: 1096716 - offset: 1079308 + - length: 0x51a + rva: 0x10bc0c + offset: 0x10780c type: RESOURCE_TYPE_STRING id: 3914 language: 19 - - length: 6382 - rva: 1098024 - offset: 1080616 + - length: 0x18ee + rva: 0x10c128 + offset: 0x107d28 type: RESOURCE_TYPE_STRING id: 3915 language: 19 - - length: 990 - rva: 1104408 - offset: 1087000 + - length: 0x3de + rva: 0x10da18 + offset: 0x109618 type: RESOURCE_TYPE_STRING id: 3916 language: 19 - - length: 3390 - rva: 1105400 - offset: 1087992 + - length: 0xd3e + rva: 0x10ddf8 + offset: 0x1099f8 type: RESOURCE_TYPE_STRING id: 3917 language: 19 - - length: 1194 - rva: 1108792 - offset: 1091384 + - length: 0x4aa + rva: 0x10eb38 + offset: 0x10a738 type: RESOURCE_TYPE_STRING id: 3918 language: 19 - - length: 796 - rva: 1109988 - offset: 1092580 + - length: 0x31c + rva: 0x10efe4 + offset: 0x10abe4 type: RESOURCE_TYPE_STRING id: 3919 language: 19 - - length: 816 - rva: 1110784 - offset: 1093376 + - length: 0x330 + rva: 0x10f300 + offset: 0x10af00 type: RESOURCE_TYPE_STRING id: 3920 language: 19 - - length: 1038 - rva: 1111600 - offset: 1094192 + - length: 0x40e + rva: 0x10f630 + offset: 0x10b230 type: RESOURCE_TYPE_STRING id: 3921 language: 19 - - length: 786 - rva: 1112640 - offset: 1095232 + - length: 0x312 + rva: 0x10fa40 + offset: 0x10b640 type: RESOURCE_TYPE_STRING id: 3922 language: 19 - - length: 1026 - rva: 1113428 - offset: 1096020 + - length: 0x402 + rva: 0x10fd54 + offset: 0x10b954 type: RESOURCE_TYPE_STRING id: 3923 language: 19 - - length: 1150 - rva: 1114456 - offset: 1097048 + - length: 0x47e + rva: 0x110158 + offset: 0x10bd58 type: RESOURCE_TYPE_STRING id: 3924 language: 19 - - length: 594 - rva: 1115608 - offset: 1098200 + - length: 0x252 + rva: 0x1105d8 + offset: 0x10c1d8 type: RESOURCE_TYPE_STRING id: 3925 language: 19 - - length: 1144 - rva: 1116204 - offset: 1098796 + - length: 0x478 + rva: 0x11082c + offset: 0x10c42c type: RESOURCE_TYPE_STRING id: 3926 language: 19 - - length: 1016 - rva: 1117348 - offset: 1099940 + - length: 0x3f8 + rva: 0x110ca4 + offset: 0x10c8a4 type: RESOURCE_TYPE_STRING id: 3927 language: 19 - - length: 1142 - rva: 1118364 - offset: 1100956 + - length: 0x476 + rva: 0x11109c + offset: 0x10cc9c type: RESOURCE_TYPE_STRING id: 3928 language: 19 - - length: 730 - rva: 1119508 - offset: 1102100 + - length: 0x2da + rva: 0x111514 + offset: 0x10d114 type: RESOURCE_TYPE_STRING id: 3929 language: 19 - - length: 940 - rva: 1120240 - offset: 1102832 + - length: 0x3ac + rva: 0x1117f0 + offset: 0x10d3f0 type: RESOURCE_TYPE_STRING id: 3930 language: 19 - - length: 970 - rva: 1121180 - offset: 1103772 + - length: 0x3ca + rva: 0x111b9c + offset: 0x10d79c type: RESOURCE_TYPE_STRING id: 3931 language: 19 - - length: 1956 - rva: 1122152 - offset: 1104744 + - length: 0x7a4 + rva: 0x111f68 + offset: 0x10db68 type: RESOURCE_TYPE_STRING id: 3932 language: 19 - - length: 1492 - rva: 1124108 - offset: 1106700 + - length: 0x5d4 + rva: 0x11270c + offset: 0x10e30c type: RESOURCE_TYPE_STRING id: 3933 language: 19 - - length: 1214 - rva: 1125600 - offset: 1108192 + - length: 0x4be + rva: 0x112ce0 + offset: 0x10e8e0 type: RESOURCE_TYPE_STRING id: 3934 language: 19 - - length: 1900 - rva: 1126816 - offset: 1109408 + - length: 0x76c + rva: 0x1131a0 + offset: 0x10eda0 type: RESOURCE_TYPE_STRING id: 3935 language: 19 - - length: 1674 - rva: 1128716 - offset: 1111308 + - length: 0x68a + rva: 0x11390c + offset: 0x10f50c type: RESOURCE_TYPE_STRING id: 3936 language: 19 - - length: 1486 - rva: 1130392 - offset: 1112984 + - length: 0x5ce + rva: 0x113f98 + offset: 0x10fb98 type: RESOURCE_TYPE_STRING id: 3937 language: 19 - - length: 1668 - rva: 1131880 - offset: 1114472 + - length: 0x684 + rva: 0x114568 + offset: 0x110168 type: RESOURCE_TYPE_STRING id: 3938 language: 19 - - length: 1072 - rva: 1133548 - offset: 1116140 + - length: 0x430 + rva: 0x114bec + offset: 0x1107ec type: RESOURCE_TYPE_STRING id: 3939 language: 19 - - length: 1440 - rva: 1134620 - offset: 1117212 + - length: 0x5a0 + rva: 0x11501c + offset: 0x110c1c type: RESOURCE_TYPE_STRING id: 3940 language: 19 - - length: 1950 - rva: 1136060 - offset: 1118652 + - length: 0x79e + rva: 0x1155bc + offset: 0x1111bc type: RESOURCE_TYPE_STRING id: 3941 language: 19 - - length: 1802 - rva: 1138012 - offset: 1120604 + - length: 0x70a + rva: 0x115d5c + offset: 0x11195c type: RESOURCE_TYPE_STRING id: 3942 language: 19 - - length: 1952 - rva: 1139816 - offset: 1122408 + - length: 0x7a0 + rva: 0x116468 + offset: 0x112068 type: RESOURCE_TYPE_STRING id: 3943 language: 19 - - length: 2334 - rva: 1141768 - offset: 1124360 + - length: 0x91e + rva: 0x116c08 + offset: 0x112808 type: RESOURCE_TYPE_STRING id: 3944 language: 19 - - length: 2180 - rva: 1144104 - offset: 1126696 + - length: 0x884 + rva: 0x117528 + offset: 0x113128 type: RESOURCE_TYPE_STRING id: 3945 language: 19 - - length: 1232 - rva: 1146284 - offset: 1128876 + - length: 0x4d0 + rva: 0x117dac + offset: 0x1139ac type: RESOURCE_TYPE_STRING id: 3946 language: 19 - - length: 1602 - rva: 1147516 - offset: 1130108 + - length: 0x642 + rva: 0x11827c + offset: 0x113e7c type: RESOURCE_TYPE_STRING id: 3947 language: 19 - - length: 740 - rva: 1149120 - offset: 1131712 + - length: 0x2e4 + rva: 0x1188c0 + offset: 0x1144c0 type: RESOURCE_TYPE_STRING id: 3948 language: 19 - - length: 470 - rva: 1149860 - offset: 1132452 + - length: 0x1d6 + rva: 0x118ba4 + offset: 0x1147a4 type: RESOURCE_TYPE_STRING id: 3949 language: 19 - - length: 1012 - rva: 1150332 - offset: 1132924 + - length: 0x3f4 + rva: 0x118d7c + offset: 0x11497c type: RESOURCE_TYPE_STRING id: 3950 language: 19 - - length: 1140 - rva: 1151344 - offset: 1133936 + - length: 0x474 + rva: 0x119170 + offset: 0x114d70 type: RESOURCE_TYPE_STRING id: 3951 language: 19 - - length: 714 - rva: 1152484 - offset: 1135076 + - length: 0x2ca + rva: 0x1195e4 + offset: 0x1151e4 type: RESOURCE_TYPE_STRING id: 3952 language: 19 - - length: 972 - rva: 1153200 - offset: 1135792 + - length: 0x3cc + rva: 0x1198b0 + offset: 0x1154b0 type: RESOURCE_TYPE_STRING id: 3953 language: 19 - - length: 1124 - rva: 1154172 - offset: 1136764 + - length: 0x464 + rva: 0x119c7c + offset: 0x11587c type: RESOURCE_TYPE_STRING id: 3954 language: 19 - - length: 842 - rva: 1155296 - offset: 1137888 + - length: 0x34a + rva: 0x11a0e0 + offset: 0x115ce0 type: RESOURCE_TYPE_STRING id: 3955 language: 19 - - length: 686 - rva: 1156140 - offset: 1138732 + - length: 0x2ae + rva: 0x11a42c + offset: 0x11602c type: RESOURCE_TYPE_STRING id: 3956 language: 19 - - length: 774 - rva: 1156828 - offset: 1139420 + - length: 0x306 + rva: 0x11a6dc + offset: 0x1162dc type: RESOURCE_TYPE_STRING id: 3957 language: 19 - - length: 854 - rva: 1157604 - offset: 1140196 + - length: 0x356 + rva: 0x11a9e4 + offset: 0x1165e4 type: RESOURCE_TYPE_STRING id: 3958 language: 19 - - length: 784 - rva: 1158460 - offset: 1141052 + - length: 0x310 + rva: 0x11ad3c + offset: 0x11693c type: RESOURCE_TYPE_STRING id: 3959 language: 19 - - length: 478 - rva: 1159244 - offset: 1141836 + - length: 0x1de + rva: 0x11b04c + offset: 0x116c4c type: RESOURCE_TYPE_STRING id: 3960 language: 19 - - length: 1140 - rva: 1159724 - offset: 1142316 + - length: 0x474 + rva: 0x11b22c + offset: 0x116e2c type: RESOURCE_TYPE_STRING id: 3961 language: 19 - - length: 2522 - rva: 1160864 - offset: 1143456 + - length: 0x9da + rva: 0x11b6a0 + offset: 0x1172a0 type: RESOURCE_TYPE_STRING id: 3962 language: 19 - - length: 420 - rva: 1163388 - offset: 1145980 + - length: 0x1a4 + rva: 0x11c07c + offset: 0x117c7c type: RESOURCE_TYPE_STRING id: 3963 language: 19 - - length: 198 - rva: 1163808 - offset: 1146400 + - length: 0xc6 + rva: 0x11c220 + offset: 0x117e20 type: RESOURCE_TYPE_STRING id: 3964 language: 19 - - length: 32 - rva: 1164008 - offset: 1146600 + - length: 0x20 + rva: 0x11c2e8 + offset: 0x117ee8 type: RESOURCE_TYPE_STRING id: 3965 language: 19 - - length: 394 - rva: 1164040 - offset: 1146632 + - length: 0x18a + rva: 0x11c308 + offset: 0x117f08 type: RESOURCE_TYPE_STRING id: 3966 language: 19 - - length: 436 - rva: 1164436 - offset: 1147028 + - length: 0x1b4 + rva: 0x11c494 + offset: 0x118094 type: RESOURCE_TYPE_STRING id: 3967 language: 19 - - length: 644 - rva: 1164872 - offset: 1147464 + - length: 0x284 + rva: 0x11c648 + offset: 0x118248 type: RESOURCE_TYPE_STRING id: 3968 language: 19 - - length: 782 - rva: 1165516 - offset: 1148108 + - length: 0x30e + rva: 0x11c8cc + offset: 0x1184cc type: RESOURCE_TYPE_STRING id: 3969 language: 19 - - length: 1940 - rva: 1166300 - offset: 1148892 + - length: 0x794 + rva: 0x11cbdc + offset: 0x1187dc type: RESOURCE_TYPE_STRING id: 3970 language: 19 - - length: 956 - rva: 1168240 - offset: 1150832 + - length: 0x3bc + rva: 0x11d370 + offset: 0x118f70 type: RESOURCE_TYPE_STRING id: 3971 language: 19 - - length: 1234 - rva: 1169196 - offset: 1151788 + - length: 0x4d2 + rva: 0x11d72c + offset: 0x11932c type: RESOURCE_TYPE_STRING id: 3972 language: 19 - - length: 734 - rva: 1170432 - offset: 1153024 + - length: 0x2de + rva: 0x11dc00 + offset: 0x119800 type: RESOURCE_TYPE_STRING id: 3973 language: 19 - - length: 1130 - rva: 1171168 - offset: 1153760 + - length: 0x46a + rva: 0x11dee0 + offset: 0x119ae0 type: RESOURCE_TYPE_STRING id: 3974 language: 19 - - length: 794 - rva: 1172300 - offset: 1154892 + - length: 0x31a + rva: 0x11e34c + offset: 0x119f4c type: RESOURCE_TYPE_STRING id: 3975 language: 19 - - length: 2638 - rva: 1173096 - offset: 1155688 + - length: 0xa4e + rva: 0x11e668 + offset: 0x11a268 type: RESOURCE_TYPE_STRING id: 3976 language: 19 - - length: 4896 - rva: 1175736 - offset: 1158328 + - length: 0x1320 + rva: 0x11f0b8 + offset: 0x11acb8 type: RESOURCE_TYPE_STRING id: 3977 language: 19 - - length: 5062 - rva: 1180632 - offset: 1163224 + - length: 0x13c6 + rva: 0x1203d8 + offset: 0x11bfd8 type: RESOURCE_TYPE_STRING id: 3978 language: 19 - - length: 5682 - rva: 1185696 - offset: 1168288 + - length: 0x1632 + rva: 0x1217a0 + offset: 0x11d3a0 type: RESOURCE_TYPE_STRING id: 3979 language: 19 - - length: 3650 - rva: 1191380 - offset: 1173972 + - length: 0xe42 + rva: 0x122dd4 + offset: 0x11e9d4 type: RESOURCE_TYPE_STRING id: 3980 language: 19 - - length: 4336 - rva: 1195032 - offset: 1177624 + - length: 0x10f0 + rva: 0x123c18 + offset: 0x11f818 type: RESOURCE_TYPE_STRING id: 3981 language: 19 - - length: 3702 - rva: 1199368 - offset: 1181960 + - length: 0xe76 + rva: 0x124d08 + offset: 0x120908 type: RESOURCE_TYPE_STRING id: 3982 language: 19 - - length: 1030 - rva: 1203072 - offset: 1185664 + - length: 0x406 + rva: 0x125b80 + offset: 0x121780 type: RESOURCE_TYPE_STRING id: 3983 language: 19 - - length: 618 - rva: 1204104 - offset: 1186696 + - length: 0x26a + rva: 0x125f88 + offset: 0x121b88 type: RESOURCE_TYPE_STRING id: 3984 language: 19 - - length: 1040 - rva: 1204724 - offset: 1187316 + - length: 0x410 + rva: 0x1261f4 + offset: 0x121df4 type: RESOURCE_TYPE_STRING id: 3985 language: 19 - - length: 982 - rva: 1205764 - offset: 1188356 + - length: 0x3d6 + rva: 0x126604 + offset: 0x122204 type: RESOURCE_TYPE_STRING id: 3986 language: 19 - - length: 938 - rva: 1206748 - offset: 1189340 + - length: 0x3aa + rva: 0x1269dc + offset: 0x1225dc type: RESOURCE_TYPE_STRING id: 3987 language: 19 - - length: 650 - rva: 1207688 - offset: 1190280 + - length: 0x28a + rva: 0x126d88 + offset: 0x122988 type: RESOURCE_TYPE_STRING id: 3988 language: 19 - - length: 768 - rva: 1208340 - offset: 1190932 + - length: 0x300 + rva: 0x127014 + offset: 0x122c14 type: RESOURCE_TYPE_STRING id: 3989 language: 19 - - length: 2068 - rva: 1209108 - offset: 1191700 + - length: 0x814 + rva: 0x127314 + offset: 0x122f14 type: RESOURCE_TYPE_STRING id: 3990 language: 19 - - length: 1394 - rva: 1211176 - offset: 1193768 + - length: 0x572 + rva: 0x127b28 + offset: 0x123728 type: RESOURCE_TYPE_STRING id: 3991 language: 19 - - length: 540 - rva: 1212572 - offset: 1195164 + - length: 0x21c + rva: 0x12809c + offset: 0x123c9c type: RESOURCE_TYPE_STRING id: 3992 language: 19 - - length: 652 - rva: 1213112 - offset: 1195704 + - length: 0x28c + rva: 0x1282b8 + offset: 0x123eb8 type: RESOURCE_TYPE_STRING id: 3993 language: 19 - - length: 1224 - rva: 1213764 - offset: 1196356 + - length: 0x4c8 + rva: 0x128544 + offset: 0x124144 type: RESOURCE_TYPE_STRING id: 3994 language: 19 - - length: 1196 - rva: 1214988 - offset: 1197580 + - length: 0x4ac + rva: 0x128a0c + offset: 0x12460c type: RESOURCE_TYPE_STRING id: 3995 language: 19 - - length: 1874 - rva: 1216184 - offset: 1198776 + - length: 0x752 + rva: 0x128eb8 + offset: 0x124ab8 type: RESOURCE_TYPE_STRING id: 3996 language: 19 - - length: 762 - rva: 1218060 - offset: 1200652 + - length: 0x2fa + rva: 0x12960c + offset: 0x12520c type: RESOURCE_TYPE_STRING id: 3997 language: 19 - - length: 720 - rva: 1218824 - offset: 1201416 + - length: 0x2d0 + rva: 0x129908 + offset: 0x125508 type: RESOURCE_TYPE_STRING id: 3998 language: 19 - - length: 984 - rva: 1219544 - offset: 1202136 + - length: 0x3d8 + rva: 0x129bd8 + offset: 0x1257d8 type: RESOURCE_TYPE_STRING id: 3999 language: 19 - - length: 1084 - rva: 1220528 - offset: 1203120 + - length: 0x43c + rva: 0x129fb0 + offset: 0x125bb0 type: RESOURCE_TYPE_STRING id: 4000 language: 19 - - length: 498 - rva: 1221612 - offset: 1204204 + - length: 0x1f2 + rva: 0x12a3ec + offset: 0x125fec type: RESOURCE_TYPE_STRING id: 4001 language: 19 - - length: 768 - rva: 1222112 - offset: 1204704 + - length: 0x300 + rva: 0x12a5e0 + offset: 0x1261e0 type: RESOURCE_TYPE_STRING id: 4002 language: 19 - - length: 658 - rva: 1222880 - offset: 1205472 + - length: 0x292 + rva: 0x12a8e0 + offset: 0x1264e0 type: RESOURCE_TYPE_STRING id: 4003 language: 19 - - length: 976 - rva: 1223540 - offset: 1206132 + - length: 0x3d0 + rva: 0x12ab74 + offset: 0x126774 type: RESOURCE_TYPE_STRING id: 4004 language: 19 - - length: 934 - rva: 1224516 - offset: 1207108 + - length: 0x3a6 + rva: 0x12af44 + offset: 0x126b44 type: RESOURCE_TYPE_STRING id: 4005 language: 19 - - length: 1106 - rva: 1225452 - offset: 1208044 + - length: 0x452 + rva: 0x12b2ec + offset: 0x126eec type: RESOURCE_TYPE_STRING id: 4006 language: 19 - - length: 1332 - rva: 1226560 - offset: 1209152 + - length: 0x534 + rva: 0x12b740 + offset: 0x127340 type: RESOURCE_TYPE_STRING id: 4007 language: 19 - - length: 1546 - rva: 1227892 - offset: 1210484 + - length: 0x60a + rva: 0x12bc74 + offset: 0x127874 type: RESOURCE_TYPE_STRING id: 4008 language: 19 - - length: 656 - rva: 1229440 - offset: 1212032 + - length: 0x290 + rva: 0x12c280 + offset: 0x127e80 type: RESOURCE_TYPE_STRING id: 4009 language: 19 - - length: 3026 - rva: 1230096 - offset: 1212688 + - length: 0xbd2 + rva: 0x12c510 + offset: 0x128110 type: RESOURCE_TYPE_STRING id: 4010 language: 19 - - length: 1332 - rva: 1233124 - offset: 1215716 + - length: 0x534 + rva: 0x12d0e4 + offset: 0x128ce4 type: RESOURCE_TYPE_STRING id: 4011 language: 19 - - length: 952 - rva: 1234456 - offset: 1217048 + - length: 0x3b8 + rva: 0x12d618 + offset: 0x129218 type: RESOURCE_TYPE_STRING id: 4012 language: 19 - - length: 992 - rva: 1235408 - offset: 1218000 + - length: 0x3e0 + rva: 0x12d9d0 + offset: 0x1295d0 type: RESOURCE_TYPE_STRING id: 4013 language: 19 - - length: 614 - rva: 1236400 - offset: 1218992 + - length: 0x266 + rva: 0x12ddb0 + offset: 0x1299b0 type: RESOURCE_TYPE_STRING id: 4014 language: 19 - - length: 346 - rva: 1237016 - offset: 1219608 + - length: 0x15a + rva: 0x12e018 + offset: 0x129c18 type: RESOURCE_TYPE_STRING id: 4015 language: 19 - - length: 580 - rva: 1237364 - offset: 1219956 + - length: 0x244 + rva: 0x12e174 + offset: 0x129d74 type: RESOURCE_TYPE_STRING id: 4016 language: 19 - - length: 900 - rva: 1237944 - offset: 1220536 + - length: 0x384 + rva: 0x12e3b8 + offset: 0x129fb8 type: RESOURCE_TYPE_STRING id: 4017 language: 19 - - length: 1076 - rva: 1238844 - offset: 1221436 + - length: 0x434 + rva: 0x12e73c + offset: 0x12a33c type: RESOURCE_TYPE_STRING id: 4018 language: 19 - - length: 1040 - rva: 1239920 - offset: 1222512 + - length: 0x410 + rva: 0x12eb70 + offset: 0x12a770 type: RESOURCE_TYPE_STRING id: 4019 language: 19 - - length: 850 - rva: 1240960 - offset: 1223552 + - length: 0x352 + rva: 0x12ef80 + offset: 0x12ab80 type: RESOURCE_TYPE_STRING id: 4020 language: 19 - - length: 776 - rva: 1241812 - offset: 1224404 + - length: 0x308 + rva: 0x12f2d4 + offset: 0x12aed4 type: RESOURCE_TYPE_STRING id: 4021 language: 19 - - length: 940 - rva: 1242588 - offset: 1225180 + - length: 0x3ac + rva: 0x12f5dc + offset: 0x12b1dc type: RESOURCE_TYPE_STRING id: 4022 language: 19 - - length: 1336 - rva: 1243528 - offset: 1226120 + - length: 0x538 + rva: 0x12f988 + offset: 0x12b588 type: RESOURCE_TYPE_STRING id: 4023 language: 19 - - length: 1658 - rva: 1244864 - offset: 1227456 + - length: 0x67a + rva: 0x12fec0 + offset: 0x12bac0 type: RESOURCE_TYPE_STRING id: 4024 language: 19 - - length: 1064 - rva: 1246524 - offset: 1229116 + - length: 0x428 + rva: 0x13053c + offset: 0x12c13c type: RESOURCE_TYPE_STRING id: 4025 language: 19 - - length: 678 - rva: 1247588 - offset: 1230180 + - length: 0x2a6 + rva: 0x130964 + offset: 0x12c564 type: RESOURCE_TYPE_STRING id: 4026 language: 19 - - length: 692 - rva: 1248268 - offset: 1230860 + - length: 0x2b4 + rva: 0x130c0c + offset: 0x12c80c type: RESOURCE_TYPE_STRING id: 4027 language: 19 - - length: 510 - rva: 1248960 - offset: 1231552 + - length: 0x1fe + rva: 0x130ec0 + offset: 0x12cac0 type: RESOURCE_TYPE_STRING id: 4028 language: 19 - - length: 678 - rva: 1249472 - offset: 1232064 + - length: 0x2a6 + rva: 0x1310c0 + offset: 0x12ccc0 type: RESOURCE_TYPE_STRING id: 4029 language: 19 - - length: 1686 - rva: 1250152 - offset: 1232744 + - length: 0x696 + rva: 0x131368 + offset: 0x12cf68 type: RESOURCE_TYPE_STRING id: 4030 language: 19 - - length: 728 - rva: 1251840 - offset: 1234432 + - length: 0x2d8 + rva: 0x131a00 + offset: 0x12d600 type: RESOURCE_TYPE_STRING id: 4031 language: 19 - - length: 978 - rva: 1252568 - offset: 1235160 + - length: 0x3d2 + rva: 0x131cd8 + offset: 0x12d8d8 type: RESOURCE_TYPE_STRING id: 4032 language: 19 - - length: 1104 - rva: 1253548 - offset: 1236140 + - length: 0x450 + rva: 0x1320ac + offset: 0x12dcac type: RESOURCE_TYPE_STRING id: 4033 language: 19 - - length: 3726 - rva: 1254652 - offset: 1237244 + - length: 0xe8e + rva: 0x1324fc + offset: 0x12e0fc type: RESOURCE_TYPE_STRING id: 4034 language: 19 - - length: 2760 - rva: 1258380 - offset: 1240972 + - length: 0xac8 + rva: 0x13338c + offset: 0x12ef8c type: RESOURCE_TYPE_STRING id: 4035 language: 19 - - length: 2770 - rva: 1261140 - offset: 1243732 + - length: 0xad2 + rva: 0x133e54 + offset: 0x12fa54 type: RESOURCE_TYPE_STRING id: 4036 language: 19 - - length: 2282 - rva: 1263912 - offset: 1246504 + - length: 0x8ea + rva: 0x134928 + offset: 0x130528 type: RESOURCE_TYPE_STRING id: 4037 language: 19 - - length: 1898 - rva: 1266196 - offset: 1248788 + - length: 0x76a + rva: 0x135214 + offset: 0x130e14 type: RESOURCE_TYPE_STRING id: 4038 language: 19 - - length: 974 - rva: 1268096 - offset: 1250688 + - length: 0x3ce + rva: 0x135980 + offset: 0x131580 type: RESOURCE_TYPE_STRING id: 4039 language: 19 - - length: 730 - rva: 1269072 - offset: 1251664 + - length: 0x2da + rva: 0x135d50 + offset: 0x131950 type: RESOURCE_TYPE_STRING id: 4040 language: 19 - - length: 1138 - rva: 1269804 - offset: 1252396 + - length: 0x472 + rva: 0x13602c + offset: 0x131c2c type: RESOURCE_TYPE_STRING id: 4041 language: 19 - - length: 1208 - rva: 1270944 - offset: 1253536 + - length: 0x4b8 + rva: 0x1364a0 + offset: 0x1320a0 type: RESOURCE_TYPE_STRING id: 4042 language: 19 - - length: 948 - rva: 1272152 - offset: 1254744 + - length: 0x3b4 + rva: 0x136958 + offset: 0x132558 type: RESOURCE_TYPE_STRING id: 4043 language: 19 - - length: 910 - rva: 1273100 - offset: 1255692 + - length: 0x38e + rva: 0x136d0c + offset: 0x13290c type: RESOURCE_TYPE_STRING id: 4044 language: 19 - - length: 1026 - rva: 1274012 - offset: 1256604 + - length: 0x402 + rva: 0x13709c + offset: 0x132c9c type: RESOURCE_TYPE_STRING id: 4045 language: 19 - - length: 1070 - rva: 1275040 - offset: 1257632 + - length: 0x42e + rva: 0x1374a0 + offset: 0x1330a0 type: RESOURCE_TYPE_STRING id: 4046 language: 19 - - length: 830 - rva: 1276112 - offset: 1258704 + - length: 0x33e + rva: 0x1378d0 + offset: 0x1334d0 type: RESOURCE_TYPE_STRING id: 4047 language: 19 - - length: 922 - rva: 1276944 - offset: 1259536 + - length: 0x39a + rva: 0x137c10 + offset: 0x133810 type: RESOURCE_TYPE_STRING id: 4048 language: 19 - - length: 610 - rva: 1277868 - offset: 1260460 + - length: 0x262 + rva: 0x137fac + offset: 0x133bac type: RESOURCE_TYPE_STRING id: 4049 language: 19 - - length: 1420 - rva: 1278480 - offset: 1261072 + - length: 0x58c + rva: 0x138210 + offset: 0x133e10 type: RESOURCE_TYPE_STRING id: 4050 language: 19 - - length: 3210 - rva: 1279900 - offset: 1262492 + - length: 0xc8a + rva: 0x13879c + offset: 0x13439c type: RESOURCE_TYPE_STRING id: 4051 language: 19 - - length: 1284 - rva: 1283112 - offset: 1265704 + - length: 0x504 + rva: 0x139428 + offset: 0x135028 type: RESOURCE_TYPE_STRING id: 4052 language: 19 - - length: 920 - rva: 1284396 - offset: 1266988 + - length: 0x398 + rva: 0x13992c + offset: 0x13552c type: RESOURCE_TYPE_STRING id: 4053 language: 19 - - length: 1188 - rva: 1285316 - offset: 1267908 + - length: 0x4a4 + rva: 0x139cc4 + offset: 0x1358c4 type: RESOURCE_TYPE_STRING id: 4054 language: 19 - - length: 570 - rva: 1286504 - offset: 1269096 + - length: 0x23a + rva: 0x13a168 + offset: 0x135d68 type: RESOURCE_TYPE_STRING id: 4055 language: 19 - - length: 576 - rva: 1287076 - offset: 1269668 + - length: 0x240 + rva: 0x13a3a4 + offset: 0x135fa4 type: RESOURCE_TYPE_STRING id: 4056 language: 19 - - length: 288 - rva: 1287652 - offset: 1270244 + - length: 0x120 + rva: 0x13a5e4 + offset: 0x1361e4 type: RESOURCE_TYPE_STRING id: 4057 language: 19 - - length: 304 - rva: 1287940 - offset: 1270532 + - length: 0x130 + rva: 0x13a704 + offset: 0x136304 type: RESOURCE_TYPE_STRING id: 4058 language: 19 - - length: 222 - rva: 1288244 - offset: 1270836 + - length: 0xde + rva: 0x13a834 + offset: 0x136434 type: RESOURCE_TYPE_STRING id: 4059 language: 19 - - length: 870 - rva: 1288468 - offset: 1271060 + - length: 0x366 + rva: 0x13a914 + offset: 0x136514 type: RESOURCE_TYPE_STRING id: 4060 language: 19 - - length: 1148 - rva: 1289340 - offset: 1271932 + - length: 0x47c + rva: 0x13ac7c + offset: 0x13687c type: RESOURCE_TYPE_STRING id: 4061 language: 19 - - length: 1258 - rva: 1290488 - offset: 1273080 + - length: 0x4ea + rva: 0x13b0f8 + offset: 0x136cf8 type: RESOURCE_TYPE_STRING id: 4062 language: 19 - - length: 1060 - rva: 1291748 - offset: 1274340 + - length: 0x424 + rva: 0x13b5e4 + offset: 0x1371e4 type: RESOURCE_TYPE_STRING id: 4063 language: 19 - - length: 1296 - rva: 1292808 - offset: 1275400 + - length: 0x510 + rva: 0x13ba08 + offset: 0x137608 type: RESOURCE_TYPE_STRING id: 4064 language: 19 - - length: 1076 - rva: 1294104 - offset: 1276696 + - length: 0x434 + rva: 0x13bf18 + offset: 0x137b18 type: RESOURCE_TYPE_STRING id: 4065 language: 19 - - length: 290 - rva: 1295180 - offset: 1277772 + - length: 0x122 + rva: 0x13c34c + offset: 0x137f4c type: RESOURCE_TYPE_STRING id: 4066 language: 19 - - length: 256 - rva: 1295472 - offset: 1278064 + - length: 0x100 + rva: 0x13c470 + offset: 0x138070 type: RESOURCE_TYPE_STRING id: 4067 language: 19 - - length: 412 - rva: 1295728 - offset: 1278320 + - length: 0x19c + rva: 0x13c570 + offset: 0x138170 type: RESOURCE_TYPE_STRING id: 4068 language: 19 - - length: 1022 - rva: 1296140 - offset: 1278732 + - length: 0x3fe + rva: 0x13c70c + offset: 0x13830c type: RESOURCE_TYPE_STRING id: 4069 language: 19 - - length: 1206 - rva: 1297164 - offset: 1279756 + - length: 0x4b6 + rva: 0x13cb0c + offset: 0x13870c type: RESOURCE_TYPE_STRING id: 4070 language: 19 - - length: 1458 - rva: 1298372 - offset: 1280964 + - length: 0x5b2 + rva: 0x13cfc4 + offset: 0x138bc4 type: RESOURCE_TYPE_STRING id: 4071 language: 19 - - length: 1362 - rva: 1299832 - offset: 1282424 + - length: 0x552 + rva: 0x13d578 + offset: 0x139178 type: RESOURCE_TYPE_STRING id: 4072 language: 19 - - length: 2130 - rva: 1301196 - offset: 1283788 + - length: 0x852 + rva: 0x13dacc + offset: 0x1396cc type: RESOURCE_TYPE_STRING id: 4073 language: 19 - - length: 2366 - rva: 1303328 - offset: 1285920 + - length: 0x93e + rva: 0x13e320 + offset: 0x139f20 type: RESOURCE_TYPE_STRING id: 4074 language: 19 - - length: 1862 - rva: 1305696 - offset: 1288288 + - length: 0x746 + rva: 0x13ec60 + offset: 0x13a860 type: RESOURCE_TYPE_STRING id: 4075 language: 19 - - length: 2104 - rva: 1307560 - offset: 1290152 + - length: 0x838 + rva: 0x13f3a8 + offset: 0x13afa8 type: RESOURCE_TYPE_STRING id: 4076 language: 19 - - length: 2604 - rva: 1309664 - offset: 1292256 + - length: 0xa2c + rva: 0x13fbe0 + offset: 0x13b7e0 type: RESOURCE_TYPE_STRING id: 4077 language: 19 - - length: 2172 - rva: 1312268 - offset: 1294860 + - length: 0x87c + rva: 0x14060c + offset: 0x13c20c type: RESOURCE_TYPE_STRING id: 4078 language: 19 - - length: 684 - rva: 1314440 - offset: 1297032 + - length: 0x2ac + rva: 0x140e88 + offset: 0x13ca88 type: RESOURCE_TYPE_STRING id: 4079 language: 19 - - length: 328 - rva: 1315124 - offset: 1297716 + - length: 0x148 + rva: 0x141134 + offset: 0x13cd34 type: RESOURCE_TYPE_STRING id: 4080 language: 19 - - length: 330 - rva: 1315452 - offset: 1298044 + - length: 0x14a + rva: 0x14127c + offset: 0x13ce7c type: RESOURCE_TYPE_STRING id: 4081 language: 19 - - length: 1242 - rva: 1315784 - offset: 1298376 + - length: 0x4da + rva: 0x1413c8 + offset: 0x13cfc8 type: RESOURCE_TYPE_STRING id: 4082 language: 19 - - length: 716 - rva: 1317028 - offset: 1299620 + - length: 0x2cc + rva: 0x1418a4 + offset: 0x13d4a4 type: RESOURCE_TYPE_STRING id: 4083 language: 19 - - length: 1102 - rva: 1317744 - offset: 1300336 + - length: 0x44e + rva: 0x141b70 + offset: 0x13d770 type: RESOURCE_TYPE_STRING id: 4084 language: 19 - - length: 1580 - rva: 1318848 - offset: 1301440 + - length: 0x62c + rva: 0x141fc0 + offset: 0x13dbc0 type: RESOURCE_TYPE_STRING id: 4085 language: 19 - - length: 1054 - rva: 1320428 - offset: 1303020 + - length: 0x41e + rva: 0x1425ec + offset: 0x13e1ec type: RESOURCE_TYPE_STRING id: 4086 language: 19 - - length: 806 - rva: 1321484 - offset: 1304076 + - length: 0x326 + rva: 0x142a0c + offset: 0x13e60c type: RESOURCE_TYPE_STRING id: 4087 language: 19 - - length: 832 - rva: 1322292 - offset: 1304884 + - length: 0x340 + rva: 0x142d34 + offset: 0x13e934 type: RESOURCE_TYPE_STRING id: 4088 language: 19 - - length: 970 - rva: 1323124 - offset: 1305716 + - length: 0x3ca + rva: 0x143074 + offset: 0x13ec74 type: RESOURCE_TYPE_STRING id: 4089 language: 19 - - length: 510 - rva: 1324096 - offset: 1306688 + - length: 0x1fe + rva: 0x143440 + offset: 0x13f040 type: RESOURCE_TYPE_STRING id: 4090 language: 19 - - length: 196 - rva: 1324608 - offset: 1307200 + - length: 0xc4 + rva: 0x143640 + offset: 0x13f240 type: RESOURCE_TYPE_STRING id: 4091 language: 19 - - length: 366 - rva: 1324804 - offset: 1307396 + - length: 0x16e + rva: 0x143704 + offset: 0x13f304 type: RESOURCE_TYPE_STRING id: 4092 language: 19 - - length: 862 - rva: 1325172 - offset: 1307764 + - length: 0x35e + rva: 0x143874 + offset: 0x13f474 type: RESOURCE_TYPE_STRING id: 4093 language: 19 - - length: 1082 - rva: 1326036 - offset: 1308628 + - length: 0x43a + rva: 0x143bd4 + offset: 0x13f7d4 type: RESOURCE_TYPE_STRING id: 4094 language: 19 - - length: 872 - rva: 1327120 - offset: 1309712 + - length: 0x368 + rva: 0x144010 + offset: 0x13fc10 type: RESOURCE_TYPE_STRING id: 4095 language: 19 - - length: 758 - rva: 1327992 - offset: 1310584 + - length: 0x2f6 + rva: 0x144378 + offset: 0x13ff78 type: RESOURCE_TYPE_STRING id: 4096 language: 19 - - length: 3634 - rva: 1328752 - offset: 1311344 + - length: 0xe32 + rva: 0x144670 + offset: 0x140270 type: RESOURCE_TYPE_RCDATA language: 19 name_string: "A\x00C\x00R\x00_\x00T\x00O\x00K\x00E\x00N\x00_\x00M\x00A\x00P\x00P\x00I\x00N\x00G\x00" - - length: 16 - rva: 1332388 - offset: 1314980 + - length: 0x10 + rva: 0x1454a4 + offset: 0x1410a4 type: RESOURCE_TYPE_RCDATA language: 19 name_string: "D\x00V\x00C\x00L\x00A\x00L\x00" - - length: 17960 - rva: 1332404 - offset: 1314996 + - length: 0x4628 + rva: 0x1454b4 + offset: 0x1410b4 type: RESOURCE_TYPE_RCDATA language: 19 name_string: "P\x00A\x00C\x00K\x00A\x00G\x00E\x00I\x00N\x00F\x00O\x00" - - length: 24464 - rva: 1350364 - offset: 1332956 + - length: 0x5f90 + rva: 0x149adc + offset: 0x1456dc type: RESOURCE_TYPE_RCDATA language: 19 name_string: "T\x00F\x00R\x00M\x00C\x00O\x00O\x00K\x00I\x00E\x00M\x00G\x00R\x00" - - length: 17627 - rva: 1374828 - offset: 1357420 + - length: 0x44db + rva: 0x14fa6c + offset: 0x14b66c type: RESOURCE_TYPE_RCDATA language: 19 name_string: "T\x00F\x00R\x00M\x00D\x00E\x00F\x00R\x00A\x00G\x00A\x00N\x00A\x00L\x00Y\x00S\x00I\x00S\x00R\x00E\x00P\x00O\x00R\x00T\x00" - - length: 1310 - rva: 1392456 - offset: 1375048 + - length: 0x51e + rva: 0x153f48 + offset: 0x14fb48 type: RESOURCE_TYPE_RCDATA language: 19 name_string: "T\x00F\x00R\x00M\x00D\x00E\x00F\x00R\x00A\x00G\x00A\x00N\x00A\x00L\x00Y\x00Z\x00E\x00P\x00R\x00O\x00G\x00R\x00E\x00S\x00S\x00" - - length: 52684 - rva: 1393768 - offset: 1376360 + - length: 0xcdcc + rva: 0x154468 + offset: 0x150068 type: RESOURCE_TYPE_RCDATA language: 19 name_string: "T\x00F\x00R\x00M\x00D\x00E\x00F\x00R\x00A\x00G\x00R\x00E\x00P\x00O\x00R\x00T\x00" - - length: 12841 - rva: 1446452 - offset: 1429044 + - length: 0x3229 + rva: 0x161234 + offset: 0x15ce34 type: RESOURCE_TYPE_RCDATA language: 19 name_string: "T\x00F\x00R\x00M\x00H\x00P\x00A\x00N\x00A\x00L\x00Y\x00S\x00I\x00S\x00P\x00R\x00O\x00G\x00R\x00E\x00S\x00S\x00" - - length: 3238 - rva: 1459296 - offset: 1441888 + - length: 0xca6 + rva: 0x164460 + offset: 0x160060 type: RESOURCE_TYPE_RCDATA language: 19 name_string: "T\x00F\x00R\x00M\x00O\x00P\x00T\x00I\x00M\x00I\x00Z\x00A\x00T\x00I\x00O\x00N\x00D\x00E\x00T\x00A\x00I\x00L\x00S\x00" - - length: 4448 - rva: 1462536 - offset: 1445128 + - length: 0x1160 + rva: 0x165108 + offset: 0x160d08 type: RESOURCE_TYPE_RCDATA language: 19 name_string: "T\x00F\x00R\x00M\x00R\x00B\x00T\x00O\x00I\x00N\x00C\x00I\x00N\x00" - - length: 5950 - rva: 1466984 - offset: 1449576 + - length: 0x173e + rva: 0x166268 + offset: 0x161e68 type: RESOURCE_TYPE_RCDATA language: 19 name_string: "T\x00F\x00R\x00M\x00R\x00E\x00P\x00A\x00I\x00R\x00C\x00O\x00N\x00F\x00I\x00R\x00M\x00" - - length: 2633 - rva: 1472936 - offset: 1455528 + - length: 0xa49 + rva: 0x1679a8 + offset: 0x1635a8 type: RESOURCE_TYPE_RCDATA language: 19 name_string: "T\x00F\x00R\x00M\x00R\x00E\x00P\x00A\x00I\x00R\x00P\x00R\x00O\x00G\x00R\x00E\x00S\x00S\x00" - - length: 38533 - rva: 1475572 - offset: 1458164 + - length: 0x9685 + rva: 0x1683f4 + offset: 0x163ff4 type: RESOURCE_TYPE_RCDATA language: 19 name_string: "T\x00F\x00R\x00M\x00R\x00E\x00P\x00A\x00I\x00R\x00P\x00R\x00O\x00G\x00R\x00E\x00S\x00S\x00M\x00U\x00L\x00T\x00I\x00" - - length: 171028 - rva: 1514108 - offset: 1496700 + - length: 0x29c14 + rva: 0x171a7c + offset: 0x16d67c type: RESOURCE_TYPE_RCDATA language: 19 name_string: "T\x00F\x00R\x00M\x00S\x00C\x00H\x00E\x00D\x00U\x00L\x00E\x00D\x00M\x00A\x00I\x00N\x00T\x00E\x00N\x00A\x00N\x00C\x00E\x00P\x00R\x00O\x00G\x00R\x00E\x00S\x00S\x00" - - length: 2340 - rva: 1685136 - offset: 1667728 + - length: 0x924 + rva: 0x19b690 + offset: 0x197290 type: RESOURCE_TYPE_RCDATA language: 19 name_string: "T\x00F\x00R\x00M\x00S\x00E\x00C\x00O\x00P\x00T\x00E\x00X\x00E\x00F\x00T\x00Y\x00P\x00E\x00C\x00O\x00N\x00F\x00I\x00G\x00" - - length: 1138 - rva: 1687476 - offset: 1670068 + - length: 0x472 + rva: 0x19bfb4 + offset: 0x197bb4 type: RESOURCE_TYPE_RCDATA language: 19 name_string: "T\x00F\x00R\x00M\x00S\x00E\x00C\x00O\x00P\x00T\x00R\x00E\x00P\x00A\x00I\x00R\x00" - - length: 3618 - rva: 1688616 - offset: 1671208 + - length: 0xe22 + rva: 0x19c428 + offset: 0x198028 type: RESOURCE_TYPE_RCDATA language: 19 name_string: "T\x00F\x00R\x00M\x00S\x00E\x00C\x00O\x00P\x00T\x00S\x00Y\x00N\x00A\x00T\x00T\x00A\x00C\x00K\x00C\x00O\x00N\x00F\x00I\x00G\x00" - - length: 1249 - rva: 1692236 - offset: 1674828 + - length: 0x4e1 + rva: 0x19d24c + offset: 0x198e4c type: RESOURCE_TYPE_RCDATA language: 19 name_string: "T\x00F\x00R\x00M\x00U\x00N\x00D\x00O\x00A\x00R\x00C\x00H\x00P\x00R\x00O\x00G\x00R\x00E\x00S\x00S\x00" - - length: 5489 - rva: 1693488 - offset: 1676080 + - length: 0x1571 + rva: 0x19d730 + offset: 0x199330 type: RESOURCE_TYPE_RCDATA language: 19 name_string: "T\x00F\x00R\x00M\x00U\x00P\x00D\x00A\x00T\x00E\x00C\x00H\x00E\x00C\x00K\x00" - - length: 891 - rva: 1698980 - offset: 1681572 + - length: 0x37b + rva: 0x19eca4 + offset: 0x19a8a4 type: RESOURCE_TYPE_RCDATA language: 19 name_string: "T\x00F\x00R\x00M\x00U\x00P\x00D\x00A\x00T\x00E\x00F\x00A\x00I\x00L\x00E\x00D\x00" - - length: 2727 - rva: 1699872 - offset: 1682464 + - length: 0xaa7 + rva: 0x19f020 + offset: 0x19ac20 type: RESOURCE_TYPE_RCDATA language: 19 name_string: "T\x00M\x00A\x00D\x00E\x00X\x00C\x00E\x00P\x00T\x00" - - length: 307 - rva: 1702600 - offset: 1685192 + - length: 0x133 + rva: 0x19fac8 + offset: 0x19b6c8 type: RESOURCE_TYPE_RCDATA language: 19 name_string: "T\x00M\x00A\x00I\x00N\x00F\x00O\x00R\x00M\x00" - - length: 780 - rva: 1702908 - offset: 1685500 + - length: 0x30c + rva: 0x19fbfc + offset: 0x19b7fc type: RESOURCE_TYPE_RCDATA language: 19 name_string: "T\x00M\x00E\x00C\x00O\x00N\x00T\x00A\x00C\x00T\x00F\x00O\x00R\x00M\x00" - - length: 513 - rva: 1703688 - offset: 1686280 + - length: 0x201 + rva: 0x19ff08 + offset: 0x19bb08 type: RESOURCE_TYPE_RCDATA language: 19 name_string: "T\x00M\x00E\x00D\x00E\x00T\x00A\x00I\x00L\x00S\x00F\x00O\x00R\x00M\x00" - - length: 628 - rva: 1704204 - offset: 1686796 + - length: 0x274 + rva: 0x1a010c + offset: 0x19bd0c type: RESOURCE_TYPE_RCDATA language: 19 name_string: "T\x00M\x00E\x00S\x00C\x00R\x00S\x00H\x00O\x00T\x00F\x00O\x00R\x00M\x00" - - length: 3007 - rva: 1704832 - offset: 1687424 + - length: 0xbbf + rva: 0x1a0380 + offset: 0x19bf80 type: RESOURCE_TYPE_RCDATA language: 19 name_string: "X\x00S\x00L\x00" - - length: 20 - rva: 1707840 - offset: 1690432 + - length: 0x14 + rva: 0x1a0f40 + offset: 0x19cb40 type: RESOURCE_TYPE_GROUP_CURSOR language: 19 name_string: "J\x00V\x00D\x00R\x00A\x00G\x00C\x00U\x00R\x00S\x00O\x00R\x00" - - length: 20 - rva: 1707860 - offset: 1690452 + - length: 0x14 + rva: 0x1a0f54 + offset: 0x19cb54 type: RESOURCE_TYPE_GROUP_CURSOR language: 19 name_string: "J\x00V\x00H\x00A\x00N\x00D\x00C\x00U\x00R\x00S\x00O\x00R\x00" - - length: 20 - rva: 1707880 - offset: 1690472 + - length: 0x14 + rva: 0x1a0f68 + offset: 0x19cb68 type: RESOURCE_TYPE_GROUP_CURSOR language: 19 name_string: "V\x00T\x00_\x00H\x00E\x00A\x00D\x00E\x00R\x00S\x00P\x00L\x00I\x00T\x00" - - length: 20 - rva: 1707900 - offset: 1690492 + - length: 0x14 + rva: 0x1a0f7c + offset: 0x19cb7c type: RESOURCE_TYPE_GROUP_CURSOR language: 19 name_string: "V\x00T\x00_\x00M\x00O\x00V\x00E\x00A\x00L\x00L\x00" - - length: 20 - rva: 1707920 - offset: 1690512 + - length: 0x14 + rva: 0x1a0f90 + offset: 0x19cb90 type: RESOURCE_TYPE_GROUP_CURSOR language: 19 name_string: "V\x00T\x00_\x00M\x00O\x00V\x00E\x00E\x00" - - length: 20 - rva: 1707940 - offset: 1690532 + - length: 0x14 + rva: 0x1a0fa4 + offset: 0x19cba4 type: RESOURCE_TYPE_GROUP_CURSOR language: 19 name_string: "V\x00T\x00_\x00M\x00O\x00V\x00E\x00E\x00W\x00" - - length: 20 - rva: 1707960 - offset: 1690552 + - length: 0x14 + rva: 0x1a0fb8 + offset: 0x19cbb8 type: RESOURCE_TYPE_GROUP_CURSOR language: 19 name_string: "V\x00T\x00_\x00M\x00O\x00V\x00E\x00N\x00" - - length: 20 - rva: 1707980 - offset: 1690572 + - length: 0x14 + rva: 0x1a0fcc + offset: 0x19cbcc type: RESOURCE_TYPE_GROUP_CURSOR language: 19 name_string: "V\x00T\x00_\x00M\x00O\x00V\x00E\x00N\x00E\x00" - - length: 20 - rva: 1708000 - offset: 1690592 + - length: 0x14 + rva: 0x1a0fe0 + offset: 0x19cbe0 type: RESOURCE_TYPE_GROUP_CURSOR language: 19 name_string: "V\x00T\x00_\x00M\x00O\x00V\x00E\x00N\x00S\x00" - - length: 20 - rva: 1708020 - offset: 1690612 + - length: 0x14 + rva: 0x1a0ff4 + offset: 0x19cbf4 type: RESOURCE_TYPE_GROUP_CURSOR language: 19 name_string: "V\x00T\x00_\x00M\x00O\x00V\x00E\x00N\x00W\x00" - - length: 20 - rva: 1708040 - offset: 1690632 + - length: 0x14 + rva: 0x1a1008 + offset: 0x19cc08 type: RESOURCE_TYPE_GROUP_CURSOR language: 19 name_string: "V\x00T\x00_\x00M\x00O\x00V\x00E\x00S\x00" - - length: 20 - rva: 1708060 - offset: 1690652 + - length: 0x14 + rva: 0x1a101c + offset: 0x19cc1c type: RESOURCE_TYPE_GROUP_CURSOR language: 19 name_string: "V\x00T\x00_\x00M\x00O\x00V\x00E\x00S\x00E\x00" - - length: 20 - rva: 1708080 - offset: 1690672 + - length: 0x14 + rva: 0x1a1030 + offset: 0x19cc30 type: RESOURCE_TYPE_GROUP_CURSOR language: 19 name_string: "V\x00T\x00_\x00M\x00O\x00V\x00E\x00S\x00W\x00" - - length: 20 - rva: 1708100 - offset: 1690692 + - length: 0x14 + rva: 0x1a1044 + offset: 0x19cc44 type: RESOURCE_TYPE_GROUP_CURSOR language: 19 name_string: "V\x00T\x00_\x00M\x00O\x00V\x00E\x00W\x00" - - length: 20 - rva: 1708120 - offset: 1690712 + - length: 0x14 + rva: 0x1a1058 + offset: 0x19cc58 type: RESOURCE_TYPE_GROUP_CURSOR id: 32761 language: 19 - - length: 20 - rva: 1708140 - offset: 1690732 + - length: 0x14 + rva: 0x1a106c + offset: 0x19cc6c type: RESOURCE_TYPE_GROUP_CURSOR id: 32762 language: 19 - - length: 20 - rva: 1708160 - offset: 1690752 + - length: 0x14 + rva: 0x1a1080 + offset: 0x19cc80 type: RESOURCE_TYPE_GROUP_CURSOR id: 32763 language: 19 - - length: 20 - rva: 1708180 - offset: 1690772 + - length: 0x14 + rva: 0x1a1094 + offset: 0x19cc94 type: RESOURCE_TYPE_GROUP_CURSOR id: 32764 language: 19 - - length: 20 - rva: 1708200 - offset: 1690792 + - length: 0x14 + rva: 0x1a10a8 + offset: 0x19cca8 type: RESOURCE_TYPE_GROUP_CURSOR id: 32765 language: 19 - - length: 20 - rva: 1708220 - offset: 1690812 + - length: 0x14 + rva: 0x1a10bc + offset: 0x19ccbc type: RESOURCE_TYPE_GROUP_CURSOR id: 32766 language: 19 - - length: 20 - rva: 1708240 - offset: 1690832 + - length: 0x14 + rva: 0x1a10d0 + offset: 0x19ccd0 type: RESOURCE_TYPE_GROUP_CURSOR id: 32767 language: 19 - - length: 20 - rva: 1708260 - offset: 1690852 + - length: 0x14 + rva: 0x1a10e4 + offset: 0x19cce4 type: RESOURCE_TYPE_GROUP_ICON language: 19 name_string: "M\x00A\x00I\x00N\x00I\x00C\x00O\x00N\x00" - - length: 800 - rva: 1708280 - offset: 1690872 + - length: 0x320 + rva: 0x1a10f8 + offset: 0x19ccf8 type: RESOURCE_TYPE_VERSION id: 1 language: 19 - - length: 1721 - rva: 1709080 - offset: 1691672 + - length: 0x6b9 + rva: 0x1a1418 + offset: 0x19d018 type: RESOURCE_TYPE_MANIFEST id: 1 language: 19 @@ -2708,67 +2708,67 @@ import_details: number_of_functions: 15 functions: - name: "DeleteCriticalSection" - rva: 16484 + rva: 0x4064 - name: "LeaveCriticalSection" - rva: 16488 + rva: 0x4068 - name: "EnterCriticalSection" - rva: 16492 + rva: 0x406c - name: "VirtualFree" - rva: 16496 + rva: 0x4070 - name: "LocalFree" - rva: 16500 + rva: 0x4074 - name: "GetCurrentThreadId" - rva: 16504 + rva: 0x4078 - name: "GetStartupInfoA" - rva: 16508 + rva: 0x407c - name: "GetCommandLineA" - rva: 16512 + rva: 0x4080 - name: "FreeLibrary" - rva: 16516 + rva: 0x4084 - name: "ExitProcess" - rva: 16520 + rva: 0x4088 - name: "WriteFile" - rva: 16524 + rva: 0x408c - name: "UnhandledExceptionFilter" - rva: 16528 + rva: 0x4090 - name: "RtlUnwind" - rva: 16532 + rva: 0x4094 - name: "RaiseException" - rva: 16536 + rva: 0x4098 - name: "GetStdHandle" - rva: 16540 + rva: 0x409c - library_name: "user32.dll" number_of_functions: 2 functions: - name: "GetKeyboardType" - rva: 16548 + rva: 0x40a4 - name: "MessageBoxA" - rva: 16552 + rva: 0x40a8 - library_name: "advapi32.dll" number_of_functions: 3 functions: - name: "RegQueryValueExA" - rva: 16560 + rva: 0x40b0 - name: "RegOpenKeyExA" - rva: 16564 + rva: 0x40b4 - name: "RegCloseKey" - rva: 16568 + rva: 0x40b8 - library_name: "kernel32.dll" number_of_functions: 6 functions: - name: "TlsSetValue" - rva: 16576 + rva: 0x40c0 - name: "TlsGetValue" - rva: 16580 + rva: 0x40c4 - name: "TlsFree" - rva: 16584 + rva: 0x40c8 - name: "TlsAlloc" - rva: 16588 + rva: 0x40cc - name: "LocalFree" - rva: 16592 + rva: 0x40d0 - name: "LocalAlloc" - rva: 16596 + rva: 0x40d4 is_signed: false overlay: - offset: 0 - size: 0 \ No newline at end of file + offset: 0x0 + size: 0x0 \ No newline at end of file diff --git a/lib/src/modules/pe/tests/testdata/8daffcac250ed6927e3d600e6bf14ea1d38dd6237f95222e6582495108b63971.out b/lib/src/modules/pe/tests/testdata/8daffcac250ed6927e3d600e6bf14ea1d38dd6237f95222e6582495108b63971.out index 2f5b3dc46..3945ea1a8 100644 --- a/lib/src/modules/pe/tests/testdata/8daffcac250ed6927e3d600e6bf14ea1d38dd6237f95222e6582495108b63971.out +++ b/lib/src/modules/pe/tests/testdata/8daffcac250ed6927e3d600e6bf14ea1d38dd6237f95222e6582495108b63971.out @@ -17,26 +17,26 @@ opthdr_magic: IMAGE_NT_OPTIONAL_HDR32_MAGIC characteristics: 0x10f # RELOCS_STRIPPED | EXECUTABLE_IMAGE | LINE_NUMS_STRIPPED | LOCAL_SYMS_STRIPPED | MACHINE_32BIT dll_characteristics: 0x0 timestamp: 1074384164 # 2004-01-18 00:02:44 UTC -image_base: 4194304 +image_base: 0x400000 checksum: 0 -base_of_code: 4096 -base_of_data: 53248 -entry_point: 26948 -entry_point_raw: 26948 -section_alignment: 4096 -file_alignment: 4096 -loader_flags: 0 -size_of_optional_header: 224 -size_of_code: 49152 -size_of_initialized_data: 28672 -size_of_uninitialized_data: 0 -size_of_image: 90112 -size_of_headers: 4096 -size_of_stack_reserve: 1048576 -size_of_stack_commit: 4096 -size_of_heap_reserve: 1048576 -size_of_heap_commit: 4096 -pointer_to_symbol_table: 0 +base_of_code: 0x1000 +base_of_data: 0xd000 +entry_point: 0x6944 +entry_point_raw: 0x6944 +section_alignment: 0x1000 +file_alignment: 0x1000 +loader_flags: 0x0 +size_of_optional_header: 0xe0 +size_of_code: 0xc000 +size_of_initialized_data: 0x7000 +size_of_uninitialized_data: 0x0 +size_of_image: 0x16000 +size_of_headers: 0x1000 +size_of_stack_reserve: 0x100000 +size_of_stack_commit: 0x1000 +size_of_heap_reserve: 0x100000 +size_of_heap_commit: 0x1000 +pointer_to_symbol_table: 0x0 win32_version_value: 0 number_of_symbols: 0 number_of_rva_and_sizes: 16 @@ -88,8 +88,8 @@ version_info_list: - key: "SpecialBuild" value: "" rich_signature: - offset: 128 - length: 88 + offset: 0x80 + length: 0x58 key: 326150311 raw_data: "\xe3\xc9\x1e@\xa7\xa8p\x13\xa7\xa8p\x13\xa7\xa8p\x13]\x8bi\x13\xa5\xa8p\x13\xa2\xa4\x7f\x13\xb3\xa8p\x13\xa2\xa4/\x13\xc2\xa8p\x13\xb4\xa0-\x13\xa5\xa8p\x13$\xa0-\x13\xa2\xa8p\x13\xa7\xa8q\x13\xc8\xa8p\x13\xa2\xa4\x10\x13\xa0\xa8p\x13K\xa3.\x13\xa6\xa8p\x13\xa2\xa4*\x13\xa6\xa8p\x13" clear_data: "DanS\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xfa#\x19\x00\x02\x00\x00\x00\x05\x0c\x0f\x00\x14\x00\x00\x00\x05\x0c_\x00e\x00\x00\x00\x13\x08]\x00\x02\x00\x00\x00\x83\x08]\x00\x05\x00\x00\x00\x00\x00\x01\x00o\x00\x00\x00\x05\x0c`\x00\x07\x00\x00\x00\xec\x0b^\x00\x01\x00\x00\x00\x05\x0cZ\x00\x01\x00\x00\x00" @@ -124,113 +124,113 @@ rich_signature: sections: - name: ".text" full_name: ".text" - characteristics: 1610612768 - raw_data_size: 49152 - raw_data_offset: 4096 - virtual_address: 4096 - virtual_size: 46980 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0x60000020 # SECTION_MEM_READ | SECTION_MEM_WRITE | SECTION_SCALE_INDEX + raw_data_size: 0xc000 + raw_data_offset: 0x1000 + virtual_address: 0x1000 + virtual_size: 0xb784 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".rdata" full_name: ".rdata" - characteristics: 1073741888 - raw_data_size: 12288 - raw_data_offset: 53248 - virtual_address: 53248 - virtual_size: 11244 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0x40000040 + raw_data_size: 0x3000 + raw_data_offset: 0xd000 + virtual_address: 0xd000 + virtual_size: 0x2bec + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".data" full_name: ".data" - characteristics: 3221225536 - raw_data_size: 8192 - raw_data_offset: 65536 - virtual_address: 65536 - virtual_size: 13848 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0xc0000040 + raw_data_size: 0x2000 + raw_data_offset: 0x10000 + virtual_address: 0x10000 + virtual_size: 0x3618 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".rsrc" full_name: ".rsrc" - characteristics: 1073741888 - raw_data_size: 8192 - raw_data_offset: 73728 - virtual_address: 81920 - virtual_size: 7168 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0x40000040 + raw_data_size: 0x2000 + raw_data_offset: 0x12000 + virtual_address: 0x14000 + virtual_size: 0x1c00 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 data_directories: - - virtual_address: 0 - size: 0 - - virtual_address: 62280 - size: 100 - - virtual_address: 81920 - size: 7168 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 62184 - size: 72 - - virtual_address: 0 - size: 0 - - virtual_address: 53248 - size: 404 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0xf348 + size: 0x64 + - virtual_address: 0x14000 + size: 0x1c00 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0xf2e8 + size: 0x48 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0xd000 + size: 0x194 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 resource_timestamp: 0 # 1970-01-01 00:00:00 UTC resource_version: major: 4 minor: 0 resources: - - length: 3640 - rva: 82272 - offset: 74080 + - length: 0xe38 + rva: 0x14160 + offset: 0x12160 type: RESOURCE_TYPE_BITMAP id: 104 language: 1033 - - length: 120 - rva: 85912 - offset: 77720 + - length: 0x78 + rva: 0x14f98 + offset: 0x12f98 type: RESOURCE_TYPE_BITMAP id: 105 language: 1033 - - length: 2216 - rva: 86032 - offset: 77840 + - length: 0x8a8 + rva: 0x15010 + offset: 0x13010 type: RESOURCE_TYPE_ICON id: 1 language: 1033 - - length: 20 - rva: 88248 - offset: 80056 + - length: 0x14 + rva: 0x158b8 + offset: 0x138b8 type: RESOURCE_TYPE_GROUP_ICON id: 103 language: 1033 - - length: 820 - rva: 88268 - offset: 80076 + - length: 0x334 + rva: 0x158cc + offset: 0x138cc type: RESOURCE_TYPE_VERSION id: 1 language: 1033 @@ -239,209 +239,209 @@ import_details: number_of_functions: 81 functions: - name: "VirtualFree" - rva: 53280 + rva: 0xd020 - name: "VirtualAlloc" - rva: 53284 + rva: 0xd024 - name: "RemoveDirectoryA" - rva: 53288 + rva: 0xd028 - name: "FindClose" - rva: 53292 + rva: 0xd02c - name: "FindNextFileA" - rva: 53296 + rva: 0xd030 - name: "DeleteFileA" - rva: 53300 + rva: 0xd034 - name: "FindFirstFileA" - rva: 53304 + rva: 0xd038 - name: "WriteFile" - rva: 53308 + rva: 0xd03c - name: "MulDiv" - rva: 53312 + rva: 0xd040 - name: "WaitForSingleObject" - rva: 53316 + rva: 0xd044 - name: "CreateProcessA" - rva: 53320 + rva: 0xd048 - name: "SetFileAttributesA" - rva: 53324 + rva: 0xd04c - name: "SetFileTime" - rva: 53328 + rva: 0xd050 - name: "GetFileSize" - rva: 53332 + rva: 0xd054 - name: "CreateDirectoryA" - rva: 53336 + rva: 0xd058 - name: "GetTempFileNameA" - rva: 53340 + rva: 0xd05c - name: "GetTempPathA" - rva: 53344 + rva: 0xd060 - name: "GetModuleFileNameA" - rva: 53348 + rva: 0xd064 - name: "GetSystemInfo" - rva: 53352 + rva: 0xd068 - name: "VirtualProtect" - rva: 53356 + rva: 0xd06c - name: "FlushFileBuffers" - rva: 53360 + rva: 0xd070 - name: "SetFilePointer" - rva: 53364 + rva: 0xd074 - name: "SetEndOfFile" - rva: 53368 + rva: 0xd078 - name: "CreateFileMappingA" - rva: 53372 + rva: 0xd07c - name: "MapViewOfFile" - rva: 53376 + rva: 0xd080 - name: "UnmapViewOfFile" - rva: 53380 + rva: 0xd084 - name: "CloseHandle" - rva: 53384 + rva: 0xd088 - name: "ReadFile" - rva: 53388 + rva: 0xd08c - name: "CreateFileA" - rva: 53392 + rva: 0xd090 - name: "GetLocaleInfoA" - rva: 53396 + rva: 0xd094 - name: "GetModuleHandleA" - rva: 53400 + rva: 0xd098 - name: "GetStartupInfoA" - rva: 53404 + rva: 0xd09c - name: "GetCommandLineA" - rva: 53408 + rva: 0xd0a0 - name: "GetVersionExA" - rva: 53412 + rva: 0xd0a4 - name: "HeapAlloc" - rva: 53416 + rva: 0xd0a8 - name: "HeapFree" - rva: 53420 + rva: 0xd0ac - name: "ExitProcess" - rva: 53424 + rva: 0xd0b0 - name: "GetProcAddress" - rva: 53428 + rva: 0xd0b4 - name: "TerminateProcess" - rva: 53432 + rva: 0xd0b8 - name: "GetCurrentProcess" - rva: 53436 + rva: 0xd0bc - name: "GetStdHandle" - rva: 53440 + rva: 0xd0c0 - name: "UnhandledExceptionFilter" - rva: 53444 + rva: 0xd0c4 - name: "FreeEnvironmentStringsA" - rva: 53448 + rva: 0xd0c8 - name: "GetEnvironmentStrings" - rva: 53452 + rva: 0xd0cc - name: "FreeEnvironmentStringsW" - rva: 53456 + rva: 0xd0d0 - name: "WideCharToMultiByte" - rva: 53460 + rva: 0xd0d4 - name: "GetLastError" - rva: 53464 + rva: 0xd0d8 - name: "GetEnvironmentStringsW" - rva: 53468 + rva: 0xd0dc - name: "SetHandleCount" - rva: 53472 + rva: 0xd0e0 - name: "GetFileType" - rva: 53476 + rva: 0xd0e4 - name: "DeleteCriticalSection" - rva: 53480 + rva: 0xd0e8 - name: "TlsAlloc" - rva: 53484 + rva: 0xd0ec - name: "SetLastError" - rva: 53488 + rva: 0xd0f0 - name: "GetCurrentThreadId" - rva: 53492 + rva: 0xd0f4 - name: "TlsFree" - rva: 53496 + rva: 0xd0f8 - name: "TlsSetValue" - rva: 53500 + rva: 0xd0fc - name: "TlsGetValue" - rva: 53504 + rva: 0xd100 - name: "HeapDestroy" - rva: 53508 + rva: 0xd104 - name: "HeapCreate" - rva: 53512 + rva: 0xd108 - name: "LeaveCriticalSection" - rva: 53516 + rva: 0xd10c - name: "EnterCriticalSection" - rva: 53520 + rva: 0xd110 - name: "HeapReAlloc" - rva: 53524 + rva: 0xd114 - name: "LoadLibraryA" - rva: 53528 + rva: 0xd118 - name: "GetACP" - rva: 53532 + rva: 0xd11c - name: "GetOEMCP" - rva: 53536 + rva: 0xd120 - name: "GetCPInfo" - rva: 53540 + rva: 0xd124 - name: "InitializeCriticalSection" - rva: 53544 + rva: 0xd128 - name: "RtlUnwind" - rva: 53548 + rva: 0xd12c - name: "InterlockedExchange" - rva: 53552 + rva: 0xd130 - name: "VirtualQuery" - rva: 53556 + rva: 0xd134 - name: "SetStdHandle" - rva: 53560 + rva: 0xd138 - name: "QueryPerformanceCounter" - rva: 53564 + rva: 0xd13c - name: "GetTickCount" - rva: 53568 + rva: 0xd140 - name: "GetCurrentProcessId" - rva: 53572 + rva: 0xd144 - name: "GetSystemTimeAsFileTime" - rva: 53576 + rva: 0xd148 - name: "HeapSize" - rva: 53580 + rva: 0xd14c - name: "LCMapStringA" - rva: 53584 + rva: 0xd150 - name: "MultiByteToWideChar" - rva: 53588 + rva: 0xd154 - name: "LCMapStringW" - rva: 53592 + rva: 0xd158 - name: "GetStringTypeA" - rva: 53596 + rva: 0xd15c - name: "GetStringTypeW" - rva: 53600 + rva: 0xd160 - library_name: "USER32.dll" number_of_functions: 7 functions: - name: "GetDC" - rva: 53620 + rva: 0xd174 - name: "SetCursor" - rva: 53624 + rva: 0xd178 - name: "ReleaseDC" - rva: 53628 + rva: 0xd17c - name: "MessageBoxA" - rva: 53632 + rva: 0xd180 - name: "InvalidateRect" - rva: 53636 + rva: 0xd184 - name: "LoadCursorA" - rva: 53640 + rva: 0xd188 - name: "LoadBitmapA" - rva: 53644 + rva: 0xd18c - library_name: "GDI32.dll" number_of_functions: 7 functions: - name: "SelectObject" - rva: 53248 + rva: 0xd000 - name: "GetDeviceCaps" - rva: 53252 + rva: 0xd004 - name: "BitBlt" - rva: 53256 + rva: 0xd008 - name: "DeleteObject" - rva: 53260 + rva: 0xd00c - name: "DeleteDC" - rva: 53264 + rva: 0xd010 - name: "StretchBlt" - rva: 53268 + rva: 0xd014 - name: "CreateCompatibleDC" - rva: 53272 + rva: 0xd018 - library_name: "SHLWAPI.dll" number_of_functions: 2 functions: - name: "PathRemoveFileSpecA" - rva: 53608 + rva: 0xd168 - name: "PathCombineA" - rva: 53612 + rva: 0xd16c is_signed: false overlay: - offset: 81920 - size: 1102273 \ No newline at end of file + offset: 0x14000 + size: 0x10d1c1 \ No newline at end of file diff --git a/lib/src/modules/pe/tests/testdata/99df28014fae5f213c8decfde423b0eb69005158f981bc84560e9a5dde103d90.out b/lib/src/modules/pe/tests/testdata/99df28014fae5f213c8decfde423b0eb69005158f981bc84560e9a5dde103d90.out index 91ee22966..5695d62fc 100644 --- a/lib/src/modules/pe/tests/testdata/99df28014fae5f213c8decfde423b0eb69005158f981bc84560e9a5dde103d90.out +++ b/lib/src/modules/pe/tests/testdata/99df28014fae5f213c8decfde423b0eb69005158f981bc84560e9a5dde103d90.out @@ -17,26 +17,26 @@ opthdr_magic: IMAGE_NT_OPTIONAL_HDR32_MAGIC characteristics: 0x30f # RELOCS_STRIPPED | EXECUTABLE_IMAGE | LINE_NUMS_STRIPPED | LOCAL_SYMS_STRIPPED | MACHINE_32BIT | DEBUG_STRIPPED dll_characteristics: 0x0 timestamp: 1459377848 # 2016-03-30 22:44:08 UTC -image_base: 4194304 +image_base: 0x400000 checksum: 43228 -base_of_code: 4096 -base_of_data: 12288 -entry_point: 5344 -entry_point_raw: 5344 -section_alignment: 4096 -file_alignment: 4096 -loader_flags: 0 -size_of_optional_header: 224 -size_of_code: 8192 -size_of_initialized_data: 28672 -size_of_uninitialized_data: 4096 -size_of_image: 36864 -size_of_headers: 4096 -size_of_stack_reserve: 2097152 -size_of_stack_commit: 4096 -size_of_heap_reserve: 1048576 -size_of_heap_commit: 4096 -pointer_to_symbol_table: 0 +base_of_code: 0x1000 +base_of_data: 0x3000 +entry_point: 0x14e0 +entry_point_raw: 0x14e0 +section_alignment: 0x1000 +file_alignment: 0x1000 +loader_flags: 0x0 +size_of_optional_header: 0xe0 +size_of_code: 0x2000 +size_of_initialized_data: 0x7000 +size_of_uninitialized_data: 0x1000 +size_of_image: 0x9000 +size_of_headers: 0x1000 +size_of_stack_reserve: 0x200000 +size_of_stack_commit: 0x1000 +size_of_heap_reserve: 0x100000 +size_of_heap_commit: 0x1000 +pointer_to_symbol_table: 0x0 win32_version_value: 0 number_of_symbols: 0 number_of_rva_and_sizes: 16 @@ -52,218 +52,218 @@ number_of_signatures: 0 sections: - name: ".text" full_name: ".text" - characteristics: 1615855712 - raw_data_size: 8192 - raw_data_offset: 4096 - virtual_address: 4096 - virtual_size: 6004 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0x60500060 # SECTION_MEM_READ | SECTION_MEM_WRITE | SECTION_SCALE_INDEX + raw_data_size: 0x2000 + raw_data_offset: 0x1000 + virtual_address: 0x1000 + virtual_size: 0x1774 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".data" full_name: ".data" - characteristics: 3224371264 - raw_data_size: 4096 - raw_data_offset: 12288 - virtual_address: 12288 - virtual_size: 48 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0xc0300040 + raw_data_size: 0x1000 + raw_data_offset: 0x3000 + virtual_address: 0x3000 + virtual_size: 0x30 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".rdata" full_name: ".rdata" - characteristics: 1076887616 - raw_data_size: 4096 - raw_data_offset: 16384 - virtual_address: 16384 - virtual_size: 1360 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0x40300040 + raw_data_size: 0x1000 + raw_data_offset: 0x4000 + virtual_address: 0x4000 + virtual_size: 0x550 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".bss" full_name: ".bss" - characteristics: 3227517056 - raw_data_size: 0 - raw_data_offset: 0 - virtual_address: 20480 - virtual_size: 1024 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0xc0600080 + raw_data_size: 0x0 + raw_data_offset: 0x0 + virtual_address: 0x5000 + virtual_size: 0x400 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".idata" full_name: ".idata" - characteristics: 3224371264 - raw_data_size: 4096 - raw_data_offset: 20480 - virtual_address: 24576 - virtual_size: 1424 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0xc0300040 + raw_data_size: 0x1000 + raw_data_offset: 0x5000 + virtual_address: 0x6000 + virtual_size: 0x590 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".CRT" full_name: ".CRT" - characteristics: 3224371264 - raw_data_size: 4096 - raw_data_offset: 24576 - virtual_address: 28672 - virtual_size: 52 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0xc0300040 + raw_data_size: 0x1000 + raw_data_offset: 0x6000 + virtual_address: 0x7000 + virtual_size: 0x34 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".tls" full_name: ".tls" - characteristics: 3224371264 - raw_data_size: 4096 - raw_data_offset: 28672 - virtual_address: 32768 - virtual_size: 32 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0xc0300040 + raw_data_size: 0x1000 + raw_data_offset: 0x7000 + virtual_address: 0x8000 + virtual_size: 0x20 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 data_directories: - - virtual_address: 0 - size: 0 - - virtual_address: 24576 - size: 1424 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 32772 - size: 24 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 24836 - size: 200 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x6000 + size: 0x590 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x8004 + size: 0x18 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x6104 + size: 0xc8 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 import_details: - library_name: "KERNEL32.dll" number_of_functions: 21 functions: - name: "DeleteCriticalSection" - rva: 24836 + rva: 0x6104 - name: "EnterCriticalSection" - rva: 24840 + rva: 0x6108 - name: "GetCurrentProcess" - rva: 24844 + rva: 0x610c - name: "GetCurrentProcessId" - rva: 24848 + rva: 0x6110 - name: "GetCurrentThreadId" - rva: 24852 + rva: 0x6114 - name: "GetLastError" - rva: 24856 + rva: 0x6118 - name: "GetModuleHandleA" - rva: 24860 + rva: 0x611c - name: "GetProcAddress" - rva: 24864 + rva: 0x6120 - name: "GetStartupInfoA" - rva: 24868 + rva: 0x6124 - name: "GetSystemTimeAsFileTime" - rva: 24872 + rva: 0x6128 - name: "GetTickCount" - rva: 24876 + rva: 0x612c - name: "InitializeCriticalSection" - rva: 24880 + rva: 0x6130 - name: "LeaveCriticalSection" - rva: 24884 + rva: 0x6134 - name: "QueryPerformanceCounter" - rva: 24888 + rva: 0x6138 - name: "SetUnhandledExceptionFilter" - rva: 24892 + rva: 0x613c - name: "Sleep" - rva: 24896 + rva: 0x6140 - name: "TerminateProcess" - rva: 24900 + rva: 0x6144 - name: "TlsGetValue" - rva: 24904 + rva: 0x6148 - name: "UnhandledExceptionFilter" - rva: 24908 + rva: 0x614c - name: "VirtualProtect" - rva: 24912 + rva: 0x6150 - name: "VirtualQuery" - rva: 24916 + rva: 0x6154 - library_name: "msvcrt.dll" number_of_functions: 27 functions: - name: "__dllonexit" - rva: 24924 + rva: 0x615c - name: "__getmainargs" - rva: 24928 + rva: 0x6160 - name: "__initenv" - rva: 24932 + rva: 0x6164 - name: "__lconv_init" - rva: 24936 + rva: 0x6168 - name: "__set_app_type" - rva: 24940 + rva: 0x616c - name: "__setusermatherr" - rva: 24944 + rva: 0x6170 - name: "_acmdln" - rva: 24948 + rva: 0x6174 - name: "_amsg_exit" - rva: 24952 + rva: 0x6178 - name: "_cexit" - rva: 24956 + rva: 0x617c - name: "_fmode" - rva: 24960 + rva: 0x6180 - name: "_initterm" - rva: 24964 + rva: 0x6184 - name: "_iob" - rva: 24968 + rva: 0x6188 - name: "_lock" - rva: 24972 + rva: 0x618c - name: "_onexit" - rva: 24976 + rva: 0x6190 - name: "calloc" - rva: 24980 + rva: 0x6194 - name: "exit" - rva: 24984 + rva: 0x6198 - name: "fprintf" - rva: 24988 + rva: 0x619c - name: "free" - rva: 24992 + rva: 0x61a0 - name: "fwrite" - rva: 24996 + rva: 0x61a4 - name: "malloc" - rva: 25000 + rva: 0x61a8 - name: "memcpy" - rva: 25004 + rva: 0x61ac - name: "signal" - rva: 25008 + rva: 0x61b0 - name: "strlen" - rva: 25012 + rva: 0x61b4 - name: "strncmp" - rva: 25016 + rva: 0x61b8 - name: "_unlock" - rva: 25020 + rva: 0x61bc - name: "abort" - rva: 25024 + rva: 0x61c0 - name: "vfprintf" - rva: 25028 + rva: 0x61c4 is_signed: false overlay: - offset: 32768 - size: 7 \ No newline at end of file + offset: 0x8000 + size: 0x7 \ No newline at end of file diff --git a/lib/src/modules/pe/tests/testdata/9bcf79a99ffbb1bd649503ce1406dea4181f6477cfb61f2130f37d014ce21888.out b/lib/src/modules/pe/tests/testdata/9bcf79a99ffbb1bd649503ce1406dea4181f6477cfb61f2130f37d014ce21888.out index 5ed2bb8be..33d4248a0 100644 --- a/lib/src/modules/pe/tests/testdata/9bcf79a99ffbb1bd649503ce1406dea4181f6477cfb61f2130f37d014ce21888.out +++ b/lib/src/modules/pe/tests/testdata/9bcf79a99ffbb1bd649503ce1406dea4181f6477cfb61f2130f37d014ce21888.out @@ -17,26 +17,26 @@ opthdr_magic: IMAGE_NT_OPTIONAL_HDR32_MAGIC characteristics: 0x2022 # EXECUTABLE_IMAGE | LARGE_ADDRESS_AWARE | DLL dll_characteristics: 0x8540 # DYNAMIC_BASE | NX_COMPAT | NO_SEH | TERMINAL_SERVER_AWARE timestamp: 3435013737 # 2078-11-07 02:28:57 UTC -image_base: 268435456 +image_base: 0x10000000 checksum: 0 -base_of_code: 8192 -base_of_data: 16384 -entry_point: 3058 -entry_point_raw: 10738 -section_alignment: 8192 -file_alignment: 512 -loader_flags: 0 -size_of_optional_header: 224 -size_of_code: 2560 -size_of_initialized_data: 1536 -size_of_uninitialized_data: 0 -size_of_image: 32768 -size_of_headers: 512 -size_of_stack_reserve: 1048576 -size_of_stack_commit: 4096 -size_of_heap_reserve: 1048576 -size_of_heap_commit: 4096 -pointer_to_symbol_table: 0 +base_of_code: 0x2000 +base_of_data: 0x4000 +entry_point: 0xbf2 +entry_point_raw: 0x29f2 +section_alignment: 0x2000 +file_alignment: 0x200 +loader_flags: 0x0 +size_of_optional_header: 0xe0 +size_of_code: 0xa00 +size_of_initialized_data: 0x600 +size_of_uninitialized_data: 0x0 +size_of_image: 0x8000 +size_of_headers: 0x200 +size_of_stack_reserve: 0x100000 +size_of_stack_commit: 0x1000 +size_of_heap_reserve: 0x100000 +size_of_heap_commit: 0x1000 +pointer_to_symbol_table: 0x0 win32_version_value: 0 number_of_symbols: 0 number_of_rva_and_sizes: 16 @@ -76,78 +76,78 @@ pdb_path: "D:\\Unity\\KenShape\\Temp\\UnityEngine.Purchasing.AppleStub.pdb" sections: - name: ".text" full_name: ".text" - characteristics: 1610612768 - raw_data_size: 2560 - raw_data_offset: 512 - virtual_address: 8192 - virtual_size: 2552 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0x60000020 # SECTION_MEM_READ | SECTION_MEM_WRITE | SECTION_SCALE_INDEX + raw_data_size: 0xa00 + raw_data_offset: 0x200 + virtual_address: 0x2000 + virtual_size: 0x9f8 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".rsrc" full_name: ".rsrc" - characteristics: 1073741888 - raw_data_size: 1024 - raw_data_offset: 3072 - virtual_address: 16384 - virtual_size: 776 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0x40000040 + raw_data_size: 0x400 + raw_data_offset: 0xc00 + virtual_address: 0x4000 + virtual_size: 0x308 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".reloc" full_name: ".reloc" - characteristics: 1107296320 - raw_data_size: 512 - raw_data_offset: 4096 - virtual_address: 24576 - virtual_size: 12 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0x42000040 + raw_data_size: 0x200 + raw_data_offset: 0x1000 + virtual_address: 0x6000 + virtual_size: 0xc + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 data_directories: - - virtual_address: 0 - size: 0 - - virtual_address: 10655 - size: 79 - - virtual_address: 16384 - size: 776 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 24576 - size: 12 - - virtual_address: 10448 - size: 84 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 8192 - size: 8 - - virtual_address: 0 - size: 0 - - virtual_address: 8200 - size: 72 - - virtual_address: 0 - size: 0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x299f + size: 0x4f + - virtual_address: 0x4000 + size: 0x308 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x6000 + size: 0xc + - virtual_address: 0x28d0 + size: 0x54 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x2000 + size: 0x8 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x2008 + size: 0x48 + - virtual_address: 0x0 + size: 0x0 resource_timestamp: 0 # 1970-01-01 00:00:00 UTC resource_version: major: 0 minor: 0 resources: - - length: 684 - rva: 16472 - offset: 3160 + - length: 0x2ac + rva: 0x4058 + offset: 0xc58 type: RESOURCE_TYPE_VERSION id: 1 language: 0 @@ -156,8 +156,8 @@ import_details: number_of_functions: 1 functions: - name: "_CorDllMain" - rva: 8192 + rva: 0x2000 is_signed: false overlay: - offset: 0 - size: 0 \ No newline at end of file + offset: 0x0 + size: 0x0 \ No newline at end of file diff --git a/lib/src/modules/pe/tests/testdata/9d8196aa4afce055daa9edb3130efa9e3ddb8b19f6d664e95f8d0e103866ea22.out b/lib/src/modules/pe/tests/testdata/9d8196aa4afce055daa9edb3130efa9e3ddb8b19f6d664e95f8d0e103866ea22.out index 6013a08fc..8c87f4fa5 100644 --- a/lib/src/modules/pe/tests/testdata/9d8196aa4afce055daa9edb3130efa9e3ddb8b19f6d664e95f8d0e103866ea22.out +++ b/lib/src/modules/pe/tests/testdata/9d8196aa4afce055daa9edb3130efa9e3ddb8b19f6d664e95f8d0e103866ea22.out @@ -17,27 +17,27 @@ opthdr_magic: IMAGE_NT_OPTIONAL_HDR64_MAGIC characteristics: 0x2022 # EXECUTABLE_IMAGE | LARGE_ADDRESS_AWARE | DLL dll_characteristics: 0x160 # HIGH_ENTROPY_VA | DYNAMIC_BASE | NX_COMPAT timestamp: 1700014107 # 2023-11-15 02:08:27 UTC -image_base: 65536 +image_base: 0x10000 checksum: 274295 -base_of_code: 4096 -entry_point: 29256 -entry_point_raw: 32328 +base_of_code: 0x1000 +entry_point: 0x7248 +entry_point_raw: 0x7e48 dll_name: "AVEDLL.dll" export_timestamp: 4294967295 # 2106-02-07 06:28:15 UTC -section_alignment: 4096 -file_alignment: 512 -loader_flags: 0 -size_of_optional_header: 240 -size_of_code: 83968 -size_of_initialized_data: 84992 -size_of_uninitialized_data: 0 -size_of_image: 188416 -size_of_headers: 1024 -size_of_stack_reserve: 262144 -size_of_stack_commit: 4096 -size_of_heap_reserve: 1048576 -size_of_heap_commit: 4096 -pointer_to_symbol_table: 0 +section_alignment: 0x1000 +file_alignment: 0x200 +loader_flags: 0x0 +size_of_optional_header: 0xf0 +size_of_code: 0x14800 +size_of_initialized_data: 0x14c00 +size_of_uninitialized_data: 0x0 +size_of_image: 0x2e000 +size_of_headers: 0x400 +size_of_stack_reserve: 0x40000 +size_of_stack_commit: 0x1000 +size_of_heap_reserve: 0x100000 +size_of_heap_commit: 0x1000 +pointer_to_symbol_table: 0x0 win32_version_value: 0 number_of_symbols: 0 number_of_rva_and_sizes: 16 @@ -110,8 +110,8 @@ version_info_list: - key: "UVEASW Version" value: "1.2" rich_signature: - offset: 128 - length: 112 + offset: 0x80 + length: 0x70 key: 1232202501 raw_data: "A\x8a\x1f\x1a\x05\xebqI\x05\xebqI\x05\xebqIV\x94tH\x83\xebqIJ\x97tH$\xebqIJ\x97uH\t\xebqIJ\x97rH\r\xebqIV\x94rH\x03\xebqIV\x94pH\x0e\xebqI\x05\xebpId\xebqIV\x94uH\t\xebqI\xb8\x97xH\x10\xebqI\xb8\x97qH\x04\xebqI\xb8\x97\x8eI\x04\xebqI\xb8\x97sH\x04\xebqI" clear_data: "DanS\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00S\x7f\x05\x01\x86\x00\x00\x00O|\x05\x01!\x00\x00\x00O|\x04\x01\x0c\x00\x00\x00O|\x03\x01\x08\x00\x00\x00S\x7f\x03\x01\x06\x00\x00\x00S\x7f\x01\x01\x0b\x00\x00\x00\x00\x00\x01\x00a\x00\x00\x00S\x7f\x04\x01\x0c\x00\x00\x00\xbd|\t\x01\x15\x00\x00\x00\xbd|\x00\x01\x01\x00\x00\x00\xbd|\xff\x00\x01\x00\x00\x00\xbd|\x02\x01\x01\x00\x00\x00" @@ -156,122 +156,122 @@ pdb_path: "c:\\constructicon\\builds\\gfx\\seven\\23.20\\drivers\\dx\\shared\\mv sections: - name: ".text" full_name: ".text" - characteristics: 1610612768 - raw_data_size: 83968 - raw_data_offset: 1024 - virtual_address: 4096 - virtual_size: 83600 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0x60000020 # SECTION_MEM_READ | SECTION_MEM_WRITE | SECTION_SCALE_INDEX + raw_data_size: 0x14800 + raw_data_offset: 0x400 + virtual_address: 0x1000 + virtual_size: 0x14690 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".rdata" full_name: ".rdata" - characteristics: 1073741888 - raw_data_size: 66048 - raw_data_offset: 84992 - virtual_address: 90112 - virtual_size: 65578 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0x40000040 + raw_data_size: 0x10200 + raw_data_offset: 0x14c00 + virtual_address: 0x16000 + virtual_size: 0x1002a + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".data" full_name: ".data" - characteristics: 3221225536 - raw_data_size: 3072 - raw_data_offset: 151040 - virtual_address: 159744 - virtual_size: 7536 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0xc0000040 + raw_data_size: 0xc00 + raw_data_offset: 0x24e00 + virtual_address: 0x27000 + virtual_size: 0x1d70 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".pdata" full_name: ".pdata" - characteristics: 1073741888 - raw_data_size: 6656 - raw_data_offset: 154112 - virtual_address: 167936 - virtual_size: 6564 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0x40000040 + raw_data_size: 0x1a00 + raw_data_offset: 0x25a00 + virtual_address: 0x29000 + virtual_size: 0x19a4 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: "_RDATA" full_name: "_RDATA" - characteristics: 1073741888 - raw_data_size: 512 - raw_data_offset: 160768 - virtual_address: 176128 - virtual_size: 348 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0x40000040 + raw_data_size: 0x200 + raw_data_offset: 0x27400 + virtual_address: 0x2b000 + virtual_size: 0x15c + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".rsrc" full_name: ".rsrc" - characteristics: 1073741888 - raw_data_size: 2048 - raw_data_offset: 161280 - virtual_address: 180224 - virtual_size: 1912 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0x40000040 + raw_data_size: 0x800 + raw_data_offset: 0x27600 + virtual_address: 0x2c000 + virtual_size: 0x778 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".reloc" full_name: ".reloc" - characteristics: 1107296320 - raw_data_size: 2048 - raw_data_offset: 163328 - virtual_address: 184320 - virtual_size: 1656 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0x42000040 + raw_data_size: 0x800 + raw_data_offset: 0x27e00 + virtual_address: 0x2d000 + virtual_size: 0x678 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 data_directories: - - virtual_address: 130112 - size: 23252 - - virtual_address: 153364 - size: 120 - - virtual_address: 180224 - size: 1912 - - virtual_address: 167936 - size: 6564 - - virtual_address: 165376 - size: 44192 - - virtual_address: 184320 - size: 1656 - - virtual_address: 121536 - size: 112 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 121216 - size: 320 - - virtual_address: 0 - size: 0 - - virtual_address: 90112 - size: 672 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 + - virtual_address: 0x1fc40 + size: 0x5ad4 + - virtual_address: 0x25714 + size: 0x78 + - virtual_address: 0x2c000 + size: 0x778 + - virtual_address: 0x29000 + size: 0x19a4 + - virtual_address: 0x28600 + size: 0xaca0 + - virtual_address: 0x2d000 + size: 0x678 + - virtual_address: 0x1dac0 + size: 0x70 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x1d980 + size: 0x140 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x16000 + size: 0x2a0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 resource_timestamp: 0 # 1970-01-01 00:00:00 UTC resource_version: major: 0 minor: 0 resources: - - length: 1812 - rva: 180320 - offset: 161376 + - length: 0x714 + rva: 0x2c060 + offset: 0x27660 type: RESOURCE_TYPE_VERSION id: 1 language: 1033 @@ -280,17576 +280,17576 @@ import_details: number_of_functions: 75 functions: - name: "VerifyVersionInfoA" - rva: 90112 + rva: 0x16000 - name: "VerSetConditionMask" - rva: 90120 + rva: 0x16008 - name: "LoadLibraryA" - rva: 90128 + rva: 0x16010 - name: "GetProcAddress" - rva: 90136 + rva: 0x16018 - name: "CloseHandle" - rva: 90144 + rva: 0x16020 - name: "CreateFileW" - rva: 90152 + rva: 0x16028 - name: "SetFilePointerEx" - rva: 90160 + rva: 0x16030 - name: "GetConsoleMode" - rva: 90168 + rva: 0x16038 - name: "GetConsoleOutputCP" - rva: 90176 + rva: 0x16040 - name: "QueryPerformanceCounter" - rva: 90184 + rva: 0x16048 - name: "GetCurrentProcessId" - rva: 90192 + rva: 0x16050 - name: "GetCurrentThreadId" - rva: 90200 + rva: 0x16058 - name: "GetSystemTimeAsFileTime" - rva: 90208 + rva: 0x16060 - name: "InitializeSListHead" - rva: 90216 + rva: 0x16068 - name: "RtlCaptureContext" - rva: 90224 + rva: 0x16070 - name: "RtlLookupFunctionEntry" - rva: 90232 + rva: 0x16078 - name: "RtlVirtualUnwind" - rva: 90240 + rva: 0x16080 - name: "IsDebuggerPresent" - rva: 90248 + rva: 0x16088 - name: "UnhandledExceptionFilter" - rva: 90256 + rva: 0x16090 - name: "SetUnhandledExceptionFilter" - rva: 90264 + rva: 0x16098 - name: "GetStartupInfoW" - rva: 90272 + rva: 0x160a0 - name: "IsProcessorFeaturePresent" - rva: 90280 + rva: 0x160a8 - name: "GetModuleHandleW" - rva: 90288 + rva: 0x160b0 - name: "RtlUnwindEx" - rva: 90296 + rva: 0x160b8 - name: "RtlPcToFileHeader" - rva: 90304 + rva: 0x160c0 - name: "RaiseException" - rva: 90312 + rva: 0x160c8 - name: "InterlockedFlushSList" - rva: 90320 + rva: 0x160d0 - name: "GetLastError" - rva: 90328 + rva: 0x160d8 - name: "SetLastError" - rva: 90336 + rva: 0x160e0 - name: "EnterCriticalSection" - rva: 90344 + rva: 0x160e8 - name: "LeaveCriticalSection" - rva: 90352 + rva: 0x160f0 - name: "DeleteCriticalSection" - rva: 90360 + rva: 0x160f8 - name: "InitializeCriticalSectionAndSpinCount" - rva: 90368 + rva: 0x16100 - name: "TlsAlloc" - rva: 90376 + rva: 0x16108 - name: "TlsGetValue" - rva: 90384 + rva: 0x16110 - name: "TlsSetValue" - rva: 90392 + rva: 0x16118 - name: "TlsFree" - rva: 90400 + rva: 0x16120 - name: "FreeLibrary" - rva: 90408 + rva: 0x16128 - name: "LoadLibraryExW" - rva: 90416 + rva: 0x16130 - name: "EncodePointer" - rva: 90424 + rva: 0x16138 - name: "GetCurrentProcess" - rva: 90432 + rva: 0x16140 - name: "ExitProcess" - rva: 90440 + rva: 0x16148 - name: "TerminateProcess" - rva: 90448 + rva: 0x16150 - name: "GetModuleHandleExW" - rva: 90456 + rva: 0x16158 - name: "GetModuleFileNameW" - rva: 90464 + rva: 0x16160 - name: "HeapAlloc" - rva: 90472 + rva: 0x16168 - name: "HeapFree" - rva: 90480 + rva: 0x16170 - name: "FindClose" - rva: 90488 + rva: 0x16178 - name: "FindFirstFileExW" - rva: 90496 + rva: 0x16180 - name: "FindNextFileW" - rva: 90504 + rva: 0x16188 - name: "IsValidCodePage" - rva: 90512 + rva: 0x16190 - name: "GetACP" - rva: 90520 + rva: 0x16198 - name: "GetOEMCP" - rva: 90528 + rva: 0x161a0 - name: "GetCPInfo" - rva: 90536 + rva: 0x161a8 - name: "GetCommandLineA" - rva: 90544 + rva: 0x161b0 - name: "GetCommandLineW" - rva: 90552 + rva: 0x161b8 - name: "MultiByteToWideChar" - rva: 90560 + rva: 0x161c0 - name: "WideCharToMultiByte" - rva: 90568 + rva: 0x161c8 - name: "GetEnvironmentStringsW" - rva: 90576 + rva: 0x161d0 - name: "FreeEnvironmentStringsW" - rva: 90584 + rva: 0x161d8 - name: "FlsAlloc" - rva: 90592 + rva: 0x161e0 - name: "FlsGetValue" - rva: 90600 + rva: 0x161e8 - name: "FlsSetValue" - rva: 90608 + rva: 0x161f0 - name: "FlsFree" - rva: 90616 + rva: 0x161f8 - name: "LCMapStringW" - rva: 90624 + rva: 0x16200 - name: "GetProcessHeap" - rva: 90632 + rva: 0x16208 - name: "GetStdHandle" - rva: 90640 + rva: 0x16210 - name: "GetFileType" - rva: 90648 + rva: 0x16218 - name: "GetStringTypeW" - rva: 90656 + rva: 0x16220 - name: "HeapSize" - rva: 90664 + rva: 0x16228 - name: "HeapReAlloc" - rva: 90672 + rva: 0x16230 - name: "SetStdHandle" - rva: 90680 + rva: 0x16238 - name: "FlushFileBuffers" - rva: 90688 + rva: 0x16240 - name: "WriteFile" - rva: 90696 + rva: 0x16248 - name: "WriteConsoleW" - rva: 90704 + rva: 0x16250 - library_name: "USER32.dll" number_of_functions: 1 functions: - name: "GetDesktopWindow" - rva: 90720 + rva: 0x16260 - library_name: "dxva2.dll" number_of_functions: 1 functions: - name: "DXVA2CreateVideoService" - rva: 90768 + rva: 0x16290 - library_name: "d3d11.dll" number_of_functions: 1 functions: - name: "D3D11CreateDevice" - rva: 90736 + rva: 0x16270 - library_name: "dxgi.dll" number_of_functions: 1 functions: - name: "CreateDXGIFactory" - rva: 90752 + rva: 0x16280 export_details: - ordinal: 1300 - rva: 8224 - offset: 5152 + rva: 0x2020 + offset: 0x1420 - ordinal: 1301 - rva: 8848 - offset: 5776 + rva: 0x2290 + offset: 0x1690 - ordinal: 1302 - rva: 10160 - offset: 7088 + rva: 0x27b0 + offset: 0x1bb0 - ordinal: 1303 - rva: 10288 - offset: 7216 + rva: 0x2830 + offset: 0x1c30 - ordinal: 1304 - rva: 10416 - offset: 7344 + rva: 0x28b0 + offset: 0x1cb0 - ordinal: 1305 - rva: 10544 - offset: 7472 + rva: 0x2930 + offset: 0x1d30 - ordinal: 1306 - rva: 10672 - offset: 7600 + rva: 0x29b0 + offset: 0x1db0 - ordinal: 1307 - rva: 10800 - offset: 7728 + rva: 0x2a30 + offset: 0x1e30 - ordinal: 1308 - rva: 10928 - offset: 7856 + rva: 0x2ab0 + offset: 0x1eb0 - ordinal: 1309 - rva: 9072 - offset: 6000 + rva: 0x2370 + offset: 0x1770 - ordinal: 1310 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1311 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1312 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1313 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1314 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1315 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1316 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1317 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1318 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1319 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1320 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1321 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1322 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1323 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1324 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1325 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1326 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1327 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1328 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1329 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1330 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1331 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1332 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1333 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1334 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1335 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1336 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1337 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1338 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1339 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1340 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1341 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1342 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1343 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1344 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1345 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1346 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1347 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1348 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1349 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1350 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1351 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1352 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1353 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1354 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1355 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1356 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1357 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1358 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1359 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1360 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1361 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1362 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1363 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1364 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1365 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1366 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1367 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1368 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1369 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1370 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1371 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1372 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1373 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1374 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1375 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1376 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1377 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1378 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1379 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1380 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1381 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1382 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1383 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1384 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1385 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1386 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1387 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1388 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1389 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1390 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1391 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1392 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1393 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1394 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1395 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1396 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1397 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1398 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1399 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1400 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1401 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1402 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1403 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1404 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1405 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1406 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1407 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1408 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1409 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1410 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1411 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1412 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1413 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1414 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1415 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1416 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1417 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1418 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1419 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1420 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1421 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1422 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1423 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1424 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1425 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1426 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1427 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1428 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1429 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1430 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1431 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1432 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1433 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1434 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1435 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1436 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1437 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1438 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1439 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1440 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1441 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1442 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1443 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1444 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1445 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1446 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1447 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1448 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1449 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1450 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1451 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1452 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1453 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1454 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1455 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1456 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1457 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1458 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1459 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1460 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1461 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1462 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1463 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1464 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1465 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1466 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1467 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1468 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1469 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1470 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1471 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1472 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1473 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1474 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1475 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1476 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1477 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1478 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1479 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1480 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1481 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1482 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1483 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1484 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1485 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1486 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1487 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1488 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1489 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1490 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1491 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1492 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1493 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1494 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1495 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1496 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1497 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1498 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1499 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1500 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1501 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1502 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1503 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1504 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1505 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1506 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1507 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1508 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1509 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1510 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1511 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1512 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1513 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1514 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1515 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1516 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1517 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1518 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1519 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1520 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1521 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1522 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1523 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1524 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1525 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1526 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1527 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1528 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1529 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1530 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1531 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1532 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1533 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1534 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1535 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1536 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1537 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1538 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1539 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1540 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1541 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1542 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1543 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1544 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1545 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1546 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1547 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1548 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1549 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1550 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1551 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1552 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1553 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1554 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1555 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1556 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1557 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1558 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1559 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1560 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1561 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1562 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1563 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1564 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1565 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1566 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1567 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1568 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1569 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1570 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1571 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1572 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1573 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1574 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1575 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1576 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1577 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1578 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1579 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1580 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1581 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1582 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1583 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1584 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1585 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1586 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1587 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1588 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1589 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1590 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1591 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1592 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1593 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1594 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1595 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1596 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1597 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1598 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1599 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1600 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1601 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1602 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1603 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1604 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1605 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1606 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1607 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1608 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1609 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1610 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1611 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1612 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1613 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1614 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1615 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1616 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1617 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1618 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1619 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1620 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1621 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1622 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1623 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1624 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1625 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1626 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1627 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1628 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1629 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1630 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1631 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1632 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1633 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1634 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1635 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1636 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1637 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1638 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1639 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1640 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1641 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1642 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1643 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1644 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1645 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1646 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1647 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1648 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1649 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1650 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1651 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1652 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1653 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1654 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1655 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1656 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1657 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1658 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1659 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1660 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1661 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1662 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1663 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1664 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1665 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1666 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1667 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1668 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1669 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1670 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1671 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1672 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1673 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1674 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1675 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1676 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1677 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1678 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1679 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1680 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1681 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1682 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1683 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1684 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1685 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1686 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1687 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1688 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1689 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1690 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1691 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1692 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1693 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1694 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1695 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1696 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1697 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1698 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1699 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1700 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1701 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1702 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1703 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1704 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1705 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1706 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1707 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1708 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1709 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1710 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1711 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1712 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1713 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1714 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1715 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1716 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1717 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1718 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1719 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1720 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1721 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1722 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1723 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1724 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1725 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1726 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1727 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1728 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1729 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1730 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1731 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1732 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1733 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1734 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1735 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1736 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1737 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1738 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1739 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1740 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1741 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1742 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1743 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1744 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1745 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1746 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1747 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1748 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1749 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1750 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1751 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1752 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1753 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1754 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1755 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1756 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1757 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1758 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1759 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1760 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1761 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1762 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1763 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1764 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1765 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1766 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1767 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1768 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1769 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1770 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1771 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1772 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1773 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1774 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1775 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1776 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1777 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1778 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1779 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1780 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1781 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1782 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1783 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1784 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1785 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1786 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1787 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1788 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1789 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1790 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1791 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1792 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1793 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1794 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1795 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1796 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1797 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1798 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1799 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1800 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1801 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1802 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1803 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1804 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1805 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1806 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1807 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1808 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1809 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1810 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1811 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1812 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1813 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1814 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1815 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1816 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1817 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1818 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1819 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1820 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1821 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1822 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1823 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1824 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1825 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1826 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1827 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1828 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1829 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1830 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1831 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1832 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1833 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1834 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1835 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1836 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1837 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1838 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1839 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1840 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1841 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1842 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1843 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1844 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1845 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1846 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1847 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1848 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1849 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1850 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1851 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1852 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1853 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1854 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1855 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1856 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1857 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1858 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1859 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1860 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1861 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1862 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1863 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1864 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1865 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1866 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1867 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1868 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1869 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1870 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1871 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1872 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1873 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1874 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1875 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1876 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1877 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1878 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1879 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1880 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1881 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1882 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1883 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1884 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1885 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1886 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1887 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1888 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1889 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1890 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1891 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1892 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1893 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1894 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1895 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1896 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1897 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1898 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1899 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1900 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1901 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1902 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1903 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1904 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1905 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1906 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1907 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1908 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1909 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1910 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1911 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1912 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1913 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1914 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1915 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1916 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1917 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1918 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1919 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1920 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1921 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1922 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1923 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1924 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1925 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1926 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1927 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1928 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1929 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1930 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1931 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1932 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1933 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1934 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1935 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1936 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1937 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1938 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1939 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1940 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1941 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1942 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1943 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1944 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1945 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1946 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1947 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1948 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1949 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1950 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1951 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1952 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1953 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1954 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1955 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1956 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1957 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1958 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1959 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1960 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1961 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1962 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1963 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1964 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1965 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1966 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1967 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1968 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1969 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1970 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1971 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1972 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1973 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1974 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1975 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1976 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1977 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1978 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1979 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1980 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1981 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1982 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1983 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1984 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1985 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1986 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1987 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1988 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1989 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1990 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1991 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1992 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1993 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1994 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1995 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1996 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1997 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1998 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 1999 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2000 - rva: 22608 - offset: 19536 + rva: 0x5850 + offset: 0x4c50 - ordinal: 2001 - rva: 23152 - offset: 20080 + rva: 0x5a70 + offset: 0x4e70 - ordinal: 2002 - rva: 23344 - offset: 20272 + rva: 0x5b30 + offset: 0x4f30 - ordinal: 2003 - rva: 23520 - offset: 20448 + rva: 0x5be0 + offset: 0x4fe0 - ordinal: 2004 - rva: 23696 - offset: 20624 + rva: 0x5c90 + offset: 0x5090 - ordinal: 2005 - rva: 24064 - offset: 20992 + rva: 0x5e00 + offset: 0x5200 - ordinal: 2006 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2007 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2008 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2009 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2010 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2011 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2012 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2013 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2014 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2015 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2016 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2017 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2018 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2019 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2020 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2021 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2022 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2023 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2024 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2025 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2026 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2027 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2028 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2029 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2030 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2031 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2032 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2033 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2034 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2035 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2036 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2037 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2038 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2039 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2040 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2041 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2042 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2043 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2044 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2045 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2046 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2047 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2048 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2049 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2050 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2051 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2052 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2053 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2054 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2055 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2056 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2057 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2058 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2059 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2060 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2061 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2062 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2063 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2064 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2065 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2066 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2067 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2068 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2069 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2070 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2071 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2072 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2073 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2074 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2075 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2076 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2077 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2078 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2079 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2080 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2081 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2082 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2083 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2084 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2085 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2086 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2087 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2088 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2089 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2090 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2091 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2092 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2093 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2094 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2095 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2096 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2097 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2098 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2099 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2100 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2101 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2102 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2103 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2104 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2105 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2106 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2107 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2108 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2109 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2110 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2111 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2112 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2113 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2114 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2115 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2116 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2117 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2118 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2119 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2120 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2121 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2122 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2123 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2124 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2125 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2126 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2127 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2128 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2129 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2130 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2131 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2132 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2133 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2134 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2135 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2136 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2137 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2138 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2139 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2140 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2141 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2142 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2143 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2144 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2145 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2146 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2147 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2148 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2149 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2150 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2151 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2152 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2153 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2154 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2155 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2156 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2157 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2158 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2159 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2160 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2161 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2162 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2163 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2164 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2165 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2166 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2167 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2168 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2169 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2170 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2171 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2172 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2173 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2174 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2175 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2176 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2177 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2178 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2179 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2180 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2181 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2182 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2183 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2184 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2185 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2186 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2187 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2188 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2189 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2190 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2191 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2192 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2193 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2194 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2195 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2196 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2197 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2198 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2199 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2200 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2201 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2202 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2203 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2204 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2205 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2206 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2207 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2208 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2209 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2210 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2211 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2212 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2213 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2214 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2215 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2216 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2217 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2218 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2219 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2220 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2221 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2222 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2223 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2224 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2225 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2226 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2227 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2228 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2229 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2230 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2231 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2232 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2233 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2234 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2235 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2236 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2237 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2238 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2239 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2240 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2241 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2242 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2243 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2244 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2245 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2246 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2247 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2248 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2249 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2250 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2251 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2252 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2253 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2254 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2255 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2256 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2257 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2258 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2259 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2260 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2261 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2262 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2263 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2264 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2265 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2266 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2267 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2268 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2269 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2270 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2271 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2272 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2273 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2274 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2275 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2276 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2277 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2278 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2279 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2280 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2281 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2282 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2283 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2284 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2285 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2286 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2287 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2288 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2289 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2290 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2291 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2292 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2293 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2294 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2295 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2296 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2297 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2298 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2299 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2300 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2301 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2302 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2303 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2304 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2305 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2306 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2307 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2308 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2309 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2310 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2311 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2312 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2313 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2314 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2315 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2316 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2317 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2318 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2319 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2320 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2321 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2322 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2323 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2324 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2325 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2326 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2327 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2328 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2329 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2330 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2331 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2332 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2333 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2334 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2335 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2336 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2337 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2338 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2339 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2340 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2341 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2342 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2343 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2344 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2345 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2346 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2347 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2348 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2349 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2350 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2351 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2352 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2353 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2354 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2355 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2356 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2357 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2358 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2359 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2360 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2361 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2362 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2363 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2364 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2365 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2366 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2367 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2368 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2369 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2370 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2371 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2372 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2373 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2374 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2375 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2376 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2377 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2378 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2379 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2380 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2381 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2382 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2383 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2384 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2385 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2386 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2387 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2388 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2389 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2390 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2391 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2392 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2393 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2394 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2395 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2396 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2397 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2398 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2399 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2400 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2401 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2402 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2403 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2404 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2405 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2406 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2407 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2408 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2409 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2410 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2411 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2412 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2413 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2414 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2415 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2416 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2417 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2418 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2419 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2420 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2421 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2422 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2423 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2424 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2425 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2426 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2427 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2428 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2429 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2430 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2431 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2432 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2433 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2434 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2435 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2436 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2437 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2438 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2439 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2440 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2441 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2442 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2443 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2444 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2445 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2446 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2447 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2448 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2449 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2450 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2451 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2452 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2453 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2454 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2455 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2456 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2457 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2458 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2459 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2460 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2461 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2462 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2463 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2464 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2465 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2466 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2467 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2468 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2469 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2470 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2471 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2472 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2473 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2474 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2475 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2476 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2477 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2478 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2479 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2480 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2481 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2482 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2483 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2484 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2485 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2486 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2487 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2488 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2489 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2490 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2491 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2492 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2493 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2494 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2495 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2496 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2497 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2498 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2499 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2500 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2501 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2502 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2503 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2504 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2505 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2506 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2507 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2508 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2509 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2510 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2511 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2512 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2513 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2514 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2515 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2516 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2517 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2518 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2519 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2520 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2521 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2522 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2523 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2524 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2525 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2526 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2527 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2528 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2529 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2530 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2531 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2532 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2533 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2534 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2535 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2536 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2537 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2538 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2539 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2540 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2541 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2542 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2543 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2544 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2545 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2546 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2547 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2548 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2549 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2550 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2551 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2552 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2553 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2554 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2555 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2556 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2557 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2558 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2559 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2560 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2561 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2562 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2563 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2564 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2565 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2566 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2567 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2568 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2569 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2570 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2571 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2572 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2573 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2574 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2575 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2576 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2577 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2578 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2579 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2580 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2581 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2582 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2583 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2584 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2585 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2586 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2587 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2588 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2589 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2590 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2591 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2592 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2593 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2594 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2595 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2596 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2597 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2598 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2599 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2600 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2601 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2602 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2603 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2604 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2605 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2606 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2607 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2608 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2609 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2610 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2611 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2612 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2613 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2614 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2615 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2616 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2617 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2618 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2619 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2620 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2621 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2622 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2623 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2624 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2625 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2626 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2627 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2628 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2629 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2630 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2631 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2632 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2633 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2634 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2635 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2636 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2637 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2638 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2639 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2640 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2641 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2642 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2643 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2644 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2645 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2646 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2647 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2648 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2649 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2650 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2651 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2652 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2653 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2654 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2655 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2656 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2657 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2658 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2659 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2660 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2661 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2662 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2663 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2664 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2665 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2666 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2667 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2668 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2669 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2670 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2671 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2672 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2673 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2674 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2675 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2676 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2677 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2678 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2679 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2680 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2681 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2682 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2683 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2684 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2685 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2686 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2687 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2688 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2689 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2690 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2691 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2692 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2693 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2694 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2695 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2696 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2697 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2698 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2699 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2700 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2701 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2702 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2703 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2704 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2705 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2706 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2707 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2708 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2709 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2710 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2711 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2712 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2713 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2714 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2715 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2716 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2717 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2718 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2719 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2720 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2721 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2722 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2723 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2724 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2725 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2726 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2727 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2728 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2729 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2730 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2731 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2732 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2733 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2734 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2735 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2736 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2737 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2738 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2739 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2740 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2741 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2742 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2743 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2744 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2745 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2746 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2747 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2748 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2749 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2750 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2751 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2752 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2753 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2754 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2755 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2756 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2757 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2758 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2759 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2760 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2761 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2762 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2763 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2764 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2765 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2766 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2767 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2768 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2769 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2770 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2771 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2772 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2773 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2774 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2775 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2776 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2777 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2778 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2779 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2780 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2781 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2782 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2783 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2784 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2785 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2786 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2787 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2788 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2789 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2790 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2791 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2792 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2793 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2794 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2795 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2796 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2797 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2798 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2799 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2800 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2801 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2802 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2803 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2804 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2805 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2806 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2807 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2808 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2809 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2810 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2811 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2812 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2813 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2814 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2815 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2816 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2817 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2818 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2819 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2820 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2821 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2822 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2823 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2824 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2825 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2826 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2827 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2828 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2829 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2830 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2831 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2832 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2833 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2834 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2835 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2836 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2837 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2838 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2839 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2840 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2841 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2842 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2843 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2844 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2845 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2846 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2847 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2848 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2849 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2850 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2851 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2852 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2853 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2854 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2855 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2856 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2857 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2858 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2859 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2860 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2861 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2862 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2863 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2864 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2865 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2866 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2867 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2868 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2869 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2870 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2871 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2872 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2873 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2874 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2875 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2876 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2877 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2878 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2879 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2880 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2881 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2882 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2883 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2884 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2885 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2886 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2887 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2888 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2889 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2890 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2891 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2892 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2893 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2894 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2895 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2896 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2897 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2898 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2899 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2900 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2901 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2902 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2903 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2904 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2905 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2906 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2907 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2908 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2909 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2910 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2911 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2912 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2913 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2914 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2915 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2916 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2917 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2918 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2919 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2920 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2921 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2922 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2923 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2924 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2925 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2926 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2927 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2928 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2929 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2930 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2931 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2932 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2933 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2934 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2935 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2936 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2937 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2938 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2939 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2940 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2941 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2942 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2943 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2944 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2945 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2946 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2947 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2948 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2949 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2950 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2951 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2952 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2953 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2954 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2955 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2956 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2957 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2958 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2959 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2960 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2961 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2962 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2963 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2964 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2965 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2966 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2967 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2968 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2969 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2970 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2971 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2972 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2973 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2974 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2975 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2976 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2977 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2978 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2979 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2980 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2981 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2982 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2983 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2984 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2985 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2986 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2987 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2988 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2989 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2990 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2991 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2992 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2993 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2994 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2995 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2996 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2997 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2998 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 2999 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3000 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3001 - rva: 29456 - offset: 26384 + rva: 0x7310 + offset: 0x6710 - ordinal: 3002 - rva: 29904 - offset: 26832 + rva: 0x74d0 + offset: 0x68d0 - ordinal: 3003 - rva: 29952 - offset: 26880 + rva: 0x7500 + offset: 0x6900 - ordinal: 3004 - rva: 30112 - offset: 27040 + rva: 0x75a0 + offset: 0x69a0 - ordinal: 3005 - rva: 30256 - offset: 27184 + rva: 0x7630 + offset: 0x6a30 - ordinal: 3006 - rva: 30480 - offset: 27408 + rva: 0x7710 + offset: 0x6b10 - ordinal: 3007 - rva: 30608 - offset: 27536 + rva: 0x7790 + offset: 0x6b90 - ordinal: 3008 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3009 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3010 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3011 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3012 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3013 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3014 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3015 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3016 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3017 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3018 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3019 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3020 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3021 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3022 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3023 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3024 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3025 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3026 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3027 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3028 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3029 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3030 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3031 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3032 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3033 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3034 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3035 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3036 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3037 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3038 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3039 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3040 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3041 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3042 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3043 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3044 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3045 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3046 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3047 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3048 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3049 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3050 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3051 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3052 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3053 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3054 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3055 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3056 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3057 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3058 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3059 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3060 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3061 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3062 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3063 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3064 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3065 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3066 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3067 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3068 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3069 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3070 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3071 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3072 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3073 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3074 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3075 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3076 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3077 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3078 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3079 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3080 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3081 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3082 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3083 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3084 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3085 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3086 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3087 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3088 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3089 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3090 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3091 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3092 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3093 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3094 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3095 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3096 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3097 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3098 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3099 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3100 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3101 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3102 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3103 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3104 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3105 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3106 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3107 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3108 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3109 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3110 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3111 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3112 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3113 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3114 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3115 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3116 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3117 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3118 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3119 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3120 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3121 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3122 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3123 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3124 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3125 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3126 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3127 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3128 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3129 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3130 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3131 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3132 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3133 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3134 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3135 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3136 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3137 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3138 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3139 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3140 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3141 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3142 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3143 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3144 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3145 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3146 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3147 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3148 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3149 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3150 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3151 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3152 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3153 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3154 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3155 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3156 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3157 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3158 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3159 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3160 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3161 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3162 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3163 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3164 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3165 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3166 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3167 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3168 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3169 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3170 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3171 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3172 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3173 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3174 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3175 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3176 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3177 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3178 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3179 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3180 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3181 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3182 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3183 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3184 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3185 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3186 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3187 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3188 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3189 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3190 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3191 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3192 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3193 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3194 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3195 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3196 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3197 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3198 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3199 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3200 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3201 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3202 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3203 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3204 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3205 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3206 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3207 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3208 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3209 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3210 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3211 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3212 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3213 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3214 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3215 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3216 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3217 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3218 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3219 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3220 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3221 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3222 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3223 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3224 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3225 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3226 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3227 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3228 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3229 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3230 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3231 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3232 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3233 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3234 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3235 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3236 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3237 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3238 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3239 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3240 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3241 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3242 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3243 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3244 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3245 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3246 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3247 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3248 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3249 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3250 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3251 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3252 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3253 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3254 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3255 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3256 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3257 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3258 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3259 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3260 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3261 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3262 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3263 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3264 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3265 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3266 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3267 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3268 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3269 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3270 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3271 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3272 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3273 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3274 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3275 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3276 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3277 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3278 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3279 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3280 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3281 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3282 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3283 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3284 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3285 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3286 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3287 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3288 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3289 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3290 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3291 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3292 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3293 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3294 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3295 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3296 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3297 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3298 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3299 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3300 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3301 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3302 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3303 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3304 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3305 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3306 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3307 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3308 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3309 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3310 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3311 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3312 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3313 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3314 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3315 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3316 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3317 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3318 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3319 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3320 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3321 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3322 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3323 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3324 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3325 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3326 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3327 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3328 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3329 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3330 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3331 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3332 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3333 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3334 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3335 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3336 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3337 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3338 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3339 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3340 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3341 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3342 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3343 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3344 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3345 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3346 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3347 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3348 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3349 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3350 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3351 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3352 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3353 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3354 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3355 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3356 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3357 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3358 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3359 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3360 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3361 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3362 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3363 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3364 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3365 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3366 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3367 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3368 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3369 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3370 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3371 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3372 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3373 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3374 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3375 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3376 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3377 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3378 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3379 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3380 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3381 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3382 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3383 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3384 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3385 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3386 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3387 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3388 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3389 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3390 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3391 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3392 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3393 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3394 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3395 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3396 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3397 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3398 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3399 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3400 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3401 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3402 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3403 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3404 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3405 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3406 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3407 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3408 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3409 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3410 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3411 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3412 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3413 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3414 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3415 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3416 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3417 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3418 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3419 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3420 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3421 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3422 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3423 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3424 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3425 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3426 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3427 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3428 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3429 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3430 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3431 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3432 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3433 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3434 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3435 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3436 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3437 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3438 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3439 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3440 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3441 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3442 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3443 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3444 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3445 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3446 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3447 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3448 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3449 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3450 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3451 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3452 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3453 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3454 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3455 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3456 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3457 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3458 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3459 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3460 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3461 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3462 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3463 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3464 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3465 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3466 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3467 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3468 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3469 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3470 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3471 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3472 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3473 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3474 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3475 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3476 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3477 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3478 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3479 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3480 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3481 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3482 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3483 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3484 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3485 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3486 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3487 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3488 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3489 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3490 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3491 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3492 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3493 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3494 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3495 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3496 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3497 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3498 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3499 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3500 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3501 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3502 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3503 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3504 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3505 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3506 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3507 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3508 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3509 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3510 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3511 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3512 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3513 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3514 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3515 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3516 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3517 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3518 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3519 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3520 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3521 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3522 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3523 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3524 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3525 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3526 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3527 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3528 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3529 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3530 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3531 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3532 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3533 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3534 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3535 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3536 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3537 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3538 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3539 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3540 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3541 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3542 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3543 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3544 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3545 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3546 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3547 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3548 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3549 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3550 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3551 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3552 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3553 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3554 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3555 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3556 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3557 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3558 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3559 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3560 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3561 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3562 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3563 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3564 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3565 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3566 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3567 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3568 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3569 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3570 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3571 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3572 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3573 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3574 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3575 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3576 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3577 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3578 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3579 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3580 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3581 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3582 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3583 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3584 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3585 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3586 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3587 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3588 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3589 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3590 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3591 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3592 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3593 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3594 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3595 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3596 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3597 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3598 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3599 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3600 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3601 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3602 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3603 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3604 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3605 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3606 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3607 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3608 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3609 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3610 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3611 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3612 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3613 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3614 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3615 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3616 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3617 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3618 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3619 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3620 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3621 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3622 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3623 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3624 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3625 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3626 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3627 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3628 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3629 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3630 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3631 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3632 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3633 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3634 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3635 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3636 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3637 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3638 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3639 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3640 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3641 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3642 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3643 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3644 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3645 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3646 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3647 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3648 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3649 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3650 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3651 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3652 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3653 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3654 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3655 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3656 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3657 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3658 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3659 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3660 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3661 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3662 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3663 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3664 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3665 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3666 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3667 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3668 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3669 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3670 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3671 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3672 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3673 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3674 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3675 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3676 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3677 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3678 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3679 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3680 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3681 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3682 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3683 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3684 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3685 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3686 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3687 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3688 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3689 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3690 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3691 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3692 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3693 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3694 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3695 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3696 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3697 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3698 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3699 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3700 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3701 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3702 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3703 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3704 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3705 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3706 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3707 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3708 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3709 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3710 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3711 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3712 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3713 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3714 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3715 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3716 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3717 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3718 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3719 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3720 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3721 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3722 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3723 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3724 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3725 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3726 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3727 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3728 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3729 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3730 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3731 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3732 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3733 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3734 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3735 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3736 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3737 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3738 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3739 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3740 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3741 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3742 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3743 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3744 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3745 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3746 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3747 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3748 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3749 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3750 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3751 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3752 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3753 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3754 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3755 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3756 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3757 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3758 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3759 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3760 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3761 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3762 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3763 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3764 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3765 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3766 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3767 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3768 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3769 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3770 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3771 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3772 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3773 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3774 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3775 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3776 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3777 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3778 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3779 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3780 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3781 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3782 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3783 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3784 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3785 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3786 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3787 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3788 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3789 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3790 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3791 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3792 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3793 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3794 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3795 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3796 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3797 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3798 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3799 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3800 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3801 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3802 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3803 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3804 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3805 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3806 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3807 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3808 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3809 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3810 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3811 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3812 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3813 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3814 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3815 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3816 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3817 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3818 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3819 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3820 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3821 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3822 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3823 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3824 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3825 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3826 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3827 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3828 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3829 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3830 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3831 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3832 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3833 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3834 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3835 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3836 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3837 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3838 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3839 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3840 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3841 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3842 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3843 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3844 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3845 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3846 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3847 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3848 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3849 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3850 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3851 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3852 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3853 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3854 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3855 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3856 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3857 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3858 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3859 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3860 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3861 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3862 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3863 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3864 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3865 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3866 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3867 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3868 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3869 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3870 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3871 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3872 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3873 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3874 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3875 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3876 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3877 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3878 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3879 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3880 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3881 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3882 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3883 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3884 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3885 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3886 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3887 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3888 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3889 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3890 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3891 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3892 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3893 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3894 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3895 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3896 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3897 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3898 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3899 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3900 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3901 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3902 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3903 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3904 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3905 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3906 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3907 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3908 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3909 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3910 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3911 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3912 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3913 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3914 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3915 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3916 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3917 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3918 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3919 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3920 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3921 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3922 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3923 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3924 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3925 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3926 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3927 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3928 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3929 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3930 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3931 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3932 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3933 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3934 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3935 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3936 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3937 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3938 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3939 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3940 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3941 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3942 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3943 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3944 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3945 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3946 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3947 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3948 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3949 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3950 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3951 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3952 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3953 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3954 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3955 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3956 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3957 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3958 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3959 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3960 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3961 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3962 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3963 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3964 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3965 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3966 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3967 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3968 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3969 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3970 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3971 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3972 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3973 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3974 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3975 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3976 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3977 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3978 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3979 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3980 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3981 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3982 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3983 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3984 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3985 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3986 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3987 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3988 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3989 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3990 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3991 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3992 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3993 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3994 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3995 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3996 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3997 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3998 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 3999 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4000 - rva: 24240 - offset: 21168 + rva: 0x5eb0 + offset: 0x52b0 - ordinal: 4001 - rva: 24592 - offset: 21520 + rva: 0x6010 + offset: 0x5410 - ordinal: 4002 - rva: 24768 - offset: 21696 + rva: 0x60c0 + offset: 0x54c0 - ordinal: 4003 - rva: 24928 - offset: 21856 + rva: 0x6160 + offset: 0x5560 - ordinal: 4004 - rva: 25328 - offset: 22256 + rva: 0x62f0 + offset: 0x56f0 - ordinal: 4005 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4006 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4007 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4008 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4009 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4010 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4011 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4012 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4013 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4014 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4015 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4016 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4017 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4018 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4019 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4020 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4021 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4022 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4023 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4024 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4025 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4026 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4027 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4028 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4029 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4030 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4031 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4032 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4033 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4034 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4035 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4036 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4037 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4038 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4039 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4040 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4041 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4042 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4043 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4044 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4045 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4046 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4047 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4048 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4049 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4050 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4051 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4052 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4053 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4054 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4055 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4056 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4057 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4058 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4059 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4060 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4061 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4062 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4063 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4064 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4065 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4066 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4067 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4068 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4069 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4070 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4071 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4072 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4073 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4074 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4075 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4076 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4077 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4078 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4079 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4080 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4081 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4082 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4083 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4084 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4085 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4086 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4087 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4088 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4089 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4090 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4091 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4092 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4093 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4094 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4095 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4096 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4097 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4098 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4099 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4100 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4101 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4102 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4103 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4104 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4105 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4106 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4107 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4108 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4109 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4110 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4111 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4112 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4113 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4114 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4115 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4116 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4117 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4118 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4119 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4120 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4121 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4122 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4123 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4124 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4125 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4126 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4127 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4128 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4129 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4130 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4131 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4132 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4133 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4134 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4135 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4136 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4137 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4138 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4139 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4140 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4141 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4142 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4143 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4144 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4145 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4146 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4147 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4148 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4149 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4150 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4151 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4152 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4153 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4154 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4155 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4156 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4157 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4158 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4159 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4160 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4161 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4162 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4163 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4164 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4165 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4166 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4167 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4168 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4169 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4170 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4171 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4172 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4173 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4174 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4175 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4176 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4177 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4178 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4179 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4180 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4181 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4182 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4183 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4184 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4185 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4186 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4187 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4188 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4189 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4190 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4191 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4192 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4193 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4194 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4195 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4196 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4197 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4198 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4199 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4200 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4201 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4202 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4203 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4204 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4205 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4206 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4207 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4208 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4209 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4210 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4211 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4212 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4213 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4214 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4215 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4216 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4217 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4218 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4219 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4220 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4221 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4222 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4223 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4224 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4225 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4226 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4227 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4228 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4229 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4230 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4231 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4232 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4233 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4234 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4235 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4236 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4237 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4238 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4239 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4240 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4241 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4242 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4243 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4244 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4245 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4246 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4247 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4248 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4249 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4250 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4251 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4252 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4253 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4254 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4255 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4256 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4257 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4258 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4259 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4260 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4261 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4262 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4263 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4264 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4265 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4266 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4267 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4268 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4269 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4270 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4271 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4272 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4273 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4274 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4275 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4276 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4277 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4278 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4279 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4280 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4281 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4282 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4283 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4284 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4285 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4286 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4287 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4288 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4289 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4290 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4291 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4292 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4293 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4294 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4295 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4296 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4297 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4298 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4299 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4300 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4301 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4302 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4303 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4304 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4305 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4306 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4307 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4308 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4309 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4310 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4311 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4312 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4313 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4314 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4315 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4316 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4317 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4318 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4319 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4320 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4321 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4322 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4323 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4324 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4325 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4326 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4327 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4328 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4329 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4330 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4331 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4332 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4333 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4334 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4335 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4336 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4337 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4338 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4339 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4340 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4341 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4342 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4343 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4344 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4345 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4346 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4347 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4348 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4349 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4350 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4351 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4352 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4353 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4354 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4355 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4356 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4357 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4358 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4359 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4360 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4361 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4362 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4363 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4364 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4365 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4366 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4367 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4368 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4369 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4370 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4371 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4372 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4373 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4374 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4375 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4376 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4377 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4378 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4379 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4380 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4381 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4382 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4383 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4384 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4385 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4386 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4387 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4388 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4389 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4390 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4391 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4392 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4393 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4394 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4395 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4396 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4397 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4398 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4399 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4400 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4401 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4402 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4403 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4404 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4405 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4406 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4407 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4408 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4409 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4410 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4411 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4412 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4413 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4414 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4415 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4416 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4417 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4418 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4419 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4420 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4421 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4422 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4423 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4424 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4425 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4426 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4427 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4428 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4429 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4430 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4431 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4432 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4433 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4434 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4435 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4436 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4437 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4438 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4439 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4440 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4441 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4442 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4443 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4444 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4445 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4446 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4447 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4448 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4449 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4450 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4451 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4452 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4453 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4454 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4455 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4456 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4457 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4458 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4459 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4460 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4461 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4462 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4463 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4464 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4465 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4466 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4467 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4468 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4469 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4470 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4471 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4472 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4473 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4474 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4475 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4476 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4477 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4478 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4479 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4480 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4481 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4482 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4483 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4484 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4485 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4486 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4487 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4488 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4489 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4490 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4491 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4492 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4493 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4494 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4495 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4496 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4497 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4498 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4499 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4500 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4501 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4502 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4503 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4504 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4505 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4506 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4507 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4508 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4509 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4510 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4511 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4512 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4513 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4514 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4515 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4516 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4517 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4518 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4519 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4520 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4521 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4522 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4523 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4524 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4525 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4526 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4527 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4528 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4529 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4530 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4531 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4532 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4533 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4534 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4535 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4536 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4537 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4538 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4539 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4540 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4541 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4542 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4543 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4544 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4545 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4546 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4547 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4548 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4549 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4550 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4551 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4552 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4553 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4554 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4555 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4556 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4557 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4558 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4559 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4560 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4561 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4562 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4563 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4564 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4565 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4566 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4567 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4568 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4569 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4570 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4571 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4572 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4573 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4574 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4575 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4576 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4577 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4578 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4579 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4580 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4581 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4582 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4583 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4584 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4585 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4586 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4587 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4588 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4589 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4590 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4591 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4592 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4593 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4594 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4595 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4596 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4597 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4598 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4599 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4600 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4601 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4602 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4603 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4604 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4605 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4606 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4607 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4608 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4609 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4610 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4611 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4612 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4613 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4614 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4615 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4616 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4617 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4618 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4619 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4620 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4621 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4622 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4623 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4624 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4625 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4626 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4627 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4628 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4629 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4630 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4631 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4632 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4633 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4634 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4635 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4636 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4637 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4638 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4639 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4640 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4641 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4642 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4643 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4644 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4645 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4646 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4647 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4648 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4649 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4650 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4651 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4652 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4653 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4654 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4655 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4656 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4657 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4658 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4659 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4660 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4661 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4662 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4663 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4664 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4665 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4666 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4667 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4668 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4669 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4670 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4671 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4672 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4673 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4674 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4675 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4676 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4677 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4678 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4679 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4680 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4681 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4682 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4683 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4684 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4685 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4686 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4687 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4688 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4689 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4690 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4691 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4692 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4693 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4694 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4695 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4696 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4697 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4698 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4699 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4700 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4701 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4702 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4703 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4704 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4705 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4706 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4707 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4708 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4709 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4710 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4711 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4712 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4713 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4714 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4715 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4716 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4717 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4718 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4719 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4720 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4721 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4722 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4723 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4724 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4725 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4726 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4727 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4728 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4729 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4730 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4731 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4732 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4733 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4734 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4735 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4736 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4737 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4738 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4739 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4740 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4741 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4742 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4743 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4744 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4745 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4746 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4747 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4748 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4749 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4750 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4751 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4752 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4753 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4754 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4755 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4756 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4757 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4758 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4759 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4760 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4761 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4762 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4763 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4764 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4765 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4766 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4767 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4768 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4769 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4770 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4771 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4772 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4773 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4774 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4775 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4776 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4777 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4778 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4779 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4780 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4781 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4782 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4783 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4784 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4785 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4786 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4787 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4788 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4789 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4790 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4791 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4792 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4793 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4794 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4795 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4796 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4797 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4798 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4799 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4800 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4801 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4802 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4803 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4804 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4805 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4806 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4807 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4808 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4809 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4810 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4811 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4812 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4813 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4814 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4815 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4816 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4817 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4818 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4819 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4820 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4821 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4822 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4823 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4824 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4825 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4826 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4827 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4828 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4829 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4830 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4831 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4832 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4833 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4834 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4835 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4836 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4837 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4838 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4839 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4840 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4841 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4842 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4843 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4844 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4845 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4846 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4847 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4848 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4849 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4850 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4851 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4852 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4853 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4854 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4855 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4856 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4857 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4858 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4859 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4860 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4861 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4862 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4863 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4864 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4865 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4866 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4867 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4868 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4869 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4870 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4871 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4872 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4873 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4874 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4875 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4876 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4877 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4878 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4879 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4880 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4881 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4882 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4883 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4884 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4885 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4886 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4887 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4888 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4889 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4890 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4891 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4892 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4893 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4894 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4895 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4896 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4897 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4898 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4899 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4900 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4901 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4902 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4903 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4904 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4905 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4906 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4907 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4908 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4909 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4910 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4911 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4912 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4913 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4914 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4915 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4916 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4917 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4918 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4919 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4920 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4921 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4922 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4923 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4924 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4925 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4926 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4927 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4928 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4929 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4930 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4931 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4932 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4933 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4934 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4935 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4936 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4937 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4938 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4939 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4940 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4941 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4942 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4943 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4944 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4945 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4946 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4947 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4948 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4949 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4950 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4951 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4952 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4953 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4954 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4955 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4956 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4957 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4958 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4959 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4960 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4961 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4962 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4963 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4964 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4965 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4966 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4967 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4968 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4969 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4970 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4971 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4972 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4973 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4974 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4975 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4976 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4977 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4978 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4979 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4980 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4981 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4982 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4983 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4984 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4985 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4986 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4987 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4988 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4989 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4990 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4991 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4992 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4993 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4994 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4995 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4996 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4997 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4998 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 4999 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5000 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5001 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5002 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5003 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5004 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5005 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5006 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5007 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5008 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5009 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5010 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5011 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5012 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5013 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5014 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5015 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5016 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5017 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5018 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5019 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5020 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5021 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5022 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5023 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5024 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5025 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5026 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5027 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5028 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5029 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5030 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5031 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5032 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5033 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5034 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5035 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5036 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5037 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5038 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5039 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5040 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5041 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5042 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5043 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5044 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5045 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5046 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5047 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5048 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5049 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5050 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5051 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5052 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5053 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5054 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5055 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5056 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5057 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5058 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5059 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5060 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5061 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5062 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5063 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5064 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5065 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5066 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5067 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5068 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5069 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5070 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5071 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5072 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5073 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5074 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5075 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5076 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5077 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5078 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5079 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5080 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5081 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5082 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5083 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5084 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5085 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5086 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5087 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5088 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5089 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5090 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5091 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5092 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5093 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5094 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5095 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5096 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5097 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5098 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5099 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5100 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5101 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5102 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5103 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5104 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5105 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5106 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5107 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5108 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5109 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5110 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5111 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5112 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5113 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5114 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5115 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5116 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5117 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5118 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5119 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5120 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5121 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5122 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5123 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5124 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5125 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5126 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5127 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5128 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5129 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5130 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5131 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5132 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5133 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5134 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5135 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5136 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5137 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5138 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5139 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5140 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5141 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5142 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5143 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5144 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5145 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5146 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5147 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5148 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5149 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5150 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5151 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5152 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5153 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5154 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5155 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5156 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5157 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5158 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5159 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5160 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5161 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5162 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5163 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5164 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5165 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5166 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5167 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5168 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5169 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5170 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5171 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5172 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5173 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5174 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5175 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5176 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5177 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5178 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5179 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5180 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5181 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5182 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5183 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5184 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5185 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5186 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5187 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5188 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5189 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5190 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5191 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5192 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5193 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5194 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5195 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5196 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5197 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5198 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5199 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5200 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5201 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5202 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5203 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5204 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5205 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5206 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5207 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5208 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5209 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5210 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5211 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5212 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5213 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5214 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5215 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5216 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5217 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5218 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5219 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5220 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5221 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5222 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5223 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5224 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5225 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5226 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5227 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5228 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5229 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5230 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5231 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5232 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5233 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5234 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5235 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5236 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5237 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5238 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5239 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5240 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5241 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5242 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5243 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5244 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5245 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5246 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5247 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5248 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5249 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5250 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5251 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5252 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5253 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5254 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5255 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5256 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5257 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5258 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5259 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5260 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5261 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5262 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5263 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5264 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5265 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5266 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5267 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5268 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5269 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5270 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5271 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5272 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5273 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5274 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5275 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5276 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5277 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5278 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5279 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5280 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5281 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5282 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5283 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5284 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5285 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5286 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5287 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5288 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5289 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5290 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5291 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5292 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5293 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5294 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5295 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5296 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5297 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5298 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5299 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5300 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5301 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5302 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5303 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5304 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5305 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5306 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5307 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5308 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5309 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5310 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5311 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5312 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5313 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5314 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5315 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5316 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5317 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5318 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5319 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5320 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5321 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5322 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5323 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5324 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5325 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5326 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5327 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5328 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5329 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5330 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5331 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5332 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5333 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5334 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5335 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5336 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5337 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5338 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5339 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5340 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5341 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5342 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5343 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5344 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5345 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5346 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5347 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5348 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5349 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5350 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5351 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5352 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5353 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5354 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5355 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5356 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5357 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5358 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5359 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5360 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5361 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5362 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5363 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5364 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5365 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5366 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5367 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5368 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5369 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5370 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5371 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5372 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5373 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5374 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5375 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5376 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5377 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5378 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5379 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5380 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5381 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5382 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5383 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5384 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5385 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5386 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5387 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5388 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5389 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5390 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5391 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5392 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5393 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5394 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5395 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5396 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5397 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5398 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5399 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5400 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5401 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5402 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5403 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5404 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5405 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5406 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5407 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5408 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5409 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5410 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5411 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5412 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5413 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5414 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5415 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5416 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5417 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5418 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5419 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5420 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5421 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5422 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5423 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5424 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5425 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5426 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5427 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5428 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5429 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5430 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5431 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5432 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5433 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5434 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5435 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5436 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5437 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5438 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5439 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5440 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5441 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5442 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5443 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5444 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5445 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5446 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5447 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5448 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5449 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5450 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5451 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5452 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5453 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5454 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5455 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5456 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5457 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5458 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5459 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5460 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5461 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5462 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5463 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5464 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5465 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5466 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5467 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5468 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5469 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5470 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5471 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5472 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5473 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5474 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5475 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5476 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5477 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5478 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5479 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5480 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5481 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5482 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5483 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5484 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5485 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5486 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5487 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5488 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5489 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5490 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5491 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5492 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5493 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5494 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5495 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5496 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5497 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5498 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5499 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5500 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5501 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5502 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5503 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5504 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5505 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5506 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5507 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5508 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5509 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5510 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5511 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5512 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5513 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5514 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5515 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5516 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5517 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5518 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5519 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5520 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5521 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5522 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5523 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5524 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5525 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5526 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5527 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5528 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5529 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5530 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5531 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5532 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5533 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5534 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5535 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5536 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5537 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5538 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5539 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5540 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5541 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5542 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5543 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5544 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5545 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5546 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5547 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5548 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5549 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5550 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5551 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5552 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5553 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5554 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5555 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5556 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5557 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5558 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5559 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5560 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5561 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5562 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5563 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5564 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5565 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5566 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5567 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5568 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5569 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5570 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5571 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5572 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5573 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5574 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5575 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5576 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5577 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5578 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5579 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5580 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5581 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5582 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5583 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5584 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5585 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5586 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5587 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5588 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5589 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5590 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5591 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5592 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5593 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5594 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5595 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5596 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5597 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5598 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5599 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5600 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5601 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5602 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5603 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5604 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5605 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5606 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5607 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5608 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5609 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5610 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5611 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5612 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5613 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5614 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5615 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5616 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5617 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5618 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5619 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5620 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5621 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5622 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5623 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5624 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5625 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5626 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5627 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5628 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5629 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5630 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5631 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5632 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5633 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5634 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5635 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5636 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5637 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5638 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5639 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5640 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5641 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5642 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5643 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5644 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5645 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5646 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5647 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5648 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5649 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5650 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5651 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5652 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5653 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5654 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5655 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5656 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5657 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5658 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5659 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5660 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5661 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5662 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5663 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5664 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5665 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5666 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5667 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5668 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5669 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5670 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5671 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5672 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5673 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5674 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5675 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5676 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5677 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5678 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5679 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5680 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5681 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5682 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5683 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5684 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5685 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5686 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5687 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5688 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5689 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5690 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5691 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5692 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5693 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5694 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5695 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5696 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5697 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5698 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5699 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5700 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5701 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5702 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5703 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5704 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5705 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5706 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5707 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5708 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5709 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5710 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5711 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5712 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5713 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5714 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5715 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5716 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5717 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5718 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5719 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5720 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5721 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5722 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5723 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5724 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5725 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5726 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5727 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5728 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5729 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5730 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5731 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5732 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5733 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5734 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5735 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5736 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5737 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5738 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5739 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5740 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5741 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5742 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5743 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5744 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5745 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5746 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5747 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5748 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5749 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5750 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5751 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5752 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5753 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5754 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5755 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5756 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5757 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5758 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5759 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5760 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5761 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5762 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5763 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5764 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5765 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5766 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5767 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5768 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5769 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5770 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5771 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5772 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5773 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5774 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5775 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5776 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5777 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5778 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5779 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5780 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5781 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5782 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5783 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5784 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5785 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5786 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5787 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5788 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5789 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5790 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5791 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5792 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5793 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5794 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5795 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5796 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5797 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5798 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5799 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5800 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5801 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5802 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5803 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5804 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5805 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5806 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5807 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5808 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5809 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5810 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5811 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5812 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5813 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5814 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5815 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5816 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5817 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5818 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5819 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5820 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5821 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5822 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5823 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5824 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5825 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5826 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5827 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5828 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5829 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5830 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5831 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5832 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5833 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5834 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5835 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5836 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5837 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5838 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5839 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5840 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5841 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5842 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5843 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5844 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5845 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5846 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5847 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5848 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5849 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5850 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5851 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5852 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5853 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5854 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5855 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5856 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5857 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5858 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5859 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5860 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5861 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5862 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5863 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5864 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5865 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5866 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5867 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5868 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5869 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5870 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5871 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5872 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5873 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5874 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5875 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5876 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5877 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5878 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5879 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5880 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5881 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5882 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5883 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5884 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5885 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5886 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5887 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5888 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5889 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5890 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5891 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5892 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5893 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5894 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5895 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5896 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5897 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5898 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5899 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5900 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5901 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5902 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5903 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5904 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5905 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5906 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5907 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5908 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5909 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5910 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5911 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5912 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5913 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5914 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5915 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5916 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5917 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5918 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5919 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5920 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5921 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5922 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5923 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5924 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5925 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5926 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5927 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5928 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5929 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5930 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5931 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5932 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5933 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5934 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5935 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5936 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5937 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5938 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5939 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5940 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5941 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5942 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5943 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5944 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5945 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5946 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5947 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5948 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5949 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5950 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5951 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5952 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5953 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5954 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5955 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5956 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5957 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5958 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5959 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5960 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5961 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5962 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5963 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5964 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5965 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5966 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5967 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5968 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5969 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5970 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5971 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5972 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5973 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5974 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5975 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5976 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5977 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5978 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5979 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5980 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5981 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5982 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5983 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5984 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5985 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5986 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5987 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5988 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5989 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5990 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5991 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5992 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5993 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5994 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5995 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5996 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5997 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5998 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 5999 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6000 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6001 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6002 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6003 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6004 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6005 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6006 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6007 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6008 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6009 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6010 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6011 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6012 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6013 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6014 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6015 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6016 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6017 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6018 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6019 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6020 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6021 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6022 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6023 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6024 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6025 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6026 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6027 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6028 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6029 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6030 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6031 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6032 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6033 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6034 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6035 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6036 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6037 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6038 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6039 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6040 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6041 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6042 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6043 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6044 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6045 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6046 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6047 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6048 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6049 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6050 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6051 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6052 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6053 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6054 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6055 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6056 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6057 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6058 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6059 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6060 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6061 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6062 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6063 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6064 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6065 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6066 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6067 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6068 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6069 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6070 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6071 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6072 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6073 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6074 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6075 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6076 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6077 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6078 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6079 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6080 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6081 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6082 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6083 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6084 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6085 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6086 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6087 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6088 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6089 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6090 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6091 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6092 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6093 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6094 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6095 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6096 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6097 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6098 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6099 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6100 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6101 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6102 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6103 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6104 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6105 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6106 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6107 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6108 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6109 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6110 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6111 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6112 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6113 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6114 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6115 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6116 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6117 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6118 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6119 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6120 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6121 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6122 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6123 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6124 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6125 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6126 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6127 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6128 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6129 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6130 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6131 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6132 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6133 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6134 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6135 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6136 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6137 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6138 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6139 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6140 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6141 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6142 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6143 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6144 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6145 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6146 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6147 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6148 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6149 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6150 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6151 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6152 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6153 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6154 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6155 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6156 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6157 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6158 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6159 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6160 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6161 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6162 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6163 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6164 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6165 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6166 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6167 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6168 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6169 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6170 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6171 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6172 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6173 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6174 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6175 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6176 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6177 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6178 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6179 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6180 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6181 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6182 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6183 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6184 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6185 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6186 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6187 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6188 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6189 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6190 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6191 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6192 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6193 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6194 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6195 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6196 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6197 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6198 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6199 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6200 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6201 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6202 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6203 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6204 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6205 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6206 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6207 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6208 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6209 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6210 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6211 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6212 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6213 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6214 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6215 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6216 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6217 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6218 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6219 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6220 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6221 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6222 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6223 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6224 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6225 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6226 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6227 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6228 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6229 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6230 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6231 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6232 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6233 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6234 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6235 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6236 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6237 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6238 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6239 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6240 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6241 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6242 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6243 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6244 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6245 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6246 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6247 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6248 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6249 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6250 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6251 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6252 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6253 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6254 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6255 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6256 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6257 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6258 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6259 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6260 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6261 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6262 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6263 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6264 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6265 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6266 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6267 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6268 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6269 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6270 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6271 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6272 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6273 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6274 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6275 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6276 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6277 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6278 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6279 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6280 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6281 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6282 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6283 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6284 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6285 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6286 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6287 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6288 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6289 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6290 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6291 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6292 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6293 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6294 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6295 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6296 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6297 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6298 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6299 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6300 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6301 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6302 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6303 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6304 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6305 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6306 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6307 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6308 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6309 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6310 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6311 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6312 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6313 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6314 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6315 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6316 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6317 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6318 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6319 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6320 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6321 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6322 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6323 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6324 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6325 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6326 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6327 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6328 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6329 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6330 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6331 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6332 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6333 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6334 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6335 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6336 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6337 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6338 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6339 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6340 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6341 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6342 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6343 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6344 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6345 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6346 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6347 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6348 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6349 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6350 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6351 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6352 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6353 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6354 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6355 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6356 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6357 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6358 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6359 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6360 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6361 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6362 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6363 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6364 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6365 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6366 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6367 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6368 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6369 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6370 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6371 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6372 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6373 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6374 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6375 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6376 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6377 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6378 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6379 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6380 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6381 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6382 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6383 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6384 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6385 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6386 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6387 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6388 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6389 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6390 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6391 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6392 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6393 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6394 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6395 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6396 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6397 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6398 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6399 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6400 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6401 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6402 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6403 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6404 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6405 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6406 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6407 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6408 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6409 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6410 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6411 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6412 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6413 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6414 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6415 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6416 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6417 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6418 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6419 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6420 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6421 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6422 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6423 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6424 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6425 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6426 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6427 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6428 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6429 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6430 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6431 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6432 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6433 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6434 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6435 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6436 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6437 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6438 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6439 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6440 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6441 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6442 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6443 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6444 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6445 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6446 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6447 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6448 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6449 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6450 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6451 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6452 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6453 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6454 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6455 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6456 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6457 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6458 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6459 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6460 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6461 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6462 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6463 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6464 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6465 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6466 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6467 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6468 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6469 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6470 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6471 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6472 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6473 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6474 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6475 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6476 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6477 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6478 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6479 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6480 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6481 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6482 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6483 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6484 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6485 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6486 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6487 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6488 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6489 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6490 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6491 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6492 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6493 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6494 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6495 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6496 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6497 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6498 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6499 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6500 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6501 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6502 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6503 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6504 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6505 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6506 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6507 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6508 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6509 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6510 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6511 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6512 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6513 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6514 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6515 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6516 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6517 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6518 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6519 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6520 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6521 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6522 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6523 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6524 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6525 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6526 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6527 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6528 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6529 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6530 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6531 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6532 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6533 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6534 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6535 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6536 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6537 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6538 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6539 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6540 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6541 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6542 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6543 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6544 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6545 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6546 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6547 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6548 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6549 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6550 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6551 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6552 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6553 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6554 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6555 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6556 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6557 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6558 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6559 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6560 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6561 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6562 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6563 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6564 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6565 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6566 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6567 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6568 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6569 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6570 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6571 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6572 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6573 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6574 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6575 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6576 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6577 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6578 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6579 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6580 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6581 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6582 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6583 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6584 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6585 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6586 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6587 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6588 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6589 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6590 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6591 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6592 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6593 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6594 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6595 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6596 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6597 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6598 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6599 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6600 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6601 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6602 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6603 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6604 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6605 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6606 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6607 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6608 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6609 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6610 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6611 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6612 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6613 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6614 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6615 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6616 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6617 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6618 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6619 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6620 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6621 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6622 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6623 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6624 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6625 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6626 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6627 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6628 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6629 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6630 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6631 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6632 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6633 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6634 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6635 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6636 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6637 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6638 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6639 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6640 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6641 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6642 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6643 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6644 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6645 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6646 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6647 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6648 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6649 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6650 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6651 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6652 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6653 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6654 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6655 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6656 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6657 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6658 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6659 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6660 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6661 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6662 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6663 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6664 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6665 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6666 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6667 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6668 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6669 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6670 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6671 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6672 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6673 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6674 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6675 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6676 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6677 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6678 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6679 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6680 - rva: 12128 - offset: 9056 + rva: 0x2f60 + offset: 0x2360 - ordinal: 6681 - rva: 11376 - offset: 8304 + rva: 0x2c70 + offset: 0x2070 - ordinal: 6682 - rva: 14752 - offset: 11680 + rva: 0x39a0 + offset: 0x2da0 - ordinal: 6683 - rva: 14624 - offset: 11552 + rva: 0x3920 + offset: 0x2d20 - ordinal: 6684 - rva: 14432 - offset: 11360 + rva: 0x3860 + offset: 0x2c60 - ordinal: 6685 - rva: 14304 - offset: 11232 + rva: 0x37e0 + offset: 0x2be0 - ordinal: 6686 - rva: 14176 - offset: 11104 + rva: 0x3760 + offset: 0x2b60 - ordinal: 6687 - rva: 14048 - offset: 10976 + rva: 0x36e0 + offset: 0x2ae0 - ordinal: 6688 - rva: 13920 - offset: 10848 + rva: 0x3660 + offset: 0x2a60 - ordinal: 6689 - rva: 13792 - offset: 10720 + rva: 0x35e0 + offset: 0x29e0 - ordinal: 6690 - rva: 13664 - offset: 10592 + rva: 0x3560 + offset: 0x2960 - ordinal: 6691 - rva: 13536 - offset: 10464 + rva: 0x34e0 + offset: 0x28e0 - ordinal: 6692 - rva: 13408 - offset: 10336 + rva: 0x3460 + offset: 0x2860 - ordinal: 6693 - rva: 13248 - offset: 10176 + rva: 0x33c0 + offset: 0x27c0 - ordinal: 6694 - rva: 13088 - offset: 10016 + rva: 0x3320 + offset: 0x2720 - ordinal: 6695 - rva: 12864 - offset: 9792 + rva: 0x3240 + offset: 0x2640 - ordinal: 6696 - rva: 12736 - offset: 9664 + rva: 0x31c0 + offset: 0x25c0 - ordinal: 6697 - rva: 12608 - offset: 9536 + rva: 0x3140 + offset: 0x2540 - ordinal: 6698 - rva: 11664 - offset: 8592 + rva: 0x2d90 + offset: 0x2190 - ordinal: 6699 - rva: 11072 - offset: 8000 + rva: 0x2b40 + offset: 0x1f40 - ordinal: 6700 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6701 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6702 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6703 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6704 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6705 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6706 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6707 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6708 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6709 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6710 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6711 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6712 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6713 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6714 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6715 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6716 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6717 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6718 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6719 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6720 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6721 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6722 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6723 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6724 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6725 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6726 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6727 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6728 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6729 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6730 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6731 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6732 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6733 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6734 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6735 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6736 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6737 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6738 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6739 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6740 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6741 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6742 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6743 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6744 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6745 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6746 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6747 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6748 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6749 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6750 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6751 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6752 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6753 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6754 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6755 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6756 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6757 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6758 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6759 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6760 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6761 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6762 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6763 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6764 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6765 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6766 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6767 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6768 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6769 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6770 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6771 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6772 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6773 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6774 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6775 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6776 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6777 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6778 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6779 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6780 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6781 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6782 - rva: 16368 - offset: 13296 + rva: 0x3ff0 + offset: 0x33f0 - ordinal: 6783 - rva: 16848 - offset: 13776 + rva: 0x41d0 + offset: 0x35d0 - ordinal: 6784 - rva: 17584 - offset: 14512 + rva: 0x44b0 + offset: 0x38b0 - ordinal: 6785 - rva: 17392 - offset: 14320 + rva: 0x43f0 + offset: 0x37f0 - ordinal: 6786 - rva: 17264 - offset: 14192 + rva: 0x4370 + offset: 0x3770 - ordinal: 6787 - rva: 17136 - offset: 14064 + rva: 0x42f0 + offset: 0x36f0 - ordinal: 6788 - rva: 13920 - offset: 10848 + rva: 0x3660 + offset: 0x2a60 - ordinal: 6789 - rva: 13792 - offset: 10720 + rva: 0x35e0 + offset: 0x29e0 - ordinal: 6790 - rva: 13664 - offset: 10592 + rva: 0x3560 + offset: 0x2960 - ordinal: 6791 - rva: 13536 - offset: 10464 + rva: 0x34e0 + offset: 0x28e0 - ordinal: 6792 - rva: 13408 - offset: 10336 + rva: 0x3460 + offset: 0x2860 - ordinal: 6793 - rva: 13248 - offset: 10176 + rva: 0x33c0 + offset: 0x27c0 - ordinal: 6794 - rva: 13088 - offset: 10016 + rva: 0x3320 + offset: 0x2720 - ordinal: 6795 - rva: 12864 - offset: 9792 + rva: 0x3240 + offset: 0x2640 - ordinal: 6796 - rva: 12736 - offset: 9664 + rva: 0x31c0 + offset: 0x25c0 - ordinal: 6797 - rva: 12608 - offset: 9536 + rva: 0x3140 + offset: 0x2540 - ordinal: 6798 - rva: 15904 - offset: 12832 + rva: 0x3e20 + offset: 0x3220 - ordinal: 6799 - rva: 15600 - offset: 12528 + rva: 0x3cf0 + offset: 0x30f0 - ordinal: 6800 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6801 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6802 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6803 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6804 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6805 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6806 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6807 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6808 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6809 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6810 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6811 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6812 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6813 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6814 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6815 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6816 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6817 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6818 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6819 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6820 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6821 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6822 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6823 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6824 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6825 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6826 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6827 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6828 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6829 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6830 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6831 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6832 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6833 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6834 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6835 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6836 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6837 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6838 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6839 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6840 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6841 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6842 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6843 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6844 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6845 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6846 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6847 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6848 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6849 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6850 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6851 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6852 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6853 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6854 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6855 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6856 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6857 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6858 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6859 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6860 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6861 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6862 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6863 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6864 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6865 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6866 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6867 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6868 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6869 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6870 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6871 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6872 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6873 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6874 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6875 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6876 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6877 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6878 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6879 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6880 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6881 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6882 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6883 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6884 - rva: 14432 - offset: 11360 + rva: 0x3860 + offset: 0x2c60 - ordinal: 6885 - rva: 14304 - offset: 11232 + rva: 0x37e0 + offset: 0x2be0 - ordinal: 6886 - rva: 14176 - offset: 11104 + rva: 0x3760 + offset: 0x2b60 - ordinal: 6887 - rva: 14048 - offset: 10976 + rva: 0x36e0 + offset: 0x2ae0 - ordinal: 6888 - rva: 13920 - offset: 10848 + rva: 0x3660 + offset: 0x2a60 - ordinal: 6889 - rva: 13792 - offset: 10720 + rva: 0x35e0 + offset: 0x29e0 - ordinal: 6890 - rva: 13664 - offset: 10592 + rva: 0x3560 + offset: 0x2960 - ordinal: 6891 - rva: 13536 - offset: 10464 + rva: 0x34e0 + offset: 0x28e0 - ordinal: 6892 - rva: 13408 - offset: 10336 + rva: 0x3460 + offset: 0x2860 - ordinal: 6893 - rva: 13248 - offset: 10176 + rva: 0x33c0 + offset: 0x27c0 - ordinal: 6894 - rva: 13088 - offset: 10016 + rva: 0x3320 + offset: 0x2720 - ordinal: 6895 - rva: 19120 - offset: 16048 + rva: 0x4ab0 + offset: 0x3eb0 - ordinal: 6896 - rva: 12736 - offset: 9664 + rva: 0x31c0 + offset: 0x25c0 - ordinal: 6897 - rva: 12608 - offset: 9536 + rva: 0x3140 + offset: 0x2540 - ordinal: 6898 - rva: 20752 - offset: 17680 + rva: 0x5110 + offset: 0x4510 - ordinal: 6899 - rva: 20448 - offset: 17376 + rva: 0x4fe0 + offset: 0x43e0 - ordinal: 6900 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6901 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6902 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6903 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6904 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6905 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6906 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6907 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6908 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6909 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6910 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6911 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6912 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6913 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6914 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6915 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6916 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6917 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6918 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6919 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6920 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6921 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6922 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6923 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6924 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6925 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6926 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6927 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6928 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6929 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6930 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6931 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6932 - rva: 11056 - offset: 7984 + rva: 0x2b30 + offset: 0x1f30 - ordinal: 6933 - rva: 5024 - offset: 1952 + rva: 0x13a0 + offset: 0x7a0 - ordinal: 6934 - rva: 6336 - offset: 3264 + rva: 0x18c0 + offset: 0xcc0 - ordinal: 6935 - rva: 6208 - offset: 3136 + rva: 0x1840 + offset: 0xc40 - ordinal: 6936 - rva: 7232 - offset: 4160 + rva: 0x1c40 + offset: 0x1040 - ordinal: 6937 - rva: 7104 - offset: 4032 + rva: 0x1bc0 + offset: 0xfc0 - ordinal: 6938 - rva: 6976 - offset: 3904 + rva: 0x1b40 + offset: 0xf40 - ordinal: 6939 - rva: 6848 - offset: 3776 + rva: 0x1ac0 + offset: 0xec0 - ordinal: 6940 - rva: 6720 - offset: 3648 + rva: 0x1a40 + offset: 0xe40 - ordinal: 6941 - rva: 5824 - offset: 2752 + rva: 0x16c0 + offset: 0xac0 - ordinal: 6942 - rva: 8096 - offset: 5024 + rva: 0x1fa0 + offset: 0x13a0 - ordinal: 6943 - rva: 7968 - offset: 4896 + rva: 0x1f20 + offset: 0x1320 - ordinal: 6944 - rva: 7840 - offset: 4768 + rva: 0x1ea0 + offset: 0x12a0 - ordinal: 6945 - rva: 7488 - offset: 4416 + rva: 0x1d40 + offset: 0x1140 - ordinal: 6946 - rva: 7360 - offset: 4288 + rva: 0x1cc0 + offset: 0x10c0 - ordinal: 6947 - rva: 6592 - offset: 3520 + rva: 0x19c0 + offset: 0xdc0 - ordinal: 6948 - rva: 6464 - offset: 3392 + rva: 0x1940 + offset: 0xd40 - ordinal: 6949 - rva: 6080 - offset: 3008 + rva: 0x17c0 + offset: 0xbc0 - ordinal: 6950 - rva: 5952 - offset: 2880 + rva: 0x1740 + offset: 0xb40 - ordinal: 6951 - rva: 5696 - offset: 2624 + rva: 0x1640 + offset: 0xa40 - ordinal: 6952 - rva: 5520 - offset: 2448 + rva: 0x1590 + offset: 0x990 - ordinal: 6953 - rva: 5152 - offset: 2080 + rva: 0x1420 + offset: 0x820 - ordinal: 6954 - rva: 4896 - offset: 1824 + rva: 0x1320 + offset: 0x720 - ordinal: 6955 - rva: 4768 - offset: 1696 + rva: 0x12a0 + offset: 0x6a0 - ordinal: 6956 - rva: 4640 - offset: 1568 + rva: 0x1220 + offset: 0x620 - ordinal: 6957 - rva: 4576 - offset: 1504 + rva: 0x11e0 + offset: 0x5e0 - ordinal: 6958 - rva: 4112 - offset: 1040 + rva: 0x1010 + offset: 0x410 - ordinal: 6959 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6960 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6961 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6962 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6963 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6964 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6965 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6966 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6967 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6968 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6969 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6970 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6971 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6972 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6973 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6974 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6975 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6976 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6977 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6978 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6979 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6980 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6981 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6982 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6983 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6984 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6985 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6986 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6987 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6988 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6989 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6990 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6991 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6992 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6993 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6994 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6995 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6996 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6997 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6998 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 6999 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 7000 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 7001 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 7002 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 7003 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 7004 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 7005 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 7006 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 7007 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 7008 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 7009 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 7010 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 7011 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 7012 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 7013 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 7014 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 7015 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 7016 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 7017 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 7018 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 7019 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 7020 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 7021 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 7022 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 7023 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 7024 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 7025 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 7026 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 7027 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 7028 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 7029 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 7030 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 7031 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 7032 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 7033 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 7034 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 7035 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 7036 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 7037 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 7038 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 7039 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 7040 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 7041 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 7042 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 7043 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 7044 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 7045 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 7046 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 7047 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 7048 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 7049 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 7050 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 7051 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 7052 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 7053 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 7054 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 7055 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 7056 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 7057 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 7058 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 7059 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 7060 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 7061 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 7062 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 7063 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 7064 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 7065 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 7066 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 7067 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 7068 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 7069 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 7070 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 7071 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 7072 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 7073 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 7074 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 7075 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 7076 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 7077 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 7078 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 7079 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 7080 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 7081 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 7082 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 7083 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 7084 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 7085 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 7086 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 7087 - rva: 0 - offset: 0 + rva: 0x0 + offset: 0x0 - ordinal: 7088 - rva: 19600 - offset: 16528 + rva: 0x4c90 + offset: 0x4090 - ordinal: 7089 - rva: 19472 - offset: 16400 + rva: 0x4c10 + offset: 0x4010 - ordinal: 7090 - rva: 19344 - offset: 16272 + rva: 0x4b90 + offset: 0x3f90 - ordinal: 7091 - rva: 13536 - offset: 10464 + rva: 0x34e0 + offset: 0x28e0 - ordinal: 7092 - rva: 13408 - offset: 10336 + rva: 0x3460 + offset: 0x2860 - ordinal: 7093 - rva: 13248 - offset: 10176 + rva: 0x33c0 + offset: 0x27c0 - ordinal: 7094 - rva: 13088 - offset: 10016 + rva: 0x3320 + offset: 0x2720 - ordinal: 7095 - rva: 19120 - offset: 16048 + rva: 0x4ab0 + offset: 0x3eb0 - ordinal: 7096 - rva: 12736 - offset: 9664 + rva: 0x31c0 + offset: 0x25c0 - ordinal: 7097 - rva: 12608 - offset: 9536 + rva: 0x3140 + offset: 0x2540 - ordinal: 7098 - rva: 18672 - offset: 15600 + rva: 0x48f0 + offset: 0x3cf0 - ordinal: 7099 - rva: 18368 - offset: 15296 + rva: 0x47c0 + offset: 0x3bc0 is_signed: true signatures: - subject: "/CN=AMD PMP-PE CB Code Signer v20220131" @@ -18299,5 +18299,5 @@ signatures: not_before: 1633026145 # 2021-09-30 18:22:25 UTC not_after: 1917023545 # 2030-09-30 18:32:25 UTC overlay: - offset: 165376 - size: 44192 \ No newline at end of file + offset: 0x28600 + size: 0xaca0 \ No newline at end of file diff --git a/lib/src/modules/pe/tests/testdata/a2b0ec36f0c6b6925431f38c3a4b2373a8804e347bbe9c65f0fc8648745b25a9.out b/lib/src/modules/pe/tests/testdata/a2b0ec36f0c6b6925431f38c3a4b2373a8804e347bbe9c65f0fc8648745b25a9.out index 6468f367c..99465fc0c 100644 --- a/lib/src/modules/pe/tests/testdata/a2b0ec36f0c6b6925431f38c3a4b2373a8804e347bbe9c65f0fc8648745b25a9.out +++ b/lib/src/modules/pe/tests/testdata/a2b0ec36f0c6b6925431f38c3a4b2373a8804e347bbe9c65f0fc8648745b25a9.out @@ -17,27 +17,27 @@ opthdr_magic: IMAGE_NT_OPTIONAL_HDR32_MAGIC characteristics: 0x10f # RELOCS_STRIPPED | EXECUTABLE_IMAGE | LINE_NUMS_STRIPPED | LOCAL_SYMS_STRIPPED | MACHINE_32BIT dll_characteristics: 0x0 timestamp: 1132705302 # 2005-11-23 00:21:42 UTC -image_base: 4194304 +image_base: 0x400000 checksum: 0 -base_of_code: 1015808 -base_of_data: 2134016 -entry_point: 1118256 -entry_point_raw: 2133040 +base_of_code: 0xf8000 +base_of_data: 0x209000 +entry_point: 0x111030 +entry_point_raw: 0x208c30 export_timestamp: 1307160866 # 2011-06-04 04:14:26 UTC -section_alignment: 4096 -file_alignment: 512 -loader_flags: 0 -size_of_optional_header: 224 -size_of_code: 1118208 -size_of_initialized_data: 4096 -size_of_uninitialized_data: 1011712 -size_of_image: 2211840 -size_of_headers: 4096 -size_of_stack_reserve: 1048576 -size_of_stack_commit: 4096 -size_of_heap_reserve: 1048576 -size_of_heap_commit: 4096 -pointer_to_symbol_table: 0 +section_alignment: 0x1000 +file_alignment: 0x200 +loader_flags: 0x0 +size_of_optional_header: 0xe0 +size_of_code: 0x111000 +size_of_initialized_data: 0x1000 +size_of_uninitialized_data: 0xf7000 +size_of_image: 0x21c000 +size_of_headers: 0x1000 +size_of_stack_reserve: 0x100000 +size_of_stack_commit: 0x1000 +size_of_heap_reserve: 0x100000 +size_of_heap_commit: 0x1000 +pointer_to_symbol_table: 0x0 win32_version_value: 0 number_of_symbols: 0 number_of_rva_and_sizes: 16 @@ -89,8 +89,8 @@ version_info_list: - key: "SpecialBuild" value: "" rich_signature: - offset: 128 - length: 96 + offset: 0x80 + length: 0x60 key: 977732471 raw_data: "3b)iw\x03G:w\x03G:w\x03G:\x0c\x1fK:{\x03G:\x18\x1cL:}\x03G:\xf4\x1fI:k\x03G:\x18\x1cM:\xff\x03G:w\x03G:g\x03G:w\x03F:\x9a\x03G:\x15\x1cT:z\x03G:q L:p\x02G:\xb0\x05A:v\x03G:\x88#C:v\x03G:" clear_data: "DanS\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00{\x1c\x0c\x00\x0c\x00\x00\x00o\x1f\x0b\x00\n\x00\x00\x00\x83\x1c\x0e\x00\x1c\x00\x00\x00o\x1f\n\x00\x88\x00\x00\x00\x00\x00\x00\x00\x10\x00\x00\x00\x00\x00\x01\x00\xed\x00\x00\x00b\x1f\x13\x00\r\x00\x00\x00\x06#\x0b\x00\x07\x01\x00\x00\xc7\x06\x06\x00\x01\x00\x00\x00\xff \x04\x00\x01\x00\x00\x00" @@ -128,215 +128,215 @@ rich_signature: sections: - name: "UPX0" full_name: "UPX0" - characteristics: 3758096512 - raw_data_size: 0 - raw_data_offset: 1024 - virtual_address: 4096 - virtual_size: 1011712 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0xe0000080 + raw_data_size: 0x0 + raw_data_offset: 0x400 + virtual_address: 0x1000 + virtual_size: 0xf7000 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: "UPX1" full_name: "UPX1" - characteristics: 3758096448 - raw_data_size: 1117696 - raw_data_offset: 1024 - virtual_address: 1015808 - virtual_size: 1118208 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0xe0000040 + raw_data_size: 0x110e00 + raw_data_offset: 0x400 + virtual_address: 0xf8000 + virtual_size: 0x111000 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".rsrc" full_name: ".rsrc" - characteristics: 3221225536 - raw_data_size: 3584 - raw_data_offset: 1118720 - virtual_address: 2134016 - virtual_size: 4096 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0xc0000040 + raw_data_size: 0xe00 + raw_data_offset: 0x111200 + virtual_address: 0x209000 + virtual_size: 0x1000 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".9UPX1" full_name: ".9UPX1" - characteristics: 3758096416 - raw_data_size: 73728 - raw_data_offset: 1122304 - virtual_address: 2138112 - virtual_size: 73728 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0xe0000020 # SECTION_MEM_READ | SECTION_MEM_WRITE | SECTION_SCALE_INDEX + raw_data_size: 0x12000 + raw_data_offset: 0x112000 + virtual_address: 0x20a000 + virtual_size: 0x12000 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 20 data_directories: - - virtual_address: 1463360 - size: 204 - - virtual_address: 2137064 - size: 420 - - virtual_address: 2134016 - size: 3048 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 + - virtual_address: 0x165440 + size: 0xcc + - virtual_address: 0x209be8 + size: 0x1a4 + - virtual_address: 0x209000 + size: 0xbe8 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 resource_timestamp: 0 # 1970-01-01 00:00:00 UTC resource_version: major: 0 minor: 0 resources: - - length: 1628 - rva: 1614336 - offset: 599552 + - length: 0x65c + rva: 0x18a200 + offset: 0x92600 type: RESOURCE_TYPE_BITMAP id: 111 language: 1033 - - length: 1710 - rva: 1615968 - offset: 601184 + - length: 0x6ae + rva: 0x18a860 + offset: 0x92c60 type: RESOURCE_TYPE_BITMAP id: 112 language: 1033 - - length: 1636 - rva: 1617680 - offset: 602896 + - length: 0x664 + rva: 0x18af10 + offset: 0x93310 type: RESOURCE_TYPE_BITMAP id: 113 language: 1033 - - length: 1764 - rva: 1619320 - offset: 604536 + - length: 0x6e4 + rva: 0x18b578 + offset: 0x93978 type: RESOURCE_TYPE_BITMAP id: 120 language: 1033 - - length: 416 - rva: 1621088 - offset: 606304 + - length: 0x1a0 + rva: 0x18bc60 + offset: 0x94060 type: RESOURCE_TYPE_BITMAP id: 121 language: 1033 - - length: 350 - rva: 1621504 - offset: 606720 + - length: 0x15e + rva: 0x18be00 + offset: 0x94200 type: RESOURCE_TYPE_BITMAP id: 122 language: 1033 - - length: 412 - rva: 1621856 - offset: 607072 + - length: 0x19c + rva: 0x18bf60 + offset: 0x94360 type: RESOURCE_TYPE_BITMAP id: 123 language: 1033 - - length: 416 - rva: 1622272 - offset: 607488 + - length: 0x1a0 + rva: 0x18c100 + offset: 0x94500 type: RESOURCE_TYPE_BITMAP id: 124 language: 1033 - - length: 744 - rva: 2135360 - offset: 1120064 + - length: 0x2e8 + rva: 0x209540 + offset: 0x111740 type: RESOURCE_TYPE_ICON id: 1 language: 1033 - - length: 116 - rva: 1611072 - offset: 596288 + - length: 0x74 + rva: 0x189540 + offset: 0x91940 type: RESOURCE_TYPE_MENU language: 1033 name_string: "I\x00D\x00R\x00_\x00M\x00A\x00I\x00N\x00M\x00E\x00N\x00U\x00" - - length: 264 - rva: 1611192 - offset: 596408 + - length: 0x108 + rva: 0x1895b8 + offset: 0x919b8 type: RESOURCE_TYPE_DIALOG id: 102 language: 1033 - - length: 308 - rva: 1611456 - offset: 596672 + - length: 0x134 + rva: 0x1896c0 + offset: 0x91ac0 type: RESOURCE_TYPE_DIALOG id: 104 language: 1033 - - length: 298 - rva: 1611768 - offset: 596984 + - length: 0x12a + rva: 0x1897f8 + offset: 0x91bf8 type: RESOURCE_TYPE_DIALOG id: 106 language: 1033 - - length: 284 - rva: 1612072 - offset: 597288 + - length: 0x11c + rva: 0x189928 + offset: 0x91d28 type: RESOURCE_TYPE_DIALOG id: 117 language: 1033 - - length: 1544 - rva: 1612360 - offset: 597576 + - length: 0x608 + rva: 0x189a48 + offset: 0x91e48 type: RESOURCE_TYPE_DIALOG id: 118 language: 1033 - - length: 428 - rva: 1613904 - offset: 599120 + - length: 0x1ac + rva: 0x18a050 + offset: 0x92450 type: RESOURCE_TYPE_DIALOG id: 122 language: 1033 - - length: 56 - rva: 1623456 - offset: 608672 + - length: 0x38 + rva: 0x18c5a0 + offset: 0x949a0 type: RESOURCE_TYPE_ACCELERATOR language: 1033 name_string: "I\x00D\x00R\x00_\x00A\x00C\x00C\x00E\x00L\x00E\x00R\x00A\x00T\x00O\x00R\x001\x00" - - length: 432640 - rva: 1624448 - offset: 609664 + - length: 0x69a00 + rva: 0x18c980 + offset: 0x94d80 type: RESOURCE_TYPE_RCDATA id: 773 language: 1033 - - length: 17731 - rva: 2057088 - offset: 1042304 + - length: 0x4543 + rva: 0x1f6380 + offset: 0xfe780 type: RESOURCE_TYPE_RCDATA id: 774 language: 1033 - - length: 44888 - rva: 2074824 - offset: 1060040 + - length: 0xaf58 + rva: 0x1fa8c8 + offset: 0x102cc8 type: RESOURCE_TYPE_RCDATA id: 775 language: 1033 - - length: 20 - rva: 2136108 - offset: 1120812 + - length: 0x14 + rva: 0x20982c + offset: 0x111a2c type: RESOURCE_TYPE_GROUP_ICON language: 1033 name_string: "A\x00P\x00P\x00I\x00C\x00O\x00N\x00" - - length: 932 - rva: 2136132 - offset: 1120836 + - length: 0x3a4 + rva: 0x209844 + offset: 0x111a44 type: RESOURCE_TYPE_VERSION id: 1 language: 1033 @@ -345,43 +345,43 @@ import_details: number_of_functions: 3 functions: - name: "LoadLibraryA" - rva: 2137224 + rva: 0x209c88 - name: "GetProcAddress" - rva: 2137228 + rva: 0x209c8c - name: "ExitProcess" - rva: 2137232 + rva: 0x209c90 - library_name: "ADVAPI32.dll" number_of_functions: 1 functions: - name: "IsValidSid" - rva: 2137240 + rva: 0x209c98 - library_name: "COMCTL32.dll" number_of_functions: 1 functions: - name: "ord17" ordinal: 17 - rva: 2137248 + rva: 0x209ca0 - library_name: "GDI32.dll" number_of_functions: 1 functions: - name: "PatBlt" - rva: 2137256 + rva: 0x209ca8 - library_name: "SHELL32.dll" number_of_functions: 1 functions: - name: "SHBrowseForFolderA" - rva: 2137264 + rva: 0x209cb0 - library_name: "USER32.dll" number_of_functions: 1 functions: - name: "GetDC" - rva: 2137272 + rva: 0x209cb8 - library_name: "VERSION.dll" number_of_functions: 1 functions: - name: "VerQueryValueA" - rva: 2137280 + rva: 0x209cc0 is_signed: false overlay: - offset: 1196032 - size: 49152 \ No newline at end of file + offset: 0x124000 + size: 0xc000 \ No newline at end of file diff --git a/lib/src/modules/pe/tests/testdata/abeef1c9452835ba856c3bef32657076b7757c21e9f5c78f6336cfedc87d0b46.out b/lib/src/modules/pe/tests/testdata/abeef1c9452835ba856c3bef32657076b7757c21e9f5c78f6336cfedc87d0b46.out index e91ec2990..88dfb8d14 100644 --- a/lib/src/modules/pe/tests/testdata/abeef1c9452835ba856c3bef32657076b7757c21e9f5c78f6336cfedc87d0b46.out +++ b/lib/src/modules/pe/tests/testdata/abeef1c9452835ba856c3bef32657076b7757c21e9f5c78f6336cfedc87d0b46.out @@ -17,26 +17,26 @@ opthdr_magic: IMAGE_NT_OPTIONAL_HDR32_MAGIC characteristics: 0x818e # EXECUTABLE_IMAGE | LINE_NUMS_STRIPPED | LOCAL_SYMS_STRIPPED | BYTES_REVERSED_LO | MACHINE_32BIT | BYTES_REVERSED_HI dll_characteristics: 0x0 timestamp: 708992537 # 1992-06-19 22:22:17 UTC -image_base: 4194304 +image_base: 0x400000 checksum: 0 -base_of_code: 4096 -base_of_data: 1425408 -entry_point: 1421928 -entry_point_raw: 1425000 -section_alignment: 4096 -file_alignment: 512 -loader_flags: 0 -size_of_optional_header: 224 -size_of_code: 1421312 -size_of_initialized_data: 840704 -size_of_uninitialized_data: 0 -size_of_image: 2285568 -size_of_headers: 1024 -size_of_stack_reserve: 1048576 -size_of_stack_commit: 16384 -size_of_heap_reserve: 1048576 -size_of_heap_commit: 4096 -pointer_to_symbol_table: 0 +base_of_code: 0x1000 +base_of_data: 0x15c000 +entry_point: 0x15b268 +entry_point_raw: 0x15be68 +section_alignment: 0x1000 +file_alignment: 0x200 +loader_flags: 0x0 +size_of_optional_header: 0xe0 +size_of_code: 0x15b000 +size_of_initialized_data: 0xcd400 +size_of_uninitialized_data: 0x0 +size_of_image: 0x22e000 +size_of_headers: 0x400 +size_of_stack_reserve: 0x100000 +size_of_stack_commit: 0x4000 +size_of_heap_reserve: 0x100000 +size_of_heap_commit: 0x1000 +pointer_to_symbol_table: 0x0 win32_version_value: 0 number_of_symbols: 0 number_of_rva_and_sizes: 16 @@ -84,715 +84,715 @@ version_info_list: sections: - name: "CODE" full_name: "CODE" - characteristics: 1610612768 - raw_data_size: 1421312 - raw_data_offset: 1024 - virtual_address: 4096 - virtual_size: 1421036 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0x60000020 # SECTION_MEM_READ | SECTION_MEM_WRITE | SECTION_SCALE_INDEX + raw_data_size: 0x15b000 + raw_data_offset: 0x400 + virtual_address: 0x1000 + virtual_size: 0x15aeec + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: "DATA" full_name: "DATA" - characteristics: 3221225536 - raw_data_size: 14336 - raw_data_offset: 1422336 - virtual_address: 1425408 - virtual_size: 13896 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0xc0000040 + raw_data_size: 0x3800 + raw_data_offset: 0x15b400 + virtual_address: 0x15c000 + virtual_size: 0x3648 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: "BSS" full_name: "BSS" - characteristics: 3221225472 - raw_data_size: 0 - raw_data_offset: 1436672 - virtual_address: 1441792 - virtual_size: 3961 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0xc0000000 + raw_data_size: 0x0 + raw_data_offset: 0x15ec00 + virtual_address: 0x160000 + virtual_size: 0xf79 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".idata" full_name: ".idata" - characteristics: 3221225536 - raw_data_size: 10752 - raw_data_offset: 1436672 - virtual_address: 1445888 - virtual_size: 10418 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0xc0000040 + raw_data_size: 0x2a00 + raw_data_offset: 0x15ec00 + virtual_address: 0x161000 + virtual_size: 0x28b2 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".tls" full_name: ".tls" - characteristics: 3221225472 - raw_data_size: 0 - raw_data_offset: 1447424 - virtual_address: 1458176 - virtual_size: 28 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0xc0000000 + raw_data_size: 0x0 + raw_data_offset: 0x161600 + virtual_address: 0x164000 + virtual_size: 0x1c + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".rdata" full_name: ".rdata" - characteristics: 1342177344 - raw_data_size: 512 - raw_data_offset: 1447424 - virtual_address: 1462272 - virtual_size: 24 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0x50000040 + raw_data_size: 0x200 + raw_data_offset: 0x161600 + virtual_address: 0x165000 + virtual_size: 0x18 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".reloc" full_name: ".reloc" - characteristics: 1342177344 - raw_data_size: 110080 - raw_data_offset: 1447936 - virtual_address: 1466368 - virtual_size: 109956 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0x50000040 + raw_data_size: 0x1ae00 + raw_data_offset: 0x161800 + virtual_address: 0x166000 + virtual_size: 0x1ad84 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".rsrc" full_name: ".rsrc" - characteristics: 1342177344 - raw_data_size: 705024 - raw_data_offset: 1558016 - virtual_address: 1576960 - virtual_size: 705024 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0x50000040 + raw_data_size: 0xac200 + raw_data_offset: 0x17c600 + virtual_address: 0x181000 + virtual_size: 0xac200 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 data_directories: - - virtual_address: 0 - size: 0 - - virtual_address: 1445888 - size: 10418 - - virtual_address: 1576960 - size: 705024 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 1466368 - size: 109956 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 1462272 - size: 24 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x161000 + size: 0x28b2 + - virtual_address: 0x181000 + size: 0xac200 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x166000 + size: 0x1ad84 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x165000 + size: 0x18 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 resource_timestamp: 1284064337 # 2010-09-09 20:32:17 UTC resource_version: major: 0 minor: 0 resources: - - length: 308 - rva: 1582692 - offset: 1563748 + - length: 0x134 + rva: 0x182664 + offset: 0x17dc64 type: RESOURCE_TYPE_CURSOR id: 1 language: 0 - - length: 308 - rva: 1583000 - offset: 1564056 + - length: 0x134 + rva: 0x182798 + offset: 0x17dd98 type: RESOURCE_TYPE_CURSOR id: 2 language: 0 - - length: 308 - rva: 1583308 - offset: 1564364 + - length: 0x134 + rva: 0x1828cc + offset: 0x17decc type: RESOURCE_TYPE_CURSOR id: 3 language: 0 - - length: 308 - rva: 1583616 - offset: 1564672 + - length: 0x134 + rva: 0x182a00 + offset: 0x17e000 type: RESOURCE_TYPE_CURSOR id: 4 language: 0 - - length: 308 - rva: 1583924 - offset: 1564980 + - length: 0x134 + rva: 0x182b34 + offset: 0x17e134 type: RESOURCE_TYPE_CURSOR id: 5 language: 0 - - length: 308 - rva: 1584232 - offset: 1565288 + - length: 0x134 + rva: 0x182c68 + offset: 0x17e268 type: RESOURCE_TYPE_CURSOR id: 6 language: 0 - - length: 308 - rva: 1584540 - offset: 1565596 + - length: 0x134 + rva: 0x182d9c + offset: 0x17e39c type: RESOURCE_TYPE_CURSOR id: 7 language: 0 - - length: 308 - rva: 1584848 - offset: 1565904 + - length: 0x134 + rva: 0x182ed0 + offset: 0x17e4d0 type: RESOURCE_TYPE_CURSOR id: 8 language: 0 - - length: 308 - rva: 1585156 - offset: 1566212 + - length: 0x134 + rva: 0x183004 + offset: 0x17e604 type: RESOURCE_TYPE_CURSOR id: 9 language: 0 - - length: 308 - rva: 1585464 - offset: 1566520 + - length: 0x134 + rva: 0x183138 + offset: 0x17e738 type: RESOURCE_TYPE_CURSOR id: 10 language: 0 - - length: 216 - rva: 1585772 - offset: 1566828 + - length: 0xd8 + rva: 0x18326c + offset: 0x17e86c type: RESOURCE_TYPE_BITMAP language: 0 name_string: "B\x00A\x00C\x00K\x00U\x00P\x00" - - length: 216 - rva: 1585988 - offset: 1567044 + - length: 0xd8 + rva: 0x183344 + offset: 0x17e944 type: RESOURCE_TYPE_BITMAP language: 0 name_string: "B\x00A\x00C\x00K\x00U\x00P\x00G\x00" - - length: 464 - rva: 1586204 - offset: 1567260 + - length: 0x1d0 + rva: 0x18341c + offset: 0x17ea1c type: RESOURCE_TYPE_BITMAP language: 0 name_string: "B\x00B\x00A\x00B\x00O\x00R\x00T\x00" - - length: 484 - rva: 1586668 - offset: 1567724 + - length: 0x1e4 + rva: 0x1835ec + offset: 0x17ebec type: RESOURCE_TYPE_BITMAP language: 0 name_string: "B\x00B\x00A\x00L\x00L\x00" - - length: 464 - rva: 1587152 - offset: 1568208 + - length: 0x1d0 + rva: 0x1837d0 + offset: 0x17edd0 type: RESOURCE_TYPE_BITMAP language: 0 name_string: "B\x00B\x00C\x00A\x00N\x00C\x00E\x00L\x00" - - length: 464 - rva: 1587616 - offset: 1568672 + - length: 0x1d0 + rva: 0x1839a0 + offset: 0x17efa0 type: RESOURCE_TYPE_BITMAP language: 0 name_string: "B\x00B\x00C\x00L\x00O\x00S\x00E\x00" - - length: 464 - rva: 1588080 - offset: 1569136 + - length: 0x1d0 + rva: 0x183b70 + offset: 0x17f170 type: RESOURCE_TYPE_BITMAP language: 0 name_string: "B\x00B\x00H\x00E\x00L\x00P\x00" - - length: 464 - rva: 1588544 - offset: 1569600 + - length: 0x1d0 + rva: 0x183d40 + offset: 0x17f340 type: RESOURCE_TYPE_BITMAP language: 0 name_string: "B\x00B\x00I\x00G\x00N\x00O\x00R\x00E\x00" - - length: 464 - rva: 1589008 - offset: 1570064 + - length: 0x1d0 + rva: 0x183f10 + offset: 0x17f510 type: RESOURCE_TYPE_BITMAP language: 0 name_string: "B\x00B\x00N\x00O\x00" - - length: 464 - rva: 1589472 - offset: 1570528 + - length: 0x1d0 + rva: 0x1840e0 + offset: 0x17f6e0 type: RESOURCE_TYPE_BITMAP language: 0 name_string: "B\x00B\x00O\x00K\x00" - - length: 464 - rva: 1589936 - offset: 1570992 + - length: 0x1d0 + rva: 0x1842b0 + offset: 0x17f8b0 type: RESOURCE_TYPE_BITMAP language: 0 name_string: "B\x00B\x00R\x00E\x00T\x00R\x00Y\x00" - - length: 464 - rva: 1590400 - offset: 1571456 + - length: 0x1d0 + rva: 0x184480 + offset: 0x17fa80 type: RESOURCE_TYPE_BITMAP language: 0 name_string: "B\x00B\x00Y\x00E\x00S\x00" - - length: 224 - rva: 1590864 - offset: 1571920 + - length: 0xe0 + rva: 0x184650 + offset: 0x17fc50 type: RESOURCE_TYPE_BITMAP language: 0 name_string: "C\x00A\x00P\x00T\x00I\x00O\x00N\x00" - - length: 232 - rva: 1591088 - offset: 1572144 + - length: 0xe8 + rva: 0x184730 + offset: 0x17fd30 type: RESOURCE_TYPE_BITMAP language: 0 name_string: "C\x00O\x00L\x00S\x00" - - length: 312 - rva: 1591320 - offset: 1572376 + - length: 0x138 + rva: 0x184818 + offset: 0x17fe18 type: RESOURCE_TYPE_BITMAP language: 0 name_string: "D\x00B\x00N\x00_\x00C\x00A\x00N\x00C\x00E\x00L\x00" - - length: 312 - rva: 1591632 - offset: 1572688 + - length: 0x138 + rva: 0x184950 + offset: 0x17ff50 type: RESOURCE_TYPE_BITMAP language: 0 name_string: "D\x00B\x00N\x00_\x00D\x00E\x00L\x00E\x00T\x00E\x00" - - length: 312 - rva: 1591944 - offset: 1573000 + - length: 0x138 + rva: 0x184a88 + offset: 0x180088 type: RESOURCE_TYPE_BITMAP language: 0 name_string: "D\x00B\x00N\x00_\x00E\x00D\x00I\x00T\x00" - - length: 312 - rva: 1592256 - offset: 1573312 + - length: 0x138 + rva: 0x184bc0 + offset: 0x1801c0 type: RESOURCE_TYPE_BITMAP language: 0 name_string: "D\x00B\x00N\x00_\x00F\x00I\x00R\x00S\x00T\x00" - - length: 312 - rva: 1592568 - offset: 1573624 + - length: 0x138 + rva: 0x184cf8 + offset: 0x1802f8 type: RESOURCE_TYPE_BITMAP language: 0 name_string: "D\x00B\x00N\x00_\x00I\x00N\x00S\x00E\x00R\x00T\x00" - - length: 312 - rva: 1592880 - offset: 1573936 + - length: 0x138 + rva: 0x184e30 + offset: 0x180430 type: RESOURCE_TYPE_BITMAP language: 0 name_string: "D\x00B\x00N\x00_\x00L\x00A\x00S\x00T\x00" - - length: 260 - rva: 1593192 - offset: 1574248 + - length: 0x104 + rva: 0x184f68 + offset: 0x180568 type: RESOURCE_TYPE_BITMAP language: 0 name_string: "D\x00B\x00N\x00_\x00N\x00E\x00X\x00T\x00" - - length: 312 - rva: 1593452 - offset: 1574508 + - length: 0x138 + rva: 0x18506c + offset: 0x18066c type: RESOURCE_TYPE_BITMAP language: 0 name_string: "D\x00B\x00N\x00_\x00P\x00O\x00S\x00T\x00" - - length: 260 - rva: 1593764 - offset: 1574820 + - length: 0x104 + rva: 0x1851a4 + offset: 0x1807a4 type: RESOURCE_TYPE_BITMAP language: 0 name_string: "D\x00B\x00N\x00_\x00P\x00R\x00I\x00O\x00R\x00" - - length: 312 - rva: 1594024 - offset: 1575080 + - length: 0x138 + rva: 0x1852a8 + offset: 0x1808a8 type: RESOURCE_TYPE_BITMAP language: 0 name_string: "D\x00B\x00N\x00_\x00R\x00E\x00F\x00R\x00E\x00S\x00H\x00" - - length: 224 - rva: 1594336 - offset: 1575392 + - length: 0xe0 + rva: 0x1853e0 + offset: 0x1809e0 type: RESOURCE_TYPE_BITMAP language: 0 name_string: "D\x00C\x00L\x00O\x00S\x00E\x00" - - length: 224 - rva: 1594560 - offset: 1575616 + - length: 0xe0 + rva: 0x1854c0 + offset: 0x180ac0 type: RESOURCE_TYPE_BITMAP language: 0 name_string: "D\x00O\x00P\x00E\x00N\x00" - - length: 216 - rva: 1594784 - offset: 1575840 + - length: 0xd8 + rva: 0x1855a0 + offset: 0x180ba0 type: RESOURCE_TYPE_BITMAP language: 0 name_string: "F\x00O\x00R\x00W\x00A\x00R\x00D\x00" - - length: 216 - rva: 1595000 - offset: 1576056 + - length: 0xd8 + rva: 0x185678 + offset: 0x180c78 type: RESOURCE_TYPE_BITMAP language: 0 name_string: "F\x00O\x00R\x00W\x00A\x00R\x00D\x00G\x00" - - length: 132 - rva: 1595216 - offset: 1576272 + - length: 0x84 + rva: 0x185750 + offset: 0x180d50 type: RESOURCE_TYPE_BITMAP language: 0 name_string: "H\x00O\x00M\x00E\x00" - - length: 132 - rva: 1595348 - offset: 1576404 + - length: 0x84 + rva: 0x1857d4 + offset: 0x180dd4 type: RESOURCE_TYPE_BITMAP language: 0 name_string: "H\x00O\x00M\x00E\x00G\x00" - - length: 224 - rva: 1595480 - offset: 1576536 + - length: 0xe0 + rva: 0x185858 + offset: 0x180e58 type: RESOURCE_TYPE_BITMAP language: 0 name_string: "L\x00E\x00F\x00T\x00A\x00R\x00R\x00O\x00W\x00" - - length: 224 - rva: 1595704 - offset: 1576760 + - length: 0xe0 + rva: 0x185938 + offset: 0x180f38 type: RESOURCE_TYPE_BITMAP language: 0 name_string: "P\x00I\x00V\x00O\x00T\x00" - - length: 232 - rva: 1595928 - offset: 1576984 + - length: 0xe8 + rva: 0x185a18 + offset: 0x181018 type: RESOURCE_TYPE_BITMAP language: 0 name_string: "P\x00R\x00E\x00V\x00I\x00E\x00W\x00G\x00L\x00Y\x00P\x00H\x00" - - length: 224 - rva: 1596160 - offset: 1577216 + - length: 0xe0 + rva: 0x185b00 + offset: 0x181100 type: RESOURCE_TYPE_BITMAP language: 0 name_string: "R\x00I\x00G\x00H\x00T\x00A\x00R\x00R\x00O\x00W\x00" - - length: 232 - rva: 1596384 - offset: 1577440 + - length: 0xe8 + rva: 0x185be0 + offset: 0x1811e0 type: RESOURCE_TYPE_BITMAP language: 0 name_string: "R\x00O\x00W\x00S\x00" - - length: 82 - rva: 1596616 - offset: 1577672 + - length: 0x52 + rva: 0x185cc8 + offset: 0x1812c8 type: RESOURCE_TYPE_DIALOG language: 0 name_string: "D\x00L\x00G\x00T\x00E\x00M\x00P\x00L\x00A\x00T\x00E\x00" - - length: 896 - rva: 1596700 - offset: 1577756 + - length: 0x380 + rva: 0x185d1c + offset: 0x18131c type: RESOURCE_TYPE_STRING id: 4064 language: 0 - - length: 884 - rva: 1597596 - offset: 1578652 + - length: 0x374 + rva: 0x18609c + offset: 0x18169c type: RESOURCE_TYPE_STRING id: 4065 language: 0 - - length: 964 - rva: 1598480 - offset: 1579536 + - length: 0x3c4 + rva: 0x186410 + offset: 0x181a10 type: RESOURCE_TYPE_STRING id: 4066 language: 0 - - length: 1160 - rva: 1599444 - offset: 1580500 + - length: 0x488 + rva: 0x1867d4 + offset: 0x181dd4 type: RESOURCE_TYPE_STRING id: 4067 language: 0 - - length: 1968 - rva: 1600604 - offset: 1581660 + - length: 0x7b0 + rva: 0x186c5c + offset: 0x18225c type: RESOURCE_TYPE_STRING id: 4068 language: 0 - - length: 1232 - rva: 1602572 - offset: 1583628 + - length: 0x4d0 + rva: 0x18740c + offset: 0x182a0c type: RESOURCE_TYPE_STRING id: 4069 language: 0 - - length: 1104 - rva: 1603804 - offset: 1584860 + - length: 0x450 + rva: 0x1878dc + offset: 0x182edc type: RESOURCE_TYPE_STRING id: 4070 language: 0 - - length: 1016 - rva: 1604908 - offset: 1585964 + - length: 0x3f8 + rva: 0x187d2c + offset: 0x18332c type: RESOURCE_TYPE_STRING id: 4071 language: 0 - - length: 1120 - rva: 1605924 - offset: 1586980 + - length: 0x460 + rva: 0x188124 + offset: 0x183724 type: RESOURCE_TYPE_STRING id: 4072 language: 0 - - length: 1168 - rva: 1607044 - offset: 1588100 + - length: 0x490 + rva: 0x188584 + offset: 0x183b84 type: RESOURCE_TYPE_STRING id: 4073 language: 0 - - length: 968 - rva: 1608212 - offset: 1589268 + - length: 0x3c8 + rva: 0x188a14 + offset: 0x184014 type: RESOURCE_TYPE_STRING id: 4074 language: 0 - - length: 1144 - rva: 1609180 - offset: 1590236 + - length: 0x478 + rva: 0x188ddc + offset: 0x1843dc type: RESOURCE_TYPE_STRING id: 4075 language: 0 - - length: 1040 - rva: 1610324 - offset: 1591380 + - length: 0x410 + rva: 0x189254 + offset: 0x184854 type: RESOURCE_TYPE_STRING id: 4076 language: 0 - - length: 1204 - rva: 1611364 - offset: 1592420 + - length: 0x4b4 + rva: 0x189664 + offset: 0x184c64 type: RESOURCE_TYPE_STRING id: 4077 language: 0 - - length: 1444 - rva: 1612568 - offset: 1593624 + - length: 0x5a4 + rva: 0x189b18 + offset: 0x185118 type: RESOURCE_TYPE_STRING id: 4078 language: 0 - - length: 556 - rva: 1614012 - offset: 1595068 + - length: 0x22c + rva: 0x18a0bc + offset: 0x1856bc type: RESOURCE_TYPE_STRING id: 4079 language: 0 - - length: 516 - rva: 1614568 - offset: 1595624 + - length: 0x204 + rva: 0x18a2e8 + offset: 0x1858e8 type: RESOURCE_TYPE_STRING id: 4080 language: 0 - - length: 268 - rva: 1615084 - offset: 1596140 + - length: 0x10c + rva: 0x18a4ec + offset: 0x185aec type: RESOURCE_TYPE_STRING id: 4081 language: 0 - - length: 800 - rva: 1615352 - offset: 1596408 + - length: 0x320 + rva: 0x18a5f8 + offset: 0x185bf8 type: RESOURCE_TYPE_STRING id: 4082 language: 0 - - length: 236 - rva: 1616152 - offset: 1597208 + - length: 0xec + rva: 0x18a918 + offset: 0x185f18 type: RESOURCE_TYPE_STRING id: 4083 language: 0 - - length: 248 - rva: 1616388 - offset: 1597444 + - length: 0xf8 + rva: 0x18aa04 + offset: 0x186004 type: RESOURCE_TYPE_STRING id: 4084 language: 0 - - length: 424 - rva: 1616636 - offset: 1597692 + - length: 0x1a8 + rva: 0x18aafc + offset: 0x1860fc type: RESOURCE_TYPE_STRING id: 4085 language: 0 - - length: 1004 - rva: 1617060 - offset: 1598116 + - length: 0x3ec + rva: 0x18aca4 + offset: 0x1862a4 type: RESOURCE_TYPE_STRING id: 4086 language: 0 - - length: 888 - rva: 1618064 - offset: 1599120 + - length: 0x378 + rva: 0x18b090 + offset: 0x186690 type: RESOURCE_TYPE_STRING id: 4087 language: 0 - - length: 940 - rva: 1618952 - offset: 1600008 + - length: 0x3ac + rva: 0x18b408 + offset: 0x186a08 type: RESOURCE_TYPE_STRING id: 4088 language: 0 - - length: 1048 - rva: 1619892 - offset: 1600948 + - length: 0x418 + rva: 0x18b7b4 + offset: 0x186db4 type: RESOURCE_TYPE_STRING id: 4089 language: 0 - - length: 564 - rva: 1620940 - offset: 1601996 + - length: 0x234 + rva: 0x18bbcc + offset: 0x1871cc type: RESOURCE_TYPE_STRING id: 4090 language: 0 - - length: 236 - rva: 1621504 - offset: 1602560 + - length: 0xec + rva: 0x18be00 + offset: 0x187400 type: RESOURCE_TYPE_STRING id: 4091 language: 0 - - length: 496 - rva: 1621740 - offset: 1602796 + - length: 0x1f0 + rva: 0x18beec + offset: 0x1874ec type: RESOURCE_TYPE_STRING id: 4092 language: 0 - - length: 1064 - rva: 1622236 - offset: 1603292 + - length: 0x428 + rva: 0x18c0dc + offset: 0x1876dc type: RESOURCE_TYPE_STRING id: 4093 language: 0 - - length: 956 - rva: 1623300 - offset: 1604356 + - length: 0x3bc + rva: 0x18c504 + offset: 0x187b04 type: RESOURCE_TYPE_STRING id: 4094 language: 0 - - length: 764 - rva: 1624256 - offset: 1605312 + - length: 0x2fc + rva: 0x18c8c0 + offset: 0x187ec0 type: RESOURCE_TYPE_STRING id: 4095 language: 0 - - length: 852 - rva: 1625020 - offset: 1606076 + - length: 0x354 + rva: 0x18cbbc + offset: 0x1881bc type: RESOURCE_TYPE_STRING id: 4096 language: 0 - - length: 648704 - rva: 1625872 - offset: 1606928 + - length: 0x9e600 + rva: 0x18cf10 + offset: 0x188510 type: RESOURCE_TYPE_RCDATA language: 1046 name_string: "D\x00E\x00M\x00O\x00D\x00L\x00L\x00" - - length: 16 - rva: 2274576 - offset: 2255632 + - length: 0x10 + rva: 0x22b510 + offset: 0x226b10 type: RESOURCE_TYPE_RCDATA language: 0 name_string: "D\x00V\x00C\x00L\x00A\x00L\x00" - - length: 1572 - rva: 2274592 - offset: 2255648 + - length: 0x624 + rva: 0x22b520 + offset: 0x226b20 type: RESOURCE_TYPE_RCDATA language: 0 name_string: "P\x00A\x00C\x00K\x00A\x00G\x00E\x00I\x00N\x00F\x00O\x00" - - length: 908 - rva: 2276164 - offset: 2257220 + - length: 0x38c + rva: 0x22bb44 + offset: 0x227144 type: RESOURCE_TYPE_RCDATA language: 0 name_string: "T\x00C\x004\x003\x004\x005\x002\x005\x00" - - length: 1172 - rva: 2277072 - offset: 2258128 + - length: 0x494 + rva: 0x22bed0 + offset: 0x2274d0 type: RESOURCE_TYPE_RCDATA language: 0 name_string: "T\x00L\x00O\x00G\x00I\x00N\x00D\x00I\x00A\x00L\x00O\x00G\x00" - - length: 964 - rva: 2278244 - offset: 2259300 + - length: 0x3c4 + rva: 0x22c364 + offset: 0x227964 type: RESOURCE_TYPE_RCDATA language: 0 name_string: "T\x00P\x00A\x00S\x00S\x00W\x00O\x00R\x00D\x00D\x00I\x00A\x00L\x00O\x00G\x00" - - length: 572 - rva: 2279208 - offset: 2260264 + - length: 0x23c + rva: 0x22c728 + offset: 0x227d28 type: RESOURCE_TYPE_RCDATA language: 0 name_string: "T\x00P\x00R\x00O\x00G\x00R\x00E\x00S\x00S\x00D\x00I\x00A\x00L\x00O\x00G\x00" - - length: 20 - rva: 2279780 - offset: 2260836 + - length: 0x14 + rva: 0x22c964 + offset: 0x227f64 type: RESOURCE_TYPE_GROUP_CURSOR language: 0 name_string: "D\x00I\x00M\x00I\x00N\x00S\x00" - - length: 20 - rva: 2279800 - offset: 2260856 + - length: 0x14 + rva: 0x22c978 + offset: 0x227f78 type: RESOURCE_TYPE_GROUP_CURSOR language: 0 name_string: "D\x00I\x00M\x00M\x00O\x00V\x00E\x00" - - length: 20 - rva: 2279820 - offset: 2260876 + - length: 0x14 + rva: 0x22c98c + offset: 0x227f8c type: RESOURCE_TYPE_GROUP_CURSOR language: 0 name_string: "T\x00E\x00E\x00_\x00C\x00U\x00R\x00S\x00O\x00R\x00_\x00H\x00A\x00N\x00D\x00" - - length: 20 - rva: 2279840 - offset: 2260896 + - length: 0x14 + rva: 0x22c9a0 + offset: 0x227fa0 type: RESOURCE_TYPE_GROUP_CURSOR id: 32761 language: 0 - - length: 20 - rva: 2279860 - offset: 2260916 + - length: 0x14 + rva: 0x22c9b4 + offset: 0x227fb4 type: RESOURCE_TYPE_GROUP_CURSOR id: 32762 language: 0 - - length: 20 - rva: 2279880 - offset: 2260936 + - length: 0x14 + rva: 0x22c9c8 + offset: 0x227fc8 type: RESOURCE_TYPE_GROUP_CURSOR id: 32763 language: 0 - - length: 20 - rva: 2279900 - offset: 2260956 + - length: 0x14 + rva: 0x22c9dc + offset: 0x227fdc type: RESOURCE_TYPE_GROUP_CURSOR id: 32764 language: 0 - - length: 20 - rva: 2279920 - offset: 2260976 + - length: 0x14 + rva: 0x22c9f0 + offset: 0x227ff0 type: RESOURCE_TYPE_GROUP_CURSOR id: 32765 language: 0 - - length: 20 - rva: 2279940 - offset: 2260996 + - length: 0x14 + rva: 0x22ca04 + offset: 0x228004 type: RESOURCE_TYPE_GROUP_CURSOR id: 32766 language: 0 - - length: 20 - rva: 2279960 - offset: 2261016 + - length: 0x14 + rva: 0x22ca18 + offset: 0x228018 type: RESOURCE_TYPE_GROUP_CURSOR id: 32767 language: 0 - - length: 776 - rva: 2279980 - offset: 2261036 + - length: 0x308 + rva: 0x22ca2c + offset: 0x22802c type: RESOURCE_TYPE_VERSION id: 1 language: 1046 - - length: 1160 - rva: 2280756 - offset: 2261812 + - length: 0x488 + rva: 0x22cd34 + offset: 0x228334 type: RESOURCE_TYPE_MANIFEST id: 1 language: 1046 @@ -801,965 +801,965 @@ import_details: number_of_functions: 34 functions: - name: "DeleteCriticalSection" - rva: 1446268 + rva: 0x16117c - name: "LeaveCriticalSection" - rva: 1446272 + rva: 0x161180 - name: "EnterCriticalSection" - rva: 1446276 + rva: 0x161184 - name: "InitializeCriticalSection" - rva: 1446280 + rva: 0x161188 - name: "VirtualFree" - rva: 1446284 + rva: 0x16118c - name: "VirtualAlloc" - rva: 1446288 + rva: 0x161190 - name: "LocalFree" - rva: 1446292 + rva: 0x161194 - name: "LocalAlloc" - rva: 1446296 + rva: 0x161198 - name: "GetVersion" - rva: 1446300 + rva: 0x16119c - name: "GetCurrentThreadId" - rva: 1446304 + rva: 0x1611a0 - name: "InterlockedDecrement" - rva: 1446308 + rva: 0x1611a4 - name: "InterlockedIncrement" - rva: 1446312 + rva: 0x1611a8 - name: "VirtualQuery" - rva: 1446316 + rva: 0x1611ac - name: "WideCharToMultiByte" - rva: 1446320 + rva: 0x1611b0 - name: "MultiByteToWideChar" - rva: 1446324 + rva: 0x1611b4 - name: "lstrlenA" - rva: 1446328 + rva: 0x1611b8 - name: "lstrcpynA" - rva: 1446332 + rva: 0x1611bc - name: "LoadLibraryExA" - rva: 1446336 + rva: 0x1611c0 - name: "GetThreadLocale" - rva: 1446340 + rva: 0x1611c4 - name: "GetStartupInfoA" - rva: 1446344 + rva: 0x1611c8 - name: "GetProcAddress" - rva: 1446348 + rva: 0x1611cc - name: "GetModuleHandleA" - rva: 1446352 + rva: 0x1611d0 - name: "GetModuleFileNameA" - rva: 1446356 + rva: 0x1611d4 - name: "GetLocaleInfoA" - rva: 1446360 + rva: 0x1611d8 - name: "GetCommandLineA" - rva: 1446364 + rva: 0x1611dc - name: "FreeLibrary" - rva: 1446368 + rva: 0x1611e0 - name: "FindFirstFileA" - rva: 1446372 + rva: 0x1611e4 - name: "FindClose" - rva: 1446376 + rva: 0x1611e8 - name: "ExitProcess" - rva: 1446380 + rva: 0x1611ec - name: "WriteFile" - rva: 1446384 + rva: 0x1611f0 - name: "UnhandledExceptionFilter" - rva: 1446388 + rva: 0x1611f4 - name: "RtlUnwind" - rva: 1446392 + rva: 0x1611f8 - name: "RaiseException" - rva: 1446396 + rva: 0x1611fc - name: "GetStdHandle" - rva: 1446400 + rva: 0x161200 - library_name: "user32.dll" number_of_functions: 4 functions: - name: "GetKeyboardType" - rva: 1446408 + rva: 0x161208 - name: "LoadStringA" - rva: 1446412 + rva: 0x16120c - name: "MessageBoxA" - rva: 1446416 + rva: 0x161210 - name: "CharNextA" - rva: 1446420 + rva: 0x161214 - library_name: "advapi32.dll" number_of_functions: 3 functions: - name: "RegQueryValueExA" - rva: 1446428 + rva: 0x16121c - name: "RegOpenKeyExA" - rva: 1446432 + rva: 0x161220 - name: "RegCloseKey" - rva: 1446436 + rva: 0x161224 - library_name: "oleaut32.dll" number_of_functions: 3 functions: - name: "SysFreeString" - rva: 1446444 + rva: 0x16122c - name: "SysReAllocStringLen" - rva: 1446448 + rva: 0x161230 - name: "SysAllocStringLen" - rva: 1446452 + rva: 0x161234 - library_name: "kernel32.dll" number_of_functions: 4 functions: - name: "TlsSetValue" - rva: 1446460 + rva: 0x16123c - name: "TlsGetValue" - rva: 1446464 + rva: 0x161240 - name: "LocalAlloc" - rva: 1446468 + rva: 0x161244 - name: "GetModuleHandleA" - rva: 1446472 + rva: 0x161248 - library_name: "advapi32.dll" number_of_functions: 3 functions: - name: "RegQueryValueExA" - rva: 1446480 + rva: 0x161250 - name: "RegOpenKeyExA" - rva: 1446484 + rva: 0x161254 - name: "RegCloseKey" - rva: 1446488 + rva: 0x161258 - library_name: "kernel32.dll" number_of_functions: 86 functions: - name: "lstrcpyA" - rva: 1446496 + rva: 0x161260 - name: "WriteFile" - rva: 1446500 + rva: 0x161264 - name: "WaitForSingleObject" - rva: 1446504 + rva: 0x161268 - name: "VirtualQuery" - rva: 1446508 + rva: 0x16126c - name: "VirtualProtect" - rva: 1446512 + rva: 0x161270 - name: "VirtualFree" - rva: 1446516 + rva: 0x161274 - name: "VirtualAlloc" - rva: 1446520 + rva: 0x161278 - name: "Sleep" - rva: 1446524 + rva: 0x16127c - name: "SizeofResource" - rva: 1446528 + rva: 0x161280 - name: "SetThreadLocale" - rva: 1446532 + rva: 0x161284 - name: "SetFilePointer" - rva: 1446536 + rva: 0x161288 - name: "SetEvent" - rva: 1446540 + rva: 0x16128c - name: "SetErrorMode" - rva: 1446544 + rva: 0x161290 - name: "SetEndOfFile" - rva: 1446548 + rva: 0x161294 - name: "SearchPathA" - rva: 1446552 + rva: 0x161298 - name: "ResetEvent" - rva: 1446556 + rva: 0x16129c - name: "ReleaseMutex" - rva: 1446560 + rva: 0x1612a0 - name: "ReadFile" - rva: 1446564 + rva: 0x1612a4 - name: "OpenFileMappingA" - rva: 1446568 + rva: 0x1612a8 - name: "MultiByteToWideChar" - rva: 1446572 + rva: 0x1612ac - name: "MulDiv" - rva: 1446576 + rva: 0x1612b0 - name: "LockResource" - rva: 1446580 + rva: 0x1612b4 - name: "LoadResource" - rva: 1446584 + rva: 0x1612b8 - name: "LoadLibraryA" - rva: 1446588 + rva: 0x1612bc - name: "LeaveCriticalSection" - rva: 1446592 + rva: 0x1612c0 - name: "IsDBCSLeadByte" - rva: 1446596 + rva: 0x1612c4 - name: "IsBadReadPtr" - rva: 1446600 + rva: 0x1612c8 - name: "InitializeCriticalSection" - rva: 1446604 + rva: 0x1612cc - name: "HeapFree" - rva: 1446608 + rva: 0x1612d0 - name: "HeapAlloc" - rva: 1446612 + rva: 0x1612d4 - name: "GlobalUnlock" - rva: 1446616 + rva: 0x1612d8 - name: "GlobalReAlloc" - rva: 1446620 + rva: 0x1612dc - name: "GlobalMemoryStatus" - rva: 1446624 + rva: 0x1612e0 - name: "GlobalHandle" - rva: 1446628 + rva: 0x1612e4 - name: "GlobalLock" - rva: 1446632 + rva: 0x1612e8 - name: "GlobalFree" - rva: 1446636 + rva: 0x1612ec - name: "GlobalFindAtomA" - rva: 1446640 + rva: 0x1612f0 - name: "GlobalDeleteAtom" - rva: 1446644 + rva: 0x1612f4 - name: "GlobalAlloc" - rva: 1446648 + rva: 0x1612f8 - name: "GlobalAddAtomA" - rva: 1446652 + rva: 0x1612fc - name: "GetVersionExA" - rva: 1446656 + rva: 0x161300 - name: "GetVersion" - rva: 1446660 + rva: 0x161304 - name: "GetTimeZoneInformation" - rva: 1446664 + rva: 0x161308 - name: "GetTickCount" - rva: 1446668 + rva: 0x16130c - name: "GetThreadLocale" - rva: 1446672 + rva: 0x161310 - name: "GetTempPathA" - rva: 1446676 + rva: 0x161314 - name: "GetSystemInfo" - rva: 1446680 + rva: 0x161318 - name: "GetStringTypeExA" - rva: 1446684 + rva: 0x16131c - name: "GetStdHandle" - rva: 1446688 + rva: 0x161320 - name: "GetProcessHeap" - rva: 1446692 + rva: 0x161324 - name: "GetProcAddress" - rva: 1446696 + rva: 0x161328 - name: "GetModuleHandleA" - rva: 1446700 + rva: 0x16132c - name: "GetModuleFileNameA" - rva: 1446704 + rva: 0x161330 - name: "GetLocaleInfoA" - rva: 1446708 + rva: 0x161334 - name: "GetLocalTime" - rva: 1446712 + rva: 0x161338 - name: "GetLastError" - rva: 1446716 + rva: 0x16133c - name: "GetFullPathNameA" - rva: 1446720 + rva: 0x161340 - name: "GetDiskFreeSpaceA" - rva: 1446724 + rva: 0x161344 - name: "GetDateFormatA" - rva: 1446728 + rva: 0x161348 - name: "GetCurrentThreadId" - rva: 1446732 + rva: 0x16134c - name: "GetCurrentProcessId" - rva: 1446736 + rva: 0x161350 - name: "GetCurrentDirectoryA" - rva: 1446740 + rva: 0x161354 - name: "GetCPInfo" - rva: 1446744 + rva: 0x161358 - name: "GetACP" - rva: 1446748 + rva: 0x16135c - name: "FreeResource" - rva: 1446752 + rva: 0x161360 - name: "InterlockedIncrement" - rva: 1446756 + rva: 0x161364 - name: "InterlockedExchange" - rva: 1446760 + rva: 0x161368 - name: "InterlockedDecrement" - rva: 1446764 + rva: 0x16136c - name: "FreeLibrary" - rva: 1446768 + rva: 0x161370 - name: "FormatMessageA" - rva: 1446772 + rva: 0x161374 - name: "FindResourceA" - rva: 1446776 + rva: 0x161378 - name: "FindFirstFileA" - rva: 1446780 + rva: 0x16137c - name: "FindClose" - rva: 1446784 + rva: 0x161380 - name: "FileTimeToLocalFileTime" - rva: 1446788 + rva: 0x161384 - name: "FileTimeToDosDateTime" - rva: 1446792 + rva: 0x161388 - name: "FatalAppExitA" - rva: 1446796 + rva: 0x16138c - name: "EnumCalendarInfoA" - rva: 1446800 + rva: 0x161390 - name: "EnterCriticalSection" - rva: 1446804 + rva: 0x161394 - name: "DeleteFileA" - rva: 1446808 + rva: 0x161398 - name: "DeleteCriticalSection" - rva: 1446812 + rva: 0x16139c - name: "CreateThread" - rva: 1446816 + rva: 0x1613a0 - name: "CreateMutexA" - rva: 1446820 + rva: 0x1613a4 - name: "CreateFileA" - rva: 1446824 + rva: 0x1613a8 - name: "CreateEventA" - rva: 1446828 + rva: 0x1613ac - name: "CompareStringA" - rva: 1446832 + rva: 0x1613b0 - name: "CloseHandle" - rva: 1446836 + rva: 0x1613b4 - library_name: "version.dll" number_of_functions: 3 functions: - name: "VerQueryValueA" - rva: 1446844 + rva: 0x1613bc - name: "GetFileVersionInfoSizeA" - rva: 1446848 + rva: 0x1613c0 - name: "GetFileVersionInfoA" - rva: 1446852 + rva: 0x1613c4 - library_name: "gdi32.dll" number_of_functions: 73 functions: - name: "UnrealizeObject" - rva: 1446860 + rva: 0x1613cc - name: "StretchBlt" - rva: 1446864 + rva: 0x1613d0 - name: "SetWindowOrgEx" - rva: 1446868 + rva: 0x1613d4 - name: "SetWindowExtEx" - rva: 1446872 + rva: 0x1613d8 - name: "SetWinMetaFileBits" - rva: 1446876 + rva: 0x1613dc - name: "SetViewportOrgEx" - rva: 1446880 + rva: 0x1613e0 - name: "SetViewportExtEx" - rva: 1446884 + rva: 0x1613e4 - name: "SetTextColor" - rva: 1446888 + rva: 0x1613e8 - name: "SetStretchBltMode" - rva: 1446892 + rva: 0x1613ec - name: "SetROP2" - rva: 1446896 + rva: 0x1613f0 - name: "SetPixel" - rva: 1446900 + rva: 0x1613f4 - name: "SetMapMode" - rva: 1446904 + rva: 0x1613f8 - name: "SetEnhMetaFileBits" - rva: 1446908 + rva: 0x1613fc - name: "SetDIBColorTable" - rva: 1446912 + rva: 0x161400 - name: "SetBrushOrgEx" - rva: 1446916 + rva: 0x161404 - name: "SetBkMode" - rva: 1446920 + rva: 0x161408 - name: "SetBkColor" - rva: 1446924 + rva: 0x16140c - name: "SelectPalette" - rva: 1446928 + rva: 0x161410 - name: "SelectObject" - rva: 1446932 + rva: 0x161414 - name: "SelectClipRgn" - rva: 1446936 + rva: 0x161418 - name: "SaveDC" - rva: 1446940 + rva: 0x16141c - name: "RestoreDC" - rva: 1446944 + rva: 0x161420 - name: "Rectangle" - rva: 1446948 + rva: 0x161424 - name: "RectVisible" - rva: 1446952 + rva: 0x161428 - name: "RealizePalette" - rva: 1446956 + rva: 0x16142c - name: "Polyline" - rva: 1446960 + rva: 0x161430 - name: "PolyPolyline" - rva: 1446964 + rva: 0x161434 - name: "PlayEnhMetaFile" - rva: 1446968 + rva: 0x161438 - name: "PatBlt" - rva: 1446972 + rva: 0x16143c - name: "MoveToEx" - rva: 1446976 + rva: 0x161440 - name: "MaskBlt" - rva: 1446980 + rva: 0x161444 - name: "LineTo" - rva: 1446984 + rva: 0x161448 - name: "IntersectClipRect" - rva: 1446988 + rva: 0x16144c - name: "GetWindowOrgEx" - rva: 1446992 + rva: 0x161450 - name: "GetWinMetaFileBits" - rva: 1446996 + rva: 0x161454 - name: "GetTextMetricsA" - rva: 1447000 + rva: 0x161458 - name: "GetTextExtentPointA" - rva: 1447004 + rva: 0x16145c - name: "GetTextExtentPoint32A" - rva: 1447008 + rva: 0x161460 - name: "GetSystemPaletteEntries" - rva: 1447012 + rva: 0x161464 - name: "GetStockObject" - rva: 1447016 + rva: 0x161468 - name: "GetPixel" - rva: 1447020 + rva: 0x16146c - name: "GetPaletteEntries" - rva: 1447024 + rva: 0x161470 - name: "GetObjectA" - rva: 1447028 + rva: 0x161474 - name: "GetEnhMetaFilePaletteEntries" - rva: 1447032 + rva: 0x161478 - name: "GetEnhMetaFileHeader" - rva: 1447036 + rva: 0x16147c - name: "GetEnhMetaFileBits" - rva: 1447040 + rva: 0x161480 - name: "GetDeviceCaps" - rva: 1447044 + rva: 0x161484 - name: "GetDIBits" - rva: 1447048 + rva: 0x161488 - name: "GetDIBColorTable" - rva: 1447052 + rva: 0x16148c - name: "GetDCOrgEx" - rva: 1447056 + rva: 0x161490 - name: "GetCurrentPositionEx" - rva: 1447060 + rva: 0x161494 - name: "GetClipBox" - rva: 1447064 + rva: 0x161498 - name: "GetBrushOrgEx" - rva: 1447068 + rva: 0x16149c - name: "GetBitmapBits" - rva: 1447072 + rva: 0x1614a0 - name: "ExtTextOutA" - rva: 1447076 + rva: 0x1614a4 - name: "ExtCreatePen" - rva: 1447080 + rva: 0x1614a8 - name: "ExcludeClipRect" - rva: 1447084 + rva: 0x1614ac - name: "DeleteObject" - rva: 1447088 + rva: 0x1614b0 - name: "DeleteEnhMetaFile" - rva: 1447092 + rva: 0x1614b4 - name: "DeleteDC" - rva: 1447096 + rva: 0x1614b8 - name: "CreateSolidBrush" - rva: 1447100 + rva: 0x1614bc - name: "CreatePenIndirect" - rva: 1447104 + rva: 0x1614c0 - name: "CreatePalette" - rva: 1447108 + rva: 0x1614c4 - name: "CreateHalftonePalette" - rva: 1447112 + rva: 0x1614c8 - name: "CreateFontIndirectA" - rva: 1447116 + rva: 0x1614cc - name: "CreateDIBitmap" - rva: 1447120 + rva: 0x1614d0 - name: "CreateDIBSection" - rva: 1447124 + rva: 0x1614d4 - name: "CreateCompatibleDC" - rva: 1447128 + rva: 0x1614d8 - name: "CreateCompatibleBitmap" - rva: 1447132 + rva: 0x1614dc - name: "CreateBrushIndirect" - rva: 1447136 + rva: 0x1614e0 - name: "CreateBitmap" - rva: 1447140 + rva: 0x1614e4 - name: "CopyEnhMetaFileA" - rva: 1447144 + rva: 0x1614e8 - name: "BitBlt" - rva: 1447148 + rva: 0x1614ec - library_name: "user32.dll" number_of_functions: 176 functions: - name: "CreateWindowExA" - rva: 1447156 + rva: 0x1614f4 - name: "WindowFromPoint" - rva: 1447160 + rva: 0x1614f8 - name: "WinHelpA" - rva: 1447164 + rva: 0x1614fc - name: "WaitMessage" - rva: 1447168 + rva: 0x161500 - name: "ValidateRect" - rva: 1447172 + rva: 0x161504 - name: "UpdateWindow" - rva: 1447176 + rva: 0x161508 - name: "UnregisterClassA" - rva: 1447180 + rva: 0x16150c - name: "UnionRect" - rva: 1447184 + rva: 0x161510 - name: "UnhookWindowsHookEx" - rva: 1447188 + rva: 0x161514 - name: "TranslateMessage" - rva: 1447192 + rva: 0x161518 - name: "TranslateMDISysAccel" - rva: 1447196 + rva: 0x16151c - name: "TrackPopupMenu" - rva: 1447200 + rva: 0x161520 - name: "SystemParametersInfoA" - rva: 1447204 + rva: 0x161524 - name: "ShowWindow" - rva: 1447208 + rva: 0x161528 - name: "ShowScrollBar" - rva: 1447212 + rva: 0x16152c - name: "ShowOwnedPopups" - rva: 1447216 + rva: 0x161530 - name: "ShowCursor" - rva: 1447220 + rva: 0x161534 - name: "SetWindowsHookExA" - rva: 1447224 + rva: 0x161538 - name: "SetWindowTextA" - rva: 1447228 + rva: 0x16153c - name: "SetWindowPos" - rva: 1447232 + rva: 0x161540 - name: "SetWindowPlacement" - rva: 1447236 + rva: 0x161544 - name: "SetWindowLongA" - rva: 1447240 + rva: 0x161548 - name: "SetTimer" - rva: 1447244 + rva: 0x16154c - name: "SetScrollRange" - rva: 1447248 + rva: 0x161550 - name: "SetScrollPos" - rva: 1447252 + rva: 0x161554 - name: "SetScrollInfo" - rva: 1447256 + rva: 0x161558 - name: "SetRect" - rva: 1447260 + rva: 0x16155c - name: "SetPropA" - rva: 1447264 + rva: 0x161560 - name: "SetParent" - rva: 1447268 + rva: 0x161564 - name: "SetMenuItemInfoA" - rva: 1447272 + rva: 0x161568 - name: "SetMenu" - rva: 1447276 + rva: 0x16156c - name: "SetKeyboardState" - rva: 1447280 + rva: 0x161570 - name: "SetForegroundWindow" - rva: 1447284 + rva: 0x161574 - name: "SetFocus" - rva: 1447288 + rva: 0x161578 - name: "SetCursor" - rva: 1447292 + rva: 0x16157c - name: "SetClipboardData" - rva: 1447296 + rva: 0x161580 - name: "SetClassLongA" - rva: 1447300 + rva: 0x161584 - name: "SetCapture" - rva: 1447304 + rva: 0x161588 - name: "SetActiveWindow" - rva: 1447308 + rva: 0x16158c - name: "SendMessageA" - rva: 1447312 + rva: 0x161590 - name: "ScrollWindowEx" - rva: 1447316 + rva: 0x161594 - name: "ScrollWindow" - rva: 1447320 + rva: 0x161598 - name: "ScreenToClient" - rva: 1447324 + rva: 0x16159c - name: "RemovePropA" - rva: 1447328 + rva: 0x1615a0 - name: "RemoveMenu" - rva: 1447332 + rva: 0x1615a4 - name: "ReleaseDC" - rva: 1447336 + rva: 0x1615a8 - name: "ReleaseCapture" - rva: 1447340 + rva: 0x1615ac - name: "RegisterWindowMessageA" - rva: 1447344 + rva: 0x1615b0 - name: "RegisterClipboardFormatA" - rva: 1447348 + rva: 0x1615b4 - name: "RegisterClassA" - rva: 1447352 + rva: 0x1615b8 - name: "RedrawWindow" - rva: 1447356 + rva: 0x1615bc - name: "PtInRect" - rva: 1447360 + rva: 0x1615c0 - name: "PostQuitMessage" - rva: 1447364 + rva: 0x1615c4 - name: "PostMessageA" - rva: 1447368 + rva: 0x1615c8 - name: "PeekMessageA" - rva: 1447372 + rva: 0x1615cc - name: "OpenClipboard" - rva: 1447376 + rva: 0x1615d0 - name: "OffsetRect" - rva: 1447380 + rva: 0x1615d4 - name: "OemToCharBuffA" - rva: 1447384 + rva: 0x1615d8 - name: "OemToCharA" - rva: 1447388 + rva: 0x1615dc - name: "MessageBoxA" - rva: 1447392 + rva: 0x1615e0 - name: "MessageBeep" - rva: 1447396 + rva: 0x1615e4 - name: "MapWindowPoints" - rva: 1447400 + rva: 0x1615e8 - name: "MapVirtualKeyA" - rva: 1447404 + rva: 0x1615ec - name: "LoadStringA" - rva: 1447408 + rva: 0x1615f0 - name: "LoadKeyboardLayoutA" - rva: 1447412 + rva: 0x1615f4 - name: "LoadIconA" - rva: 1447416 + rva: 0x1615f8 - name: "LoadCursorA" - rva: 1447420 + rva: 0x1615fc - name: "LoadBitmapA" - rva: 1447424 + rva: 0x161600 - name: "KillTimer" - rva: 1447428 + rva: 0x161604 - name: "IsZoomed" - rva: 1447432 + rva: 0x161608 - name: "IsWindowVisible" - rva: 1447436 + rva: 0x16160c - name: "IsWindowEnabled" - rva: 1447440 + rva: 0x161610 - name: "IsWindow" - rva: 1447444 + rva: 0x161614 - name: "IsRectEmpty" - rva: 1447448 + rva: 0x161618 - name: "IsIconic" - rva: 1447452 + rva: 0x16161c - name: "IsDialogMessageA" - rva: 1447456 + rva: 0x161620 - name: "IsChild" - rva: 1447460 + rva: 0x161624 - name: "IsCharAlphaNumericA" - rva: 1447464 + rva: 0x161628 - name: "IsCharAlphaA" - rva: 1447468 + rva: 0x16162c - name: "InvalidateRect" - rva: 1447472 + rva: 0x161630 - name: "IntersectRect" - rva: 1447476 + rva: 0x161634 - name: "InsertMenuItemA" - rva: 1447480 + rva: 0x161638 - name: "InsertMenuA" - rva: 1447484 + rva: 0x16163c - name: "InflateRect" - rva: 1447488 + rva: 0x161640 - name: "GetWindowThreadProcessId" - rva: 1447492 + rva: 0x161644 - name: "GetWindowTextA" - rva: 1447496 + rva: 0x161648 - name: "GetWindowRect" - rva: 1447500 + rva: 0x16164c - name: "GetWindowPlacement" - rva: 1447504 + rva: 0x161650 - name: "GetWindowLongA" - rva: 1447508 + rva: 0x161654 - name: "GetWindowDC" - rva: 1447512 + rva: 0x161658 - name: "GetTopWindow" - rva: 1447516 + rva: 0x16165c - name: "GetSystemMetrics" - rva: 1447520 + rva: 0x161660 - name: "GetSystemMenu" - rva: 1447524 + rva: 0x161664 - name: "GetSysColorBrush" - rva: 1447528 + rva: 0x161668 - name: "GetSysColor" - rva: 1447532 + rva: 0x16166c - name: "GetSubMenu" - rva: 1447536 + rva: 0x161670 - name: "GetScrollRange" - rva: 1447540 + rva: 0x161674 - name: "GetScrollPos" - rva: 1447544 + rva: 0x161678 - name: "GetScrollInfo" - rva: 1447548 + rva: 0x16167c - name: "GetPropA" - rva: 1447552 + rva: 0x161680 - name: "GetParent" - rva: 1447556 + rva: 0x161684 - name: "GetWindow" - rva: 1447560 + rva: 0x161688 - name: "GetMessageTime" - rva: 1447564 + rva: 0x16168c - name: "GetMenuStringA" - rva: 1447568 + rva: 0x161690 - name: "GetMenuState" - rva: 1447572 + rva: 0x161694 - name: "GetMenuItemInfoA" - rva: 1447576 + rva: 0x161698 - name: "GetMenuItemID" - rva: 1447580 + rva: 0x16169c - name: "GetMenuItemCount" - rva: 1447584 + rva: 0x1616a0 - name: "GetMenu" - rva: 1447588 + rva: 0x1616a4 - name: "GetLastActivePopup" - rva: 1447592 + rva: 0x1616a8 - name: "GetKeyboardState" - rva: 1447596 + rva: 0x1616ac - name: "GetKeyboardLayoutList" - rva: 1447600 + rva: 0x1616b0 - name: "GetKeyboardLayout" - rva: 1447604 + rva: 0x1616b4 - name: "GetKeyState" - rva: 1447608 + rva: 0x1616b8 - name: "GetKeyNameTextA" - rva: 1447612 + rva: 0x1616bc - name: "GetIconInfo" - rva: 1447616 + rva: 0x1616c0 - name: "GetForegroundWindow" - rva: 1447620 + rva: 0x1616c4 - name: "GetFocus" - rva: 1447624 + rva: 0x1616c8 - name: "GetDoubleClickTime" - rva: 1447628 + rva: 0x1616cc - name: "GetDesktopWindow" - rva: 1447632 + rva: 0x1616d0 - name: "GetDCEx" - rva: 1447636 + rva: 0x1616d4 - name: "GetDC" - rva: 1447640 + rva: 0x1616d8 - name: "GetCursorPos" - rva: 1447644 + rva: 0x1616dc - name: "GetCursor" - rva: 1447648 + rva: 0x1616e0 - name: "GetClipboardData" - rva: 1447652 + rva: 0x1616e4 - name: "GetClientRect" - rva: 1447656 + rva: 0x1616e8 - name: "GetClassNameA" - rva: 1447660 + rva: 0x1616ec - name: "GetClassInfoA" - rva: 1447664 + rva: 0x1616f0 - name: "GetCaretPos" - rva: 1447668 + rva: 0x1616f4 - name: "GetCapture" - rva: 1447672 + rva: 0x1616f8 - name: "GetActiveWindow" - rva: 1447676 + rva: 0x1616fc - name: "FrameRect" - rva: 1447680 + rva: 0x161700 - name: "FindWindowA" - rva: 1447684 + rva: 0x161704 - name: "FillRect" - rva: 1447688 + rva: 0x161708 - name: "EqualRect" - rva: 1447692 + rva: 0x16170c - name: "EnumWindows" - rva: 1447696 + rva: 0x161710 - name: "EnumThreadWindows" - rva: 1447700 + rva: 0x161714 - name: "EnumClipboardFormats" - rva: 1447704 + rva: 0x161718 - name: "EndPaint" - rva: 1447708 + rva: 0x16171c - name: "EnableWindow" - rva: 1447712 + rva: 0x161720 - name: "EnableScrollBar" - rva: 1447716 + rva: 0x161724 - name: "EnableMenuItem" - rva: 1447720 + rva: 0x161728 - name: "EmptyClipboard" - rva: 1447724 + rva: 0x16172c - name: "DrawTextA" - rva: 1447728 + rva: 0x161730 - name: "DrawMenuBar" - rva: 1447732 + rva: 0x161734 - name: "DrawIconEx" - rva: 1447736 + rva: 0x161738 - name: "DrawIcon" - rva: 1447740 + rva: 0x16173c - name: "DrawFrameControl" - rva: 1447744 + rva: 0x161740 - name: "DrawFocusRect" - rva: 1447748 + rva: 0x161744 - name: "DrawEdge" - rva: 1447752 + rva: 0x161748 - name: "DispatchMessageA" - rva: 1447756 + rva: 0x16174c - name: "DestroyWindow" - rva: 1447760 + rva: 0x161750 - name: "DestroyMenu" - rva: 1447764 + rva: 0x161754 - name: "DestroyIcon" - rva: 1447768 + rva: 0x161758 - name: "DestroyCursor" - rva: 1447772 + rva: 0x16175c - name: "DeleteMenu" - rva: 1447776 + rva: 0x161760 - name: "DefWindowProcA" - rva: 1447780 + rva: 0x161764 - name: "DefMDIChildProcA" - rva: 1447784 + rva: 0x161768 - name: "DefFrameProcA" - rva: 1447788 + rva: 0x16176c - name: "CreatePopupMenu" - rva: 1447792 + rva: 0x161770 - name: "CreateMenu" - rva: 1447796 + rva: 0x161774 - name: "CreateIcon" - rva: 1447800 + rva: 0x161778 - name: "CloseClipboard" - rva: 1447804 + rva: 0x16177c - name: "ClientToScreen" - rva: 1447808 + rva: 0x161780 - name: "CheckMenuItem" - rva: 1447812 + rva: 0x161784 - name: "CallWindowProcA" - rva: 1447816 + rva: 0x161788 - name: "CallNextHookEx" - rva: 1447820 + rva: 0x16178c - name: "BeginPaint" - rva: 1447824 + rva: 0x161790 - name: "CharNextA" - rva: 1447828 + rva: 0x161794 - name: "CharLowerBuffA" - rva: 1447832 + rva: 0x161798 - name: "CharLowerA" - rva: 1447836 + rva: 0x16179c - name: "CharUpperBuffA" - rva: 1447840 + rva: 0x1617a0 - name: "CharToOemBuffA" - rva: 1447844 + rva: 0x1617a4 - name: "CharToOemA" - rva: 1447848 + rva: 0x1617a8 - name: "AdjustWindowRectEx" - rva: 1447852 + rva: 0x1617ac - name: "ActivateKeyboardLayout" - rva: 1447856 + rva: 0x1617b0 - library_name: "ole32.dll" number_of_functions: 4 functions: - name: "IsEqualGUID" - rva: 1447864 + rva: 0x1617b8 - name: "CoTaskMemFree" - rva: 1447868 + rva: 0x1617bc - name: "StringFromCLSID" - rva: 1447872 + rva: 0x1617c0 - name: "CoCreateGuid" - rva: 1447876 + rva: 0x1617c4 - library_name: "kernel32.dll" number_of_functions: 1 functions: - name: "Sleep" - rva: 1447884 + rva: 0x1617cc - library_name: "oleaut32.dll" number_of_functions: 13 functions: - name: "SafeArrayPtrOfIndex" - rva: 1447892 + rva: 0x1617d4 - name: "SafeArrayPutElement" - rva: 1447896 + rva: 0x1617d8 - name: "SafeArrayGetElement" - rva: 1447900 + rva: 0x1617dc - name: "SafeArrayUnaccessData" - rva: 1447904 + rva: 0x1617e0 - name: "SafeArrayAccessData" - rva: 1447908 + rva: 0x1617e4 - name: "SafeArrayGetUBound" - rva: 1447912 + rva: 0x1617e8 - name: "SafeArrayGetLBound" - rva: 1447916 + rva: 0x1617ec - name: "SafeArrayCreate" - rva: 1447920 + rva: 0x1617f0 - name: "VariantChangeType" - rva: 1447924 + rva: 0x1617f4 - name: "VariantCopyInd" - rva: 1447928 + rva: 0x1617f8 - name: "VariantCopy" - rva: 1447932 + rva: 0x1617fc - name: "VariantClear" - rva: 1447936 + rva: 0x161800 - name: "VariantInit" - rva: 1447940 + rva: 0x161804 - library_name: "ole32.dll" number_of_functions: 3 functions: - name: "CoCreateInstance" - rva: 1447948 + rva: 0x16180c - name: "CoUninitialize" - rva: 1447952 + rva: 0x161810 - name: "CoInitialize" - rva: 1447956 + rva: 0x161814 - library_name: "oleaut32.dll" number_of_functions: 4 functions: - name: "CreateErrorInfo" - rva: 1447964 + rva: 0x16181c - name: "GetErrorInfo" - rva: 1447968 + rva: 0x161820 - name: "SetErrorInfo" - rva: 1447972 + rva: 0x161824 - name: "SysFreeString" - rva: 1447976 + rva: 0x161828 - library_name: "comctl32.dll" number_of_functions: 22 functions: - name: "ImageList_SetIconSize" - rva: 1447984 + rva: 0x161830 - name: "ImageList_GetIconSize" - rva: 1447988 + rva: 0x161834 - name: "ImageList_Write" - rva: 1447992 + rva: 0x161838 - name: "ImageList_Read" - rva: 1447996 + rva: 0x16183c - name: "ImageList_GetDragImage" - rva: 1448000 + rva: 0x161840 - name: "ImageList_DragShowNolock" - rva: 1448004 + rva: 0x161844 - name: "ImageList_SetDragCursorImage" - rva: 1448008 + rva: 0x161848 - name: "ImageList_DragMove" - rva: 1448012 + rva: 0x16184c - name: "ImageList_DragLeave" - rva: 1448016 + rva: 0x161850 - name: "ImageList_DragEnter" - rva: 1448020 + rva: 0x161854 - name: "ImageList_EndDrag" - rva: 1448024 + rva: 0x161858 - name: "ImageList_BeginDrag" - rva: 1448028 + rva: 0x16185c - name: "ImageList_Remove" - rva: 1448032 + rva: 0x161860 - name: "ImageList_DrawEx" - rva: 1448036 + rva: 0x161864 - name: "ImageList_Draw" - rva: 1448040 + rva: 0x161868 - name: "ImageList_GetBkColor" - rva: 1448044 + rva: 0x16186c - name: "ImageList_SetBkColor" - rva: 1448048 + rva: 0x161870 - name: "ImageList_ReplaceIcon" - rva: 1448052 + rva: 0x161874 - name: "ImageList_Add" - rva: 1448056 + rva: 0x161878 - name: "ImageList_GetImageCount" - rva: 1448060 + rva: 0x16187c - name: "ImageList_Destroy" - rva: 1448064 + rva: 0x161880 - name: "ImageList_Create" - rva: 1448068 + rva: 0x161884 - library_name: "wininet.dll" number_of_functions: 17 functions: - name: "HttpSendRequestExA" - rva: 1448076 + rva: 0x16188c - name: "InternetAttemptConnect" - rva: 1448080 + rva: 0x161890 - name: "HttpEndRequestA" - rva: 1448084 + rva: 0x161894 - name: "InternetWriteFile" - rva: 1448088 + rva: 0x161898 - name: "InternetSetOptionA" - rva: 1448092 + rva: 0x16189c - name: "InternetReadFile" - rva: 1448096 + rva: 0x1618a0 - name: "InternetQueryOptionA" - rva: 1448100 + rva: 0x1618a4 - name: "InternetQueryDataAvailable" - rva: 1448104 + rva: 0x1618a8 - name: "InternetOpenA" - rva: 1448108 + rva: 0x1618ac - name: "InternetErrorDlg" - rva: 1448112 + rva: 0x1618b0 - name: "InternetCrackUrlA" - rva: 1448116 + rva: 0x1618b4 - name: "InternetConnectA" - rva: 1448120 + rva: 0x1618b8 - name: "InternetCloseHandle" - rva: 1448124 + rva: 0x1618bc - name: "HttpSendRequestA" - rva: 1448128 + rva: 0x1618c0 - name: "HttpQueryInfoA" - rva: 1448132 + rva: 0x1618c4 - name: "HttpOpenRequestA" - rva: 1448136 + rva: 0x1618c8 - name: "HttpAddRequestHeadersA" - rva: 1448140 + rva: 0x1618cc - library_name: "kernel32.dll" number_of_functions: 1 functions: - name: "MulDiv" - rva: 1448148 + rva: 0x1618d4 is_signed: false overlay: - offset: 0 - size: 0 \ No newline at end of file + offset: 0x0 + size: 0x0 \ No newline at end of file diff --git a/lib/src/modules/pe/tests/testdata/af3f20a9272489cbef4281c8c86ad42ccfb04ccedd3ada1e8c26939c726a4c8e.out b/lib/src/modules/pe/tests/testdata/af3f20a9272489cbef4281c8c86ad42ccfb04ccedd3ada1e8c26939c726a4c8e.out index 2d8c9bce8..e0060c751 100644 --- a/lib/src/modules/pe/tests/testdata/af3f20a9272489cbef4281c8c86ad42ccfb04ccedd3ada1e8c26939c726a4c8e.out +++ b/lib/src/modules/pe/tests/testdata/af3f20a9272489cbef4281c8c86ad42ccfb04ccedd3ada1e8c26939c726a4c8e.out @@ -17,25 +17,25 @@ opthdr_magic: IMAGE_NT_OPTIONAL_HDR64_MAGIC characteristics: 0x206 # EXECUTABLE_IMAGE | LINE_NUMS_STRIPPED | DEBUG_STRIPPED dll_characteristics: 0x0 timestamp: 0 # 1970-01-01 00:00:00 UTC -image_base: 16777216 +image_base: 0x1000000 checksum: 3991994 -base_of_code: 512 -entry_point: 3937578 -entry_point_raw: 3937578 -section_alignment: 32 -file_alignment: 32 -loader_flags: 0 -size_of_optional_header: 160 -size_of_code: 40582656 -size_of_initialized_data: 0 -size_of_uninitialized_data: 0 -size_of_image: 40583168 -size_of_headers: 512 -size_of_stack_reserve: 0 -size_of_stack_commit: 0 -size_of_heap_reserve: 0 -size_of_heap_commit: 0 -pointer_to_symbol_table: 0 +base_of_code: 0x200 +entry_point: 0x3c152a +entry_point_raw: 0x3c152a +section_alignment: 0x20 +file_alignment: 0x20 +loader_flags: 0x0 +size_of_optional_header: 0xa0 +size_of_code: 0x26b3e00 +size_of_initialized_data: 0x0 +size_of_uninitialized_data: 0x0 +size_of_image: 0x26b4000 +size_of_headers: 0x200 +size_of_stack_reserve: 0x0 +size_of_stack_commit: 0x0 +size_of_heap_reserve: 0x0 +size_of_heap_commit: 0x0 +pointer_to_symbol_table: 0x0 win32_version_value: 0 number_of_symbols: 1 number_of_rva_and_sizes: 6 @@ -51,61 +51,61 @@ number_of_signatures: 1 sections: - name: ".setup" full_name: ".setup" - characteristics: 1615855648 - raw_data_size: 14272 - raw_data_offset: 512 - virtual_address: 512 - virtual_size: 14272 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0x60500020 # SECTION_MEM_READ | SECTION_MEM_WRITE | SECTION_SCALE_INDEX + raw_data_size: 0x37c0 + raw_data_offset: 0x200 + virtual_address: 0x200 + virtual_size: 0x37c0 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".reloc" full_name: ".reloc" - characteristics: 1108344896 - raw_data_size: 32 - raw_data_offset: 14784 - virtual_address: 14784 - virtual_size: 32 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0x42100040 + raw_data_size: 0x20 + raw_data_offset: 0x39c0 + virtual_address: 0x39c0 + virtual_size: 0x20 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".compat" full_name: ".compat" - characteristics: 1108344896 - raw_data_size: 32 - raw_data_offset: 14816 - virtual_address: 14816 - virtual_size: 32 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0x42100040 + raw_data_size: 0x20 + raw_data_offset: 0x39e0 + virtual_address: 0x39e0 + virtual_size: 0x20 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".text" full_name: ".text" - characteristics: 1615855648 - raw_data_size: 3949344 - raw_data_offset: 14848 - virtual_address: 14848 - virtual_size: 40568320 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0x60500020 # SECTION_MEM_READ | SECTION_MEM_WRITE | SECTION_SCALE_INDEX + raw_data_size: 0x3c4320 + raw_data_offset: 0x3a00 + virtual_address: 0x3a00 + virtual_size: 0x26b0600 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 data_directories: - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 3964192 - size: 2832 - - virtual_address: 0 - size: 0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x3c7d20 + size: 0xb10 + - virtual_address: 0x0 + size: 0x0 is_signed: true signatures: - subject: "/C=AT/O=Security Coding Factory GmbH/OU=Security Coding Factory Certificate Authority/CN=Security Coding Factory Software CA" @@ -147,5 +147,5 @@ signatures: not_before: 1615365865 # 2021-03-10 08:44:25 UTC not_after: 2246431465 # 2041-03-09 08:44:25 UTC overlay: - offset: 3964192 - size: 2832 \ No newline at end of file + offset: 0x3c7d20 + size: 0xb10 \ No newline at end of file diff --git a/lib/src/modules/pe/tests/testdata/b7a3b9f050d3fdf5ee4b5f8c625b10ab74adfc7923f7f2be70bfe785b374e05c.out b/lib/src/modules/pe/tests/testdata/b7a3b9f050d3fdf5ee4b5f8c625b10ab74adfc7923f7f2be70bfe785b374e05c.out index c54316615..f03349533 100644 --- a/lib/src/modules/pe/tests/testdata/b7a3b9f050d3fdf5ee4b5f8c625b10ab74adfc7923f7f2be70bfe785b374e05c.out +++ b/lib/src/modules/pe/tests/testdata/b7a3b9f050d3fdf5ee4b5f8c625b10ab74adfc7923f7f2be70bfe785b374e05c.out @@ -17,25 +17,25 @@ opthdr_magic: IMAGE_NT_OPTIONAL_HDR64_MAGIC characteristics: 0x2026 # EXECUTABLE_IMAGE | LINE_NUMS_STRIPPED | LARGE_ADDRESS_AWARE | DLL dll_characteristics: 0x160 # HIGH_ENTROPY_VA | DYNAMIC_BASE | NX_COMPAT timestamp: 1706933973 # 2024-02-03 04:19:33 UTC -image_base: 12822773760 +image_base: 0x2fc4c0000 checksum: 1317510 -base_of_code: 4096 -entry_point: 2194 -entry_point_raw: 4754 -section_alignment: 4096 -file_alignment: 512 -loader_flags: 0 -size_of_optional_header: 240 -size_of_code: 1139712 -size_of_initialized_data: 1267712 -size_of_uninitialized_data: 512 -size_of_image: 1335296 -size_of_headers: 1536 -size_of_stack_reserve: 2097152 -size_of_stack_commit: 4096 -size_of_heap_reserve: 1048576 -size_of_heap_commit: 4096 -pointer_to_symbol_table: 1276416 +base_of_code: 0x1000 +entry_point: 0x892 +entry_point_raw: 0x1292 +section_alignment: 0x1000 +file_alignment: 0x200 +loader_flags: 0x0 +size_of_optional_header: 0xf0 +size_of_code: 0x116400 +size_of_initialized_data: 0x135800 +size_of_uninitialized_data: 0x200 +size_of_image: 0x146000 +size_of_headers: 0x600 +size_of_stack_reserve: 0x200000 +size_of_stack_commit: 0x1000 +size_of_heap_reserve: 0x100000 +size_of_heap_commit: 0x1000 +pointer_to_symbol_table: 0x137a00 win32_version_value: 0 number_of_symbols: 1220 number_of_rva_and_sizes: 16 @@ -51,148 +51,148 @@ number_of_signatures: 0 sections: - name: ".text" full_name: ".text" - characteristics: 1610612832 - raw_data_size: 1139712 - raw_data_offset: 1536 - virtual_address: 4096 - virtual_size: 1139208 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0x60000060 # SECTION_MEM_READ | SECTION_MEM_WRITE | SECTION_SCALE_INDEX + raw_data_size: 0x116400 + raw_data_offset: 0x600 + virtual_address: 0x1000 + virtual_size: 0x116208 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".data" full_name: ".data" - characteristics: 3221225536 - raw_data_size: 118272 - raw_data_offset: 1141248 - virtual_address: 1146880 - virtual_size: 118064 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0xc0000040 + raw_data_size: 0x1ce00 + raw_data_offset: 0x116a00 + virtual_address: 0x118000 + virtual_size: 0x1cd30 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".rdata" full_name: ".rdata" - characteristics: 1073741888 - raw_data_size: 2560 - raw_data_offset: 1259520 - virtual_address: 1265664 - virtual_size: 2400 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0x40000040 + raw_data_size: 0xa00 + raw_data_offset: 0x133800 + virtual_address: 0x135000 + virtual_size: 0x960 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: "/4" full_name: "/4" - characteristics: 3221225536 - raw_data_size: 512 - raw_data_offset: 1262080 - virtual_address: 1269760 - virtual_size: 4 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0xc0000040 + raw_data_size: 0x200 + raw_data_offset: 0x134200 + virtual_address: 0x136000 + virtual_size: 0x4 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".pdata" full_name: ".pdata" - characteristics: 1073741888 - raw_data_size: 1024 - raw_data_offset: 1262592 - virtual_address: 1273856 - virtual_size: 672 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0x40000040 + raw_data_size: 0x400 + raw_data_offset: 0x134400 + virtual_address: 0x137000 + virtual_size: 0x2a0 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".xdata" full_name: ".xdata" - characteristics: 1073741888 - raw_data_size: 1024 - raw_data_offset: 1263616 - virtual_address: 1277952 - virtual_size: 740 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0x40000040 + raw_data_size: 0x400 + raw_data_offset: 0x134800 + virtual_address: 0x138000 + virtual_size: 0x2e4 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".bss" full_name: ".bss" - characteristics: 3221225600 - raw_data_size: 0 - raw_data_offset: 0 - virtual_address: 1282048 - virtual_size: 408 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0xc0000080 + raw_data_size: 0x0 + raw_data_offset: 0x0 + virtual_address: 0x139000 + virtual_size: 0x198 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".edata" full_name: ".edata" - characteristics: 1073741888 - raw_data_size: 512 - raw_data_offset: 1264640 - virtual_address: 1286144 - virtual_size: 63 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0x40000040 + raw_data_size: 0x200 + raw_data_offset: 0x134c00 + virtual_address: 0x13a000 + virtual_size: 0x3f + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".idata" full_name: ".idata" - characteristics: 3221225536 - raw_data_size: 2560 - raw_data_offset: 1265152 - virtual_address: 1290240 - virtual_size: 2224 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0xc0000040 + raw_data_size: 0xa00 + raw_data_offset: 0x134e00 + virtual_address: 0x13b000 + virtual_size: 0x8b0 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".CRT" full_name: ".CRT" - characteristics: 3221225536 - raw_data_size: 512 - raw_data_offset: 1267712 - virtual_address: 1294336 - virtual_size: 88 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0xc0000040 + raw_data_size: 0x200 + raw_data_offset: 0x135800 + virtual_address: 0x13c000 + virtual_size: 0x58 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 data_directories: - - virtual_address: 1286144 - size: 63 - - virtual_address: 1290240 - size: 2224 - - virtual_address: 0 - size: 0 - - virtual_address: 1273856 - size: 672 - - virtual_address: 0 - size: 0 - - virtual_address: 1302528 - size: 120 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 1265760 - size: 40 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 1290840 - size: 416 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 + - virtual_address: 0x13a000 + size: 0x3f + - virtual_address: 0x13b000 + size: 0x8b0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x137000 + size: 0x2a0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x13e000 + size: 0x78 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x135060 + size: 0x28 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x13b258 + size: 0x1a0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 is_signed: false overlay: - offset: 0 - size: 0 \ No newline at end of file + offset: 0x0 + size: 0x0 \ No newline at end of file diff --git a/lib/src/modules/pe/tests/testdata/b8543d3aceec5a754292393f6602eeb966dbf9e198c94e3d74a9e9260e5f9870.out b/lib/src/modules/pe/tests/testdata/b8543d3aceec5a754292393f6602eeb966dbf9e198c94e3d74a9e9260e5f9870.out index c7321d4de..e8da416c3 100644 --- a/lib/src/modules/pe/tests/testdata/b8543d3aceec5a754292393f6602eeb966dbf9e198c94e3d74a9e9260e5f9870.out +++ b/lib/src/modules/pe/tests/testdata/b8543d3aceec5a754292393f6602eeb966dbf9e198c94e3d74a9e9260e5f9870.out @@ -17,25 +17,25 @@ opthdr_magic: IMAGE_NT_OPTIONAL_HDR64_MAGIC characteristics: 0x22 # EXECUTABLE_IMAGE | LARGE_ADDRESS_AWARE dll_characteristics: 0xc160 # HIGH_ENTROPY_VA | DYNAMIC_BASE | NX_COMPAT | GUARD_CF | TERMINAL_SERVER_AWARE timestamp: 1776026023 # 2026-04-12 20:33:43 UTC -image_base: 5368709120 +image_base: 0x140000000 checksum: 58189 -base_of_code: 4096 -entry_point: 2272 -entry_point_raw: 5344 -section_alignment: 4096 -file_alignment: 512 -loader_flags: 0 -size_of_optional_header: 240 -size_of_code: 3072 -size_of_initialized_data: 9216 -size_of_uninitialized_data: 0 -size_of_image: 28672 -size_of_headers: 1024 -size_of_stack_reserve: 524288 -size_of_stack_commit: 8192 -size_of_heap_reserve: 1048576 -size_of_heap_commit: 4096 -pointer_to_symbol_table: 0 +base_of_code: 0x1000 +entry_point: 0x8e0 +entry_point_raw: 0x14e0 +section_alignment: 0x1000 +file_alignment: 0x200 +loader_flags: 0x0 +size_of_optional_header: 0xf0 +size_of_code: 0xc00 +size_of_initialized_data: 0x2400 +size_of_uninitialized_data: 0x0 +size_of_image: 0x7000 +size_of_headers: 0x400 +size_of_stack_reserve: 0x80000 +size_of_stack_commit: 0x2000 +size_of_heap_reserve: 0x100000 +size_of_heap_commit: 0x1000 +pointer_to_symbol_table: 0x0 win32_version_value: 0 number_of_symbols: 0 number_of_rva_and_sizes: 16 @@ -75,8 +75,8 @@ version_info_list: - key: "ProductVersion" value: "10.0.19041.1202" rich_signature: - offset: 128 - length: 88 + offset: 0x80 + length: 0x58 key: 3921423185 raw_data: "\x15J\xd2\xbaQ+\xbc\xe9Q+\xbc\xe9Q+\xbc\xe9XS/\xe9E+\xbc\xe9E@\xb9\xe8P+\xbc\xe9E@\xbf\xe8S+\xbc\xe9E@\xb8\xe8C+\xbc\xe9Q+\xbd\xe9x+\xbc\xe9E@\xbd\xe8T+\xbc\xe9E@\xb4\xe8R+\xbc\xe9E@C\xe9P+\xbc\xe9E@\xbe\xe8P+\xbc\xe9" clear_data: "DanS\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\tx\x93\x00\x14\x00\x00\x00\x14k\x05\x01\x01\x00\x00\x00\x14k\x03\x01\x02\x00\x00\x00\x14k\x04\x01\x12\x00\x00\x00\x00\x00\x01\x00)\x00\x00\x00\x14k\x01\x01\x05\x00\x00\x00\x14k\x08\x01\x03\x00\x00\x00\x14k\xff\x00\x01\x00\x00\x00\x14k\x02\x01\x01\x00\x00\x00" @@ -112,117 +112,117 @@ pdb_path: "launchtm.pdb" sections: - name: ".text" full_name: ".text" - characteristics: 1610612768 - raw_data_size: 3072 - raw_data_offset: 1024 - virtual_address: 4096 - virtual_size: 2864 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0x60000020 # SECTION_MEM_READ | SECTION_MEM_WRITE | SECTION_SCALE_INDEX + raw_data_size: 0xc00 + raw_data_offset: 0x400 + virtual_address: 0x1000 + virtual_size: 0xb30 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".rdata" full_name: ".rdata" - characteristics: 1073741888 - raw_data_size: 3584 - raw_data_offset: 4096 - virtual_address: 8192 - virtual_size: 3522 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0x40000040 + raw_data_size: 0xe00 + raw_data_offset: 0x1000 + virtual_address: 0x2000 + virtual_size: 0xdc2 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".data" full_name: ".data" - characteristics: 3221225536 - raw_data_size: 512 - raw_data_offset: 7680 - virtual_address: 12288 - virtual_size: 1664 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0xc0000040 + raw_data_size: 0x200 + raw_data_offset: 0x1e00 + virtual_address: 0x3000 + virtual_size: 0x680 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".pdata" full_name: ".pdata" - characteristics: 1073741888 - raw_data_size: 512 - raw_data_offset: 8192 - virtual_address: 16384 - virtual_size: 228 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0x40000040 + raw_data_size: 0x200 + raw_data_offset: 0x2000 + virtual_address: 0x4000 + virtual_size: 0xe4 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".rsrc" full_name: ".rsrc" - characteristics: 1073741888 - raw_data_size: 2560 - raw_data_offset: 8704 - virtual_address: 20480 - virtual_size: 2312 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0x40000040 + raw_data_size: 0xa00 + raw_data_offset: 0x2200 + virtual_address: 0x5000 + virtual_size: 0x908 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".reloc" full_name: ".reloc" - characteristics: 1107296320 - raw_data_size: 512 - raw_data_offset: 11264 - virtual_address: 24576 - virtual_size: 32 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0x42000040 + raw_data_size: 0x200 + raw_data_offset: 0x2c00 + virtual_address: 0x6000 + virtual_size: 0x20 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 data_directories: - - virtual_address: 0 - size: 0 - - virtual_address: 9988 - size: 260 - - virtual_address: 20480 - size: 2312 - - virtual_address: 16384 - size: 228 - - virtual_address: 0 - size: 0 - - virtual_address: 24576 - size: 32 - - virtual_address: 9088 - size: 84 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 8208 - size: 280 - - virtual_address: 0 - size: 0 - - virtual_address: 8488 - size: 392 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x2704 + size: 0x104 + - virtual_address: 0x5000 + size: 0x908 + - virtual_address: 0x4000 + size: 0xe4 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x6000 + size: 0x20 + - virtual_address: 0x2380 + size: 0x54 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x2010 + size: 0x118 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x2128 + size: 0x188 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 resource_timestamp: 0 # 1970-01-01 00:00:00 UTC resource_version: major: 0 minor: 0 resources: - - length: 928 - rva: 21864 - offset: 10088 + - length: 0x3a0 + rva: 0x5568 + offset: 0x2768 type: RESOURCE_TYPE_VERSION id: 1 language: 1033 - - length: 1219 - rva: 20640 - offset: 8864 + - length: 0x4c3 + rva: 0x50a0 + offset: 0x22a0 type: RESOURCE_TYPE_MANIFEST id: 1 language: 1033 @@ -231,113 +231,113 @@ import_details: number_of_functions: 15 functions: - name: "__set_app_type" - rva: 8752 + rva: 0x2230 - name: "__wgetmainargs" - rva: 8760 + rva: 0x2238 - name: "_amsg_exit" - rva: 8768 + rva: 0x2240 - name: "?terminate@@YAXXZ" - rva: 8776 + rva: 0x2248 - name: "_commode" - rva: 8784 + rva: 0x2250 - name: "_fmode" - rva: 8792 + rva: 0x2258 - name: "_wcmdln" - rva: 8800 + rva: 0x2260 - name: "__C_specific_handler" - rva: 8808 + rva: 0x2268 - name: "_initterm" - rva: 8816 + rva: 0x2270 - name: "__setusermatherr" - rva: 8824 + rva: 0x2278 - name: "_cexit" - rva: 8832 + rva: 0x2280 - name: "_XcptFilter" - rva: 8840 + rva: 0x2288 - name: "_exit" - rva: 8848 + rva: 0x2290 - name: "exit" - rva: 8856 + rva: 0x2298 - name: "memset" - rva: 8864 + rva: 0x22a0 - library_name: "api-ms-win-core-heap-l1-1-0.dll" number_of_functions: 1 functions: - name: "HeapSetInformation" - rva: 8560 + rva: 0x2170 - library_name: "api-ms-win-core-processthreads-l1-1-0.dll" number_of_functions: 6 functions: - name: "GetStartupInfoW" - rva: 8608 + rva: 0x21a0 - name: "GetCurrentProcess" - rva: 8616 + rva: 0x21a8 - name: "GetCurrentThreadId" - rva: 8624 + rva: 0x21b0 - name: "GetCurrentProcessId" - rva: 8632 + rva: 0x21b8 - name: "TerminateProcess" - rva: 8640 + rva: 0x21c0 - name: "SetPriorityClass" - rva: 8648 + rva: 0x21c8 - library_name: "api-ms-win-core-com-l1-1-0.dll" number_of_functions: 2 functions: - name: "CoInitializeEx" - rva: 8504 + rva: 0x2138 - name: "CoUninitialize" - rva: 8512 + rva: 0x2140 - library_name: "api-ms-win-core-processenvironment-l1-1-0.dll" number_of_functions: 1 functions: - name: "ExpandEnvironmentStringsW" - rva: 8592 + rva: 0x2190 - library_name: "api-ms-win-core-errorhandling-l1-1-0.dll" number_of_functions: 3 functions: - name: "GetLastError" - rva: 8528 + rva: 0x2150 - name: "UnhandledExceptionFilter" - rva: 8536 + rva: 0x2158 - name: "SetUnhandledExceptionFilter" - rva: 8544 + rva: 0x2160 - library_name: "api-ms-win-core-synch-l1-2-0.dll" number_of_functions: 1 functions: - name: "Sleep" - rva: 8712 + rva: 0x2208 - library_name: "api-ms-win-core-libraryloader-l1-2-0.dll" number_of_functions: 1 functions: - name: "GetModuleHandleW" - rva: 8576 + rva: 0x2180 - library_name: "api-ms-win-core-profile-l1-1-0.dll" number_of_functions: 1 functions: - name: "QueryPerformanceCounter" - rva: 8664 + rva: 0x21d8 - library_name: "api-ms-win-core-sysinfo-l1-1-0.dll" number_of_functions: 2 functions: - name: "GetTickCount" - rva: 8728 + rva: 0x2218 - name: "GetSystemTimeAsFileTime" - rva: 8736 + rva: 0x2220 - library_name: "api-ms-win-core-rtlsupport-l1-1-0.dll" number_of_functions: 3 functions: - name: "RtlVirtualUnwind" - rva: 8680 + rva: 0x21e8 - name: "RtlLookupFunctionEntry" - rva: 8688 + rva: 0x21f0 - name: "RtlCaptureContext" - rva: 8696 + rva: 0x21f8 - library_name: "SHELL32.dll" number_of_functions: 1 functions: - name: "ShellExecuteExW" - rva: 8488 + rva: 0x2128 is_signed: false overlay: - offset: 0 - size: 0 \ No newline at end of file + offset: 0x0 + size: 0x0 \ No newline at end of file diff --git a/lib/src/modules/pe/tests/testdata/bd15a7227770d89546e0a16e4c8da45937d970baa810827a7ceb17abd3138fec.out b/lib/src/modules/pe/tests/testdata/bd15a7227770d89546e0a16e4c8da45937d970baa810827a7ceb17abd3138fec.out index c9431ca71..3659acc41 100644 --- a/lib/src/modules/pe/tests/testdata/bd15a7227770d89546e0a16e4c8da45937d970baa810827a7ceb17abd3138fec.out +++ b/lib/src/modules/pe/tests/testdata/bd15a7227770d89546e0a16e4c8da45937d970baa810827a7ceb17abd3138fec.out @@ -17,25 +17,25 @@ opthdr_magic: 36 characteristics: 0x2e4e # EXECUTABLE_IMAGE | LINE_NUMS_STRIPPED | LOCAL_SYMS_STRIPPED | DEBUG_STRIPPED | REMOVABLE_RUN_FROM_SWAP | NET_RUN_FROM_SWAP | DLL dll_characteristics: 0x0 timestamp: 0 # 1970-01-01 00:00:00 UTC -image_base: 0 +image_base: 0x0 checksum: 0 -base_of_code: 3950706940 -base_of_data: 16765563 -entry_point_raw: 28684 -section_alignment: 1634548736 -file_alignment: 6515047 -loader_flags: 2071690107 -size_of_optional_header: 3257 -size_of_code: 176688205 -size_of_initialized_data: 65725 -size_of_uninitialized_data: 4286186044 -size_of_image: 2071690107 -size_of_headers: 16776990 -size_of_stack_reserve: 252 -size_of_stack_commit: 70 -size_of_heap_reserve: 89 -size_of_heap_commit: 2071658748 -pointer_to_symbol_table: 3019898880 +base_of_code: 0xeb7b00fc +base_of_data: 0xffd27b +entry_point_raw: 0x700c +section_alignment: 0x616d3c00 +file_alignment: 0x636967 +loader_flags: 0x7b7b7b7b +size_of_optional_header: 0xcb9 +size_of_code: 0xa880c4d +size_of_initialized_data: 0x100bd +size_of_uninitialized_data: 0xff7a023c +size_of_image: 0x7b7b7b7b +size_of_headers: 0xffff1e +size_of_stack_reserve: 0xfc +size_of_stack_commit: 0x46 +size_of_heap_reserve: 0x59 +size_of_heap_commit: 0x7b7b00fc +pointer_to_symbol_table: 0xb4000000 win32_version_value: 2071658748 number_of_symbols: 3040305 number_of_rva_and_sizes: 16776990 @@ -49,39 +49,39 @@ number_of_delayed_imports: 0 number_of_exports: 0 number_of_signatures: 0 data_directories: - - virtual_address: 0 - size: 89 - - virtual_address: 252 - size: 70 - - virtual_address: 89 - size: 2071658748 - - virtual_address: 2071690107 - size: 16776990 - - virtual_address: 0 - size: 89 - - virtual_address: 252 - size: 70 - - virtual_address: 89 - size: 2071658748 - - virtual_address: 2071690107 - size: 16776990 - - virtual_address: 1970143232 - size: 1919246957 - - virtual_address: 1600548703 - size: 1869833586 - - virtual_address: 29301 - size: 89 - - virtual_address: 252 - size: 70 - - virtual_address: 89 - size: 2071658748 - - virtual_address: 2071690107 - size: 16776990 - - virtual_address: 0 - size: 89 - - virtual_address: 252 - size: 70 + - virtual_address: 0x0 + size: 0x59 + - virtual_address: 0xfc + size: 0x46 + - virtual_address: 0x59 + size: 0x7b7b00fc + - virtual_address: 0x7b7b7b7b + size: 0xffff1e + - virtual_address: 0x0 + size: 0x59 + - virtual_address: 0xfc + size: 0x46 + - virtual_address: 0x59 + size: 0x7b7b00fc + - virtual_address: 0x7b7b7b7b + size: 0xffff1e + - virtual_address: 0x756e0000 + size: 0x7265626d + - virtual_address: 0x5f666f5f + size: 0x6f736572 + - virtual_address: 0x7275 + size: 0x59 + - virtual_address: 0xfc + size: 0x46 + - virtual_address: 0x59 + size: 0x7b7b00fc + - virtual_address: 0x7b7b7b7b + size: 0xffff1e + - virtual_address: 0x0 + size: 0x59 + - virtual_address: 0xfc + size: 0x46 is_signed: false overlay: - offset: 0 - size: 0 \ No newline at end of file + offset: 0x0 + size: 0x0 \ No newline at end of file diff --git a/lib/src/modules/pe/tests/testdata/bd82090d9c6e23c1e2708550f4c21bbafd719dcc7cfc28f405ad3bc2783c6a12.out b/lib/src/modules/pe/tests/testdata/bd82090d9c6e23c1e2708550f4c21bbafd719dcc7cfc28f405ad3bc2783c6a12.out index 544936b78..870d5e4b9 100644 --- a/lib/src/modules/pe/tests/testdata/bd82090d9c6e23c1e2708550f4c21bbafd719dcc7cfc28f405ad3bc2783c6a12.out +++ b/lib/src/modules/pe/tests/testdata/bd82090d9c6e23c1e2708550f4c21bbafd719dcc7cfc28f405ad3bc2783c6a12.out @@ -17,26 +17,26 @@ opthdr_magic: IMAGE_NT_OPTIONAL_HDR32_MAGIC characteristics: 0x103 # RELOCS_STRIPPED | EXECUTABLE_IMAGE | MACHINE_32BIT dll_characteristics: 0x400 # NO_SEH timestamp: 1162198621 # 2006-10-30 08:57:01 UTC -image_base: 4194304 +image_base: 0x400000 checksum: 0 -base_of_code: 464 -base_of_data: 468 -entry_point: 464 -entry_point_raw: 464 -section_alignment: 1 -file_alignment: 1 -loader_flags: 0 -size_of_optional_header: 224 -size_of_code: 4 -size_of_initialized_data: 0 -size_of_uninitialized_data: 0 -size_of_image: 468 -size_of_headers: 464 -size_of_stack_reserve: 1048576 -size_of_stack_commit: 4096 -size_of_heap_reserve: 1048576 -size_of_heap_commit: 4096 -pointer_to_symbol_table: 0 +base_of_code: 0x1d0 +base_of_data: 0x1d4 +entry_point: 0x1d0 +entry_point_raw: 0x1d0 +section_alignment: 0x1 +file_alignment: 0x1 +loader_flags: 0x0 +size_of_optional_header: 0xe0 +size_of_code: 0x4 +size_of_initialized_data: 0x0 +size_of_uninitialized_data: 0x0 +size_of_image: 0x1d4 +size_of_headers: 0x1d0 +size_of_stack_reserve: 0x100000 +size_of_stack_commit: 0x1000 +size_of_heap_reserve: 0x100000 +size_of_heap_commit: 0x1000 +pointer_to_symbol_table: 0x0 win32_version_value: 0 number_of_symbols: 0 number_of_rva_and_sizes: 16 @@ -50,8 +50,8 @@ number_of_delayed_imports: 0 number_of_exports: 0 number_of_signatures: 0 rich_signature: - offset: 128 - length: 32 + offset: 0x80 + length: 0x20 key: 2317110461 raw_data: "\xf9-r\xd9\xbdL\x1c\x8a\xbdL\x1c\x8a\xbdL\x1c\x8a\x9a\x8aq\x8a\xbcL\x1c\x8a\x9a\x8ad\x8a\xbcL\x1c\x8a" clear_data: "DanS\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\'\xc6m\x00\x01\x00\x00\x00\'\xc6x\x00\x01\x00\x00\x00" @@ -65,49 +65,49 @@ rich_signature: sections: - name: ".text" full_name: ".text" - characteristics: 1610612768 - raw_data_size: 4 - raw_data_offset: 464 - virtual_address: 464 - virtual_size: 4 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0x60000020 # SECTION_MEM_READ | SECTION_MEM_WRITE | SECTION_SCALE_INDEX + raw_data_size: 0x4 + raw_data_offset: 0x1d0 + virtual_address: 0x1d0 + virtual_size: 0x4 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 data_directories: - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 is_signed: false overlay: - offset: 0 - size: 0 \ No newline at end of file + offset: 0x0 + size: 0x0 \ No newline at end of file diff --git a/lib/src/modules/pe/tests/testdata/bf191e20cc1a441e89c3de23abcf05443e0bc168bb78397b041502f4f33361b9.out b/lib/src/modules/pe/tests/testdata/bf191e20cc1a441e89c3de23abcf05443e0bc168bb78397b041502f4f33361b9.out index 6abe5a0f7..7b7d42a01 100644 --- a/lib/src/modules/pe/tests/testdata/bf191e20cc1a441e89c3de23abcf05443e0bc168bb78397b041502f4f33361b9.out +++ b/lib/src/modules/pe/tests/testdata/bf191e20cc1a441e89c3de23abcf05443e0bc168bb78397b041502f4f33361b9.out @@ -17,25 +17,25 @@ opthdr_magic: 31619 characteristics: 0xc43 # RELOCS_STRIPPED | EXECUTABLE_IMAGE | REMOVABLE_RUN_FROM_SWAP | NET_RUN_FROM_SWAP dll_characteristics: 0x8bcf # DYNAMIC_BASE | FORCE_INTEGRITY | NX_COMPAT | NO_ISOLATION | NO_BIND | TERMINAL_SERVER_AWARE timestamp: 440487448 # 1983-12-17 05:37:28 UTC -image_base: 1401996123 +image_base: 0x5390c35b checksum: 1943944191 -base_of_code: 3296923785 -base_of_data: 1583308052 -entry_point_raw: 3526566916 -section_alignment: 3296941910 -file_alignment: 2314832876 -loader_flags: 16115896 -size_of_optional_header: 10500 -size_of_code: 3280670837 -size_of_initialized_data: 4294613736 -size_of_uninitialized_data: 2332552191 -size_of_image: 2179990308 -size_of_headers: 4290773222 -size_of_stack_reserve: 2345872342 -size_of_stack_commit: 4254722243 -size_of_heap_reserve: 1284374527 -size_of_heap_commit: 3616212004 -pointer_to_symbol_table: 2332557312 +base_of_code: 0xc4831089 +base_of_data: 0x5e5f5d14 +entry_point_raw: 0xd2332404 +section_alignment: 0xc4835756 +file_alignment: 0x89f98bec +loader_flags: 0xf5e8b8 +size_of_optional_header: 0x2904 +size_of_code: 0xc38b1075 +size_of_initialized_data: 0xfffa9ae8 +size_of_uninitialized_data: 0x8b07ebff +size_of_image: 0x81f00324 +size_of_headers: 0xffc000e6 +size_of_stack_reserve: 0x8bd32bd6 +size_of_stack_commit: 0xfd99e8c3 +size_of_heap_reserve: 0x4c8dffff +size_of_heap_commit: 0xd78b0424 +pointer_to_symbol_table: 0x8b080000 win32_version_value: 881590271 number_of_symbols: 1082860548 number_of_rva_and_sizes: 4200458256 @@ -49,39 +49,39 @@ number_of_delayed_imports: 0 number_of_exports: 0 number_of_signatures: 0 data_directories: - - virtual_address: 1552678911 - size: 3682927652 - - virtual_address: 1284317044 - size: 1418398756 - - virtual_address: 3280668708 - size: 4294715112 - - virtual_address: 608472063 - size: 608471308 - - virtual_address: 608471812 - size: 608471312 - - virtual_address: 612139784 - size: 343146500 - - virtual_address: 69489805 - size: 16115896 - - virtual_address: 4203866128 - size: 82575359 - - virtual_address: 126468147 - size: 1595196547 - - virtual_address: 1438866270 - size: 3526618251 - - virtual_address: 418801749 - size: 4284747776 - - virtual_address: 579429426 - size: 16103528 - - virtual_address: 4181321744 - size: 1031864319 - - virtual_address: 268496953 - size: 1745515520 - - virtual_address: 268498360 - size: 4294520552 - - virtual_address: 4124621055 - size: 2364018688 + - virtual_address: 0x5c8bffff + size: 0xdb850424 + - virtual_address: 0x4c8d1f74 + size: 0x548b0c24 + - virtual_address: 0xc38b0824 + size: 0xfffc26e8 + - virtual_address: 0x24448bff + size: 0x2444890c + - virtual_address: 0x24448b04 + size: 0x24448910 + - virtual_address: 0x247c8308 + size: 0x14740004 + - virtual_address: 0x424548d + size: 0xf5e8b8 + - virtual_address: 0xfa91e810 + size: 0x4ebffff + - virtual_address: 0x789c033 + size: 0x5f14c483 + - virtual_address: 0x55c35b5e + size: 0xd233ec8b + - virtual_address: 0x18f66855 + size: 0xff641000 + - virtual_address: 0x22896432 + size: 0xf5b868 + - virtual_address: 0xf939e810 + size: 0x3d80ffff + - virtual_address: 0x1000f039 + size: 0x680a7400 + - virtual_address: 0x1000f5b8 + size: 0xfff92ee8 + - virtual_address: 0xf5d8b8ff + size: 0x8ce81000 is_signed: false overlay: - offset: 0 - size: 0 \ No newline at end of file + offset: 0x0 + size: 0x0 \ No newline at end of file diff --git a/lib/src/modules/pe/tests/testdata/c6f9709feccf42f2d9e22057182fe185f177fb9daaa2649b4669a24f2ee7e3ba.out b/lib/src/modules/pe/tests/testdata/c6f9709feccf42f2d9e22057182fe185f177fb9daaa2649b4669a24f2ee7e3ba.out index b76e43cce..819aadb05 100644 --- a/lib/src/modules/pe/tests/testdata/c6f9709feccf42f2d9e22057182fe185f177fb9daaa2649b4669a24f2ee7e3ba.out +++ b/lib/src/modules/pe/tests/testdata/c6f9709feccf42f2d9e22057182fe185f177fb9daaa2649b4669a24f2ee7e3ba.out @@ -17,26 +17,26 @@ opthdr_magic: IMAGE_NT_OPTIONAL_HDR32_MAGIC characteristics: 0x182 # EXECUTABLE_IMAGE | BYTES_REVERSED_LO | MACHINE_32BIT dll_characteristics: 0x0 timestamp: 1616191348 # 2021-03-19 22:02:28 UTC -image_base: 4194304 +image_base: 0x400000 checksum: 0 -base_of_code: 4096 -base_of_data: 20480 -entry_point: 1360 -entry_point_raw: 4432 -section_alignment: 4096 -file_alignment: 512 -loader_flags: 0 -size_of_optional_header: 224 -size_of_code: 16384 -size_of_initialized_data: 4608 -size_of_uninitialized_data: 4096 -size_of_image: 233472 -size_of_headers: 1024 -size_of_stack_reserve: 1048576 -size_of_stack_commit: 51200 -size_of_heap_reserve: 8192 -size_of_heap_commit: 4096 -pointer_to_symbol_table: 0 +base_of_code: 0x1000 +base_of_data: 0x5000 +entry_point: 0x550 +entry_point_raw: 0x1150 +section_alignment: 0x1000 +file_alignment: 0x200 +loader_flags: 0x0 +size_of_optional_header: 0xe0 +size_of_code: 0x4000 +size_of_initialized_data: 0x1200 +size_of_uninitialized_data: 0x1000 +size_of_image: 0x39000 +size_of_headers: 0x400 +size_of_stack_reserve: 0x100000 +size_of_stack_commit: 0xc800 +size_of_heap_reserve: 0x2000 +size_of_heap_commit: 0x1000 +pointer_to_symbol_table: 0x0 win32_version_value: 0 number_of_symbols: 0 number_of_rva_and_sizes: 16 @@ -75,195 +75,195 @@ version_info_list: sections: - name: "AUTO" full_name: "AUTO" - characteristics: 1610612768 - raw_data_size: 16384 - raw_data_offset: 1024 - virtual_address: 4096 - virtual_size: 0 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0x60000020 # SECTION_MEM_READ | SECTION_MEM_WRITE | SECTION_SCALE_INDEX + raw_data_size: 0x4000 + raw_data_offset: 0x400 + virtual_address: 0x1000 + virtual_size: 0x0 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".idata" full_name: ".idata" - characteristics: 3221225536 - raw_data_size: 1536 - raw_data_offset: 17408 - virtual_address: 20480 - virtual_size: 0 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0xc0000040 + raw_data_size: 0x600 + raw_data_offset: 0x4400 + virtual_address: 0x5000 + virtual_size: 0x0 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: "DGROUP" full_name: "DGROUP" - characteristics: 3221225536 - raw_data_size: 3072 - raw_data_offset: 18944 - virtual_address: 24576 - virtual_size: 0 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0xc0000040 + raw_data_size: 0xc00 + raw_data_offset: 0x4a00 + virtual_address: 0x6000 + virtual_size: 0x0 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".bss" full_name: ".bss" - characteristics: 3221225600 - raw_data_size: 4096 - raw_data_offset: 0 - virtual_address: 28672 - virtual_size: 0 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0xc0000080 + raw_data_size: 0x1000 + raw_data_offset: 0x0 + virtual_address: 0x7000 + virtual_size: 0x0 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".reloc" full_name: ".reloc" - characteristics: 1107296320 - raw_data_size: 1536 - raw_data_offset: 22016 - virtual_address: 32768 - virtual_size: 0 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0x42000040 + raw_data_size: 0x600 + raw_data_offset: 0x5600 + virtual_address: 0x8000 + virtual_size: 0x0 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".rsrc" full_name: ".rsrc" - characteristics: 1073741888 - raw_data_size: 194048 - raw_data_offset: 23552 - virtual_address: 36864 - virtual_size: 0 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0x40000040 + raw_data_size: 0x2f600 + raw_data_offset: 0x5c00 + virtual_address: 0x9000 + virtual_size: 0x0 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 data_directories: - - virtual_address: 0 - size: 0 - - virtual_address: 20480 - size: 1410 - - virtual_address: 36864 - size: 194048 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 32768 - size: 1440 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x5000 + size: 0x582 + - virtual_address: 0x9000 + size: 0x2f600 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x8000 + size: 0x5a0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 resource_timestamp: 1616191348 # 2021-03-19 22:02:28 UTC resource_version: major: 0 minor: 0 resources: - - length: 24329 - rva: 37696 - offset: 24384 + - length: 0x5f09 + rva: 0x9340 + offset: 0x5f40 type: RESOURCE_TYPE_ICON id: 1 language: 0 - - length: 1640 - rva: 62028 - offset: 48716 + - length: 0x668 + rva: 0xf24c + offset: 0xbe4c type: RESOURCE_TYPE_ICON id: 2 language: 0 - - length: 744 - rva: 63668 - offset: 50356 + - length: 0x2e8 + rva: 0xf8b4 + offset: 0xc4b4 type: RESOURCE_TYPE_ICON id: 3 language: 0 - - length: 296 - rva: 64412 - offset: 51100 + - length: 0x128 + rva: 0xfb9c + offset: 0xc79c type: RESOURCE_TYPE_ICON id: 4 language: 0 - - length: 35889 - rva: 64708 - offset: 51396 + - length: 0x8c31 + rva: 0xfcc4 + offset: 0xc8c4 type: RESOURCE_TYPE_ICON id: 5 language: 0 - - length: 3752 - rva: 100600 - offset: 87288 + - length: 0xea8 + rva: 0x188f8 + offset: 0x154f8 type: RESOURCE_TYPE_ICON id: 6 language: 0 - - length: 2216 - rva: 104352 - offset: 91040 + - length: 0x8a8 + rva: 0x197a0 + offset: 0x163a0 type: RESOURCE_TYPE_ICON id: 7 language: 0 - - length: 1384 - rva: 106568 - offset: 93256 + - length: 0x568 + rva: 0x1a048 + offset: 0x16c48 type: RESOURCE_TYPE_ICON id: 8 language: 0 - - length: 105783 - rva: 107952 - offset: 94640 + - length: 0x19d37 + rva: 0x1a5b0 + offset: 0x171b0 type: RESOURCE_TYPE_ICON id: 9 language: 0 - - length: 9640 - rva: 213736 - offset: 200424 + - length: 0x25a8 + rva: 0x342e8 + offset: 0x30ee8 type: RESOURCE_TYPE_ICON id: 10 language: 0 - - length: 4264 - rva: 223376 - offset: 210064 + - length: 0x10a8 + rva: 0x36890 + offset: 0x33490 type: RESOURCE_TYPE_ICON id: 11 language: 0 - - length: 1128 - rva: 227640 - offset: 214328 + - length: 0x468 + rva: 0x37938 + offset: 0x34538 type: RESOURCE_TYPE_ICON id: 12 language: 0 - - length: 174 - rva: 228768 - offset: 215456 + - length: 0xae + rva: 0x37da0 + offset: 0x349a0 type: RESOURCE_TYPE_GROUP_ICON id: 1000 language: 0 - - length: 1024 - rva: 228944 - offset: 215632 + - length: 0x400 + rva: 0x37e50 + offset: 0x34a50 type: RESOURCE_TYPE_VERSION id: 1 language: 0 - - length: 647 - rva: 229968 - offset: 216656 + - length: 0x287 + rva: 0x38250 + offset: 0x34e50 type: RESOURCE_TYPE_MANIFEST id: 1 language: 0 @@ -272,111 +272,111 @@ import_details: number_of_functions: 1 functions: - name: "CharUpperBuffA" - rva: 20768 + rva: 0x5120 - library_name: "KERNEL32.dll" number_of_functions: 47 functions: - name: "CloseHandle" - rva: 20776 + rva: 0x5128 - name: "CreateEventA" - rva: 20780 + rva: 0x512c - name: "CreateFileA" - rva: 20784 + rva: 0x5130 - name: "CreateThread" - rva: 20788 + rva: 0x5134 - name: "DeleteCriticalSection" - rva: 20792 + rva: 0x5138 - name: "EnterCriticalSection" - rva: 20796 + rva: 0x513c - name: "ExitProcess" - rva: 20800 + rva: 0x5140 - name: "ExitThread" - rva: 20804 + rva: 0x5144 - name: "FreeEnvironmentStringsA" - rva: 20808 + rva: 0x5148 - name: "GetACP" - rva: 20812 + rva: 0x514c - name: "GetCPInfo" - rva: 20816 + rva: 0x5150 - name: "GetCommandLineA" - rva: 20820 + rva: 0x5154 - name: "GetCommandLineW" - rva: 20824 + rva: 0x5158 - name: "GetCurrentThreadId" - rva: 20828 + rva: 0x515c - name: "GetCurrentThread" - rva: 20832 + rva: 0x5160 - name: "GetEnvironmentStrings" - rva: 20836 + rva: 0x5164 - name: "GetFileType" - rva: 20840 + rva: 0x5168 - name: "GetLastError" - rva: 20844 + rva: 0x516c - name: "GetModuleFileNameA" - rva: 20848 + rva: 0x5170 - name: "GetModuleFileNameW" - rva: 20852 + rva: 0x5174 - name: "GetModuleHandleA" - rva: 20856 + rva: 0x5178 - name: "GetOEMCP" - rva: 20860 + rva: 0x517c - name: "GetProcAddress" - rva: 20864 + rva: 0x5180 - name: "GetStdHandle" - rva: 20868 + rva: 0x5184 - name: "GetVersion" - rva: 20872 + rva: 0x5188 - name: "InitializeCriticalSection" - rva: 20876 + rva: 0x518c - name: "LeaveCriticalSection" - rva: 20880 + rva: 0x5190 - name: "LoadLibraryA" - rva: 20884 + rva: 0x5194 - name: "MultiByteToWideChar" - rva: 20888 + rva: 0x5198 - name: "SetConsoleCtrlHandler" - rva: 20892 + rva: 0x519c - name: "SetEnvironmentVariableA" - rva: 20896 + rva: 0x51a0 - name: "SetEnvironmentVariableW" - rva: 20900 + rva: 0x51a4 - name: "SetEvent" - rva: 20904 + rva: 0x51a8 - name: "SetLastError" - rva: 20908 + rva: 0x51ac - name: "SetStdHandle" - rva: 20912 + rva: 0x51b0 - name: "SetUnhandledExceptionFilter" - rva: 20916 + rva: 0x51b4 - name: "TlsAlloc" - rva: 20920 + rva: 0x51b8 - name: "TlsFree" - rva: 20924 + rva: 0x51bc - name: "TlsGetValue" - rva: 20928 + rva: 0x51c0 - name: "TlsSetValue" - rva: 20932 + rva: 0x51c4 - name: "UnhandledExceptionFilter" - rva: 20936 + rva: 0x51c8 - name: "VirtualAlloc" - rva: 20940 + rva: 0x51cc - name: "VirtualFree" - rva: 20944 + rva: 0x51d0 - name: "VirtualQuery" - rva: 20948 + rva: 0x51d4 - name: "WaitForSingleObject" - rva: 20952 + rva: 0x51d8 - name: "WideCharToMultiByte" - rva: 20956 + rva: 0x51dc - name: "WriteFile" - rva: 20960 + rva: 0x51e0 - library_name: "PBVM115.DLL" number_of_functions: 1 functions: - name: "ord67" ordinal: 67 - rva: 20968 + rva: 0x51e8 is_signed: false overlay: - offset: 217600 - size: 17408 \ No newline at end of file + offset: 0x35200 + size: 0x4400 \ No newline at end of file diff --git a/lib/src/modules/pe/tests/testdata/c703e95b9ec0ca955b1bcf33e1318a0029d9d4e7903cd63291946b334c314831.out b/lib/src/modules/pe/tests/testdata/c703e95b9ec0ca955b1bcf33e1318a0029d9d4e7903cd63291946b334c314831.out index ec7f09970..0138c4587 100644 --- a/lib/src/modules/pe/tests/testdata/c703e95b9ec0ca955b1bcf33e1318a0029d9d4e7903cd63291946b334c314831.out +++ b/lib/src/modules/pe/tests/testdata/c703e95b9ec0ca955b1bcf33e1318a0029d9d4e7903cd63291946b334c314831.out @@ -17,25 +17,25 @@ opthdr_magic: IMAGE_NT_OPTIONAL_HDR64_MAGIC characteristics: 0x30e # EXECUTABLE_IMAGE | LINE_NUMS_STRIPPED | LOCAL_SYMS_STRIPPED | MACHINE_32BIT | DEBUG_STRIPPED dll_characteristics: 0x0 timestamp: 0 # 1970-01-01 00:00:00 UTC -image_base: 0 +image_base: 0x0 checksum: 0 -base_of_code: 4096 -entry_point: 16794 -entry_point_raw: 16794 -section_alignment: 4096 -file_alignment: 4096 -loader_flags: 0 -size_of_optional_header: 240 -size_of_code: 0 -size_of_initialized_data: 0 -size_of_uninitialized_data: 0 -size_of_image: 36864 -size_of_headers: 4096 -size_of_stack_reserve: 0 -size_of_stack_commit: 0 -size_of_heap_reserve: 0 -size_of_heap_commit: 0 -pointer_to_symbol_table: 36864 +base_of_code: 0x1000 +entry_point: 0x419a +entry_point_raw: 0x419a +section_alignment: 0x1000 +file_alignment: 0x1000 +loader_flags: 0x0 +size_of_optional_header: 0xf0 +size_of_code: 0x0 +size_of_initialized_data: 0x0 +size_of_uninitialized_data: 0x0 +size_of_image: 0x9000 +size_of_headers: 0x1000 +size_of_stack_reserve: 0x0 +size_of_stack_commit: 0x0 +size_of_heap_reserve: 0x0 +size_of_heap_commit: 0x0 +pointer_to_symbol_table: 0x9000 win32_version_value: 0 number_of_symbols: 0 number_of_rva_and_sizes: 16 @@ -52,82 +52,82 @@ pdb_path: "/Users/runner/work/OpenCorePkg/OpenCorePkg/UDK/Build/OpenCorePkg/DEBU sections: - name: ".text" full_name: ".text" - characteristics: 1610612768 - raw_data_size: 20480 - raw_data_offset: 4096 - virtual_address: 4096 - virtual_size: 20480 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0x60000020 # SECTION_MEM_READ | SECTION_MEM_WRITE | SECTION_SCALE_INDEX + raw_data_size: 0x5000 + raw_data_offset: 0x1000 + virtual_address: 0x1000 + virtual_size: 0x5000 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".data" full_name: ".data" - characteristics: 3221225536 - raw_data_size: 4096 - raw_data_offset: 24576 - virtual_address: 24576 - virtual_size: 4096 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0xc0000040 + raw_data_size: 0x1000 + raw_data_offset: 0x6000 + virtual_address: 0x6000 + virtual_size: 0x1000 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".reloc" full_name: ".reloc" - characteristics: 1644167264 - raw_data_size: 4096 - raw_data_offset: 28672 - virtual_address: 28672 - virtual_size: 12 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0x62000060 # SECTION_MEM_READ | SECTION_MEM_WRITE | SECTION_SCALE_INDEX + raw_data_size: 0x1000 + raw_data_offset: 0x7000 + virtual_address: 0x7000 + virtual_size: 0xc + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".debug" full_name: ".debug" - characteristics: 1644167264 - raw_data_size: 4096 - raw_data_offset: 32768 - virtual_address: 32768 - virtual_size: 191 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0x62000060 # SECTION_MEM_READ | SECTION_MEM_WRITE | SECTION_SCALE_INDEX + raw_data_size: 0x1000 + raw_data_offset: 0x8000 + virtual_address: 0x8000 + virtual_size: 0xbf + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 data_directories: - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 28672 - size: 12 - - virtual_address: 32768 - size: 28 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x7000 + size: 0xc + - virtual_address: 0x8000 + size: 0x1c + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 is_signed: false overlay: - offset: 36864 - size: 4 \ No newline at end of file + offset: 0x9000 + size: 0x4 \ No newline at end of file diff --git a/lib/src/modules/pe/tests/testdata/c704cca0fe4c9bdee18a302952540073b860e3b4d42e081f86d27bdb1cf6ede4.out b/lib/src/modules/pe/tests/testdata/c704cca0fe4c9bdee18a302952540073b860e3b4d42e081f86d27bdb1cf6ede4.out index d42c38609..e6ada452b 100644 --- a/lib/src/modules/pe/tests/testdata/c704cca0fe4c9bdee18a302952540073b860e3b4d42e081f86d27bdb1cf6ede4.out +++ b/lib/src/modules/pe/tests/testdata/c704cca0fe4c9bdee18a302952540073b860e3b4d42e081f86d27bdb1cf6ede4.out @@ -17,26 +17,26 @@ opthdr_magic: IMAGE_NT_OPTIONAL_HDR32_MAGIC characteristics: 0x30f # RELOCS_STRIPPED | EXECUTABLE_IMAGE | LINE_NUMS_STRIPPED | LOCAL_SYMS_STRIPPED | MACHINE_32BIT | DEBUG_STRIPPED dll_characteristics: 0x0 timestamp: 1459377848 # 2016-03-30 22:44:08 UTC -image_base: 4194304 +image_base: 0x400000 checksum: 43228 -base_of_code: 4096 -base_of_data: 12288 -entry_point: 5344 -entry_point_raw: 5344 -section_alignment: 4096 -file_alignment: 4096 -loader_flags: 0 -size_of_optional_header: 224 -size_of_code: 8192 -size_of_initialized_data: 28672 -size_of_uninitialized_data: 4096 -size_of_image: 36864 -size_of_headers: 4096 -size_of_stack_reserve: 2097152 -size_of_stack_commit: 4096 -size_of_heap_reserve: 1048576 -size_of_heap_commit: 4096 -pointer_to_symbol_table: 0 +base_of_code: 0x1000 +base_of_data: 0x3000 +entry_point: 0x14e0 +entry_point_raw: 0x14e0 +section_alignment: 0x1000 +file_alignment: 0x1000 +loader_flags: 0x0 +size_of_optional_header: 0xe0 +size_of_code: 0x2000 +size_of_initialized_data: 0x7000 +size_of_uninitialized_data: 0x1000 +size_of_image: 0x9000 +size_of_headers: 0x1000 +size_of_stack_reserve: 0x200000 +size_of_stack_commit: 0x1000 +size_of_heap_reserve: 0x100000 +size_of_heap_commit: 0x1000 +pointer_to_symbol_table: 0x0 win32_version_value: 0 number_of_symbols: 0 number_of_rva_and_sizes: 16 @@ -52,218 +52,218 @@ number_of_signatures: 0 sections: - name: ".text" full_name: ".text" - characteristics: 1615855712 - raw_data_size: 8192 - raw_data_offset: 4096 - virtual_address: 4096 - virtual_size: 6004 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0x60500060 # SECTION_MEM_READ | SECTION_MEM_WRITE | SECTION_SCALE_INDEX + raw_data_size: 0x2000 + raw_data_offset: 0x1000 + virtual_address: 0x1000 + virtual_size: 0x1774 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".data" full_name: ".data" - characteristics: 3224371264 - raw_data_size: 4096 - raw_data_offset: 12288 - virtual_address: 12288 - virtual_size: 48 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0xc0300040 + raw_data_size: 0x1000 + raw_data_offset: 0x3000 + virtual_address: 0x3000 + virtual_size: 0x30 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".rdata" full_name: ".rdata" - characteristics: 1076887616 - raw_data_size: 4096 - raw_data_offset: 16384 - virtual_address: 16384 - virtual_size: 1360 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0x40300040 + raw_data_size: 0x1000 + raw_data_offset: 0x4000 + virtual_address: 0x4000 + virtual_size: 0x550 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".bss" full_name: ".bss" - characteristics: 3227517056 - raw_data_size: 0 - raw_data_offset: 0 - virtual_address: 20480 - virtual_size: 1024 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0xc0600080 + raw_data_size: 0x0 + raw_data_offset: 0x0 + virtual_address: 0x5000 + virtual_size: 0x400 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".idata" full_name: ".idata" - characteristics: 3224371264 - raw_data_size: 4096 - raw_data_offset: 20480 - virtual_address: 24576 - virtual_size: 1424 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0xc0300040 + raw_data_size: 0x1000 + raw_data_offset: 0x5000 + virtual_address: 0x6000 + virtual_size: 0x590 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".CRT" full_name: ".CRT" - characteristics: 3224371264 - raw_data_size: 4096 - raw_data_offset: 24576 - virtual_address: 28672 - virtual_size: 52 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0xc0300040 + raw_data_size: 0x1000 + raw_data_offset: 0x6000 + virtual_address: 0x7000 + virtual_size: 0x34 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".tls" full_name: ".tls" - characteristics: 3224371264 - raw_data_size: 4096 - raw_data_offset: 28672 - virtual_address: 32768 - virtual_size: 32 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0xc0300040 + raw_data_size: 0x1000 + raw_data_offset: 0x7000 + virtual_address: 0x8000 + virtual_size: 0x20 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 data_directories: - - virtual_address: 0 - size: 0 - - virtual_address: 24576 - size: 1424 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 32772 - size: 24 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 24836 - size: 200 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x6000 + size: 0x590 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x8004 + size: 0x18 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x6104 + size: 0xc8 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 import_details: - library_name: "KERNEL32.dll" number_of_functions: 21 functions: - name: "DeleteCriticalSection" - rva: 24836 + rva: 0x6104 - name: "EnterCriticalSection" - rva: 24840 + rva: 0x6108 - name: "GetCurrentProcess" - rva: 24844 + rva: 0x610c - name: "GetCurrentProcessId" - rva: 24848 + rva: 0x6110 - name: "GetCurrentThreadId" - rva: 24852 + rva: 0x6114 - name: "GetLastError" - rva: 24856 + rva: 0x6118 - name: "GetModuleHandleA" - rva: 24860 + rva: 0x611c - name: "GetProcAddress" - rva: 24864 + rva: 0x6120 - name: "GetStartupInfoA" - rva: 24868 + rva: 0x6124 - name: "GetSystemTimeAsFileTime" - rva: 24872 + rva: 0x6128 - name: "GetTickCount" - rva: 24876 + rva: 0x612c - name: "InitializeCriticalSection" - rva: 24880 + rva: 0x6130 - name: "LeaveCriticalSection" - rva: 24884 + rva: 0x6134 - name: "QueryPerformanceCounter" - rva: 24888 + rva: 0x6138 - name: "SetUnhandledExceptionFilter" - rva: 24892 + rva: 0x613c - name: "Sleep" - rva: 24896 + rva: 0x6140 - name: "TerminateProcess" - rva: 24900 + rva: 0x6144 - name: "TlsGetValue" - rva: 24904 + rva: 0x6148 - name: "UnhandledExceptionFilter" - rva: 24908 + rva: 0x614c - name: "VirtualProtect" - rva: 24912 + rva: 0x6150 - name: "VirtualQuery" - rva: 24916 + rva: 0x6154 - library_name: "msvcrt.dll" number_of_functions: 27 functions: - name: "__dllonexit" - rva: 24924 + rva: 0x615c - name: "__getmainargs" - rva: 24928 + rva: 0x6160 - name: "__initenv" - rva: 24932 + rva: 0x6164 - name: "__lconv_init" - rva: 24936 + rva: 0x6168 - name: "__set_app_type" - rva: 24940 + rva: 0x616c - name: "__setusermatherr" - rva: 24944 + rva: 0x6170 - name: "_acmdln" - rva: 24948 + rva: 0x6174 - name: "_amsg_exit" - rva: 24952 + rva: 0x6178 - name: "_cexit" - rva: 24956 + rva: 0x617c - name: "_fmode" - rva: 24960 + rva: 0x6180 - name: "_initterm" - rva: 24964 + rva: 0x6184 - name: "_iob" - rva: 24968 + rva: 0x6188 - name: "_lock" - rva: 24972 + rva: 0x618c - name: "_onexit" - rva: 24976 + rva: 0x6190 - name: "calloc" - rva: 24980 + rva: 0x6194 - name: "exit" - rva: 24984 + rva: 0x6198 - name: "fprintf" - rva: 24988 + rva: 0x619c - name: "free" - rva: 24992 + rva: 0x61a0 - name: "fwrite" - rva: 24996 + rva: 0x61a4 - name: "malloc" - rva: 25000 + rva: 0x61a8 - name: "memcpy" - rva: 25004 + rva: 0x61ac - name: "signal" - rva: 25008 + rva: 0x61b0 - name: "strlen" - rva: 25012 + rva: 0x61b4 - name: "strncmp" - rva: 25016 + rva: 0x61b8 - name: "_unlock" - rva: 25020 + rva: 0x61bc - name: "abort" - rva: 25024 + rva: 0x61c0 - name: "vfprintf" - rva: 25028 + rva: 0x61c4 is_signed: false overlay: - offset: 0 - size: 0 \ No newline at end of file + offset: 0x0 + size: 0x0 \ No newline at end of file diff --git a/lib/src/modules/pe/tests/testdata/c7dce6c950735bfcf2125be8eb1f3dd468eeb56a1c615c34f95bf38cb58b7d3a.out b/lib/src/modules/pe/tests/testdata/c7dce6c950735bfcf2125be8eb1f3dd468eeb56a1c615c34f95bf38cb58b7d3a.out index 52a2d905e..b86c7e04d 100644 --- a/lib/src/modules/pe/tests/testdata/c7dce6c950735bfcf2125be8eb1f3dd468eeb56a1c615c34f95bf38cb58b7d3a.out +++ b/lib/src/modules/pe/tests/testdata/c7dce6c950735bfcf2125be8eb1f3dd468eeb56a1c615c34f95bf38cb58b7d3a.out @@ -17,27 +17,27 @@ opthdr_magic: IMAGE_NT_OPTIONAL_HDR64_MAGIC characteristics: 0x2022 # EXECUTABLE_IMAGE | LARGE_ADDRESS_AWARE | DLL dll_characteristics: 0x160 # HIGH_ENTROPY_VA | DYNAMIC_BASE | NX_COMPAT timestamp: 1692784145 # 2023-08-23 09:49:05 UTC -image_base: 6442450944 +image_base: 0x180000000 checksum: 174636 -base_of_code: 4096 -entry_point: 35760 -entry_point_raw: 38832 +base_of_code: 0x1000 +entry_point: 0x8bb0 +entry_point_raw: 0x97b0 dll_name: "" export_timestamp: 4294967295 # 2106-02-07 06:28:15 UTC -section_alignment: 4096 -file_alignment: 512 -loader_flags: 0 -size_of_optional_header: 240 -size_of_code: 100352 -size_of_initialized_data: 72192 -size_of_uninitialized_data: 0 -size_of_image: 192512 -size_of_headers: 1024 -size_of_stack_reserve: 1048576 -size_of_stack_commit: 4096 -size_of_heap_reserve: 1048576 -size_of_heap_commit: 4096 -pointer_to_symbol_table: 0 +section_alignment: 0x1000 +file_alignment: 0x200 +loader_flags: 0x0 +size_of_optional_header: 0xf0 +size_of_code: 0x18800 +size_of_initialized_data: 0x11a00 +size_of_uninitialized_data: 0x0 +size_of_image: 0x2f000 +size_of_headers: 0x400 +size_of_stack_reserve: 0x100000 +size_of_stack_commit: 0x1000 +size_of_heap_reserve: 0x100000 +size_of_heap_commit: 0x1000 +pointer_to_symbol_table: 0x0 win32_version_value: 0 number_of_symbols: 0 number_of_rva_and_sizes: 16 @@ -51,8 +51,8 @@ number_of_delayed_imports: 0 number_of_exports: 4 number_of_signatures: 1 rich_signature: - offset: 128 - length: 112 + offset: 0x80 + length: 0x70 key: 893123191 raw_data: "3\x9bUfw\xfa;5w\xfa;5w\xfa;5c\x91?4|\xfa;5c\x9184r\xfa;5c\x91>4\xe0\xfa;5%\x8f>4j\xfa;5%\x8f?4y\xfa;5%\x8f84~\xfa;5\xce\x8f84v\xfa;5c\x91:4p\xfa;5w\xfa:5\x1b\xfa;5\xce\x8f34m\xfa;5\xce\x8f;4v\xfa;5\xce\x8f94v\xfa;5" clear_data: "DanS\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x14k\x04\x01\x0b\x00\x00\x00\x14k\x03\x01\x05\x00\x00\x00\x14k\x05\x01\x97\x00\x00\x00Ru\x05\x01\x1d\x00\x00\x00Ru\x04\x01\x0e\x00\x00\x00Ru\x03\x01\t\x00\x00\x00\xb9u\x03\x01\x01\x00\x00\x00\x14k\x01\x01\x07\x00\x00\x00\x00\x00\x01\x00l\x00\x00\x00\xb9u\x08\x01\x1a\x00\x00\x00\xb9u\x00\x01\x01\x00\x00\x00\xb9u\x02\x01\x01\x00\x00\x00" @@ -96,310 +96,310 @@ rich_signature: sections: - name: ".text" full_name: ".text" - characteristics: 1610612768 - raw_data_size: 100352 - raw_data_offset: 1024 - virtual_address: 4096 - virtual_size: 100096 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0x60000020 # SECTION_MEM_READ | SECTION_MEM_WRITE | SECTION_SCALE_INDEX + raw_data_size: 0x18800 + raw_data_offset: 0x400 + virtual_address: 0x1000 + virtual_size: 0x18700 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".rdata" full_name: ".rdata" - characteristics: 1073741888 - raw_data_size: 47104 - raw_data_offset: 101376 - virtual_address: 106496 - virtual_size: 46636 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0x40000040 + raw_data_size: 0xb800 + raw_data_offset: 0x18c00 + virtual_address: 0x1a000 + virtual_size: 0xb62c + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".data" full_name: ".data" - characteristics: 3221225536 - raw_data_size: 3584 - raw_data_offset: 148480 - virtual_address: 155648 - virtual_size: 16832 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0xc0000040 + raw_data_size: 0xe00 + raw_data_offset: 0x24400 + virtual_address: 0x26000 + virtual_size: 0x41c0 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".pdata" full_name: ".pdata" - characteristics: 1073741888 - raw_data_size: 5632 - raw_data_offset: 152064 - virtual_address: 176128 - virtual_size: 5340 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0x40000040 + raw_data_size: 0x1600 + raw_data_offset: 0x25200 + virtual_address: 0x2b000 + virtual_size: 0x14dc + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: "_RDATA" full_name: "_RDATA" - characteristics: 1073741888 - raw_data_size: 512 - raw_data_offset: 157696 - virtual_address: 184320 - virtual_size: 252 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0x40000040 + raw_data_size: 0x200 + raw_data_offset: 0x26800 + virtual_address: 0x2d000 + virtual_size: 0xfc + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".reloc" full_name: ".reloc" - characteristics: 1107296320 - raw_data_size: 2048 - raw_data_offset: 158208 - virtual_address: 188416 - virtual_size: 1636 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0x42000040 + raw_data_size: 0x800 + raw_data_offset: 0x26a00 + virtual_address: 0x2e000 + virtual_size: 0x664 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 data_directories: - - virtual_address: 150432 - size: 148 - - virtual_address: 150580 - size: 80 - - virtual_address: 0 - size: 0 - - virtual_address: 176128 - size: 5340 - - virtual_address: 160256 - size: 3024 - - virtual_address: 188416 - size: 1636 - - virtual_address: 143808 - size: 56 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 143872 - size: 312 - - virtual_address: 0 - size: 0 - - virtual_address: 106496 - size: 744 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 + - virtual_address: 0x24ba0 + size: 0x94 + - virtual_address: 0x24c34 + size: 0x50 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x2b000 + size: 0x14dc + - virtual_address: 0x27200 + size: 0xbd0 + - virtual_address: 0x2e000 + size: 0x664 + - virtual_address: 0x231c0 + size: 0x38 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x23200 + size: 0x138 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x1a000 + size: 0x2e8 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 import_details: - library_name: "KERNEL32.dll" number_of_functions: 83 functions: - name: "Sleep" - rva: 106528 + rva: 0x1a020 - name: "WriteConsoleW" - rva: 106536 + rva: 0x1a028 - name: "HeapFree" - rva: 106544 + rva: 0x1a030 - name: "GetCurrentProcess" - rva: 106552 + rva: 0x1a038 - name: "TerminateProcess" - rva: 106560 + rva: 0x1a040 - name: "CreateThread" - rva: 106568 + rva: 0x1a048 - name: "HeapAlloc" - rva: 106576 + rva: 0x1a050 - name: "GetProcessHeap" - rva: 106584 + rva: 0x1a058 - name: "ReadFile" - rva: 106592 + rva: 0x1a060 - name: "ExpandEnvironmentStringsW" - rva: 106600 + rva: 0x1a068 - name: "GetModuleFileNameW" - rva: 106608 + rva: 0x1a070 - name: "CreateFileW" - rva: 106616 + rva: 0x1a078 - name: "DeleteFileW" - rva: 106624 + rva: 0x1a080 - name: "CloseHandle" - rva: 106632 + rva: 0x1a088 - name: "GetFileSize" - rva: 106640 + rva: 0x1a090 - name: "CreateDirectoryW" - rva: 106648 + rva: 0x1a098 - name: "FindFirstFileW" - rva: 106656 + rva: 0x1a0a0 - name: "VirtualProtect" - rva: 106664 + rva: 0x1a0a8 - name: "EnterCriticalSection" - rva: 106672 + rva: 0x1a0b0 - name: "VirtualFree" - rva: 106680 + rva: 0x1a0b8 - name: "FindNextFileW" - rva: 106688 + rva: 0x1a0c0 - name: "WriteFile" - rva: 106696 + rva: 0x1a0c8 - name: "VirtualAlloc" - rva: 106704 + rva: 0x1a0d0 - name: "RemoveDirectoryW" - rva: 106712 + rva: 0x1a0d8 - name: "LeaveCriticalSection" - rva: 106720 + rva: 0x1a0e0 - name: "InitializeCriticalSection" - rva: 106728 + rva: 0x1a0e8 - name: "SetFilePointer" - rva: 106736 + rva: 0x1a0f0 - name: "FindClose" - rva: 106744 + rva: 0x1a0f8 - name: "GetFileAttributesW" - rva: 106752 + rva: 0x1a100 - name: "GetSystemDirectoryW" - rva: 106760 + rva: 0x1a108 - name: "LoadLibraryA" - rva: 106768 + rva: 0x1a110 - name: "GetWindowsDirectoryW" - rva: 106776 + rva: 0x1a118 - name: "GetProcAddress" - rva: 106784 + rva: 0x1a120 - name: "DeleteCriticalSection" - rva: 106792 + rva: 0x1a128 - name: "GetModuleHandleW" - rva: 106800 + rva: 0x1a130 - name: "VirtualQuery" - rva: 106808 + rva: 0x1a138 - name: "GetModuleHandleA" - rva: 106816 + rva: 0x1a140 - name: "UnhandledExceptionFilter" - rva: 106824 + rva: 0x1a148 - name: "SetUnhandledExceptionFilter" - rva: 106832 + rva: 0x1a150 - name: "IsProcessorFeaturePresent" - rva: 106840 + rva: 0x1a158 - name: "QueryPerformanceCounter" - rva: 106848 + rva: 0x1a160 - name: "GetCurrentProcessId" - rva: 106856 + rva: 0x1a168 - name: "GetCurrentThreadId" - rva: 106864 + rva: 0x1a170 - name: "GetSystemTimeAsFileTime" - rva: 106872 + rva: 0x1a178 - name: "InitializeSListHead" - rva: 106880 + rva: 0x1a180 - name: "IsDebuggerPresent" - rva: 106888 + rva: 0x1a188 - name: "GetStartupInfoW" - rva: 106896 + rva: 0x1a190 - name: "RtlUnwindEx" - rva: 106904 + rva: 0x1a198 - name: "InterlockedFlushSList" - rva: 106912 + rva: 0x1a1a0 - name: "GetLastError" - rva: 106920 + rva: 0x1a1a8 - name: "SetLastError" - rva: 106928 + rva: 0x1a1b0 - name: "InitializeCriticalSectionAndSpinCount" - rva: 106936 + rva: 0x1a1b8 - name: "TlsAlloc" - rva: 106944 + rva: 0x1a1c0 - name: "TlsGetValue" - rva: 106952 + rva: 0x1a1c8 - name: "TlsSetValue" - rva: 106960 + rva: 0x1a1d0 - name: "TlsFree" - rva: 106968 + rva: 0x1a1d8 - name: "FreeLibrary" - rva: 106976 + rva: 0x1a1e0 - name: "LoadLibraryExW" - rva: 106984 + rva: 0x1a1e8 - name: "RaiseException" - rva: 106992 + rva: 0x1a1f0 - name: "GetCommandLineA" - rva: 107000 + rva: 0x1a1f8 - name: "GetCommandLineW" - rva: 107008 + rva: 0x1a200 - name: "ExitProcess" - rva: 107016 + rva: 0x1a208 - name: "GetModuleHandleExW" - rva: 107024 + rva: 0x1a210 - name: "LCMapStringW" - rva: 107032 + rva: 0x1a218 - name: "GetStdHandle" - rva: 107040 + rva: 0x1a220 - name: "GetFileType" - rva: 107048 + rva: 0x1a228 - name: "FindFirstFileExW" - rva: 107056 + rva: 0x1a230 - name: "IsValidCodePage" - rva: 107064 + rva: 0x1a238 - name: "GetACP" - rva: 107072 + rva: 0x1a240 - name: "GetOEMCP" - rva: 107080 + rva: 0x1a248 - name: "GetCPInfo" - rva: 107088 + rva: 0x1a250 - name: "MultiByteToWideChar" - rva: 107096 + rva: 0x1a258 - name: "WideCharToMultiByte" - rva: 107104 + rva: 0x1a260 - name: "GetEnvironmentStringsW" - rva: 107112 + rva: 0x1a268 - name: "FreeEnvironmentStringsW" - rva: 107120 + rva: 0x1a270 - name: "SetFilePointerEx" - rva: 107128 + rva: 0x1a278 - name: "GetConsoleMode" - rva: 107136 + rva: 0x1a280 - name: "GetConsoleOutputCP" - rva: 107144 + rva: 0x1a288 - name: "GetStringTypeW" - rva: 107152 + rva: 0x1a290 - name: "SetStdHandle" - rva: 107160 + rva: 0x1a298 - name: "HeapSize" - rva: 107168 + rva: 0x1a2a0 - name: "HeapReAlloc" - rva: 107176 + rva: 0x1a2a8 - name: "FlushFileBuffers" - rva: 107184 + rva: 0x1a2b0 - library_name: "ntdll.dll" number_of_functions: 4 functions: - name: "RtlCaptureContext" - rva: 107200 + rva: 0x1a2c0 - name: "RtlGetVersion" - rva: 107208 + rva: 0x1a2c8 - name: "RtlLookupFunctionEntry" - rva: 107216 + rva: 0x1a2d0 - name: "RtlVirtualUnwind" - rva: 107224 + rva: 0x1a2d8 - library_name: "ADVAPI32.dll" number_of_functions: 3 functions: - name: "CryptGenRandom" - rva: 106496 + rva: 0x1a000 - name: "CryptAcquireContextW" - rva: 106504 + rva: 0x1a008 - name: "CryptReleaseContext" - rva: 106512 + rva: 0x1a010 export_details: - name: "DebugConnect" ordinal: 1 - rva: 4096 - offset: 1024 + rva: 0x1000 + offset: 0x400 - name: "DebugConnectWide" ordinal: 2 - rva: 4096 - offset: 1024 + rva: 0x1000 + offset: 0x400 - name: "DebugCreate" ordinal: 3 - rva: 4096 - offset: 1024 + rva: 0x1000 + offset: 0x400 - name: "DebugCreateEx" ordinal: 4 - rva: 4096 - offset: 1024 + rva: 0x1000 + offset: 0x400 is_signed: true signatures: - subject: "/C=KR/ST=SEOUL/L=Gangnam-gu/O=CCR INC/OU=IT Team/CN=CCR INC" @@ -459,5 +459,5 @@ signatures: not_before: 1550707200 # 2019-02-21 00:00:00 UTC not_after: 1650585599 # 2022-04-21 23:59:59 UTC overlay: - offset: 160256 - size: 3024 \ No newline at end of file + offset: 0x27200 + size: 0xbd0 \ No newline at end of file diff --git a/lib/src/modules/pe/tests/testdata/d009038e4e371f9cdc3a96923700c17d29de9dfc156666c98581dfeccc07548e.out b/lib/src/modules/pe/tests/testdata/d009038e4e371f9cdc3a96923700c17d29de9dfc156666c98581dfeccc07548e.out index f276edb4f..a958a46f1 100644 --- a/lib/src/modules/pe/tests/testdata/d009038e4e371f9cdc3a96923700c17d29de9dfc156666c98581dfeccc07548e.out +++ b/lib/src/modules/pe/tests/testdata/d009038e4e371f9cdc3a96923700c17d29de9dfc156666c98581dfeccc07548e.out @@ -17,25 +17,25 @@ opthdr_magic: IMAGE_NT_OPTIONAL_HDR32_MAGIC characteristics: 0x102 # EXECUTABLE_IMAGE | MACHINE_32BIT dll_characteristics: 0x400 # NO_SEH timestamp: 1301987779 # 2011-04-05 07:16:19 UTC -image_base: 65536 +image_base: 0x10000 checksum: 60403 -base_of_code: 1152 -base_of_data: 6400 -entry_point_raw: 6846 -section_alignment: 128 -file_alignment: 128 -loader_flags: 0 -size_of_optional_header: 224 -size_of_code: 5888 -size_of_initialized_data: 1664 -size_of_uninitialized_data: 0 -size_of_image: 8704 -size_of_headers: 1152 -size_of_stack_reserve: 262144 -size_of_stack_commit: 4096 -size_of_heap_reserve: 1048576 -size_of_heap_commit: 4096 -pointer_to_symbol_table: 0 +base_of_code: 0x480 +base_of_data: 0x1900 +entry_point_raw: 0x1abe +section_alignment: 0x80 +file_alignment: 0x80 +loader_flags: 0x0 +size_of_optional_header: 0xe0 +size_of_code: 0x1700 +size_of_initialized_data: 0x680 +size_of_uninitialized_data: 0x0 +size_of_image: 0x2200 +size_of_headers: 0x480 +size_of_stack_reserve: 0x40000 +size_of_stack_commit: 0x1000 +size_of_heap_reserve: 0x100000 +size_of_heap_commit: 0x1000 +pointer_to_symbol_table: 0x0 win32_version_value: 0 number_of_symbols: 0 number_of_rva_and_sizes: 16 @@ -49,8 +49,8 @@ number_of_delayed_imports: 0 number_of_exports: 0 number_of_signatures: 0 rich_signature: - offset: 512 - length: 64 + offset: 0x200 + length: 0x40 key: 2669511953 raw_data: "U\xe4s\xcc\x11\x85\x1d\x9f\x11\x85\x1d\x9f\x11\x85\x1d\x9f\x11\x85\x1c\x9f\x00\x85\x1d\x9f\xd2\x8a@\x9f\x12\x85\x1d\x9f\x18\xfd\x88\x9f\x10\x85\x1d\x9f\x18\xfd\x9e\x9f\x14\x85\x1d\x9f\x18\xfd\x89\x9f\x10\x85\x1d\x9f\x18\xfd\x8c\x9f\x10\x85\x1d\x9f" clear_data: "DanS\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x11\x00\x00\x00\xc3\x0f]\x00\x03\x00\x00\x00\tx\x95\x00\x01\x00\x00\x00\tx\x83\x00\x05\x00\x00\x00\tx\x94\x00\x01\x00\x00\x00\tx\x91\x00\x01\x00\x00\x00" @@ -74,39 +74,39 @@ rich_signature: version: 30729 times: 1 data_directories: - - virtual_address: 0 - size: 0 - - virtual_address: 6864 - size: 40 - - virtual_address: 7424 - size: 952 - - virtual_address: 0 - size: 0 - - virtual_address: 8704 - size: 4520 - - virtual_address: 8448 - size: 152 - - virtual_address: 6480 - size: 28 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 6400 - size: 72 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x1ad0 + size: 0x28 + - virtual_address: 0x1d00 + size: 0x3b8 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x2200 + size: 0x11a8 + - virtual_address: 0x2100 + size: 0x98 + - virtual_address: 0x1950 + size: 0x1c + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x1900 + size: 0x48 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 is_signed: false overlay: - offset: 0 - size: 0 \ No newline at end of file + offset: 0x0 + size: 0x0 \ No newline at end of file diff --git a/lib/src/modules/pe/tests/testdata/d3ad9f9db7c89a229b1bdb8b49310ea51f71fa70be014b191b8a545dc8251cdb.out b/lib/src/modules/pe/tests/testdata/d3ad9f9db7c89a229b1bdb8b49310ea51f71fa70be014b191b8a545dc8251cdb.out index 71874348c..1552cdecd 100644 --- a/lib/src/modules/pe/tests/testdata/d3ad9f9db7c89a229b1bdb8b49310ea51f71fa70be014b191b8a545dc8251cdb.out +++ b/lib/src/modules/pe/tests/testdata/d3ad9f9db7c89a229b1bdb8b49310ea51f71fa70be014b191b8a545dc8251cdb.out @@ -17,28 +17,28 @@ opthdr_magic: IMAGE_NT_OPTIONAL_HDR32_MAGIC characteristics: 0x210e # EXECUTABLE_IMAGE | LINE_NUMS_STRIPPED | LOCAL_SYMS_STRIPPED | MACHINE_32BIT | DLL dll_characteristics: 0x0 timestamp: 1157380595 # 2006-09-04 14:36:35 UTC -image_base: 268435456 +image_base: 0x10000000 checksum: 0 -base_of_code: 4096 -base_of_data: 36864 -entry_point: 14285 -entry_point_raw: 14285 +base_of_code: 0x1000 +base_of_data: 0x9000 +entry_point: 0x37cd +entry_point_raw: 0x37cd dll_name: "sens32.dll" export_timestamp: 1157380595 # 2006-09-04 14:36:35 UTC -section_alignment: 4096 -file_alignment: 4096 -loader_flags: 0 -size_of_optional_header: 224 -size_of_code: 32768 -size_of_initialized_data: 32768 -size_of_uninitialized_data: 0 -size_of_image: 69632 -size_of_headers: 4096 -size_of_stack_reserve: 1048576 -size_of_stack_commit: 4096 -size_of_heap_reserve: 1048576 -size_of_heap_commit: 4096 -pointer_to_symbol_table: 0 +section_alignment: 0x1000 +file_alignment: 0x1000 +loader_flags: 0x0 +size_of_optional_header: 0xe0 +size_of_code: 0x8000 +size_of_initialized_data: 0x8000 +size_of_uninitialized_data: 0x0 +size_of_image: 0x11000 +size_of_headers: 0x1000 +size_of_stack_reserve: 0x100000 +size_of_stack_commit: 0x1000 +size_of_heap_reserve: 0x100000 +size_of_heap_commit: 0x1000 +pointer_to_symbol_table: 0x0 win32_version_value: 0 number_of_symbols: 0 number_of_rva_and_sizes: 16 @@ -52,8 +52,8 @@ number_of_delayed_imports: 0 number_of_exports: 3 number_of_signatures: 0 rich_signature: - offset: 128 - length: 80 + offset: 0x80 + length: 0x50 key: 1940349680 raw_data: "\xb4\x03\xc9 \xf0b\xa7s\xf0b\xa7s\xf0b\xa7s\xc6D\xacs\xf1b\xa7ss~\xa9s\xe5b\xa7s\xc6D\xads\xbbb\xa7s\xf0b\xa7s\xf7b\xa7s\x92}\xb4s\xf7b\xa7s\xf0b\xa6s\x91b\xa7s\x18}\xacs\xf1b\xa7s\x18}\xa3s\xf1b\xa7s" clear_data: "DanS\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x006&\x0b\x00\x01\x00\x00\x00\x83\x1c\x0e\x00\x15\x00\x00\x006&\n\x00K\x00\x00\x00\x00\x00\x00\x00\x07\x00\x00\x00b\x1f\x13\x00\x07\x00\x00\x00\x00\x00\x01\x00a\x00\x00\x00\xe8\x1f\x0b\x00\x01\x00\x00\x00\xe8\x1f\x04\x00\x01\x00\x00\x00" @@ -86,286 +86,286 @@ pdb_path: "E:\\Coding\\DownLoader\\0823\xd7\xd4\xb6\xaf\xc9\xfd\xbc\xb6\xb0\xe6\ sections: - name: ".text" full_name: ".text" - characteristics: 1610612768 - raw_data_size: 32768 - raw_data_offset: 4096 - virtual_address: 4096 - virtual_size: 29842 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0x60000020 # SECTION_MEM_READ | SECTION_MEM_WRITE | SECTION_SCALE_INDEX + raw_data_size: 0x8000 + raw_data_offset: 0x1000 + virtual_address: 0x1000 + virtual_size: 0x7492 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".rdata" full_name: ".rdata" - characteristics: 1073741888 - raw_data_size: 4096 - raw_data_offset: 36864 - virtual_address: 36864 - virtual_size: 4040 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0x40000040 + raw_data_size: 0x1000 + raw_data_offset: 0x9000 + virtual_address: 0x9000 + virtual_size: 0xfc8 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".data" full_name: ".data" - characteristics: 3221225536 - raw_data_size: 16384 - raw_data_offset: 40960 - virtual_address: 40960 - virtual_size: 22764 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0xc0000040 + raw_data_size: 0x4000 + raw_data_offset: 0xa000 + virtual_address: 0xa000 + virtual_size: 0x58ec + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 - name: ".reloc" full_name: ".reloc" - characteristics: 1107296320 - raw_data_size: 4096 - raw_data_offset: 57344 - virtual_address: 65536 - virtual_size: 4032 - pointer_to_relocations: 0 - pointer_to_line_numbers: 0 + characteristics: 0x42000040 + raw_data_size: 0x1000 + raw_data_offset: 0xe000 + virtual_address: 0x10000 + virtual_size: 0xfc0 + pointer_to_relocations: 0x0 + pointer_to_line_numbers: 0x0 number_of_relocations: 0 number_of_line_numbers: 0 data_directories: - - virtual_address: 40784 - size: 120 - - virtual_address: 38716 - size: 100 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 65536 - size: 2184 - - virtual_address: 37232 - size: 28 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 36864 - size: 368 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 - - virtual_address: 0 - size: 0 + - virtual_address: 0x9f50 + size: 0x78 + - virtual_address: 0x973c + size: 0x64 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x10000 + size: 0x888 + - virtual_address: 0x9170 + size: 0x1c + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x9000 + size: 0x170 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 + - virtual_address: 0x0 + size: 0x0 import_details: - library_name: "KERNEL32.dll" number_of_functions: 67 functions: - name: "ReadFile" - rva: 36924 + rva: 0x903c - name: "CreateFileMappingA" - rva: 36928 + rva: 0x9040 - name: "MapViewOfFile" - rva: 36932 + rva: 0x9044 - name: "UnmapViewOfFile" - rva: 36936 + rva: 0x9048 - name: "WriteFile" - rva: 36940 + rva: 0x904c - name: "FlushFileBuffers" - rva: 36944 + rva: 0x9050 - name: "CreateProcessA" - rva: 36948 + rva: 0x9054 - name: "DeleteFileA" - rva: 36952 + rva: 0x9058 - name: "CloseHandle" - rva: 36956 + rva: 0x905c - name: "GetSystemDirectoryA" - rva: 36960 + rva: 0x9060 - name: "lstrlenA" - rva: 36964 + rva: 0x9064 - name: "CreateFileA" - rva: 36968 + rva: 0x9068 - name: "GetTempPathA" - rva: 36972 + rva: 0x906c - name: "CreateThread" - rva: 36976 + rva: 0x9070 - name: "WaitForSingleObject" - rva: 36980 + rva: 0x9074 - name: "SetFilePointer" - rva: 36984 + rva: 0x9078 - name: "Sleep" - rva: 36988 + rva: 0x907c - name: "GetCommandLineA" - rva: 36992 + rva: 0x9080 - name: "GetVersion" - rva: 36996 + rva: 0x9084 - name: "EnterCriticalSection" - rva: 37000 + rva: 0x9088 - name: "LeaveCriticalSection" - rva: 37004 + rva: 0x908c - name: "ExitProcess" - rva: 37008 + rva: 0x9090 - name: "TerminateProcess" - rva: 37012 + rva: 0x9094 - name: "GetCurrentProcess" - rva: 37016 + rva: 0x9098 - name: "GetCurrentThreadId" - rva: 37020 + rva: 0x909c - name: "TlsSetValue" - rva: 37024 + rva: 0x90a0 - name: "TlsAlloc" - rva: 37028 + rva: 0x90a4 - name: "TlsFree" - rva: 37032 + rva: 0x90a8 - name: "SetLastError" - rva: 37036 + rva: 0x90ac - name: "TlsGetValue" - rva: 37040 + rva: 0x90b0 - name: "GetLastError" - rva: 37044 + rva: 0x90b4 - name: "SetHandleCount" - rva: 37048 + rva: 0x90b8 - name: "GetStdHandle" - rva: 37052 + rva: 0x90bc - name: "GetFileType" - rva: 37056 + rva: 0x90c0 - name: "GetStartupInfoA" - rva: 37060 + rva: 0x90c4 - name: "DeleteCriticalSection" - rva: 37064 + rva: 0x90c8 - name: "GetModuleFileNameA" - rva: 37068 + rva: 0x90cc - name: "FreeEnvironmentStringsA" - rva: 37072 + rva: 0x90d0 - name: "FreeEnvironmentStringsW" - rva: 37076 + rva: 0x90d4 - name: "WideCharToMultiByte" - rva: 37080 + rva: 0x90d8 - name: "GetEnvironmentStrings" - rva: 37084 + rva: 0x90dc - name: "GetEnvironmentStringsW" - rva: 37088 + rva: 0x90e0 - name: "GetModuleHandleA" - rva: 37092 + rva: 0x90e4 - name: "GetEnvironmentVariableA" - rva: 37096 + rva: 0x90e8 - name: "GetVersionExA" - rva: 37100 + rva: 0x90ec - name: "HeapDestroy" - rva: 37104 + rva: 0x90f0 - name: "HeapCreate" - rva: 37108 + rva: 0x90f4 - name: "VirtualFree" - rva: 37112 + rva: 0x90f8 - name: "HeapFree" - rva: 37116 + rva: 0x90fc - name: "MultiByteToWideChar" - rva: 37120 + rva: 0x9100 - name: "GetStringTypeA" - rva: 37124 + rva: 0x9104 - name: "GetStringTypeW" - rva: 37128 + rva: 0x9108 - name: "HeapAlloc" - rva: 37132 + rva: 0x910c - name: "InitializeCriticalSection" - rva: 37136 + rva: 0x9110 - name: "InterlockedDecrement" - rva: 37140 + rva: 0x9114 - name: "InterlockedIncrement" - rva: 37144 + rva: 0x9118 - name: "GetCPInfo" - rva: 37148 + rva: 0x911c - name: "GetACP" - rva: 37152 + rva: 0x9120 - name: "GetOEMCP" - rva: 37156 + rva: 0x9124 - name: "VirtualAlloc" - rva: 37160 + rva: 0x9128 - name: "HeapReAlloc" - rva: 37164 + rva: 0x912c - name: "GetProcAddress" - rva: 37168 + rva: 0x9130 - name: "LoadLibraryA" - rva: 37172 + rva: 0x9134 - name: "RtlUnwind" - rva: 37176 + rva: 0x9138 - name: "LCMapStringA" - rva: 37180 + rva: 0x913c - name: "LCMapStringW" - rva: 37184 + rva: 0x9140 - name: "SetStdHandle" - rva: 37188 + rva: 0x9144 - library_name: "ADVAPI32.dll" number_of_functions: 14 functions: - name: "DeleteService" - rva: 36864 + rva: 0x9000 - name: "RegOpenKeyExA" - rva: 36868 + rva: 0x9004 - name: "ChangeServiceConfigA" - rva: 36872 + rva: 0x9008 - name: "RegCreateKeyA" - rva: 36876 + rva: 0x900c - name: "OpenSCManagerA" - rva: 36880 + rva: 0x9010 - name: "OpenServiceA" - rva: 36884 + rva: 0x9014 - name: "CloseServiceHandle" - rva: 36888 + rva: 0x9018 - name: "RegCreateKeyExA" - rva: 36892 + rva: 0x901c - name: "RegCloseKey" - rva: 36896 + rva: 0x9020 - name: "RegSetValueExA" - rva: 36900 + rva: 0x9024 - name: "RegQueryValueExA" - rva: 36904 + rva: 0x9028 - name: "RegisterServiceCtrlHandlerA" - rva: 36908 + rva: 0x902c - name: "SetServiceStatus" - rva: 36912 + rva: 0x9030 - name: "CreateServiceA" - rva: 36916 + rva: 0x9034 - library_name: "WS2_32.dll" number_of_functions: 2 functions: - name: "WSACleanup" ordinal: 116 - rva: 37220 + rva: 0x9164 - name: "WSAStartup" ordinal: 115 - rva: 37224 + rva: 0x9168 - library_name: "WININET.dll" number_of_functions: 5 functions: - name: "InternetOpenA" - rva: 37196 + rva: 0x914c - name: "InternetOpenUrlA" - rva: 37200 + rva: 0x9150 - name: "InternetReadFile" - rva: 37204 + rva: 0x9154 - name: "InternetCloseHandle" - rva: 37208 + rva: 0x9158 - name: "InternetGetConnectedState" - rva: 37212 + rva: 0x915c export_details: - name: "_DllMain@12" ordinal: 1 - rva: 4750 - offset: 4750 + rva: 0x128e + offset: 0x128e - name: "ServiceMain" ordinal: 2 - rva: 4465 - offset: 4465 + rva: 0x1171 + offset: 0x1171 - name: "_SvcCtrlFnct@4" ordinal: 3 - rva: 4096 - offset: 4096 + rva: 0x1000 + offset: 0x1000 is_signed: false overlay: - offset: 61440 - size: 1134 \ No newline at end of file + offset: 0xf000 + size: 0x46e \ No newline at end of file diff --git a/lib/src/modules/pe/tests/testdata/db6a9934570fa98a93a979e7e0e218e0c9710e5a787b18c6948f2eedd9338984.out b/lib/src/modules/pe/tests/testdata/db6a9934570fa98a93a979e7e0e218e0c9710e5a787b18c6948f2eedd9338984.out index 95a01434a..5996195f1 100644 --- a/lib/src/modules/pe/tests/testdata/db6a9934570fa98a93a979e7e0e218e0c9710e5a787b18c6948f2eedd9338984.out +++ b/lib/src/modules/pe/tests/testdata/db6a9934570fa98a93a979e7e0e218e0c9710e5a787b18c6948f2eedd9338984.out @@ -17,25 +17,25 @@ opthdr_magic: IMAGE_NT_OPTIONAL_HDR64_MAGIC characteristics: 0x22 # EXECUTABLE_IMAGE | LARGE_ADDRESS_AWARE dll_characteristics: 0x8120 # HIGH_ENTROPY_VA | NX_COMPAT | TERMINAL_SERVER_AWARE timestamp: 1629390430 # 2021-08-19 16:27:10 UTC -image_base: 5368709120 +image_base: 0x140000000 checksum: 0 -base_of_code: 4096 -entry_point: 2674832 -entry_point_raw: 2677904 -section_alignment: 4096 -file_alignment: 512 -loader_flags: 0 -size_of_optional_header: 240 -size_of_code: 3176448 -size_of_initialized_data: 2019328 -size_of_uninitialized_data: 0 -size_of_image: 5267456 -size_of_headers: 1024 -size_of_stack_reserve: 1048576 -size_of_stack_commit: 4096 -size_of_heap_reserve: 1048576 -size_of_heap_commit: 4096 -pointer_to_symbol_table: 0 +base_of_code: 0x1000 +entry_point: 0x28d090 +entry_point_raw: 0x28dc90 +section_alignment: 0x1000 +file_alignment: 0x200 +loader_flags: 0x0 +size_of_optional_header: 0xf0 +size_of_code: 0x307800 +size_of_initialized_data: 0x1ed000 +size_of_uninitialized_data: 0x0 +size_of_image: 0x506000 +size_of_headers: 0x400 +size_of_stack_reserve: 0x100000 +size_of_stack_commit: 0x1000 +size_of_heap_reserve: 0x100000 +size_of_heap_commit: 0x1000 +pointer_to_symbol_table: 0x0 win32_version_value: 0 number_of_symbols: 0 number_of_rva_and_sizes: 16 @@ -81,8 +81,8 @@ version_info_list: - key: "OriginalFilename" value: "EsaFin.exe" rich_signature: - offset: 128 - length: 144 + offset: 0x80 + length: 0x90 key: 1295525344 raw_data: "\xa4DV\x1e\xe0%8M\xe0%8M\xe0%8MT\xb9\xc9M\xef%8MT\xb9\xcbMG%8MT\xb9\xcaM\xf4%8M\x05|=L\xe2%8M=\xda\xf6M\xed%8M=\xda\xf7M\xe1%8M=\xda\xe8M\xe2%8M=\xda\xf3M\xc3%8M\xe0%9M\xeb&8M\xdb{