在上一篇文章：http://www.mouseos.com/windows/PE_image1.html 介绍 helloworld.exe 映像的 section 表内容，section 表指出每个映像中每个 section 的信息，包括：section 的 RVA，Size，Raw 数据位置和大小等。接下来深入了解 .text 节内容
|
域
|
.textbss 节
|
.text 节
|
.rdata 节
|
.data 节
|
.idata 节
|
.rsrc 节
|
.reloc 节
|
| VirtualSize |
0x00010000
|
0x00003BDB
|
0x00001CD1
|
0x00000764
|
0x00000AAE
|
0x0000E71C
|
0x00000564
|
| VirtualAddress |
0x00001000
|
0x00011000
|
0x00015000
|
0x00017000
|
0x00018000
|
0x00019000
|
0x00028000
|
| SizeOfRawData |
0
|
0x00003C00
|
0x00001E00
|
0x00000200
|
0x00000C00
|
0x0000E800
|
0x00000600
|
| PointerToRawData |
0
|
0x00000400
|
0x00004000
|
0x00005E00
|
0x00006000
|
0x00006C00
|
0x00015400
|
| PointerToRelocations |
0
|
0
|
0
|
0
|
0
|
0
|
0
|
| PointerToLinenumbers |
0
|
0
|
0
|
0
|
0
|
0
|
0
|
| NumberOfRelocations |
0
|
0
|
0
|
0
|
0
|
0
|
0
|
| NumberOfLinenumbers |
0
|
0
|
0
|
0
|
0
|
0
|
0
|
| Characteristics |
0xE00000A0
|
0x60000020
|
0x40000040
|
0xC0000040
|
0xC0000040
|
0x40000040
|
0x42000040
|
1. .text 节的 Raw 数据
.text 节表中的 PointerToRawData 指出 .text 节在映像中的位置，在它 helloworld.exe 映像中的 0x00000400 位置。SizeOfRawData 是 0x3C00 表明 .text 节占用 image 文件空间为 0x3C00，但是 .text 节的实际大小为 0x3BDB，它由 VirtualSize得出。它占用 0x3C00 的文件空间是因为要进行 0x200 bytes 的边界对齐，在 IMAGE_OPTIONAL_HEADER32 结构的 FileAlignment 域指出文件的边界是 0x200 bytes，这说明在 Image 文件中 section 的 size 是 0x200 的倍数。
下面是 .text 的 Raw 数据，从 0x00000400 - 0x00003FFF（共 0x3C00 bytes）：
| Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 00000400 CC CC CC CC CC E9 56 1F 00 00 E9 81 1C 00 00 E9 ìììììéV...é....é ----\
00000410 10 0B 00 00 E9 C7 0D 00 00 E9 02 2C 00 00 E9 F1 ....é?...é.,..é? |
00000420 2B 00 00 E9 44 0B 00 00 E9 13 20 00 00 E9 E6 0A +..éD...é. ..é?. |
00000430 00 00 E9 E3 2B 00 00 E9 F4 0B 00 00 E9 0F 1D 00 ..é?+..é?...é... |
00000440 00 E9 3A 1C 00 00 E9 15 0B 00 00 E9 92 1F 00 00 .é:...é....é’.. |
00000450 E9 AD 2B 00 00 E9 38 2C 00 00 E9 81 21 00 00 E9 é.+..é8,..é.!..é |
00000460 F2 2B 00 00 E9 9B 22 00 00 E9 F8 0A 00 00 E9 23 ò+..é?"..é?...é |
00000470 25 00 00 E9 20 2C 00 00 E9 23 21 00 00 E9 A4 2B %..é ,..é#!..é¤+ |
00000480 00 00 E9 8B 0A 00 00 E9 24 1C 00 00 E9 9F 09 00 ..é?...é$...é?.. |
00000490 00 E9 1A 25 00 00 E9 83 0A 00 00 E9 4A 2B 00 00 .é.%..é?...éJ+.. |
000004A0 E9 93 2B 00 00 E9 06 0B 00 00 E9 9F 0A 00 00 E9 é“+..é....é?...é |
000004B0 AC 1C 00 00 E9 A1 0A 00 00 E9 78 0A 00 00 E9 09 ?...é?...éx...é. |
000004C0 2B 00 00 E9 30 22 00 00 E9 A1 2B 00 00 E9 CA 24 +..é0"..é?+..éê$ |
000004D0 00 00 E9 29 0A 00 00 E9 6E 2B 00 00 E9 6F 1A 00 ..é)...én+..éo.. |
000004E0 00 E9 DA 0C 00 00 E9 B5 22 00 00 E9 4E 2B 00 00 .éú...éμ"..éN+.. \
000004F0 E9 19 2B 00 00 E9 60 1E 00 00 E9 81 0C 00 00 E9 é.+..é`...é....é \
00000500 FC 16 00 00 E9 23 2B 00 00 E9 B8 2A 00 00 E9 0D ü...é#+..é?*..é. / 函数跳转表
00000510 22 00 00 E9 3C 0A 00 00 E9 EB 2A 00 00 E9 AE 20 "..é<...é?*..é? /
00000520 00 00 E9 19 06 00 00 E9 DA 09 00 00 E9 5B 2B 00 ..é....éú...é[+. |
00000530 00 E9 DA 1B 00 00 E9 35 1F 00 00 E9 90 11 00 00 .éú...é5...é.... |
00000540 E9 3B 2B 00 00 E9 96 1B 00 00 E9 61 1E 00 00 E9 é;+..é–...éa...é |
00000550 F0 2A 00 00 E9 67 1D 00 00 E9 E2 1D 00 00 E9 FF e*..ég...éa...é? |
00000560 2A 00 00 E9 98 1E 00 00 E9 71 2A 00 00 E9 02 2B *..é?...éq*..é.+ |
00000570 00 00 E9 F9 0A 00 00 E9 48 20 00 00 E9 FF 09 00 ..éù...éH ..é?.. |
00000580 00 E9 C2 09 00 00 E9 6B 2A 00 00 E9 90 06 00 00 .é?...ék*..é.... |
00000590 E9 7B 1E 00 00 E9 38 2A 00 00 E9 DB 2A 00 00 E9 é{...é8*..é?*..é |
000005A0 68 09 00 00 E9 B3 2A 00 00 E9 2A 2A 00 00 E9 3D h...é3*..é**..é= |
000005B0 24 00 00 E9 9E 1B 00 00 E9 AB 2A 00 00 E9 7E 22 $..é?...é?*..é~" |
000005C0 00 00 E9 BF 2A 00 00 E9 FE 1F 00 00 E9 2D 21 00 ..é?*..ét...é-!. |
000005D0 00 E9 3A 21 00 00 E9 21 2A 00 00 E9 70 2A 00 00 .é:!..é!*..ép*.. |
000005E0 E9 5D 09 00 00 E9 06 2A 00 00 E9 01 1E 00 00 E9 é]...é.*..é....é |
000005F0 36 09 00 00 E9 39 2A 00 00 E9 72 11 00 00 E9 39 6...é9*..ér...é9 |
00000600 09 00 00 E9 38 17 00 00 E9 63 02 00 00 E9 0E 0D ...é8...éc...é.. |
00000610 00 00 E9 F3 20 00 00 E9 E4 03 00 00 E9 C3 29 00 ..éó ..é?...é?). |
00000620 00 E9 78 2A 00 00 E9 77 23 00 00 E9 10 1B 00 00 .éx*..éw#..é.... |
00000630 E9 FB 08 00 00 E9 74 03 00 00 E9 69 03 00 00 CC é?...ét...éi...ì -------+
00000640 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00000650 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00000660 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00000670 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00000680 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00000690 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
000006A0 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
000006B0 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
000006C0 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
000006D0 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
000006E0 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
000006F0 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00000700 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00000710 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00000720 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00000730 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00000740 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00000750 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00000760 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00000770 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00000780 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00000790 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
000007A0 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
000007B0 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
000007C0 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
000007D0 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
000007E0 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
000007F0 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00000800 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00000810 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00000820 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00000830 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00000840 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00000850 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00000860 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00000870 55 8B EC 81 EC F0 00 00 00 53 56 57 8D BD 10 FF U?ì.ìe...SVW.?.? ---\
00000880 FF FF B9 3C 00 00 00 B8 CC CC CC CC F3 AB 8B F4 ??1<...?ììììó??? |
00000890 6A 64 68 00 72 41 00 6A 67 8B 45 08 50 FF 15 C0 jdh.rA.jg?E.P?.à |
000008A0 83 41 00 3B F4 E8 D2 FC FF FF 8B F4 6A 64 68 38 ?A.;?èòü????jdh8 |
000008B0 71 41 00 6A 6D 8B 45 08 50 FF 15 C0 83 41 00 3B qA.jm?E.P?.à?A.; |
000008C0 F4 E8 B6 FC FF FF 8B 45 08 50 E8 48 FD FF FF 83 ?è?ü???E.PèHy??? |
000008D0 C4 04 8B 45 14 50 8B 4D 08 51 E8 43 FC FF FF 83 ?.?E.P?M.QèCü??? |
000008E0 C4 08 85 C0 75 04 33 C0 EB 7F 8B F4 6A 6D 8B 45 ?.…àu.3à?.??jm?E \
000008F0 08 50 FF 15 C4 83 41 00 3B F4 E8 7D FC FF FF 89 .P?.??A.;?è}ü??‰ \
00000900 45 D4 8B F4 6A 00 6A 00 6A 00 8D 45 E0 50 FF 15 E???j.j.j..EàP?. / _tWinMain() 函数
00000910 C8 83 41 00 3B F4 E8 61 FC FF FF 85 C0 74 47 8B è?A.;?èaü??…àtG? /
00000920 F4 8D 45 E0 50 8B 4D D4 51 8B 55 E0 52 FF 15 CC ?.EàP?M?Q?UàR?.ì |
00000930 83 41 00 3B F4 E8 42 FC FF FF 85 C0 75 26 8B F4 ?A.;?èBü??…àu&?? |
00000940 8D 45 E0 50 FF 15 D0 83 41 00 3B F4 E8 2B FC FF .EàP?.D?A.;?è+ü? |
00000950 FF 8B F4 8D 45 E0 50 FF 15 D4 83 41 00 3B F4 E8 ???.EàP?.??A.;?è |
00000960 18 FC FF FF EB 9C 8B 45 E8 52 8B CD 50 8D 15 90 .ü?????EèR?íP... |
00000970 15 41 00 E8 2D FB FF FF 58 5A 5F 5E 5B 81 C4 F0 .A.è-???XZ_^[.?e |
00000980 00 00 00 3B EC E8 F2 FB FF FF 8B E5 5D C2 10 00 ...;ìèò?????]?.. |
00000990 01 00 00 00 98 15 41 00 E0 FF FF FF 1C 00 00 00 ....?.A.à???.... /
000009A0 A4 15 41 00 6D 73 67 00 FF 25 D8 83 41 00 FF 25 ¤.A.msg.?%??A.?% ---
000009B0 DC 83 41 00 CC CC CC CC CC CC CC CC CC CC CC CC ü?A.ìììììììììììì
000009C0 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
000009D0 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
000009E0 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
000009F0 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00000A00 55 8B EC 81 EC F8 00 00 00 53 56 57 8D BD 08 FF U?ì.ì?...SVW.?.? ---\
00000A10 FF FF B9 3E 00 00 00 B8 CC CC CC CC F3 AB C7 45 ??1>...?ììììó??E |
00000A20 CC 30 00 00 00 C7 45 D0 03 00 00 00 C7 45 D4 8B ì0...?ED....?E?? |
00000A30 11 41 00 C7 45 D8 00 00 00 00 C7 45 DC 00 00 00 .A.?E?....?Eü... |
00000A40 00 8B 45 08 89 45 E0 8B F4 6A 6B 8B 45 08 50 FF .?E.‰Eà??jk?E.P? \
00000A50 15 B4 83 41 00 3B F4 E8 20 FB FF FF 89 45 E4 8B .′?A.;?è ???‰E?? \
00000A60 F4 68 00 7F 00 00 6A 00 FF 15 B8 83 41 00 3B F4 ?h....j.?.??A.;? / MyRegisterClass() 函数
00000A70 E8 07 FB FF FF 89 45 E8 C7 45 EC 06 00 00 00 C7 è.???‰Eè?Eì....? /
00000A80 45 F0 6D 00 00 00 C7 45 F4 38 71 41 00 8B F4 6A Eem...?E?8qA.??j |
00000A90 6C 8B 45 E0 50 FF 15 B4 83 41 00 3B F4 E8 DA FA l?EàP?.′?A.;?èúú |
00000AA0 FF FF 89 45 F8 8B F4 8D 45 CC 50 FF 15 BC 83 41 ??‰E???.EìP?.??A |
00000AB0 00 3B F4 E8 C4 FA FF FF 52 8B CD 50 8D 15 E0 16 .;?è?ú??R?íP..à. |
00000AC0 41 00 E8 DE F9 FF FF 58 5A 5F 5E 5B 81 C4 F8 00 A.èTù??XZ_^[.??. /
00000AD0 00 00 3B EC E8 A3 FA FF FF 8B E5 5D C3 8D 49 00 ..;ìè￡ú????]?.I. ---
00000AE0 01 00 00 00 E8 16 41 00 CC FF FF FF 30 00 00 00 ....è.A.ì???0...
00000AF0 F4 16 41 00 77 63 65 78 00 CC CC CC CC CC CC CC ?.A.wcex.ììììììì
00000B00 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00000B10 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00000B20 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00000B30 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00000B40 55 8B EC 81 EC CC 00 00 00 53 56 57 8D BD 34 FF U?ì.ìì...SVW.?4? ---\
00000B50 FF FF B9 33 00 00 00 B8 CC CC CC CC F3 AB 8B 45 ??13...?ììììó??E |
00000B60 08 A3 C8 72 41 00 8B F4 6A 00 8B 45 08 50 6A 00 .￡èrA.??j.?E.Pj. |
00000B70 6A 00 6A 00 68 00 00 00 80 6A 00 68 00 00 00 80 j.j.h...€j.h...€ \
00000B80 68 00 00 CF 00 68 00 72 41 00 68 38 71 41 00 6A h..?.h.rA.h8qA.j \
00000B90 00 FF 15 A8 83 41 00 3B F4 E8 DE F9 FF FF 89 45 .?.¨?A.;?èTù??‰E / InitInstance() 函数
00000BA0 F8 83 7D F8 00 75 04 33 C0 EB 2F 8B F4 8B 45 0C ??}?.u.3à?/???E. /
00000BB0 50 8B 4D F8 51 FF 15 AC 83 41 00 3B F4 E8 BA F9 P?M?Q?.??A.;?èoù |
00000BC0 FF FF 8B F4 8B 45 F8 50 FF 15 B0 83 41 00 3B F4 ?????E?P?.°?A.;? |
00000BD0 E8 A7 F9 FF FF B8 01 00 00 00 5F 5E 5B 81 C4 CC è§ù???...._^[.?ì /
00000BE0 00 00 00 3B EC E8 92 F9 FF FF 8B E5 5D C3 CC CC ...;ìè’ù????]?ìì ---
00000BF0 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00000C00 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00000C10 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00000C20 55 8B EC 81 EC 4C 01 00 00 53 56 57 8D BD B4 FE U?ì.ìL...SVW.?′t -----\
00000C30 FF FF B9 53 00 00 00 B8 CC CC CC CC F3 AB A1 00 ??1S...?ììììó??. |
00000C40 70 41 00 33 C5 89 45 FC 8B 45 0C 89 85 B4 FE FF pA.3?‰Eü?E.‰…′t? |
00000C50 FF 83 BD B4 FE FF FF 02 0F 84 2D 01 00 00 83 BD ???′t??..?-...?? |
00000C60 B4 FE FF FF 0F 0F 84 B0 00 00 00 81 BD B4 FE FF ′t??..?°....?′t? |
00000C70 FF 11 01 00 00 74 05 E9 22 01 00 00 8B 45 10 25 ?....t.é"...?E.% |
00000C80 FF FF 00 00 0F B7 C8 89 4D F4 8B 45 10 C1 E8 10 ??...·è‰M??E.áè. |
00000C90 25 FF FF 00 00 0F B7 C8 89 4D E8 8B 45 F4 89 85 %??...·è‰Mè?E?‰… |
00000CA0 B4 FE FF FF 83 BD B4 FE FF FF 68 74 0B 83 BD B4 ′t????′t??ht.??′ |
00000CB0 FE FF FF 69 74 27 EB 3A 8B F4 6A 00 68 8C 10 41 t??it'?:??j.h?.A |
00000CC0 00 8B 45 08 50 6A 67 8B 0D C8 72 41 00 51 FF 15 .?E.Pjg?.èrA.Q?. |
00000CD0 90 83 41 00 3B F4 E8 A1 F8 FF FF EB 39 8B F4 8B .?A.;?è?????9??? |
00000CE0 45 08 50 FF 15 94 83 41 00 3B F4 E8 8C F8 FF FF E.P?.”?A.;?è???? |
00000CF0 EB 24 8B F4 8B 45 14 50 8B 4D 10 51 8B 55 0C 52 ?$???E.P?M.Q?U.R |
00000D00 8B 45 08 50 FF 15 98 83 41 00 3B F4 E8 6B F8 FF ?E.P?.??A.;?èk?? \
00000D10 FF E9 AB 00 00 00 E9 A4 00 00 00 8B F4 8D 45 A0 ?é?...é¤...??.E \ WndProc() 函数
00000D20 50 8B 4D 08 51 FF 15 9C 83 41 00 3B F4 E8 4A F8 P?M.Q?.??A.;?èJ? /
00000D30 FF FF 89 45 94 8B F4 8D 85 7C FF FF FF 50 8B 4D ??‰E”??.…|???P?M /
00000D40 08 51 FF 15 D8 83 41 00 3B F4 E8 2D F8 FF FF 8B .Q?.??A.;?è-???? |
00000D50 F4 6A 25 8D 85 7C FF FF FF 50 6A FF 68 F8 59 41 ?j%.…|???Pj?h?YA |
00000D60 00 8B 4D 94 51 FF 15 DC 83 41 00 3B F4 E8 0A F8 .?M”Q?.ü?A.;?è.? |
00000D70 FF FF 8B F4 8D 45 A0 50 8B 4D 08 51 FF 15 A0 83 ????.E P?M.Q?. ? |
00000D80 41 00 3B F4 E8 F3 F7 FF FF EB 34 8B F4 6A 00 FF A.;?èó÷???4??j.? |
00000D90 15 A4 83 41 00 3B F4 E8 E0 F7 FF FF EB 21 8B F4 .¤?A.;?èà÷???!?? |
00000DA0 8B 45 14 50 8B 4D 10 51 8B 55 0C 52 8B 45 08 50 ?E.P?M.Q?U.R?E.P |
00000DB0 FF 15 98 83 41 00 3B F4 E8 BF F7 FF FF EB 02 33 ?.??A.;?è?÷???.3 |
00000DC0 C0 52 8B CD 50 8D 15 F4 19 41 00 E8 D5 F6 FF FF àR?íP..?.A.è???? |
00000DD0 58 5A 5F 5E 5B 8B 4D FC 33 CD E8 35 F6 FF FF 81 XZ_^[?Mü3íè5???. |
00000DE0 C4 4C 01 00 00 3B EC E8 90 F7 FF FF 8B E5 5D C2 ?L...;ìè.÷????]? |
00000DF0 10 00 8B FF 02 00 00 00 FC 19 41 00 A0 FF FF FF ..??....ü.A. ??? /
00000E00 40 00 00 00 19 1A 41 00 7C FF FF FF 10 00 00 00 @.....A.|???.... ----
00000E10 14 1A 41 00 72 65 63 74 00 70 73 00 CC CC CC CC ..A.rect.ps.ìììì
00000E20 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00000E30 55 8B EC 81 EC C4 00 00 00 53 56 57 8D BD 3C FF U?ì.ì?...SVW.?<? ----\
00000E40 FF FF B9 31 00 00 00 B8 CC CC CC CC F3 AB 8B 45 ??11...?ììììó??E |
00000E50 0C 89 85 3C FF FF FF 81 BD 3C FF FF FF 10 01 00 .‰…<???.?<???... |
00000E60 00 74 0E 81 BD 3C FF FF FF 11 01 00 00 74 09 EB .t..?<???....t.? |
00000E70 4D B8 01 00 00 00 EB 48 8B 45 10 25 FF FF 00 00 M?....?H?E.%??.. \
00000E80 0F B7 C8 83 F9 01 74 10 8B 45 10 25 FF FF 00 00 .·è?ù.t.?E.%??.. \ About() 函数
00000E90 0F B7 C8 83 F9 02 75 26 8B 45 10 25 FF FF 00 00 .·è?ù.u&?E.%??.. /
00000EA0 0F B7 C8 8B F4 51 8B 55 08 52 FF 15 8C 83 41 00 .·è??Q?U.R?.??A. /
00000EB0 3B F4 E8 C5 F6 FF FF B8 01 00 00 00 EB 02 33 C0 ;?è?????....?.3à |
00000EC0 5F 5E 5B 81 C4 C4 00 00 00 3B EC E8 AC F6 FF FF _^[.??...;ìè???? |
00000ED0 8B E5 5D C2 10 00 CC CC CC CC CC CC CC CC CC CC ??]?..ìììììììììì ----/
00000EE0 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00000EF0 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00000F00 FF 25 D4 83 41 00 FF 25 D0 83 41 00 FF 25 CC 83 ?%??A.?%D?A.?%ì? ---+
00000F10 41 00 FF 25 C8 83 41 00 FF 25 C4 83 41 00 FF 25 A.?%è?A.?%??A.?% |
00000F20 C0 83 41 00 FF 25 BC 83 41 00 FF 25 B8 83 41 00 à?A.?%??A.?%??A. |
00000F30 FF 25 B4 83 41 00 FF 25 B0 83 41 00 FF 25 AC 83 ?%′?A.?%°?A.?%?? >>> _RTC_CheckEsp()
00000F40 41 00 FF 25 A8 83 41 00 FF 25 A4 83 41 00 FF 25 A.?%¨?A.?%¤?A.?% |
00000F50 A0 83 41 00 FF 25 9C 83 41 00 FF 25 98 83 41 00 ?A.?%??A.?%??A. |
00000F60 FF 25 94 83 41 00 FF 25 90 83 41 00 FF 25 8C 83 ?%”?A.?%.?A.?%?? ---+
00000F70 41 00 CC CC CC CC CC CC CC CC CC CC CC CC CC CC A.ìììììììììììììì
00000F80 75 01 C3 55 8B EC 83 EC 00 50 52 53 56 57 8B 45 u.?U?ì?ì.PRSVW?E ---+
00000F90 04 6A 00 50 E8 60 F6 FF FF 83 C4 08 5F 5E 5B 5A .j.Pè`?????._^[Z |
00000FA0 58 8B E5 5D C3 CC CC CC CC CC CC CC CC CC CC CC X??]?ììììììììììì |
00000FB0 8B FF 55 8B EC 51 53 56 57 33 FF 8B F2 8B D9 89 ??U?ìQSVW3??ò?ù‰ \ _RTC_CheckStackVars()
00000FC0 7D FC 39 3E 7E 48 EB 08 8D A4 24 00 00 00 00 90 }ü9>~H?..¤$..... /
00000FD0 8B 46 04 8B 0C 38 81 7C 19 FC CC CC CC CC 75 0F ?F.?.8.|.üììììu. |
00000FE0 8B 54 38 04 03 D1 81 3C 1A CC CC CC CC 74 11 8B ?T8..?.<.ììììt.? |
00000FF0 4C 38 08 8B 55 04 51 52 E8 02 F5 FF FF 83 C4 08 L8.?U.QRè.?????. |
00001000 8B 45 FC 40 83 C7 0C 89 45 FC 3B 06 7C C2 5F 5E ?Eü@??.‰Eü;.|?_^ ---+
00001010 5B 8B E5 5D C3 CC CC CC CC CC CC CC CC CC CC CC [??]?ììììììììììì
00001020 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00001030 8B FF 55 8B EC 56 8B F1 85 F6 74 21 85 D2 74 1D ??U?ìV??…?t!…òt.
00001040 53 8B 5D 08 85 DB 74 14 57 B0 CC 8B FE 8B CA F3 S?].…?t.W°ì?t?êó
00001050 AA 8B 03 89 46 04 89 56 0C 89 33 5F 5B 5E 5D C2 a?.‰F.‰V.‰3_[^]? ---> _RTC_AllocaHelper()
00001060 04 00 CC CC CC CC CC CC CC CC CC CC CC CC CC CC ..ìììììììììììììì
00001070 8B FF 55 8B EC 51 53 56 57 8B F2 33 FF 8B D9 3B ??U?ìQSVW?ò3??ù; ------+
00001080 F7 74 52 89 7D FC 39 3E 7E 4B 8D 9B 00 00 00 00 ÷tR‰}ü9>~K.?.... |
00001090 8B 46 04 8B 0C 38 BA CC CC CC CC 39 54 19 FC 75 ?F.?.8oìììì9T.üu |
000010A0 0B 8B 44 38 04 03 C1 39 14 18 74 19 8B 4E 04 8B .?D8..á9..t.?N.? |
000010B0 54 0F 08 8B 45 04 52 50 E8 42 F4 FF FF 83 C4 08 T..?E.RPèB?????. \ _RTC_CheckStackVars2()
000010C0 BA CC CC CC CC 8B 45 FC 40 83 C7 0C 89 45 FC 3B oìììì?Eü@??.‰Eü; /
000010D0 06 7C BD EB 05 BA CC CC CC CC 8B 75 08 33 FF 8B .|??.oìììì?u.3?? |
000010E0 C6 85 F6 74 56 8B 40 04 47 85 C0 75 F8 85 F6 74 ?…?tV?@.G…àu?…?t |
000010F0 4A 39 16 75 0F 39 56 14 75 0A 39 56 18 75 05 39 J9.u.9V.u.9V.u.9 |
00001100 56 1C 74 13 8B 4D 04 57 56 51 E8 F4 F4 FF FF 83 V.t.?M.WVQè????? |
00001110 C4 0C BA CC CC CC CC 8B 46 0C 39 54 30 FC 74 13 ?.oìììì?F.9T0üt. |
00001120 8B 4D 04 57 56 51 E8 D8 F4 FF FF 83 C4 0C BA CC ?M.WVQè??????.oì |
00001130 CC CC CC 8B 76 04 4F 85 F6 75 B6 5F 5E 5B 8B E5 ììì?v.O…?u?_^[?? ------+
00001140 5D C2 04 00 CC CC CC CC CC CC CC CC CC CC CC CC ]?..ìììììììììììì
00001150 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00001160 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00001170 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00001180 80 3D 1C 73 41 00 00 75 1F 6A 00 6A 01 6A 00 6A €=.sA..u.j.j.j.j
00001190 00 6A 00 C6 05 1C 73 41 00 01 E8 14 F4 FF FF 50 .j.?..sA..è.???P
000011A0 E8 8C F3 FF FF 83 C4 18 C3 CC CC CC CC CC CC CC è?ó????.?ììììììì ----> _RTC_InitBase()
000011B0 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
000011C0 6A 01 6A 01 6A 00 6A 00 6A 00 E8 E4 F3 FF FF 83 j.j.j.j.j.è?ó???
000011D0 C4 14 C3 CC CC CC CC CC CC CC CC CC CC CC CC CC ?.?ììììììììììììì ----> _RTC_Shutdown()
000011E0 3B 0D 00 70 41 00 75 02 F3 C3 E9 C0 F2 FF FF CC ;..pA.u.ó?éàò??ì ----> __security_check_cookie()
000011F0 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00001200 8B FF 55 8B EC E8 D6 04 00 00 A3 2C 73 41 00 6A ??U?ìè?...￡,sA.j ----+
00001210 02 FF 15 30 83 41 00 83 C4 04 6A FF FF 15 A0 82 .?.0?A.??.j??. ? |
00001220 41 00 A3 48 77 41 00 A1 48 77 41 00 A3 58 77 41 A.￡HwA.?HwA.￡XwA |
00001230 00 8B 0D 34 83 41 00 8B 15 20 77 41 00 89 11 A1 .?.4?A.?. wA.‰.? \
00001240 38 83 41 00 8B 0D 1C 77 41 00 89 08 E8 3F F3 FF 8?A.?..wA.‰.è?ó? / pre_c_init()
00001250 FF E8 0D F3 FF FF 83 3D 24 70 41 00 00 75 0E 68 ?è.ó???=$pA..u.h |
00001260 EA 11 41 00 FF 15 3C 83 41 00 83 C4 04 E8 93 F1 ê.A.?.<?A.??.è“? |
00001270 FF FF 83 3D 20 70 41 00 FF 75 0B 6A FF FF 15 40 ???= pA.?u.j??.@ |
00001280 83 41 00 83 C4 04 33 C0 5D C3 CC CC CC CC CC CC ?A.??.3à]?ìììììì ----+
00001290 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
000012A0 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
000012B0 8B FF 55 8B EC 68 28 10 41 00 E8 B9 F1 FF FF 83 ??U?ìh(.A.è1????
000012C0 C4 04 A1 28 77 41 00 A3 34 73 41 00 68 34 73 41 ?.?(wA.￡4sA.h4sA ----> pre_cpp_init()
000012D0 00 8B 0D 24 77 41 00 51 68 24 73 41 00 68 28 73 .?.$wA.Qh$sA.h(s
000012E0 41 00 68 20 73 41 00 FF 15 28 83 41 00 83 C4 14 A.h sA.?.(?A.??.
000012F0 A3 30 73 41 00 83 3D 30 73 41 00 00 7D 0A 6A 08 ￡0sA.?=0sA..}.j.
00001300 E8 C2 F2 FF FF 83 C4 04 5D C3 CC CC CC CC CC CC è?ò????.]?ìììììì
00001310 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00001320 8B FF 55 8B EC E8 30 F1 FF FF E8 11 00 00 00 5D ??U?ìè0???è....] ---> wWinMainCRTStartup()
00001330 C3 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ?ììììììììììììììì
00001340 8B FF 55 8B EC 6A FE 68 20 6B 41 00 68 91 10 41 ??U?ìjth kA.h‘.A -----+
00001350 00 64 A1 00 00 00 00 50 83 C4 90 53 56 57 A1 00 .d?....P??.SVW?. |
00001360 70 41 00 31 45 F8 33 C5 50 8D 45 F0 64 A3 00 00 pA.1E?3?P.Eed￡.. |
00001370 00 00 89 65 E8 C7 45 98 00 00 00 00 8D 45 A0 50 ..‰eè?E?.....E P |
00001380 FF 15 88 82 41 00 83 3D 5C 77 41 00 00 75 0E 6A ?.??A.?=\wA..u.j |
00001390 00 6A 00 6A 01 6A 00 FF 15 8C 82 41 00 C7 45 FC .j.j.j.?.??A.?Eü |
000013A0 00 00 00 00 C7 45 8C 00 00 00 00 E8 8B F1 FF FF ....?E?....è???? |
000013B0 8B 48 04 89 4D 90 C7 45 94 00 00 00 00 6A 00 8B ?H.‰M.?E”....j.? |
000013C0 55 90 52 68 44 77 41 00 FF 15 90 82 41 00 89 45 U.RhDwA.?..?A.‰E |
000013D0 8C 83 7D 8C 00 74 1E 8B 45 8C 3B 45 90 75 09 C7 ??}?.t.?E?;E.u.? |
000013E0 45 94 01 00 00 00 EB 0D 68 E8 03 00 00 FF 15 94 E”....?.hè...?.” |
000013F0 82 41 00 EB C8 83 3D 34 77 41 00 01 75 0C 6A 1F ?A.?è?=4wA..u.j. |
00001400 E8 C2 F1 FF FF 83 C4 04 EB 4B 83 3D 34 77 41 00 è??????.?K?=4wA. |
00001410 00 75 38 C7 05 34 77 41 00 01 00 00 00 68 18 56 .u8?.4wA.....h.V |
00001420 41 00 68 0C 53 41 00 E8 FA F1 FF FF 83 C4 08 85 A.h.SA.èú?????.… |
00001430 C0 74 16 C7 45 84 FF 00 00 00 C7 45 FC FE FF FF àt.?E??...?Eüt?? \
00001440 FF 8B 45 84 E9 BD 01 00 00 EB 0A C7 05 3C 73 41 ??E?é?...?.?.<sA \
00001450 00 01 00 00 00 83 3D 34 77 41 00 01 75 1C 68 08 .....?=4wA..u.h. / __tmainCRTStartup()
00001460 52 41 00 68 00 50 41 00 E8 60 F0 FF FF 83 C4 08 RA.h.PA.è`e????. /
00001470 C7 05 34 77 41 00 02 00 00 00 83 3D 34 77 41 00 ?.4wA.....?=4wA. |
00001480 02 74 22 68 B8 57 41 00 6A 00 68 DC 01 00 00 68 .t"h?WA.j.hü...h |
00001490 40 57 41 00 6A 02 FF 15 F4 82 41 00 83 C4 14 83 @WA.j.?.??A.??.? |
000014A0 F8 01 75 01 CC 83 7D 94 00 75 0D 6A 00 68 44 77 ?.u.ì?}”.u.j.hDw |
000014B0 41 00 FF 15 98 82 41 00 83 3D 60 77 41 00 00 74 A.?.??A.?=`wA..t |
000014C0 1D 68 60 77 41 00 E8 F2 F0 FF FF 83 C4 04 85 C0 .h`wA.èòe????.…à |
000014D0 74 0C 6A 00 6A 02 6A 00 FF 15 60 77 41 00 6A 01 t.j.j.j.?.`wA.j. |
000014E0 FF 15 F0 82 41 00 83 C4 04 8B 15 EC 82 41 00 8B ?.e?A.??.?.ì?A.? |
000014F0 02 89 45 9C 8B 4D 9C 0F B7 11 83 FA 20 7F 10 8B .‰E??M?.·.?ú ..? |
00001500 45 9C 0F B7 08 85 C9 74 28 83 7D 98 00 74 22 8B E?.·.…ét(?}?.t"? |
00001510 55 9C 0F B7 02 83 F8 22 75 0C 33 C9 83 7D 98 00 U?.·.??"u.3é?}?. |
00001520 0F 94 C1 89 4D 98 8B 55 9C 83 C2 02 89 55 9C EB .”á‰M??U???.‰U?? |
00001530 C3 8B 45 9C 0F B7 08 85 C9 74 16 8B 55 9C 0F B7 ??E?.·.…ét.?U?.· |
00001540 02 83 F8 20 7F 0B 8B 4D 9C 83 C1 02 89 4D 9C EB .?? ..?M??á.‰M?? |
00001550 E0 8B 55 CC 83 E2 01 74 09 0F B7 45 D0 89 45 80 à?Uì?a.t..·ED‰E€ |
00001560 EB 07 C7 45 80 0A 00 00 00 8B 4D 80 51 8B 55 9C ?.?E€....?M€Q?U? |
00001570 52 6A 00 68 00 00 40 00 E8 8B F0 FF FF A3 38 73 Rj.h..@.è?e??￡8s |
00001580 41 00 83 3D 2C 73 41 00 00 75 0C A1 38 73 41 00 A.?=,sA..u.?8sA. |
00001590 50 FF 15 E8 82 41 00 83 3D 3C 73 41 00 00 75 06 P?.è?A.?=<sA..u. |
000015A0 FF 15 E4 82 41 00 C7 45 FC FE FF FF FF EB 52 8B ?.??A.?Eüt????R? |
000015B0 4D EC 8B 11 8B 02 89 45 88 8B 4D EC 51 8B 55 88 Mì?.?.‰E??MìQ?U? |
000015C0 52 E8 06 F0 FF FF 83 C4 08 C3 8B 65 E8 8B 45 88 Rè.e????.??eè?E? |
000015D0 A3 38 73 41 00 83 3D 2C 73 41 00 00 75 0D 8B 0D ￡8sA.?=,sA..u.?. |
000015E0 38 73 41 00 51 FF 15 48 83 41 00 83 3D 3C 73 41 8sA.Q?.H?A.?=<sA |
000015F0 00 00 75 06 FF 15 E4 82 41 00 C7 45 FC FE FF FF ..u.?.??A.?Eüt?? |
00001600 FF A1 38 73 41 00 8B 4D F0 64 89 0D 00 00 00 00 ??8sA.?Med‰..... |
00001610 59 5F 5E 5B 8B E5 5D C3 CC CC CC CC CC CC CC CC Y_^[??]?ìììììììì -----+
00001620 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00001630 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00001640 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00001650 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00001660 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00001670 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00001680 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00001690 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
000016A0 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
000016B0 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
000016C0 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
000016D0 8B FF 55 8B EC 64 A1 18 00 00 00 5D C3 CC CC CC ??U?ìd?....]?ììì
000016E0 8B FF 55 8B EC 83 EC 08 C7 45 FC 00 00 40 00 8B ??U?ì?ì.?Eü..@.?
000016F0 45 FC 0F B7 08 81 F9 4D 5A 00 00 74 04 33 C0 EB Eü.·..ùMZ..t.3à?
00001700 49 8B 55 FC 8B 45 FC 03 42 3C 89 45 F8 8B 4D F8 I?Uü?Eü.B<‰E??M? ----> check_managed_app()
00001710 81 39 50 45 00 00 74 04 33 C0 EB 2E 8B 55 F8 0F .9PE..t.3à?.?U?.
00001720 B7 42 18 3D 0B 01 00 00 74 04 33 C0 EB 1C 8B 4D ·B.=....t.3à?.?M
00001730 F8 83 79 74 0E 77 04 33 C0 EB 0F 8B 55 F8 33 C0 ??yt.w.3à?.?U?3à
00001740 83 BA E8 00 00 00 00 0F 95 C0 8B E5 5D C3 CC CC ?oè.....?à??]?ìì
00001750 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00001760 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00001770 8B FF 55 8B EC 8B 45 0C 83 F8 04 77 24 8B 0C 85 ??U?ì?E.??.w$?.…
00001780 08 70 41 00 8B 14 85 3C 5B 41 00 83 F9 FF 74 0F .pA.?.…<[A.?ù?t.
00001790 52 50 8B 45 08 51 50 E8 44 00 00 00 83 C4 10 5D RP?E.QPèD...??.] ----> _RTC_Failure()
000017A0 C3 BA 18 58 41 00 52 B8 05 00 00 00 50 8B 45 08 ?o.XA.R?....P?E.
000017B0 B9 01 00 00 00 51 50 E8 24 00 00 00 83 C4 10 5D 1....QPè$...??.]
000017C0 C3 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ?ììììììììììììììì
000017D0 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
000017E0 8B FF 55 8B EC 81 EC 40 0E 00 00 A1 00 70 41 00 ??U?ì.ì@...?.pA. ----+
000017F0 33 C5 89 45 FC 8B 45 10 53 8B 5D 08 56 57 8B 7D 3?‰Eü?E.S?].VW?} |
00001800 14 53 89 85 C8 F1 FF FF 89 BD C0 F1 FF FF C7 85 .S‰…è???‰?à????… |
00001810 C4 F1 FF FF 00 00 00 00 E8 1F EC FF FF 83 C4 04 ????....è.ì????. |
00001820 89 85 D0 F1 FF FF 85 C0 75 0F 53 E8 FB ED FF FF ‰…D???…àu.Sè?í?? |
00001830 83 C4 04 89 85 C4 F1 FF FF 8B 35 7C 82 41 00 6A ??.‰…?????5|?A.j |
00001840 00 6A 00 6A FF 57 6A 00 68 E9 FD 00 00 FF D6 3D .j.j?Wj.héy..??= |
00001850 00 02 00 00 73 26 50 8D 8D D4 F1 FF FF 51 6A FF ....s&P..????Qj? |
00001860 57 6A 00 68 E9 FD 00 00 FF D6 85 C0 74 0E 8D 95 Wj.héy..??…àt..? |
00001870 D4 F1 FF FF 89 95 CC F1 FF FF EB 0A C7 85 CC F1 ????‰?ì????.?…ì? |
00001880 FF FF A0 5C 41 00 68 02 10 00 00 E8 F0 01 00 00 ?? \A.h....èe... |
00001890 8B BD C8 F1 FF FF 83 C4 04 85 C0 74 25 8B 85 CC ??è?????.…àt%?…ì |
000018A0 F1 FF FF 8B 0C BD 54 5B 41 00 50 53 51 57 E8 7D ????.?T[A.PSQWè} |
000018B0 02 00 00 83 C4 10 85 C0 0F 85 22 01 00 00 32 C0 ...??.…à.…"...2à \
000018C0 EB 02 B0 01 83 BD C4 F1 FF FF 00 8B B5 D0 F1 FF ?.°.??????.?μD?? \
000018D0 FF 75 08 85 F6 0F 84 04 01 00 00 84 C0 74 0E FF ?u.…?.?....?àt.? / failwithmessage()
000018E0 15 80 82 41 00 85 C0 0F 85 F2 00 00 00 68 04 01 .€?A.…à.…ò...h. /
000018F0 00 00 8D 95 F4 FD FF FF 52 8D 85 D0 F1 FF FF 50 ...??y??R.…D???P |
00001900 68 04 01 00 00 8D 8D EC FB FF FF 51 83 C3 FB 53 h......ì???Q???S |
00001910 E8 99 EC FF FF 83 C4 18 85 F6 74 2D 8B 95 CC F1 è?ì????.…?t-??ì? |
00001920 FF FF 8B 8D D0 F1 FF FF 52 57 68 50 5C 41 00 8D ???.D???RWhP\A.. |
00001930 85 F4 FD FF FF 50 8B 45 0C 51 8D 95 EC FB FF FF …?y??P?E.Q.?ì??? |
00001940 52 50 FF D6 E9 8E 00 00 00 8B 3D 84 82 41 00 6A RP??é?...?=??A.j |
00001950 00 6A 00 68 0A 03 00 00 8D 8D D4 F5 FF FF 51 6A .j.h......????Qj |
00001960 FF 8D 95 EC FB FF FF 52 6A 00 68 E9 FD 00 00 BB ?.?ì???Rj.héy..? |
00001970 38 5C 41 00 FF D7 85 C0 74 06 8D 9D D4 F5 FF FF 8\A.?×…àt...???? |
00001980 6A 00 6A 00 68 0A 03 00 00 8D 85 E0 F8 FF FF 50 j.j.h.....…à???P |
00001990 6A FF 8D 8D F4 FD FF FF 51 6A 00 68 E9 FD 00 00 j?..?y??Qj.héy.. |
000019A0 BE 20 5C 41 00 FF D7 85 C0 74 06 8D B5 E0 F8 FF ? \A.?×…àt..μà?? |
000019B0 FF 8B 95 C0 F1 FF FF 8B 85 C8 F1 FF FF 8B 8D D0 ???à????…è????.D |
000019C0 F1 FF FF 52 8B 55 0C 50 68 F8 5B 41 00 56 51 53 ???R?U.Ph?[A.VQS |
000019D0 52 FF 95 C4 F1 FF FF 83 C4 1C 83 F8 01 75 01 CC R????????.??.u.ì |
000019E0 8B 4D FC 5F 5E 33 CD 5B E8 27 EA FF FF 8B E5 5D ?Mü_^3í[è'ê????] ------+
000019F0 C3 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ?ììììììììììììììì
00001A00 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00001A10 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00001A20 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00001A30 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00001A40 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00001A50 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00001A60 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00001A70 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00001A80 8B FF 55 8B EC 6A FE 68 40 6B 41 00 68 91 10 41 ??U?ìjth@kA.h‘.A
00001A90 00 64 A1 00 00 00 00 50 83 EC 24 53 56 57 A1 00 .d?....P?ì$SVW?.
00001AA0 70 41 00 31 45 F8 33 C5 50 8D 45 F0 64 A3 00 00 pA.1E?3?P.Eed￡..
00001AB0 00 00 89 65 E8 33 C0 88 45 E7 C7 45 CC 01 10 00 ..‰eè3à?E??Eì...
00001AC0 00 8B 4D 08 89 4D D0 8D 55 E7 89 55 D4 89 45 FC .?M.‰MD.U?‰U?‰Eü ---> DebuggerProbe()
00001AD0 8D 4D CC 51 6A 06 50 68 88 13 6D 40 FF 15 9C 82 .MìQj.Ph?.m@?.??
00001AE0 41 00 EB 09 B8 01 00 00 00 C3 8B 65 E8 C7 45 FC A.?.?....??eè?Eü
00001AF0 FE FF FF FF 0F B6 45 E7 8B 4D F0 64 89 0D 00 00 t???.?E??Med‰...
00001B00 00 00 59 5F 5E 5B 8B E5 5D C3 CC CC CC CC CC CC ..Y_^[??]?ìììììì
00001B10 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00001B20 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00001B30 8B FF 55 8B EC 6A FE 68 60 6B 41 00 68 91 10 41 ??U?ìjth`kA.h‘.A
00001B40 00 64 A1 00 00 00 00 50 83 EC 24 53 56 57 A1 00 .d?....P?ì$SVW?.
00001B50 70 41 00 31 45 F8 33 C5 50 8D 45 F0 64 A3 00 00 pA.1E?3?P.Eed￡..
00001B60 00 00 89 65 E8 33 C0 88 45 E7 C7 45 CC 02 10 00 ..‰eè3à?E??Eì...
00001B70 00 8B 4D 08 89 4D D0 8B 55 0C 89 55 D4 8B 4D 10 .?M.‰MD?U.‰U??M. ----> DebuggerRuntime()
00001B80 89 4D D8 8D 55 E7 89 55 DC 8B 4D 14 89 4D E0 89 ‰M?.U?‰Uü?M.‰Mà‰
00001B90 45 FC 8D 55 CC 52 6A 06 50 68 88 13 6D 40 FF 15 Eü.UìRj.Ph?.m@?.
00001BA0 9C 82 41 00 EB 09 B8 01 00 00 00 C3 8B 65 E8 C7 ??A.?.?....??eè?
00001BB0 45 FC FE FF FF FF 0F B6 45 E7 8B 4D F0 64 89 0D Eüt???.?E??Med‰.
00001BC0 00 00 00 00 59 5F 5E 5B 8B E5 5D C3 CC CC CC CC ....Y_^[??]?ìììì
00001BD0 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00001BE0 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00001BF0 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00001C00 8B FF 55 8B EC 81 EC 08 04 00 00 A1 00 70 41 00 ??U?ì.ì....?.pA.
00001C10 33 C5 89 45 FC 83 3D 10 70 41 00 FF 8B 45 08 89 3?‰Eü?=.pA.??E.‰
00001C20 85 F8 FB FF FF 8B 45 0C 0F 84 C0 00 00 00 80 38 …?????E..?à...€8
00001C30 00 53 56 0F 84 96 00 00 00 8B C8 8D 71 01 8B FF .SV.?–...?è.q.??
00001C40 8A 11 41 84 D2 75 F9 2B CE 83 C1 2D 81 F9 00 04 ?.A?òuù+??á-.ù..
00001C50 00 00 77 7B 8D 9D FC FB FF FF 33 C9 8D 64 24 00 ..w{..ü???3é.d$.
00001C60 8A 91 6C 5B 41 00 88 94 0D FC FB FF FF 41 84 D2 ?‘l[A.?”.ü???A?ò
00001C70 75 EE 8B D0 8A 08 40 84 C9 75 F9 57 8D BD FC FB u??D?.@?éuùW.?ü? ----> _RTC_StackFailure()
00001C80 FF FF 2B C2 4F 8A 4F 01 47 84 C9 75 F8 8B C8 C1 ??+?O?O.G?éu??èá
00001C90 E9 02 8B F2 F3 A5 8B C8 83 E1 03 B8 88 5B 41 00 é.?òó￥?è?á.??[A.
00001CA0 F3 A4 8B C8 8A 10 40 84 D2 75 F9 8D BD FC FB FF ó¤?è?.@?òuù.?ü??
00001CB0 FF 2B C1 8B F1 4F 8A 4F 01 47 84 C9 75 F8 8B C8 ?+á??O?O.G?éu??è
00001CC0 C1 E9 02 F3 A5 8B C8 83 E1 03 F3 A4 5F EB 05 BB áé.ó￥?è?á.ó¤_?.?
00001CD0 24 5D 41 00 A1 10 70 41 00 8B 8D F8 FB FF FF 53 $]A.?.pA.?.????S
00001CE0 6A 02 50 51 E8 F7 FA FF FF 83 C4 10 5E 5B 8B 4D j.PQè÷ú????.^[?M
00001CF0 FC 33 CD E8 1C E7 FF FF 8B E5 5D C3 CC CC CC CC ü3íè.?????]?ìììì
00001D00 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00001D10 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00001D20 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00001D30 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00001D40 8B FF 55 8B EC 81 EC 44 01 00 00 A1 00 70 41 00 ??U?ì.ìD...?.pA.
00001D50 33 C5 89 45 FC 53 8B 1D 18 70 41 00 56 8B 75 0C 3?‰EüS?..pA.V?u.
00001D60 57 8B 7D 08 89 BD BC FE FF FF 83 FB FF 0F 84 EF W?}.‰??t?????.??
00001D70 00 00 00 68 A0 5E 41 00 FF 15 70 82 41 00 85 C0 ...h ^A.?.p?A.…à
00001D80 0F 84 CB 00 00 00 68 94 5E 41 00 50 FF 15 74 82 .??...h”^A.P?.t?
00001D90 41 00 A3 48 73 41 00 85 F6 0F 84 B2 00 00 00 85 A.￡HsA.…?.?2...…
00001DA0 C0 0F 84 AA 00 00 00 8B 4D 10 8B 56 0C 68 88 5E à.?a...?M.?V.h?^
00001DB0 41 00 51 68 54 5E 41 00 83 EA 24 52 68 48 5E 41 A.QhT^A.?ê$RhH^A
00001DC0 00 8D 7E 20 57 68 38 5E 41 00 68 E0 5D 41 00 8D ..~ Wh8^A.hà]A..
00001DD0 8D C0 FE FF FF 68 C4 5D 41 00 51 FF D0 8B 56 0C .àt??h?]A.Q?D?V. ----> _RTC_AllocaFailure()
00001DE0 83 EA 24 52 57 8D 45 B4 50 8D 4D E8 51 E8 CE 00 ?ê$RW.E′P.MèQè?.
00001DF0 00 00 83 C4 38 68 C0 5D 41 00 8D 55 B4 52 68 BC ..??8hà]A..U′Rh?
00001E00 5D 41 00 8D 45 E8 50 68 B0 5D 41 00 8D 8D C0 FE ]A..EèPh°]A...àt
00001E10 FF FF 51 FF 15 78 82 41 00 8D 94 05 C0 FE FF FF ??Q?.x?A..”.àt??
00001E20 52 FF 15 48 73 41 00 8B 8D BC FE FF FF 8D 85 C0 R?.HsA.?.?t??.…à
00001E30 FE FF FF 50 6A 04 53 51 E8 A3 F9 FF FF 83 C4 28 t??Pj.SQè￡ù????(
00001E40 5F 5E 5B 8B 4D FC 33 CD E8 C7 E5 FF FF 8B E5 5D _^[?Mü3íè??????]
00001E50 C3 68 58 5D 41 00 6A 04 53 57 E8 81 F9 FF FF 83 ?hX]A.j.SWè.ù???
00001E60 C4 10 8B 4D FC 5F 5E 33 CD 5B E8 A5 E5 FF FF 8B ?.?Mü_^3í[è￥????
00001E70 E5 5D C3 CC CC CC CC CC CC CC CC CC CC CC CC CC ?]?ììììììììììììì
00001E80 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00001E90 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00001EA0 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00001EB0 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00001EC0 8B FF 55 8B EC 83 EC 08 8B 45 0C 53 56 8B 75 08 ??U?ì?ì.?E.SV?u.
00001ED0 89 45 FC 8B 45 10 57 33 FF 2B C6 89 45 F8 8B FF ‰Eü?E.W3?+?‰E???
00001EE0 8B 4D 14 83 F9 10 72 05 B9 10 00 00 00 3B F9 73 ?M.?ù.r.1....;ùs
00001EF0 26 8A 1C 30 8B 55 FC 0F B6 CB 51 68 BC 5E 41 00 &?.0?Uü.??Qh?^A.
00001F00 52 FF 15 48 73 41 00 83 45 FC 03 8B 45 F8 83 C4 R?.HsA.?Eü.?E??? ----> _getMemBlockDataString()
00001F10 0C 88 1E 47 46 EB C9 8B 4D 0C 8B 45 08 8D 14 79 .?.GF?é?M.?E...y
00001F20 C6 04 07 00 C6 04 17 00 5F 5E 5B 8B E5 5D C3 CC ?...?..._^[??]?ì
00001F30 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00001F40 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00001F50 8B FF 55 8B EC 81 EC 04 04 00 00 A1 00 70 41 00 ??U?ì.ì....?.pA.
00001F60 33 C5 89 45 FC 83 3D 14 70 41 00 FF 8B 45 08 0F 3?‰Eü?=.pA.??E..
00001F70 84 B6 00 00 00 53 56 85 C0 0F 84 90 00 00 00 8B ??...SV…à.?....?
00001F80 C8 8D 71 01 8A 11 41 84 D2 75 F9 2B CE 83 C1 3A è.q.?.A?òuù+??á:
00001F90 81 F9 00 04 00 00 77 77 8D 9D FC FB FF FF 33 C9 .ù....ww..ü???3é
00001FA0 8A 91 9C 5B 41 00 88 94 0D FC FB FF FF 41 84 D2 ?‘?[A.?”.ü???A?ò
00001FB0 75 EE 8B D0 8A 08 40 84 C9 75 F9 57 8D BD FC FB u??D?.@?éuùW.?ü?
00001FC0 FF FF 2B C2 4F 8A 4F 01 47 84 C9 75 F8 8B C8 C1 ??+?O?O.G?éu??èá ----> _RTC_UninitUse()
00001FD0 E9 02 8B F2 F3 A5 8B C8 83 E1 03 B8 AC 5B 41 00 é.?òó￥?è?á.??[A.
00001FE0 F3 A4 8B C8 8A 10 40 84 D2 75 F9 8D BD FC FB FF ó¤?è?.@?òuù.?ü??
00001FF0 FF 2B C1 8B F1 4F 8A 4F 01 47 84 C9 75 F8 8B C8 ?+á??O?O.G?éu??è
00002000 C1 E9 02 F3 A5 8B C8 83 E1 03 F3 A4 5F EB 05 BB áé.ó￥?è?á.ó¤_?.?
00002010 C4 5E 41 00 A1 14 70 41 00 53 6A 03 50 8B 45 04 ?^A.?.pA.Sj.P?E.
00002020 50 E8 BA F7 FF FF 83 C4 10 5E 5B 8B 4D FC 33 CD Pèo÷????.^[?Mü3í
00002030 E8 DF E3 FF FF 8B E5 5D C3 CC CC CC CC CC CC CC è??????]?ììììììì
00002040 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00002050 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00002060 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00002070 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00002080 B8 05 00 00 00 C3 CC CC CC CC CC CC CC CC CC CC ?....?ìììììììììì ---> _RTC_NumErrors()
00002090 8B FF 55 8B EC 8B 45 08 83 F8 04 77 09 8B 04 85 ??U?ì?E.??.w.?.…
000020A0 D0 5F 41 00 5D C3 33 C0 5D C3 CC CC CC CC CC CC D_A.]?3à]?ìììììì ---> _RTC_GetErrDesc()
000020B0 8B FF 55 8B EC 8B 4D 08 83 F9 04 77 13 8B 55 0C ??U?ì?M.?ù.w.?U.
000020C0 8B 04 8D 08 70 41 00 89 14 8D 08 70 41 00 5D C3 ?...pA.‰...pA.]? ---> _RTC_SetErrorType()
000020D0 83 C8 FF 5D C3 CC CC CC CC CC CC CC CC CC CC CC ?è?]?ììììììììììì
000020E0 8B FF 55 8B EC 8B 4D 08 A1 4C 73 41 00 89 0D 4C ??U?ì?M.?LsA.‰.L
000020F0 73 41 00 C7 05 50 73 41 00 00 00 00 00 5D C3 CC sA.?.PsA.....]?ì ----> _RTC_SetErrorFunc()
00002100 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00002110 8B FF 55 8B EC 8B 4D 08 A1 50 73 41 00 89 0D 50 ??U?ì?M.?PsA.‰.P
00002120 73 41 00 C7 05 4C 73 41 00 00 00 00 00 5D C3 CC sA.?.LsA.....]?ì ----> _RTC_SetErrorFuncW()
00002130 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00002140 A1 4C 73 41 00 C3 CC CC CC CC CC CC CC CC CC CC ?LsA.?ìììììììììì ----> _RTC_GetErrorFunc()
00002150 A1 50 73 41 00 C3 FF 25 44 83 41 00 CC CC CC CC ?PsA.??%D?A.ìììì ----> _RTC_GetErrorFuncW(),_CRT_RTC_INITW()
00002160 8B FF 55 8B EC 81 EC 28 03 00 00 A3 60 74 41 00 ??U?ì.ì(...￡`tA.
00002170 89 0D 5C 74 41 00 89 15 58 74 41 00 89 1D 54 74 ‰.\tA.‰.XtA.‰.Tt
00002180 41 00 89 35 50 74 41 00 89 3D 4C 74 41 00 66 8C A.‰5PtA.‰=LtA.f?
00002190 15 78 74 41 00 66 8C 0D 6C 74 41 00 66 8C 1D 48 .xtA.f?.ltA.f?.H
000021A0 74 41 00 66 8C 05 44 74 41 00 66 8C 25 40 74 41 tA.f?.DtA.f?%@tA
000021B0 00 66 8C 2D 3C 74 41 00 9C 8F 05 70 74 41 00 8B .f?-<tA.?..ptA.?
000021C0 45 00 A3 64 74 41 00 8B 45 04 A3 68 74 41 00 8D E.￡dtA.?E.￡htA..
000021D0 45 08 A3 74 74 41 00 8B 85 E0 FC FF FF C7 05 B0 E.￡ttA.?…àü???.°
000021E0 73 41 00 01 00 01 00 A1 68 74 41 00 A3 64 73 41 sA.....?htA.￡dsA ----> __report_gsfailure()
000021F0 00 C7 05 58 73 41 00 09 04 00 C0 C7 05 5C 73 41 .?.XsA....à?.\sA
00002200 00 01 00 00 00 8B 0D 00 70 41 00 89 8D D8 FC FF .....?..pA.‰.?ü?
00002210 FF 8B 15 04 70 41 00 89 95 DC FC FF FF FF 15 80 ??..pA.‰?üü???.€
00002220 82 41 00 A3 A8 73 41 00 6A 01 E8 DA E2 FF FF 83 ?A.￡¨sA.j.èúa???
00002230 C4 04 6A 00 FF 15 60 82 41 00 68 E8 5F 41 00 FF ?.j.?.`?A.hè_A.?
00002240 15 64 82 41 00 83 3D A8 73 41 00 00 75 0A 6A 01 .d?A.?=¨sA..u.j.
00002250 E8 B4 E2 FF FF 83 C4 04 68 09 04 00 C0 FF 15 68 è′a????.h...à?.h
00002260 82 41 00 50 FF 15 6C 82 41 00 8B E5 5D C3 CC CC ?A.P?.l?A.??]?ìì
00002270 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00002280 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00002290 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
000022A0 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
000022B0 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
000022C0 8B FF 55 8B EC 8B 45 08 8B 08 81 39 63 73 6D E0 ??U?ì?E.?..9csmà
000022D0 75 4F 8B 55 08 8B 02 83 78 10 03 75 44 8B 4D 08 uO?U.?.?x..uD?M.
000022E0 8B 11 81 7A 14 20 05 93 19 74 2A 8B 45 08 8B 08 ?..z. .“.t*?E.?. ---> unknow!
000022F0 81 79 14 21 05 93 19 74 1C 8B 55 08 8B 02 81 78 .y.!.“.t.?U.?..x
00002300 14 22 05 93 19 74 0E 8B 4D 08 8B 11 81 7A 14 00 .".“.t.?M.?..z..
00002310 40 99 01 75 0C E8 A4 E1 FF FF B8 01 00 00 00 EB @?.u.è¤á???....?
00002320 02 33 C0 5D C2 04 00 CC CC CC CC CC CC CC CC CC .3à]?..ììììììììì
00002330 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00002340 8B FF 55 8B EC 68 54 11 41 00 FF 15 60 82 41 00 ??U?ìhT.A.?.`?A. ----> unknow
00002350 33 C0 5D C3 CC CC CC CC CC CC FF 25 40 83 41 00 3à]?ìììììì?%@?A. ----> _configthreadlocale()
00002360 8B FF 55 8B EC 6A 00 6A 1F 68 B8 60 41 00 68 80 ??U?ìj.j.h?`A.h€
00002370 60 41 00 68 08 60 41 00 68 00 00 03 00 68 00 00 `A.h.`A.h....h..
00002380 01 00 6A 00 E8 0C E2 FF FF 83 C4 0C 50 E8 B8 E1 ..j.è.a????.Pè?á
00002390 FF FF 83 C4 18 5D C3 CC CC CC CC CC CC CC CC CC ????.]?ììììììììì
000023A0 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
000023B0 8B FF 55 8B EC 83 7D 08 00 75 02 EB 19 8B 45 1C ??U?ì?}..u.?.?E. ---> _invoke_watson_if_error()
000023C0 50 8B 4D 18 51 8B 55 14 52 8B 45 10 50 8B 4D 0C P?M.Q?U.R?E.P?M.
000023D0 51 E8 D3 E1 FF FF 5D C3 CC CC CC CC CC CC CC CC Qèóá??]?ìììììììì
000023E0 CC CC FF 25 3C 83 41 00 CC CC CC CC CC CC CC CC ìì?%<?A.ìììììììì ---> __setusermatherr()
000023F0 8B FF 55 8B EC 33 C0 5D C3 CC CC CC CC CC CC CC ??U?ì3à]?ììììììì ---> _matherr()
00002400 8B FF 55 8B EC 33 C0 5D C3 CC CC CC CC CC CC CC ??U?ì3à]?ììììììì ---> _setargv()
00002410 8B FF 56 BE 08 65 41 00 8B C6 3D 0C 67 41 00 73 ??V?.eA.??=.gA.s
00002420 13 8B 06 85 C0 74 02 FF D0 83 C6 04 81 FE 0C 67 .?.…àt.?D??..t.g ---> _RTC_Initialize()
00002430 41 00 72 ED 5E C3 CC CC CC CC CC CC CC CC CC CC A.rí^?ìììììììììì
00002440 8B FF 56 BE 14 68 41 00 8B C6 3D 18 6A 41 00 73 ??V?.hA.??=.jA.s
00002450 13 8B 06 85 C0 74 02 FF D0 83 C6 04 81 FE 18 6A .?.…àt.?D??..t.j ---> _RTC_Terminate()
00002460 41 00 72 ED 5E C3 CC CC CC CC CC CC CC CC CC CC A.rí^?ìììììììììì
00002470 8B FF 55 8B EC 6A FE 68 80 6B 41 00 68 91 10 41 ??U?ìjth€kA.h‘.A
00002480 00 64 A1 00 00 00 00 50 83 C4 EC 53 56 57 A1 00 .d?....P??ìSVW?.
00002490 70 41 00 31 45 F8 33 C5 50 8D 45 F0 64 A3 00 00 pA.1E?3?P.Eed￡..
000024A0 00 00 A1 58 77 41 00 50 FF 15 5C 82 41 00 89 45 ..?XwA.P?.\?A.‰E
000024B0 E4 83 7D E4 FF 75 12 8B 4D 08 51 FF 15 1C 83 41 ??}??u.?M.Q?..?A
000024C0 00 83 C4 04 E9 88 00 00 00 6A 08 E8 CB DF FF FF .??.é?...j.è????
000024D0 83 C4 04 C7 45 FC 00 00 00 00 8B 15 58 77 41 00 ??.?Eü....?.XwA.
000024E0 52 FF 15 5C 82 41 00 89 45 E4 A1 48 77 41 00 50 R?.\?A.‰E??HwA.P ---> _onexit()
000024F0 FF 15 5C 82 41 00 89 45 DC 8D 4D DC 51 8D 55 E4 ?.\?A.‰Eü.MüQ.U?
00002500 52 8B 45 08 50 FF 15 A0 82 41 00 50 E8 0B E1 FF R?E.P?. ?A.Pè.á?
00002510 FF 83 C4 0C 89 45 E0 8B 4D E4 51 FF 15 A0 82 41 ???.‰Eà?M?Q?. ?A
00002520 00 A3 58 77 41 00 8B 55 DC 52 FF 15 A0 82 41 00 .￡XwA.?UüR?. ?A.
00002530 A3 48 77 41 00 C7 45 FC FE FF FF FF E8 02 00 00 ￡HwA.?Eüt???è...
00002540 00 EB 0B 6A 08 E8 1E E0 FF FF 83 C4 04 C3 8B 45 .?.j.è.à????.??E
00002550 E0 8B 4D F0 64 89 0D 00 00 00 00 59 5F 5E 5B 8B à?Med‰.....Y_^[?
00002560 E5 5D C3 CC CC CC CC CC CC CC CC CC CC CC CC CC ?]?ììììììììììììì
00002570 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00002580 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00002590 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
000025A0 8B FF 55 8B EC 8B 45 08 50 E8 88 DF FF FF 83 C4 ??U?ì?E.Pè?????? ---> atexit()
000025B0 04 F7 D8 1B C0 F7 D8 83 E8 01 5D C3 CC CC CC CC .÷?.à÷??è.]?ìììì
000025C0 CC CC CC CC FF 25 30 83 41 00 FF 25 2C 83 41 00 ìììì?%0?A.?%,?A.
000025D0 FF 25 28 83 41 00 CC CC CC CC CC CC CC CC CC CC ?%(?A.ìììììììììì
000025E0 8B FF 55 8B EC 83 EC 18 C7 45 F8 00 00 00 00 C7 ??U?ì?ì.?E?....? -----+
000025F0 45 FC 00 00 00 00 81 3D 00 70 41 00 4E E6 40 BB Eü.....=.pA.N?@? |
00002600 74 1F A1 00 70 41 00 25 00 00 FF FF 74 13 8B 0D t.?.pA.%..??t.?. |
00002610 00 70 41 00 F7 D1 89 0D 04 70 41 00 E9 9B 00 00 .pA.÷?‰..pA.é?.. |
00002620 00 8D 55 F8 52 FF 15 48 82 41 00 8B 45 F8 89 45 ..U?R?.H?A.?E?‰E |
00002630 F4 8B 4D F4 33 4D FC 89 4D F4 FF 15 4C 82 41 00 ??M?3Mü‰M??.L?A. \
00002640 33 45 F4 89 45 F4 FF 15 50 82 41 00 33 45 F4 89 3E?‰E??.P?A.3E?‰ \ __security_init_cookie()
00002650 45 F4 FF 15 54 82 41 00 33 45 F4 89 45 F4 8D 55 E??.T?A.3E?‰E?.U /
00002660 E8 52 FF 15 58 82 41 00 8B 45 F4 33 45 E8 89 45 èR?.X?A.?E?3Eè‰E /
00002670 F4 8B 4D F4 33 4D EC 89 4D F4 81 7D F4 4E E6 40 ??M?3Mì‰M?.}?N?@ |
00002680 BB 75 09 C7 45 F4 4F E6 40 BB EB 1C 8B 55 F4 81 ?u.?E?O?@??.?U?. |
00002690 E2 00 00 FF FF 75 11 8B 45 F4 0D 11 47 00 00 C1 a..??u.?E?..G..á |
000026A0 E0 10 0B 45 F4 89 45 F4 8B 4D F4 89 0D 00 70 41 à..E?‰E??M?‰..pA |
000026B0 00 8B 55 F4 F7 D2 89 15 04 70 41 00 8B E5 5D C3 .?U?÷ò‰..pA.??]? -----+
000026C0 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
000026D0 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
000026E0 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
000026F0 CC CC CC CC CC CC CC CC FF 25 48 83 41 00 FF 25 ìììììììì?%H?A.?%
00002700 24 83 41 00 FF 25 E4 82 41 00 FF 25 E8 82 41 00 $?A.?%??A.?%è?A.--->_exit,_cexit,exit
00002710 FF 25 F0 82 41 00 CC CC CC CC CC CC CC CC CC CC ?%e?A.ìììììììììì
00002720 8B FF 55 8B EC 83 EC 0C 8B 45 08 89 45 F8 8B 4D ??U?ì?ì.?E.‰E??M
00002730 F8 0F B7 11 81 FA 4D 5A 00 00 74 04 33 C0 EB 3B ?.·..úMZ..t.3à?;
00002740 8B 45 F8 8B 4D F8 03 48 3C 89 4D F4 8B 55 F4 81 ?E??M?.H<‰M??U?. ---> _ValidateImageBase()
00002750 3A 50 45 00 00 74 04 33 C0 EB 20 8B 45 F4 83 C0 :PE..t.3à? ?E??à
00002760 18 89 45 FC 8B 4D FC 0F B7 11 81 FA 0B 01 00 00 .‰Eü?Mü.·..ú....
00002770 74 04 33 C0 EB 05 B8 01 00 00 00 8B E5 5D C3 CC t.3à?.?....??]?ì
00002780 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00002790 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
000027A0 8B FF 55 8B EC 83 EC 0C 8B 45 08 8B 4D 08 03 48 ??U?ì?ì.?E.?M..H
000027B0 3C 89 4D FC C7 45 F8 00 00 00 00 8B 55 FC 0F B7 <‰Mü?E?....?Uü.·
000027C0 42 14 8B 4D FC 8D 54 01 18 89 55 F4 EB 12 8B 45 B.?Mü.T..‰U??.?E
000027D0 F8 83 C0 01 89 45 F8 8B 4D F4 83 C1 28 89 4D F4 ??à.‰E??M??á(‰M? ---> _FindPESection()
000027E0 8B 55 FC 0F B7 42 06 39 45 F8 73 23 8B 4D F4 8B ?Uü.·B.9E?s#?M??
000027F0 55 0C 3B 51 0C 72 16 8B 45 F4 8B 48 0C 8B 55 F4 U.;Q.r.?E??H.?U?
00002800 03 4A 08 39 4D 0C 73 05 8B 45 F4 EB 04 EB BF 33 .J.9M.s.?E??.??3
00002810 C0 8B E5 5D C3 CC CC CC CC CC CC CC CC CC CC CC à??]?ììììììììììì
00002820 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00002830 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00002840 8B FF 55 8B EC 6A FE 68 A0 6B 41 00 68 91 10 41 ??U?ìjth kA.h‘.A
00002850 00 64 A1 00 00 00 00 50 83 C4 D8 53 56 57 A1 00 .d?....P???SVW?.
00002860 70 41 00 31 45 F8 33 C5 50 8D 45 F0 64 A3 00 00 pA.1E?3?P.Eed￡..
00002870 00 00 89 65 E8 C7 45 E4 00 00 40 00 C7 45 FC 00 ..‰eè?E?..@.?Eü.
00002880 00 00 00 8B 45 E4 50 E8 82 DC FF FF 83 C4 04 85 ...?E?Pè?ü????.…
00002890 C0 75 16 C7 45 D4 00 00 00 00 C7 45 FC FE FF FF àu.?E?....?Eüt??
000028A0 FF 8B 45 D4 E9 97 00 00 00 8B 4D 08 2B 4D E4 89 ??E?é—...?M.+M?‰
000028B0 4D DC 8B 55 DC 52 8B 45 E4 50 E8 27 DC FF FF 83 Mü?UüR?E?Pè'ü???
000028C0 C4 08 89 45 E0 83 7D E0 00 75 13 C7 45 D0 00 00 ?.‰Eà?}à.u.?ED.. ---> _IsNonwritableInCurrentImage()
000028D0 00 00 C7 45 FC FE FF FF FF 8B 45 D0 EB 62 8B 4D ..?Eüt????ED?b?M
000028E0 E0 8B 51 24 81 E2 00 00 00 80 F7 DA 1B D2 83 C2 à?Q$.a...€÷ú.ò??
000028F0 01 89 55 CC C7 45 FC FE FF FF FF 8B 45 CC EB 40 .‰Uì?Eüt????Eì?@
00002900 C7 45 FC FE FF FF FF EB 37 8B 45 EC 8B 08 8B 11 ?Eüt????7?Eì?.?.
00002910 89 55 D8 8B 45 D8 33 C9 3D 05 00 00 C0 0F 94 C1 ‰U??E?3é=...à.”á
00002920 8B C1 C3 8B 65 E8 C7 45 C8 00 00 00 00 C7 45 FC ?á??eè?Eè....?Eü
00002930 FE FF FF FF 8B 45 C8 EB 07 C7 45 FC FE FF FF FF t????Eè?.?Eüt???
00002940 8B 4D F0 64 89 0D 00 00 00 00 59 5F 5E 5B 8B E5 ?Med‰.....Y_^[??
00002950 5D C3 CC CC CC CC CC CC CC CC CC CC CC CC CC CC ]?ìììììììììììììì
00002960 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00002970 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00002980 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00002990 CC CC CC CC CC CC FF 25 F4 82 41 00 FF 25 F8 82 ìììììì?%??A.?%??
000029A0 41 00 FF 25 FC 82 41 00 CC CC CC CC CC CC CC CC A.?%ü?A.ìììììììì
000029B0 8B FF 55 8B EC 8B 45 14 50 8B 4D 10 51 8B 55 0C ??U?ì?E.P?M.Q?U. ---> _except_handler4()
000029C0 52 8B 45 08 50 68 14 10 41 00 68 00 70 41 00 E8 R?E.Ph..A.h.pA.è
000029D0 11 DC FF FF 83 C4 18 5D C3 CC CC CC CC CC CC CC .ü????.]?ììììììì
000029E0 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
000029F0 8B FF 55 8B EC 8B 45 14 8B 55 0C 83 EC 44 56 8B ??U?ì?E.?U.?ìDV?
00002A00 75 08 C7 00 00 00 00 00 6A 1C 8D 45 BC 50 33 C9 u.?.....j..E?P3é
00002A10 4E 56 66 89 0A FF 15 34 82 41 00 85 C0 75 07 33 NVf‰.?.4?A.…àu.3
00002A20 C0 5E 8B E5 5D C3 8B 4D 1C 8B 55 18 8B 45 C0 51 à^??]??M.?U.?EàQ
00002A30 52 50 FF 15 38 82 41 00 85 C0 74 E3 8B 55 C0 B9 RP?.8?A.…àt??Uà1
00002A40 4D 5A 00 00 66 39 0A 75 D6 8B 42 3C 85 C0 7E CF MZ..f9.u??B<…à~?
00002A50 03 C2 81 38 50 45 00 00 75 C5 0F B7 48 06 53 57 .?.8PE..u?.·H.SW
00002A60 0F B7 78 14 8D 44 07 24 2B F2 33 FF 33 DB 85 C9 .·x..D.$+ò3?3?…é
00002A70 74 17 8B 10 3B F2 72 09 8B FE 2B FA 3B 70 FC 72 t.?.;òr.?t+ú;pür
00002A80 08 43 83 C0 28 3B D9 72 E9 3B D9 74 5B 43 80 3D .C?à(;ùré;ùt[C€=
00002A90 30 77 41 00 00 75 20 83 3D 2C 77 41 00 00 75 48 0wA..u ?=,wA..uH
00002AA0 E8 BB 02 00 00 A3 2C 77 41 00 85 C0 74 3A C6 05 è?...￡,wA.…àt:?.
00002AB0 30 77 41 00 01 EB 05 A1 2C 77 41 00 68 58 61 41 0wA..?.?,wA.hXaA
00002AC0 00 50 FF 15 74 82 41 00 33 F6 3B C6 74 1A 8D 55 .P?.t?A.3?;?t..U
00002AD0 F0 52 8B 55 18 56 56 8D 4D D8 51 56 56 56 52 FF eR?U.VV.M?QVVVR?
00002AE0 D0 83 C4 20 85 C0 75 09 5F 5B 33 C0 5E 8B E5 5D D?? …àu._[3à^??]
00002AF0 C3 8B 4D F0 8B 01 8B 10 89 75 E4 FF D2 3D B5 A5 ??Me?.?.‰u??ò=μ￥
00002B00 31 01 0F 85 8C 01 00 00 8B 4D F0 8B 01 8B 40 1C 1..…?...?Me?.?@.
00002B10 8D 55 E8 52 68 54 61 41 00 56 FF D0 85 C0 0F 84 .UèRhTaA.V?D…à.?
00002B20 70 01 00 00 8B 4D E8 8B 11 8B 52 20 56 56 56 8D p...?Mè?.?R VVV.
00002B30 45 F4 50 57 53 FF D2 85 C0 0F 84 4B 01 00 00 8B E?PWS?ò…à.?K...? ---> _RTC_GetSrcLine()
00002B40 4D F4 89 75 FC 8B 01 8B 40 68 8D 55 FC 52 FF D0 M?‰uü?.?@h.UüR?D
00002B50 84 C0 0F 84 28 01 00 00 8B 4D FC 3B CE 0F 84 1D ?à.?(...?Mü;?.?.
00002B60 01 00 00 8B 11 8B 42 08 FF D0 85 C0 0F 84 F5 00 ...?.?B.?D…à.??.
00002B70 00 00 8B 4D FC 8B 11 8B 52 0C 6A 00 8D 45 F8 50 ..?Mü?.?R.j..E?P
00002B80 8D 45 E0 50 8D 45 08 50 8D 45 EC 50 6A 00 FF D2 .EàP.E.P.EìPj.?ò
00002B90 84 C0 0F 84 DF 00 00 00 0F B7 45 08 3B C3 75 0E ?à.??....·E.;?u.
00002BA0 8B 45 EC 3B C7 77 07 03 45 E0 3B F8 72 13 8B 4D ?Eì;?w..Eà;?r.?M
00002BB0 FC 8B 11 8B 42 08 FF D0 85 C0 75 B6 E9 A6 00 00 ü?.?B.?D…àu?é|..
00002BC0 00 8B 45 F8 85 C0 0F 84 AB 00 00 00 3D FF FF FF .?E?…à.??...=???
00002BD0 1F 0F 83 A0 00 00 00 8D 0C C5 00 00 00 00 51 6A ..? .....?....Qj
00002BE0 00 FF 15 3C 82 41 00 50 FF 15 40 82 41 00 8B F0 .?.<?A.P?.@?A.?e
00002BF0 85 F6 0F 84 7F 00 00 00 8B 4D FC 8B 11 8B 52 0C …?.?....?Mü?.?R.
00002C00 56 8D 45 F8 50 6A 00 6A 00 6A 00 8D 45 DC 50 FF V.E?Pj.j.j..EüP?
00002C10 D2 84 C0 74 52 2B 7D EC 3B 3E 72 4B 8B 4D F8 B8 ò?àtR+}ì;>rK?M??
00002C20 01 00 00 00 3B C8 76 0A 3B 3C C6 72 05 40 3B C1 ....;èv.;<?r.@;á
00002C30 72 F6 8B 44 C6 FC 8B 4D 14 6A 00 25 FF FF FF 00 r??D?ü?M.j.%???.
00002C40 89 01 8B 4D F4 8B 11 8B 52 70 6A 00 6A 00 8D 45 ‰.?M??.?Rpj.j..E
00002C50 10 50 8B 45 0C 50 8B 45 DC 50 FF D2 84 C0 74 07 .P?E.P?EüP?ò?àt.
00002C60 C7 45 E4 01 00 00 00 56 6A 00 FF 15 3C 82 41 00 ?E?....Vj.?.<?A.
00002C70 50 FF 15 44 82 41 00 8B 4D FC 8B 01 8B 10 FF D2 P?.D?A.?Mü?.?.?ò
00002C80 8B 4D F4 8B 01 8B 50 40 FF D2 8B 4D E8 8B 01 8B ?M??.?P@?ò?Mè?.?
00002C90 50 38 FF D2 8B 4D F0 8B 01 8B 50 28 FF D2 8B 45 P8?ò?Me?.?P(?ò?E
00002CA0 E4 5F 5B 5E 8B E5 5D C3 CC CC CC CC CC CC CC CC ?_[^??]?ìììììììì
00002CB0 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00002CC0 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00002CD0 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00002CE0 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00002CF0 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00002D00 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00002D10 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00002D20 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00002D30 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00002D40 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00002D50 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00002D60 8B FF 55 8B EC 81 EC 1C 02 00 00 A1 00 70 41 00 ??U?ì.ì....?.pA.
00002D70 33 C5 89 45 FC 80 3D 31 77 41 00 00 74 10 33 C0 3?‰Eü€=1wA..t.3à
00002D80 8B 4D FC 33 CD E8 8A D6 FF FF 8B E5 5D C3 56 8B ?Mü3íè??????]?V?
00002D90 35 70 82 41 00 68 34 61 41 00 C6 05 31 77 41 00 5p?A.h4aA.?.1wA.
00002DA0 01 FF D6 85 C0 0F 85 91 01 00 00 68 44 62 41 00 .??…à.…‘...hDbA.
00002DB0 FF D6 8B F0 85 F6 75 0F 5E 8B 4D FC 33 CD E8 51 ???e…?u.^?Mü3íèQ
00002DC0 D6 FF FF 8B E5 5D C3 57 8B 3D 74 82 41 00 68 34 ?????]?W?=t?A.h4
00002DD0 62 41 00 56 FF D7 89 85 E8 FD FF FF 85 C0 75 10 bA.V?׉…èy??…àu.
00002DE0 5F 5E 8B 4D FC 33 CD E8 28 D6 FF FF 8B E5 5D C3 _^?Mü3íè(?????]?
00002DF0 53 68 20 62 41 00 56 FF D7 8B D8 85 DB 74 34 68 Sh bA.V?×??…?t4h
00002E00 10 62 41 00 56 FF D7 8B F8 85 FF 74 26 8D 85 EC .bA.V?×??…?t&.…ì
00002E10 FD FF FF 50 6A 01 6A 00 68 A0 61 41 00 68 02 00 y??Pj.j.h aA.h..
00002E20 00 80 FF 95 E8 FD FF FF 85 C0 74 1A 56 FF 15 30 .€??èy??…àt.V?.0
00002E30 82 41 00 5B 5F 33 C0 5E 8B 4D FC 33 CD E8 D2 D5 ?A.[_3à^?Mü3íèò?
00002E40 FF FF 8B E5 5D C3 8D 8D F0 FD FF FF 51 8B 8D EC ????]?..ey??Q?.ì
00002E50 FD FF FF 8D 95 F4 FD FF FF 52 8D 85 E4 FD FF FF y??.??y??R.…?y?? ---> GetPdbDll()
00002E60 50 6A 00 68 6C 61 41 00 51 C7 85 F0 FD FF FF 08 Pj.hlaA.Q?…ey??.
00002E70 02 00 00 FF D3 8B 95 EC FD FF FF 52 8B D8 FF D7 ...?ó??ìy??R???×
00002E80 56 FF 15 30 82 41 00 85 DB 75 A8 83 BD E4 FD FF V?.0?A.…?u¨???y?
00002E90 FF 01 75 9F 8B 85 F0 FD FF FF A8 01 75 95 D1 E8 ?.u??…ey??¨.u??è
00002EA0 83 F8 02 72 8E 48 66 39 9C 45 F4 FD FF FF 75 83 ??.r?Hf9?E?y??u?
00002EB0 66 83 BC 45 F2 FD FF FF 5C 74 0E B9 5C 00 00 00 f??Eòy??\t.1\...
00002EC0 66 89 8C 45 F4 FD FF FF 40 83 CA FF 2B D0 83 FA f‰?E?y??@?ê?+D?ú
00002ED0 0E 0F 82 5C FF FF FF 8D 48 0D 81 F9 04 01 00 00 ..?\???.H..ù....
00002EE0 0F 87 4D FF FF FF 8B 15 34 61 41 00 8B 0D 38 61 .?M????.4aA.?.8a
00002EF0 41 00 8D 84 45 F4 FD FF FF 89 10 8B 15 3C 61 41 A..?E?y??‰.?.<aA
00002F00 00 89 48 04 8B 0D 40 61 41 00 89 50 08 8B 15 44 .‰H.?.@aA.‰P.?.D
00002F10 61 41 00 89 48 0C 8B 0D 48 61 41 00 89 50 10 66 aA.‰H.?.HaA.‰P.f
00002F20 8B 15 4C 61 41 00 89 48 14 66 89 50 18 8D 85 F4 ?.LaA.‰H.f‰P..…?
00002F30 FD FF FF 50 FF 15 70 82 41 00 5B 5F 8B 4D FC 33 y??P?.p?A.[_?Mü3
00002F40 CD 5E E8 CD D4 FF FF 8B E5 5D C3 CC CC CC CC CC í^èí?????]?ììììì
00002F50 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00002F60 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00002F70 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00002F80 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00002F90 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00002FA0 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00002FB0 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00002FC0 CC CC CC CC CC CC FF 25 00 83 41 00 FF 25 04 83 ìììììì?%.?A.?%.? ----\
00002FD0 41 00 FF 25 08 83 41 00 FF 25 0C 83 41 00 FF 25 A.?%.?A.?%.?A.?% |
00002FE0 10 83 41 00 FF 25 14 83 41 00 FF 25 18 83 41 00 .?A.?%.?A.?%.?A. |
00002FF0 FF 25 20 83 41 00 FF 25 A0 82 41 00 FF 25 98 82 ?% ?A.?% ?A.?%? ? |
00003000 41 00 FF 25 94 82 41 00 FF 25 90 82 41 00 FF 25 A.?%”?A.?%.?A.?% \
00003010 8C 82 41 00 FF 25 88 82 41 00 FF 25 84 82 41 00 ??A.?%??A.?%??A. \
00003020 FF 25 80 82 41 00 FF 25 7C 82 41 00 FF 25 9C 82 ?%€?A.?%|?A.?%?? / 函数跳转表（导入函数）
00003030 41 00 FF 25 78 82 41 00 FF 25 74 82 41 00 FF 25 A.?%x?A.?%t?A.?% /
00003040 70 82 41 00 FF 25 6C 82 41 00 FF 25 68 82 41 00 p?A.?%l?A.?%h?A. |
00003050 FF 25 64 82 41 00 FF 25 60 82 41 00 FF 25 5C 82 ?%d?A.?%`?A.?%\? |
00003060 41 00 FF 25 58 82 41 00 FF 25 54 82 41 00 FF 25 A.?%X?A.?%T?A.?% |
00003070 50 82 41 00 FF 25 4C 82 41 00 FF 25 48 82 41 00 P?A.?%L?A.?%H?A. |
00003080 FF 25 44 82 41 00 FF 25 40 82 41 00 FF 25 3C 82 ?%D?A.?%@?A.?%<? |
00003090 41 00 FF 25 38 82 41 00 FF 25 34 82 41 00 FF 25 A.?%8?A.?%4?A.?% -----+
000030A0 30 82 41 00 CC CC CC CC CC CC CC CC CC CC CC CC 0?A.ìììììììììììì
000030B0 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
000030C0 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
000030D0 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
000030E0 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
000030F0 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003100 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003110 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003120 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003130 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003140 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003150 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003160 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003170 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003180 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003190 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
000031A0 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
000031B0 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
000031C0 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
000031D0 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
000031E0 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
000031F0 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003200 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003210 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003220 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003230 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003240 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003250 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003260 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003270 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003280 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003290 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
000032A0 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
000032B0 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
000032C0 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
000032D0 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
000032E0 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
000032F0 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003300 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003310 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003320 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003330 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003340 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003350 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003360 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003370 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003380 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003390 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
000033A0 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
000033B0 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
000033C0 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
000033D0 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
000033E0 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
000033F0 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003400 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003410 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003420 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003430 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003440 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003450 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003460 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003470 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003480 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003490 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
000034A0 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
000034B0 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
000034C0 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
000034D0 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
000034E0 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
000034F0 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003500 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003510 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003520 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003530 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003540 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003550 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003560 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003570 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003580 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003590 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
000035A0 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
000035B0 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
000035C0 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
000035D0 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
000035E0 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
000035F0 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003600 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003610 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003620 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003630 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003640 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003650 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003660 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003670 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003680 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003690 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
000036A0 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
000036B0 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
000036C0 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
000036D0 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
000036E0 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
000036F0 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003700 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003710 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003720 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003730 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003740 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003750 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003760 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003770 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003780 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003790 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
000037A0 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
000037B0 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
000037C0 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
000037D0 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
000037E0 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
000037F0 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003800 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003810 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003820 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003830 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003840 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003850 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003860 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003870 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003880 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003890 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
000038A0 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
000038B0 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
000038C0 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
000038D0 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
000038E0 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
000038F0 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003900 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003910 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003920 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003930 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003940 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003950 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003960 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003970 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003980 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003990 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
000039A0 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
000039B0 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
000039C0 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
000039D0 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
000039E0 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
000039F0 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003A00 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003A10 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003A20 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003A30 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003A40 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003A50 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003A60 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003A70 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003A80 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003A90 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003AA0 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003AB0 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003AC0 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003AD0 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003AE0 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003AF0 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003B00 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003B10 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003B20 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003B30 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003B40 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003B50 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003B60 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003B70 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003B80 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003B90 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003BA0 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003BB0 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003BC0 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003BD0 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003BE0 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003BF0 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003C00 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003C10 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003C20 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003C30 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003C40 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003C50 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003C60 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003C70 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003C80 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003C90 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003CA0 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003CB0 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003CC0 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003CD0 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003CE0 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003CF0 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003D00 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003D10 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003D20 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003D30 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003D40 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003D50 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003D60 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003D70 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003D80 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003D90 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003DA0 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003DB0 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003DC0 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003DD0 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003DE0 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003DF0 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003E00 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003E10 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003E20 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003E30 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003E40 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003E50 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003E60 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003E70 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003E80 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003E90 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003EA0 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003EB0 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003EC0 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003ED0 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003EE0 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003EF0 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003F00 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003F10 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003F20 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003F30 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003F40 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003F50 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003F60 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003F70 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003F80 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003F90 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003FA0 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003FB0 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003FC0 CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC CC ìììììììììììììììì
00003FD0 CC CC CC CC CC CC CC CC CC CC CC 00 00 00 00 00 ììììììììììì.....
00003FE0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00003FF0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ |
.text 节有一大部分是无效的数据，用 0xCC 字节来填充，从 0x3FDB - 0x3FFF 这段空间是 0，多出来的这部分是为了 0x200 边界对齐的。
上面所标注的函数名是用 vistual studio 2010 调试时显示出来的。我将它们与 Raw 数据对应起来，标注出来 :)
2. .text 节的加载点
当映像被 windows 加载运行时，.text 节被加载在 0x00411000 地址上，这个地址是 ImageBase + VirtualAddress = 0x00400000 + 0x00011000 = 0x00411000
在 IMAGE_OPTIONAL_HEADER32 结构里指出 ImageBase 的值是 0x00400000，对于 32 位下台来说，ImageBase 都是 0x00400000，有趣的是：在我的 windows 7 x64 上选择 Win32 为目标平台编译时，ImageBase 也是 0x00400000。
但是这个 32 位的 helloworld.exe 映像在 win7 x64 上运行时，.text 节被加载到 0x011C1000 地址上，因此：
| 32 位的 helloworld.exe 在 Win64 下，它的 ImageBase 的值是 0x011b0000，这个 ImageBase 可能每次都是不同的 |
在 64 位 windows 上，加载器加载 helloworld.exe 映像时，改来了原来的 ImageBase 值，所以：.text 节被加载到 0x011b0000 + 0x00011000 = 0x011C1000 地址上。
事实上这个 ImageBase 可能是每次运行都不一样的。
3. 映像执行的入口点
IMAGE_OPTIONAL_HEADER32 结构的 AddressOfEntryPoint 指出了程序的入口点，helloworld.exe 映像的 AddressOfEntryPoint 值为：0x0001120D
因此，程序的入口应该是：ImageBase + AddressOfEntryPoint = 0x00400000 + 0x0001120D = 0x0041120D
那么在我的环境（是指：32 位 helloworld.exe 运行在 64 位的 windows 7 下）上，程序的入口应该是：0x011b0000 + 0x0001120D = 0x011C120D
| _RTC_AllocaFailure:
011C1203 E9 38 17 00 00 jmp _RTC_AllocaFailure (11C2940h)
@ILT+515(_wWinMain@16):
011C1208 E9 63 02 00 00 jmp wWinMain (11C1470h)
@ILT+520(_wWinMainCRTStartup):
011C120D E9 0E 0D 00 00 jmp wWinMainCRTStartup (11C1F20h)
@ILT+525(_exit):
011C1212 E9 F3 20 00 00 jmp exit (11C330Ah)
MyRegisterClass:
011C1217 E9 E4 03 00 00 jmp MyRegisterClass (11C1600h)
@ILT+535(___dllonexit): |
上面的代码是摘自我的环境中的 helloworld.exe 调试运行时情形。
注意红色标注部分就是入口点：0x001C120D，这个入口点仅仅是一条跳转指令，转到真正的执行入口点 0x011C1F20 处的 wWinMainCRTStrartup() 例程，这个运行时例程是 linker 为我们添加的。在这个例子里你可以看到 linker 添加了很多的运行时例程和其它的例程。
那么这个入口点应该对应 Raw 数据的：0x400 + (0x011C120D - 0x011C1000) = 0x60D ，在 image 文件的 0x60D 处正好是这条指令：E9 0E 0D 00 00
我们程序代码中的 _tWinMain() 入口函数倒底在哪？这并不是很重要，它是由启动例程 wWinMainCRTStrartup() 负责调用。事实上 linker 按我们源代码的函数顺序来链接代码。_tWinMain() 就在所有函数最前面。
4. .text 节的属性
.text 节的属性是 0x60000020，在 WinNT.h 里定义了所有的属性，如下：
| //
// Section characteristics.
//
// IMAGE_SCN_TYPE_REG 0x00000000 // Reserved.
// IMAGE_SCN_TYPE_DSECT 0x00000001 // Reserved.
// IMAGE_SCN_TYPE_NOLOAD 0x00000002 // Reserved.
// IMAGE_SCN_TYPE_GROUP 0x00000004 // Reserved.
#define IMAGE_SCN_TYPE_NO_PAD 0x00000008 // Reserved.
// IMAGE_SCN_TYPE_COPY 0x00000010 // Reserved. #define IMAGE_SCN_CNT_CODE 0x00000020 // Section contains code.
#define IMAGE_SCN_CNT_INITIALIZED_DATA 0x00000040 // Section contains initialized data.
#define IMAGE_SCN_CNT_UNINITIALIZED_DATA 0x00000080 // Section contains uninitialized data. #define IMAGE_SCN_LNK_OTHER 0x00000100 // Reserved.
#define IMAGE_SCN_LNK_INFO 0x00000200 // Section contains comments or some other type of information.
// IMAGE_SCN_TYPE_OVER 0x00000400 // Reserved.
#define IMAGE_SCN_LNK_REMOVE 0x00000800 // Section contents will not become part of image.
#define IMAGE_SCN_LNK_COMDAT 0x00001000 // Section contents comdat.
// 0x00002000 // Reserved.
// IMAGE_SCN_MEM_PROTECTED - Obsolete 0x00004000
#define IMAGE_SCN_NO_DEFER_SPEC_EXC 0x00004000 // Reset speculative exceptions handling bits in the TLB entries for this section.
#define IMAGE_SCN_GPREL 0x00008000 // Section content can be accessed relative to GP
#define IMAGE_SCN_MEM_FARDATA 0x00008000
// IMAGE_SCN_MEM_SYSHEAP - Obsolete 0x00010000
#define IMAGE_SCN_MEM_PURGEABLE 0x00020000
#define IMAGE_SCN_MEM_16BIT 0x00020000
#define IMAGE_SCN_MEM_LOCKED 0x00040000
#define IMAGE_SCN_MEM_PRELOAD 0x00080000 #define IMAGE_SCN_ALIGN_1BYTES 0x00100000 //
#define IMAGE_SCN_ALIGN_2BYTES 0x00200000 //
#define IMAGE_SCN_ALIGN_4BYTES 0x00300000 //
#define IMAGE_SCN_ALIGN_8BYTES 0x00400000 //
#define IMAGE_SCN_ALIGN_16BYTES 0x00500000 // Default alignment if no others are specified.
#define IMAGE_SCN_ALIGN_32BYTES 0x00600000 //
#define IMAGE_SCN_ALIGN_64BYTES 0x00700000 //
#define IMAGE_SCN_ALIGN_128BYTES 0x00800000 //
#define IMAGE_SCN_ALIGN_256BYTES 0x00900000 //
#define IMAGE_SCN_ALIGN_512BYTES 0x00A00000 //
#define IMAGE_SCN_ALIGN_1024BYTES 0x00B00000 //
#define IMAGE_SCN_ALIGN_2048BYTES 0x00C00000 //
#define IMAGE_SCN_ALIGN_4096BYTES 0x00D00000 //
#define IMAGE_SCN_ALIGN_8192BYTES 0x00E00000 //
// Unused 0x00F00000
#define IMAGE_SCN_ALIGN_MASK 0x00F00000 #define IMAGE_SCN_LNK_NRELOC_OVFL 0x01000000 // Section contains extended relocations.
#define IMAGE_SCN_MEM_DISCARDABLE 0x02000000 // Section can be discarded.
#define IMAGE_SCN_MEM_NOT_CACHED 0x04000000 // Section is not cachable.
#define IMAGE_SCN_MEM_NOT_PAGED 0x08000000 // Section is not pageable.
#define IMAGE_SCN_MEM_SHARED 0x10000000 // Section is shareable.
#define IMAGE_SCN_MEM_EXECUTE 0x20000000 // Section is executable.
#define IMAGE_SCN_MEM_READ 0x40000000 // Section is readable.
#define IMAGE_SCN_MEM_WRITE 0x80000000 // Section is writeable. |
那么：0x60000020 = IMAGE_SCN_MEM_READ | IMAGE_SCN_MEM_EXECUTE | IMAGE_SCN_CNT_CODE;
说明 .text 节是 readable/executeable 的，并且包含了 code 代码在内。
版权 mik 所有，转载请注明出处
3610
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
