----------DOS_HEADER---------- [IMAGE_DOS_HEADER] e_magic: 0x5A4D e_cblp: 0x90 e_cp: 0x3 e_crlc: 0x0 e_cparhdr: 0x4 e_minalloc: 0x0 e_maxalloc: 0xFFFF e_ss: 0x0 e_sp: 0xB8 e_csum: 0x0 e_ip: 0x0 e_cs: 0x0 e_lfarlc: 0x40 e_ovno: 0x0 e_res: e_oemid: 0x0 e_oeminfo: 0x0 e_res2: e_lfanew: 0xE8 ----------NT_HEADERS---------- [IMAGE_NT_HEADERS] Signature: 0x4550 ----------FILE_HEADER---------- [IMAGE_FILE_HEADER] Machine: 0x14C NumberOfSections: 0x5 TimeDateStamp: 0x452CF092 [Wed Oct 11 22:24:34 2006] PointerToSymbolTable: 0x0 NumberOfSymbols: 0x0 SizeOfOptionalHeader: 0xE0 Characteristics: 0x210E Flags: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL, LINE_NUMS_STRIPPED ----------OPTIONAL_HEADER---------- [IMAGE_OPTIONAL_HEADER] Magic: 0x10B MajorLinkerVersion: 0x6 MinorLinkerVersion: 0x0 SizeOfCode: 0x5000 SizeOfInitializedData: 0x6000 SizeOfUninitializedData: 0x0 AddressOfEntryPoint: 0x58FA BaseOfCode: 0x1000 BaseOfData: 0x6000 ImageBase: 0x10000000 SectionAlignment: 0x1000 FileAlignment: 0x1000 MajorOperatingSystemVersion: 0x4 MinorOperatingSystemVersion: 0x0 MajorImageVersion: 0x0 MinorImageVersion: 0x0 MajorSubsystemVersion: 0x4 MinorSubsystemVersion: 0x0 Reserved1: 0x0 SizeOfImage: 0xC000 SizeOfHeaders: 0x1000 CheckSum: 0x0 Subsystem: 0x2 DllCharacteristics: 0x0 SizeOfStackReserve: 0x100000 SizeOfStackCommit: 0x1000 SizeOfHeapReserve: 0x100000 SizeOfHeapCommit: 0x1000 LoaderFlags: 0x0 NumberOfRvaAndSizes: 0x10 ----------PE Sections---------- [IMAGE_SECTION_HEADER] Name: .text Misc: 0x4C9B Misc_PhysicalAddress: 0x4C9B Misc_VirtualSize: 0x4C9B VirtualAddress: 0x1000 SizeOfRawData: 0x5000 PointerToRawData: 0x1000 PointerToRelocations: 0x0 PointerToLinenumbers: 0x0 NumberOfRelocations: 0x0 NumberOfLinenumbers: 0x0 Characteristics: 0x60000020 Flags: CNT_CODE, MEM_EXECUTE, MEM_READ [IMAGE_SECTION_HEADER] Name: .rdata Misc: 0x1518 Misc_PhysicalAddress: 0x1518 Misc_VirtualSize: 0x1518 VirtualAddress: 0x6000 SizeOfRawData: 0x2000 PointerToRawData: 0x6000 PointerToRelocations: 0x0 PointerToLinenumbers: 0x0 NumberOfRelocations: 0x0 NumberOfLinenumbers: 0x0 Characteristics: 0x40000040 Flags: CNT_INITIALIZED_DATA, MEM_READ [IMAGE_SECTION_HEADER] Name: .data Misc: 0x154C Misc_PhysicalAddress: 0x154C Misc_VirtualSize: 0x154C VirtualAddress: 0x8000 SizeOfRawData: 0x1000 PointerToRawData: 0x8000 PointerToRelocations: 0x0 PointerToLinenumbers: 0x0 NumberOfRelocations: 0x0 NumberOfLinenumbers: 0x0 Characteristics: 0xC0000040 Flags: MEM_WRITE, CNT_INITIALIZED_DATA, MEM_READ [IMAGE_SECTION_HEADER] Name: .rsrc Misc: 0x3A8 Misc_PhysicalAddress: 0x3A8 Misc_VirtualSize: 0x3A8 VirtualAddress: 0xA000 SizeOfRawData: 0x1000 PointerToRawData: 0x9000 PointerToRelocations: 0x0 PointerToLinenumbers: 0x0 NumberOfRelocations: 0x0 NumberOfLinenumbers: 0x0 Characteristics: 0x40000040 Flags: CNT_INITIALIZED_DATA, MEM_READ [IMAGE_SECTION_HEADER] Name: .reloc Misc: 0x722 Misc_PhysicalAddress: 0x722 Misc_VirtualSize: 0x722 VirtualAddress: 0xB000 SizeOfRawData: 0x1000 PointerToRawData: 0xA000 PointerToRelocations: 0x0 PointerToLinenumbers: 0x0 NumberOfRelocations: 0x0 NumberOfLinenumbers: 0x0 Characteristics: 0x42000040 Flags: CNT_INITIALIZED_DATA, MEM_DISCARDABLE, MEM_READ ----------Directories---------- [IMAGE_DIRECTORY_ENTRY_EXPORT] VirtualAddress: 0x7370 Size: 0x1A8 [IMAGE_DIRECTORY_ENTRY_IMPORT] VirtualAddress: 0x64B0 Size: 0xA0 [IMAGE_DIRECTORY_ENTRY_RESOURCE] VirtualAddress: 0xA000 Size: 0x3A8 [IMAGE_DIRECTORY_ENTRY_EXCEPTION] VirtualAddress: 0x0 Size: 0x0 [IMAGE_DIRECTORY_ENTRY_SECURITY] VirtualAddress: 0x0 Size: 0x0 [IMAGE_DIRECTORY_ENTRY_BASERELOC] VirtualAddress: 0xB000 Size: 0x554 [IMAGE_DIRECTORY_ENTRY_DEBUG] VirtualAddress: 0x0 Size: 0x0 [IMAGE_DIRECTORY_ENTRY_COPYRIGHT] VirtualAddress: 0x0 Size: 0x0 [IMAGE_DIRECTORY_ENTRY_GLOBALPTR] VirtualAddress: 0x0 Size: 0x0 [IMAGE_DIRECTORY_ENTRY_TLS] VirtualAddress: 0x0 Size: 0x0 [IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG] VirtualAddress: 0x0 Size: 0x0 [IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT] VirtualAddress: 0x0 Size: 0x0 [IMAGE_DIRECTORY_ENTRY_IAT] VirtualAddress: 0x6000 Size: 0x1A0 [IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT] VirtualAddress: 0x0 Size: 0x0 [IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR] VirtualAddress: 0x0 Size: 0x0 [IMAGE_DIRECTORY_ENTRY_RESERVED] VirtualAddress: 0x0 Size: 0x0 ----------Version Information---------- [VS_VERSIONINFO] Length: 0x344 ValueLength: 0x34 Type: 0x0 [VS_FIXEDFILEINFO] Signature: 0xFEEF04BD StrucVersion: 0x10000 FileVersionMS: 0x7D6000A FileVersionLS: 0xB0001 ProductVersionMS: 0x7D6000A ProductVersionLS: 0xB0001 FileFlagsMask: 0x3F FileFlags: 0x0 FileOS: 0x4 FileType: 0x2 FileSubtype: 0x0 FileDateMS: 0x0 FileDateLS: 0x0 [StringFileInfo] Length: 0x2A4 ValueLength: 0x0 Type: 0x1 [StringTable] Length: 0x280 ValueLength: 0x0 Type: 0x1 LangID: 041204b0 LegalCopyright: Copyright (C) 2006 InternalName: npScan FileVersion: 2006, 10, 11, 1 CompanyName: PrivateBuild: LegalTrademarks: Comments: ProductName: npScan u'\ub3d9'u'\uc801' u'\uc5f0'u'\uacb0' u'\ub77c'u'\uc774'u'\ube0c'u'\ub7ec'u'\ub9ac' SpecialBuild: ProductVersion: 2006, 10, 11, 1 FileDescription: npScan DLL OriginalFilename: npScan.DLL [VarFileInfo] Length: 0x44 ValueLength: 0x0 Type: 0x1 [Var] Length: 0x24 ValueLength: 0x4 Type: 0x0 Translation: 0x0412 0x04b0 ----------Exported symbols---------- [IMAGE_EXPORT_DIRECTORY] Characteristics: 0x0 TimeDateStamp: 0x452CF092 [Wed Oct 11 22:24:34 2006] MajorVersion: 0x0 MinorVersion: 0x0 Name: 0x7438 Base: 0x1 NumberOfFunctions: 0x10 NumberOfNames: 0x10 AddressOfFunctions: 0x7398 AddressOfNames: 0x73D8 AddressOfNameOrdinals: 0x7418 Ordinal RVA Name 1 0x00002E60h CureFile 2 0x00002C70h Init 3 0x00002E40h KillInfectedModule 4 0x00002DE0h ScanFile_1 5 0x00002E00h ScanFile_2 6 0x00002E20h ScanModule 7 0x00002DC0h Unload 8 0x00003340h dlCloseProbe 9 0x00003250h dlGetFileFormat 10 0x00003330h dlGetViRobotVersion 11 0x000031D0h dlGetVirusName 12 0x00002EF0h dlGetVirusReport 13 0x00002FC0h dlProbeInto 14 0x00003260h dlRecoverFile 15 0x00003340h dlTurnOffViRobot 16 0x00003340h dlTurnOnViRobot ----------Imported symbols---------- [IMAGE_IMPORT_DESCRIPTOR] OriginalFirstThunk: 0x65D4 Characteristics: 0x65D4 TimeDateStamp: 0x0 [Thu Jan 01 09:00:00 1970] ForwarderChain: 0x0 Name: 0x66F0 FirstThunk: 0x6084 MFC42.DLL.None Ord[3318] MFC42.DLL.None Ord[823] MFC42.DLL.None Ord[800] MFC42.DLL.None Ord[2915] MFC42.DLL.None Ord[6877] MFC42.DLL.None Ord[2818] MFC42.DLL.None Ord[540] MFC42.DLL.None Ord[1168] MFC42.DLL.None Ord[1253] MFC42.DLL.None Ord[342] MFC42.DLL.None Ord[1182] MFC42.DLL.None Ord[665] MFC42.DLL.None Ord[537] MFC42.DLL.None Ord[2764] MFC42.DLL.None Ord[354] MFC42.DLL.None Ord[5186] MFC42.DLL.None Ord[825] MFC42.DLL.None Ord[1979] [IMAGE_IMPORT_DESCRIPTOR] OriginalFirstThunk: 0x66B0 Characteristics: 0x66B0 TimeDateStamp: 0x0 [Thu Jan 01 09:00:00 1970] ForwarderChain: 0x0 Name: 0x6738 FirstThunk: 0x6160 MSVCRT.dll._initterm Ord[271] MSVCRT.dll.memmove Ord[664] MSVCRT.dll.sprintf Ord[690] MSVCRT.dll.__CxxFrameHandler Ord[73] MSVCRT.dll._mbsicmp Ord[351] MSVCRT.dll._adjust_fdiv Ord[157] MSVCRT.dll.malloc Ord[657] MSVCRT.dll.free Ord[606] MSVCRT.dll._mbsstr Ord[380] [IMAGE_IMPORT_DESCRIPTOR] OriginalFirstThunk: 0x657C Characteristics: 0x657C TimeDateStamp: 0x0 [Thu Jan 01 09:00:00 1970] ForwarderChain: 0x0 Name: 0x68DA FirstThunk: 0x602C KERNEL32.dll.GetModuleHandleA Ord[294] KERNEL32.dll.CreateRemoteThread Ord[70] KERNEL32.dll.WaitForSingleObject Ord[718] KERNEL32.dll.GetCurrentProcess Ord[247] KERNEL32.dll.GetProcessHeap Ord[320] KERNEL32.dll.HeapAlloc Ord[409] KERNEL32.dll.HeapFree Ord[415] KERNEL32.dll.SetLastError Ord[625] KERNEL32.dll.TerminateProcess Ord[670] KERNEL32.dll.OpenProcess Ord[495] KERNEL32.dll.CloseHandle Ord[27] KERNEL32.dll.FreeLibrary Ord[180] KERNEL32.dll.OutputDebugStringA Ord[501] KERNEL32.dll.GetVersionExA Ord[373] KERNEL32.dll.GetDateFormatA Ord[251] KERNEL32.dll.GetTimeFormatA Ord[366] KERNEL32.dll.GetSystemDirectoryA Ord[345] KERNEL32.dll.LoadLibraryA Ord[450] KERNEL32.dll.ResetEvent Ord[555] KERNEL32.dll.SetEvent Ord[613] KERNEL32.dll.GetProcAddress Ord[318] [IMAGE_IMPORT_DESCRIPTOR] OriginalFirstThunk: 0x66E4 Characteristics: 0x66E4 TimeDateStamp: 0x0 [Thu Jan 01 09:00:00 1970] ForwarderChain: 0x0 Name: 0x6904 FirstThunk: 0x6194 USER32.dll.SendMessageA Ord[532] USER32.dll.wsprintfA Ord[684] [IMAGE_IMPORT_DESCRIPTOR] OriginalFirstThunk: 0x6550 Characteristics: 0x6550 TimeDateStamp: 0x0 [Thu Jan 01 09:00:00 1970] ForwarderChain: 0x0 Name: 0x69CA FirstThunk: 0x6000 ADVAPI32.dll.OpenProcessToken Ord[322] ADVAPI32.dll.LookupPrivilegeValueA Ord[245] ADVAPI32.dll.AdjustTokenPrivileges Ord[23] ADVAPI32.dll.RegEnumKeyExA Ord[359] ADVAPI32.dll.RegEnumValueA Ord[362] ADVAPI32.dll.RegSetValueExA Ord[390] ADVAPI32.dll.RegDeleteValueA Ord[356] ADVAPI32.dll.RegCloseKey Ord[347] ADVAPI32.dll.RegOpenKeyExA Ord[370] ADVAPI32.dll.RegQueryValueExA Ord[379] [IMAGE_IMPORT_DESCRIPTOR] OriginalFirstThunk: 0x66D8 Characteristics: 0x66D8 TimeDateStamp: 0x0 [Thu Jan 01 09:00:00 1970] ForwarderChain: 0x0 Name: 0x6A0E FirstThunk: 0x6188 SHELL32.dll.SHGetSpecialFolderLocation Ord[83] SHELL32.dll.SHGetPathFromIDListA Ord[80] [IMAGE_IMPORT_DESCRIPTOR] OriginalFirstThunk: 0x6620 Characteristics: 0x6620 TimeDateStamp: 0x0 [Thu Jan 01 09:00:00 1970] ForwarderChain: 0x0 Name: 0x7360 FirstThunk: 0x60D0 MSVCP60.dll.?_Xran@std@@YAXXZ Ord[1030] MSVCP60.dll.??1?$basic_ofstream@DU?$char_traits@D@std@@@std@@UAE@XZ Ord[225] MSVCP60.dll.??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ Ord[217] MSVCP60.dll.?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z Ord[1056] MSVCP60.dll.?_Split@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ Ord[1010] MSVCP60.dll.?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z Ord[1346] MSVCP60.dll.?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z Ord[1052] MSVCP60.dll.??_8?$basic_ofstream@DU?$char_traits@D@std@@@std@@7B@ Ord[707] MSVCP60.dll.??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ Ord[25] MSVCP60.dll.??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N1@Z Ord[54] MSVCP60.dll.??0?$basic_filebuf@DU?$char_traits@D@std@@@std@@QAE@PAU_iobuf@@@Z Ord[8] MSVCP60.dll.??_7?$basic_ofstream@DU?$char_traits@D@std@@@std@@6B@ Ord[635] MSVCP60.dll.?open@?$basic_filebuf@DU?$char_traits@D@std@@@std@@QAEPAV12@PBDH@Z Ord[1636] MSVCP60.dll.?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z Ord[1891] MSVCP60.dll.?close@?$basic_filebuf@DU?$char_traits@D@std@@@std@@QAEPAV12@XZ Ord[1094] MSVCP60.dll.?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z Ord[1041] MSVCP60.dll.?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBDH@Z Ord[2031] MSVCP60.dll.?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z Ord[1722] MSVCP60.dll.?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z Ord[842] MSVCP60.dll.?_Copy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z Ord[824] MSVCP60.dll.?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z Ord[1016] MSVCP60.dll.?_Xlen@std@@YAXXZ Ord[1029] MSVCP60.dll.?max_size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ Ord[1599] MSVCP60.dll.?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z Ord[914] MSVCP60.dll.?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB Ord[813] MSVCP60.dll.??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ Ord[233] MSVCP60.dll.?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z Ord[1959] MSVCP60.dll.?rfind@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z Ord[1829] MSVCP60.dll.?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB Ord[1633] MSVCP60.dll.??_D?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXXZ Ord[749] MSVCP60.dll.??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ Ord[227] MSVCP60.dll.??1ios_base@std@@UAE@XZ Ord[279] MSVCP60.dll.??_7?$basic_ios@DU?$char_traits@D@std@@@std@@6B@ Ord[627] MSVCP60.dll.??_7?$basic_ostream@DU?$char_traits@D@std@@@std@@6B@ Ord[637] MSVCP60.dll.??1?$basic_filebuf@DU?$char_traits@D@std@@@std@@UAE@XZ Ord[211] ----------Resource directory---------- [IMAGE_RESOURCE_DIRECTORY] Characteristics: 0x0 TimeDateStamp: 0x0 [Thu Jan 01 09:00:00 1970] MajorVersion: 0x0 MinorVersion: 0x0 NumberOfNamedEntries: 0x0 NumberOfIdEntries: 0x1 Id: [0x10] (RT_VERSION) [IMAGE_RESOURCE_DIRECTORY_ENTRY] Name: 0x10 OffsetToData: 0x80000018 [IMAGE_RESOURCE_DIRECTORY] Characteristics: 0x0 TimeDateStamp: 0x0 [Thu Jan 01 09:00:00 1970] MajorVersion: 0x0 MinorVersion: 0x0 NumberOfNamedEntries: 0x0 NumberOfIdEntries: 0x1 Id: [0x1] [IMAGE_RESOURCE_DIRECTORY_ENTRY] Name: 0x1 OffsetToData: 0x80000030 [IMAGE_RESOURCE_DIRECTORY] Characteristics: 0x0 TimeDateStamp: 0x0 [Thu Jan 01 09:00:00 1970] MajorVersion: 0x0 MinorVersion: 0x0 NumberOfNamedEntries: 0x0 NumberOfIdEntries: 0x1 [IMAGE_RESOURCE_DIRECTORY_ENTRY] Name: 0x412 OffsetToData: 0x48 [IMAGE_RESOURCE_DATA_ENTRY] OffsetToData: 0xA060 Size: 0x344 CodePage: 0x0 Reserved: 0x0 ----------Base relocations---------- [IMAGE_BASE_RELOCATION] VirtualAddress: 0x1000 SizeOfBlock: 0xEC 0000105Ah HIGHLOW 00001098h HIGHLOW 00001121h HIGHLOW 00001172h HIGHLOW 0000119Bh HIGHLOW 000011CBh HIGHLOW 000011E7h HIGHLOW 00001222h HIGHLOW 00001227h HIGHLOW 00001249h HIGHLOW 00001250h HIGHLOW 0000128Ah HIGHLOW 000012B1h HIGHLOW 000012E0h HIGHLOW 00001307h HIGHLOW 00001336h HIGHLOW 00001354h HIGHLOW 0000135Ch HIGHLOW 00001372h HIGHLOW 0000137Dh HIGHLOW 00001386h HIGHLOW 0000139Fh HIGHLOW 000013B0h HIGHLOW 000013E2h HIGHLOW 000013FCh HIGHLOW 0000142Ah HIGHLOW 00001443h HIGHLOW 0000144Dh HIGHLOW 00001471h HIGHLOW 00001481h HIGHLOW 00001499h HIGHLOW 000014A2h HIGHLOW 000014C4h HIGHLOW 000014C9h HIGHLOW 000014D4h HIGHLOW 000014DFh HIGHLOW 00001502h HIGHLOW 00001516h HIGHLOW 0000151Fh HIGHLOW 00001538h HIGHLOW 00001560h HIGHLOW 0000158Ah HIGHLOW 000015BAh HIGHLOW 000015E8h HIGHLOW 00001601h HIGHLOW 0000160Bh HIGHLOW 0000162Fh HIGHLOW 0000163Fh HIGHLOW 00001657h HIGHLOW 00001660h HIGHLOW 00001680h HIGHLOW 0000168Dh HIGHLOW 000016A6h HIGHLOW 000016B0h HIGHLOW 000016D4h HIGHLOW 000016E4h HIGHLOW 000016FCh HIGHLOW 00001705h HIGHLOW 0000172Dh HIGHLOW 00001738h HIGHLOW 00001743h HIGHLOW 00001766h HIGHLOW 0000177Ah HIGHLOW 00001783h HIGHLOW 0000179Ch HIGHLOW 000017ACh HIGHLOW 000017DEh HIGHLOW 000017EBh HIGHLOW 0000182Ch HIGHLOW 00001831h HIGHLOW 00001865h HIGHLOW 00001871h HIGHLOW 0000188Eh HIGHLOW 00001893h HIGHLOW 0000189Eh HIGHLOW 000018AFh HIGHLOW 000018C6h HIGHLOW 000018D1h HIGHLOW 000018E2h HIGHLOW 000018F9h HIGHLOW 00001904h HIGHLOW 00001915h HIGHLOW 0000192Ch HIGHLOW 00001937h HIGHLOW 00001948h HIGHLOW 0000195Fh HIGHLOW 0000196Ah HIGHLOW 0000197Bh HIGHLOW 00001992h HIGHLOW 000019A0h HIGHLOW 00001A6Dh HIGHLOW 00001A8Dh HIGHLOW 00001AD0h HIGHLOW 00001B44h HIGHLOW 00001B57h HIGHLOW 00001B6Ah HIGHLOW 00001B7Dh HIGHLOW 00001B90h HIGHLOW 00001BA3h HIGHLOW 00001BBEh HIGHLOW 00001BDAh HIGHLOW 00001C57h HIGHLOW 00001C79h HIGHLOW 00001CC5h HIGHLOW 00001CDFh HIGHLOW 00001CE4h HIGHLOW 00001D53h HIGHLOW 00001DC8h HIGHLOW 00001DE2h HIGHLOW 00001DE7h HIGHLOW 00001E33h HIGHLOW 00001EA3h HIGHLOW 00001F2Bh HIGHLOW 00001FE9h HIGHLOW [IMAGE_BASE_RELOCATION] VirtualAddress: 0x2000 SizeOfBlock: 0x108 00002098h HIGHLOW 000020E7h HIGHLOW 000020FDh HIGHLOW 0000212Eh HIGHLOW 00002169h HIGHLOW 0000217Fh HIGHLOW 00002186h HIGHLOW 000021F3h HIGHLOW 00002222h HIGHLOW 00002241h HIGHLOW 00002271h HIGHLOW 00002292h HIGHLOW 00002298h HIGHLOW 000022ABh HIGHLOW 000022B7h HIGHLOW 000022BCh HIGHLOW 000022C3h HIGHLOW 00002363h HIGHLOW 000023B0h HIGHLOW 000023B5h HIGHLOW 000023DFh HIGHLOW 000023F7h HIGHLOW 00002419h HIGHLOW 0000242Bh HIGHLOW 00002435h HIGHLOW 00002458h HIGHLOW 00002470h HIGHLOW 00002493h HIGHLOW 000024ABh HIGHLOW 000024C3h HIGHLOW 000024D0h HIGHLOW 000024EAh HIGHLOW 000024EFh HIGHLOW 000024FFh HIGHLOW 00002509h HIGHLOW 0000255Dh HIGHLOW 00002575h HIGHLOW 00002586h HIGHLOW 0000259Dh HIGHLOW 000025C1h HIGHLOW 000025C6h HIGHLOW 000025D6h HIGHLOW 000025E0h HIGHLOW 000025FBh HIGHLOW 0000260Dh HIGHLOW 00002625h HIGHLOW 0000264Fh HIGHLOW 0000265Eh HIGHLOW 0000266Eh HIGHLOW 0000267Ah HIGHLOW 000026AAh HIGHLOW 000026BAh HIGHLOW 000026C4h HIGHLOW 000026E8h HIGHLOW 000026EDh HIGHLOW 000026FDh HIGHLOW 00002704h HIGHLOW 00002714h HIGHLOW 0000271Eh HIGHLOW 00002742h HIGHLOW 00002747h HIGHLOW 00002757h HIGHLOW 00002761h HIGHLOW 00002780h HIGHLOW 000027B2h HIGHLOW 000027CBh HIGHLOW 000027D5h HIGHLOW 000027ECh HIGHLOW 00002800h HIGHLOW 0000286Ch HIGHLOW 00002887h HIGHLOW 0000289Ah HIGHLOW 000028A1h HIGHLOW 000028CAh HIGHLOW 00002928h HIGHLOW 0000292Dh HIGHLOW 00002945h HIGHLOW 00002956h HIGHLOW 00002969h HIGHLOW 00002975h HIGHLOW 00002A01h HIGHLOW 00002A23h HIGHLOW 00002A5Ah HIGHLOW 00002BCFh HIGHLOW 00002BFEh HIGHLOW 00002C11h HIGHLOW 00002C2Ah HIGHLOW 00002C35h HIGHLOW 00002C46h HIGHLOW 00002C4Ch HIGHLOW 00002C71h HIGHLOW 00002C91h HIGHLOW 00002C97h HIGHLOW 00002D08h HIGHLOW 00002D1Bh HIGHLOW 00002D21h HIGHLOW 00002D33h HIGHLOW 00002D5Ah HIGHLOW 00002D8Bh HIGHLOW 00002D91h HIGHLOW 00002DA5h HIGHLOW 00002DC2h HIGHLOW 00002DCDh HIGHLOW 00002DF0h HIGHLOW 00002E0Ch HIGHLOW 00002E2Ch HIGHLOW 00002E46h HIGHLOW 00002E80h HIGHLOW 00002E99h HIGHLOW 00002ECCh HIGHLOW 00002ED0h HIGHLOW 00002ED4h HIGHLOW 00002ED8h HIGHLOW 00002EDCh HIGHLOW 00002EE0h HIGHLOW 00002F1Eh HIGHLOW 00002F24h HIGHLOW 00002F56h HIGHLOW 00002F7Eh HIGHLOW 00002FA0h HIGHLOW 00002FA4h HIGHLOW 00002FA8h HIGHLOW 00002FACh HIGHLOW 00002FB0h HIGHLOW 00002FD1h HIGHLOW 00002FDDh HIGHLOW 00002FF0h HIGHLOW 00002000h ABSOLUTE [IMAGE_BASE_RELOCATION] VirtualAddress: 0x3000 SizeOfBlock: 0xE8 00003016h HIGHLOW 00003062h HIGHLOW 00003078h HIGHLOW 00003093h HIGHLOW 0000309Dh HIGHLOW 000030B4h HIGHLOW 000030E7h HIGHLOW 000030F8h HIGHLOW 00003103h HIGHLOW 00003122h HIGHLOW 00003136h HIGHLOW 0000317Eh HIGHLOW 000031A5h HIGHLOW 000031F6h HIGHLOW 0000321Fh HIGHLOW 00003226h HIGHLOW 00003236h HIGHLOW 0000323Dh HIGHLOW 00003269h HIGHLOW 000032F6h HIGHLOW 00003331h HIGHLOW 00003353h HIGHLOW 0000341Eh HIGHLOW 00003460h HIGHLOW 0000349Dh HIGHLOW 000034A3h HIGHLOW 000034B4h HIGHLOW 000034B9h HIGHLOW 000034C4h HIGHLOW 000034D5h HIGHLOW 00003508h HIGHLOW 00003512h HIGHLOW 00003518h HIGHLOW 00003524h HIGHLOW 0000352Bh HIGHLOW 0000354Bh HIGHLOW 000035A3h HIGHLOW 000035C5h HIGHLOW 0000372Ah HIGHLOW 0000375Ah HIGHLOW 00003773h HIGHLOW 0000377Ch HIGHLOW 000037C1h HIGHLOW 000037DAh HIGHLOW 000037E3h HIGHLOW 00003823h HIGHLOW 000038B5h HIGHLOW 000038D9h HIGHLOW 000038F3h HIGHLOW 00003912h HIGHLOW 0000391Ch HIGHLOW 0000393Ah HIGHLOW 0000394Fh HIGHLOW 00003967h HIGHLOW 0000396Dh HIGHLOW 0000398Ah HIGHLOW 0000399Bh HIGHLOW 000039A1h HIGHLOW 000039B8h HIGHLOW 000039CCh HIGHLOW 000039D2h HIGHLOW 000039EAh HIGHLOW 000039F0h HIGHLOW 00003A0Dh HIGHLOW 00003A1Eh HIGHLOW 00003A24h HIGHLOW 00003A3Bh HIGHLOW 00003A4Fh HIGHLOW 00003A59h HIGHLOW 00003B16h HIGHLOW 00003B2Dh HIGHLOW 00003BA9h HIGHLOW 00003BD3h HIGHLOW 00003BF4h HIGHLOW 00003C07h HIGHLOW 00003C1Ah HIGHLOW 00003C21h HIGHLOW 00003C2Eh HIGHLOW 00003C3Bh HIGHLOW 00003C41h HIGHLOW 00003C7Fh HIGHLOW 00003D00h HIGHLOW 00003D24h HIGHLOW 00003D3Eh HIGHLOW 00003D5Dh HIGHLOW 00003D67h HIGHLOW 00003D85h HIGHLOW 00003D9Ah HIGHLOW 00003DB2h HIGHLOW 00003DB8h HIGHLOW 00003DD5h HIGHLOW 00003DE6h HIGHLOW 00003DECh HIGHLOW 00003E03h HIGHLOW 00003E17h HIGHLOW 00003E1Dh HIGHLOW 00003E35h HIGHLOW 00003E3Bh HIGHLOW 00003E58h HIGHLOW 00003E69h HIGHLOW 00003E6Fh HIGHLOW 00003E86h HIGHLOW 00003E9Ah HIGHLOW 00003EA4h HIGHLOW 00003EE7h HIGHLOW 00003F00h HIGHLOW 00003F07h HIGHLOW 00003F65h HIGHLOW 00003F74h HIGHLOW 00003FBDh HIGHLOW 00003FD4h HIGHLOW 00003000h ABSOLUTE [IMAGE_BASE_RELOCATION] VirtualAddress: 0x4000 SizeOfBlock: 0xF4 00004053h HIGHLOW 0000405Eh HIGHLOW 00004093h HIGHLOW 000040ECh HIGHLOW 0000410Eh HIGHLOW 00004131h HIGHLOW 00004155h HIGHLOW 00004170h HIGHLOW 00004183h HIGHLOW 00004189h HIGHLOW 000041A1h HIGHLOW 000041DFh HIGHLOW 000041EAh HIGHLOW 00004208h HIGHLOW 00004229h HIGHLOW 0000424Fh HIGHLOW 00004287h HIGHLOW 000042FBh HIGHLOW 00004333h HIGHLOW 00004372h HIGHLOW 000043B1h HIGHLOW 000043C5h HIGHLOW 000043CCh HIGHLOW 00004439h HIGHLOW 00004456h HIGHLOW 00004465h HIGHLOW 00004480h HIGHLOW 0000448Fh HIGHLOW 00004498h HIGHLOW 0000449Fh HIGHLOW 000044AFh HIGHLOW 000044B4h HIGHLOW 000044EBh HIGHLOW 00004530h HIGHLOW 00004549h HIGHLOW 000045BCh HIGHLOW 000045C3h HIGHLOW 000045D1h HIGHLOW 000045D9h HIGHLOW 000045E8h HIGHLOW 00004624h HIGHLOW 0000462Fh HIGHLOW 00004664h HIGHLOW 00004670h HIGHLOW 00004675h HIGHLOW 0000467Bh HIGHLOW 00004682h HIGHLOW 000046A1h HIGHLOW 000046BEh HIGHLOW 000046C5h HIGHLOW 000046E5h HIGHLOW 000046F1h HIGHLOW 00004713h HIGHLOW 000047F0h HIGHLOW 00004814h HIGHLOW 00004819h HIGHLOW 00004844h HIGHLOW 00004858h HIGHLOW 0000486Dh HIGHLOW 00004873h HIGHLOW 0000488Ah HIGHLOW 0000489Dh HIGHLOW 000048AAh HIGHLOW 000048B0h HIGHLOW 000048B5h HIGHLOW 00004923h HIGHLOW 00004947h HIGHLOW 00004962h HIGHLOW 00004981h HIGHLOW 0000498Bh HIGHLOW 000049BBh HIGHLOW 000049D4h HIGHLOW 000049D9h HIGHLOW 000049F2h HIGHLOW 000049F8h HIGHLOW 00004A0Ch HIGHLOW 00004A12h HIGHLOW 00004A29h HIGHLOW 00004A3Dh HIGHLOW 00004A42h HIGHLOW 00004A5Bh HIGHLOW 00004A61h HIGHLOW 00004A7Ah HIGHLOW 00004A80h HIGHLOW 00004A94h HIGHLOW 00004A9Ah HIGHLOW 00004AB1h HIGHLOW 00004AC5h HIGHLOW 00004ACFh HIGHLOW 00004B97h HIGHLOW 00004BA9h HIGHLOW 00004BB5h HIGHLOW 00004BD0h HIGHLOW 00004C3Dh HIGHLOW 00004C8Ch HIGHLOW 00004CB3h HIGHLOW 00004E26h HIGHLOW 00004E2Bh HIGHLOW 00004E3Bh HIGHLOW 00004E45h HIGHLOW 00004E70h HIGHLOW 00004E94h HIGHLOW 00004EADh HIGHLOW 00004EB3h HIGHLOW 00004EC7h HIGHLOW 00004ECDh HIGHLOW 00004EE4h HIGHLOW 00004EF8h HIGHLOW 00004F05h HIGHLOW 00004F0Bh HIGHLOW 00004F10h HIGHLOW 00004F26h HIGHLOW 00004F54h HIGHLOW 00004F7Eh HIGHLOW 00004FCDh HIGHLOW 00004FD2h HIGHLOW 00004FEBh HIGHLOW 00004FFCh HIGHLOW [IMAGE_BASE_RELOCATION] VirtualAddress: 0x5000 SizeOfBlock: 0xFC 00005013h HIGHLOW 00005041h HIGHLOW 0000506Bh HIGHLOW 00005077h HIGHLOW 00005090h HIGHLOW 00005096h HIGHLOW 000050AAh HIGHLOW 000050B0h HIGHLOW 000050C7h HIGHLOW 000050DBh HIGHLOW 000050E8h HIGHLOW 000050EEh HIGHLOW 000050F3h HIGHLOW 00005109h HIGHLOW 00005137h HIGHLOW 00005264h HIGHLOW 00005270h HIGHLOW 000052A6h HIGHLOW 000052B8h HIGHLOW 00005322h HIGHLOW 00005334h HIGHLOW 000053B7h HIGHLOW 000053C0h HIGHLOW 00005447h HIGHLOW 00005450h HIGHLOW 000054BEh HIGHLOW 000054D0h HIGHLOW 000054FDh HIGHLOW 00005623h HIGHLOW 00005664h HIGHLOW 00005681h HIGHLOW 00005689h HIGHLOW 000056ABh HIGHLOW 000056BDh HIGHLOW 000056CAh HIGHLOW 000056D2h HIGHLOW 000056F9h HIGHLOW 00005709h HIGHLOW 00005715h HIGHLOW 0000574Ah HIGHLOW 0000575Bh HIGHLOW 000057A2h HIGHLOW 000057A8h HIGHLOW 000057AEh HIGHLOW 000057B4h HIGHLOW 000057BAh HIGHLOW 000057C0h HIGHLOW 000057C6h HIGHLOW 000057CCh HIGHLOW 000057D2h HIGHLOW 000057D8h HIGHLOW 000057DEh HIGHLOW 000057E4h HIGHLOW 000057EAh HIGHLOW 000057F0h HIGHLOW 000057F6h HIGHLOW 000057FCh HIGHLOW 00005802h HIGHLOW 00005808h HIGHLOW 0000580Eh HIGHLOW 00005859h HIGHLOW 00005861h HIGHLOW 00005867h HIGHLOW 00005872h HIGHLOW 0000587Fh HIGHLOW 00005887h HIGHLOW 00005895h HIGHLOW 0000589Ah HIGHLOW 0000589Fh HIGHLOW 000058A4h HIGHLOW 000058AFh HIGHLOW 000058BCh HIGHLOW 000058C6h HIGHLOW 000058DBh HIGHLOW 000058E7h HIGHLOW 000058EDh HIGHLOW 0000590Fh HIGHLOW 00005921h HIGHLOW 0000597Dh HIGHLOW 0000599Ah HIGHLOW 000059A9h HIGHLOW 000059D1h HIGHLOW 000059E9h HIGHLOW 00005A17h HIGHLOW 00005A25h HIGHLOW 00005A2Ah HIGHLOW 00005A59h HIGHLOW 00005A66h HIGHLOW 00005A72h HIGHLOW 00005A7Eh HIGHLOW 00005A8Ah HIGHLOW 00005A99h HIGHLOW 00005A9Eh HIGHLOW 00005ADBh HIGHLOW 00005B1Bh HIGHLOW 00005B38h HIGHLOW 00005B44h HIGHLOW 00005B50h HIGHLOW 00005B5Ch HIGHLOW 00005B61h HIGHLOW 00005B78h HIGHLOW 00005B84h HIGHLOW 00005B90h HIGHLOW 00005B9Ch HIGHLOW 00005BA1h HIGHLOW 00005BB8h HIGHLOW 00005BC4h HIGHLOW 00005BD4h HIGHLOW 00005BE8h HIGHLOW 00005BF4h HIGHLOW 00005C00h HIGHLOW 00005C0Ch HIGHLOW 00005C18h HIGHLOW 00005C24h HIGHLOW 00005C29h HIGHLOW 00005C48h HIGHLOW 00005C54h HIGHLOW 00005C60h HIGHLOW 00005C6Ch HIGHLOW 00005C71h HIGHLOW 00005C92h HIGHLOW 00005000h ABSOLUTE [IMAGE_BASE_RELOCATION] VirtualAddress: 0x6000 SizeOfBlock: 0x7C 000061A0h HIGHLOW 000061A4h HIGHLOW 000061B0h HIGHLOW 000061CCh HIGHLOW 000061D8h HIGHLOW 000061F4h HIGHLOW 000061FCh HIGHLOW 00006208h HIGHLOW 00006224h HIGHLOW 00006230h HIGHLOW 0000624Ch HIGHLOW 00006254h HIGHLOW 00006260h HIGHLOW 0000627Ch HIGHLOW 00006288h HIGHLOW 000062A4h HIGHLOW 000062ACh HIGHLOW 000062B4h HIGHLOW 000062BCh HIGHLOW 000062C4h HIGHLOW 000062CCh HIGHLOW 000062D8h HIGHLOW 000062F4h HIGHLOW 000062FCh HIGHLOW 00006304h HIGHLOW 00006310h HIGHLOW 0000632Ch HIGHLOW 00006334h HIGHLOW 0000633Ch HIGHLOW 00006348h HIGHLOW 00006364h HIGHLOW 0000636Ch HIGHLOW 00006374h HIGHLOW 0000637Ch HIGHLOW 00006388h HIGHLOW 000063A4h HIGHLOW 000063ACh HIGHLOW 000063B4h HIGHLOW 000063BCh HIGHLOW 000063C8h HIGHLOW 000063E4h HIGHLOW 000063ECh HIGHLOW 000063F4h HIGHLOW 00006400h HIGHLOW 0000641Ch HIGHLOW 00006424h HIGHLOW 0000642Ch HIGHLOW 00006434h HIGHLOW 0000643Ch HIGHLOW 00006444h HIGHLOW 00006450h HIGHLOW 0000646Ch HIGHLOW 00006474h HIGHLOW 0000647Ch HIGHLOW 00006484h HIGHLOW 00006490h HIGHLOW 000064ACh HIGHLOW 00006000h ABSOLUTE [IMAGE_BASE_RELOCATION] VirtualAddress: 0x8000 SizeOfBlock: 0xC 000085F0h HIGHLOW 00008000h ABSOLUTE