#install.packages('neuralnet')
library("neuralnet")
#Going to create a neural network to perform sqare rooting
#Type ?neuralnet for more information on the neuralnet library
#Generate 50 random numbers uniformly distributed between 0 and 100
#And store them as a dataframe
library(quantmod)
library(fGarch)
URL <- "http://ichart.finance.yahoo.com/table.csv?s=^KS11"
dat <- read.csv(URL)
dat$Date <- as.Date(dat$Date, "%Y-%m-%d")
odat<-dat[c(1:100),]
attach(odat)
x<-odat[order(Date),]
t <- c(1:100)
traininginput <- cbind(t, Lag(x$Close, 1))
trainingoutput <- x$Close
#Column bind the data into one variable
trainingdata <- data.frame(traininginput,trainingoutput)
colnames(trainingdata) <- c("Input","Output")
#Train the neural network
#Going to have 10 hidden layers
#Threshold is a numeric value specifying the threshold for the partial
#derivatives of the error function as stopping criteria.
net.sqrt <- neuralnet(Output~Input,trainingdata, hidden=5, threshold=0.01)
#Plot the neural network
plot(net.sqrt)
#Test the neural network on some training data
testdata <- c(101:110) #Generate some squared numbers
net.results <- compute(net.sqrt, testdata) #Run them through the neural network
#Lets display a better version of the results
cleanoutput <- cbind(testdata,sqrt(testdata),
as.data.frame(net.results$net.result))
colnames(cleanoutput) <- c("Input","Expected Output","Neural Net Output")
cleanoutput
2013년 12월 30일 월요일
2013년 12월 28일 토요일
neural network
R script
--------------
library(datasets)
names(infert)
# *------------------------------------------------------------------*
# | train the network
# *------------------------------------------------------------------*
library(neuralnet)
#input is age, parity, induced ...
nn <- neuralnet(
case~age+parity+induced+spontaneous,
data=infert, hidden=5, err.fct="ce",
linear.output=FALSE)
# *------------------------------------------------------------------*
# | output training results
# *------------------------------------------------------------------*
# basic
nn
# reults options
names(nn)
# result matrix contains weights
nn$result.matrix
# The given data is saved in nn$covariate and
# nn$response as well as in nn$data for the whole data
# set inclusive non-used variables. The output of the
# neural network, i.e. the fitted values o(x), is provided
# by nn$net.result:
out <- cbind(nn$covariate,nn$net.result[[1]])
dimnames(out) <- list(NULL, c("age", "parity","induced","spontaneous","nn-output"))
head(out)
# visualization
plot(nn)
--------------
library(datasets)
names(infert)
# *------------------------------------------------------------------*
# | train the network
# *------------------------------------------------------------------*
library(neuralnet)
#input is age, parity, induced ...
nn <- neuralnet(
case~age+parity+induced+spontaneous,
data=infert, hidden=5, err.fct="ce",
linear.output=FALSE)
# *------------------------------------------------------------------*
# | output training results
# *------------------------------------------------------------------*
# basic
nn
# reults options
names(nn)
# result matrix contains weights
nn$result.matrix
# The given data is saved in nn$covariate and
# nn$response as well as in nn$data for the whole data
# set inclusive non-used variables. The output of the
# neural network, i.e. the fitted values o(x), is provided
# by nn$net.result:
out <- cbind(nn$covariate,nn$net.result[[1]])
dimnames(out) <- list(NULL, c("age", "parity","induced","spontaneous","nn-output"))
head(out)
# visualization
plot(nn)
ar(1) model with prediction
R script
----------------------
library(quantmod)
library(fGarch)
URL <- "http://ichart.finance.yahoo.com/table.csv?s=^KS11"
dat <- read.csv(URL)
dat$Date <- as.Date(dat$Date, "%Y-%m-%d")
odat<-dat[c(1:100),]
attach(odat)
x<-odat[order(Date),]
#kospiGarch <- garchFit(~arma(1, 2) + garch(1, 1), data=as.ts(x$Close))
fit <- arima(diff(log(x$Close)), order=c(1,0,0))
#fore <- predict(fit, n.ahead=10, doplot=F)
err <- rnorm(20, 0, .002)
sim <- diff(log(abs(x$Close)))[99]
for (t in 2:20) {
sim[t] <- fit$coef[2]+ fit$coef[1]*sim[t-1] + err[t]
}
dev.new()
plot(x$Close, type='l', xlim=c(0, 120),
panel.first=grid(col = "gray", lty = "dotted"), pch=20)
t <- c(101:120)
points(x$Close, pch = 20, col = "red")
for (j in 2:20) {
ye[j] <- exp(sim[j-1])*ye[j-1]
}
points(t, ye, col='red', pch=20, type='b')
----------------------
library(fGarch)
URL <- "http://ichart.finance.yahoo.com/table.csv?s=^KS11"
dat <- read.csv(URL)
dat$Date <- as.Date(dat$Date, "%Y-%m-%d")
odat<-dat[c(1:100),]
attach(odat)
x<-odat[order(Date),]
#kospiGarch <- garchFit(~arma(1, 2) + garch(1, 1), data=as.ts(x$Close))
fit <- arima(diff(log(x$Close)), order=c(1,0,0))
#fore <- predict(fit, n.ahead=10, doplot=F)
err <- rnorm(20, 0, .002)
sim <- diff(log(abs(x$Close)))[99]
for (t in 2:20) {
sim[t] <- fit$coef[2]+ fit$coef[1]*sim[t-1] + err[t]
}
dev.new()
plot(x$Close, type='l', xlim=c(0, 120),
panel.first=grid(col = "gray", lty = "dotted"), pch=20)
t <- c(101:120)
points(x$Close, pch = 20, col = "red")
for (j in 2:20) {
ye[j] <- exp(sim[j-1])*ye[j-1]
}
points(t, ye, col='red', pch=20, type='b')
지수가중이동평균법
코스피 분석
R 스크립트
-----------------
require(TTR)
URL <- "http://ichart.finance.yahoo.com/table.csv?s=^KS11"
dat <- read.csv(URL)
dat$Date <- as.Date(dat$Date, "%Y-%m-%d")
odat<-dat[c(1:100),]
#N<-99
attach(odat)
x<-odat[order(Date),]
par(mfrow=c(2,1), mar=c(2,3,3,2))
plot(x$Close,type="l", xaxt='n', xlab=NA,
panel.first=grid(col = "gray", lty = "dotted"))
points(x$Close, pch = 20, col = "red")
price<-x$Close
row<-diff(log(price),1,1)*100
x<-c(1:99)
plot(x, row, type="l", ylim=c(-0.8,0.8), col='lightgray', xaxt='n', xlab=NA)
ema<-EMA(row,n=10)
points(x=x, y=ema, col='green', type='l', xlab=NA)
wma<-WMA(row, n=5, wts=1:5)
points(x=x, y=wma, col='red', type='l')
abline(h=0, col="lightgray")
R 스크립트
-----------------
require(TTR)
URL <- "http://ichart.finance.yahoo.com/table.csv?s=^KS11"
dat <- read.csv(URL)
dat$Date <- as.Date(dat$Date, "%Y-%m-%d")
odat<-dat[c(1:100),]
#N<-99
attach(odat)
x<-odat[order(Date),]
par(mfrow=c(2,1), mar=c(2,3,3,2))
plot(x$Close,type="l", xaxt='n', xlab=NA,
panel.first=grid(col = "gray", lty = "dotted"))
points(x$Close, pch = 20, col = "red")
price<-x$Close
row<-diff(log(price),1,1)*100
x<-c(1:99)
plot(x, row, type="l", ylim=c(-0.8,0.8), col='lightgray', xaxt='n', xlab=NA)
ema<-EMA(row,n=10)
points(x=x, y=ema, col='green', type='l', xlab=NA)
wma<-WMA(row, n=5, wts=1:5)
points(x=x, y=wma, col='red', type='l')
abline(h=0, col="lightgray")
2013년 12월 5일 목요일
2013년 12월 3일 화요일
2013년 12월 1일 일요일
2013년 11월 23일 토요일
gcc -o arraytest.exe arraytest.c arrayinc.obj
// File: arraytest.c
//
// C program to test arrayinc.asm
//
#include <stdio.h>
void arrayinc(int A[], int n) ;
main() {
int A[7] = {2, 7, 19, 45, 3, 42, 9} ;
int i ;
printf ("sizeof(int) = %d\n", sizeof(int)) ;
printf("\nOriginal array:\n") ;
for (i = 0 ; i < 7 ; i++) {
printf("A[%d] = %d ", i, A[i]) ;
}
printf("\n") ;
arrayinc(A,7) ;
printf("\nModified array:\n") ;
for (i = 0 ; i < 7 ; i++) {
printf("A[%d] = %d ", i, A[i]) ;
}
printf("\n") ;
}
-----------------------------------
; File: arrayinc.asm
;
; A subroutine to be called from C programs.
; Parameters: int A[], int n
; Result: A[0], ... A[n-1] are each incremented by 1
SECTION .text
global _arrayinc
_arrayinc:
push ebp ; set up stack frame
mov ebp, esp
; registers ebx, esi and edi must be saved, if used
push ebx
push edi
mov edi, [ebp+8] ; get address of A
mov ecx, [ebp+12] ; get num of elts
mov ebx, 0 ; initialize count
for_loop:
mov eax, [edi+4*ebx] ; get array element
inc eax ; add 1
mov [edi+4*ebx], eax ; put it back
inc ebx ; update counter
loop for_loop
pop edi ; restore registers
pop ebx
mov esp, ebp ; take down stack frame
pop ebp
ret
----------------------------------------
nasm -f obj arrayinc.asm
//
// C program to test arrayinc.asm
//
#include <stdio.h>
void arrayinc(int A[], int n) ;
main() {
int A[7] = {2, 7, 19, 45, 3, 42, 9} ;
int i ;
printf ("sizeof(int) = %d\n", sizeof(int)) ;
printf("\nOriginal array:\n") ;
for (i = 0 ; i < 7 ; i++) {
printf("A[%d] = %d ", i, A[i]) ;
}
printf("\n") ;
arrayinc(A,7) ;
printf("\nModified array:\n") ;
for (i = 0 ; i < 7 ; i++) {
printf("A[%d] = %d ", i, A[i]) ;
}
printf("\n") ;
}
-----------------------------------
; File: arrayinc.asm
;
; A subroutine to be called from C programs.
; Parameters: int A[], int n
; Result: A[0], ... A[n-1] are each incremented by 1
SECTION .text
global _arrayinc
_arrayinc:
push ebp ; set up stack frame
mov ebp, esp
; registers ebx, esi and edi must be saved, if used
push ebx
push edi
mov edi, [ebp+8] ; get address of A
mov ecx, [ebp+12] ; get num of elts
mov ebx, 0 ; initialize count
for_loop:
mov eax, [edi+4*ebx] ; get array element
inc eax ; add 1
mov [edi+4*ebx], eax ; put it back
inc ebx ; update counter
loop for_loop
pop edi ; restore registers
pop ebx
mov esp, ebp ; take down stack frame
pop ebp
ret
----------------------------------------
nasm -f obj arrayinc.asm
2013년 11월 21일 목요일
eggshell perl
wolverine:~ stephen$ nasm -f bin omlette.asm -o omlette
wolverine:~ stephen$ cat omlette | perl -e 'print chr(0x22); while (read STDIN, $d, 1) {print "\\x" . sprintf( "%02x", ord($d)); $c++; if ($c == 14) {print chr(0x22) . " .\n" . chr(0x22);$c=0}}; print chr(0x22) . ";\n"'
"\x89\xe5\x66\x81\xcb\xff\x0f\x43\x31\xc0\xb0\x02\x89\xda" .
"\xcd\x2e\x3c\x05\x74\xee\xb8\x12\x34\x56\x78\x89\xdf\xaf" .
"\x75\xe9\xaf\x75\xe6\x89\xfe\x89\xef\x66\xad\x31\xc9\x88" .
"\xe1\x3c\x01\xf3\xa4\x89\xfd\x75\xd4\xff\xe4";
http://www.thegreycorner.com/2013/10/omlette-egghunter-shellcode.html
giibs sampler
## PROGRAMS THE GIBBS SAMPLING - pag 64-67
# Define the number of observations & simulations
n <- 30
# Load the data
#y <- rnorm(n,4,10) # This would generate random values
y <- c(1.2697,7.7637,2.2532,3.4557,4.1776,6.4320,-3.6623,7.7567,5.9032,7.2671,
-2.3447,8.0160,3.5013,2.8495,0.6467,3.2371,5.8573,-3.3749,4.1507,4.3092,
11.7327,2.6174,9.4942,-2.7639,-1.5859,3.6986,2.4544,-0.3294,0.2329,5.2846)
# Defines the hyper-parameters to build the full conditionals
ybar <- mean(y)
mu_0 <- 0
sigma2_0 <- 10000
alpha_0 <- 0.01
beta_0 <- 0.01
# Initialises the parameters
mu <- tau <- numeric()
sigma2 <- 1/tau
mu[1] <- rnorm(1,0,3)
tau[1] <- runif(1,0,3)
sigma2[1] <- 1/tau[1]
# Gibbs sampling (samples from the full conditionals)
nsim <- 1000
for (i in 2:nsim) {
sigma_n <- sqrt(1/(1/sigma2_0 + n/sigma2[i-1]))
mu_n <- (mu_0/sigma2_0 + n*ybar/sigma2[i-1])*sigma_n^2
mu[i] <- rnorm(1,mu_n,sigma_n)
alpha_n <- alpha_0+n/2
beta_n <- beta_0 + sum((y-mu[i])^2)/2
tau[i] <- rgamma(1,alpha_n,beta_n)
sigma2[i] <- 1/tau[i]
}
## Creates a bivariate contour, using the package mvtnorm
require(mvtnorm)
theta <- c(mean(mu),mean(sqrt(sigma2)))
sigma <- c(var(mu),var(sqrt(sigma2)))
rho <- cor(mu,sqrt(sigma2))
ins <- c(-10,10)
x1 <- seq(theta[1]-abs(ins[1]),theta[1]+abs(ins[1]),length.out=1000)
x2 <- seq(theta[2]-abs(ins[2]),theta[2]+abs(ins[2]),length.out=1000)
all <- expand.grid(x1, x2)
Sigma<-matrix(c(sigma[1], sigma[1]*sigma[2]*rho, sigma[1]*sigma[2]*rho, sigma[2]), nrow=2, ncol=2)
f.x <- dmvnorm(all, mean = theta, sigma = Sigma)
f.x2 <- matrix(f.x, nrow=length(x1), ncol=length(x2))
##Plots of the results at different simulation lengths
lw <- c(1,1.6)
# First 100 iterations
plot(mu,sqrt(sigma2),col="white",pch=20,cex=.3,xlim=range(mu),ylim=range(sqrt(sigma2)),xlab=expression(mu),ylab=expression(sigma),
main="After 100 iterations")
for (i in 1:99) {
points(c(mu[i],mu[i+1]),c(sqrt(sigma2)[i],sqrt(sigma2)[i]),t="l",col="grey60")
points(c(mu[i+1],mu[i+1]),c(sqrt(sigma2)[i],sqrt(sigma2)[i+1]),t="l",col="grey60")
}
text(jitter(mu[1:100]),jitter(sqrt(sigma2[1:100])),1:100,col="grey20")
contour(x = x1, y = x2, z = f.x2, nlevels=5,add=T,col="black",drawlabels=FALSE,lwd=lw[1])
=============================================================
똑같은 걸 이번에는 jags로
=============================
library('rjags')
y <- c(1.2697,7.7637,2.2532,3.4557,4.1776,6.4320,-3.6623,7.7567,5.9032,7.2671,
-2.3447,8.0160,3.5013,2.8495,0.6467,3.2371,5.8573,-3.3749,4.1507,4.3092,
11.7327,2.6174,9.4942,-2.7639,-1.5859,3.6986,2.4544,-0.3294,0.2329,5.2846)
model_string <- "model {
for (i in 1:length(y)) {
y[i] ~ dnorm(mu, tau)
}
mu ~ dnorm(0,0.0001)
sigma ~ dlnorm(0,0.0625)
tau <- 1/ pow(sigma, 2)
}"
model <- jags.model(textConnection(model_string),
data = list(y = y),
n.chains = 3,
n.adapt = 100)
update(jags, 100)
output<-coda.samples(model,
variable.names=c('mu', 'sigma'),
n.iter=100)
plot(output)
# Define the number of observations & simulations
n <- 30
# Load the data
#y <- rnorm(n,4,10) # This would generate random values
y <- c(1.2697,7.7637,2.2532,3.4557,4.1776,6.4320,-3.6623,7.7567,5.9032,7.2671,
-2.3447,8.0160,3.5013,2.8495,0.6467,3.2371,5.8573,-3.3749,4.1507,4.3092,
11.7327,2.6174,9.4942,-2.7639,-1.5859,3.6986,2.4544,-0.3294,0.2329,5.2846)
# Defines the hyper-parameters to build the full conditionals
ybar <- mean(y)
mu_0 <- 0
sigma2_0 <- 10000
alpha_0 <- 0.01
beta_0 <- 0.01
# Initialises the parameters
mu <- tau <- numeric()
sigma2 <- 1/tau
mu[1] <- rnorm(1,0,3)
tau[1] <- runif(1,0,3)
sigma2[1] <- 1/tau[1]
# Gibbs sampling (samples from the full conditionals)
nsim <- 1000
for (i in 2:nsim) {
sigma_n <- sqrt(1/(1/sigma2_0 + n/sigma2[i-1]))
mu_n <- (mu_0/sigma2_0 + n*ybar/sigma2[i-1])*sigma_n^2
mu[i] <- rnorm(1,mu_n,sigma_n)
alpha_n <- alpha_0+n/2
beta_n <- beta_0 + sum((y-mu[i])^2)/2
tau[i] <- rgamma(1,alpha_n,beta_n)
sigma2[i] <- 1/tau[i]
}
## Creates a bivariate contour, using the package mvtnorm
require(mvtnorm)
theta <- c(mean(mu),mean(sqrt(sigma2)))
sigma <- c(var(mu),var(sqrt(sigma2)))
rho <- cor(mu,sqrt(sigma2))
ins <- c(-10,10)
x1 <- seq(theta[1]-abs(ins[1]),theta[1]+abs(ins[1]),length.out=1000)
x2 <- seq(theta[2]-abs(ins[2]),theta[2]+abs(ins[2]),length.out=1000)
all <- expand.grid(x1, x2)
Sigma<-matrix(c(sigma[1], sigma[1]*sigma[2]*rho, sigma[1]*sigma[2]*rho, sigma[2]), nrow=2, ncol=2)
f.x <- dmvnorm(all, mean = theta, sigma = Sigma)
f.x2 <- matrix(f.x, nrow=length(x1), ncol=length(x2))
##Plots of the results at different simulation lengths
lw <- c(1,1.6)
# First 100 iterations
plot(mu,sqrt(sigma2),col="white",pch=20,cex=.3,xlim=range(mu),ylim=range(sqrt(sigma2)),xlab=expression(mu),ylab=expression(sigma),
main="After 100 iterations")
for (i in 1:99) {
points(c(mu[i],mu[i+1]),c(sqrt(sigma2)[i],sqrt(sigma2)[i]),t="l",col="grey60")
points(c(mu[i+1],mu[i+1]),c(sqrt(sigma2)[i],sqrt(sigma2)[i+1]),t="l",col="grey60")
}
text(jitter(mu[1:100]),jitter(sqrt(sigma2[1:100])),1:100,col="grey20")
contour(x = x1, y = x2, z = f.x2, nlevels=5,add=T,col="black",drawlabels=FALSE,lwd=lw[1])
=============================================================
똑같은 걸 이번에는 jags로
=============================
library('rjags')
y <- c(1.2697,7.7637,2.2532,3.4557,4.1776,6.4320,-3.6623,7.7567,5.9032,7.2671,
-2.3447,8.0160,3.5013,2.8495,0.6467,3.2371,5.8573,-3.3749,4.1507,4.3092,
11.7327,2.6174,9.4942,-2.7639,-1.5859,3.6986,2.4544,-0.3294,0.2329,5.2846)
model_string <- "model {
for (i in 1:length(y)) {
y[i] ~ dnorm(mu, tau)
}
mu ~ dnorm(0,0.0001)
sigma ~ dlnorm(0,0.0625)
tau <- 1/ pow(sigma, 2)
}"
model <- jags.model(textConnection(model_string),
data = list(y = y),
n.chains = 3,
n.adapt = 100)
update(jags, 100)
output<-coda.samples(model,
variable.names=c('mu', 'sigma'),
n.iter=100)
plot(output)
2013년 11월 18일 월요일
2013년 11월 15일 금요일
installation of perl modules
# cpan cpan shell -- CPAN exploration and modules installation (v1.9205) ReadLine support available (maybe install Bundle::CPAN or Bundle::CPANxxl?) cpan[1]> install "Email::Reply";
2013년 11월 7일 목요일
2013년 10월 31일 목요일
link
section .data
ldlibry dd 0
pro dd 0
dll db "user32.dll",0
myFtion db "MessageBoxA",0
MSG db "ASM GetProcAddress",0
extern _LoadLibraryA@4
extern _FreeLibrary@4
extern _GetProcAddress@8
extern _ExitProcess@4
global _start
section .text
_start:
push dll ;push user32.dll
call _LoadLibraryA@4 ;Call the API.
mov [ldlibry],eax ;eax hold return address. So eax=LoadLibrary("user32.dll") and now ldlibry=LoadLibrary("user32.dll")
;now we need to call GetProcAddress
push myFtion ;The API name we are going to call
push eax ;LoadLibrary("user32.dll")
call _GetProcAddress@8 ;GetProcAddress(LoadLibrary("user32.dll"),"MessageBoxA"). Again eax holding the return address
push 0x0 ;MB_OK
push MSG ;TITLE="ASM GetProcAddress"
push MSG ;Messgage="ASM GetProcAddress"
push 0 ;Reserved=0
call eax ;Call MessageBoxA through GetProcAddress.
push dword [ldlibry] ; ldlibry holding the LoadLibrary("user32.dll"). Again load to Free up.
call _FreeLibrary@4 ;Call the Windows api FreeLibrary()
;We should exit the process otherwise it may cause "access violation"
push 0 ;load 0 to stack
call _ExitProcess@4 ;Call ExitProcess
----------------
C:\work>nasm -f win32 asmcall.asm
C:\work>link asmcall.obj /entry:start /subsystem:console kernel32.lib
Microsoft (R) Incremental Linker Version 6.00.8168
Copyright (C) Microsoft Corp 1992-1998. All rights reserved.
2013년 10월 19일 토요일
cmd stdout to file c:\>dumpbin explorer > std.txt
Microsoft (R) COFF Binary File Dumper Version 6.00.8168
Copyright (C) Microsoft Corp 1992-1998. All rights reserved.
Dump of file explorer.exe
File Type: EXECUTABLE IMAGE
Section contains the following imports:
ADVAPI32.dll
1001000 Import Address Table
10431E8 Import Name Table
FFFFFFFF time date stamp
FFFFFFFF Index of first forwarder reference
77FB60EE 1FD RegSetValueW
77F57BC9 1D9 RegEnumKeyExW
77F6494D 124 GetUserNameW
77F5D8EE 1E1 RegNotifyChangeKeyValue
77F57EDD 1DC RegEnumValueW
77F57AAB 1EE RegQueryValueExA
77F57842 1E4 RegOpenKeyExA
77F5D5D4 1DA RegEnumKeyW
77F56C17 1CA RegCloseKey
77F7BA25 1D0 RegCreateKeyW
77F649AE 1EA RegQueryInfoKeyW
77F56A9F 1E5 RegOpenKeyExW
77F56FEF 1EF RegQueryValueExW
77F5775C 1CF RegCreateKeyExW
77F5D757 1FC RegSetValueExW
77F5EDE1 1D4 RegDeleteValueW
77F5D86A 1F0 RegQueryValueW
BROWSEUI.dll
1001048 Import Address Table
1043230 Import Name Table
FFFFFFFF time date stamp
FFFFFFFF Index of first forwarder reference
75ED76CB Ordinal 118
75EFD7A5 Ordinal 135
75F01C8F Ordinal 107
75F019C7 Ordinal 106
GDI32.dll
100105C Import Address Table
1043244 Import Name Table
FFFFFFFF time date stamp
FFFFFFFF Index of first forwarder reference
77E261C1 1A6 GetStockObject
77E2ACB8 46 CreatePatternBrush
77E2C006 1D6 OffsetViewportOrgEx
77E26B2E 18B GetLayout
77E295D8 21 CombineRgn
77E29E09 32 CreateDIBSection
77E27F9D 1B6 GetTextExtentPoint32W
77E2B6C0 24A StretchBlt
77E2827C 4C CreateRectRgnIndirect
77E27786 4B CreateRectRgn
77E26AD6 162 GetClipRgn
77E26A56 1C8 IntersectClipRect
77E27C01 1C1 GetViewportOrgEx
77E27B4C 240 SetViewportOrgEx
77E27AA0 20D SelectClipRgn
77E2869B 1DE PatBlt
77E28F4C 14D GetBkColor
77E25FE0 2D CreateCompatibleDC
77E2700A 2C CreateCompatibleBitmap
77E27ABB 1D7 OffsetWindowOrgEx
77E26E5F 8C DeleteDC
77E25E29 216 SetBkColor
77E26F79 12 BitBlt
77E28086 DE ExtTextOutW
77E26B0D 1B9 GetTextExtentPointW
77E26AA1 161 GetClipBox
77E283B3 198 GetObjectW
77E25D77 23D SetTextColor
77E25EDB 217 SetBkMode
77E2938F 3D CreateFontIndirectW
77E26BFA 8F DeleteObject
77E27DB9 1BE GetTextMetricsW
77E25B70 20F SelectObject
77E25A69 16C GetDeviceCaps
77E2A8CB 251 TranslateCharsetInfo
77E28597 239 SetStretchBltMode
KERNEL32.dll
10010F0 Import Address Table
10432D8 Import Name Table
FFFFFFFF time date stamp
FFFFFFFF Index of first forwarder reference
7C831DD3 1BA GetSystemDirectoryW
7C8106C7 6C CreateThread
7C82CAFB 57 CreateJobObjectW
7C81CAFA B6 ExitProcess
7C82C8E5 323 SetProcessShutdownParameters
7C8024B7 2B3 ReleaseMutex
7C80E947 5D CreateMutexW
7C82C330 31F SetPriorityClass
7C80DE85 13B GetCurrentProcess
7C801E54 1AF GetStartupInfoW
7C817013 10A GetCommandLineW
7C80AC9F 303 SetErrorMode
7C9310E0 243 LeaveCriticalSection
7C931000 96 EnterCriticalSection
7C80A0CB 2BF ResetEvent
7C801D53 245 LoadLibraryExA
7C810B69 36 CompareFileTime
7C8017E9 1C0 GetSystemTimeAsFileTime
7C80C198 331 SetThreadPriority
7C8097B8 13E GetCurrentThreadId
7C80A823 1D0 GetThreadPriority
7C80997B 13D GetCurrentThread
7C80BFF4 1D9 GetUserDefaultLangID
7C802446 342 Sleep
7C868BAC FB GetBinaryTypeW
7C81FCA9 178 GetModuleHandleExW
7C810BAC 347 SystemTimeToFileTime
7C80A864 16A GetLocalTime
7C8099B0 13C GetCurrentProcessId
7C80F184 151 GetEnvironmentVariableW
7C82BFF0 360 UnregisterWait
7C82C3B6 1F6 GlobalGetAtomNameW
7C80B7DC 159 GetFileAttributesW
7C821249 263 MoveFileW
7C80AA5C 3AC lstrcmpW
7C801AF5 246 LoadLibraryExW
7C80EE67 CC FindClose
7C80EFCA DA FindNextFileW
7C80EF71 D3 FindFirstFileW
7C80BB31 3AE lstrcmpiA
7C80A0A7 304 SetEvent
7C82E442 C AssignProcessToJobObject
7C83378D 140 GetDateFormatW
7C833FEB 1D6 GetTimeFormatW
7C8355D4 E7 FlushInstructionCache
7C80BA7F 3B5 lstrcpynW
7C80ADB9 1C3 GetSystemWindowsDirectoryW
7C93FE10 316 SetLastError
7C80AC51 19C GetProcessHeap
7C93FF0D 20B HeapFree
7C949B80 20F HeapReAlloc
7C9404BD 211 HeapSize
7C9400A4 205 HeapAlloc
7C809FA0 1D8 GetUserDefaultLCID
7C8021D0 2A9 ReadProcessMemory
7C8309D1 277 OpenProcess
7C809832 21B InterlockedCompareExchange
7C801D7B 244 LoadLibraryA
7C80A4B7 294 QueryPerformanceCounter
7C863E6A 35B UnhandledExceptionFilter
7C8449FD 336 SetUnhandledExceptionFilter
7C809B74 371 VirtualFree
7C809AE1 36E VirtualAlloc
7C83290F 2C2 ResumeThread
7C801E1A 34A TerminateProcess
7C81CB23 34B TerminateThread
7C80BFCD 1B6 GetSystemDefaultLCID
7C8115F2 16C GetLocaleInfoW
7C80A739 4C CreateEventW
7C93FE01 168 GetLastError
7C8131D0 26F OpenEventW
7C87EECD 7D DelayLoadFailureHook
7C802530 37E WaitForSingleObject
7C80932E 1D4 GetTickCount
7C8305E6 BA ExpandEnvironmentStringsW
7C80B465 175 GetModuleFileNameW
7C80F9ED 195 GetPrivateProfileStringW
7C80AA26 3AF lstrcmpiW
7C802336 66 CreateProcessW
7C80AC6E F0 FreeLibrary
7C80AE0B 1E9 GetWindowsDirectoryW
7C809A1D 24A LocalAlloc
7C8107F0 52 CreateFileW
7C801629 88 DeviceIoControl
7C8099BF 24E LocalFree
7C80A7AD 1AB GetQueuedCompletionStatus
7C831375 55 CreateIoCompletionPort
7C82CA97 314 SetInformationJobObject
7C809BD7 31 CloseHandle
7C80AEDB 247 LoadLibraryW
7C80E4CD 179 GetModuleHandleW
7C80A6D4 0 ActivateActCtx
7C80A705 73 DeactivateActCtx
7C811185 158 GetFileAttributesExW
7C80AE30 198 GetProcAddress
7C94135A 7F DeleteCriticalSection
7C83089D 4B CreateEventA
7C810F88 209 HeapDestroy
7C809F81 218 InitializeCriticalSection
7C809856 266 MulDiv
7C80B8B9 219 InitializeCriticalSectionAndSpinCount
7C809A99 3B8 lstrlenW
7C80980A 21C InterlockedDecrement
7C8097F6 220 InterlockedIncrement
7C80FDBD 1ED GlobalAlloc
7C80981E 21D InterlockedExchange
7C80B731 176 GetModuleHandleA
7C812B6E 1DE GetVersionExA
7C80FCBF 1F4 GlobalFree
7C8352F1 1A2 GetProcessTimes
7C80BAF4 3B2 lstrcpyW
7C8133E3 172 GetLongPathNameW
7C8211B5 2AE RegisterWaitForSingleObject
msvcrt.dll
10012B8 Import Address Table
10434A0 Import Name Table
FFFFFFFF time date stamp
FFFFFFFF Index of first forwarder reference
4D3EC392 161 _itow
4D3FC21B 2A5 free
4D4172B0 2DF memmove
4D3FC437 2EE realloc
4D405C94 ED _except_handler3
4D3FC407 2D8 malloc
4D41FA30 118 _ftol
4D40FFE7 220 _vsnwprintf
ntdll.dll
10012DC Import Address Table
10434C4 Import Name Table
FFFFFFFF time date stamp
FFFFFFFF Index of first forwarder reference
7C93F60D 2CD RtlNtStatusToDosError
7C93D7E0 EB NtQueryInformationProcess
ole32.dll
10012E8 Import Address Table
10434D0 Import Name Table
FFFFFFFF time date stamp
FFFFFFFF Index of first forwarder reference
769C00AC 1C CoFreeUnusedLibraries
7698F62A 121 RegisterDragDrop
7698E54C 84 CreateBindCtx
769C2B55 123 RevokeDragDrop
7698EF7B 3B CoInitializeEx
7698EE46 68 CoUninitialize
7698F6EA FC OleInitialize
769BA2F3 5B CoRevokeClassObject
769A7E90 4F CoRegisterClassObject
769E6EC6 45 CoMarshalInterThreadInterfaceInStream
7699057E 10 CoCreateInstance
769C31E7 113 OleUninitialize
76A60B6D 97 DoDragDrop
OLEAUT32.dll
1001320 Import Address Table
1043508 Import Name Table
FFFFFFFF time date stamp
FFFFFFFF Index of first forwarder reference
770D4BA2 Ordinal 2
770D48F0 Ordinal 9
SHDOCVW.dll
100132C Import Address Table
1043514 Import Name Table
FFFFFFFF time date stamp
FFFFFFFF Index of first forwarder reference
7E75E4F8 Ordinal 110
7E75DF24 Ordinal 125
7E7FA588 Ordinal 111
SHELL32.dll
100133C Import Address Table
1043524 Import Name Table
FFFFFFFF time date stamp
FFFFFFFF Index of first forwarder reference
7D77C971 Ordinal 182
7D5CF759 Ordinal 162
7D5CED76 B2 SHGetFolderPathW
7D5D8FD4 Ordinal 67
7D5D3FE0 Ordinal 72
7D6AE246 Ordinal 90
7D5EA7D2 Ordinal 181
7D5DFF29 Ordinal 727
7D5DE1B7 2E ExtractIconExW
7D5E8C9C Ordinal 137
7D604410 Ordinal 645
7D6028E5 Ordinal 644
7D5D88D7 Ordinal 2
7D5F2B39 Ordinal 236
7D6ACC4E Ordinal 149
7D5CC7B3 Ordinal 147
7D5ED2F0 Ordinal 188
7D5E1F27 Ordinal 660
7D5ED00C Ordinal 201
7D5E555F Ordinal 245
7D5CC3B0 Ordinal 68
7D5D6F47 Ordinal 723
7D5EA404 Ordinal 200
7D5CF2E3 C3 SHGetSpecialFolderLocation
7D5E2F03 10A ShellExecuteExW
7D5CC059 Ordinal 100
7D5E5ABE Ordinal 85
7D5EE48B Ordinal 653
7D5CF778 C5 SHGetSpecialFolderPathW
7D5CAD60 Ordinal 196
7D5CB115 Ordinal 25
7D5CAD90 Ordinal 152
7D5D3E90 77 SHBindToParent
7D5E872C Ordinal 719
7D5E85B9 Ordinal 732
7D5DCB44 Ordinal 148
7D5CDB70 DA SHParseDisplayName
7D697681 Ordinal 154
7D5D6598 Ordinal 77
7D5DEC99 Ordinal 6
7D69AD46 Ordinal 193
7D6B5E42 Ordinal 747
7D5D3D09 Ordinal 71
7D5CC1B7 Ordinal 17
7D5D142C Ordinal 23
7D68EADC Ordinal 132
7D5EDB5B Ordinal 680
7D5EB0B4 Ordinal 233
7D5CA8EA Ordinal 195
7D5CAAEC Ordinal 155
7D5DE54B Ordinal 89
7D5EB2F2 Ordinal 241
7D68EA01 Ordinal 134
7D68E94F Ordinal 22
7D604909 7E SHChangeNotify
7D5CB768 A7 SHGetDesktopFolder
7D60FD22 73 SHAddToRecentDocs
7D670D3D Ordinal 127
7D5D120F Ordinal 21
7D5CF5E2 Ordinal 102
7D652A57 26 DuplicateIcon
7D73AA2A Ordinal 202
7D73AAC2 Ordinal 82
7D67379F Ordinal 244
7D658C55 Ordinal 54
7D652325 Ordinal 161
7D6AE167 Ordinal 91
7D658C6D Ordinal 254
7D658CA3 Ordinal 60
7D5EBCE0 EF SHUpdateRecycleBinIcon
7D5CF261 AE SHGetFolderLocation
7D614C31 BC SHGetPathFromIDListA
7D675778 Ordinal 711
7D5F2CCA Ordinal 731
7D5D542A Ordinal 4
7D5CA639 Ordinal 733
7D5CE2DF Ordinal 190
7D5D0ECE Ordinal 64
7D620206 Ordinal 61
7D5D1024 BD SHGetPathFromIDListW
7D5EB409 Ordinal 753
7D5CC97C Ordinal 16
7D5CADF5 Ordinal 18
SHLWAPI.dll
100148C Import Address Table
1043674 Import Name Table
FFFFFFFF time date stamp
FFFFFFFF Index of first forwarder reference
77E76753 F0 StrCpyNW
77E76948 Ordinal 215
77E7413F Ordinal 217
77E7880D Ordinal 476
77E76FF0 Ordinal 157
77E76D2F 109 StrRetToBufW
77E82613 10B StrRetToStrW
77E78390 Ordinal 176
77E8A950 Ordinal 154
77E7BF88 Ordinal 439
77E76919 Ordinal 156
77E76F2E AD SHQueryValueExW
77E77DC3 49 PathIsNetworkPathW
77EC7302 Ordinal 513
77E79E69 0 AssocCreate
77E8788F Ordinal 512
77E85C75 Ordinal 171
77E826C0 Ordinal 178
77EC71DF Ordinal 177
77E7C22E Ordinal 193
77E80486 DE StrCatW
77E7682A F1 StrCpyW
77E87205 Ordinal 225
77E803F5 Ordinal 413
77E74076 Ordinal 219
77E799EA Ordinal 175
77E790E9 Ordinal 164
77E85CE3 Ordinal 172
77E74587 A1 SHGetValueW
77E748D4 Ordinal 437
77E76F84 ED StrCmpNIW
77E7B01C 6D PathRemoveBlanksW
77E8420B 69 PathRemoveArgsW
77E77077 31 PathFindFileNameW
77E77E7C 110 StrStrIW
77E841D1 39 PathGetArgsW
77E74E3B Ordinal 563
77E7AF74 119 StrToIntW
77E78F94 BB SHRegGetBoolUSValueW
77E84F7D CD SHRegWriteUSValueW
77E78AD8 AE SHRegCloseUSKey
77E87687 B0 SHRegCreateUSKeyW
77E78CF2 BF SHRegGetUSValueW
77E7975F D2 SHSetValueW
77E87C2C Ordinal 433
77E77ACD 1D PathAppendW
77E7AFBF 85 PathUnquoteSpacesW
77E76DCA Ordinal 460
77E8AEB0 Ordinal 194
77EC1067 65 PathQuoteSpacesW
77EB39FF Ordinal 244
77E87C86 D0 SHSetThreadRef
77E87CC0 90 SHCreateThreadRef
77E7502E Ordinal 241
77E789F0 Ordinal 236
77EC941D Ordinal 279
77E779C9 23 PathCombineW
77E8C464 Ordinal 192
77E776DE Ordinal 204
77E89469 Ordinal 509
77E76C63 D5 SHStrDupW
77E8430C 4B PathIsPrefixW
77E7B09D 63 PathParseIconLocationW
77E7A5AE 4 AssocQueryKeyW
77E873A6 Ordinal 16
77E8A78E 8 AssocQueryStringW
77E77126 EF StrCmpW
77E77C21 Ordinal 174
77E911B0 Ordinal 548
77E894B1 Ordinal 165
77E7779D Ordinal 240
77E85FD5 Ordinal 163
77E8940A Ordinal 479
77E7B53E Ordinal 9
77E8C287 Ordinal 8
77E78E75 C7 SHRegQueryUSValueW
77E78C8A C3 SHRegOpenUSKeyW
77E88A8B CB SHRegSetUSValueW
77E8AE59 43 PathIsDirectoryW
77E77D89 2D PathFileExistsW
77E76BDA 3D PathGetDriveNumberW
77E7B559 Ordinal 10
77E766BD E4 StrChrW
77E76859 2F PathFindExtensionW
77E7959F Ordinal 260
77EC7A8B Ordinal 292
77E77C56 71 PathRemoveFileSpecW
77E783F5 7D PathStripToRootW
77EB2DAE Ordinal 250
77EC6F12 Ordinal 478
77E7C266 Ordinal 184
77E824BA A7 SHOpenRegStream2W
77E7C311 Ordinal 212
77E87D29 Ordinal 213
77E76FA8 Ordinal 158
77E76772 F3 StrDupW
77E8C341 98 SHDeleteValueW
77E76B50 DC StrCatBuffW
77E86F94 94 SHDeleteKeyW
77E76A8E E9 StrCmpIW
77EB26BB Ordinal 467
77E76808 Ordinal 346
77E793E6 137 wnsprintfW
77E8CA99 Ordinal 197
77E8961B Ordinal 278
77E76DE8 EE StrCmpNW
77E8A6A8 Ordinal 237
77E77032 Ordinal 199
USER32.dll
1001640 Import Address Table
1043828 Import Name Table
FFFFFFFF time date stamp
FFFFFFFF Index of first forwarder reference
77D45215 29E TileWindows
77D0D86B 115 GetDoubleClickTime
77CF8F9C 15D GetSystemMetrics
77CF8EAB 15B GetSysColorBrush
77D01E40 5 AllowSetForegroundWindow
77D0EB48 1C6 LoadMenuW
77D0D896 159 GetSubMenu
77CFF716 22B RemoveMenu
77D0C7F9 266 SetParent
77D0996C 13C GetMessagePos
77D04DCA 38 CheckDlgButton
77D09849 C4 EnableWindow
77D3BC8B 112 GetDlgItemInt
77D3BC09 252 SetDlgItemInt
77CFDE72 48 CopyIcon
77D0E7EA 2 AdjustWindowRectEx
77D0F94F B3 DrawFocusRect
77D0FBF6 B2 DrawEdge
77D3A275 E1 ExitWindowsEx
77D09766 2D5 WindowFromPoint
77D08FA6 26C SetRect
77D032BA 9 AppendMenuW
77D0EE76 1B4 LoadAcceleratorsW
77D00242 1B6 LoadBitmapW
77D0D64F 242 SendNotifyMessageW
77CFDE46 282 SetWindowPlacement
77D11ABD 39 CheckMenuItem
77D04A4E C6 EndDialog
77D073CC 237 SendDlgItemMessageW
77D11F7B 1DB MessageBeep
77D0C2E8 EB GetActiveWindow
77D0CA5A 201 PostQuitMessage
77D0B29E 1E9 MoveWindow
77D0436E 111 GetDlgItem
77D0C076 22D RemovePropW
77D09D12 FD GetClassNameW
77D0C595 10D GetDCEx
77D361B3 24F SetCursorPos
77D0201F 3C ChildWindowFromPoint
77D39623 23 ChangeDisplaySettingsW
77CFEBB3 21E RegisterHotKey
77D4CF8A 2B6 UnregisterHotKey
77D09930 24D SetCursor
77D0CDAA 23F SendMessageTimeoutW
77D103C7 173 GetWindowPlacement
77D07B97 1BE LoadImageW
77D0E528 284 SetWindowRgn
77D08F1F 192 IntersectRect
77D09011 1F2 OffsetRect
77D0A77B D2 EnumDisplayMonitors
77D09944 215 RedrawWindow
77D00138 295 SubtractRect
77CF941E 2A8 TranslateAcceleratorW
77CF940C 2D0 WaitMessage
77D098D5 18A InflateRect
77D0A01E 1C CallWindowProcW
77D0AF1B 110 GetDlgCtrlID
77D0C35E 244 SetCapture
77CFDE5A 1CA LockSetForegroundWindow
77CF9F06 29A SystemParametersInfoW
77D0C9C3 E6 FindWindowW
77CFF601 5E CreatePopupMenu
77CFF667 130 GetMenuDefaultItem
77D0D39D 97 DestroyMenu
77CF9252 158 GetShellWindow
77D0B0F0 CB EnumChildWindows
77CF88A6 16F GetWindowLongW
77D0929A 240 SendMessageW
77CFAF34 228 RegisterWindowMessageW
77D09ED9 121 GetKeyState
77D0A042 4A CopyRect
77D0C713 1E7 MonitorFromRect
77D0ABF5 1E6 MonitorFromPoint
77CFA39A 219 RegisterClassW
77D0C0B9 26B SetPropW
77CF945D 16E GetWindowLongA
77D0C2BB 281 SetWindowLongW
77D09C2F E2 FillRect
77D0974E 10B GetCursorPos
77D46534 1E3 MessageBoxW
77CF9E36 1C9 LoadStringW
77CF869D 22A ReleaseDC
77CF86C7 10C GetDC
77D03563 D5 EnumDisplaySettingsExW
77CFE03C D1 EnumDisplayDevicesW
77CF8CCB 200 PostMessageW
77CF8A01 A2 DispatchMessageW
77CF8BF6 2AA TranslateMessage
77CF91C6 13E GetMessageW
77CF929B 1FE PeekMessageW
77D09719 20B PtInRect
77D08FE9 D BeginPaint
77D08FFD C8 EndPaint
77D0960E 287 SetWindowTextW
77D0A78F F2 GetAsyncKeyState
77D08FD5 193 InvalidateRect
77D09655 16A GetWindow
77D0337D 293 ShowWindowAsync
77D4CF62 2A5 TrackPopupMenuEx
77D0AEAB 2BB UpdateWindow
77D0D312 96 DestroyIcon
77D098FE 1A8 IsRectEmpty
77D07822 243 SetActiveWindow
77CF8E78 15A GetSysColor
77D0D7E2 BF DrawTextW
77D49C61 1A5 IsHungAppWindow
77CF8C2E 27A SetTimer
77D2F1C8 133 GetMenuItemID
77D4531E 2A4 TrackPopupMenu
77D3A0A5 C9 EndTask
77D0D6DB 23D SendMessageCallbackW
77D09AE9 FB GetClassLongW
77D0E8BC 1BC LoadIconW
77CFECA3 1F7 OpenInputDesktop
77D0812F 43 CloseDesktop
77D0F750 26F SetScrollPos
77D0AF56 292 ShowWindow
77D103A8 F BringWindowToTop
77D0D1D2 10E GetDesktopWindow
77D45039 1E CascadeWindows
77CF9216 36 CharUpperBuffW
77D3581C 298 SwitchToThisWindow
77D0C5A9 191 InternalGetWindowText
77D0DFE2 155 GetScrollInfo
77D0EF1C 132 GetMenuItemCount
77D0D0A3 61 CreateWindowExW
77D047AB 9F DialogBoxParamW
77CF9689 1EA MsgWaitForMultipleObjects
77D0C8B0 2A CharNextA
77CFAF34 21B RegisterClipboardFormatW
77D0AF8D C5 EndDeferWindowPos
77D0AFDB 90 DeferWindowPos
77D0AFB9 C BeginDeferWindowPos
77D03810 204 PrintWindow
77CFE14B 248 SetClassLongW
77D094B3 14B GetPropW
77D3BF27 142 GetNextDlgGroupItem
77D037C3 143 GetNextDlgTabItem
77D0200B 3D ChildWindowFromPointEx
77CF970E 19E IsChild
77D099CB 1EC NotifyWinEvent
77D0C80D 2A3 TrackMouseEvent
77CF94DA F3 GetCapture
77D0AF79 EF GetAncestor
77CF90D2 37 CharUpperW
77D0C29D 280 SetWindowLongA
77D46D9F AF DrawCaption
77CFF51F 1E5 ModifyMenuW
77CFF60E 190 InsertMenuW
77D0977A 1AC IsWindowEnabled
77CFF967 137 GetMenuState
77CF9D69 1BA LoadCursorW
77D0910F 145 GetParent
77D04DFA 1A3 IsDlgButtonChecked
77D0B19C 99 DestroyWindow
77D0A5AE DE EnumWindows
77D09E3D 1AF IsWindowVisible
77D0908E FF GetClientRect
77D0A0F1 2AF UnionRect
77D09E81 DF EqualRect
77CF8A80 17B GetWindowThreadProcessId
77D09823 117 GetForegroundWindow
77CF8C42 1B2 KillTimer
77CFDEBC F8 GetClassInfoExW
77D08D20 8F DefWindowProcW
77CFAF7F 218 RegisterClassExW
77D0D427 11A GetIconInfo
77CF9056 26E SetScrollInfo
77D1157A 128 GetLastActivePopup
77D042ED 257 SetForegroundWindow
77D09313 1AB IsWindow
77D0B222 15C GetSystemMenu
77D097FF 1A6 IsIconic
77D09C8A 1B0 IsZoomed
77D0D2C4 C2 EnableMenuItem
77CFF5B4 25F SetMenuDefaultItem
77D0A679 1E8 MonitorFromWindow
77D0A6D9 140 GetMonitorInfoW
77D0C49C 16D GetWindowInfo
77D098C8 116 GetFocus
77D0B112 256 SetFocus
77D09507 1D7 MapWindowPoints
77D097A0 231 ScreenToClient
77D09B60 40 ClientToScreen
77D090B4 174 GetWindowRect
77D099F3 283 SetWindowPos
77D0CED3 91 DeleteMenu
77CFF72A 135 GetMenuItemInfoW
77D03281 263 SetMenuItemInfoW
77D0B1B0 2C CharNextW
UxTheme.dll
100193C Import Address Table
1043B24 Import Name Table
FFFFFFFF time date stamp
FFFFFFFF Index of first forwarder reference
5A483E8A B GetThemeBackgroundContentRect
5A48BEA5 E GetThemeBool
5A4841A9 18 GetThemePartSize
5A49AF7D 5 DrawThemeParentBackground
5A4873B8 2D OpenThemeData
5A482BEF 1 DrawThemeBackground
5A482E63 24 GetThemeTextExtent
5A482FF8 6 DrawThemeText
5A484773 0 CloseThemeData
5A48B39E 2F SetWindowTheme
5A487DD3 D GetThemeBackgroundRegion
5A485458 Ordinal 47
5A48B0D2 16 GetThemeMargins
5A48459D F GetThemeColor
5A48BE06 13 GetThemeFont
5A48BF0A 1B GetThemeRect
5A488B4D 28 IsAppThemed
Header contains the following bound import information:
Bound to ADVAPI32.dll [4802C081] Mon Apr 14 11:25:05 2008
Bound to BROWSEUI.dll [4802C073] Mon Apr 14 11:24:51 2008
Bound to GDI32.dll [4802C07D] Mon Apr 14 11:25:01 2008
Bound to KERNEL32.dll [4802C0CE] Mon Apr 14 11:26:22 2008
Contained forwarders bound to NTDLL.DLL [4802C0CE] Mon Apr 14 11:26:22 2008
Bound to msvcrt.dll [4802C064] Mon Apr 14 11:24:36 2008
Bound to NTDLL.DLL [4802C0CE] Mon Apr 14 11:26:22 2008
Bound to ole32.dll [4802C0BD] Mon Apr 14 11:26:05 2008
Bound to OLEAUT32.dll [4802C0BE] Mon Apr 14 11:26:06 2008
Bound to SHDOCVW.dll [4802C0BA] Mon Apr 14 11:26:02 2008
Bound to SHELL32.dll [4802C0BB] Mon Apr 14 11:26:03 2008
Bound to SHLWAPI.dll [4802C0C0] Mon Apr 14 11:26:08 2008
Bound to USER32.dll [4802C0C3] Mon Apr 14 11:26:11 2008
Bound to UxTheme.dll [4802C0C6] Mon Apr 14 11:26:14 2008
Section contains the following delay load imports:
DUMPBIN : error : Internal error during DumpDelayLoadImports
ExceptionCode = C0000005
ExceptionFlags = 00000000
ExceptionAddress = 0040C6D9
NumberParameters = 00000002
ExceptionInformation[ 0] = 00000000
ExceptionInformation[ 1] = FF5021B0
CONTEXT:
Eax = FF0421B1 Esp = 0012F7A0
Ebx = 00389978 Ebp = 00000001
Ecx = 00000001 Esi = FF5021B0
Edx = 00000001 Edi = 0012F82C
Eip = 0040C6D9 EFlags = 00010202
SegCs = 0000001B SegDs = 00000023
SegSs = 00000023 SegEs = 00000023
SegFs = 0000003B SegGs = 00000000
Dr0 = 0012F7A0 Dr3 = 00389978
Dr1 = 00000001 Dr6 = 00000001
Dr2 = 00000000 Dr7 = 00000000
Copyright (C) Microsoft Corp 1992-1998. All rights reserved.
Dump of file explorer.exe
File Type: EXECUTABLE IMAGE
Section contains the following imports:
ADVAPI32.dll
1001000 Import Address Table
10431E8 Import Name Table
FFFFFFFF time date stamp
FFFFFFFF Index of first forwarder reference
77FB60EE 1FD RegSetValueW
77F57BC9 1D9 RegEnumKeyExW
77F6494D 124 GetUserNameW
77F5D8EE 1E1 RegNotifyChangeKeyValue
77F57EDD 1DC RegEnumValueW
77F57AAB 1EE RegQueryValueExA
77F57842 1E4 RegOpenKeyExA
77F5D5D4 1DA RegEnumKeyW
77F56C17 1CA RegCloseKey
77F7BA25 1D0 RegCreateKeyW
77F649AE 1EA RegQueryInfoKeyW
77F56A9F 1E5 RegOpenKeyExW
77F56FEF 1EF RegQueryValueExW
77F5775C 1CF RegCreateKeyExW
77F5D757 1FC RegSetValueExW
77F5EDE1 1D4 RegDeleteValueW
77F5D86A 1F0 RegQueryValueW
BROWSEUI.dll
1001048 Import Address Table
1043230 Import Name Table
FFFFFFFF time date stamp
FFFFFFFF Index of first forwarder reference
75ED76CB Ordinal 118
75EFD7A5 Ordinal 135
75F01C8F Ordinal 107
75F019C7 Ordinal 106
GDI32.dll
100105C Import Address Table
1043244 Import Name Table
FFFFFFFF time date stamp
FFFFFFFF Index of first forwarder reference
77E261C1 1A6 GetStockObject
77E2ACB8 46 CreatePatternBrush
77E2C006 1D6 OffsetViewportOrgEx
77E26B2E 18B GetLayout
77E295D8 21 CombineRgn
77E29E09 32 CreateDIBSection
77E27F9D 1B6 GetTextExtentPoint32W
77E2B6C0 24A StretchBlt
77E2827C 4C CreateRectRgnIndirect
77E27786 4B CreateRectRgn
77E26AD6 162 GetClipRgn
77E26A56 1C8 IntersectClipRect
77E27C01 1C1 GetViewportOrgEx
77E27B4C 240 SetViewportOrgEx
77E27AA0 20D SelectClipRgn
77E2869B 1DE PatBlt
77E28F4C 14D GetBkColor
77E25FE0 2D CreateCompatibleDC
77E2700A 2C CreateCompatibleBitmap
77E27ABB 1D7 OffsetWindowOrgEx
77E26E5F 8C DeleteDC
77E25E29 216 SetBkColor
77E26F79 12 BitBlt
77E28086 DE ExtTextOutW
77E26B0D 1B9 GetTextExtentPointW
77E26AA1 161 GetClipBox
77E283B3 198 GetObjectW
77E25D77 23D SetTextColor
77E25EDB 217 SetBkMode
77E2938F 3D CreateFontIndirectW
77E26BFA 8F DeleteObject
77E27DB9 1BE GetTextMetricsW
77E25B70 20F SelectObject
77E25A69 16C GetDeviceCaps
77E2A8CB 251 TranslateCharsetInfo
77E28597 239 SetStretchBltMode
KERNEL32.dll
10010F0 Import Address Table
10432D8 Import Name Table
FFFFFFFF time date stamp
FFFFFFFF Index of first forwarder reference
7C831DD3 1BA GetSystemDirectoryW
7C8106C7 6C CreateThread
7C82CAFB 57 CreateJobObjectW
7C81CAFA B6 ExitProcess
7C82C8E5 323 SetProcessShutdownParameters
7C8024B7 2B3 ReleaseMutex
7C80E947 5D CreateMutexW
7C82C330 31F SetPriorityClass
7C80DE85 13B GetCurrentProcess
7C801E54 1AF GetStartupInfoW
7C817013 10A GetCommandLineW
7C80AC9F 303 SetErrorMode
7C9310E0 243 LeaveCriticalSection
7C931000 96 EnterCriticalSection
7C80A0CB 2BF ResetEvent
7C801D53 245 LoadLibraryExA
7C810B69 36 CompareFileTime
7C8017E9 1C0 GetSystemTimeAsFileTime
7C80C198 331 SetThreadPriority
7C8097B8 13E GetCurrentThreadId
7C80A823 1D0 GetThreadPriority
7C80997B 13D GetCurrentThread
7C80BFF4 1D9 GetUserDefaultLangID
7C802446 342 Sleep
7C868BAC FB GetBinaryTypeW
7C81FCA9 178 GetModuleHandleExW
7C810BAC 347 SystemTimeToFileTime
7C80A864 16A GetLocalTime
7C8099B0 13C GetCurrentProcessId
7C80F184 151 GetEnvironmentVariableW
7C82BFF0 360 UnregisterWait
7C82C3B6 1F6 GlobalGetAtomNameW
7C80B7DC 159 GetFileAttributesW
7C821249 263 MoveFileW
7C80AA5C 3AC lstrcmpW
7C801AF5 246 LoadLibraryExW
7C80EE67 CC FindClose
7C80EFCA DA FindNextFileW
7C80EF71 D3 FindFirstFileW
7C80BB31 3AE lstrcmpiA
7C80A0A7 304 SetEvent
7C82E442 C AssignProcessToJobObject
7C83378D 140 GetDateFormatW
7C833FEB 1D6 GetTimeFormatW
7C8355D4 E7 FlushInstructionCache
7C80BA7F 3B5 lstrcpynW
7C80ADB9 1C3 GetSystemWindowsDirectoryW
7C93FE10 316 SetLastError
7C80AC51 19C GetProcessHeap
7C93FF0D 20B HeapFree
7C949B80 20F HeapReAlloc
7C9404BD 211 HeapSize
7C9400A4 205 HeapAlloc
7C809FA0 1D8 GetUserDefaultLCID
7C8021D0 2A9 ReadProcessMemory
7C8309D1 277 OpenProcess
7C809832 21B InterlockedCompareExchange
7C801D7B 244 LoadLibraryA
7C80A4B7 294 QueryPerformanceCounter
7C863E6A 35B UnhandledExceptionFilter
7C8449FD 336 SetUnhandledExceptionFilter
7C809B74 371 VirtualFree
7C809AE1 36E VirtualAlloc
7C83290F 2C2 ResumeThread
7C801E1A 34A TerminateProcess
7C81CB23 34B TerminateThread
7C80BFCD 1B6 GetSystemDefaultLCID
7C8115F2 16C GetLocaleInfoW
7C80A739 4C CreateEventW
7C93FE01 168 GetLastError
7C8131D0 26F OpenEventW
7C87EECD 7D DelayLoadFailureHook
7C802530 37E WaitForSingleObject
7C80932E 1D4 GetTickCount
7C8305E6 BA ExpandEnvironmentStringsW
7C80B465 175 GetModuleFileNameW
7C80F9ED 195 GetPrivateProfileStringW
7C80AA26 3AF lstrcmpiW
7C802336 66 CreateProcessW
7C80AC6E F0 FreeLibrary
7C80AE0B 1E9 GetWindowsDirectoryW
7C809A1D 24A LocalAlloc
7C8107F0 52 CreateFileW
7C801629 88 DeviceIoControl
7C8099BF 24E LocalFree
7C80A7AD 1AB GetQueuedCompletionStatus
7C831375 55 CreateIoCompletionPort
7C82CA97 314 SetInformationJobObject
7C809BD7 31 CloseHandle
7C80AEDB 247 LoadLibraryW
7C80E4CD 179 GetModuleHandleW
7C80A6D4 0 ActivateActCtx
7C80A705 73 DeactivateActCtx
7C811185 158 GetFileAttributesExW
7C80AE30 198 GetProcAddress
7C94135A 7F DeleteCriticalSection
7C83089D 4B CreateEventA
7C810F88 209 HeapDestroy
7C809F81 218 InitializeCriticalSection
7C809856 266 MulDiv
7C80B8B9 219 InitializeCriticalSectionAndSpinCount
7C809A99 3B8 lstrlenW
7C80980A 21C InterlockedDecrement
7C8097F6 220 InterlockedIncrement
7C80FDBD 1ED GlobalAlloc
7C80981E 21D InterlockedExchange
7C80B731 176 GetModuleHandleA
7C812B6E 1DE GetVersionExA
7C80FCBF 1F4 GlobalFree
7C8352F1 1A2 GetProcessTimes
7C80BAF4 3B2 lstrcpyW
7C8133E3 172 GetLongPathNameW
7C8211B5 2AE RegisterWaitForSingleObject
msvcrt.dll
10012B8 Import Address Table
10434A0 Import Name Table
FFFFFFFF time date stamp
FFFFFFFF Index of first forwarder reference
4D3EC392 161 _itow
4D3FC21B 2A5 free
4D4172B0 2DF memmove
4D3FC437 2EE realloc
4D405C94 ED _except_handler3
4D3FC407 2D8 malloc
4D41FA30 118 _ftol
4D40FFE7 220 _vsnwprintf
ntdll.dll
10012DC Import Address Table
10434C4 Import Name Table
FFFFFFFF time date stamp
FFFFFFFF Index of first forwarder reference
7C93F60D 2CD RtlNtStatusToDosError
7C93D7E0 EB NtQueryInformationProcess
ole32.dll
10012E8 Import Address Table
10434D0 Import Name Table
FFFFFFFF time date stamp
FFFFFFFF Index of first forwarder reference
769C00AC 1C CoFreeUnusedLibraries
7698F62A 121 RegisterDragDrop
7698E54C 84 CreateBindCtx
769C2B55 123 RevokeDragDrop
7698EF7B 3B CoInitializeEx
7698EE46 68 CoUninitialize
7698F6EA FC OleInitialize
769BA2F3 5B CoRevokeClassObject
769A7E90 4F CoRegisterClassObject
769E6EC6 45 CoMarshalInterThreadInterfaceInStream
7699057E 10 CoCreateInstance
769C31E7 113 OleUninitialize
76A60B6D 97 DoDragDrop
OLEAUT32.dll
1001320 Import Address Table
1043508 Import Name Table
FFFFFFFF time date stamp
FFFFFFFF Index of first forwarder reference
770D4BA2 Ordinal 2
770D48F0 Ordinal 9
SHDOCVW.dll
100132C Import Address Table
1043514 Import Name Table
FFFFFFFF time date stamp
FFFFFFFF Index of first forwarder reference
7E75E4F8 Ordinal 110
7E75DF24 Ordinal 125
7E7FA588 Ordinal 111
SHELL32.dll
100133C Import Address Table
1043524 Import Name Table
FFFFFFFF time date stamp
FFFFFFFF Index of first forwarder reference
7D77C971 Ordinal 182
7D5CF759 Ordinal 162
7D5CED76 B2 SHGetFolderPathW
7D5D8FD4 Ordinal 67
7D5D3FE0 Ordinal 72
7D6AE246 Ordinal 90
7D5EA7D2 Ordinal 181
7D5DFF29 Ordinal 727
7D5DE1B7 2E ExtractIconExW
7D5E8C9C Ordinal 137
7D604410 Ordinal 645
7D6028E5 Ordinal 644
7D5D88D7 Ordinal 2
7D5F2B39 Ordinal 236
7D6ACC4E Ordinal 149
7D5CC7B3 Ordinal 147
7D5ED2F0 Ordinal 188
7D5E1F27 Ordinal 660
7D5ED00C Ordinal 201
7D5E555F Ordinal 245
7D5CC3B0 Ordinal 68
7D5D6F47 Ordinal 723
7D5EA404 Ordinal 200
7D5CF2E3 C3 SHGetSpecialFolderLocation
7D5E2F03 10A ShellExecuteExW
7D5CC059 Ordinal 100
7D5E5ABE Ordinal 85
7D5EE48B Ordinal 653
7D5CF778 C5 SHGetSpecialFolderPathW
7D5CAD60 Ordinal 196
7D5CB115 Ordinal 25
7D5CAD90 Ordinal 152
7D5D3E90 77 SHBindToParent
7D5E872C Ordinal 719
7D5E85B9 Ordinal 732
7D5DCB44 Ordinal 148
7D5CDB70 DA SHParseDisplayName
7D697681 Ordinal 154
7D5D6598 Ordinal 77
7D5DEC99 Ordinal 6
7D69AD46 Ordinal 193
7D6B5E42 Ordinal 747
7D5D3D09 Ordinal 71
7D5CC1B7 Ordinal 17
7D5D142C Ordinal 23
7D68EADC Ordinal 132
7D5EDB5B Ordinal 680
7D5EB0B4 Ordinal 233
7D5CA8EA Ordinal 195
7D5CAAEC Ordinal 155
7D5DE54B Ordinal 89
7D5EB2F2 Ordinal 241
7D68EA01 Ordinal 134
7D68E94F Ordinal 22
7D604909 7E SHChangeNotify
7D5CB768 A7 SHGetDesktopFolder
7D60FD22 73 SHAddToRecentDocs
7D670D3D Ordinal 127
7D5D120F Ordinal 21
7D5CF5E2 Ordinal 102
7D652A57 26 DuplicateIcon
7D73AA2A Ordinal 202
7D73AAC2 Ordinal 82
7D67379F Ordinal 244
7D658C55 Ordinal 54
7D652325 Ordinal 161
7D6AE167 Ordinal 91
7D658C6D Ordinal 254
7D658CA3 Ordinal 60
7D5EBCE0 EF SHUpdateRecycleBinIcon
7D5CF261 AE SHGetFolderLocation
7D614C31 BC SHGetPathFromIDListA
7D675778 Ordinal 711
7D5F2CCA Ordinal 731
7D5D542A Ordinal 4
7D5CA639 Ordinal 733
7D5CE2DF Ordinal 190
7D5D0ECE Ordinal 64
7D620206 Ordinal 61
7D5D1024 BD SHGetPathFromIDListW
7D5EB409 Ordinal 753
7D5CC97C Ordinal 16
7D5CADF5 Ordinal 18
SHLWAPI.dll
100148C Import Address Table
1043674 Import Name Table
FFFFFFFF time date stamp
FFFFFFFF Index of first forwarder reference
77E76753 F0 StrCpyNW
77E76948 Ordinal 215
77E7413F Ordinal 217
77E7880D Ordinal 476
77E76FF0 Ordinal 157
77E76D2F 109 StrRetToBufW
77E82613 10B StrRetToStrW
77E78390 Ordinal 176
77E8A950 Ordinal 154
77E7BF88 Ordinal 439
77E76919 Ordinal 156
77E76F2E AD SHQueryValueExW
77E77DC3 49 PathIsNetworkPathW
77EC7302 Ordinal 513
77E79E69 0 AssocCreate
77E8788F Ordinal 512
77E85C75 Ordinal 171
77E826C0 Ordinal 178
77EC71DF Ordinal 177
77E7C22E Ordinal 193
77E80486 DE StrCatW
77E7682A F1 StrCpyW
77E87205 Ordinal 225
77E803F5 Ordinal 413
77E74076 Ordinal 219
77E799EA Ordinal 175
77E790E9 Ordinal 164
77E85CE3 Ordinal 172
77E74587 A1 SHGetValueW
77E748D4 Ordinal 437
77E76F84 ED StrCmpNIW
77E7B01C 6D PathRemoveBlanksW
77E8420B 69 PathRemoveArgsW
77E77077 31 PathFindFileNameW
77E77E7C 110 StrStrIW
77E841D1 39 PathGetArgsW
77E74E3B Ordinal 563
77E7AF74 119 StrToIntW
77E78F94 BB SHRegGetBoolUSValueW
77E84F7D CD SHRegWriteUSValueW
77E78AD8 AE SHRegCloseUSKey
77E87687 B0 SHRegCreateUSKeyW
77E78CF2 BF SHRegGetUSValueW
77E7975F D2 SHSetValueW
77E87C2C Ordinal 433
77E77ACD 1D PathAppendW
77E7AFBF 85 PathUnquoteSpacesW
77E76DCA Ordinal 460
77E8AEB0 Ordinal 194
77EC1067 65 PathQuoteSpacesW
77EB39FF Ordinal 244
77E87C86 D0 SHSetThreadRef
77E87CC0 90 SHCreateThreadRef
77E7502E Ordinal 241
77E789F0 Ordinal 236
77EC941D Ordinal 279
77E779C9 23 PathCombineW
77E8C464 Ordinal 192
77E776DE Ordinal 204
77E89469 Ordinal 509
77E76C63 D5 SHStrDupW
77E8430C 4B PathIsPrefixW
77E7B09D 63 PathParseIconLocationW
77E7A5AE 4 AssocQueryKeyW
77E873A6 Ordinal 16
77E8A78E 8 AssocQueryStringW
77E77126 EF StrCmpW
77E77C21 Ordinal 174
77E911B0 Ordinal 548
77E894B1 Ordinal 165
77E7779D Ordinal 240
77E85FD5 Ordinal 163
77E8940A Ordinal 479
77E7B53E Ordinal 9
77E8C287 Ordinal 8
77E78E75 C7 SHRegQueryUSValueW
77E78C8A C3 SHRegOpenUSKeyW
77E88A8B CB SHRegSetUSValueW
77E8AE59 43 PathIsDirectoryW
77E77D89 2D PathFileExistsW
77E76BDA 3D PathGetDriveNumberW
77E7B559 Ordinal 10
77E766BD E4 StrChrW
77E76859 2F PathFindExtensionW
77E7959F Ordinal 260
77EC7A8B Ordinal 292
77E77C56 71 PathRemoveFileSpecW
77E783F5 7D PathStripToRootW
77EB2DAE Ordinal 250
77EC6F12 Ordinal 478
77E7C266 Ordinal 184
77E824BA A7 SHOpenRegStream2W
77E7C311 Ordinal 212
77E87D29 Ordinal 213
77E76FA8 Ordinal 158
77E76772 F3 StrDupW
77E8C341 98 SHDeleteValueW
77E76B50 DC StrCatBuffW
77E86F94 94 SHDeleteKeyW
77E76A8E E9 StrCmpIW
77EB26BB Ordinal 467
77E76808 Ordinal 346
77E793E6 137 wnsprintfW
77E8CA99 Ordinal 197
77E8961B Ordinal 278
77E76DE8 EE StrCmpNW
77E8A6A8 Ordinal 237
77E77032 Ordinal 199
USER32.dll
1001640 Import Address Table
1043828 Import Name Table
FFFFFFFF time date stamp
FFFFFFFF Index of first forwarder reference
77D45215 29E TileWindows
77D0D86B 115 GetDoubleClickTime
77CF8F9C 15D GetSystemMetrics
77CF8EAB 15B GetSysColorBrush
77D01E40 5 AllowSetForegroundWindow
77D0EB48 1C6 LoadMenuW
77D0D896 159 GetSubMenu
77CFF716 22B RemoveMenu
77D0C7F9 266 SetParent
77D0996C 13C GetMessagePos
77D04DCA 38 CheckDlgButton
77D09849 C4 EnableWindow
77D3BC8B 112 GetDlgItemInt
77D3BC09 252 SetDlgItemInt
77CFDE72 48 CopyIcon
77D0E7EA 2 AdjustWindowRectEx
77D0F94F B3 DrawFocusRect
77D0FBF6 B2 DrawEdge
77D3A275 E1 ExitWindowsEx
77D09766 2D5 WindowFromPoint
77D08FA6 26C SetRect
77D032BA 9 AppendMenuW
77D0EE76 1B4 LoadAcceleratorsW
77D00242 1B6 LoadBitmapW
77D0D64F 242 SendNotifyMessageW
77CFDE46 282 SetWindowPlacement
77D11ABD 39 CheckMenuItem
77D04A4E C6 EndDialog
77D073CC 237 SendDlgItemMessageW
77D11F7B 1DB MessageBeep
77D0C2E8 EB GetActiveWindow
77D0CA5A 201 PostQuitMessage
77D0B29E 1E9 MoveWindow
77D0436E 111 GetDlgItem
77D0C076 22D RemovePropW
77D09D12 FD GetClassNameW
77D0C595 10D GetDCEx
77D361B3 24F SetCursorPos
77D0201F 3C ChildWindowFromPoint
77D39623 23 ChangeDisplaySettingsW
77CFEBB3 21E RegisterHotKey
77D4CF8A 2B6 UnregisterHotKey
77D09930 24D SetCursor
77D0CDAA 23F SendMessageTimeoutW
77D103C7 173 GetWindowPlacement
77D07B97 1BE LoadImageW
77D0E528 284 SetWindowRgn
77D08F1F 192 IntersectRect
77D09011 1F2 OffsetRect
77D0A77B D2 EnumDisplayMonitors
77D09944 215 RedrawWindow
77D00138 295 SubtractRect
77CF941E 2A8 TranslateAcceleratorW
77CF940C 2D0 WaitMessage
77D098D5 18A InflateRect
77D0A01E 1C CallWindowProcW
77D0AF1B 110 GetDlgCtrlID
77D0C35E 244 SetCapture
77CFDE5A 1CA LockSetForegroundWindow
77CF9F06 29A SystemParametersInfoW
77D0C9C3 E6 FindWindowW
77CFF601 5E CreatePopupMenu
77CFF667 130 GetMenuDefaultItem
77D0D39D 97 DestroyMenu
77CF9252 158 GetShellWindow
77D0B0F0 CB EnumChildWindows
77CF88A6 16F GetWindowLongW
77D0929A 240 SendMessageW
77CFAF34 228 RegisterWindowMessageW
77D09ED9 121 GetKeyState
77D0A042 4A CopyRect
77D0C713 1E7 MonitorFromRect
77D0ABF5 1E6 MonitorFromPoint
77CFA39A 219 RegisterClassW
77D0C0B9 26B SetPropW
77CF945D 16E GetWindowLongA
77D0C2BB 281 SetWindowLongW
77D09C2F E2 FillRect
77D0974E 10B GetCursorPos
77D46534 1E3 MessageBoxW
77CF9E36 1C9 LoadStringW
77CF869D 22A ReleaseDC
77CF86C7 10C GetDC
77D03563 D5 EnumDisplaySettingsExW
77CFE03C D1 EnumDisplayDevicesW
77CF8CCB 200 PostMessageW
77CF8A01 A2 DispatchMessageW
77CF8BF6 2AA TranslateMessage
77CF91C6 13E GetMessageW
77CF929B 1FE PeekMessageW
77D09719 20B PtInRect
77D08FE9 D BeginPaint
77D08FFD C8 EndPaint
77D0960E 287 SetWindowTextW
77D0A78F F2 GetAsyncKeyState
77D08FD5 193 InvalidateRect
77D09655 16A GetWindow
77D0337D 293 ShowWindowAsync
77D4CF62 2A5 TrackPopupMenuEx
77D0AEAB 2BB UpdateWindow
77D0D312 96 DestroyIcon
77D098FE 1A8 IsRectEmpty
77D07822 243 SetActiveWindow
77CF8E78 15A GetSysColor
77D0D7E2 BF DrawTextW
77D49C61 1A5 IsHungAppWindow
77CF8C2E 27A SetTimer
77D2F1C8 133 GetMenuItemID
77D4531E 2A4 TrackPopupMenu
77D3A0A5 C9 EndTask
77D0D6DB 23D SendMessageCallbackW
77D09AE9 FB GetClassLongW
77D0E8BC 1BC LoadIconW
77CFECA3 1F7 OpenInputDesktop
77D0812F 43 CloseDesktop
77D0F750 26F SetScrollPos
77D0AF56 292 ShowWindow
77D103A8 F BringWindowToTop
77D0D1D2 10E GetDesktopWindow
77D45039 1E CascadeWindows
77CF9216 36 CharUpperBuffW
77D3581C 298 SwitchToThisWindow
77D0C5A9 191 InternalGetWindowText
77D0DFE2 155 GetScrollInfo
77D0EF1C 132 GetMenuItemCount
77D0D0A3 61 CreateWindowExW
77D047AB 9F DialogBoxParamW
77CF9689 1EA MsgWaitForMultipleObjects
77D0C8B0 2A CharNextA
77CFAF34 21B RegisterClipboardFormatW
77D0AF8D C5 EndDeferWindowPos
77D0AFDB 90 DeferWindowPos
77D0AFB9 C BeginDeferWindowPos
77D03810 204 PrintWindow
77CFE14B 248 SetClassLongW
77D094B3 14B GetPropW
77D3BF27 142 GetNextDlgGroupItem
77D037C3 143 GetNextDlgTabItem
77D0200B 3D ChildWindowFromPointEx
77CF970E 19E IsChild
77D099CB 1EC NotifyWinEvent
77D0C80D 2A3 TrackMouseEvent
77CF94DA F3 GetCapture
77D0AF79 EF GetAncestor
77CF90D2 37 CharUpperW
77D0C29D 280 SetWindowLongA
77D46D9F AF DrawCaption
77CFF51F 1E5 ModifyMenuW
77CFF60E 190 InsertMenuW
77D0977A 1AC IsWindowEnabled
77CFF967 137 GetMenuState
77CF9D69 1BA LoadCursorW
77D0910F 145 GetParent
77D04DFA 1A3 IsDlgButtonChecked
77D0B19C 99 DestroyWindow
77D0A5AE DE EnumWindows
77D09E3D 1AF IsWindowVisible
77D0908E FF GetClientRect
77D0A0F1 2AF UnionRect
77D09E81 DF EqualRect
77CF8A80 17B GetWindowThreadProcessId
77D09823 117 GetForegroundWindow
77CF8C42 1B2 KillTimer
77CFDEBC F8 GetClassInfoExW
77D08D20 8F DefWindowProcW
77CFAF7F 218 RegisterClassExW
77D0D427 11A GetIconInfo
77CF9056 26E SetScrollInfo
77D1157A 128 GetLastActivePopup
77D042ED 257 SetForegroundWindow
77D09313 1AB IsWindow
77D0B222 15C GetSystemMenu
77D097FF 1A6 IsIconic
77D09C8A 1B0 IsZoomed
77D0D2C4 C2 EnableMenuItem
77CFF5B4 25F SetMenuDefaultItem
77D0A679 1E8 MonitorFromWindow
77D0A6D9 140 GetMonitorInfoW
77D0C49C 16D GetWindowInfo
77D098C8 116 GetFocus
77D0B112 256 SetFocus
77D09507 1D7 MapWindowPoints
77D097A0 231 ScreenToClient
77D09B60 40 ClientToScreen
77D090B4 174 GetWindowRect
77D099F3 283 SetWindowPos
77D0CED3 91 DeleteMenu
77CFF72A 135 GetMenuItemInfoW
77D03281 263 SetMenuItemInfoW
77D0B1B0 2C CharNextW
UxTheme.dll
100193C Import Address Table
1043B24 Import Name Table
FFFFFFFF time date stamp
FFFFFFFF Index of first forwarder reference
5A483E8A B GetThemeBackgroundContentRect
5A48BEA5 E GetThemeBool
5A4841A9 18 GetThemePartSize
5A49AF7D 5 DrawThemeParentBackground
5A4873B8 2D OpenThemeData
5A482BEF 1 DrawThemeBackground
5A482E63 24 GetThemeTextExtent
5A482FF8 6 DrawThemeText
5A484773 0 CloseThemeData
5A48B39E 2F SetWindowTheme
5A487DD3 D GetThemeBackgroundRegion
5A485458 Ordinal 47
5A48B0D2 16 GetThemeMargins
5A48459D F GetThemeColor
5A48BE06 13 GetThemeFont
5A48BF0A 1B GetThemeRect
5A488B4D 28 IsAppThemed
Header contains the following bound import information:
Bound to ADVAPI32.dll [4802C081] Mon Apr 14 11:25:05 2008
Bound to BROWSEUI.dll [4802C073] Mon Apr 14 11:24:51 2008
Bound to GDI32.dll [4802C07D] Mon Apr 14 11:25:01 2008
Bound to KERNEL32.dll [4802C0CE] Mon Apr 14 11:26:22 2008
Contained forwarders bound to NTDLL.DLL [4802C0CE] Mon Apr 14 11:26:22 2008
Bound to msvcrt.dll [4802C064] Mon Apr 14 11:24:36 2008
Bound to NTDLL.DLL [4802C0CE] Mon Apr 14 11:26:22 2008
Bound to ole32.dll [4802C0BD] Mon Apr 14 11:26:05 2008
Bound to OLEAUT32.dll [4802C0BE] Mon Apr 14 11:26:06 2008
Bound to SHDOCVW.dll [4802C0BA] Mon Apr 14 11:26:02 2008
Bound to SHELL32.dll [4802C0BB] Mon Apr 14 11:26:03 2008
Bound to SHLWAPI.dll [4802C0C0] Mon Apr 14 11:26:08 2008
Bound to USER32.dll [4802C0C3] Mon Apr 14 11:26:11 2008
Bound to UxTheme.dll [4802C0C6] Mon Apr 14 11:26:14 2008
Section contains the following delay load imports:
DUMPBIN : error : Internal error during DumpDelayLoadImports
ExceptionCode = C0000005
ExceptionFlags = 00000000
ExceptionAddress = 0040C6D9
NumberParameters = 00000002
ExceptionInformation[ 0] = 00000000
ExceptionInformation[ 1] = FF5021B0
CONTEXT:
Eax = FF0421B1 Esp = 0012F7A0
Ebx = 00389978 Ebp = 00000001
Ecx = 00000001 Esi = FF5021B0
Edx = 00000001 Edi = 0012F82C
Eip = 0040C6D9 EFlags = 00010202
SegCs = 0000001B SegDs = 00000023
SegSs = 00000023 SegEs = 00000023
SegFs = 0000003B SegGs = 00000000
Dr0 = 0012F7A0 Dr3 = 00389978
Dr1 = 00000001 Dr6 = 00000001
Dr2 = 00000000 Dr7 = 00000000
2013년 10월 17일 목요일
2013년 10월 13일 일요일
2013년 10월 12일 토요일
2013년 10월 11일 금요일
IMAGE_IMPORT_DESCRIPTOR
C:\work>gcc codeob.c -o codeob.exe
codeob.c: In function 'find_kernel32_import':
codeob.c:41:1: warning: passing argument 2 of 'SetFilePointer' makes integer fro
m pointer without a cast [enabled by default]
c:\program files\mingw\mingw\bin\../lib/gcc/mingw32/4.6.2/../../../../include/wi
nbase.h:2087:25: note: expected 'LONG' but argument is of type 'void *'
C:\work>codeob
Examining c:\work\putty.exe
/* Locate Import Directory Table */
DOS magic: 0x5a4d @ [raw:0x0000]
PE header offset: 0xf8 @ [raw:0x003C]
Vjh$?@ [raw:0xffff]
Dissing MZ?@ [raw:0x0]
Dissing MZ?@ [raw:0x0]
Dissing MZ?@ [raw:0x4c01b821]
Dissing MZ?@ [raw:0x6f6e6e61]
Dissing MZ?@ [raw:0x65646f6d]
Dissing MZ?@ [raw:0x18f67e2a]
Dissing MZ?@ [raw:0x1896722f]
Dissing MZ?@ [raw:0x18f67e28]
Dissing MZ?@ [raw:0x18f77e2a]
Dissing MZ?@ [raw:0x18f67e2b]
Dissing MZ?@ [raw:0x0]
Dissing S?끕YYSP @ [raw:0x4014c]
Dissing S?끕YYSP @ [raw:0xa07010b]
Dissing V?@쥘 땸?G @ [raw:0x1000]
Dissing @ [raw:0x4]
Dissing V?@쥘 땸?G @ [raw:0x1000]
Dissing V?@쥘 땸?G @ [raw:0x100000]
Dissing MZ?@ [raw:0x0]
Dissing MZ?@ [raw:0x0]
Past max imports...
/* Locate the FirstThunk member of Kernel32's
IMAGE_IMPORT_DESCRIPTOR structure for a pointer
to the Import Address Table entry */
Kernel32 FirstThunk: [raw:0x1a0] -> [raw:0x0]
Address of imported function: 0x905a4d @ [raw:0x0]
function returned 0x905a4d
C:\work>
codeob.c: In function 'find_kernel32_import':
codeob.c:41:1: warning: passing argument 2 of 'SetFilePointer' makes integer fro
m pointer without a cast [enabled by default]
c:\program files\mingw\mingw\bin\../lib/gcc/mingw32/4.6.2/../../../../include/wi
nbase.h:2087:25: note: expected 'LONG' but argument is of type 'void *'
C:\work>codeob
Examining c:\work\putty.exe
/* Locate Import Directory Table */
DOS magic: 0x5a4d @ [raw:0x0000]
PE header offset: 0xf8 @ [raw:0x003C]
Vjh$?@ [raw:0xffff]
Dissing MZ?@ [raw:0x0]
Dissing MZ?@ [raw:0x0]
Dissing MZ?@ [raw:0x4c01b821]
Dissing MZ?@ [raw:0x6f6e6e61]
Dissing MZ?@ [raw:0x65646f6d]
Dissing MZ?@ [raw:0x18f67e2a]
Dissing MZ?@ [raw:0x1896722f]
Dissing MZ?@ [raw:0x18f67e28]
Dissing MZ?@ [raw:0x18f77e2a]
Dissing MZ?@ [raw:0x18f67e2b]
Dissing MZ?@ [raw:0x0]
Dissing S?끕YYSP @ [raw:0x4014c]
Dissing S?끕YYSP @ [raw:0xa07010b]
Dissing V?@쥘 땸?G @ [raw:0x1000]
Dissing @ [raw:0x4]
Dissing V?@쥘 땸?G @ [raw:0x1000]
Dissing V?@쥘 땸?G @ [raw:0x100000]
Dissing MZ?@ [raw:0x0]
Dissing MZ?@ [raw:0x0]
Past max imports...
/* Locate the FirstThunk member of Kernel32's
IMAGE_IMPORT_DESCRIPTOR structure for a pointer
to the Import Address Table entry */
Kernel32 FirstThunk: [raw:0x1a0] -> [raw:0x0]
Address of imported function: 0x905a4d @ [raw:0x0]
function returned 0x905a4d
C:\work>
2013년 10월 7일 월요일
pe
C:\work>peoep Hack.dll
Valid Dos Exe File
------------------
Dumping DOS Header Info....
---------------------------
Magic number : MZ(Mark Zbikowski)
Bytes on last page of file : 0x90
Pages in file : 0x3
Relocation : 0
Size of header in paragraphs : 0x4
Minimum extra paragraphs needed : 0
Maximum extra paragraphs needed : 0xffff
Initial (relative) SS value : 0
Initial SP value : 0xb8
Checksum : 0
Initial IP value : 0
Initial (relative) CS value : 0
File address of relocation table : 0x40
Overlay number : 0
OEM identifier : 0
OEM information(e_oemid specific) : 0
RVA address of PE header : 0xd0
===============================================================================
Valid PE file
-------------
Dumping COFF/PE Header Info....
--------------------------------
Signature : PE
Machine Architechture : Intel i386,i486,i586
Characteristics : Executable Image ,Dll file ,
Time Stamp : Sun Oct 06 19:14:48 2013
No.sections(size) : 5
No.entries in symbol table : 0
Size of optional header : 224
Dumping PE Optional Header Info....
-----------------------------------
Address of Entry Point : 0x12e0
Base Address of the Image : 0x10000000
SubSystem type : Windows GUI
Given file is a : PE32
Size of code segment(.text) : 163840
Base address of code segment(RVA) : 0x1000
Size of Initialized data : 36864
Base address of data segment(RVA) : 0x1000
Section Alignment : 0x1000
Major Linker Version : 6
Minor Linker Version : 0
Dumping Sections Header Info....
--------------------------------
Section Info (1 of 5)
---------------------
Section Header name : .text
ActualSize of code or data : 0x27590
Virtual Address(RVA) : 0x1000
Size of raw data (rounded to FA) : 0x28000
Pointer to Raw Data : 0x1000
Pointer to Relocations : 0
Pointer to Line numbers : 0
Number of relocations : 0
Number of line numbers : 0
Characteristics : Contains executable code, Readable,
Section Info (2 of 5)
---------------------
Section Header name : .rdata
ActualSize of code or data : 0x1ee2
Virtual Address(RVA) : 0x29000
Size of raw data (rounded to FA) : 0x2000
Pointer to Raw Data : 0x29000
Pointer to Relocations : 0
Pointer to Line numbers : 0
Number of relocations : 0
Number of line numbers : 0
Characteristics : Contains initialized data, Readable,
Section Info (3 of 5)
---------------------
Section Header name : .data
ActualSize of code or data : 0x3f64
Virtual Address(RVA) : 0x2b000
Size of raw data (rounded to FA) : 0x3000
Pointer to Raw Data : 0x2b000
Pointer to Relocations : 0
Pointer to Line numbers : 0
Number of relocations : 0
Number of line numbers : 0
Characteristics : Contains initialized data, Readable, Writabl
e,
Section Info (4 of 5)
---------------------
Section Header name : .idata
ActualSize of code or data : 0x9ce
Virtual Address(RVA) : 0x2f000
Size of raw data (rounded to FA) : 0x1000
Pointer to Raw Data : 0x2e000
Pointer to Relocations : 0
Pointer to Line numbers : 0
Number of relocations : 0
Number of line numbers : 0
Characteristics : Contains initialized data, Readable, Writabl
e,
Section Info (5 of 5)
---------------------
Section Header name : .reloc
ActualSize of code or data : 0x15cc
Virtual Address(RVA) : 0x30000
Size of raw data (rounded to FA) : 0x2000
Pointer to Raw Data : 0x2f000
Pointer to Relocations : 0
Pointer to Line numbers : 0
Number of relocations : 0
Number of line numbers : 0
Characteristics : Contains initialized data, Readable,
===============================================================================
This Program is written by
K.Vineel Kumar Reddy.
III/IV IT Gayathri Vidya Parishad college of Eng.
C:\work>
Valid Dos Exe File
------------------
Dumping DOS Header Info....
---------------------------
Magic number : MZ(Mark Zbikowski)
Bytes on last page of file : 0x90
Pages in file : 0x3
Relocation : 0
Size of header in paragraphs : 0x4
Minimum extra paragraphs needed : 0
Maximum extra paragraphs needed : 0xffff
Initial (relative) SS value : 0
Initial SP value : 0xb8
Checksum : 0
Initial IP value : 0
Initial (relative) CS value : 0
File address of relocation table : 0x40
Overlay number : 0
OEM identifier : 0
OEM information(e_oemid specific) : 0
RVA address of PE header : 0xd0
===============================================================================
Valid PE file
-------------
Dumping COFF/PE Header Info....
--------------------------------
Signature : PE
Machine Architechture : Intel i386,i486,i586
Characteristics : Executable Image ,Dll file ,
Time Stamp : Sun Oct 06 19:14:48 2013
No.sections(size) : 5
No.entries in symbol table : 0
Size of optional header : 224
Dumping PE Optional Header Info....
-----------------------------------
Address of Entry Point : 0x12e0
Base Address of the Image : 0x10000000
SubSystem type : Windows GUI
Given file is a : PE32
Size of code segment(.text) : 163840
Base address of code segment(RVA) : 0x1000
Size of Initialized data : 36864
Base address of data segment(RVA) : 0x1000
Section Alignment : 0x1000
Major Linker Version : 6
Minor Linker Version : 0
Dumping Sections Header Info....
--------------------------------
Section Info (1 of 5)
---------------------
Section Header name : .text
ActualSize of code or data : 0x27590
Virtual Address(RVA) : 0x1000
Size of raw data (rounded to FA) : 0x28000
Pointer to Raw Data : 0x1000
Pointer to Relocations : 0
Pointer to Line numbers : 0
Number of relocations : 0
Number of line numbers : 0
Characteristics : Contains executable code, Readable,
Section Info (2 of 5)
---------------------
Section Header name : .rdata
ActualSize of code or data : 0x1ee2
Virtual Address(RVA) : 0x29000
Size of raw data (rounded to FA) : 0x2000
Pointer to Raw Data : 0x29000
Pointer to Relocations : 0
Pointer to Line numbers : 0
Number of relocations : 0
Number of line numbers : 0
Characteristics : Contains initialized data, Readable,
Section Info (3 of 5)
---------------------
Section Header name : .data
ActualSize of code or data : 0x3f64
Virtual Address(RVA) : 0x2b000
Size of raw data (rounded to FA) : 0x3000
Pointer to Raw Data : 0x2b000
Pointer to Relocations : 0
Pointer to Line numbers : 0
Number of relocations : 0
Number of line numbers : 0
Characteristics : Contains initialized data, Readable, Writabl
e,
Section Info (4 of 5)
---------------------
Section Header name : .idata
ActualSize of code or data : 0x9ce
Virtual Address(RVA) : 0x2f000
Size of raw data (rounded to FA) : 0x1000
Pointer to Raw Data : 0x2e000
Pointer to Relocations : 0
Pointer to Line numbers : 0
Number of relocations : 0
Number of line numbers : 0
Characteristics : Contains initialized data, Readable, Writabl
e,
Section Info (5 of 5)
---------------------
Section Header name : .reloc
ActualSize of code or data : 0x15cc
Virtual Address(RVA) : 0x30000
Size of raw data (rounded to FA) : 0x2000
Pointer to Raw Data : 0x2f000
Pointer to Relocations : 0
Pointer to Line numbers : 0
Number of relocations : 0
Number of line numbers : 0
Characteristics : Contains initialized data, Readable,
===============================================================================
This Program is written by
K.Vineel Kumar Reddy.
III/IV IT Gayathri Vidya Parishad college of Eng.
C:\work>
2013년 10월 6일 일요일
gdb intel syntax
C:\work>gdb -q memcpy
Reading symbols from C:\work\memcpy.exe...done.
(gdb) set dis intel
Ambiguous set command "dis intel": disable-randomization, disassemble-next-line,
disassembly-flavor, disconnected-tracing...
(gdb) list
1 #include <stdio.h>
2 #include <stdlib.h>
3 #include <string.h>
4 int main()
5 {
6 char* str1="this is sample string";
7 char* str2;
8
9 str2=(char*)malloc(strlen(str1));
10 memcpy(str2, str1, strlen(str1)+1);(gdb) set disassembly-flavor intel
(gdb) disass main
Dump of assembler code for function main:
0x0040138c <+0>: push ebp
0x0040138d <+1>: mov ebp,esp
0x0040138f <+3>: push edi
0x00401390 <+4>: push esi
0x00401391 <+5>: push ebx
0x00401392 <+6>: and esp,0xfffffff0
0x00401395 <+9>: sub esp,0x30
0x00401398 <+12>: call 0x401944 <__main>
0x0040139d <+17>: mov DWORD PTR [esp+0x2c],0x403064
0x004013a5 <+25>: mov eax,DWORD PTR [esp+0x2c]
0x004013a9 <+29>: mov DWORD PTR [esp+0x1c],0xffffffff
0x004013b1 <+37>: mov edx,eax
0x004013b3 <+39>: mov al,0x0
0x004013b5 <+41>: mov ecx,DWORD PTR [esp+0x1c]
0x004013b9 <+45>: mov edi,edx
0x004013bb <+47>: repnz scas al,BYTE PTR es:[edi]
0x004013bd <+49>: mov eax,ecx
0x004013bf <+51>: not eax
0x004013c1 <+53>: dec eax
0x004013c2 <+54>: mov DWORD PTR [esp],eax
0x004013c5 <+57>: call 0x401b7c <malloc>
0x004013ca <+62>: mov DWORD PTR [esp+0x28],eax
0x004013ce <+66>: mov eax,DWORD PTR [esp+0x2c]
0x004013d2 <+70>: mov DWORD PTR [esp+0x1c],0xffffffff
0x004013da <+78>: mov edx,eax
0x004013dc <+80>: mov al,0x0
0x004013de <+82>: mov ecx,DWORD PTR [esp+0x1c]
0x004013e2 <+86>: mov edi,edx
0x004013e4 <+88>: repnz scas al,BYTE PTR es:[edi]
0x004013e6 <+90>: mov eax,ecx
0x004013e8 <+92>: not eax
0x004013ea <+94>: dec eax
0x004013eb <+95>: inc eax
0x004013ec <+96>: mov edx,DWORD PTR [esp+0x28]
0x004013f0 <+100>: mov ecx,DWORD PTR [esp+0x2c]
0x004013f4 <+104>: mov ebx,ecx
0x004013f6 <+106>: mov edi,edx
0x004013f8 <+108>: mov esi,ebx
0x004013fa <+110>: mov ecx,eax
0x004013fc <+112>: rep movs BYTE PTR es:[edi],BYTE PTR ds:[esi]
0x004013fe <+114>: mov eax,DWORD PTR [esp+0x28]
0x00401402 <+118>: mov DWORD PTR [esp+0x8],eax
0x00401406 <+122>: mov eax,DWORD PTR [esp+0x2c]
0x0040140a <+126>: mov DWORD PTR [esp+0x4],eax
0x0040140e <+130>: mov DWORD PTR [esp],0x40307a
0x00401415 <+137>: call 0x401b84 <printf>
0x0040141a <+142>: mov eax,0x0
0x0040141f <+147>: lea esp,[ebp-0xc]
0x00401422 <+150>: pop ebx
0x00401423 <+151>: pop esi
0x00401424 <+152>: pop edi
0x00401425 <+153>: pop ebp
0x00401426 <+154>: ret
End of assembler dump.
(gdb)
Reading symbols from C:\work\memcpy.exe...done.
(gdb) set dis intel
Ambiguous set command "dis intel": disable-randomization, disassemble-next-line,
disassembly-flavor, disconnected-tracing...
(gdb) list
1 #include <stdio.h>
2 #include <stdlib.h>
3 #include <string.h>
4 int main()
5 {
6 char* str1="this is sample string";
7 char* str2;
8
9 str2=(char*)malloc(strlen(str1));
10 memcpy(str2, str1, strlen(str1)+1);(gdb) set disassembly-flavor intel
(gdb) disass main
Dump of assembler code for function main:
0x0040138c <+0>: push ebp
0x0040138d <+1>: mov ebp,esp
0x0040138f <+3>: push edi
0x00401390 <+4>: push esi
0x00401391 <+5>: push ebx
0x00401392 <+6>: and esp,0xfffffff0
0x00401395 <+9>: sub esp,0x30
0x00401398 <+12>: call 0x401944 <__main>
0x0040139d <+17>: mov DWORD PTR [esp+0x2c],0x403064
0x004013a5 <+25>: mov eax,DWORD PTR [esp+0x2c]
0x004013a9 <+29>: mov DWORD PTR [esp+0x1c],0xffffffff
0x004013b1 <+37>: mov edx,eax
0x004013b3 <+39>: mov al,0x0
0x004013b5 <+41>: mov ecx,DWORD PTR [esp+0x1c]
0x004013b9 <+45>: mov edi,edx
0x004013bb <+47>: repnz scas al,BYTE PTR es:[edi]
0x004013bd <+49>: mov eax,ecx
0x004013bf <+51>: not eax
0x004013c1 <+53>: dec eax
0x004013c2 <+54>: mov DWORD PTR [esp],eax
0x004013c5 <+57>: call 0x401b7c <malloc>
0x004013ca <+62>: mov DWORD PTR [esp+0x28],eax
0x004013ce <+66>: mov eax,DWORD PTR [esp+0x2c]
0x004013d2 <+70>: mov DWORD PTR [esp+0x1c],0xffffffff
0x004013da <+78>: mov edx,eax
0x004013dc <+80>: mov al,0x0
0x004013de <+82>: mov ecx,DWORD PTR [esp+0x1c]
0x004013e2 <+86>: mov edi,edx
0x004013e4 <+88>: repnz scas al,BYTE PTR es:[edi]
0x004013e6 <+90>: mov eax,ecx
0x004013e8 <+92>: not eax
0x004013ea <+94>: dec eax
0x004013eb <+95>: inc eax
0x004013ec <+96>: mov edx,DWORD PTR [esp+0x28]
0x004013f0 <+100>: mov ecx,DWORD PTR [esp+0x2c]
0x004013f4 <+104>: mov ebx,ecx
0x004013f6 <+106>: mov edi,edx
0x004013f8 <+108>: mov esi,ebx
0x004013fa <+110>: mov ecx,eax
0x004013fc <+112>: rep movs BYTE PTR es:[edi],BYTE PTR ds:[esi]
0x004013fe <+114>: mov eax,DWORD PTR [esp+0x28]
0x00401402 <+118>: mov DWORD PTR [esp+0x8],eax
0x00401406 <+122>: mov eax,DWORD PTR [esp+0x2c]
0x0040140a <+126>: mov DWORD PTR [esp+0x4],eax
0x0040140e <+130>: mov DWORD PTR [esp],0x40307a
0x00401415 <+137>: call 0x401b84 <printf>
0x0040141a <+142>: mov eax,0x0
0x0040141f <+147>: lea esp,[ebp-0xc]
0x00401422 <+150>: pop ebx
0x00401423 <+151>: pop esi
0x00401424 <+152>: pop edi
0x00401425 <+153>: pop ebp
0x00401426 <+154>: ret
End of assembler dump.
(gdb)
피드 구독하기:
글 (Atom)