============================================================================================================================================== OFFSET 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 10 11 12 13 14 15 16 17 18 19 1A 1B 1C 1D 1E 1F ---------------------------------------------------------------------------------------------------------------------------------------------- 00000000 00 00 00 00 00 00 00 00 5B 17 DB 77 2B 18 DB 77 4A 22 DB 77 F8 13 DB 77 80 E1 DC 77 08 22 DB 77 ........[↨█w+↑█wJ"█w°‼█wÇß▄w◘"█w 00000020 4A 17 DB 77 DE 15 DB 77 3C E4 DC 77 00 00 00 00 35 DF F2 77 C3 43 F3 77 17 3C F3 77 52 CA F3 77 J↨█w▐§█w<Σ▄w....5▀≥w├C≤w↨<≤wR╩≤w 00000040 AC 3F F3 77 00 00 00 00 F2 B6 FF 76 8F 97 FF 76 BD 97 FF 76 00 00 00 00 9A 27 84 76 00 00 00 00 ¼?≤w....≥╢ vÅù v╜ù v....Ü'äv.... 00000060 F0 8C F8 77 AC 91 F8 77 A0 FC F9 77 74 93 F8 77 80 6B F9 77 F2 83 F9 77 A8 89 F8 77 48 89 F8 77 ≡î°w¼æ°wáⁿ∙wtô°wÇk∙w≥â∙w¿ë°wHë°w 00000080 10 92 F8 77 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 C2 A1 61 30 00 00 00 00 04 00 00 00 ►Æ°w................┬ía0....♦... 000000A0 10 01 00 00 00 00 00 00 00 1A 00 00 00 00 00 00 C2 A1 61 30 00 00 00 00 03 00 00 00 20 00 00 00 ►☺.......→......┬ía0....♥... ... 000000C0 00 00 00 00 10 1B 00 00 00 00 00 00 C2 A1 61 30 00 00 00 00 03 00 00 00 20 00 00 00 00 00 00 00 ....►←......┬ía0....♥... ....... 000000E0 60 32 00 00 00 00 00 00 C2 A1 61 30 00 00 00 00 06 00 00 00 00 00 00 00 00 00 00 00 80 32 00 00 `2......┬ía0....♠...........Ç2.. 00000100 00 00 00 00 C2 A1 61 30 00 00 00 00 02 00 00 00 8C 1C 00 00 00 00 00 00 10 3A E7 FF 00 00 00 00 ....┬ía0....☻...î∟......►:τ .... 00000120 FF FF FF FF 4F 13 57 01 66 13 57 01 E4 21 00 00 FF FF FF FF FF FF FF FF 50 22 00 00 48 20 00 00 O‼W☺f‼W☺Σ!.. P"..H .. 00000140 F4 21 00 00 FF FF FF FF FF FF FF FF 6E 22 00 00 58 20 00 00 FC 21 00 00 FF FF FF FF FF FF FF FF ⌠!.. n"..X ..ⁿ!.. 00000160 2E 23 00 00 60 20 00 00 A4 21 00 00 FF FF FF FF FF FF FF FF 90 23 00 00 08 20 00 00 CC 21 00 00 .#..` ..ñ!.. É#..◘ ..╠!.. 00000180 FF FF FF FF FF FF FF FF 1E 24 00 00 30 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ▲$..0 .................. 000001A0 00 00 00 00 38 23 00 00 56 23 00 00 AE 23 00 00 62 23 00 00 72 23 00 00 9C 23 00 00 4E 23 00 00 ....8#..V#..«#..b#..r#..£#..N#.. 000001C0 40 23 00 00 82 23 00 00 00 00 00 00 0E 24 00 00 CE 23 00 00 E0 23 00 00 F0 23 00 00 C0 23 00 00 @#..é#......♫$..╬#..α#..≡#..└#.. 000001E0 00 00 00 00 42 22 00 00 34 22 00 00 24 22 00 00 00 00 00 00 5C 22 00 00 00 00 00 00 F8 22 00 00 ....B"..4"..$"......\"......°".. 00000200 EA 22 00 00 16 23 00 00 B2 22 00 00 96 22 00 00 7A 22 00 00 06 23 00 00 E0 22 00 00 C6 22 00 00 Ω"..▬#..▓"..û"..z"..♠#..α"..╞".. 00000220 00 00 00 00 1D 00 4C 73 61 70 41 75 4F 70 65 6E 53 61 6D 00 3F 00 53 65 72 76 69 63 65 49 6E 69 ....↔.LsapAuOpenSam.?.ServiceIni 00000240 74 00 1E 00 4C 73 61 70 49 6E 69 74 4C 73 61 00 4C 53 41 53 52 56 2E 64 6C 6C 00 00 12 00 53 61 t.▲.LsapInitLsa.LSASRV.dll..↕.Sa 00000260 6D 49 49 6E 69 74 69 61 6C 69 7A 65 00 00 53 41 4D 53 52 56 2E 64 6C 6C 00 00 9C 01 52 74 6C 49 mIInitialize..SAMSRV.dll..£☺RtlI 00000280 6E 74 65 67 65 72 54 6F 55 6E 69 63 6F 64 65 53 74 72 69 6E 67 00 10 01 52 74 6C 41 70 70 65 6E ntegerToUnicodeString.►☺RtlAppen 000002A0 64 55 6E 69 63 6F 64 65 54 6F 53 74 72 69 6E 67 00 00 E6 00 4E 74 54 65 72 6D 69 6E 61 74 65 54 dUnicodeToString..µ.NtTerminateT 000002C0 68 72 65 61 64 00 CE 00 4E 74 53 65 74 49 6E 66 6F 72 6D 61 74 69 6F 6E 50 72 6F 63 65 73 73 00 hread.╬.NtSetInformationProcess. 000002E0 40 00 4E 74 43 6C 6F 73 65 00 C7 00 4E 74 53 65 74 45 76 65 6E 74 00 00 7C 00 4E 74 4F 70 65 6E @.NtClose.╟.NtSetEvent..|.NtOpen 00000300 45 76 65 6E 74 00 46 00 4E 74 43 72 65 61 74 65 45 76 65 6E 74 00 92 01 52 74 6C 49 6E 69 74 55 Event.F.NtCreateEvent.Æ☺RtlInitU 00000320 6E 69 63 6F 64 65 53 74 72 69 6E 67 00 00 6E 74 64 6C 6C 2E 64 6C 6C 00 56 00 5F 65 78 69 74 00 nicodeString..ntdll.dll.V._exit. 00000340 14 00 5F 58 63 70 74 46 69 6C 74 65 72 00 66 01 65 78 69 74 00 00 86 00 5F 69 6E 69 74 74 65 72 ¶._XcptFilter.f☺exit..å._initter 00000360 6D 00 15 00 5F 5F 47 65 74 4D 61 69 6E 41 72 67 73 00 3A 00 5F 63 6F 6D 6D 6F 64 65 5F 64 6C 6C m.§.__GetMainArgs.:._commode_dll 00000380 00 00 67 00 5F 66 6D 6F 64 65 5F 64 6C 6C 00 00 43 52 54 44 4C 4C 2E 64 6C 6C 00 00 80 00 5F 67 ..g._fmode_dll..CRTDLL.dll..Ç._g 000003A0 6C 6F 62 61 6C 5F 75 6E 77 69 6E 64 32 00 AC 00 5F 6C 6F 63 61 6C 5F 75 6E 77 69 6E 64 32 00 00 lobal_unwind2.¼._local_unwind2.. 000003C0 8D 00 46 72 65 65 4C 69 62 72 61 72 79 00 03 01 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 ì.FreeLibrary.♥☺GetProcAddress.. 000003E0 78 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 11 02 53 65 74 55 6E 68 61 6E 64 6C 65 64 45 78 x☺LoadLibraryA..◄☻SetUnhandledEx 00000400 63 65 70 74 69 6F 6E 46 69 6C 74 65 72 00 F2 01 53 65 74 45 72 72 6F 72 4D 6F 64 65 00 00 4B 45 ceptionFilter.≥☺SetErrorMode..KE 00000420 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 RNEL32.dll...................... 00000440 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................................ 00000460 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................................ 00000480 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................................ 000004A0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................................ 000004C0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................................ 000004E0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................................ 00000500 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................................ 00000520 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................................ 00000540 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................................ 00000560 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................................ 00000580 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................................ 000005A0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................................ 000005C0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................................ 000005E0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................................