==============================================================================================================================================
OFFSET    00 01 02 03 04 05 06 07  08 09 0A 0B 0C 0D 0E 0F  10 11 12 13 14 15 16 17  18 19 1A 1B 1C 1D 1E 1F
----------------------------------------------------------------------------------------------------------------------------------------------
00000000  E0 73 F2 77 9B 2E F3 77  C3 5F F3 77 00 00 00 00  0A D1 E6 77 74 3B E6 77  71 4C E6 77 51 43 E6 77  αs≥w¢.≤w├_≤w....◙╤µwt;µwqLµwQCµw
00000020  00 00 00 00 B0 44 FA 77  3C 94 F8 77 5E 6C F8 77  6E 6C F8 77 54 69 F8 77  48 89 F8 77 10 8D F8 77  ....░D·w<ö°w^l°wnl°wTi°wHë°w►ì°w
00000040  E0 91 F8 77 30 90 F8 77  34 5D F8 77 E4 8B F8 77  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  αæ°w0É°w4]°wΣï°w................
00000060  00 00 00 00 EA CC 61 30  00 00 00 00 04 00 00 00  10 01 00 00 00 00 00 00  00 16 00 00 00 00 00 00  ....Ω╠a0....♦...►☺.......▬......
00000080  EA CC 61 30 00 00 00 00  03 00 00 00 80 00 00 00  00 00 00 00 10 17 00 00  00 00 00 00 EA CC 61 30  Ω╠a0....♥...Ç.......►↨......Ω╠a0
000000A0  00 00 00 00 03 00 00 00  80 00 00 00 00 00 00 00  DC 1F 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ....♥...Ç.......▄▼..............
000000C0  4E 54 20 52 65 6D 6F 74  65 20 50 72 6F 63 65 64  75 72 65 20 43 61 6C 6C  20 4E 61 6D 65 64 20 50  NT Remote Procedure Call Named P
000000E0  69 70 65 20 43 6C 69 65  6E 74 20 54 72 61 6E 73  70 6F 72 74 00 00 68 E8  03 00 00 FF 74 24 08 FF  ipe Client Transport..hΦ♥.. t$◘ 
00000100  15 08 10 E5 77 C2 04 00  55 8B EC 83 EC 50 53 8B  45 14 56 33 DB 66 39 18  57 C7 45 EC 10 00 00 00  §◘►σw┬♦.Uï∞â∞PSïE¶V3█f9↑W╟E∞►...
00000120  88 5D FF 74 1D 8D 4D C8  51 50 E8 55 06 00 00 85  C0 0F 85 C7 01 00 00 C7  45 C8 0C 00 00 00 C6 45  ê] t↔ìM╚QPΦU♠..à└☼à╟☺..╟E╚♀...╞E
00000140  FF 01 8B 75 0C 66 83 3E  5C 75 2C 66 83 7E 02 5C  75 1B 83 C6 04 66 8B 06  66 85 C0 74 06 66 3D 5C   ☺ïu♀fâ>\u,fâ~☻\u←â╞♦fï♠fà└t♠f=\
00000160  00 75 14 B8 AB 06 00 00  E9 91 01 00 00 B8 AB 06  00 00 E9 87 01 00 00 FF  15 2C 10 E5 77 83 3D 24  .u¶╕½♠..Θæ☺..╕½♠..Θç☺.. §,►σwâ=$
00000180  20 E5 77 00 75 1D 8D 45  EC 50 68 00 20 E5 77 FF  15 00 10 E5 77 3C 01 75  0A C7 05 24 20 E5 77 01   σw.u↔ìE∞Ph. σw §.►σw<☺u◙╟♣$ σw☺
000001A0  00 00 00 FF 15 30 10 E5  77 66 83 3E 00 74 1B 83  3D 24 20 E5 77 01 75 17  68 00 20 E5 77 56 E8 AF  ... §0►σwfâ>.t←â=$ σw☺u↨h. σwVΦ»
000001C0  05 00 00 83 C4 08 85 C0  75 05 BB 01 00 00 00 85  DB 74 05 BE 28 20 E5 77  56 8B 3D 04 10 E5 77 FF  ♣..â─◘à└u♣╗☺...à█t♣╛( σwVï=♦►σw 
000001E0  D7 FF 75 10 89 45 F4 FF  D7 8B C8 89 45 F0 8B 45  F4 8D 44 08 03 03 C0 50  E8 81 05 00 00 8B D8 85  ╫ u►ëE⌠ ╫ï╚ëE≡ïE⌠ìD◘♥♥└PΦü♣..ï╪à
00000200  DB 75 0A B8 0E 00 00 00  E9 F1 00 00 00 66 C7 03  5C 00 8B 45 F4 03 C0 8D  7B 04 66 C7 43 02 5C 00  █u◙╕♫...Θ±...f╟♥\.ïE⌠♥└ì{♦f╟C☻\.
00000220  8B C8 C1 E9 02 F3 A5 8B  C8 83 E1 03 F3 A4 8B 4D  F0 8B 45 F4 8B 75 10 8D  14 4D 02 00 00 00 8D 7C  ï╚┴Θ☻≤Ñï╚âß♥≤ñïM≡ïE⌠ïu►ì¶M☻...ì|
00000240  43 04 8B CA C1 E9 02 F3  A5 8B CA 6A 00 83 E1 03  6A 00 F3 A4 8D 4D DC 51  53 FF 15 34 10 E5 77 84  C♦ï╩┴Θ☻≤Ñï╩j.âß♥j.≤ñìM▄QS §4►σwä
00000260  C0 75 10 53 E8 0F 05 00  00 B8 AA 06 00 00 E9 8B  00 00 00 33 C9 8D 45 DC  89 4D B4 89 45 B8 89 4D  └u►SΦ☼♣..╕¬♠..Θï...3╔ìE▄ëM┤ëE╕ëM
00000280  C0 89 4D C4 C7 45 B0 18  00 00 00 C7 45 BC 40 00  00 00 38 4D FF 74 06 8D  45 C8 89 45 C4 C7 45 F8  └ëM─╟E░↑...╟E╝@...8M t♠ìE╚ëE─╟E°
000002A0  14 00 00 00 8B 7D 08 6A  20 8D 45 E4 6A 03 8D 4D  B0 50 51 68 00 00 10 C0  57 FF 15 3C 10 E5 77 8B  ¶...ï}◘j ìEΣj♥ìM░PQh..►└W §<►σwï
000002C0  F0 85 F6 7D 42 81 FE AC  00 00 C0 0F 85 B0 00 00  00 53 E8 1F FE FF FF FF  4D F8 75 CB 64 A1 18 00  ≡à÷}Bü■¼..└☼à░...SΦ▼■   M°u╦dí↑.
000002E0  00 00 8B 40 30 FF 75 E0  6A 00 FF 70 18 FF 15 48  10 E5 77 53 E8 7F 04 00  00 B8 BB 06 00 00 5F 5E  ..ï@0 uαj. p↑ §H►σwSΦ⌂♦..╕╗♠.._^
00000300  5B 8B E5 5D C2 1C 00 6A  17 8D 45 D4 6A 08 8D 4D  E4 C7 45 D4 01 00 00 00  C7 45 D8 00 00 00 00 50  [ïσ]┬∟.j↨ìE╘j◘ìMΣ╟E╘☺...╟E╪....P
00000320  51 FF 37 FF 15 40 10 E5  77 8B F0 64 A1 18 00 00  00 8B 40 30 FF 75 E0 6A  00 FF 70 18 FF 15 48 10  Q 7 §@►σwï≡dí↑...ï@0 uαj. p↑ §H►
00000340  E5 77 53 E8 30 04 00 00  85 F6 7D 2E FF 37 FF 15  38 10 E5 77 81 FE 22 00  00 C0 75 07 B8 05 00 00  σwSΦ0♦..à÷}. 7 §8►σwü■"..└u•╕♣..
00000360  00 EB 9B 81 C6 5B FF FF  3F 83 FE 01 1B C0 25 4B  F9 FF FF 05 BA 06 00 00  EB 84 33 C0 E9 7D FF FF  .δ¢ü╞[  ?â■☺←└%K∙  ♣║♠..δä3└Θ}  
00000380  FF 64 A1 18 00 00 00 8B  40 30 FF 75 E0 6A 00 FF  70 18 FF 15 48 10 E5 77  53 E8 DA 03 00 00 81 FE   dí↑...ï@0 uαj. p↑ §H►σwSΦ┌♥..ü■
000003A0  33 00 00 C0 75 0A B8 AA  06 00 00 E9 4E FF FF FF  81 FE 17 00 00 C0 75 0A  B8 0E 00 00 00 E9 3C FF  3..└u◙╕¬♠..ΘN   ü■↨..└u◙╕♫...Θ< 
000003C0  FF FF 81 FE 22 00 00 C0  74 1A 81 FE 6D 00 00 C0  74 12 81 FE A5 00 00 C0  74 0A B8 BA 06 00 00 E9    ü■"..└t→ü■m..└t↕ü■Ñ..└t◙╕║♠..Θ
000003E0  1A FF FF FF B8 05 00 00  00 E9 10 FF FF FF 8B 44  24 04 FF 30 FF 15 38 10  E5 77 33 C0 C2 04 00 83  →   ╕♣...Θ►   ïD$♦ 0 §8►σw3└┬♦.â
00000400  EC 08 8D 54 24 00 56 6A  00 6A 00 FF 74 24 20 FF  74 24 20 52 8B 74 24 24  6A 00 6A 00 6A 00 FF 36  ∞◘ìT$.Vj.j. t$  t$ Rït$$j.j.j. 6
00000420  FF 15 28 10 E5 77 85 C0  B8 00 00 00 00 7D 0B 56  E8 B9 FF FF FF B8 0A 10  02 C0 5E 83 C4 08 C2 0C   §(►σwà└╕....}♂VΦ╣   ╕◙►☻└^â─◘┬♀
00000440  00 83 EC 04 53 56 8B 74  24 14 57 8B 7C 24 1C 55  8B 46 04 89 44 24 10 8B  07 8A 48 04 80 E1 F0 80  .â∞♦SVït$¶Wï|$∟UïF♦ëD$►ï•èH♦Çß≡Ç
00000460  F9 10 74 0C 0F B7 40 08  33 DB 8A DC 8A F8 EB 04  0F B7 58 08 8B 54 24 24  53 8B 6C 24 1C FF 32 57  ∙►t♀☼╖@◘3█è▄è°δ♦☼╖X◘ïT$$Sïl$∟ 2W
00000480  55 E8 04 03 00 00 85 C0  75 47 2B 5C 24 10 6A 00  6A 00 8B 07 03 44 24 18  53 50 56 6A 00 6A 00 6A  UΦ♦♥..à└uG+\$►j.j.ï•♥D$↑SPVj.j.j
000004A0  00 FF 75 00 FF 15 44 10  E5 77 8B 4E 04 8B 54 24  24 03 4C 24 10 89 0A 83  7E 04 00 74 09 85 C0 B8  . u. §D►σwïN♦ïT$$♥L$►ë◙â~♦.t○à└╕
000004C0  00 00 00 00 7D 0B 55 E8  22 FF FF FF B8 09 10 02  C0 5D 5F 5E 5B 83 C4 04  C2 10 00 55 8B EC 83 EC  ....}♂UΦ"   ╕○►☻└]_^[â─♦┬►.Uï∞â∞
000004E0  08 53 56 57 8B 75 10 6A  00 8B 7D 0C 6A 00 8D 45  F8 FF 36 FF 37 50 6A 00  8B 5D 08 6A 00 6A 00 FF  ◘SVWïu►j.ï}♀j.ìE° 6 7Pj.ï]◘j.j. 
00000500  33 FF 15 44 10 E5 77 3D  05 00 00 80 75 0E 56 8D  45 F8 57 50 53 E8 27 FF  FF FF EB 1D 8B 4D FC 89  3 §D►σw=♣..Çu♫VìE°WPSΦ'   δ↔ïMⁿë
00000520  0E 85 C9 74 09 85 C0 B8  00 00 00 00 7D 0B 53 E8  BA FE FF FF B8 09 10 02  C0 5F 5E 5B 8B E5 5D C2  ♫à╔t○à└╕....}♂SΦ║■  ╕○►☻└_^[ïσ]┬
00000540  0C 00 83 EC 08 53 56 8B  74 24 24 57 8B 7C 24 24  55 FF 36 FF 37 FF 74 24  2C FF 74 24 2C 68 17 C0  ♀.â∞◘SVït$$Wï|$$U 6 7 t$, t$,h↨└
00000560  11 00 8D 4C 24 24 8B 5C  24 30 51 8B 2D 4C 10 E5  77 6A 00 6A 00 6A 00 FF  33 FF D5 3D 05 00 00 80  ◄.ìL$$ï\$0Qï-L►σwj.j.j. 3 ╒=♣..Ç
00000580  8B E8 75 0F 8D 44 24 10  56 57 50 53 E8 B0 FE FF  FF EB 32 8B 44 24 14 89  06 85 C0 74 08 85 ED 7C  ïΦu☼ìD$►VWPSΦ░■  δ2ïD$¶ë♠à└t◘àφ|
000005A0  04 33 C0 EB 20 53 E8 43  FE FF FF 81 FD B0 00 00  C0 74 0D B8 09 10 02 C0  81 FD AD 00 00 C0 75 05  ♦3└δ SΦC■  ü²░..└t♪╕○►☻└ü²¡..└u♣
000005C0  B8 0A 10 02 C0 5D 5F 5E  5B 83 C4 08 C2 14 00 8B  44 24 0C 53 66 C7 00 05  00 56 8B 74 24 0C 57 55  ╕◙►☻└]_^[â─◘┬¶.ïD$♀Sf╟.♣.Vït$♀WU
000005E0  85 F6 74 16 80 3E 00 74  11 8B FE B9 FF FF FF FF  2B C0 F2 AE F7 D1 8B D1  EB 05 BA 02 00 00 00 8B  à÷t▬Ç>.t◄ï■╣    +└≥«≈╤ï╤δ♣║☻...ï
00000600  5C 24 18 85 DB 74 16 80  3B 00 74 11 8B FB B9 FF  FF FF FF 2B C0 F2 AE F7  D1 03 D1 EB 03 83 C2 02  \$↑à█t▬Ç;.t◄ï√╣    +└≥«≈╤♥╤δ♥â┬☻
00000620  83 C2 0A 8B 44 24 20 52  89 10 E8 4F 01 00 00 8B  4C 24 24 8B D0 85 D2 89  01 75 0A B8 0E 00 00 00  â┬◙ïD$ Rë►ΦO☺..ïL$$ï╨à╥ë☺u◙╕♫...
00000640  E9 9E 00 00 00 66 C7 02  01 00 85 F6 C6 42 02 0F  74 2F 80 3E 00 74 2A 8D  6A 03 8B FE B9 FF FF FF  Θ₧...f╟☻☺.à÷╞B☻☼t/Ç>.t*ìj♥ï■╣   
00000660  FF 2B C0 F2 AE F7 D1 66  89 4D 00 8D 7A 05 0F B7  C1 8B C8 C1 E9 02 F3 A5  8B C8 83 E1 03 F3 A4 EB   +└≥«≈╤fëM.ìz♣☼╖┴ï╚┴Θ☻≤Ñï╚âß♥≤ñδ
00000680  0D 8D 6A 03 66 C7 45 00  02 00 C6 42 05 00 0F B7  0A 0F B7 45 00 03 C8 83  C1 04 03 D1 85 DB 66 C7  ♪ìj♥f╟E.☻.╞B♣.☼╖◙☼╖E.♥╚â┴♦♥╤à█f╟
000006A0  02 01 00 C6 42 02 01 74  2E 80 3B 00 74 29 8B FB  B9 FF FF FF FF 2B C0 F2  AE 8D 7A 05 8B F3 F7 D1  ☻☺.╞B☻☺t.Ç;.t)ï√╣    +└≥«ìz♣ï≤≈╤
000006C0  0F B7 C1 66 89 4A 03 8B  C8 C1 E9 02 F3 A5 8B C8  83 E1 03 F3 A4 EB 0A 66  C7 42 03 02 00 C6 42 05  ☼╖┴fëJ♥ï╚┴Θ☻≤Ñï╚âß♥≤ñδ◙f╟B♥☻.╞B♣
000006E0  00 33 C0 5D 5F 5E 5B C2  18 00 53 56 57 33 DB 55  8B 6C 24 18 3B EB 74 1F  6A 09 E8 7F 00 00 00 8B  .3└]_^[┬↑.SVW3█Uïl$↑;δt▼j○Φ⌂...ï
00000700  F8 89 45 00 85 FF 75 07  BB 0E 00 00 00 EB 08 BE  68 20 E5 77 A5 A5 A4 8B  7C 24 1C 85 FF 74 42 85  °ëE.à u•╗♫...δ◘╛h σwÑÑñï|$∟à tBà
00000720  DB 75 3E 8B 74 24 14 0F  B7 46 03 50 E8 4D 00 00  00 89 07 8B F8 85 FF 75  13 BB 0E 00 00 00 85 ED  █u>ït$¶☼╖F♥PΦM...ë•ï°à u‼╗♫...àφ
00000740  74 1F FF 75 00 E8 2E 00  00 00 EB 15 0F B7 46 03  83 C6 05 8B C8 C1 E9 02  F3 A5 8B C8 83 E1 03 F3  t▼ u.Φ....δ§☼╖F♥â╞♣ï╚┴Θ☻≤Ñï╚âß♥≤
00000760  A4 8B C3 5D 5F 5E 5B C2  10 00 B8 30 20 E5 77 C2  04 00 FF 25 24 10 E5 77  FF 25 14 10 E5 77 FF 25  ñï├]_^[┬►.╕0 σw┬♦. %$►σw %¶►σw %
00000780  1C 10 E5 77 FF 25 18 10  E5 77 FF 25 10 10 E5 77  04 18 00 00 FF FF FF FF  FF FF FF FF F4 18 00 00  ∟►σw %↑►σw %►►σw♦↑..        ⌠↑..
000007A0  24 10 00 00 F0 17 00 00  FF FF FF FF FF FF FF FF  50 19 00 00 10 10 00 00  E0 17 00 00 FF FF FF FF  $►..≡↨..        P↓..►►..α↨..    
000007C0  FF FF FF FF 8E 19 00 00  00 10 00 00 00 00 00 00  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00      Ä↓...►......................
000007E0  7A 19 00 00 6E 19 00 00  5C 19 00 00 00 00 00 00  30 19 00 00 FE 18 00 00  1A 19 00 00 0A 19 00 00  z↓..n↓..\↓......0↓..■↑..→↓..◙↓..
00000800  00 00 00 00 92 18 00 00  C6 18 00 00 B2 18 00 00  9E 18 00 00 72 18 00 00  42 18 00 00 64 18 00 00  ....Æ↑..╞↑..▓↑..₧↑..r↑..B↑..d↑..
00000820  4C 18 00 00 D4 18 00 00  34 18 00 00 E2 18 00 00  00 00 00 00 75 01 52 74  6C 46 72 65 65 48 65 61  L↑..╘↑..4↑..Γ↑......u☺RtlFreeHea
00000840  70 00 40 00 4E 74 43 6C  6F 73 65 00 CB 00 4E 74  53 65 74 49 6E 66 6F 72  6D 61 74 69 6F 6E 46 69  p.@.NtClose.╦.NtSetInformationFi
00000860  6C 65 00 00 7E 00 4E 74  4F 70 65 6E 46 69 6C 65  00 00 51 01 52 74 6C 44  6F 73 50 61 74 68 4E 61  le..~.NtOpenFile..Q☺RtlDosPathNa
00000880  6D 65 54 6F 4E 74 50 61  74 68 4E 61 6D 65 5F 55  00 00 6E 03 5F 77 63 73  69 63 6D 70 00 00 D5 01  meToNtPathName_U..n♥_wcsicmp..╒☺
000008A0  52 74 6C 52 65 6C 65 61  73 65 50 65 62 4C 6F 63  6B 00 FE 00 52 74 6C 41  63 71 75 69 72 65 50 65  RtlReleasePebLock.■.RtlAcquirePe
000008C0  62 4C 6F 63 6B 00 F4 00  4E 74 57 72 69 74 65 46  69 6C 65 00 B0 00 4E 74  52 65 61 64 46 69 6C 65  bLock.⌠.NtWriteFile.░.NtReadFile
000008E0  00 00 6B 00 4E 74 46 73  43 6F 6E 74 72 6F 6C 46  69 6C 65 00 6E 74 64 6C  6C 2E 64 6C 6C 00 18 00  ..k.NtFsControlFile.ntdll.dll.↑.
00000900  49 5F 52 70 63 46 72 65  65 00 0E 00 49 5F 52 70  63 41 6C 6C 6F 63 61 74  65 00 22 00 49 5F 52 70  I_RpcFree.♫.I_RpcAllocate.".I_Rp
00000920  63 50 61 72 73 65 53 65  63 75 72 69 74 79 00 00  2B 00 49 5F 52 70 63 54  72 61 6E 73 43 6C 69 65  cParseSecurity..+.I_RpcTransClie
00000940  6E 74 52 65 61 6C 6C 6F  63 42 75 66 66 65 72 00  52 50 43 52 54 34 2E 64  6C 6C 00 00 41 02 57 61  ntReallocBuffer.RPCRT4.dll..A☻Wa
00000960  69 74 4E 61 6D 65 64 50  69 70 65 57 00 00 76 02  6C 73 74 72 6C 65 6E 57  00 00 A4 00 47 65 74 43  itNamedPipeW..v☻lstrlenW..ñ.GetC
00000980  6F 6D 70 75 74 65 72 4E  61 6D 65 57 00 00 4B 45  52 4E 45 4C 33 32 2E 64  6C 6C 00 00 00 00 00 00  omputerNameW..KERNEL32.dll......
000009A0  00 00 00 00 FC CB 61 30  00 00 00 00 D2 19 00 00  01 00 00 00 01 00 00 00  01 00 00 00 C8 19 00 00  ....ⁿ╦a0....╥↓..☺...☺...☺...╚↓..
000009C0  CC 19 00 00 D0 19 00 00  6A 17 00 00 DE 19 00 00  00 00 52 50 43 4C 54 43  31 2E 64 6C 6C 00 54 72  ╠↓..╨↓..j↨..▐↓....RPCLTC1.dll.Tr
000009E0  61 6E 73 70 6F 72 74 4C  6F 61 64 00 00 00 00 00  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ansportLoad.....................