---------------------------------------------------------------------------------------------------------------------------------- Module info : ---------------------------------------------------------------------------------------------------------------------------------- Base | Top | Size | Rebase | SafeSEH | ASLR | NXCompat | OS Dll | Version, Modulename & Path ---------------------------------------------------------------------------------------------------------------------------------- 0x10000000 | 0x10039000 | 0x00039000 | False | True | False | False | False | 0.0.0.1 [WinCRT.dll] (C:\Program Files (x86)\Samsung\Movie Color Enhancer\WinCRT.dll) ---------------------------------------------------------------------------------------------------------------------------------- Suggestions ----------- [move ecx -> ebp] 0x10009d30 (RVA : 0x00009d30) : # PUSH ECX # DEC EAX # POP EBP # RETN 0x08 ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x10009d62 (RVA : 0x00009d62) : # PUSH ECX # DEC ESP # POP EBP # RETN 0x08 ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x10009ea9 (RVA : 0x00009ea9) : # PUSH ECX # PUSHAD # POP EBP # RETN 0x10 ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x100079ab (RVA : 0x000079ab) : # PUSH ECX # PUSHAD # POP EBP # RETN 0x0C ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x100078f0 (RVA : 0x000078f0) : # PUSH ECX # DEC ESP # POP EBP # RETN 0x04 ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x100078db (RVA : 0x000078db) : # PUSH ECX # DEC EAX # POP EBP # RETN 0x04 ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} [inc edi] 0x10017816 (RVA : 0x00017816) : # INC EDI # ADD AL,3B # RETN ** [WinCRT.dll] ** | ascii {PAGE_EXECUTE_READ} [move esi -> eax] 0x1000a002 (RVA : 0x0000a002) : # MOV EAX,ESI # POP ESI # POP EBP # RETN 0x04 ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x10003703 (RVA : 0x00003703) : # MOV EAX,ESI # POP ESI # POP EBP # RETN 0x04 ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x1000a585 (RVA : 0x0000a585) : # MOV EAX,ESI # POP ESI # POP EBP # RETN 0x04 ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x100049c1 (RVA : 0x000049c1) : # MOV EAX,ESI # POP ESI # POP EBP # RETN 0x04 ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x100036ec (RVA : 0x000036ec) : # MOV EAX,ESI # POP ESI # POP EBP # RETN 0x04 ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x1000128a (RVA : 0x0000128a) : # MOV EAX,ESI # POP ESI # POP EBP # RETN ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x1001390b (RVA : 0x0001390b) : # MOV EAX,ESI # POP ESI # POP EBP # RETN 0x04 ** [WinCRT.dll] ** | ascii {PAGE_EXECUTE_READ} 0x10004d8c (RVA : 0x00004d8c) : # MOV EAX,ESI # POP ESI # RETN ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x1000698d (RVA : 0x0000698d) : # MOV EAX,ESI # POP ESI # POP EBP # RETN 0x04 ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x1001448e (RVA : 0x0001448e) : # MOV EAX,ESI # POP ESI # POP EBP # RETN 0x04 ** [WinCRT.dll] ** | {PAGE_EXECUTE_READ} 0x10007e8f (RVA : 0x00007e8f) : # MOV EAX,ESI # POP ESI # RETN ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x10004911 (RVA : 0x00004911) : # MOV EAX,ESI # POP ESI # RETN ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x10002012 (RVA : 0x00002012) : # MOV EAX,ESI # POP ESI # RETN ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x1001e114 (RVA : 0x0001e114) : # MOV EAX,ESI # POP ESI # RETN ** [WinCRT.dll] ** | {PAGE_EXECUTE_READ} 0x10011c15 (RVA : 0x00011c15) : # MOV EAX,ESI # POP ESI # RETN ** [WinCRT.dll] ** | ascii {PAGE_EXECUTE_READ} 0x1000de96 (RVA : 0x0000de96) : # MOV EAX,ESI # POP ESI # POP EBP # RETN 0x04 ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x100138d9 (RVA : 0x000138d9) : # MOV EAX,ESI # POP ESI # POP EBP # RETN 0x04 ** [WinCRT.dll] ** | {PAGE_EXECUTE_READ} 0x10001599 (RVA : 0x00001599) : # MOV EAX,ESI # POP ESI # RETN ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x1001919c (RVA : 0x0001919c) : # MOV EAX,ESI # POP ESI # POP EBX # POP EBP # RETN 0x04 ** [WinCRT.dll] ** | {PAGE_EXECUTE_READ} 0x10004f41 (RVA : 0x00004f41) : # MOV EAX,ESI # POP ESI # POP EBP # RETN 0x04 ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x1000249f (RVA : 0x0000249f) : # MOV EAX,ESI # POP ESI # POP EBP # RETN 0x04 ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x10001020 (RVA : 0x00001020) : # MOV EAX,ESI # POP ESI # RETN ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x100074a1 (RVA : 0x000074a1) : # MOV EAX,ESI # POP ESI # POP EBP # RETN 0x04 ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x1000c8a3 (RVA : 0x0000c8a3) : # MOV EAX,ESI # POP ESI # POP EBP # RETN 0x04 ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x100034a4 (RVA : 0x000034a4) : # MOV EAX,ESI # POP ESI # POP EBP # RETN 0x04 ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x100054b3 (RVA : 0x000054b3) : # MOV EAX,ESI # POP ESI # POP EBP # RETN 0x04 ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x10005d27 (RVA : 0x00005d27) : # MOV EAX,ESI # POP ESI # POP EBP # RETN 0x04 ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x100028a8 (RVA : 0x000028a8) : # MOV EAX,ESI # POP ESI # RETN ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x1000c929 (RVA : 0x0000c929) : # MOV EAX,ESI # POP ESI # POP EBP # RETN 0x04 ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x1000c3aa (RVA : 0x0000c3aa) : # MOV EAX,ESI # POP ESI # POP EBP # RETN 0x04 ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x100044af (RVA : 0x000044af) : # MOV EAX,ESI # POP ESI # POP EBP # RETN 0x04 ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x10003031 (RVA : 0x00003031) : # MOV EAX,ESI # POP ESI # POP EBP # RETN 0x04 ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x1000bd58 (RVA : 0x0000bd58) : # MOV EAX,ESI # POP ESI # POP EBX # RETN ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x1000a3b3 (RVA : 0x0000a3b3) : # MOV EAX,ESI # POP ESI # RETN 0x04 ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x10004385 (RVA : 0x00004385) : # MOV EAX,ESI # POP ESI # POP EBP # RETN 0x04 ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x1000433b (RVA : 0x0000433b) : # MOV EAX,ESI # POP ESI # POP EBP # RETN 0x04 ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x1001e0bc (RVA : 0x0001e0bc) : # MOV EAX,ESI # POP ESI # RETN ** [WinCRT.dll] ** | {PAGE_EXECUTE_READ} 0x100024c0 (RVA : 0x000024c0) : # MOV EAX,ESI # POP ESI # POP EBP # RETN 0x04 ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x1000c1c1 (RVA : 0x0000c1c1) : # MOV EAX,ESI # POP ESI # RETN ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x1000c144 (RVA : 0x0000c144) : # MOV EAX,ESI # POP ESI # POP EBP # RETN 0x04 ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x100191e1 (RVA : 0x000191e1) : # MOV EAX,ESI # POP ESI # POP EBP # RETN 0x04 ** [WinCRT.dll] ** | {PAGE_EXECUTE_READ} 0x10010ccb (RVA : 0x00010ccb) : # MOV EAX,ESI # POP ESI # POP EBP # RETN 0x04 ** [WinCRT.dll] ** | {PAGE_EXECUTE_READ} 0x1000a54d (RVA : 0x0000a54d) : # MOV EAX,ESI # POP ESI # POP EBP # RETN 0x04 ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x100068cf (RVA : 0x000068cf) : # MOV EAX,ESI # POP ESI # RETN ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x100010f8 (RVA : 0x000010f8) : # MOV EAX,ESI # POP ESI # RETN 0x04 ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x10012fd4 (RVA : 0x00012fd4) : # MOV EAX,ESI # POP EDI # POP ESI # RETN ** [WinCRT.dll] ** | {PAGE_EXECUTE_READ} 0x1001e055 (RVA : 0x0001e055) : # MOV EAX,ESI # POP ESI # RETN ** [WinCRT.dll] ** | {PAGE_EXECUTE_READ} 0x1000d156 (RVA : 0x0000d156) : # MOV EAX,ESI # POP ESI # POP EBP # RETN 0x04 ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x100024d7 (RVA : 0x000024d7) : # MOV EAX,ESI # POP ESI # POP EBP # RETN 0x04 ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x100098d8 (RVA : 0x000098d8) : # MOV EAX,ESI # POP ESI # RETN ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x100075d9 (RVA : 0x000075d9) : # MOV EAX,ESI # POP ESI # POP EBP # RETN 0x04 ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x10001c4f (RVA : 0x00001c4f) : # MOV EAX,ESI # POP ESI # POP EBP # RETN 0x04 ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x10011a5e (RVA : 0x00011a5e) : # MOV EAX,ESI # POP ESI # RETN ** [WinCRT.dll] ** | ascii {PAGE_EXECUTE_READ} 0x1000565f (RVA : 0x0000565f) : # MOV EAX,ESI # POP ESI # POP EBP # RETN 0x0C ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x1000c8e1 (RVA : 0x0000c8e1) : # MOV EAX,ESI # POP ESI # POP EBP # RETN 0x04 ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x100034bb (RVA : 0x000034bb) : # MOV EAX,ESI # POP ESI # POP EBP # RETN 0x04 ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x1000de65 (RVA : 0x0000de65) : # MOV EAX,ESI # POP ESI # POP EBP # RETN 0x04 ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x10003d20 (RVA : 0x00003d20) : # MOV EAX,ESI # POP ESI # POP EBX # POP EBP # RETN 0x08 ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x1000567c (RVA : 0x0000567c) : # MOV EAX,ESI # POP ESI # POP EBP # RETN 0x0C ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x1000ccec (RVA : 0x0000ccec) : # MOV EAX,ESI # POP ESI # POP EBP # RETN 0x04 ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x100066ee (RVA : 0x000066ee) : # MOV EAX,ESI # POP ESI # POP EBP # RETN 0x04 ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x100181ef (RVA : 0x000181ef) : # MOV EAX,ESI # POP ESI # RETN 0x10 ** [WinCRT.dll] ** | {PAGE_EXECUTE_READ} 0x1000c970 (RVA : 0x0000c970) : # MOV EAX,ESI # POP ESI # POP EBP # RETN 0x04 ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x10005171 (RVA : 0x00005171) : # MOV EAX,ESI # POP ESI # POP EBP # RETN 0x04 ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x100046f3 (RVA : 0x000046f3) : # MOV EAX,ESI # POP ESI # POP EBP # RETN 0x04 ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x100034f5 (RVA : 0x000034f5) : # MOV EAX,ESI # POP ESI # POP EBP # RETN 0x04 ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x1000dd71 (RVA : 0x0000dd71) : # MOV EAX,ESI # POP ESI # POP EBP # RETN 0x04 ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x10004469 (RVA : 0x00004469) : # MOV EAX,ESI # POP ESI # POP EBP # RETN 0x04 ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x1000e6f8 (RVA : 0x0000e6f8) : # MOV EAX,ESI # POP ESI # POP EBP # RETN ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x1000d3d4 (RVA : 0x0000d3d4) : # MOV EAX,ESI # POP ESI # POP EBP # RETN 0x04 ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x10007dfa (RVA : 0x00007dfa) : # MOV EAX,ESI # POP ESI # RETN ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x10011bfb (RVA : 0x00011bfb) : # MOV EAX,ESI # POP ESI # RETN ** [WinCRT.dll] ** | {PAGE_EXECUTE_READ} 0x1000657c (RVA : 0x0000657c) : # MOV EAX,ESI # POP ESI # POP EBP # RETN 0x04 ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x1000767f (RVA : 0x0000767f) : # MOV EAX,ESI # POP ESI # RETN ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} [move ebx -> edx] 0x1001175e (RVA : 0x0001175e) : # ADD EDX,EBX # POP EBX # RETN 0x10 ** [WinCRT.dll] ** | ascii {PAGE_EXECUTE_READ} [move edi -> eax] 0x10009242 (RVA : 0x00009242) : # MOV EAX,EDI # POP EDI # POP ESI # RETN ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x10009046 (RVA : 0x00009046) : # MOV EAX,EDI # POP EDI # POP ESI # RETN ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x10006547 (RVA : 0x00006547) : # MOV EAX,EDI # POP EDI # POP ESI # RETN ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x10003609 (RVA : 0x00003609) : # MOV EAX,EDI # POP EDI # POP ESI # POP EBP # RETN 0x04 ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x10011f82 (RVA : 0x00011f82) : # MOV EAX,EDI # POP EDI # POP ESI # POP EBP # RETN ** [WinCRT.dll] ** | {PAGE_EXECUTE_READ} 0x10011fce (RVA : 0x00011fce) : # MOV EAX,EDI # POP EDI # POP ESI # POP EBP # RETN ** [WinCRT.dll] ** | {PAGE_EXECUTE_READ} 0x1000c36f (RVA : 0x0000c36f) : # MOV EAX,EDI # POP EDI # POP ESI # RETN ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x1001795e (RVA : 0x0001795e) : # MOV EAX,EDI # POP EDI # POP EBP # RETN ** [WinCRT.dll] ** | ascii {PAGE_EXECUTE_READ} 0x10008fb6 (RVA : 0x00008fb6) : # MOV EAX,EDI # POP EDI # POP ESI # POP EBP # RETN 0x04 ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x10003458 (RVA : 0x00003458) : # MOV EAX,EDI # POP EDI # POP ESI # POP EBP # RETN ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x1000647a (RVA : 0x0000647a) : # MOV EAX,EDI # POP EDI # POP ESI # RETN ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x1001201c (RVA : 0x0001201c) : # MOV EAX,EDI # POP EDI # POP ESI # POP EBP # RETN ** [WinCRT.dll] ** | ascii {PAGE_EXECUTE_READ} 0x1001799a (RVA : 0x0001799a) : # MOV EAX,EDI # POP ESI # RETN ** [WinCRT.dll] ** | {PAGE_EXECUTE_READ} 0x1001913e (RVA : 0x0001913e) : # MOV EAX,EDI # POP EDI # POP ESI # POP EBX # POP EBP # RETN 0x04 ** [WinCRT.dll] ** | {PAGE_EXECUTE_READ} [move ecx -> edi] 0x100078c4 (RVA : 0x000078c4) : # PUSH ECX # INC ESP # POP EDI # POP ESI # POP EBP # RETN 0x14 ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x10009cfc (RVA : 0x00009cfc) : # PUSH ECX # INC ESP # POP EDI # POP ESI # POP EBP # RETN 0x18 ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x100079cb (RVA : 0x000079cb) : # PUSH ECX # POP EDI # POP ESI # POP EBP # RETN 0x10 ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x10009ed7 (RVA : 0x00009ed7) : # PUSH ECX # POP EDI # POP ESI # POP EBP # RETN 0x14 ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x10009cbc (RVA : 0x00009cbc) : # PUSH ECX # INC EAX # POP EDI # POP ESI # POP EBP # RETN 0x1C ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x1000789f (RVA : 0x0000789f) : # PUSH ECX # INC EAX # POP EDI # POP ESI # POP EBP # RETN 0x18 ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} [move edx -> ecx] 0x10013b57 (RVA : 0x00013b57) : # ADD ECX,EDX # ADD EAX,ECX # POP ESI # POP EBP # RETN ** [WinCRT.dll] ** | ascii {PAGE_EXECUTE_READ} [move eax -> edi] 0x10009da1 (RVA : 0x00009da1) : # PUSH EAX # POP EDI # POP ESI # POP EBP # RETN 0x18 ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x10007914 (RVA : 0x00007914) : # PUSH EAX # POP EDI # POP ESI # POP EBP # RETN 0x14 ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} [inc ebx] 0x10004aa7 (RVA : 0x00004aa7) : # INC EBX # XOR EAX,EAX # RETN ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} [inc esi] 0x10008d0d (RVA : 0x00008d0d) : # INC ESI # ADD AL,5E # RETN ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x1001e006 (RVA : 0x0001e006) : # INC ESI # ADD AL,5E # POP EBP # RETN ** [WinCRT.dll] ** | {PAGE_EXECUTE_READ} 0x100032b5 (RVA : 0x000032b5) : # INC ESI # SUB AL,5E # RETN ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} [move edx -> eax] 0x10014911 (RVA : 0x00014911) : # MOV EAX,EDX # POP EBP # RETN ** [WinCRT.dll] ** | ascii {PAGE_EXECUTE_READ} 0x10014a0c (RVA : 0x00014a0c) : # MOV EAX,EDX # RETN ** [WinCRT.dll] ** | ascii {PAGE_EXECUTE_READ} [inc ebp] 0x10013bd5 (RVA : 0x00013bd5) : # INC EBP # DEC ECX # RETN ** [WinCRT.dll] ** | {PAGE_EXECUTE_READ} [move ebx -> esp] 0x10007f13 (RVA : 0x00007f13) : # PUSH EBX # POP ESP # POP EDI # POP ESI # POP EBX # POP EBP # RETN 0x20 ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x10007f63 (RVA : 0x00007f63) : # PUSH EBX # POP ESP # POP EDI # POP ESI # POP EBX # POP EBP # RETN 0x1C ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} [pushad] 0x10006382 (RVA : 0x00006382) : # PUSHAD # ADD AL,0 # RETN ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x100079ac (RVA : 0x000079ac) : # PUSHAD # POP EBP # RETN 0x0C ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x10009eaa (RVA : 0x00009eaa) : # PUSHAD # POP EBP # RETN 0x10 ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x1000c27e (RVA : 0x0000c27e) : # PUSHAD # ADD AL,0 # RETN ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} [add edx -> ecx] 0x10013b57 (RVA : 0x00013b57) : # ADD ECX,EDX # ADD EAX,ECX # POP ESI # POP EBP # RETN ** [WinCRT.dll] ** | ascii {PAGE_EXECUTE_READ} [move ecx -> eax] 0x10014ca1 (RVA : 0x00014ca1) : # MOV EAX,ECX # RETN ** [WinCRT.dll] ** | {PAGE_EXECUTE_READ} 0x10007966 (RVA : 0x00007966) : # PUSH ECX # POP EAX # POP EDI # POP ESI # POP EBP # RETN 0x20 ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x10006127 (RVA : 0x00006127) : # MOV EAX,ECX # POP EBP # RETN 0x20 ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x1001e087 (RVA : 0x0001e087) : # MOV EAX,ECX # RETN ** [WinCRT.dll] ** | {PAGE_EXECUTE_READ} 0x10009e2c (RVA : 0x00009e2c) : # PUSH ECX # POP EAX # POP EDI # POP ESI # POP EBP # RETN 0x24 ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x10006aaf (RVA : 0x00006aaf) : # MOV EAX,ECX # RETN ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x10006af0 (RVA : 0x00006af0) : # MOV EAX,ECX # RETN ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x1001a1a1 (RVA : 0x0001a1a1) : # MOV EAX,ECX # RETN ** [WinCRT.dll] ** | {PAGE_EXECUTE_READ} 0x10013b59 (RVA : 0x00013b59) : # ADD EAX,ECX # POP ESI # POP EBP # RETN ** [WinCRT.dll] ** | ascii {PAGE_EXECUTE_READ} 0x10013ada (RVA : 0x00013ada) : # MOV EAX,ECX # RETN ** [WinCRT.dll] ** | {PAGE_EXECUTE_READ} [move eax -> ebx] 0x1000c771 (RVA : 0x0000c771) : # PUSH EAX # PUSH EAX # MOV EAX,DWORD PTR DS:[EDI] # POP EBX # POP EDI # MOV DWORD PTR DS:[ESI+28],EAX # POP ESI # RETN ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x1000c772 (RVA : 0x0000c772) : # PUSH EAX # MOV EAX,DWORD PTR DS:[EDI] # POP EBX # POP EDI # MOV DWORD PTR DS:[ESI+28],EAX # POP ESI # RETN ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} [dec eax] 0x10002560 (RVA : 0x00002560) : # DEC EAX # ADD AL,8B # RETN ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x10001906 (RVA : 0x00001906) : # DEC EAX # DEC EAX # POP EBP # RETN ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x10001907 (RVA : 0x00001907) : # DEC EAX # POP EBP # RETN ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x10009d31 (RVA : 0x00009d31) : # DEC EAX # POP EBP # RETN 0x08 ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x10005cb2 (RVA : 0x00005cb2) : # DEC EAX # ADD AL,5D # RETN 0x04 ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x1000dff8 (RVA : 0x0000dff8) : # DEC EAX # POP EBP # RETN ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x100078dc (RVA : 0x000078dc) : # DEC EAX # POP EBP # RETN 0x04 ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} [move eax -> ebp] 0x10003808 (RVA : 0x00003808) : # XCHG EAX,EBP # RETN ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} [move edx -> esi] 0x10003c83 (RVA : 0x00003c83) : # PUSH EDX # POP ESI # POP EBP # RETN ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} [dec ecx] 0x1001b685 (RVA : 0x0001b685) : # DEC ECX # RETN ** [WinCRT.dll] ** | {PAGE_EXECUTE_READ} 0x1001b087 (RVA : 0x0001b087) : # DEC ECX # RETN ** [WinCRT.dll] ** | {PAGE_EXECUTE_READ} 0x1001b90c (RVA : 0x0001b90c) : # DEC ECX # RETN ** [WinCRT.dll] ** | {PAGE_EXECUTE_READ} 0x1001cc0f (RVA : 0x0001cc0f) : # DEC ECX # RETN ** [WinCRT.dll] ** | {PAGE_EXECUTE_READ} 0x1000d190 (RVA : 0x0000d190) : # DEC ECX # ADD AL,8B # ADD AL,81 # POP EBP # RETN 0x04 ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x1001b293 (RVA : 0x0001b293) : # DEC ECX # RETN ** [WinCRT.dll] ** | {PAGE_EXECUTE_READ} 0x10014896 (RVA : 0x00014896) : # DEC ECX # RETN ** [WinCRT.dll] ** | {PAGE_EXECUTE_READ} 0x1001a919 (RVA : 0x0001a919) : # DEC ECX # RETN ** [WinCRT.dll] ** | {PAGE_EXECUTE_READ} 0x1001a71a (RVA : 0x0001a71a) : # DEC ECX # RETN ** [WinCRT.dll] ** | {PAGE_EXECUTE_READ} 0x10019e1b (RVA : 0x00019e1b) : # DEC ECX # RETN ** [WinCRT.dll] ** | {PAGE_EXECUTE_READ} 0x10018c22 (RVA : 0x00018c22) : # DEC ECX # RETN ** [WinCRT.dll] ** | {PAGE_EXECUTE_READ} 0x1001d527 (RVA : 0x0001d527) : # DEC ECX # RETN ** [WinCRT.dll] ** | {PAGE_EXECUTE_READ} 0x10018b28 (RVA : 0x00018b28) : # DEC ECX # RETN ** [WinCRT.dll] ** | {PAGE_EXECUTE_READ} 0x10017232 (RVA : 0x00017232) : # DEC ECX # RETN ** [WinCRT.dll] ** | ascii {PAGE_EXECUTE_READ} 0x10017537 (RVA : 0x00017537) : # DEC ECX # RETN ** [WinCRT.dll] ** | ascii {PAGE_EXECUTE_READ} 0x1001bac0 (RVA : 0x0001bac0) : # DEC ECX # RETN ** [WinCRT.dll] ** | {PAGE_EXECUTE_READ} 0x100160ca (RVA : 0x000160ca) : # DEC ECX # RETN ** [WinCRT.dll] ** | {PAGE_EXECUTE_READ} 0x10013bd6 (RVA : 0x00013bd6) : # DEC ECX # RETN ** [WinCRT.dll] ** | {PAGE_EXECUTE_READ} 0x1001afdf (RVA : 0x0001afdf) : # DEC ECX # RETN ** [WinCRT.dll] ** | {PAGE_EXECUTE_READ} 0x100185e3 (RVA : 0x000185e3) : # DEC ECX # RETN ** [WinCRT.dll] ** | {PAGE_EXECUTE_READ} 0x1000c866 (RVA : 0x0000c866) : # DEC ECX # RETN 0x04 ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x1000d16f (RVA : 0x0000d16f) : # DEC ECX # ADD AL,8D # ADD AL,81 # POP EBP # RETN 0x04 ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x10016cf2 (RVA : 0x00016cf2) : # DEC ECX # RETN ** [WinCRT.dll] ** | {PAGE_EXECUTE_READ} 0x1001ddfc (RVA : 0x0001ddfc) : # DEC ECX # RETN ** [WinCRT.dll] ** | {PAGE_EXECUTE_READ} [move ebp -> eax] 0x10003808 (RVA : 0x00003808) : # XCHG EAX,EBP # RETN ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} [move eax -> esi] 0x100074a0 (RVA : 0x000074a0) : # PUSH EAX # MOV EAX,ESI # POP ESI # POP EBP # RETN 0x04 ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x1000bd54 (RVA : 0x0000bd54) : # PUSH EAX # MOV DWORD PTR DS:[ESI+44],EBX # MOV EAX,ESI # POP ESI # POP EBX # RETN ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x1000431d (RVA : 0x0000431d) : # PUSH EAX # ADD AL,5F # POP ESI # RETN ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x10007e8e (RVA : 0x00007e8e) : # PUSH EAX # MOV EAX,ESI # POP ESI # RETN ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} [inc ecx] 0x1000c408 (RVA : 0x0000c408) : # INC ECX # ADD AL,3 # RETN ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x10005ecb (RVA : 0x00005ecb) : # INC ECX # ADD AL,5D # RETN 0x04 ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x100193af (RVA : 0x000193af) : # INC ECX # AND EAX,4 # POP EBP # RETN ** [WinCRT.dll] ** | {PAGE_EXECUTE_READ} [dec esi] 0x1000de0a (RVA : 0x0000de0a) : # DEC ESI # ADD AL,8B # RETN ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} [popad] 0x10005ed7 (RVA : 0x00005ed7) : # POPAD # ADD AL,0 # RETN ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} [move eax -> esp] 0x1000260d (RVA : 0x0000260d) : # XCHG EAX,ESP # RETN ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x1000a78d (RVA : 0x0000a78d) : # XCHG EAX,ESP # RETN ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} [add ebx -> edx] 0x1001175e (RVA : 0x0001175e) : # ADD EDX,EBX # POP EBX # RETN 0x10 ** [WinCRT.dll] ** | ascii {PAGE_EXECUTE_READ} [clear eax] 0x1000c282 (RVA : 0x0000c282) : # XOR EAX,EAX # RETN ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x10006386 (RVA : 0x00006386) : # XOR EAX,EAX # RETN ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x10017e87 (RVA : 0x00017e87) : # XOR EAX,EAX # RETN ** [WinCRT.dll] ** | {PAGE_EXECUTE_READ} 0x1000a28c (RVA : 0x0000a28c) : # XOR EAX,EAX # RETN ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x1000279a (RVA : 0x0000279a) : # XOR EAX,EAX # RETN 0x04 ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x1001799e (RVA : 0x0001799e) : # XOR EAX,EAX # RETN ** [WinCRT.dll] ** | {PAGE_EXECUTE_READ} 0x10017023 (RVA : 0x00017023) : # XOR EAX,EAX # RETN ** [WinCRT.dll] ** | ascii {PAGE_EXECUTE_READ} 0x10004aa9 (RVA : 0x00004aa9) : # XOR EAX,EAX # RETN ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x10007a2c (RVA : 0x00007a2c) : # XOR EAX,EAX # RETN ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x10016e2f (RVA : 0x00016e2f) : # XOR EAX,EAX # RETN ** [WinCRT.dll] ** | ascii {PAGE_EXECUTE_READ} 0x1000d139 (RVA : 0x0000d139) : # XOR EAX,EAX # RETN ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x1001de41 (RVA : 0x0001de41) : # XOR EAX,EAX # RETN ** [WinCRT.dll] ** | {PAGE_EXECUTE_READ} 0x10013add (RVA : 0x00013add) : # XOR EAX,EAX # RETN ** [WinCRT.dll] ** | {PAGE_EXECUTE_READ} 0x100033c5 (RVA : 0x000033c5) : # XOR EAX,EAX # RETN ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x1000774f (RVA : 0x0000774f) : # XOR EAX,EAX # RETN ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x10006552 (RVA : 0x00006552) : # XOR EAX,EAX # RETN ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x1000dd54 (RVA : 0x0000dd54) : # XOR EAX,EAX # RETN ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x10016eb9 (RVA : 0x00016eb9) : # XOR EAX,EAX # RETN ** [WinCRT.dll] ** | {PAGE_EXECUTE_READ} 0x1000955d (RVA : 0x0000955d) : # XOR EAX,EAX # RETN ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x100018e7 (RVA : 0x000018e7) : # XOR EAX,EAX # RETN ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x10009867 (RVA : 0x00009867) : # XOR EAX,EAX # RETN ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x1000a3eb (RVA : 0x0000a3eb) : # XOR EAX,EAX # RETN 0x08 ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x1000636c (RVA : 0x0000636c) : # XOR EAX,EAX # RETN ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x100176ef (RVA : 0x000176ef) : # XOR EAX,EAX # RETN ** [WinCRT.dll] ** | {PAGE_EXECUTE_READ} 0x100118f0 (RVA : 0x000118f0) : # XOR EAX,EAX # RETN ** [WinCRT.dll] ** | {PAGE_EXECUTE_READ} 0x10002d75 (RVA : 0x00002d75) : # XOR EAX,EAX # RETN ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x1000c37a (RVA : 0x0000c37a) : # XOR EAX,EAX # RETN ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x1000a3fe (RVA : 0x0000a3fe) : # XOR EAX,EAX # RETN ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} [add ecx -> eax] 0x10013b59 (RVA : 0x00013b59) : # ADD EAX,ECX # POP ESI # POP EBP # RETN ** [WinCRT.dll] ** | ascii {PAGE_EXECUTE_READ} [inc eax] 0x10001500 (RVA : 0x00001500) : # INC EAX # POP ESI # RETN ** [WinCRT.dll] ** | null,unicodereverse,ascii {PAGE_EXECUTE_READ} 0x1001396c (RVA : 0x0001396c) : # INC EAX # POP EDI # POP ESI # POP EBP # RETN ** [WinCRT.dll] ** | ascii {PAGE_EXECUTE_READ} 0x10003a8a (RVA : 0x00003a8a) : # INC EAX # RETN ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x1000120d (RVA : 0x0000120d) : # INC EAX # POP EBP # RETN 0x0C ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x10003011 (RVA : 0x00003011) : # INC EAX # POP EDI # POP EBX # POP ESI # POP EBP # RETN ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x10009013 (RVA : 0x00009013) : # INC EAX # POP EBX # POP EDI # POP ESI # POP EBP # RETN 0x04 ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x10009095 (RVA : 0x00009095) : # INC EAX # POP ESI # RETN ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x10002796 (RVA : 0x00002796) : # INC EAX # RETN 0x04 ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x100030ef (RVA : 0x000030ef) : # INC EAX # POP EDI # POP ESI # RETN ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x1000e71d (RVA : 0x0000e71d) : # INC EAX # POP EBP # RETN ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x100078a0 (RVA : 0x000078a0) : # INC EAX # POP EDI # POP ESI # POP EBP # RETN 0x18 ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x10019fa3 (RVA : 0x00019fa3) : # INC EAX # POP ESI # POP EBP # RETN ** [WinCRT.dll] ** | {PAGE_EXECUTE_READ} 0x10007515 (RVA : 0x00007515) : # INC EAX # RETN ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x10003ba6 (RVA : 0x00003ba6) : # INC EAX # POP ESI # POP EBP # RETN 0x04 ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x1000e129 (RVA : 0x0000e129) : # INC EAX # POP EDI # POP ESI # POP EBP # RETN 0x0C ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x10007a2a (RVA : 0x00007a2a) : # INC EAX # RETN ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x10013f2b (RVA : 0x00013f2b) : # INC EAX # RETN ** [WinCRT.dll] ** | ascii {PAGE_EXECUTE_READ} 0x1001459d (RVA : 0x0001459d) : # INC EAX # RETN ** [WinCRT.dll] ** | {PAGE_EXECUTE_READ} 0x10001132 (RVA : 0x00001132) : # INC EAX # RETN 0x0C ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x10001233 (RVA : 0x00001233) : # INC EAX # POP EBP # RETN 0x0C ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x10016e34 (RVA : 0x00016e34) : # INC EAX # RETN ** [WinCRT.dll] ** | ascii {PAGE_EXECUTE_READ} 0x100012b5 (RVA : 0x000012b5) : # INC EAX # POP EBP # RETN 0x14 ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x10002eb7 (RVA : 0x00002eb7) : # INC EAX # POP EBP # RETN ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x1000deb8 (RVA : 0x0000deb8) : # INC EAX # POP EBP # RETN 0x04 ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x1000253b (RVA : 0x0000253b) : # INC EAX # POP EBP # RETN ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x100033bd (RVA : 0x000033bd) : # INC EAX # RETN ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x10006835 (RVA : 0x00006835) : # INC EAX # POP ESI # POP EBP # RETN ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x10013fc4 (RVA : 0x00013fc4) : # INC EAX # RETN ** [WinCRT.dll] ** | {PAGE_EXECUTE_READ} 0x10007a45 (RVA : 0x00007a45) : # INC EAX # POP EBP # RETN 0x04 ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x1001de46 (RVA : 0x0001de46) : # INC EAX # RETN ** [WinCRT.dll] ** | {PAGE_EXECUTE_READ} 0x1001d68d (RVA : 0x0001d68d) : # INC EAX # RETN ** [WinCRT.dll] ** | {PAGE_EXECUTE_READ} 0x100013d5 (RVA : 0x000013d5) : # INC EAX # POP ESI # RETN ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x10007a60 (RVA : 0x00007a60) : # INC EAX # POP EBP # RETN 0x10 ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x10012261 (RVA : 0x00012261) : # INC EAX # RETN ** [WinCRT.dll] ** | ascii {PAGE_EXECUTE_READ} 0x100138bb (RVA : 0x000138bb) : # INC EAX # POP EBP # RETN ** [WinCRT.dll] ** | {PAGE_EXECUTE_READ} 0x1000a3e4 (RVA : 0x0000a3e4) : # INC EAX # POP EBP # RETN ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x1000696c (RVA : 0x0000696c) : # INC EAX # POP EBX # POP EBP # RETN 0x0C ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x100145ed (RVA : 0x000145ed) : # INC EAX # RETN ** [WinCRT.dll] ** | {PAGE_EXECUTE_READ} 0x10012a6f (RVA : 0x00012a6f) : # INC EAX # POP EDI # POP ESI # RETN ** [WinCRT.dll] ** | ascii {PAGE_EXECUTE_READ} 0x10001af2 (RVA : 0x00001af2) : # INC EAX # POP ESI # RETN ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x10005b74 (RVA : 0x00005b74) : # INC EAX # POP EBP # RETN 0x10 ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x10014575 (RVA : 0x00014575) : # INC EAX # POP EDI # POP ESI # POP EBX # POP EBP # RETN ** [WinCRT.dll] ** | ascii {PAGE_EXECUTE_READ} 0x100013f9 (RVA : 0x000013f9) : # INC EAX # RETN ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x1000bb3f (RVA : 0x0000bb3f) : # INC EAX # POP ESI # POP EBP # RETN 0x04 ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x10009cbd (RVA : 0x00009cbd) : # INC EAX # POP EDI # POP ESI # POP EBP # RETN 0x1C ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x100182ff (RVA : 0x000182ff) : # INC EAX # POP EBP # RETN ** [WinCRT.dll] ** | {PAGE_EXECUTE_READ} [pickup pointer into eax] 0x1001b503 (RVA : 0x0001b503) : # MOV EAX,DWORD PTR DS:[EAX] # POP ESI # POP EBP # RETN ** [WinCRT.dll] ** | {PAGE_EXECUTE_READ} 0x1000203d (RVA : 0x0000203d) : # MOV EAX,DWORD PTR DS:[ESI] # POP ESI # POP EBP # RETN 0x04 ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x10005bff (RVA : 0x00005bff) : # MOV EAX,DWORD PTR DS:[EAX] # ADD CL,CL # RETN 0x08 ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} [move esp -> edi] 0x10008965 (RVA : 0x00008965) : # PUSH ESP # POP EDI # ADD BYTE PTR DS:[EAX],AL # RETN 0x04 ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} [move ecx -> esi] 0x100077e3 (RVA : 0x000077e3) : # PUSH ECX # SUB AL,5F # POP ESI # POP EBP # RETN 0x14 ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x10009b73 (RVA : 0x00009b73) : # PUSH ECX # SUB AL,5F # POP ESI # POP EBP # RETN 0x18 ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} [add value to eax] 0x10013a40 (RVA : 0x00013a40) : # SUB EAX,59FFFFFF # RETN ** [WinCRT.dll] ** | ascii {PAGE_EXECUTE_READ} 0x1000c584 (RVA : 0x0000c584) : # ADD EAX,80004002 # POP EDI # POP ESI # POP EBP # RETN 0x08 ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x1000f156 (RVA : 0x0000f156) : # ADD EAX,8 # RETN ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x1001448b (RVA : 0x0001448b) : # ADC EAX,C68B1002 # POP ESI # POP EBP # RETN 0x04 ** [WinCRT.dll] ** | {PAGE_EXECUTE_READ} 0x10011004 (RVA : 0x00011004) : # ADD EAX,C940C033 # RETN ** [WinCRT.dll] ** | ascii {PAGE_EXECUTE_READ} 0x1000df9b (RVA : 0x0000df9b) : # ADD EAX,5E58186A # RETN ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x1000b824 (RVA : 0x0000b824) : # XOR EAX,5FFFFFFF # POP ESI # POP EBP # RETN 0x0C ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x1001af27 (RVA : 0x0001af27) : # ADD EAX,20 # POP EBP # RETN ** [WinCRT.dll] ** | {PAGE_EXECUTE_READ} 0x100044ab (RVA : 0x000044ab) : # ADD EAX,C68B0000 # POP ESI # POP EBP # RETN 0x04 ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x100044ac (RVA : 0x000044ac) : # ADD EAX,C68B0000 # POP ESI # POP EBP # RETN 0x04 ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x10018d2f (RVA : 0x00018d2f) : # ADD EAX,C940C033 # RETN ** [WinCRT.dll] ** | {PAGE_EXECUTE_READ} 0x10017831 (RVA : 0x00017831) : # SUB EAX,59FFFF6B # POP EDI # POP ESI # POP EBX # POP EBP # RETN ** [WinCRT.dll] ** | ascii {PAGE_EXECUTE_READ} 0x10002eb4 (RVA : 0x00002eb4) : # ADD EAX,5D40C033 # RETN ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x100138b8 (RVA : 0x000138b8) : # ADD EAX,5D40C033 # RETN ** [WinCRT.dll] ** | {PAGE_EXECUTE_READ} 0x1001babd (RVA : 0x0001babd) : # ADC EAX,C9FFFF2D # RETN ** [WinCRT.dll] ** | {PAGE_EXECUTE_READ} 0x10016f40 (RVA : 0x00016f40) : # ADD EAX,0 # ADD ESP,18 # POP EDI # POP ESI # POP EBX # RETN ** [WinCRT.dll] ** | ascii {PAGE_EXECUTE_READ} 0x1000f142 (RVA : 0x0000f142) : # ADD EAX,8 # POP EBP # RETN ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x100138d6 (RVA : 0x000138d6) : # ADC EAX,C68B1002 # POP ESI # POP EBP # RETN 0x04 ** [WinCRT.dll] ** | {PAGE_EXECUTE_READ} 0x10018d57 (RVA : 0x00018d57) : # ADD EAX,D0FF006A # RETN ** [WinCRT.dll] ** | {PAGE_EXECUTE_READ} 0x1000f169 (RVA : 0x0000f169) : # ADD EAX,0C # RETN ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x1000a3e1 (RVA : 0x0000a3e1) : # ADD EAX,5D40C033 # RETN ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x100182fc (RVA : 0x000182fc) : # ADD EAX,5D40C033 # RETN ** [WinCRT.dll] ** | {PAGE_EXECUTE_READ} 0x10009ef3 (RVA : 0x00009ef3) : # ADD EAX,80010108 # POP EBP # RETN 0x18 ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x10019ff7 (RVA : 0x00019ff7) : # ADD EAX,5E581A6A # RETN ** [WinCRT.dll] ** | {PAGE_EXECUTE_READ} 0x100118f8 (RVA : 0x000118f8) : # ADD EAX,1 # RETN ** [WinCRT.dll] ** | {PAGE_EXECUTE_READ} 0x10002bfc (RVA : 0x00002bfc) : # ADD EAX,30 # RETN ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} [move ebx -> eax] 0x1001da60 (RVA : 0x0001da60) : # MOV EAX,EBX # POP EDI # POP ESI # POP EBX # POP EBP # RETN ** [WinCRT.dll] ** | {PAGE_EXECUTE_READ} 0x10005f0a (RVA : 0x00005f0a) : # MOV EAX,EBX # POP EBX # RETN ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x1001b796 (RVA : 0x0001b796) : # MOV EAX,EBX # POP EBX # POP EBP # RETN ** [WinCRT.dll] ** | {PAGE_EXECUTE_READ} [inc edx] 0x1000c443 (RVA : 0x0000c443) : # INC EDX # ADD AL,3 # RETN ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} [move ecx -> esp] 0x1000798e (RVA : 0x0000798e) : # PUSH ECX # POP ESP # POP EDI # POP ESI # POP EBP # RETN 0x18 ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} 0x10009e6f (RVA : 0x00009e6f) : # PUSH ECX # POP ESP # POP EDI # POP ESI # POP EBP # RETN 0x1C ** [WinCRT.dll] ** | null {PAGE_EXECUTE_READ} [clear edx] 0x1001183c (RVA : 0x0001183c) : # XOR EDX,EDX # RETN ** [WinCRT.dll] ** | ascii {PAGE_EXECUTE_READ} 0x1001b39c (RVA : 0x0001b39c) : # XOR EDX,EDX # RETN ** [WinCRT.dll] ** | {PAGE_EXECUTE_READ}