添加项目文件。

2026-06-08 16:53:41 +00:00 · 2020-01-10 00:05:02 +08:00
commit a9e1d6e4cd
31 changed files with 3190 additions and 0 deletions
@@ -0,0 +1,63 @@
+###############################################################################
+# Set default behavior to automatically normalize line endings.
+###############################################################################
+* text=auto
+
+###############################################################################
+# Set default behavior for command prompt diff.
+#
+# This is need for earlier builds of msysgit that does not have it on by
+# default for csharp files.
+# Note: This is only used by command line
+###############################################################################
+#*.cs     diff=csharp
+
+###############################################################################
+# Set the merge driver for project and solution files
+#
+# Merging from the command prompt will add diff markers to the files if there
+# are conflicts (Merging from VS is not affected by the settings below, in VS
+# the diff markers are never inserted). Diff markers may cause the following 
+# file extensions to fail to load in VS. An alternative would be to treat
+# these files as binary and thus will always conflict and require user
+# intervention with every merge. To do so, just uncomment the entries below
+###############################################################################
+#*.sln       merge=binary
+#*.csproj    merge=binary
+#*.vbproj    merge=binary
+#*.vcxproj   merge=binary
+#*.vcproj    merge=binary
+#*.dbproj    merge=binary
+#*.fsproj    merge=binary
+#*.lsproj    merge=binary
+#*.wixproj   merge=binary
+#*.modelproj merge=binary
+#*.sqlproj   merge=binary
+#*.wwaproj   merge=binary
+
+###############################################################################
+# behavior for image files
+#
+# image files are treated as binary by default.
+###############################################################################
+#*.jpg   binary
+#*.png   binary
+#*.gif   binary
+
+###############################################################################
+# diff behavior for common document formats
+# 
+# Convert binary document formats to text before diffing them. This feature
+# is only available from the command line. Turn it on by uncommenting the 
+# entries below.
+###############################################################################
+#*.doc   diff=astextplain
+#*.DOC   diff=astextplain
+#*.docx  diff=astextplain
+#*.DOCX  diff=astextplain
+#*.dot   diff=astextplain
+#*.DOT   diff=astextplain
+#*.pdf   diff=astextplain
+#*.PDF   diff=astextplain
+#*.rtf   diff=astextplain
+#*.RTF   diff=astextplain
@@ -0,0 +1,261 @@
+## Ignore Visual Studio temporary files, build results, and
+## files generated by popular Visual Studio add-ons.
+
+# User-specific files
+*.suo
+*.user
+*.userosscache
+*.sln.docstates
+
+# User-specific files (MonoDevelop/Xamarin Studio)
+*.userprefs
+
+# Build results
+[Dd]ebug/
+[Dd]ebugPublic/
+[Rr]elease/
+[Rr]eleases/
+x64/
+x86/
+bld/
+[Bb]in/
+[Oo]bj/
+[Ll]og/
+
+# Visual Studio 2015 cache/options directory
+.vs/
+# Uncomment if you have tasks that create the project's static files in wwwroot
+#wwwroot/
+
+# MSTest test Results
+[Tt]est[Rr]esult*/
+[Bb]uild[Ll]og.*
+
+# NUNIT
+*.VisualState.xml
+TestResult.xml
+
+# Build Results of an ATL Project
+[Dd]ebugPS/
+[Rr]eleasePS/
+dlldata.c
+
+# DNX
+project.lock.json
+project.fragment.lock.json
+artifacts/
+
+*_i.c
+*_p.c
+*_i.h
+*.ilk
+*.meta
+*.obj
+*.pch
+*.pdb
+*.pgc
+*.pgd
+*.rsp
+*.sbr
+*.tlb
+*.tli
+*.tlh
+*.tmp
+*.tmp_proj
+*.log
+*.vspscc
+*.vssscc
+.builds
+*.pidb
+*.svclog
+*.scc
+
+# Chutzpah Test files
+_Chutzpah*
+
+# Visual C++ cache files
+ipch/
+*.aps
+*.ncb
+*.opendb
+*.opensdf
+*.sdf
+*.cachefile
+*.VC.db
+*.VC.VC.opendb
+
+# Visual Studio profiler
+*.psess
+*.vsp
+*.vspx
+*.sap
+
+# TFS 2012 Local Workspace
+$tf/
+
+# Guidance Automation Toolkit
+*.gpState
+
+# ReSharper is a .NET coding add-in
+_ReSharper*/
+*.[Rr]e[Ss]harper
+*.DotSettings.user
+
+# JustCode is a .NET coding add-in
+.JustCode
+
+# TeamCity is a build add-in
+_TeamCity*
+
+# DotCover is a Code Coverage Tool
+*.dotCover
+
+# NCrunch
+_NCrunch_*
+.*crunch*.local.xml
+nCrunchTemp_*
+
+# MightyMoose
+*.mm.*
+AutoTest.Net/
+
+# Web workbench (sass)
+.sass-cache/
+
+# Installshield output folder
+[Ee]xpress/
+
+# DocProject is a documentation generator add-in
+DocProject/buildhelp/
+DocProject/Help/*.HxT
+DocProject/Help/*.HxC
+DocProject/Help/*.hhc
+DocProject/Help/*.hhk
+DocProject/Help/*.hhp
+DocProject/Help/Html2
+DocProject/Help/html
+
+# Click-Once directory
+publish/
+
+# Publish Web Output
+*.[Pp]ublish.xml
+*.azurePubxml
+# TODO: Comment the next line if you want to checkin your web deploy settings
+# but database connection strings (with potential passwords) will be unencrypted
+#*.pubxml
+*.publishproj
+
+# Microsoft Azure Web App publish settings. Comment the next line if you want to
+# checkin your Azure Web App publish settings, but sensitive information contained
+# in these scripts will be unencrypted
+PublishScripts/
+
+# NuGet Packages
+*.nupkg
+# The packages folder can be ignored because of Package Restore
+**/packages/*
+# except build/, which is used as an MSBuild target.
+!**/packages/build/
+# Uncomment if necessary however generally it will be regenerated when needed
+#!**/packages/repositories.config
+# NuGet v3's project.json files produces more ignoreable files
+*.nuget.props
+*.nuget.targets
+
+# Microsoft Azure Build Output
+csx/
+*.build.csdef
+
+# Microsoft Azure Emulator
+ecf/
+rcf/
+
+# Windows Store app package directories and files
+AppPackages/
+BundleArtifacts/
+Package.StoreAssociation.xml
+_pkginfo.txt
+
+# Visual Studio cache files
+# files ending in .cache can be ignored
+*.[Cc]ache
+# but keep track of directories ending in .cache
+!*.[Cc]ache/
+
+# Others
+ClientBin/
+~$*
+*~
+*.dbmdl
+*.dbproj.schemaview
+*.jfm
+*.pfx
+*.publishsettings
+node_modules/
+orleans.codegen.cs
+
+# Since there are multiple workflows, uncomment next line to ignore bower_components
+# (https://github.com/github/gitignore/pull/1529#issuecomment-104372622)
+#bower_components/
+
+# RIA/Silverlight projects
+Generated_Code/
+
+# Backup & report files from converting an old project file
+# to a newer Visual Studio version. Backup files are not needed,
+# because we have git ;-)
+_UpgradeReport_Files/
+Backup*/
+UpgradeLog*.XML
+UpgradeLog*.htm
+
+# SQL Server files
+*.mdf
+*.ldf
+
+# Business Intelligence projects
+*.rdl.data
+*.bim.layout
+*.bim_*.settings
+
+# Microsoft Fakes
+FakesAssemblies/
+
+# GhostDoc plugin setting file
+*.GhostDoc.xml
+
+# Node.js Tools for Visual Studio
+.ntvs_analysis.dat
+
+# Visual Studio 6 build log
+*.plg
+
+# Visual Studio 6 workspace options file
+*.opt
+
+# Visual Studio LightSwitch build output
+**/*.HTMLClient/GeneratedArtifacts
+**/*.DesktopClient/GeneratedArtifacts
+**/*.DesktopClient/ModelManifest.xml
+**/*.Server/GeneratedArtifacts
+**/*.Server/ModelManifest.xml
+_Pvt_Extensions
+
+# Paket dependency manager
+.paket/paket.exe
+paket-files/
+
+# FAKE - F# Make
+.fake/
+
+# JetBrains Rider
+.idea/
+*.sln.iml
+
+# CodeRush
+.cr/
+
+# Python Tools for Visual Studio (PTVS)
+__pycache__/
+*.pyc
@@ -0,0 +1,61 @@
+
+Microsoft Visual Studio Solution File, Format Version 12.00
+# Visual Studio 15
+VisualStudioVersion = 15.0.28307.902
+MinimumVisualStudioVersion = 10.0.40219.1
+Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "PE2Shellcode", "PE2Shellcode\PE2Shellcode.vcxproj", "{E1A5BE0D-F978-45C7-BEF3-8F010D65EA82}"
+EndProject
+Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "PELoader", "PELoader\PELoader.vcxproj", "{1BFE8FDC-A162-4ACA-9964-535BC853DD9F}"
+EndProject
+Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "Test", "Test\Test.vcxproj", "{0B7FEBF4-FBCE-46E7-B864-398625233D5C}"
+EndProject
+Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "TestBin", "TestBin\TestBin.vcxproj", "{4A4DA453-788F-4D22-9A09-2134143DA1E3}"
+EndProject
+Global
+	GlobalSection(SolutionConfigurationPlatforms) = preSolution
+		Debug|x64 = Debug|x64
+		Debug|x86 = Debug|x86
+		Release|x64 = Release|x64
+		Release|x86 = Release|x86
+	EndGlobalSection
+	GlobalSection(ProjectConfigurationPlatforms) = postSolution
+		{E1A5BE0D-F978-45C7-BEF3-8F010D65EA82}.Debug|x64.ActiveCfg = Debug|x64
+		{E1A5BE0D-F978-45C7-BEF3-8F010D65EA82}.Debug|x64.Build.0 = Debug|x64
+		{E1A5BE0D-F978-45C7-BEF3-8F010D65EA82}.Debug|x86.ActiveCfg = Debug|Win32
+		{E1A5BE0D-F978-45C7-BEF3-8F010D65EA82}.Debug|x86.Build.0 = Debug|Win32
+		{E1A5BE0D-F978-45C7-BEF3-8F010D65EA82}.Release|x64.ActiveCfg = Release|x64
+		{E1A5BE0D-F978-45C7-BEF3-8F010D65EA82}.Release|x64.Build.0 = Release|x64
+		{E1A5BE0D-F978-45C7-BEF3-8F010D65EA82}.Release|x86.ActiveCfg = Release|Win32
+		{E1A5BE0D-F978-45C7-BEF3-8F010D65EA82}.Release|x86.Build.0 = Release|Win32
+		{1BFE8FDC-A162-4ACA-9964-535BC853DD9F}.Debug|x64.ActiveCfg = Debug|x64
+		{1BFE8FDC-A162-4ACA-9964-535BC853DD9F}.Debug|x64.Build.0 = Debug|x64
+		{1BFE8FDC-A162-4ACA-9964-535BC853DD9F}.Debug|x86.ActiveCfg = Debug|Win32
+		{1BFE8FDC-A162-4ACA-9964-535BC853DD9F}.Debug|x86.Build.0 = Debug|Win32
+		{1BFE8FDC-A162-4ACA-9964-535BC853DD9F}.Release|x64.ActiveCfg = Release|x64
+		{1BFE8FDC-A162-4ACA-9964-535BC853DD9F}.Release|x64.Build.0 = Release|x64
+		{1BFE8FDC-A162-4ACA-9964-535BC853DD9F}.Release|x86.ActiveCfg = Release|Win32
+		{1BFE8FDC-A162-4ACA-9964-535BC853DD9F}.Release|x86.Build.0 = Release|Win32
+		{0B7FEBF4-FBCE-46E7-B864-398625233D5C}.Debug|x64.ActiveCfg = Debug|x64
+		{0B7FEBF4-FBCE-46E7-B864-398625233D5C}.Debug|x64.Build.0 = Debug|x64
+		{0B7FEBF4-FBCE-46E7-B864-398625233D5C}.Debug|x86.ActiveCfg = Debug|Win32
+		{0B7FEBF4-FBCE-46E7-B864-398625233D5C}.Debug|x86.Build.0 = Debug|Win32
+		{0B7FEBF4-FBCE-46E7-B864-398625233D5C}.Release|x64.ActiveCfg = Release|x64
+		{0B7FEBF4-FBCE-46E7-B864-398625233D5C}.Release|x64.Build.0 = Release|x64
+		{0B7FEBF4-FBCE-46E7-B864-398625233D5C}.Release|x86.ActiveCfg = Release|Win32
+		{0B7FEBF4-FBCE-46E7-B864-398625233D5C}.Release|x86.Build.0 = Release|Win32
+		{4A4DA453-788F-4D22-9A09-2134143DA1E3}.Debug|x64.ActiveCfg = Debug|x64
+		{4A4DA453-788F-4D22-9A09-2134143DA1E3}.Debug|x64.Build.0 = Debug|x64
+		{4A4DA453-788F-4D22-9A09-2134143DA1E3}.Debug|x86.ActiveCfg = Debug|Win32
+		{4A4DA453-788F-4D22-9A09-2134143DA1E3}.Debug|x86.Build.0 = Debug|Win32
+		{4A4DA453-788F-4D22-9A09-2134143DA1E3}.Release|x64.ActiveCfg = Release|x64
+		{4A4DA453-788F-4D22-9A09-2134143DA1E3}.Release|x64.Build.0 = Release|x64
+		{4A4DA453-788F-4D22-9A09-2134143DA1E3}.Release|x86.ActiveCfg = Release|Win32
+		{4A4DA453-788F-4D22-9A09-2134143DA1E3}.Release|x86.Build.0 = Release|Win32
+	EndGlobalSection
+	GlobalSection(SolutionProperties) = preSolution
+		HideSolutionNode = FALSE
+	EndGlobalSection
+	GlobalSection(ExtensibilityGlobals) = postSolution
+		SolutionGuid = {AF919E2B-7D17-417B-9C97-56573C7C3D3B}
+	EndGlobalSection
+EndGlobal
@@ -0,0 +1,169 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project DefaultTargets="Build" ToolsVersion="15.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <ItemGroup Label="ProjectConfigurations">
+    <ProjectConfiguration Include="Debug|Win32">
+      <Configuration>Debug</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Release|Win32">
+      <Configuration>Release</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Debug|x64">
+      <Configuration>Debug</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Release|x64">
+      <Configuration>Release</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+  </ItemGroup>
+  <PropertyGroup Label="Globals">
+    <VCProjectVersion>15.0</VCProjectVersion>
+    <ProjectGuid>{E1A5BE0D-F978-45C7-BEF3-8F010D65EA82}</ProjectGuid>
+    <Keyword>Win32Proj</Keyword>
+    <RootNamespace>PE2Shellcode</RootNamespace>
+    <WindowsTargetPlatformVersion>10.0.18362.0</WindowsTargetPlatformVersion>
+    <ProjectName>PE2Shellcode</ProjectName>
+  </PropertyGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseDebugLibraries>true</UseDebugLibraries>
+    <PlatformToolset>v141</PlatformToolset>
+    <CharacterSet>Unicode</CharacterSet>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseDebugLibraries>false</UseDebugLibraries>
+    <PlatformToolset>v141</PlatformToolset>
+    <WholeProgramOptimization>true</WholeProgramOptimization>
+    <CharacterSet>Unicode</CharacterSet>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseDebugLibraries>true</UseDebugLibraries>
+    <PlatformToolset>v141</PlatformToolset>
+    <CharacterSet>Unicode</CharacterSet>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseDebugLibraries>false</UseDebugLibraries>
+    <PlatformToolset>v141</PlatformToolset>
+    <WholeProgramOptimization>true</WholeProgramOptimization>
+    <CharacterSet>Unicode</CharacterSet>
+  </PropertyGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
+  <ImportGroup Label="ExtensionSettings">
+  </ImportGroup>
+  <ImportGroup Label="Shared">
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <PropertyGroup Label="UserMacros" />
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
+    <LinkIncremental>true</LinkIncremental>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
+    <LinkIncremental>true</LinkIncremental>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+    <LinkIncremental>false</LinkIncremental>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
+    <LinkIncremental>false</LinkIncremental>
+  </PropertyGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
+    <ClCompile>
+      <WarningLevel>Level3</WarningLevel>
+      <Optimization>Disabled</Optimization>
+      <SDLCheck>true</SDLCheck>
+      <PreprocessorDefinitions>WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <ConformanceMode>true</ConformanceMode>
+      <RuntimeLibrary>MultiThreaded</RuntimeLibrary>
+    </ClCompile>
+    <Link>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+      <SubSystem>Console</SubSystem>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
+    <ClCompile>
+      <WarningLevel>Level3</WarningLevel>
+      <Optimization>Disabled</Optimization>
+      <SDLCheck>true</SDLCheck>
+      <PreprocessorDefinitions>_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <ConformanceMode>true</ConformanceMode>
+    </ClCompile>
+    <Link>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+      <SubSystem>Console</SubSystem>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+    <ClCompile>
+      <WarningLevel>Level3</WarningLevel>
+      <Optimization>MaxSpeed</Optimization>
+      <FunctionLevelLinking>true</FunctionLevelLinking>
+      <IntrinsicFunctions>true</IntrinsicFunctions>
+      <SDLCheck>true</SDLCheck>
+      <PreprocessorDefinitions>WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <ConformanceMode>true</ConformanceMode>
+      <RuntimeLibrary>MultiThreaded</RuntimeLibrary>
+    </ClCompile>
+    <Link>
+      <EnableCOMDATFolding>true</EnableCOMDATFolding>
+      <OptimizeReferences>true</OptimizeReferences>
+      <GenerateDebugInformation>false</GenerateDebugInformation>
+      <SubSystem>Console</SubSystem>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
+    <ClCompile>
+      <WarningLevel>Level3</WarningLevel>
+      <Optimization>MaxSpeed</Optimization>
+      <FunctionLevelLinking>true</FunctionLevelLinking>
+      <IntrinsicFunctions>true</IntrinsicFunctions>
+      <SDLCheck>true</SDLCheck>
+      <PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <ConformanceMode>true</ConformanceMode>
+      <RuntimeLibrary>MultiThreaded</RuntimeLibrary>
+    </ClCompile>
+    <Link>
+      <EnableCOMDATFolding>true</EnableCOMDATFolding>
+      <OptimizeReferences>true</OptimizeReferences>
+      <GenerateDebugInformation>false</GenerateDebugInformation>
+      <SubSystem>Console</SubSystem>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemGroup>
+    <ClCompile Include="main.cpp" />
+    <ClCompile Include="PePacket.cpp" />
+    <ClCompile Include="ProccessData.cpp" />
+  </ItemGroup>
+  <ItemGroup>
+    <ClInclude Include="PePacket.h" />
+    <ClInclude Include="ProccessData.h" />
+    <ClInclude Include="resource.h" />
+  </ItemGroup>
+  <ItemGroup>
+    <ResourceCompile Include="PE2Shellcode.rc" />
+  </ItemGroup>
+  <ItemGroup>
+    <None Include="..\..\x64.bin" />
+    <None Include="..\PELoader\x86.bin" />
+  </ItemGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
+  <ImportGroup Label="ExtensionTargets">
+  </ImportGroup>
+</Project>
@@ -0,0 +1,52 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <ItemGroup>
+    <Filter Include="源文件">
+      <UniqueIdentifier>{4FC737F1-C7A5-4376-A066-2A32D752A2FF}</UniqueIdentifier>
+      <Extensions>cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx</Extensions>
+    </Filter>
+    <Filter Include="头文件">
+      <UniqueIdentifier>{93995380-89BD-4b04-88EB-625FBE52EBFB}</UniqueIdentifier>
+      <Extensions>h;hh;hpp;hxx;hm;inl;inc;ipp;xsd</Extensions>
+    </Filter>
+    <Filter Include="资源文件">
+      <UniqueIdentifier>{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}</UniqueIdentifier>
+      <Extensions>rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms</Extensions>
+    </Filter>
+  </ItemGroup>
+  <ItemGroup>
+    <ClCompile Include="ProccessData.cpp">
+      <Filter>源文件</Filter>
+    </ClCompile>
+    <ClCompile Include="main.cpp">
+      <Filter>源文件</Filter>
+    </ClCompile>
+    <ClCompile Include="PePacket.cpp">
+      <Filter>源文件</Filter>
+    </ClCompile>
+  </ItemGroup>
+  <ItemGroup>
+    <ClInclude Include="PePacket.h">
+      <Filter>头文件</Filter>
+    </ClInclude>
+    <ClInclude Include="ProccessData.h">
+      <Filter>头文件</Filter>
+    </ClInclude>
+    <ClInclude Include="resource.h">
+      <Filter>头文件</Filter>
+    </ClInclude>
+  </ItemGroup>
+  <ItemGroup>
+    <ResourceCompile Include="PE2Shellcode.rc">
+      <Filter>资源文件</Filter>
+    </ResourceCompile>
+  </ItemGroup>
+  <ItemGroup>
+    <None Include="..\PELoader\x86.bin">
+      <Filter>资源文件</Filter>
+    </None>
+    <None Include="..\..\x64.bin">
+      <Filter>资源文件</Filter>
+    </None>
+  </ItemGroup>
+</Project>
@@ -0,0 +1,334 @@
+#include "PePacket.h"
+#include "ProccessData.h"
+#include "resource.h"
+CPePacket::CPePacket()
+{
+	rc4Flag = FALSE;
+	cmpFlag = FALSE;
+	data = NULL;
+	head = NULL;
+	shellcode = NULL;
+	dataSize = 0;
+}
+CPePacket::~CPePacket()
+{
+	if (data != NULL)
+		delete data;
+	data = NULL;
+
+	if (head != NULL)
+		delete head;
+	head = NULL;
+
+	if (shellcode != NULL)
+		delete shellcode;
+	shellcode = NULL;
+
+	dataSize = 0;
+	headSize = 0;
+	shellSize = 0;
+}
+
+
+int CPePacket::ParsePara(int argc, wchar_t ** argv)
+{
+	if (argc <= 2)
+	{
+		printf("Used : PE2Shellcode.exe <path of PE>[output path] [-?]\n");
+		printf("[-r] Rc4 encrypt\n");
+		printf("[-c] Compress PE file\n");
+		return 1;
+	}
+
+	srcExePath = argv[1];
+	targetBinPath = argv[2];
+
+	if (argc > 2)
+	{
+		for (int i = 3; i < argc; i++)
+		{
+			if (wcscmp(L"-r", argv[i]) == 0 && wcslen(argv[i]) == 2)
+				rc4Flag = true;
+
+			else if (wcscmp(L"-c", argv[i]) == 0 && wcslen(argv[i]) == 2)
+				cmpFlag = true;
+		}
+	}
+
+	return 0;
+}
+
+BOOL CPePacket::IsExeFile()
+{
+#ifdef _WIN64
+	int bit = 64;
+#else
+	int bit = 32;
+#endif
+
+
+	PIMAGE_DOS_HEADER pDos = (PIMAGE_DOS_HEADER)data;
+
+	PIMAGE_NT_HEADERS pNt = (PIMAGE_NT_HEADERS)(data + pDos->e_lfanew);
+
+	if (pDos->e_magic != IMAGE_DOS_SIGNATURE)
+	{
+		printf("[!] The file is not PE file.\n");
+		return 1;
+	}
+	if (pNt->Signature != IMAGE_NT_SIGNATURE)
+	{
+		printf("[!] The file is not PE file.\n");
+		return 1;
+	}
+
+	if ((pNt->FileHeader.Characteristics & IMAGE_FILE_DLL) == IMAGE_FILE_DLL)
+	{
+		printf("[!] DLL file is not supported.\n");
+		return 1;
+	}
+
+	DWORD offsetDonet = pNt->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR].VirtualAddress;
+	if (offsetDonet)
+	{
+		printf("[!] .NET applications are not supported.\n");
+		return 1;
+	}
+
+	if (pNt->FileHeader.Machine == IMAGE_FILE_MACHINE_I386 && bit == 32)
+	{
+		return 0;
+	}
+	else if ((pNt->FileHeader.Machine == IMAGE_FILE_MACHINE_IA64 ||
+		pNt->FileHeader.Machine == IMAGE_FILE_MACHINE_AMD64) && bit == 64)
+	{
+		return 0;
+	}
+
+	printf("[!] Bits of PE file is not match.\n");
+	return 1;
+}
+
+int CPePacket::ReadFileContent()
+{
+
+	char buffer[1024];
+	DWORD filesize;
+	DWORD dwReadBytes;
+	int Result = 0;
+
+
+	HANDLE hFile = INVALID_HANDLE_VALUE;
+	do
+	{
+		hFile = CreateFileW(srcExePath, GENERIC_READ | GENERIC_WRITE, 0, NULL, OPEN_EXISTING, 0, NULL);
+		if (hFile == INVALID_HANDLE_VALUE)
+		{
+			Result = GetLastError();
+			printf("[-] Open src file failed.ErrorCode:%d\n", Result);
+			break;
+		}
+		filesize = GetFileSize(hFile, NULL);
+		data = new char[filesize];
+		char *p = data;
+		while (1)
+		{
+			if (!ReadFile(hFile, buffer, 1024, &dwReadBytes, NULL))
+			{
+				Result = GetLastError();
+				printf("[-] ReadFile failed.ErrorCode:%d\n", Result);
+				break;
+			}
+			if (dwReadBytes == 0)
+				break;
+			memcpy(p, buffer, dwReadBytes);
+			p += dwReadBytes;
+			dataSize += dwReadBytes;
+		}
+	} while (FALSE);
+	if (hFile != INVALID_HANDLE_VALUE)
+		CloseHandle(hFile);
+
+	return Result;
+}
+
+int CPePacket::CreateBinFile()
+{
+
+	HANDLE hFile = INVALID_HANDLE_VALUE;
+	DWORD dwWriteBytes;
+	int Result = 0;
+	do
+	{
+		hFile = CreateFileW(targetBinPath, GENERIC_READ | GENERIC_WRITE, 0, NULL, CREATE_ALWAYS, 0, NULL);
+		if (hFile == INVALID_HANDLE_VALUE)
+		{
+			Result = GetLastError();
+			printf("[-] Create bin file failed. ErrorCode:%d\n", Result);
+			break;
+		}
+		if (!WriteFile(hFile, shellcode, shellSize, &dwWriteBytes, NULL) ||
+			!WriteFile(hFile, head, headSize, &dwWriteBytes, NULL) ||
+			!WriteFile(hFile, data, dataSize, &dwWriteBytes, NULL)
+			)
+		{
+			Result = GetLastError();
+			printf("[-] Write bin file failed. ErrorCode:%d\n", Result);
+			break;
+		}
+
+	} while (FALSE);
+	
+
+	if(hFile != INVALID_HANDLE_VALUE)
+		CloseHandle(hFile);
+	return Result;
+}
+
+
+int CPePacket::GetCustomHead()
+{
+	PIMAGE_DOS_HEADER pDos = (PIMAGE_DOS_HEADER)data;
+
+	PIMAGE_NT_HEADERS pNt = (PIMAGE_NT_HEADERS)(data + pDos->e_lfanew);
+
+	customHead.size = dataSize;
+	customHead.numberOfSection = pNt->FileHeader.NumberOfSections;
+	customHead.entryPoint = pNt->OptionalHeader.AddressOfEntryPoint;
+	customHead.offsetImportTable = pNt->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress;
+	customHead.offsetRelocation = pNt->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC].VirtualAddress;
+	customHead.offsetSection = (DA)((char *)IMAGE_FIRST_SECTION(pNt) - (char *)data);
+	customHead.imageAddr = pNt->OptionalHeader.ImageBase;
+
+	//clear DOS head and NT head
+	memset(data, 0, customHead.offsetSection);
+	return 0;
+}
+
+int CPePacket::GenerateShellCode()
+{
+	if (
+		ReadFileContent() ||
+		IsExeFile() ||
+		GetCustomHead() ||
+		ProcessData() ||
+		GetResourceFile() ||
+		PacthCustomHead() ||
+		CreateBinFile()
+		)
+	{
+		printf("[-] Generate failed.\n");
+	}
+	else
+	{
+		printf("[+] Generate success.\n");
+	}
+
+
+	return 0;
+}
+
+int CPePacket::ProcessData()
+{
+	if (cmpFlag)
+	{
+		if (CProcsData::CompressData(data, dataSize, data, dataSize))
+		{
+			printf("[-] Compress PE failed.\n");
+			return 1;
+		}
+		else
+		{
+			customHead.flag1 = 1;
+			customHead.compressSize = dataSize;
+		}
+	}
+
+	if (rc4Flag)
+	{
+		if (CProcsData::Rc4Encrypt(data, dataSize, rc4Key, RC4_KEY_SIZE))
+		{
+			printf("[-] Rc4 encrypt failed.\n");
+			return 1;
+		}
+		else
+		{
+			customHead.flag2 = 1;
+			customHead.rc4Size = dataSize;
+		}
+	}
+
+	
+	return 0;
+}
+
+int CPePacket::GetResourceFile()
+{
+	HRSRC hRsrc = NULL;
+	DWORD dwSize = 0;
+	HGLOBAL hGlobal = NULL;
+	LPVOID pBuffer = NULL;
+	int Result = 0;
+	do
+	{
+#ifdef _WIN64
+		hRsrc = FindResource(NULL, MAKEINTRESOURCE(IDR_BIN2), L"BIN");
+#else
+		hRsrc = FindResource(NULL, MAKEINTRESOURCE(IDR_BIN1), L"BIN");
+#endif // _WIN64
+
+		if (hRsrc == NULL)
+		{
+			Result = GetLastError();
+			printf("[-] Find resource failed. ErrCode:%d\n", Result);
+		}
+
+		DWORD dwSize = SizeofResource(NULL, hRsrc);
+		if (dwSize == 0)
+		{
+			Result = GetLastError();
+			printf("[-] Get resource size failed. ErrCode:%d\n", Result);
+		}
+
+
+		hGlobal = LoadResource(NULL, hRsrc);
+		if (hGlobal == NULL)
+		{
+			Result = GetLastError();
+			printf("[-] Load resource failed. ErrCode:%d\n", Result);
+		}
+
+		 pBuffer = LockResource(hGlobal);
+
+		if (pBuffer == NULL)
+		{
+			Result = GetLastError();
+			printf("[-] Lock resource failed. ErrCode:%d\n", Result);
+		}
+
+
+		shellcode = new char[dwSize];
+		
+		memcpy(shellcode, pBuffer, dwSize);
+		shellSize = dwSize;
+
+	} while (FALSE);
+	
+	if(hGlobal != NULL)
+		GlobalUnlock(hGlobal);
+
+
+	return Result;
+}
+
+
+int CPePacket::PacthCustomHead()
+{
+	//patch head
+	head = new char[headSize];
+	unsigned char sign[] = { '\xaa','\xbb', '\xcc', '\xdd', '\x01', '\x01', '\x01', '\x01'};
+	memcpy(head, sign, 8);
+	memcpy(head + 8, &customHead, sizeof(CustomHead));
+	memcpy(head + 8 + sizeof(CustomHead), rc4Key, sizeof(rc4Key));
+	return 0;
+}
@@ -0,0 +1,101 @@
+#pragma once
+
+#include <Windows.h>
+#include <string>
+#include <iostream>
+#include <time.h>
+/*
+shellcode struct
+
+			+------------+
+			|   PE Load  |
+			+------------+
+			|    Head    |   <--- sign + struct CustomHead + rc4key
+			+------------+   
+			|            |
+			|    exe     |
+			|            |
+			+------------+
+
+*/
+#pragma pack(push, 1)
+#ifdef _WIN64
+typedef ULONG64 QWORD;
+typedef QWORD DA;
+typedef struct CustomHead
+{
+	QWORD size;//PE size
+	QWORD offsetSection;
+	QWORD numberOfSection;
+	QWORD offsetRelocation;
+	QWORD imageAddr;
+	QWORD offsetImportTable;
+	QWORD entryPoint;
+	QWORD flag1;
+	QWORD compressSize;
+	QWORD flag2;
+	QWORD rc4Size;
+}*pCustomHead;
+#else
+typedef DWORD DA;
+typedef struct CustomHead
+{
+	DWORD size;//PE size
+	DWORD offsetSection;
+	DWORD numberOfSection;
+	DWORD offsetRelocation;
+	DWORD imageAddr;
+	DWORD offsetImportTable;
+	DWORD entryPoint;
+	DWORD flag1;
+	DWORD compressSize;
+	DWORD flag2;
+	DWORD rc4Size;
+}*pCustomHead;
+#endif // _WIN64
+#pragma pack(pop)
+
+#define SIGN_SIZE 8
+#define RC4_KEY_SIZE 16
+
+class CPePacket
+{
+public:
+	CPePacket();
+	~CPePacket();
+
+
+	int ParsePara(int argc, wchar_t ** argv);
+
+	BOOL IsExeFile();
+
+	int ReadFileContent();
+
+	int CreateBinFile();
+	
+	int PacthCustomHead();
+
+	int GetCustomHead();
+
+	int GenerateShellCode();
+
+	int ProcessData();
+
+	int GetResourceFile();
+
+private:
+	wchar_t *srcExePath;
+	wchar_t *targetBinPath;
+
+	BOOL rc4Flag;
+	BOOL cmpFlag;
+
+	char * head;
+	int headSize = SIGN_SIZE + RC4_KEY_SIZE + sizeof(CustomHead);
+	char * data;
+	int dataSize;
+	char * shellcode;
+	int shellSize;
+	unsigned char rc4Key[RC4_KEY_SIZE];
+	CustomHead customHead;
+};
@@ -0,0 +1,102 @@
+#include <time.h>
+#include <Windows.h>
+#include <iostream>
+#include "ProccessData.h"
+
+int CProcsData::Rc4Encrypt(char * org, int size, unsigned char * rc4Key, int keySize)
+{
+	//create key
+	srand((int)time(0));
+	int i = 0;
+	while (1) {
+		unsigned char r = rand() % 255;
+		if (0x30 <= r && r <= 0x39 || 0x41 <= r && r <= 0x5a || 0x61 <= r && r <= 0x7a)
+		{
+			rc4Key[i++] = r;
+		}
+		if (i > keySize) break;
+	}
+
+
+	unsigned char box[256];
+	unsigned int index_i = 0;
+	unsigned int index_j = 0;
+
+	//init box
+	for (int i = 0; i < 256; i++)
+	{
+		box[i] = i;
+	}
+
+	int j = 0;
+	unsigned char tmp;
+	for (int i = 0; i < 256; i++)
+	{
+		j = (j + box[i] + rc4Key[i % 16]) % 256;
+		tmp = box[i];
+		box[i] = box[j];
+		box[j] = tmp;
+	}
+
+	for (unsigned long k = 0; k < size; k++)
+	{
+		index_i = (index_i + 1) % 256;
+		index_j = (index_j + box[index_i]) % 256;
+
+		tmp = box[index_i];
+		box[index_i] = box[index_j];
+		box[index_j] = tmp;
+
+		DWORD r = (box[index_i] + box[index_j]) % 256;
+		org[k] ^= box[r];
+	}
+	return 0;
+}
+
+int CProcsData::CompressData(char * src, int size, char * retData, int & retSize)
+{
+
+	DWORD dwCompressionFormat = COMPRESSION_FORMAT_LZNT1 | COMPRESSION_ENGINE_MAXIMUM;
+	DWORD dwCompress;
+	DWORD unKnow;
+
+	pRtlCompressBuffer f_RtlCompressBuffer = (pRtlCompressBuffer)GetProcAddress(GetModuleHandleA("ntdll.dll"), "RtlCompressBuffer");
+	pRtlGetCompressionWorkSpaceSize f_RelGetCompressionWorkApacesize = (pRtlGetCompressionWorkSpaceSize)GetProcAddress(GetModuleHandleA("ntdll.dll"), "RtlGetCompressionWorkSpaceSize");
+	if (f_RtlCompressBuffer == NULL || f_RelGetCompressionWorkApacesize == NULL)
+	{
+		printf("[-] Get Function failed.\n");
+		return 1;
+	}
+
+
+	f_RelGetCompressionWorkApacesize(dwCompressionFormat, &dwCompress, &unKnow);
+
+	char *tempMem = new char[dwCompress];
+	char *tempData = new char[size];
+
+	DWORD ret = f_RtlCompressBuffer(
+		dwCompressionFormat,
+		src,
+		size,
+		tempData,
+		size,
+		unKnow,
+		&dwCompress,
+		tempMem
+	);
+
+	if (ret == 0)
+	{
+		retSize = dwCompress;
+		memcpy(retData, tempData, retSize);
+		
+	}
+	else
+	{
+		printf("[-] Compress PE failed.\n");
+	}
+
+	delete tempMem;
+	delete tempData;
+	return ret;
+}
@@ -0,0 +1,24 @@
+#pragma once
+typedef DWORD(__stdcall *pRtlCompressBuffer)(
+	IN ULONG   CompressionFormat,
+	IN PVOID   SourceBuffer,
+	IN ULONG   SourceBufferLength,
+	OUT PVOID   DestinationBuffer,
+	IN ULONG   DestinationBufferLength,
+	IN ULONG   Unknown,
+	OUT PULONG   pDestinationSize,
+	IN PVOID   WorkspaceBuffer);
+
+
+typedef DWORD(__stdcall *pRtlGetCompressionWorkSpaceSize)(
+	IN ULONG   CompressionFormat,
+	OUT PULONG   pNeededBufferSize,
+	OUT PULONG   pUnknown);
+
+namespace CProcsData
+{
+
+	int Rc4Encrypt(char * org, int size, unsigned char * rc4Key, int keySize);
+
+	int CompressData(char *org, int size, char * retData ,int & retSize);
+}
@@ -0,0 +1,20 @@
+#include <Windows.h>
+#include <iostream>
+
+#include "PePacket.h"
+
+int wmain(int argc, wchar_t * argv[])
+{
+
+	CPePacket pePacket;
+
+	if (pePacket.ParsePara(argc, argv))
+	{
+		printf("Invaild para\n");
+		exit(0);
+	}
+	
+	pePacket.GenerateShellCode();
+
+	return 0;
+}
@@ -0,0 +1,17 @@
+//{{NO_DEPENDENCIES}}
+// Microsoft Visual C++ 生成的包含文件。
+// 供 PE2Shellcode.rc 使用
+//
+#define IDR_BIN1                        101
+#define IDR_BIN2                        102
+
+// Next default values for new objects
+// 
+#ifdef APSTUDIO_INVOKED
+#ifndef APSTUDIO_READONLY_SYMBOLS
+#define _APS_NEXT_RESOURCE_VALUE        103
+#define _APS_NEXT_COMMAND_VALUE         40001
+#define _APS_NEXT_CONTROL_VALUE         1001
+#define _APS_NEXT_SYMED_VALUE           101
+#endif
+#endif
@@ -0,0 +1,185 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project DefaultTargets="Build" ToolsVersion="15.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <ItemGroup Label="ProjectConfigurations">
+    <ProjectConfiguration Include="Debug|Win32">
+      <Configuration>Debug</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Release|Win32">
+      <Configuration>Release</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Debug|x64">
+      <Configuration>Debug</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Release|x64">
+      <Configuration>Release</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+  </ItemGroup>
+  <PropertyGroup Label="Globals">
+    <VCProjectVersion>15.0</VCProjectVersion>
+    <ProjectGuid>{1BFE8FDC-A162-4ACA-9964-535BC853DD9F}</ProjectGuid>
+    <Keyword>Win32Proj</Keyword>
+    <RootNamespace>PELoader</RootNamespace>
+    <WindowsTargetPlatformVersion>10.0.18362.0</WindowsTargetPlatformVersion>
+  </PropertyGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseDebugLibraries>true</UseDebugLibraries>
+    <PlatformToolset>v141</PlatformToolset>
+    <CharacterSet>Unicode</CharacterSet>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseDebugLibraries>false</UseDebugLibraries>
+    <PlatformToolset>v141</PlatformToolset>
+    <WholeProgramOptimization>true</WholeProgramOptimization>
+    <CharacterSet>Unicode</CharacterSet>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseDebugLibraries>true</UseDebugLibraries>
+    <PlatformToolset>v141</PlatformToolset>
+    <CharacterSet>Unicode</CharacterSet>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseDebugLibraries>false</UseDebugLibraries>
+    <PlatformToolset>v141</PlatformToolset>
+    <WholeProgramOptimization>true</WholeProgramOptimization>
+    <CharacterSet>Unicode</CharacterSet>
+  </PropertyGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
+  <ImportGroup Label="ExtensionSettings">
+  </ImportGroup>
+  <ImportGroup Label="Shared">
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <PropertyGroup Label="UserMacros" />
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
+    <LinkIncremental>true</LinkIncremental>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
+    <LinkIncremental>true</LinkIncremental>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+    <LinkIncremental>false</LinkIncremental>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
+    <LinkIncremental>false</LinkIncremental>
+  </PropertyGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
+    <ClCompile>
+      <WarningLevel>Level3</WarningLevel>
+      <Optimization>MinSpace</Optimization>
+      <SDLCheck>false</SDLCheck>
+      <PreprocessorDefinitions>WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <ConformanceMode>true</ConformanceMode>
+      <BufferSecurityCheck>false</BufferSecurityCheck>
+      <SupportJustMyCode>false</SupportJustMyCode>
+      <IntrinsicFunctions>true</IntrinsicFunctions>
+      <FunctionLevelLinking>true</FunctionLevelLinking>
+      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
+      <BasicRuntimeChecks>Default</BasicRuntimeChecks>
+    </ClCompile>
+    <Link>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+      <SubSystem>Console</SubSystem>
+      <EnableCOMDATFolding>true</EnableCOMDATFolding>
+      <GenerateMapFile>true</GenerateMapFile>
+      <MapFileName>mapfile</MapFileName>
+      <FunctionOrder>order.txt</FunctionOrder>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
+    <ClCompile>
+      <WarningLevel>Level3</WarningLevel>
+      <Optimization>MinSpace</Optimization>
+      <SDLCheck>false</SDLCheck>
+      <PreprocessorDefinitions>_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <ConformanceMode>true</ConformanceMode>
+      <BufferSecurityCheck>false</BufferSecurityCheck>
+      <BasicRuntimeChecks>Default</BasicRuntimeChecks>
+      <SupportJustMyCode>false</SupportJustMyCode>
+      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
+      <FunctionLevelLinking>true</FunctionLevelLinking>
+      <WholeProgramOptimization>false</WholeProgramOptimization>
+      <DebugInformationFormat>EditAndContinue</DebugInformationFormat>
+      <IntrinsicFunctions>true</IntrinsicFunctions>
+    </ClCompile>
+    <Link>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+      <SubSystem>Console</SubSystem>
+      <EnableCOMDATFolding>true</EnableCOMDATFolding>
+      <GenerateMapFile>true</GenerateMapFile>
+      <MapFileName>mapfile64</MapFileName>
+      <FunctionOrder>order.txt</FunctionOrder>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+    <ClCompile>
+      <WarningLevel>Level3</WarningLevel>
+      <Optimization>MaxSpeed</Optimization>
+      <FunctionLevelLinking>true</FunctionLevelLinking>
+      <IntrinsicFunctions>true</IntrinsicFunctions>
+      <SDLCheck>true</SDLCheck>
+      <PreprocessorDefinitions>WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <ConformanceMode>true</ConformanceMode>
+    </ClCompile>
+    <Link>
+      <EnableCOMDATFolding>true</EnableCOMDATFolding>
+      <OptimizeReferences>true</OptimizeReferences>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+      <SubSystem>Console</SubSystem>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
+    <ClCompile>
+      <WarningLevel>Level3</WarningLevel>
+      <Optimization>MaxSpeed</Optimization>
+      <FunctionLevelLinking>true</FunctionLevelLinking>
+      <IntrinsicFunctions>true</IntrinsicFunctions>
+      <SDLCheck>true</SDLCheck>
+      <PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <ConformanceMode>true</ConformanceMode>
+    </ClCompile>
+    <Link>
+      <EnableCOMDATFolding>true</EnableCOMDATFolding>
+      <OptimizeReferences>true</OptimizeReferences>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+      <SubSystem>Console</SubSystem>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemGroup>
+    <ClCompile Include="Source.cpp" />
+  </ItemGroup>
+  <ItemGroup>
+    <CustomBuild Include="func.asm">
+      <ExcludedFromBuild Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">true</ExcludedFromBuild>
+      <FileType>Document</FileType>
+      <Command Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
+      </Command>
+      <Outputs Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
+      </Outputs>
+      <Command Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">ml64 /Fo $(IntDir)%(fileName).obj /c %(fileName).asm</Command>
+      <Outputs Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">$(IntDir)%(fileName).obj</Outputs>
+    </CustomBuild>
+  </ItemGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
+  <ImportGroup Label="ExtensionTargets">
+  </ImportGroup>
+</Project>
@@ -0,0 +1,27 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <ItemGroup>
+    <Filter Include="源文件">
+      <UniqueIdentifier>{4FC737F1-C7A5-4376-A066-2A32D752A2FF}</UniqueIdentifier>
+      <Extensions>cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx</Extensions>
+    </Filter>
+    <Filter Include="头文件">
+      <UniqueIdentifier>{93995380-89BD-4b04-88EB-625FBE52EBFB}</UniqueIdentifier>
+      <Extensions>h;hh;hpp;hxx;hm;inl;inc;ipp;xsd</Extensions>
+    </Filter>
+    <Filter Include="资源文件">
+      <UniqueIdentifier>{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}</UniqueIdentifier>
+      <Extensions>rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms</Extensions>
+    </Filter>
+  </ItemGroup>
+  <ItemGroup>
+    <CustomBuild Include="func.asm">
+      <Filter>源文件</Filter>
+    </CustomBuild>
+  </ItemGroup>
+  <ItemGroup>
+    <ClCompile Include="Source.cpp">
+      <Filter>资源文件</Filter>
+    </ClCompile>
+  </ItemGroup>
+</Project>
@@ -0,0 +1,10 @@
+# PELoader
+
+Binary source code embedded in the program. PE loader is not written with pure assembly, but is generated by Visual Stdiotdio 2017 and extracted. The extraction method can refer to the following information.
+
+PS: you can try to write with pure assembly, which can reduce the size of shellcode again.
+
+## Reference
+
+<https://bbs.pediy.com/thread-249133.htm>  
+<https://www.freebuf.com/column/197184.html>  
@@ -0,0 +1,461 @@
+#include <Windows.h>
+#include <winternl.h>
+#include <iostream>
+
+#pragma pack(push, 1)
+#ifdef _WIN64
+typedef ULONG64 QWORD;
+typedef QWORD DA;
+typedef struct CustomHead
+{
+	QWORD size;//PE size
+	QWORD offsetSection;
+	QWORD numberOfSection;
+	QWORD offsetRelocation;
+	QWORD imageAddr;
+	QWORD offsetImportTable;
+	QWORD entryPoint;
+	QWORD flag1;
+	QWORD compressSize;
+	QWORD flag2;
+	QWORD rc4Size;
+
+}*pCustomHead;
+#else
+typedef DWORD DA;
+typedef struct CustomHead
+{
+	DWORD size;//PE size
+	DWORD offsetSection;
+	DWORD numberOfSection;
+	DWORD offsetRelocation;
+	DWORD imageAddr;
+	DWORD offsetImportTable;
+	DWORD entryPoint;
+	DWORD flag1;
+	DWORD compressSize;
+	DWORD flag2;
+	DWORD rc4Size;
+}*pCustomHead;
+#endif // _WIN64
+#pragma pack(pop)
+
+typedef DWORD(__stdcall *pRtlDecompressBuffer)(
+	IN ULONG   CompressionFormat,
+	OUT PVOID   DestinationBuffer,
+	IN ULONG   DestinationBufferLength,
+	IN PVOID   SourceBuffer,
+	IN ULONG   SourceBufferLength,
+	OUT PULONG   pDestinationSize);
+
+
+
+DWORD getHash(const char *str) {
+
+	DWORD h = 0;
+	while (*str) {
+		h = (h >> 12) | (h << (32 - 12));
+		h += *str >= 'a' ? *str - 32 : *str;
+		str++;
+	}
+	return h;
+
+}
+
+DWORD getUnicodeHash(const wchar_t * str) {
+	DWORD h = 0;
+	PWORD ptr = (PWORD)str;
+	while (*ptr) {
+		h = (h >> 12) | (h << (32 - 12));
+		h += (BYTE)(*ptr) >= 'a' ? (BYTE)(*ptr) - 32 : (BYTE)(*ptr);
+		ptr++;
+	}
+	return h;
+}
+
+void MemCopy(char * det, char * src, DWORD size)
+{
+	while(size--)
+	{
+		*det++ = *src++;
+	}
+}
+DWORD MemCmp(char *buf1, char *buf2, DWORD size)
+{
+	while (size--)
+	{
+		if (*buf1++ != *buf2++)
+			return size;
+	}
+	return 0;
+}
+
+
+void Rc4Decrypt(char * buff, int size, unsigned char *key)
+{
+	unsigned char box[256];
+	unsigned int index_i = 0;
+	unsigned int index_j = 0;
+
+
+	//init
+	for (int i = 0; i < 256; i++)
+	{
+		box[i] = i;
+	}
+
+	int j = 0;
+	unsigned char tmp;
+	for (int i = 0; i < 256; i++)
+	{
+		j = (j + box[i] + key[i % 16]) % 256;
+		tmp = box[i];
+		box[i] = box[j];
+		box[j] = tmp;
+	}
+
+	for (unsigned long k = 0; k < size; k++)
+	{
+		index_i = (index_i + 1) % 256;    // a
+		index_j = (index_j + box[index_i]) % 256; // b
+
+		tmp = box[index_i];
+		box[index_i] = box[index_j];
+		box[index_j] = tmp;
+
+		DWORD r = (box[index_i] + box[index_j]) % 256;
+		buff[k] ^= box[r];
+	}
+
+}
+
+char * GetFunction(DWORD DLLhash,DWORD APIhash)
+{
+	_PEB *peb = NtCurrentTeb()->ProcessEnvironmentBlock;
+
+	LIST_ENTRY *first = peb->Ldr->InMemoryOrderModuleList.Flink;
+
+	LIST_ENTRY *ptr = first;
+	char *func = NULL;
+	do {
+#ifdef _WIN64
+		LDR_DATA_TABLE_ENTRY *pLdr = (LDR_DATA_TABLE_ENTRY*)((BYTE*)ptr - 0x10);
+#else // _WIN64
+		LDR_DATA_TABLE_ENTRY *pLdr = (LDR_DATA_TABLE_ENTRY*)((BYTE*)ptr - 0x8);
+#endif
+		BYTE * baseAddr = (BYTE *)pLdr->DllBase;
+
+		ptr = ptr->Flink;
+
+		if (!baseAddr) {
+			continue;
+		}
+
+		PIMAGE_DOS_HEADER pDos = (PIMAGE_DOS_HEADER)(baseAddr);
+		PIMAGE_NT_HEADERS pNt = (PIMAGE_NT_HEADERS)(baseAddr + pDos->e_lfanew);
+		PIMAGE_EXPORT_DIRECTORY pExport = (PIMAGE_EXPORT_DIRECTORY)(baseAddr + pNt->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress);
+		if (!pExport) {
+			continue;
+		}
+
+		if (getUnicodeHash(((decltype(pLdr->FullDllName)*)(DWORD*)&(pLdr->Reserved4))->Buffer) == DLLhash) {
+			DWORD* nameRVAs = (DWORD*)(baseAddr + pExport->AddressOfNames);
+
+			for (DWORD i = 0; i < pExport->NumberOfNames; i++) {
+				char* funName = (char*)(baseAddr + nameRVAs[i]);
+				//get address of function
+				if (func == NULL && getHash(funName) == APIhash) {
+					WORD ordinal = ((WORD*)(baseAddr + pExport->AddressOfNameOrdinals))[i];
+					DWORD functionRVA = ((DWORD*)(baseAddr + pExport->AddressOfFunctions))[ordinal];
+					func = (char*)(baseAddr + functionRVA);
+					break;
+				}
+			}
+		}
+		if (func != NULL) break;
+	} while (ptr != first);
+
+	return func;
+}
+
+
+
+#ifdef _WIN64
+extern "C" char * getCurrAddr(void);
+#else
+DWORD * getCurrAddr()
+{
+	DWORD *p = NULL;
+	_asm {
+		call fun;
+	fun:
+		pop eax;
+		mov p, eax;
+	}
+	return p;
+}
+#endif // _WIN64
+
+char * ReadFileContent(
+	pCustomHead &head,
+	unsigned char ** rc4Key
+)
+{
+
+#ifdef _WIN64
+	char *curAddr =  getCurrAddr();
+#else
+	char * curAddr = (char *)getCurrAddr();
+#endif
+
+	char sign[] = {'\xaa', '\xbb', '\xcc', '\xdd', '\x01' , '\x01', '\x01', '\x01', '\x00' };
+	while(curAddr ++ )
+	{
+		if (MemCmp(curAddr, sign, 8) == 0)
+		{
+			curAddr += 8;
+			break;
+		}
+	}
+
+	head = (pCustomHead)curAddr;
+	curAddr += sizeof(CustomHead);
+	
+	*rc4Key = (unsigned char *)curAddr;
+	curAddr += 16;
+
+	return curAddr;
+}
+
+
+char* ApplySpace
+(
+	char * pData,
+	decltype(VirtualAlloc)* pVirtualAlloc,
+	pCustomHead pustomHead
+)
+{
+	char * baseAddress = NULL;
+
+	PIMAGE_SECTION_HEADER pSection = (PIMAGE_SECTION_HEADER)(pData + pustomHead->offsetSection);
+
+	pSection += pustomHead->numberOfSection - 1;
+
+	baseAddress = (char *)pVirtualAlloc(
+		(char*)pustomHead->imageAddr,
+		pSection->SizeOfRawData + pSection->VirtualAddress,
+		MEM_COMMIT | MEM_RESERVE,
+		PAGE_EXECUTE_READWRITE);
+
+	if (NULL == baseAddress) {
+		baseAddress = (char *)pVirtualAlloc(
+			NULL,
+			pSection->SizeOfRawData + pSection->VirtualAddress,
+			MEM_COMMIT | MEM_RESERVE,
+			PAGE_EXECUTE_READWRITE);
+	}
+
+	return baseAddress;
+}
+
+
+
+void CopyToMemory(
+	char*pData,
+	char*address,
+	pCustomHead pcustomHead
+) {
+
+	PIMAGE_SECTION_HEADER pSection = (PIMAGE_SECTION_HEADER)(pData + pcustomHead->offsetSection);
+
+
+	for (int i = 0; i < pcustomHead->numberOfSection; i++) {
+		if ((0 == pSection->VirtualAddress) || (0 == pSection->SizeOfRawData)) {
+			pSection++;
+			continue;
+		}
+
+		DA* chSrcMem = (DA *)((DA)pData + pSection->PointerToRawData);
+		DA* chDestMem = (DA *)((DA)address + pSection->VirtualAddress);
+		DA dwSizeOfRawData = pSection->SizeOfRawData;
+		MemCopy((char*)chDestMem, (char *)chSrcMem, dwSizeOfRawData);
+
+		pSection++;
+	}
+
+}
+
+void Reloaction(char *address, pCustomHead pcustomHead) {
+	PIMAGE_DOS_HEADER pDos = (PIMAGE_DOS_HEADER)address;
+	
+	PIMAGE_BASE_RELOCATION pRel = (PIMAGE_BASE_RELOCATION)(address + pcustomHead->offsetRelocation);
+	
+	if ((DA*)pRel == (DA*)pDos) {
+		return;
+	}
+
+	while ((pRel->VirtualAddress + pRel->SizeOfBlock) != 0) {
+
+		WORD *pLocData = (WORD*)((PBYTE)pRel + sizeof(IMAGE_BASE_RELOCATION));
+		int numberOfReloc = (pRel->SizeOfBlock - sizeof(IMAGE_BASE_RELOCATION)) / sizeof(WORD);
+
+		for (int i = 0; i < numberOfReloc; i++) {
+
+#ifdef _WIN64
+			if ((DWORD)(pLocData[i] & 0xf000) == 0xa000) {
+#else
+			if ((DWORD)(pLocData[i] & 0xf000) == 0x3000) {
+#endif
+				DA *pAddress = (DA*)((DA)pDos + pRel->VirtualAddress + ((DWORD)pLocData[i] & 0x0fff));
+				DA dwDelta = (DA)pDos - pcustomHead->imageAddr;
+				*pAddress += dwDelta;
+			}
+
+		
+		}
+		pRel = (PIMAGE_BASE_RELOCATION)((PBYTE)pRel + pRel->SizeOfBlock);
+	}
+	return;
+}
+
+void LoadDll(
+	char *address,
+	decltype(GetModuleHandleA) * myGetModuleHandleA,
+	decltype(LoadLibraryA) * myLoadLibraryA,
+	decltype(GetProcAddress) *myGetProcAddress,
+	pCustomHead pcustomHead
+)
+{
+
+	PIMAGE_IMPORT_DESCRIPTOR pImportTable = (PIMAGE_IMPORT_DESCRIPTOR)(address + pcustomHead->offsetImportTable);
+
+	char *lpDllName = NULL;
+	HMODULE hDll = NULL;
+
+	PIMAGE_THUNK_DATA lpImportNameArray = NULL;
+	PIMAGE_IMPORT_BY_NAME lpImportByName = NULL;
+	PIMAGE_THUNK_DATA lpImportFuncAddrArray = NULL;
+	FARPROC lpFuncAddress = NULL;
+	DA i = 0;
+
+	while (TRUE) {
+		if (0 == pImportTable->OriginalFirstThunk) {
+			break;
+		}
+
+		//load dll, get hmoudle
+		lpDllName = (char *)((DA)address + pImportTable->Name);
+		hDll = myGetModuleHandleA(lpDllName);
+		if (hDll == NULL) {
+			hDll = myLoadLibraryA(lpDllName);
+			if (hDll == NULL) {
+				pImportTable++;
+				continue;
+			}
+		}
+
+		
+		i = 0;
+		lpImportNameArray = (PIMAGE_THUNK_DATA)((DA)address + pImportTable->OriginalFirstThunk);
+		lpImportFuncAddrArray = (PIMAGE_THUNK_DATA)((DA)address + pImportTable->FirstThunk);
+		while (TRUE) {
+			if (lpImportNameArray[i].u1.AddressOfData == 0) {
+				break;
+			}
+
+			lpImportByName = (PIMAGE_IMPORT_BY_NAME)((DA)address + lpImportNameArray[i].u1.AddressOfData);
+
+			if (0x80000000 & lpImportNameArray[i].u1.Ordinal) {
+				lpFuncAddress = myGetProcAddress(hDll, (LPCSTR)(lpImportNameArray[i].u1.Ordinal & 0x0000FFFF));
+			}
+			else {
+				lpFuncAddress = myGetProcAddress(hDll, (LPCSTR)lpImportByName->Name);
+			}
+			lpImportFuncAddrArray[i].u1.Function = (DA)lpFuncAddress;
+			i++;
+		}
+
+		pImportTable++;
+	}
+
+}
+
+void Run(pCustomHead pcustomHead, char *address) {
+
+	DA * ExeEntry = (DA*)(address + pcustomHead->entryPoint);
+
+	((void(*) (void)) ExeEntry)();
+
+}
+
+char * DeCompress(
+	char *buff,
+	pCustomHead pcustomHead,
+	decltype(VirtualAlloc)* pVirtualAlloc,
+	pRtlDecompressBuffer f_RtlDecompressBuffer
+)
+{
+	char *outData = NULL;
+	DWORD CompressionFormat = COMPRESSION_FORMAT_LZNT1 | COMPRESSION_ENGINE_MAXIMUM;
+
+	outData = (char *)pVirtualAlloc(NULL, pcustomHead->size, MEM_RESERVE | MEM_COMMIT, PAGE_EXECUTE_READWRITE);
+	DWORD dwDeCompress;
+	f_RtlDecompressBuffer(
+		CompressionFormat,
+		outData,
+		pcustomHead->size,
+		buff,
+		pcustomHead->compressSize,
+		&dwDeCompress);
+
+	return outData;
+}
+
+void func() {
+
+	pCustomHead pCustomHead = NULL;
+	unsigned char *rc4Key = NULL;
+
+	DWORD Hash_Kernel = 0xe616dcd1;
+	DWORD Hash_Ntdll = 0x2911895d;
+	DWORD Hash_VirtualAlloc = 0x6b56ea61;
+	DWORD Hash_RtlDecompressBuffer = 0xd75e613c;
+	DWORD Hash_GetProcAddress = 0xabddce5c;
+	DWORD Hash_GetModuleHandleA = 0xc74459e6;
+	DWORD Hash_LoadLibraryA = 0x22f765ae;
+
+	pRtlDecompressBuffer f_RtlDecompressBuffer = (pRtlDecompressBuffer)GetFunction(Hash_Ntdll, Hash_RtlDecompressBuffer);
+	decltype(VirtualAlloc)* pVirtualAlloc = (decltype(VirtualAlloc)*) GetFunction(Hash_Kernel, Hash_VirtualAlloc);
+	decltype(GetProcAddress) *pGetProcAddress = (decltype(GetProcAddress) *)GetFunction(Hash_Kernel, Hash_GetProcAddress);
+	decltype(GetModuleHandleA) *pGetModuleHandleA = (decltype(GetModuleHandleA)*)GetFunction(Hash_Kernel, Hash_GetModuleHandleA);
+	decltype(LoadLibraryA) * pLoadLibraryA = (decltype(LoadLibraryA) *)GetFunction(Hash_Kernel, Hash_LoadLibraryA);
+
+
+	
+	char *pDataBuff = ReadFileContent(pCustomHead, &rc4Key);
+
+	if (pCustomHead->flag2)
+		Rc4Decrypt(pDataBuff, pCustomHead->rc4Size, rc4Key);
+
+	if (pCustomHead->flag1)
+		pDataBuff = DeCompress(pDataBuff, pCustomHead, pVirtualAlloc, f_RtlDecompressBuffer);
+
+	char *baseAddress = ApplySpace(pDataBuff,  pVirtualAlloc ,pCustomHead);
+
+	CopyToMemory(pDataBuff, baseAddress, pCustomHead);
+
+	Reloaction(baseAddress, pCustomHead);
+
+	LoadDll(baseAddress, pGetModuleHandleA, pLoadLibraryA, pGetProcAddress, pCustomHead);
+
+	Run(pCustomHead, baseAddress);
+
+}
+
+
+int main(int argc, char *argv[], char ** envp) {
+
+	func();
+
+	return 0;
+}
@@ -0,0 +1,13 @@
+public getCurrAddr
+
+_TEXT	SEGMENT
+getCurrAddr PROC
+		call f;
+		f:
+		pop rax;
+		ret;
+getCurrAddr ENDP
+
+_TEXT ENDS
+
+END
@@ -0,0 +1,367 @@
+ PELoader
+
+ Timestamp is 5e17372e (Thu Jan  9 22:22:38 2020)
+
+ Preferred load address is 00400000
+
+ Start         Length     Name                   Class
+ 0001:00000000 00001d87H .text$mn                CODE
+ 0002:00000000 000000b8H .idata$5                DATA
+ 0002:000000b8 00000004H .00cfg                  DATA
+ 0002:000000bc 00000004H .CRT$XCA                DATA
+ 0002:000000c0 00000004H .CRT$XCAA               DATA
+ 0002:000000c4 00000004H .CRT$XCZ                DATA
+ 0002:000000c8 00000004H .CRT$XIA                DATA
+ 0002:000000cc 00000004H .CRT$XIAA               DATA
+ 0002:000000d0 00000004H .CRT$XIAC               DATA
+ 0002:000000d4 00000004H .CRT$XIZ                DATA
+ 0002:000000d8 00000004H .CRT$XPA                DATA
+ 0002:000000dc 00000004H .CRT$XPZ                DATA
+ 0002:000000e0 00000004H .CRT$XTA                DATA
+ 0002:000000e4 0000000cH .CRT$XTZ                DATA
+ 0002:000000e8 00000000H .gfids$y                DATA
+ 0002:000000f0 00000110H .rdata                  DATA
+ 0002:00000200 00000004H .rdata$sxdata           DATA
+ 0002:00000204 000002b0H .rdata$zzzdbg           DATA
+ 0002:000004b4 00000004H .rtc$IAA                DATA
+ 0002:000004b8 00000004H .rtc$IZZ                DATA
+ 0002:000004bc 00000004H .rtc$TAA                DATA
+ 0002:000004c0 00000008H .rtc$TZZ                DATA
+ 0002:000004c8 0000003cH .xdata$x                DATA
+ 0002:00000504 00000000H .edata                  DATA
+ 0002:00000504 0000003cH .idata$2                DATA
+ 0002:00000540 00000014H .idata$3                DATA
+ 0002:00000554 000000b8H .idata$4                DATA
+ 0002:0000060c 000003a2H .idata$6                DATA
+ 0003:00000000 00000018H .data                   DATA
+ 0003:00000018 00000374H .bss                    DATA
+ 0004:00000000 00000060H .rsrc$01                DATA
+ 0004:00000060 00000180H .rsrc$02                DATA
+
+  Address         Publics by Value              Rva+Base       Lib:Object
+
+ 0000:00000000       ___dynamic_value_reloc_table 00000000     <absolute>
+ 0000:00000000       ___hybrid_code_map         00000000     <absolute>
+ 0000:00000000       ___guard_fids_table        00000000     <absolute>
+ 0000:00000000       ___guard_longjmp_table     00000000     <absolute>
+ 0000:00000000       ___volatile_metadata       00000000     <absolute>
+ 0000:00000000       ___guard_fids_count        00000000     <absolute>
+ 0000:00000000       ___enclave_config          00000000     <absolute>
+ 0000:00000000       ___guard_iat_table         00000000     <absolute>
+ 0000:00000000       ___guard_longjmp_count     00000000     <absolute>
+ 0000:00000000       ___guard_iat_count         00000000     <absolute>
+ 0000:00000000       ___hybrid_auxiliary_iat    00000000     <absolute>
+ 0000:00000000       ___hybrid_code_map_count   00000000     <absolute>
+ 0000:00000001       ___safe_se_handler_count   00000001     <absolute>
+ 0000:00000100       ___guard_flags             00000100     <absolute>
+ 0000:00000000       ___ImageBase               00400000     <linker-defined>
+ 0001:00000000       ?func@@YAXXZ               00401000 f   Source.obj
+ 0001:000000d7       ?ApplySpace@@YAPADPADP6GPAXPAXKKK@ZPAUCustomHead@@@Z 004010d7 f   Source.obj
+ 0001:0000011b       ?CopyToMemory@@YAXPAD0PAUCustomHead@@@Z 0040111b f   Source.obj
+ 0001:00000164       ?DeCompress@@YAPADPADPAUCustomHead@@P6GPAXPAXKKK@ZP6GKK2K2KPAK@Z@Z 00401164 f   Source.obj
+ 0001:00000197       ?GetFunction@@YAPADKK@Z    00401197 f   Source.obj
+ 0001:0000024f       ?LoadDll@@YAXPADP6GPAUHINSTANCE__@@PBD@Z2P6GP6GHXZPAU1@1@ZPAUCustomHead@@@Z 0040124f f   Source.obj
+ 0001:000002e9       ?MemCmp@@YAKPAD0K@Z        004012e9 f   Source.obj
+ 0001:00000316       ?MemCopy@@YAXPAD0K@Z       00401316 f   Source.obj
+ 0001:00000337       ?Rc4Decrypt@@YAXPADHPAE@Z  00401337 f   Source.obj
+ 0001:0000040d       ?ReadFileContent@@YAPADAAPAUCustomHead@@PAPAE@Z 0040140d f   Source.obj
+ 0001:00000460       ?Reloaction@@YAXPADPAUCustomHead@@@Z 00401460 f   Source.obj
+ 0001:000004ce       ?Run@@YAXPAUCustomHead@@PAD@Z 004014ce f   Source.obj
+ 0001:000004dd       ?__empty_global_delete@@YAXPAXI@Z 004014dd f i Source.obj
+ 0001:000004dd       ?__empty_global_delete@@YAXPAX@Z 004014dd f i Source.obj
+ 0001:000004de       ?getCurrAddr@@YAPAKXZ      004014de f   Source.obj
+ 0001:000004f4       ?getHash@@YAKPBD@Z         004014f4 f   Source.obj
+ 0001:0000051e       ?getUnicodeHash@@YAKPB_W@Z 0040151e f   Source.obj
+ 0001:0000054d       _main                      0040154d f   Source.obj
+ 0001:00000870       ?configure_argv@__scrt_narrow_argv_policy@@SAHXZ 00401870 f i MSVCRTD:exe_main.obj
+ 0001:00000890       ?initialize_environment@__scrt_narrow_environment_policy@@SAHXZ 00401890 f i MSVCRTD:exe_main.obj
+ 0001:000008d0       ?set_app_type@__scrt_main_policy@@SAXXZ 004018d0 f i MSVCRTD:exe_main.obj
+ 0001:000008e0       ?set_commode@__scrt_file_policy@@SAXXZ 004018e0 f i MSVCRTD:exe_main.obj
+ 0001:00000900       ?set_fmode@__scrt_file_policy@@SAXXZ 00401900 f i MSVCRTD:exe_main.obj
+ 0001:00000920       _mainCRTStartup            00401920 f   MSVCRTD:exe_main.obj
+ 0001:00000930       ??$__crt_fast_decode_pointer@PAP6AXXZ@@YAPAP6AXXZQAP6AXXZ@Z 00401930 f i MSVCRTD:utility.obj
+ 0001:00000960       ??$__crt_fast_encode_pointer@PAP6AXXZ@@YAPAP6AXXZQAP6AXXZ@Z 00401960 f i MSVCRTD:utility.obj
+ 0001:00000990       ?__crt_rotate_pointer_value@@YAIIH@Z 00401990 f i MSVCRTD:utility.obj
+ 0001:00000aa0       _NtCurrentTeb              00401aa0 f i MSVCRTD:utility.obj
+ 0001:00000ab0       ___scrt_acquire_startup_lock 00401ab0 f   MSVCRTD:utility.obj
+ 0001:00000b00       ___scrt_dllmain_after_initialize_c 00401b00 f   MSVCRTD:utility.obj
+ 0001:00000b30       ___scrt_dllmain_before_initialize_c 00401b30 f   MSVCRTD:utility.obj
+ 0001:00000b50       ___scrt_dllmain_crt_thread_attach 00401b50 f   MSVCRTD:utility.obj
+ 0001:00000b80       ___scrt_dllmain_crt_thread_detach 00401b80 f   MSVCRTD:utility.obj
+ 0001:00000ba0       ___scrt_dllmain_exception_filter 00401ba0 f   MSVCRTD:utility.obj
+ 0001:00000bf0       ___scrt_dllmain_uninitialize_c 00401bf0 f   MSVCRTD:utility.obj
+ 0001:00000c20       ___scrt_dllmain_uninitialize_critical 00401c20 f   MSVCRTD:utility.obj
+ 0001:00000c40       ___scrt_initialize_crt     00401c40 f   MSVCRTD:utility.obj
+ 0001:00000c90       ___scrt_initialize_onexit_tables 00401c90 f   MSVCRTD:utility.obj
+ 0001:00000d70       ___scrt_is_nonwritable_in_current_image 00401d70 f   MSVCRTD:utility.obj
+ 0001:00000ea0       ___scrt_release_startup_lock 00401ea0 f   MSVCRTD:utility.obj
+ 0001:00000ed0       ___scrt_uninitialize_crt   00401ed0 f   MSVCRTD:utility.obj
+ 0001:00000f10       __onexit                   00401f10 f   MSVCRTD:utility.obj
+ 0001:00000f80       _at_quick_exit             00401f80 f   MSVCRTD:utility.obj
+ 0001:00000fd0       _atexit                    00401fd0 f   MSVCRTD:utility.obj
+ 0001:00001070       ___security_init_cookie    00402070 f   MSVCRTD:gs_support.obj
+ 0001:000010f0       __get_startup_new_mode     004020f0 f   MSVCRTD:new_mode.obj
+ 0001:000010f0       __matherr                  004020f0 f   MSVCRTD:matherr.obj
+ 0001:000010f0       ___scrt_stub_for_initialize_mta 004020f0 f   MSVCRTD:utility_desktop.obj
+ 0001:000010f0       __get_startup_thread_locale_mode 004020f0 f   MSVCRTD:thread_locale.obj
+ 0001:000010f0       ___scrt_initialize_winrt   004020f0 f   MSVCRTD:utility_desktop.obj
+ 0001:000010f0       __get_startup_commit_mode  004020f0 f   MSVCRTD:commit_mode.obj
+ 0001:000010f0       ___scrt_stub_for_is_c_termination_complete 004020f0 f   MSVCRTD:ucrt_stubs.obj
+ 0001:000010f0       ___scrt_exe_initialize_mta 004020f0 f   MSVCRTD:utility_desktop.obj
+ 0001:000010f0       __is_c_termination_complete 004020f0 f   MSVCRTD:ucrt_stubs.obj
+ 0001:00001100       __get_startup_argv_mode    00402100 f   MSVCRTD:argv_mode.obj
+ 0001:00001110       __get_startup_file_mode    00402110 f   MSVCRTD:file_mode.obj
+ 0001:00001120       ?__scrt_initialize_type_info@@YAXXZ 00402120 f   MSVCRTD:tncleanup.obj
+ 0001:00001130       ?__scrt_uninitialize_type_info@@YAXXZ 00402130 f   MSVCRTD:tncleanup.obj
+ 0001:00001150       ___vcrt_initialize         00402150 f   MSVCRTD:ucrt_stubs.obj
+ 0001:00001150       ___vcrt_thread_detach      00402150 f   MSVCRTD:ucrt_stubs.obj
+ 0001:00001150       ___acrt_thread_attach      00402150 f   MSVCRTD:ucrt_stubs.obj
+ 0001:00001150       ___acrt_uninitialize       00402150 f   MSVCRTD:ucrt_stubs.obj
+ 0001:00001150       ___scrt_stub_for_acrt_thread_attach 00402150 f   MSVCRTD:ucrt_stubs.obj
+ 0001:00001150       ___vcrt_thread_attach      00402150 f   MSVCRTD:ucrt_stubs.obj
+ 0001:00001150       ___scrt_stub_for_acrt_uninitialize 00402150 f   MSVCRTD:ucrt_stubs.obj
+ 0001:00001150       __should_initialize_environment 00402150 f   MSVCRTD:env_mode.obj
+ 0001:00001150       ___vcrt_uninitialize_critical 00402150 f   MSVCRTD:ucrt_stubs.obj
+ 0001:00001150       ___vcrt_uninitialize       00402150 f   MSVCRTD:ucrt_stubs.obj
+ 0001:00001150       ___scrt_stub_for_acrt_thread_detach 00402150 f   MSVCRTD:ucrt_stubs.obj
+ 0001:00001150       ___acrt_thread_detach      00402150 f   MSVCRTD:ucrt_stubs.obj
+ 0001:00001150       ___acrt_initialize         00402150 f   MSVCRTD:ucrt_stubs.obj
+ 0001:00001150       ___acrt_uninitialize_critical 00402150 f   MSVCRTD:ucrt_stubs.obj
+ 0001:00001150       ___scrt_stub_for_acrt_uninitialize_critical 00402150 f   MSVCRTD:ucrt_stubs.obj
+ 0001:00001150       ___scrt_stub_for_acrt_initialize 00402150 f   MSVCRTD:ucrt_stubs.obj
+ 0001:00001160       __initialize_default_precision 00402160 f   MSVCRTD:default_precision.obj
+ 0001:00001190       __initialize_denormal_control 00402190 f   MSVCRTD:denormal_control.obj
+ 0001:00001190       __initialize_invalid_parameter_handler 00402190 f   MSVCRTD:invalid_parameter_handler.obj
+ 0001:000011a0       ___local_stdio_printf_options 004021a0 f i MSVCRTD:default_local_stdio_options.obj
+ 0001:000011b0       ___local_stdio_scanf_options 004021b0 f i MSVCRTD:default_local_stdio_options.obj
+ 0001:000011c0       ___scrt_initialize_default_local_stdio_options 004021c0 f   MSVCRTD:default_local_stdio_options.obj
+ 0001:00001200       ___scrt_is_user_matherr_present 00402200 f   MSVCRTD:matherr_detection.obj
+ 0001:00001230       ___scrt_get_dyn_tls_init_callback 00402230 f   MSVCRTD:dyn_tls_init.obj
+ 0001:00001240       ___scrt_get_dyn_tls_dtor_callback 00402240 f   MSVCRTD:dyn_tls_dtor.obj
+ 0001:00001250       ___scrt_fastfail           00402250 f   MSVCRTD:utility_desktop.obj
+ 0001:00001390       ___scrt_get_show_window_mode 00402390 f   MSVCRTD:utility_desktop.obj
+ 0001:000013d0       ___scrt_initialize_mta     004023d0 f   MSVCRTD:utility_desktop.obj
+ 0001:000013e0       ___scrt_is_managed_app     004023e0 f   MSVCRTD:utility_desktop.obj
+ 0001:00001470       ___scrt_set_unhandled_exception_filter 00402470 f   MSVCRTD:utility_desktop.obj
+ 0001:00001480       ___scrt_unhandled_exception_filter@4 00402480 f   MSVCRTD:utility_desktop.obj
+ 0001:000014e0       __crt_debugger_hook        004024e0 f   MSVCRTD:utility_desktop.obj
+ 0001:000014f0       __RTC_Initialize           004024f0 f   MSVCRTD:initsect.obj
+ 0001:00001520       __RTC_Terminate            00402520 f   MSVCRTD:initsect.obj
+ 0001:00001550       __except_handler4          00402550 f   MSVCRTD:chandler4gs.obj
+ 0001:00001580       @_guard_check_icall_nop@4  00402580 f i MSVCRTD:guard_support.obj
+ 0001:00001590       _ReadNoFence               00402590 f i MSVCRTD:guard_support.obj
+ 0001:000015b0       _ReadPointerNoFence        004025b0 f i MSVCRTD:guard_support.obj
+ 0001:000015d0       __guard_icall_checks_enforced 004025d0 f i MSVCRTD:guard_support.obj
+ 0001:00001600       ___isa_available_init      00402600 f   MSVCRTD:cpu_disp.obj
+ 0001:000018e0       ___scrt_is_ucrt_dll_in_use 004028e0 f   MSVCRTD:ucrt_detection.obj
+ 0001:00001910       @__security_check_cookie@4 00402910 f   MSVCRTD:secchk.obj
+ 0001:00001930       ___raise_securityfailure   00402930 f   MSVCRTD:gs_report.obj
+ 0001:00001960       ___report_gsfailure        00402960 f   MSVCRTD:gs_report.obj
+ 0001:00001a70       ___report_rangecheckfailure 00402a70 f   MSVCRTD:gs_report.obj
+ 0001:00001a80       ___report_securityfailure  00402a80 f   MSVCRTD:gs_report.obj
+ 0001:00001b60       ___report_securityfailureEx 00402b60 f   MSVCRTD:gs_report.obj
+ 0001:00001c85       ___std_type_info_destroy_list 00402c85 f   vcruntimed:VCRUNTIME140D.dll
+ 0001:00001c8b       _memset                    00402c8b f   vcruntimed:VCRUNTIME140D.dll
+ 0001:00001c91       __except_handler4_common   00402c91 f   vcruntimed:VCRUNTIME140D.dll
+ 0001:00001c97       __seh_filter_exe           00402c97 f   ucrtd:ucrtbased.dll
+ 0001:00001c9d       __set_app_type             00402c9d f   ucrtd:ucrtbased.dll
+ 0001:00001ca3       ___setusermatherr          00402ca3 f   ucrtd:ucrtbased.dll
+ 0001:00001ca9       __configure_narrow_argv    00402ca9 f   ucrtd:ucrtbased.dll
+ 0001:00001caf       __initialize_narrow_environment 00402caf f   ucrtd:ucrtbased.dll
+ 0001:00001cb5       __get_initial_narrow_environment 00402cb5 f   ucrtd:ucrtbased.dll
+ 0001:00001cbb       __initterm                 00402cbb f   ucrtd:ucrtbased.dll
+ 0001:00001cc1       __initterm_e               00402cc1 f   ucrtd:ucrtbased.dll
+ 0001:00001cc7       _exit                      00402cc7 f   ucrtd:ucrtbased.dll
+ 0001:00001ccd       __exit                     00402ccd f   ucrtd:ucrtbased.dll
+ 0001:00001cd3       __set_fmode                00402cd3 f   ucrtd:ucrtbased.dll
+ 0001:00001cd9       ___p___argc                00402cd9 f   ucrtd:ucrtbased.dll
+ 0001:00001cdf       ___p___argv                00402cdf f   ucrtd:ucrtbased.dll
+ 0001:00001ce5       __cexit                    00402ce5 f   ucrtd:ucrtbased.dll
+ 0001:00001ceb       __c_exit                   00402ceb f   ucrtd:ucrtbased.dll
+ 0001:00001cf1       __register_thread_local_exe_atexit_callback 00402cf1 f   ucrtd:ucrtbased.dll
+ 0001:00001cf7       __configthreadlocale       00402cf7 f   ucrtd:ucrtbased.dll
+ 0001:00001cfd       __set_new_mode             00402cfd f   ucrtd:ucrtbased.dll
+ 0001:00001d03       ___p__commode              00402d03 f   ucrtd:ucrtbased.dll
+ 0001:00001d09       __seh_filter_dll           00402d09 f   ucrtd:ucrtbased.dll
+ 0001:00001d0f       __initialize_onexit_table  00402d0f f   ucrtd:ucrtbased.dll
+ 0001:00001d15       __register_onexit_function 00402d15 f   ucrtd:ucrtbased.dll
+ 0001:00001d1b       __execute_onexit_table     00402d1b f   ucrtd:ucrtbased.dll
+ 0001:00001d21       __crt_atexit               00402d21 f   ucrtd:ucrtbased.dll
+ 0001:00001d27       __crt_at_quick_exit        00402d27 f   ucrtd:ucrtbased.dll
+ 0001:00001d2d       __controlfp_s              00402d2d f   ucrtd:ucrtbased.dll
+ 0001:00001d33       _terminate                 00402d33 f   ucrtd:ucrtbased.dll
+ 0001:00001d39       _QueryPerformanceCounter@4 00402d39 f   kernel32:KERNEL32.dll
+ 0001:00001d3f       _GetCurrentProcessId@0     00402d3f f   kernel32:KERNEL32.dll
+ 0001:00001d45       _GetCurrentThreadId@0      00402d45 f   kernel32:KERNEL32.dll
+ 0001:00001d4b       _GetSystemTimeAsFileTime@4 00402d4b f   kernel32:KERNEL32.dll
+ 0001:00001d51       _InitializeSListHead@4     00402d51 f   kernel32:KERNEL32.dll
+ 0001:00001d57       _IsDebuggerPresent@0       00402d57 f   kernel32:KERNEL32.dll
+ 0001:00001d5d       _UnhandledExceptionFilter@4 00402d5d f   kernel32:KERNEL32.dll
+ 0001:00001d63       _SetUnhandledExceptionFilter@4 00402d63 f   kernel32:KERNEL32.dll
+ 0001:00001d69       _GetStartupInfoW@4         00402d69 f   kernel32:KERNEL32.dll
+ 0001:00001d6f       _IsProcessorFeaturePresent@4 00402d6f f   kernel32:KERNEL32.dll
+ 0001:00001d75       _GetModuleHandleW@4        00402d75 f   kernel32:KERNEL32.dll
+ 0001:00001d7b       _GetCurrentProcess@0       00402d7b f   kernel32:KERNEL32.dll
+ 0001:00001d81       _TerminateProcess@8        00402d81 f   kernel32:KERNEL32.dll
+ 0002:00000000       __imp__SetUnhandledExceptionFilter@4 00403000     kernel32:KERNEL32.dll
+ 0002:00000004       __imp__GetCurrentProcessId@0 00403004     kernel32:KERNEL32.dll
+ 0002:00000008       __imp__GetCurrentThreadId@0 00403008     kernel32:KERNEL32.dll
+ 0002:0000000c       __imp__TerminateProcess@8  0040300c     kernel32:KERNEL32.dll
+ 0002:00000010       __imp__GetCurrentProcess@0 00403010     kernel32:KERNEL32.dll
+ 0002:00000014       __imp__GetModuleHandleW@4  00403014     kernel32:KERNEL32.dll
+ 0002:00000018       __imp__IsProcessorFeaturePresent@4 00403018     kernel32:KERNEL32.dll
+ 0002:0000001c       __imp__GetStartupInfoW@4   0040301c     kernel32:KERNEL32.dll
+ 0002:00000020       __imp__QueryPerformanceCounter@4 00403020     kernel32:KERNEL32.dll
+ 0002:00000024       __imp__UnhandledExceptionFilter@4 00403024     kernel32:KERNEL32.dll
+ 0002:00000028       __imp__IsDebuggerPresent@0 00403028     kernel32:KERNEL32.dll
+ 0002:0000002c       __imp__InitializeSListHead@4 0040302c     kernel32:KERNEL32.dll
+ 0002:00000030       __imp__GetSystemTimeAsFileTime@4 00403030     kernel32:KERNEL32.dll
+ 0002:00000034       \177KERNEL32_NULL_THUNK_DATA 00403034     kernel32:KERNEL32.dll
+ 0002:00000038       __imp__memset              00403038     vcruntimed:VCRUNTIME140D.dll
+ 0002:0000003c       __imp___except_handler4_common 0040303c     vcruntimed:VCRUNTIME140D.dll
+ 0002:00000040       __imp____std_type_info_destroy_list 00403040     vcruntimed:VCRUNTIME140D.dll
+ 0002:00000044       \177VCRUNTIME140D_NULL_THUNK_DATA 00403044     vcruntimed:VCRUNTIME140D.dll
+ 0002:00000048       __imp___c_exit             00403048     ucrtd:ucrtbased.dll
+ 0002:0000004c       __imp___register_thread_local_exe_atexit_callback 0040304c     ucrtd:ucrtbased.dll
+ 0002:00000050       __imp___configthreadlocale 00403050     ucrtd:ucrtbased.dll
+ 0002:00000054       __imp___set_new_mode       00403054     ucrtd:ucrtbased.dll
+ 0002:00000058       __imp____p__commode        00403058     ucrtd:ucrtbased.dll
+ 0002:0000005c       __imp____p___argv          0040305c     ucrtd:ucrtbased.dll
+ 0002:00000060       __imp___initialize_onexit_table 00403060     ucrtd:ucrtbased.dll
+ 0002:00000064       __imp___register_onexit_function 00403064     ucrtd:ucrtbased.dll
+ 0002:00000068       __imp___execute_onexit_table 00403068     ucrtd:ucrtbased.dll
+ 0002:0000006c       __imp___crt_atexit         0040306c     ucrtd:ucrtbased.dll
+ 0002:00000070       __imp___crt_at_quick_exit  00403070     ucrtd:ucrtbased.dll
+ 0002:00000074       __imp___controlfp_s        00403074     ucrtd:ucrtbased.dll
+ 0002:00000078       __imp__terminate           00403078     ucrtd:ucrtbased.dll
+ 0002:0000007c       __imp___seh_filter_dll     0040307c     ucrtd:ucrtbased.dll
+ 0002:00000080       __imp____p___argc          00403080     ucrtd:ucrtbased.dll
+ 0002:00000084       __imp___set_fmode          00403084     ucrtd:ucrtbased.dll
+ 0002:00000088       __imp___exit               00403088     ucrtd:ucrtbased.dll
+ 0002:0000008c       __imp__exit                0040308c     ucrtd:ucrtbased.dll
+ 0002:00000090       __imp___initterm_e         00403090     ucrtd:ucrtbased.dll
+ 0002:00000094       __imp___initterm           00403094     ucrtd:ucrtbased.dll
+ 0002:00000098       __imp___get_initial_narrow_environment 00403098     ucrtd:ucrtbased.dll
+ 0002:0000009c       __imp___initialize_narrow_environment 0040309c     ucrtd:ucrtbased.dll
+ 0002:000000a0       __imp___configure_narrow_argv 004030a0     ucrtd:ucrtbased.dll
+ 0002:000000a4       __imp____setusermatherr    004030a4     ucrtd:ucrtbased.dll
+ 0002:000000a8       __imp___set_app_type       004030a8     ucrtd:ucrtbased.dll
+ 0002:000000ac       __imp___seh_filter_exe     004030ac     ucrtd:ucrtbased.dll
+ 0002:000000b0       __imp___cexit              004030b0     ucrtd:ucrtbased.dll
+ 0002:000000b4       \177ucrtbased_NULL_THUNK_DATA 004030b4     ucrtd:ucrtbased.dll
+ 0002:000000b8       ___guard_check_icall_fptr  004030b8     MSVCRTD:guard_support.obj
+ 0002:000000bc       ___xc_a                    004030bc     MSVCRTD:initializers.obj
+ 0002:000000c4       ___xc_z                    004030c4     MSVCRTD:initializers.obj
+ 0002:000000c8       ___xi_a                    004030c8     MSVCRTD:initializers.obj
+ 0002:000000d4       ___xi_z                    004030d4     MSVCRTD:initializers.obj
+ 0002:000000d8       ___xp_a                    004030d8     MSVCRTD:initializers.obj
+ 0002:000000dc       ___xp_z                    004030dc     MSVCRTD:initializers.obj
+ 0002:000000e0       ___xt_a                    004030e0     MSVCRTD:initializers.obj
+ 0002:000000e4       ___xt_z                    004030e4     MSVCRTD:initializers.obj
+ 0002:00000158       __load_config_used         00403158     MSVCRTD:loadcfg.obj
+ 0002:00000200       ___safe_se_handler_table   00403200     <linker-defined>
+ 0002:000004b4       ___rtc_iaa                 004034b4     MSVCRTD:initsect.obj
+ 0002:000004b8       ___rtc_izz                 004034b8     MSVCRTD:initsect.obj
+ 0002:000004bc       ___rtc_taa                 004034bc     MSVCRTD:initsect.obj
+ 0002:000004c0       ___rtc_tzz                 004034c0     MSVCRTD:initsect.obj
+ 0002:00000504       __IMPORT_DESCRIPTOR_VCRUNTIME140D 00403504     vcruntimed:VCRUNTIME140D.dll
+ 0002:00000518       __IMPORT_DESCRIPTOR_ucrtbased 00403518     ucrtd:ucrtbased.dll
+ 0002:0000052c       __IMPORT_DESCRIPTOR_KERNEL32 0040352c     kernel32:KERNEL32.dll
+ 0002:00000540       __NULL_IMPORT_DESCRIPTOR   00403540     vcruntimed:VCRUNTIME140D.dll
+ 0003:00000000       ___scrt_native_dllmain_reason 00404000     MSVCRTD:utility.obj
+ 0003:00000004       ___scrt_default_matherr    00404004     MSVCRTD:matherr.obj
+ 0003:00000008       ___security_cookie_complement 00404008     MSVCRTD:gs_cookie.obj
+ 0003:0000000c       ___security_cookie         0040400c     MSVCRTD:gs_cookie.obj
+ 0003:00000010       ___isa_enabled             00404010     MSVCRTD:cpu_disp.obj
+ 0003:00000014       ___scrt_ucrt_dll_is_in_use 00404014     MSVCRTD:ucrt_stubs.obj
+ 0003:00000018       ___scrt_current_native_startup_state 00404018     MSVCRTD:utility.obj
+ 0003:0000001c       ___scrt_native_startup_lock 0040401c     MSVCRTD:utility.obj
+ 0003:00000040       ?__type_info_root_node@@3U__type_info_node@@A 00404040     MSVCRTD:tncleanup.obj
+ 0003:00000048       ?_OptionsStorage@?1??__local_stdio_printf_options@@9@4_KA 00404048     MSVCRTD:default_local_stdio_options.obj
+ 0003:00000050       ?_OptionsStorage@?1??__local_stdio_scanf_options@@9@4_KA 00404050     MSVCRTD:default_local_stdio_options.obj
+ 0003:00000058       ___scrt_debugger_hook_flag 00404058     MSVCRTD:utility_desktop.obj
+ 0003:0000005c       ___isa_available           0040405c     MSVCRTD:cpu_disp.obj
+ 0003:00000060       ___favor                   00404060     MSVCRTD:cpu_disp.obj
+ 0003:00000384       ___dyn_tls_dtor_callback   00404384     <common>
+ 0003:00000388       ___dyn_tls_init_callback   00404388     <common>
+
+ entry point at        0001:00000920
+
+ Static symbols
+
+ 0002:ffffcfff       __guard_fids__             1003fffff     MSVCRTD:guard_support.obj
+ 0002:ffffcfff       __guard_fids___guard_icall_checks_enforced 1003fffff     MSVCRTD:guard_support.obj
+ 0000:ffff9000       .debug$S                   00400000     kernel32:KERNEL32.dll
+ 0000:ffff9000       .debug$S                   00400000     kernel32:KERNEL32.dll
+ 0000:ffff9000       .debug$S                   00400000     kernel32:KERNEL32.dll
+ 0000:ffff9000       .debug$S                   00400000     kernel32:KERNEL32.dll
+ 0000:ffff9000       .debug$S                   00400000     kernel32:KERNEL32.dll
+ 0000:ffff9000       .debug$S                   00400000     kernel32:KERNEL32.dll
+ 0002:ffffd000       __guard_fids__             00400000     MSVCRTD:exe_main.obj
+ 0000:ffff9000       .debug$S                   00400000     kernel32:KERNEL32.dll
+ 0000:ffff9000       .debug$S                   00400000     kernel32:KERNEL32.dll
+ 0000:ffff9000       .debug$S                   00400000     kernel32:KERNEL32.dll
+ 0000:ffff9000       .debug$S                   00400000     kernel32:KERNEL32.dll
+ 0000:ffff9000       .debug$S                   00400000     kernel32:KERNEL32.dll
+ 0000:ffff9000       .debug$S                   00400000     kernel32:KERNEL32.dll
+ 0000:ffff9000       .debug$S                   00400000     kernel32:KERNEL32.dll
+ 0000:ffff9000       .debug$S                   00400000     ucrtd:ucrtbased.dll
+ 0000:ffff9000       .debug$S                   00400000     ucrtd:ucrtbased.dll
+ 0000:ffff9000       .debug$S                   00400000     ucrtd:ucrtbased.dll
+ 0000:ffff9000       .debug$S                   00400000     ucrtd:ucrtbased.dll
+ 0000:ffff9000       .debug$S                   00400000     ucrtd:ucrtbased.dll
+ 0000:ffff9000       .debug$S                   00400000     ucrtd:ucrtbased.dll
+ 0000:ffff9000       .debug$S                   00400000     ucrtd:ucrtbased.dll
+ 0000:ffff9000       .debug$S                   00400000     ucrtd:ucrtbased.dll
+ 0000:ffff9000       .debug$S                   00400000     ucrtd:ucrtbased.dll
+ 0000:ffff9000       .debug$S                   00400000     ucrtd:ucrtbased.dll
+ 0000:ffff9000       .debug$S                   00400000     ucrtd:ucrtbased.dll
+ 0000:ffff9000       .debug$S                   00400000     ucrtd:ucrtbased.dll
+ 0000:ffff9000       .debug$S                   00400000     ucrtd:ucrtbased.dll
+ 0000:ffff9000       .debug$S                   00400000     ucrtd:ucrtbased.dll
+ 0000:ffff9000       .debug$S                   00400000     ucrtd:ucrtbased.dll
+ 0000:ffff9000       .debug$S                   00400000     ucrtd:ucrtbased.dll
+ 0000:ffff9000       .debug$S                   00400000     ucrtd:ucrtbased.dll
+ 0000:ffff9000       .debug$S                   00400000     ucrtd:ucrtbased.dll
+ 0000:ffff9000       .debug$S                   00400000     ucrtd:ucrtbased.dll
+ 0000:ffff9000       .debug$S                   00400000     ucrtd:ucrtbased.dll
+ 0000:ffff9000       .debug$S                   00400000     ucrtd:ucrtbased.dll
+ 0000:ffff9000       .debug$S                   00400000     ucrtd:ucrtbased.dll
+ 0002:ffffd000       __guard_fids___except_handler4 00400000     MSVCRTD:chandler4gs.obj
+ 0000:ffff9000       .debug$S                   00400000     ucrtd:ucrtbased.dll
+ 0000:ffff9000       .debug$S                   00400000     ucrtd:ucrtbased.dll
+ 0000:ffff9000       .debug$S                   00400000     ucrtd:ucrtbased.dll
+ 0000:ffff9000       .debug$S                   00400000     ucrtd:ucrtbased.dll
+ 0002:ffffd000       __guard_fids____scrt_set_unhandled_exception_filter 00400000     MSVCRTD:utility_desktop.obj
+ 0000:ffff9000       .debug$S                   00400000     vcruntimed:VCRUNTIME140D.dll
+ 0000:ffff9000       .debug$S                   00400000     vcruntimed:VCRUNTIME140D.dll
+ 0000:ffff9000       .debug$S                   00400000     vcruntimed:VCRUNTIME140D.dll
+ 0002:ffffd000       __guard_fids_?pre_c_initialization@@YAHXZ 00400000     MSVCRTD:exe_main.obj
+ 0000:ffff9000       .debug$S                   00400000     ucrtd:ucrtbased.dll
+ 0002:ffffd004       __guard_fids__             00400004     MSVCRTD:exe_main.obj
+ 0002:ffffd008       __guard_fids__             00400008     MSVCRTD:exe_main.obj
+ 0001:00000560       ?pre_c_initialization@@YAHXZ 00401560 f   MSVCRTD:exe_main.obj
+ 0001:00000610       ?post_pgo_initialization@@YAHXZ 00401610 f   MSVCRTD:exe_main.obj
+ 0001:00000620       ?pre_cpp_initialization@@YAXXZ 00401620 f   MSVCRTD:exe_main.obj
+ 0001:00000640       ?__scrt_common_main@@YAHXZ 00401640 f   MSVCRTD:exe_main.obj
+ 0001:00000650       ?__scrt_common_main_seh@@YAHXZ 00401650 f   MSVCRTD:exe_main.obj
+ 0001:000008a0       ?invoke_main@@YAHXZ        004018a0 f   MSVCRTD:exe_main.obj
+ 0001:000009a0       ?find_pe_section@@YAPAU_IMAGE_SECTION_HEADER@@QAEI@Z 004019a0 f   MSVCRTD:utility.obj
+ 0001:00000a30       ?is_potentially_valid_image_base@@YA_NQAX@Z 00401a30 f   MSVCRTD:utility.obj
+ 0001:00001000       ___get_entropy             00402000 f   MSVCRTD:gs_support.obj
+ 0002:000000c0       ?pre_cpp_initializer@@3P6AXXZA 004030c0     MSVCRTD:exe_main.obj
+ 0002:000000cc       ?pre_c_initializer@@3P6AHXZA 004030cc     MSVCRTD:exe_main.obj
+ 0002:000000d0       ?post_pgo_initializer@@3P6AHXZA 004030d0     MSVCRTD:exe_main.obj
+ 0002:000000f0       _GS_ExceptionPointers      004030f0     MSVCRTD:gs_report.obj
+ 0002:000004c8       __sehtable$?__scrt_common_main_seh@@YAHXZ 004034c8     MSVCRTD:exe_main.obj
+ 0002:000004e8       __sehtable$___scrt_is_nonwritable_in_current_image 004034e8     MSVCRTD:utility.obj
+ 0002:00000650       .idata$6                   00403650     vcruntimed:VCRUNTIME140D.dll
+ 0002:00000864       .idata$6                   00403864     ucrtd:ucrtbased.dll
+ 0002:000009a0       .idata$6                   004039a0     kernel32:KERNEL32.dll
+ 0003:00000020       ?is_initialized_as_dll@@3_NA 00404020     MSVCRTD:utility.obj
+ 0003:00000021       ?module_local_atexit_table_initialized@@3_NA 00404021     MSVCRTD:utility.obj
+ 0003:00000024       ?module_local_atexit_table@@3U_onexit_table_t@@A 00404024     MSVCRTD:utility.obj
+ 0003:00000030       ?module_local_at_quick_exit_table@@3U_onexit_table_t@@A 00404030     MSVCRTD:utility.obj
+ 0003:00000068       _GS_ExceptionRecord        00404068     MSVCRTD:gs_report.obj
+ 0003:000000b8       _GS_ContextRecord          004040b8     MSVCRTD:gs_report.obj
+ 0004:00000060       $R000000                   00405060     * linker generated manifest res *
@@ -0,0 +1,529 @@
+ PELoader
+
+ Timestamp is 5e11f470 (Sun Jan  5 22:36:32 2020)
+
+ Preferred load address is 0000000140000000
+
+ Start         Length     Name                   Class
+ 0001:00000000 00002390H .text$mn                CODE
+ 0001:00002390 00000020H .text$mn$00             CODE
+ 0001:000023b0 0000006dH .text$x                 CODE
+ 0002:00000000 00000178H .idata$5                DATA
+ 0002:00000178 00000010H .00cfg                  DATA
+ 0002:00000188 00000008H .CRT$XCA                DATA
+ 0002:00000190 00000008H .CRT$XCAA               DATA
+ 0002:00000198 00000008H .CRT$XCZ                DATA
+ 0002:000001a0 00000008H .CRT$XIA                DATA
+ 0002:000001a8 00000008H .CRT$XIAA               DATA
+ 0002:000001b0 00000008H .CRT$XIAC               DATA
+ 0002:000001b8 00000008H .CRT$XIZ                DATA
+ 0002:000001c0 00000008H .CRT$XPA                DATA
+ 0002:000001c8 00000008H .CRT$XPZ                DATA
+ 0002:000001d0 00000008H .CRT$XTA                DATA
+ 0002:000001d8 00000008H .CRT$XTZ                DATA
+ 0002:000001e0 00000000H .gfids$y                DATA
+ 0002:000001e0 00000170H .rdata                  DATA
+ 0002:00000350 000002d0H .rdata$zzzdbg           DATA
+ 0002:00000620 00000008H .rtc$IAA                DATA
+ 0002:00000628 00000008H .rtc$IZZ                DATA
+ 0002:00000630 00000008H .rtc$TAA                DATA
+ 0002:00000638 00000008H .rtc$TZZ                DATA
+ 0002:00000640 000001dcH .xdata                  DATA
+ 0002:0000081c 00000000H .edata                  DATA
+ 0002:0000081c 0000003cH .idata$2                DATA
+ 0002:00000858 00000018H .idata$3                DATA
+ 0002:00000870 00000178H .idata$4                DATA
+ 0002:000009e8 000003c8H .idata$6                DATA
+ 0003:00000000 00000040H .data                   DATA
+ 0003:00000040 00000600H .bss                    DATA
+ 0004:00000000 00000378H .pdata                  DATA
+ 0005:00000000 00000060H .rsrc$01                DATA
+ 0005:00000060 00000180H .rsrc$02                DATA
+
+  Address         Publics by Value              Rva+Base               Lib:Object
+
+ 0000:00000000       __guard_iat_table          0000000000000000     <absolute>
+ 0000:00000000       __dynamic_value_reloc_table 0000000000000000     <absolute>
+ 0000:00000000       __volatile_metadata        0000000000000000     <absolute>
+ 0000:00000000       __enclave_config           0000000000000000     <absolute>
+ 0000:00000000       __guard_iat_count          0000000000000000     <absolute>
+ 0000:00000000       __guard_longjmp_count      0000000000000000     <absolute>
+ 0000:00000000       __hybrid_auxiliary_iat     0000000000000000     <absolute>
+ 0000:00000000       ___safe_se_handler_table   0000000000000000     <absolute>
+ 0000:00000000       __guard_fids_count         0000000000000000     <absolute>
+ 0000:00000000       __hybrid_code_map          0000000000000000     <absolute>
+ 0000:00000000       ___safe_se_handler_count   0000000000000000     <absolute>
+ 0000:00000000       __hybrid_code_map_count    0000000000000000     <absolute>
+ 0000:00000000       __guard_fids_table         0000000000000000     <absolute>
+ 0000:00000000       __guard_longjmp_table      0000000000000000     <absolute>
+ 0000:00000100       __guard_flags              0000000000000100     <absolute>
+ 0000:00000000       __ImageBase                0000000140000000     <linker-defined>
+ 0001:00000000       ?func@@YAXXZ               0000000140001000 f   Source.obj
+ 0001:00000120       getCurrAddr                0000000140001120 f   func.obj
+ 0001:00000128       ?ApplySpace@@YAPEADPEADP6APEAXPEAX_KKK@ZPEAUCustomHead@@@Z 0000000140001128 f   Source.obj
+ 0001:00000198       ?CopyToMemory@@YAXPEAD0PEAUCustomHead@@@Z 0000000140001198 f   Source.obj
+ 0001:00000214       ?DeCompress@@YAPEADPEADPEAUCustomHead@@P6APEAXPEAX_KKK@ZP6AKK2K2KPEAK@Z@Z 0000000140001214 f   Source.obj
+ 0001:00000288       ?GetFunction@@YAPEADKK@Z   0000000140001288 f   Source.obj
+ 0001:00000370       ?LoadDll@@YAXPEADP6APEAUHINSTANCE__@@PEBD@Z2P6AP6A_JXZPEAU1@1@ZPEAUCustomHead@@@Z 0000000140001370 f   Source.obj
+ 0001:00000440       ?MemCmp@@YAKPEAD0K@Z       0000000140001440 f   Source.obj
+ 0001:00000468       ?MemCopy@@YAXPEAD0K@Z      0000000140001468 f   Source.obj
+ 0001:00000480       ?Rc4Decrypt@@YAXPEADHPEAE@Z 0000000140001480 f   Source.obj
+ 0001:0000057c       ?ReadFileContent@@YAPEADAEAPEAUCustomHead@@PEAPEAE@Z 000000014000157c f   Source.obj
+ 0001:000005fc       ?Reloaction@@YAXPEADPEAUCustomHead@@@Z 00000001400015fc f   Source.obj
+ 0001:00000698       ?Run@@YAXPEAUCustomHead@@PEAD@Z 0000000140001698 f   Source.obj
+ 0001:000006b0       _initialize_invalid_parameter_handler 00000001400016b0 f i MSVCRTD:invalid_parameter_handler.obj
+ 0001:000006b0       ?__empty_global_delete@@YAXPEAX_K@Z 00000001400016b0 f i Source.obj
+ 0001:000006b0       _initialize_denormal_control 00000001400016b0 f i MSVCRTD:denormal_control.obj
+ 0001:000006b0       ?__empty_global_delete@@YAXPEAX@Z 00000001400016b0 f i Source.obj
+ 0001:000006b4       ?getHash@@YAKPEBD@Z        00000001400016b4 f   Source.obj
+ 0001:000006e0       ?getUnicodeHash@@YAKPEB_W@Z 00000001400016e0 f   Source.obj
+ 0001:0000070c       main                       000000014000170c f   Source.obj
+ 0001:000009d0       ?configure_argv@__scrt_narrow_argv_policy@@SAHXZ 00000001400019d0 f i MSVCRTD:exe_main.obj
+ 0001:000009f0       ?initialize_environment@__scrt_narrow_environment_policy@@SAHXZ 00000001400019f0 f i MSVCRTD:exe_main.obj
+ 0001:00000a40       ?set_app_type@__scrt_main_policy@@SAXXZ 0000000140001a40 f i MSVCRTD:exe_main.obj
+ 0001:00000a60       ?set_commode@__scrt_file_policy@@SAXXZ 0000000140001a60 f i MSVCRTD:exe_main.obj
+ 0001:00000a80       ?set_fmode@__scrt_file_policy@@SAXXZ 0000000140001a80 f i MSVCRTD:exe_main.obj
+ 0001:00000aa0       mainCRTStartup             0000000140001aa0 f   MSVCRTD:exe_main.obj
+ 0001:00000ab0       ??$__crt_fast_decode_pointer@PEAP6AXXZ@@YAPEAP6AXXZQEAP6AXXZ@Z 0000000140001ab0 f i MSVCRTD:utility.obj
+ 0001:00000af0       ??$__crt_fast_encode_pointer@PEAP6AXXZ@@YAPEAP6AXXZQEAP6AXXZ@Z 0000000140001af0 f i MSVCRTD:utility.obj
+ 0001:00000b30       ?__crt_rotate_pointer_value@@YA_K_KH@Z 0000000140001b30 f i MSVCRTD:utility.obj
+ 0001:00000cb0       NtCurrentTeb               0000000140001cb0 f i MSVCRTD:utility.obj
+ 0001:00000cc0       __scrt_acquire_startup_lock 0000000140001cc0 f   MSVCRTD:utility.obj
+ 0001:00000d30       __scrt_dllmain_after_initialize_c 0000000140001d30 f   MSVCRTD:utility.obj
+ 0001:00000d60       __scrt_dllmain_before_initialize_c 0000000140001d60 f   MSVCRTD:utility.obj
+ 0001:00000d80       __scrt_dllmain_crt_thread_attach 0000000140001d80 f   MSVCRTD:utility.obj
+ 0001:00000db0       __scrt_dllmain_crt_thread_detach 0000000140001db0 f   MSVCRTD:utility.obj
+ 0001:00000dd0       __scrt_dllmain_exception_filter 0000000140001dd0 f   MSVCRTD:utility.obj
+ 0001:00000e30       __scrt_dllmain_uninitialize_c 0000000140001e30 f   MSVCRTD:utility.obj
+ 0001:00000e60       __scrt_dllmain_uninitialize_critical 0000000140001e60 f   MSVCRTD:utility.obj
+ 0001:00000e80       __scrt_initialize_crt      0000000140001e80 f   MSVCRTD:utility.obj
+ 0001:00000ed0       __scrt_initialize_onexit_tables 0000000140001ed0 f   MSVCRTD:utility.obj
+ 0001:00000fe0       __scrt_is_nonwritable_in_current_image 0000000140001fe0 f   MSVCRTD:utility.obj
+ 0001:00001070       __scrt_release_startup_lock 0000000140002070 f   MSVCRTD:utility.obj
+ 0001:000010a0       __scrt_uninitialize_crt    00000001400020a0 f   MSVCRTD:utility.obj
+ 0001:000010e0       _onexit                    00000001400020e0 f   MSVCRTD:utility.obj
+ 0001:00001170       at_quick_exit              0000000140002170 f   MSVCRTD:utility.obj
+ 0001:000011c0       atexit                     00000001400021c0 f   MSVCRTD:utility.obj
+ 0001:000012c0       __security_init_cookie     00000001400022c0 f   MSVCRTD:gs_support.obj
+ 0001:00001340       _matherr                   0000000140002340 f   MSVCRTD:matherr.obj
+ 0001:00001350       _get_startup_argv_mode     0000000140002350 f   MSVCRTD:argv_mode.obj
+ 0001:00001360       _get_startup_thread_locale_mode 0000000140002360 f   MSVCRTD:thread_locale.obj
+ 0001:00001360       __scrt_exe_initialize_mta  0000000140002360 f   MSVCRTD:utility_desktop.obj
+ 0001:00001360       _guard_rf_checks_enforced  0000000140002360 f   MSVCRTD:guard_support.obj
+ 0001:00001360       __scrt_initialize_winrt    0000000140002360 f   MSVCRTD:utility_desktop.obj
+ 0001:00001360       _get_startup_new_mode      0000000140002360 f   MSVCRTD:new_mode.obj
+ 0001:00001360       __scrt_stub_for_is_c_termination_complete 0000000140002360 f   MSVCRTD:ucrt_stubs.obj
+ 0001:00001360       _is_c_termination_complete 0000000140002360 f   MSVCRTD:ucrt_stubs.obj
+ 0001:00001360       __scrt_stub_for_initialize_mta 0000000140002360 f   MSVCRTD:utility_desktop.obj
+ 0001:00001360       _get_startup_commit_mode   0000000140002360 f   MSVCRTD:commit_mode.obj
+ 0001:00001370       _get_startup_file_mode     0000000140002370 f   MSVCRTD:file_mode.obj
+ 0001:00001380       ?__scrt_initialize_type_info@@YAXXZ 0000000140002380 f   MSVCRTD:tncleanup.obj
+ 0001:000013a0       ?__scrt_uninitialize_type_info@@YAXXZ 00000001400023a0 f   MSVCRTD:tncleanup.obj
+ 0001:000013c0       __acrt_initialize          00000001400023c0 f   MSVCRTD:ucrt_stubs.obj
+ 0001:000013c0       __vcrt_thread_attach       00000001400023c0 f   MSVCRTD:ucrt_stubs.obj
+ 0001:000013c0       __scrt_stub_for_acrt_initialize 00000001400023c0 f   MSVCRTD:ucrt_stubs.obj
+ 0001:000013c0       _should_initialize_environment 00000001400023c0 f   MSVCRTD:env_mode.obj
+ 0001:000013c0       __acrt_thread_attach       00000001400023c0 f   MSVCRTD:ucrt_stubs.obj
+ 0001:000013c0       __acrt_thread_detach       00000001400023c0 f   MSVCRTD:ucrt_stubs.obj
+ 0001:000013c0       __scrt_stub_for_acrt_thread_detach 00000001400023c0 f   MSVCRTD:ucrt_stubs.obj
+ 0001:000013c0       __vcrt_thread_detach       00000001400023c0 f   MSVCRTD:ucrt_stubs.obj
+ 0001:000013c0       __vcrt_initialize          00000001400023c0 f   MSVCRTD:ucrt_stubs.obj
+ 0001:000013c0       __scrt_stub_for_acrt_thread_attach 00000001400023c0 f   MSVCRTD:ucrt_stubs.obj
+ 0001:000013d0       __local_stdio_printf_options 00000001400023d0 f i MSVCRTD:default_local_stdio_options.obj
+ 0001:000013e0       __local_stdio_scanf_options 00000001400023e0 f i MSVCRTD:default_local_stdio_options.obj
+ 0001:000013f0       __scrt_initialize_default_local_stdio_options 00000001400023f0 f   MSVCRTD:default_local_stdio_options.obj
+ 0001:00001440       __scrt_is_user_matherr_present 0000000140002440 f   MSVCRTD:matherr_detection.obj
+ 0001:00001470       __scrt_get_dyn_tls_init_callback 0000000140002470 f   MSVCRTD:dyn_tls_init.obj
+ 0001:00001480       __scrt_get_dyn_tls_dtor_callback 0000000140002480 f   MSVCRTD:dyn_tls_dtor.obj
+ 0001:00001490       __crt_debugger_hook        0000000140002490 f   MSVCRTD:utility_desktop.obj
+ 0001:000014a0       __scrt_fastfail            00000001400024a0 f   MSVCRTD:utility_desktop.obj
+ 0001:00001640       __scrt_get_show_window_mode 0000000140002640 f   MSVCRTD:utility_desktop.obj
+ 0001:000016a0       __scrt_initialize_mta      00000001400026a0 f   MSVCRTD:utility_desktop.obj
+ 0001:000016b0       __scrt_is_managed_app      00000001400026b0 f   MSVCRTD:utility_desktop.obj
+ 0001:00001760       __scrt_set_unhandled_exception_filter 0000000140002760 f   MSVCRTD:utility_desktop.obj
+ 0001:00001780       __scrt_unhandled_exception_filter 0000000140002780 f   MSVCRTD:utility_desktop.obj
+ 0001:00001800       _RTC_Initialize            0000000140002800 f   MSVCRTD:initsect.obj
+ 0001:00001850       _RTC_Terminate             0000000140002850 f   MSVCRTD:initsect.obj
+ 0001:000018a0       _guard_check_icall_nop     00000001400028a0 f i MSVCRTD:guard_support.obj
+ 0001:000018b0       ReadNoFence64              00000001400028b0 f i MSVCRTD:guard_support.obj
+ 0001:000018d0       ReadPointerNoFence         00000001400028d0 f i MSVCRTD:guard_support.obj
+ 0001:000018f0       _guard_icall_checks_enforced 00000001400028f0 f i MSVCRTD:guard_support.obj
+ 0001:00001930       __isa_available_init       0000000140002930 f   MSVCRTD:cpu_disp.obj
+ 0001:00001c80       __scrt_is_ucrt_dll_in_use  0000000140002c80 f   MSVCRTD:ucrt_detection.obj
+ 0001:00001cb0       __GSHandlerCheck           0000000140002cb0 f   MSVCRTD:gshandler.obj
+ 0001:00001cf0       __GSHandlerCheckCommon     0000000140002cf0 f   MSVCRTD:gshandler.obj
+ 0001:00001e00       __security_check_cookie    0000000140002e00 f   MSVCRTD:amdsecgs.obj
+ 0001:00001e30       __raise_securityfailure    0000000140002e30 f   MSVCRTD:gs_report.obj
+ 0001:00001e70       __report_gsfailure         0000000140002e70 f   MSVCRTD:gs_report.obj
+ 0001:00001f50       __report_rangecheckfailure 0000000140002f50 f   MSVCRTD:gs_report.obj
+ 0001:00001f70       __report_securityfailure   0000000140002f70 f   MSVCRTD:gs_report.obj
+ 0001:00002010       __report_securityfailureEx 0000000140003010 f   MSVCRTD:gs_report.obj
+ 0001:00002272       __C_specific_handler       0000000140003272 f   vcruntimed:VCRUNTIME140D.dll
+ 0001:00002278       __std_type_info_destroy_list 0000000140003278 f   vcruntimed:VCRUNTIME140D.dll
+ 0001:0000227e       _seh_filter_exe            000000014000327e f   ucrtd:ucrtbased.dll
+ 0001:00002284       _set_app_type              0000000140003284 f   ucrtd:ucrtbased.dll
+ 0001:0000228a       __setusermatherr           000000014000328a f   ucrtd:ucrtbased.dll
+ 0001:00002290       _configure_narrow_argv     0000000140003290 f   ucrtd:ucrtbased.dll
+ 0001:00002296       _initialize_narrow_environment 0000000140003296 f   ucrtd:ucrtbased.dll
+ 0001:0000229c       _get_initial_narrow_environment 000000014000329c f   ucrtd:ucrtbased.dll
+ 0001:000022a2       _initterm                  00000001400032a2 f   ucrtd:ucrtbased.dll
+ 0001:000022a8       _initterm_e                00000001400032a8 f   ucrtd:ucrtbased.dll
+ 0001:000022ae       exit                       00000001400032ae f   ucrtd:ucrtbased.dll
+ 0001:000022b4       _exit                      00000001400032b4 f   ucrtd:ucrtbased.dll
+ 0001:000022ba       _set_fmode                 00000001400032ba f   ucrtd:ucrtbased.dll
+ 0001:000022c0       __p___argc                 00000001400032c0 f   ucrtd:ucrtbased.dll
+ 0001:000022c6       __p___argv                 00000001400032c6 f   ucrtd:ucrtbased.dll
+ 0001:000022cc       _cexit                     00000001400032cc f   ucrtd:ucrtbased.dll
+ 0001:000022d2       _c_exit                    00000001400032d2 f   ucrtd:ucrtbased.dll
+ 0001:000022d8       _register_thread_local_exe_atexit_callback 00000001400032d8 f   ucrtd:ucrtbased.dll
+ 0001:000022de       _configthreadlocale        00000001400032de f   ucrtd:ucrtbased.dll
+ 0001:000022e4       _set_new_mode              00000001400032e4 f   ucrtd:ucrtbased.dll
+ 0001:000022ea       __p__commode               00000001400032ea f   ucrtd:ucrtbased.dll
+ 0001:000022f0       _seh_filter_dll            00000001400032f0 f   ucrtd:ucrtbased.dll
+ 0001:000022f6       _initialize_onexit_table   00000001400032f6 f   ucrtd:ucrtbased.dll
+ 0001:000022fc       _register_onexit_function  00000001400032fc f   ucrtd:ucrtbased.dll
+ 0001:00002302       _execute_onexit_table      0000000140003302 f   ucrtd:ucrtbased.dll
+ 0001:00002308       _crt_atexit                0000000140003308 f   ucrtd:ucrtbased.dll
+ 0001:0000230e       _crt_at_quick_exit         000000014000330e f   ucrtd:ucrtbased.dll
+ 0001:00002314       terminate                  0000000140003314 f   ucrtd:ucrtbased.dll
+ 0001:0000231a       QueryPerformanceCounter    000000014000331a f   kernel32:KERNEL32.dll
+ 0001:00002320       GetCurrentProcessId        0000000140003320 f   kernel32:KERNEL32.dll
+ 0001:00002326       GetCurrentThreadId         0000000140003326 f   kernel32:KERNEL32.dll
+ 0001:0000232c       GetSystemTimeAsFileTime    000000014000332c f   kernel32:KERNEL32.dll
+ 0001:00002332       InitializeSListHead        0000000140003332 f   kernel32:KERNEL32.dll
+ 0001:00002338       RtlCaptureContext          0000000140003338 f   kernel32:KERNEL32.dll
+ 0001:0000233e       RtlLookupFunctionEntry     000000014000333e f   kernel32:KERNEL32.dll
+ 0001:00002344       RtlVirtualUnwind           0000000140003344 f   kernel32:KERNEL32.dll
+ 0001:0000234a       IsDebuggerPresent          000000014000334a f   kernel32:KERNEL32.dll
+ 0001:00002350       UnhandledExceptionFilter   0000000140003350 f   kernel32:KERNEL32.dll
+ 0001:00002356       SetUnhandledExceptionFilter 0000000140003356 f   kernel32:KERNEL32.dll
+ 0001:0000235c       GetStartupInfoW            000000014000335c f   kernel32:KERNEL32.dll
+ 0001:00002362       IsProcessorFeaturePresent  0000000140003362 f   kernel32:KERNEL32.dll
+ 0001:00002368       GetModuleHandleW           0000000140003368 f   kernel32:KERNEL32.dll
+ 0001:0000236e       GetCurrentProcess          000000014000336e f   kernel32:KERNEL32.dll
+ 0001:00002374       TerminateProcess           0000000140003374 f   kernel32:KERNEL32.dll
+ 0001:00002380       __acrt_uninitialize_critical 0000000140003380 f   MSVCRTD:ucrt_stubs.obj
+ 0001:00002380       __scrt_stub_for_acrt_uninitialize_critical 0000000140003380 f   MSVCRTD:ucrt_stubs.obj
+ 0001:00002380       __acrt_uninitialize        0000000140003380 f   MSVCRTD:ucrt_stubs.obj
+ 0001:00002380       __vcrt_uninitialize_critical 0000000140003380 f   MSVCRTD:ucrt_stubs.obj
+ 0001:00002380       __vcrt_uninitialize        0000000140003380 f   MSVCRTD:ucrt_stubs.obj
+ 0001:00002380       __scrt_stub_for_acrt_uninitialize 0000000140003380 f   MSVCRTD:ucrt_stubs.obj
+ 0001:000023a0       _guard_dispatch_icall_nop  00000001400033a0 f   MSVCRTD:guard_dispatch.obj
+ 0002:00000000       __imp_IsDebuggerPresent    0000000140004000     kernel32:KERNEL32.dll
+ 0002:00000008       __imp_GetCurrentProcessId  0000000140004008     kernel32:KERNEL32.dll
+ 0002:00000010       __imp_TerminateProcess     0000000140004010     kernel32:KERNEL32.dll
+ 0002:00000018       __imp_GetCurrentProcess    0000000140004018     kernel32:KERNEL32.dll
+ 0002:00000020       __imp_GetModuleHandleW     0000000140004020     kernel32:KERNEL32.dll
+ 0002:00000028       __imp_IsProcessorFeaturePresent 0000000140004028     kernel32:KERNEL32.dll
+ 0002:00000030       __imp_GetStartupInfoW      0000000140004030     kernel32:KERNEL32.dll
+ 0002:00000038       __imp_SetUnhandledExceptionFilter 0000000140004038     kernel32:KERNEL32.dll
+ 0002:00000040       __imp_UnhandledExceptionFilter 0000000140004040     kernel32:KERNEL32.dll
+ 0002:00000048       __imp_QueryPerformanceCounter 0000000140004048     kernel32:KERNEL32.dll
+ 0002:00000050       __imp_RtlVirtualUnwind     0000000140004050     kernel32:KERNEL32.dll
+ 0002:00000058       __imp_RtlLookupFunctionEntry 0000000140004058     kernel32:KERNEL32.dll
+ 0002:00000060       __imp_RtlCaptureContext    0000000140004060     kernel32:KERNEL32.dll
+ 0002:00000068       __imp_InitializeSListHead  0000000140004068     kernel32:KERNEL32.dll
+ 0002:00000070       __imp_GetSystemTimeAsFileTime 0000000140004070     kernel32:KERNEL32.dll
+ 0002:00000078       __imp_GetCurrentThreadId   0000000140004078     kernel32:KERNEL32.dll
+ 0002:00000080       \177KERNEL32_NULL_THUNK_DATA 0000000140004080     kernel32:KERNEL32.dll
+ 0002:00000088       __imp___std_type_info_destroy_list 0000000140004088     vcruntimed:VCRUNTIME140D.dll
+ 0002:00000090       __imp___C_specific_handler 0000000140004090     vcruntimed:VCRUNTIME140D.dll
+ 0002:00000098       \177VCRUNTIME140D_NULL_THUNK_DATA 0000000140004098     vcruntimed:VCRUNTIME140D.dll
+ 0002:000000a0       __imp__set_new_mode        00000001400040a0     ucrtd:ucrtbased.dll
+ 0002:000000a8       __imp___p__commode         00000001400040a8     ucrtd:ucrtbased.dll
+ 0002:000000b0       __imp__seh_filter_dll      00000001400040b0     ucrtd:ucrtbased.dll
+ 0002:000000b8       __imp__register_thread_local_exe_atexit_callback 00000001400040b8     ucrtd:ucrtbased.dll
+ 0002:000000c0       __imp__register_onexit_function 00000001400040c0     ucrtd:ucrtbased.dll
+ 0002:000000c8       __imp__execute_onexit_table 00000001400040c8     ucrtd:ucrtbased.dll
+ 0002:000000d0       __imp__crt_atexit          00000001400040d0     ucrtd:ucrtbased.dll
+ 0002:000000d8       __imp__crt_at_quick_exit   00000001400040d8     ucrtd:ucrtbased.dll
+ 0002:000000e0       __imp_terminate            00000001400040e0     ucrtd:ucrtbased.dll
+ 0002:000000e8       __imp__configthreadlocale  00000001400040e8     ucrtd:ucrtbased.dll
+ 0002:000000f0       __imp__c_exit              00000001400040f0     ucrtd:ucrtbased.dll
+ 0002:000000f8       __imp__cexit               00000001400040f8     ucrtd:ucrtbased.dll
+ 0002:00000100       __imp___p___argv           0000000140004100     ucrtd:ucrtbased.dll
+ 0002:00000108       __imp___p___argc           0000000140004108     ucrtd:ucrtbased.dll
+ 0002:00000110       __imp__set_fmode           0000000140004110     ucrtd:ucrtbased.dll
+ 0002:00000118       __imp__exit                0000000140004118     ucrtd:ucrtbased.dll
+ 0002:00000120       __imp_exit                 0000000140004120     ucrtd:ucrtbased.dll
+ 0002:00000128       __imp__initterm_e          0000000140004128     ucrtd:ucrtbased.dll
+ 0002:00000130       __imp__initterm            0000000140004130     ucrtd:ucrtbased.dll
+ 0002:00000138       __imp__get_initial_narrow_environment 0000000140004138     ucrtd:ucrtbased.dll
+ 0002:00000140       __imp__initialize_narrow_environment 0000000140004140     ucrtd:ucrtbased.dll
+ 0002:00000148       __imp__configure_narrow_argv 0000000140004148     ucrtd:ucrtbased.dll
+ 0002:00000150       __imp___setusermatherr     0000000140004150     ucrtd:ucrtbased.dll
+ 0002:00000158       __imp__set_app_type        0000000140004158     ucrtd:ucrtbased.dll
+ 0002:00000160       __imp__seh_filter_exe      0000000140004160     ucrtd:ucrtbased.dll
+ 0002:00000168       __imp__initialize_onexit_table 0000000140004168     ucrtd:ucrtbased.dll
+ 0002:00000170       \177ucrtbased_NULL_THUNK_DATA 0000000140004170     ucrtd:ucrtbased.dll
+ 0002:00000178       __guard_check_icall_fptr   0000000140004178     MSVCRTD:guard_support.obj
+ 0002:00000180       __guard_dispatch_icall_fptr 0000000140004180     MSVCRTD:guard_support.obj
+ 0002:00000188       __xc_a                     0000000140004188     MSVCRTD:initializers.obj
+ 0002:00000198       __xc_z                     0000000140004198     MSVCRTD:initializers.obj
+ 0002:000001a0       __xi_a                     00000001400041a0     MSVCRTD:initializers.obj
+ 0002:000001b8       __xi_z                     00000001400041b8     MSVCRTD:initializers.obj
+ 0002:000001c0       __xp_a                     00000001400041c0     MSVCRTD:initializers.obj
+ 0002:000001c8       __xp_z                     00000001400041c8     MSVCRTD:initializers.obj
+ 0002:000001d0       __xt_a                     00000001400041d0     MSVCRTD:initializers.obj
+ 0002:000001d8       __xt_z                     00000001400041d8     MSVCRTD:initializers.obj
+ 0002:00000250       _load_config_used          0000000140004250     MSVCRTD:loadcfg.obj
+ 0002:00000620       __rtc_iaa                  0000000140004620     MSVCRTD:initsect.obj
+ 0002:00000628       __rtc_izz                  0000000140004628     MSVCRTD:initsect.obj
+ 0002:00000630       __rtc_taa                  0000000140004630     MSVCRTD:initsect.obj
+ 0002:00000638       __rtc_tzz                  0000000140004638     MSVCRTD:initsect.obj
+ 0002:0000081c       __IMPORT_DESCRIPTOR_VCRUNTIME140D 000000014000481c     vcruntimed:VCRUNTIME140D.dll
+ 0002:00000830       __IMPORT_DESCRIPTOR_ucrtbased 0000000140004830     ucrtd:ucrtbased.dll
+ 0002:00000844       __IMPORT_DESCRIPTOR_KERNEL32 0000000140004844     kernel32:KERNEL32.dll
+ 0002:00000858       __NULL_IMPORT_DESCRIPTOR   0000000140004858     vcruntimed:VCRUNTIME140D.dll
+ 0003:00000000       __scrt_native_dllmain_reason 0000000140005000     MSVCRTD:utility.obj
+ 0003:00000004       __scrt_default_matherr     0000000140005004     MSVCRTD:matherr.obj
+ 0003:00000008       __isa_available            0000000140005008     MSVCRTD:cpu_disp.obj
+ 0003:0000000c       __isa_enabled              000000014000500c     MSVCRTD:cpu_disp.obj
+ 0003:00000010       __memcpy_nt_iters          0000000140005010     MSVCRTD:cpu_disp.obj
+ 0003:00000018       __security_cookie_complement 0000000140005018     MSVCRTD:gs_cookie.obj
+ 0003:00000020       __security_cookie          0000000140005020     MSVCRTD:gs_cookie.obj
+ 0003:00000030       __scrt_ucrt_dll_is_in_use  0000000140005030     MSVCRTD:ucrt_stubs.obj
+ 0003:00000040       __scrt_current_native_startup_state 0000000140005040     MSVCRTD:utility.obj
+ 0003:00000048       __scrt_native_startup_lock 0000000140005048     MSVCRTD:utility.obj
+ 0003:00000090       ?__type_info_root_node@@3U__type_info_node@@A 0000000140005090     MSVCRTD:tncleanup.obj
+ 0003:000000a0       ?_OptionsStorage@?1??__local_stdio_printf_options@@9@4_KA 00000001400050a0     MSVCRTD:default_local_stdio_options.obj
+ 0003:000000a8       ?_OptionsStorage@?1??__local_stdio_scanf_options@@9@4_KA 00000001400050a8     MSVCRTD:default_local_stdio_options.obj
+ 0003:000000b0       __scrt_debugger_hook_flag  00000001400050b0     MSVCRTD:utility_desktop.obj
+ 0003:000000b4       __favor                    00000001400050b4     MSVCRTD:cpu_disp.obj
+ 0003:00000630       __dyn_tls_dtor_callback    0000000140005630     <common>
+ 0003:00000638       __dyn_tls_init_callback    0000000140005638     <common>
+
+ entry point at        0001:00000aa0
+
+ Static symbols
+
+ 0002:ffffbfff       __guard_fids__guard_icall_checks_enforced 000000023fffffff     MSVCRTD:guard_support.obj
+ 0002:ffffbfff       __guard_fids__             000000023fffffff     MSVCRTD:guard_support.obj
+ 0000:ffff7000       .debug$S                   0000000140000000     kernel32:KERNEL32.dll
+ 0000:ffff7000       .debug$S                   0000000140000000     kernel32:KERNEL32.dll
+ 0000:ffff7000       .debug$S                   0000000140000000     kernel32:KERNEL32.dll
+ 0000:ffff7000       .debug$S                   0000000140000000     kernel32:KERNEL32.dll
+ 0000:ffff7000       .debug$S                   0000000140000000     kernel32:KERNEL32.dll
+ 0000:ffff7000       .debug$S                   0000000140000000     kernel32:KERNEL32.dll
+ 0000:ffff7000       .debug$S                   0000000140000000     kernel32:KERNEL32.dll
+ 0000:ffff7000       .debug$S                   0000000140000000     kernel32:KERNEL32.dll
+ 0000:ffff7000       .debug$S                   0000000140000000     kernel32:KERNEL32.dll
+ 0000:ffff7000       .debug$S                   0000000140000000     kernel32:KERNEL32.dll
+ 0000:ffff7000       .debug$S                   0000000140000000     kernel32:KERNEL32.dll
+ 0000:ffff7000       .debug$S                   0000000140000000     kernel32:KERNEL32.dll
+ 0000:ffff7000       .debug$S                   0000000140000000     kernel32:KERNEL32.dll
+ 0000:ffff7000       .debug$S                   0000000140000000     kernel32:KERNEL32.dll
+ 0000:ffff7000       .debug$S                   0000000140000000     kernel32:KERNEL32.dll
+ 0000:ffff7000       .debug$S                   0000000140000000     kernel32:KERNEL32.dll
+ 0004:ffffa000       $pdata$?initialize_environment@__scrt_narrow_environment_policy@@SAHXZ 0000000140000000     MSVCRTD:utility.obj
+ 0000:ffff7000       .debug$S                   0000000140000000     ucrtd:ucrtbased.dll
+ 0000:ffff7000       .debug$S                   0000000140000000     ucrtd:ucrtbased.dll
+ 0000:ffff7000       .debug$S                   0000000140000000     ucrtd:ucrtbased.dll
+ 0000:ffff7000       .debug$S                   0000000140000000     ucrtd:ucrtbased.dll
+ 0000:ffff7000       .debug$S                   0000000140000000     ucrtd:ucrtbased.dll
+ 0000:ffff7000       .debug$S                   0000000140000000     ucrtd:ucrtbased.dll
+ 0000:ffff7000       .debug$S                   0000000140000000     ucrtd:ucrtbased.dll
+ 0000:ffff7000       .debug$S                   0000000140000000     ucrtd:ucrtbased.dll
+ 0000:ffff7000       .debug$S                   0000000140000000     ucrtd:ucrtbased.dll
+ 0000:ffff7000       .debug$S                   0000000140000000     ucrtd:ucrtbased.dll
+ 0000:ffff7000       .debug$S                   0000000140000000     ucrtd:ucrtbased.dll
+ 0000:ffff7000       .debug$S                   0000000140000000     ucrtd:ucrtbased.dll
+ 0000:ffff7000       .debug$S                   0000000140000000     ucrtd:ucrtbased.dll
+ 0000:ffff7000       .debug$S                   0000000140000000     ucrtd:ucrtbased.dll
+ 0000:ffff7000       .debug$S                   0000000140000000     ucrtd:ucrtbased.dll
+ 0000:ffff7000       .debug$S                   0000000140000000     ucrtd:ucrtbased.dll
+ 0000:ffff7000       .debug$S                   0000000140000000     ucrtd:ucrtbased.dll
+ 0000:ffff7000       .debug$S                   0000000140000000     ucrtd:ucrtbased.dll
+ 0000:ffff7000       .debug$S                   0000000140000000     ucrtd:ucrtbased.dll
+ 0002:ffffc000       __guard_fids_?pre_c_initialization@@YAHXZ 0000000140000000     MSVCRTD:exe_main.obj
+ 0000:ffff7000       .debug$S                   0000000140000000     ucrtd:ucrtbased.dll
+ 0000:ffff7000       .debug$S                   0000000140000000     ucrtd:ucrtbased.dll
+ 0000:ffff7000       .debug$S                   0000000140000000     ucrtd:ucrtbased.dll
+ 0000:ffff7000       .debug$S                   0000000140000000     ucrtd:ucrtbased.dll
+ 0000:ffff7000       .debug$S                   0000000140000000     ucrtd:ucrtbased.dll
+ 0000:ffff7000       .debug$S                   0000000140000000     ucrtd:ucrtbased.dll
+ 0002:ffffc000       $unwind$?initialize_environment@__scrt_narrow_environment_policy@@SAHXZ 0000000140000000     MSVCRTD:utility.obj
+ 0000:ffff7000       .debug$S                   0000000140000000     vcruntimed:VCRUNTIME140D.dll
+ 0000:ffff7000       .debug$S                   0000000140000000     vcruntimed:VCRUNTIME140D.dll
+ 0004:ffffa000       $pdata$?configure_argv@__scrt_narrow_argv_policy@@SAHXZ 0000000140000000     MSVCRTD:utility.obj
+ 0002:ffffc000       $unwind$?configure_argv@__scrt_narrow_argv_policy@@SAHXZ 0000000140000000     MSVCRTD:utility.obj
+ 0002:ffffc000       __guard_fids___scrt_set_unhandled_exception_filter 0000000140000000     MSVCRTD:utility_desktop.obj
+ 0000:ffff7000       .debug$S                   0000000140000000     ucrtd:ucrtbased.dll
+ 0002:ffffc000       __guard_fids__             0000000140000000     MSVCRTD:exe_main.obj
+ 0002:ffffc004       __guard_fids__             0000000140000004     MSVCRTD:exe_main.obj
+ 0002:ffffc008       __guard_fids__             0000000140000008     MSVCRTD:exe_main.obj
+ 0001:00000720       ?pre_c_initialization@@YAHXZ 0000000140001720 f   MSVCRTD:exe_main.obj
+ 0001:000007e0       ?post_pgo_initialization@@YAHXZ 00000001400017e0 f   MSVCRTD:exe_main.obj
+ 0001:000007f0       ?pre_cpp_initialization@@YAXXZ 00000001400017f0 f   MSVCRTD:exe_main.obj
+ 0001:00000810       ?__scrt_common_main@@YAHXZ 0000000140001810 f   MSVCRTD:exe_main.obj
+ 0001:00000830       ?__scrt_common_main_seh@@YAHXZ 0000000140001830 f   MSVCRTD:exe_main.obj
+ 0001:00000a00       ?invoke_main@@YAHXZ        0000000140001a00 f   MSVCRTD:exe_main.obj
+ 0001:00000b50       ?find_pe_section@@YAPEAU_IMAGE_SECTION_HEADER@@QEAE_K@Z 0000000140001b50 f   MSVCRTD:utility.obj
+ 0001:00000c20       ?is_potentially_valid_image_base@@YA_NQEAX@Z 0000000140001c20 f   MSVCRTD:utility.obj
+ 0001:00001200       __get_entropy              0000000140002200 f   MSVCRTD:gs_support.obj
+ 0001:00001df0       $$000000                   0000000140002df0     MSVCRTD:amdsecgs.obj
+ 0001:00002120       capture_current_context    0000000140003120 f   MSVCRTD:gs_report.obj
+ 0001:000021c0       capture_previous_context   00000001400031c0 f   MSVCRTD:gs_report.obj
+ 0001:00002390       $$000000                   0000000140003390     MSVCRTD:guard_dispatch.obj
+ 0001:000023b0       ?filt$0@?0??__scrt_common_main_seh@@YAHXZ@4HA 00000001400033b0 f   MSVCRTD:exe_main.obj
+ 0001:000023e0       __scrt_is_nonwritable_in_current_image$filt$0 00000001400033e0 f   MSVCRTD:utility.obj
+ 0002:00000190       ?pre_cpp_initializer@@3P6AXXZEA 0000000140004190     MSVCRTD:exe_main.obj
+ 0002:000001a8       ?pre_c_initializer@@3P6AHXZEA 00000001400041a8     MSVCRTD:exe_main.obj
+ 0002:000001b0       ?post_pgo_initializer@@3P6AHXZEA 00000001400041b0     MSVCRTD:exe_main.obj
+ 0002:000001e0       GS_ExceptionPointers       00000001400041e0     MSVCRTD:gs_report.obj
+ 0002:00000640       $unwind$?func@@YAXXZ       0000000140004640     Source.obj
+ 0002:00000658       $unwind$?Rc4Decrypt@@YAXPEADHPEAE@Z 0000000140004658     Source.obj
+ 0002:00000674       $unwind$?GetFunction@@YAPEADKK@Z 0000000140004674     Source.obj
+ 0002:00000690       $unwind$?ReadFileContent@@YAPEADAEAPEAUCustomHead@@PEAPEAE@Z 0000000140004690     Source.obj
+ 0002:000006a0       $unwind$?ApplySpace@@YAPEADPEADP6APEAXPEAX_KKK@ZPEAUCustomHead@@@Z 00000001400046a0     Source.obj
+ 0002:000006b0       $unwind$?CopyToMemory@@YAXPEAD0PEAUCustomHead@@@Z 00000001400046b0     Source.obj
+ 0002:000006c8       $unwind$?Reloaction@@YAXPEADPEAUCustomHead@@@Z 00000001400046c8     Source.obj
+ 0002:000006d4       $unwind$?LoadDll@@YAXPEADP6APEAUHINSTANCE__@@PEBD@Z2P6AP6A_JXZPEAU1@1@ZPEAUCustomHead@@@Z 00000001400046d4     Source.obj
+ 0002:000006ec       $unwind$?DeCompress@@YAPEADPEADPEAUCustomHead@@P6APEAXPEAX_KKK@ZP6AKK2K2KPEAK@Z@Z 00000001400046ec     Source.obj
+ 0002:00000700       $unwind$?post_pgo_initialization@@YAHXZ 0000000140004700     MSVCRTD:exe_main.obj
+ 0002:00000700       $unwind$?pre_cpp_initialization@@YAXXZ 0000000140004700     MSVCRTD:exe_main.obj
+ 0002:00000700       $unwind$?__scrt_common_main@@YAHXZ 0000000140004700     MSVCRTD:exe_main.obj
+ 0002:00000700       $unwind$?configure_argv@__scrt_narrow_argv_policy@@SAHXZ 0000000140004700     MSVCRTD:exe_main.obj
+ 0002:00000700       $unwind$mainCRTStartup     0000000140004700     MSVCRTD:exe_main.obj
+ 0002:00000700       $unwind$__report_rangecheckfailure 0000000140004700     MSVCRTD:gs_report.obj
+ 0002:00000700       $unwind$?__scrt_initialize_type_info@@YAXXZ 0000000140004700     MSVCRTD:tncleanup.obj
+ 0002:00000700       $unwind$?pre_c_initialization@@YAHXZ 0000000140004700     MSVCRTD:exe_main.obj
+ 0002:00000700       $unwind$__scrt_dllmain_before_initialize_c 0000000140004700     MSVCRTD:utility.obj
+ 0002:00000700       $unwind$__scrt_dllmain_after_initialize_c 0000000140004700     MSVCRTD:utility.obj
+ 0002:00000700       $unwind$__scrt_dllmain_uninitialize_c 0000000140004700     MSVCRTD:utility.obj
+ 0002:00000700       $unwind$__scrt_dllmain_uninitialize_critical 0000000140004700     MSVCRTD:utility.obj
+ 0002:00000700       $unwind$__scrt_dllmain_crt_thread_attach 0000000140004700     MSVCRTD:utility.obj
+ 0002:00000700       $unwind$__scrt_set_unhandled_exception_filter 0000000140004700     MSVCRTD:utility_desktop.obj
+ 0002:00000700       $unwind$?initialize_environment@__scrt_narrow_environment_policy@@SAHXZ 0000000140004700     MSVCRTD:exe_main.obj
+ 0002:00000700       $unwind$__scrt_dllmain_crt_thread_detach 0000000140004700     MSVCRTD:utility.obj
+ 0002:00000700       $unwind$__scrt_initialize_mta 0000000140004700     MSVCRTD:utility_desktop.obj
+ 0002:00000700       $unwind$?set_app_type@__scrt_main_policy@@SAXXZ 0000000140004700     MSVCRTD:exe_main.obj
+ 0002:00000700       $unwind$main               0000000140004700     Source.obj
+ 0002:00000700       $unwind$?set_fmode@__scrt_file_policy@@SAXXZ 0000000140004700     MSVCRTD:exe_main.obj
+ 0002:00000700       $unwind$?__scrt_uninitialize_type_info@@YAXXZ 0000000140004700     MSVCRTD:tncleanup.obj
+ 0002:00000708       $unwind$?invoke_main@@YAHXZ 0000000140004708     MSVCRTD:exe_main.obj
+ 0002:00000708       $unwind$__security_init_cookie 0000000140004708     MSVCRTD:gs_support.obj
+ 0002:00000708       $unwind$__scrt_initialize_default_local_stdio_options 0000000140004708     MSVCRTD:default_local_stdio_options.obj
+ 0002:00000708       $unwind$?set_commode@__scrt_file_policy@@SAXXZ 0000000140004708     MSVCRTD:exe_main.obj
+ 0002:00000708       $unwind$_guard_icall_checks_enforced 0000000140004708     MSVCRTD:guard_support.obj
+ 0002:00000708       $unwind$__scrt_is_managed_app 0000000140004708     MSVCRTD:utility_desktop.obj
+ 0002:00000710       $unwind$?__scrt_common_main_seh@@YAHXZ 0000000140004710     MSVCRTD:exe_main.obj
+ 0002:00000730       $unwind$?filt$0@?0??__scrt_common_main_seh@@YAHXZ@4HA 0000000140004730     MSVCRTD:exe_main.obj
+ 0002:00000730       $unwind$__scrt_is_nonwritable_in_current_image$filt$0 0000000140004730     MSVCRTD:utility.obj
+ 0002:00000738       $unwind$__report_gsfailure 0000000140004738     MSVCRTD:gs_report.obj
+ 0002:00000738       $unwind$atexit             0000000140004738     MSVCRTD:utility.obj
+ 0002:00000738       $unwind$__scrt_unhandled_exception_filter 0000000140004738     MSVCRTD:utility_desktop.obj
+ 0002:00000738       $unwind$at_quick_exit      0000000140004738     MSVCRTD:utility.obj
+ 0002:00000740       $unwind$_onexit            0000000140004740     MSVCRTD:utility.obj
+ 0002:00000748       $unwind$__scrt_is_nonwritable_in_current_image 0000000140004748     MSVCRTD:utility.obj
+ 0002:00000768       $unwind$__scrt_acquire_startup_lock 0000000140004768     MSVCRTD:utility.obj
+ 0002:00000770       $unwind$__scrt_release_startup_lock 0000000140004770     MSVCRTD:utility.obj
+ 0002:00000770       $unwind$__scrt_initialize_crt 0000000140004770     MSVCRTD:utility.obj
+ 0002:00000770       $unwind$__report_securityfailure 0000000140004770     MSVCRTD:gs_report.obj
+ 0002:00000778       $unwind$__scrt_uninitialize_crt 0000000140004778     MSVCRTD:utility.obj
+ 0002:00000780       $unwind$__scrt_initialize_onexit_tables 0000000140004780     MSVCRTD:utility.obj
+ 0002:0000078c       $unwind$__scrt_dllmain_exception_filter 000000014000478c     MSVCRTD:utility.obj
+ 0002:00000794       $unwind$__raise_securityfailure 0000000140004794     MSVCRTD:gs_report.obj
+ 0002:00000794       $unwind$?is_potentially_valid_image_base@@YA_NQEAX@Z 0000000140004794     MSVCRTD:utility.obj
+ 0002:00000794       $unwind$??$__crt_fast_encode_pointer@PEAP6AXXZ@@YAPEAP6AXXZQEAP6AXXZ@Z 0000000140004794     MSVCRTD:utility.obj
+ 0002:00000794       $unwind$ReadPointerNoFence 0000000140004794     MSVCRTD:guard_support.obj
+ 0002:00000794       $unwind$??$__crt_fast_decode_pointer@PEAP6AXXZ@@YAPEAP6AXXZQEAP6AXXZ@Z 0000000140004794     MSVCRTD:utility.obj
+ 0002:0000079c       $unwind$?find_pe_section@@YAPEAU_IMAGE_SECTION_HEADER@@QEAE_K@Z 000000014000479c     MSVCRTD:utility.obj
+ 0002:000007a4       $unwind$__get_entropy      00000001400047a4     MSVCRTD:gs_support.obj
+ 0002:000007ac       $unwind$__scrt_is_user_matherr_present 00000001400047ac     MSVCRTD:matherr_detection.obj
+ 0002:000007ac       $unwind$__scrt_is_ucrt_dll_in_use 00000001400047ac     MSVCRTD:ucrt_detection.obj
+ 0002:000007b4       $unwind$__scrt_get_show_window_mode 00000001400047b4     MSVCRTD:utility_desktop.obj
+ 0002:000007c0       $unwind$__scrt_fastfail    00000001400047c0     MSVCRTD:utility_desktop.obj
+ 0002:000007cc       $unwind$_RTC_Terminate     00000001400047cc     MSVCRTD:initsect.obj
+ 0002:000007cc       $unwind$_RTC_Initialize    00000001400047cc     MSVCRTD:initsect.obj
+ 0002:000007d8       $unwind$ReadNoFence64      00000001400047d8     MSVCRTD:guard_support.obj
+ 0002:000007e0       $unwind$__isa_available_init 00000001400047e0     MSVCRTD:cpu_disp.obj
+ 0002:000007f0       $xdatasym                  00000001400047f0     MSVCRTD:guard_dispatch.obj
+ 0002:000007f4       $unwind$__GSHandlerCheckCommon 00000001400047f4     MSVCRTD:gshandler.obj
+ 0002:000007fc       $unwind$__GSHandlerCheck   00000001400047fc     MSVCRTD:gshandler.obj
+ 0002:00000808       $xdatasym                  0000000140004808     MSVCRTD:amdsecgs.obj
+ 0002:0000080c       $unwind$__report_securityfailureEx 000000014000480c     MSVCRTD:gs_report.obj
+ 0002:00000814       $unwind$capture_current_context 0000000140004814     MSVCRTD:gs_report.obj
+ 0002:00000814       $unwind$capture_previous_context 0000000140004814     MSVCRTD:gs_report.obj
+ 0002:00000a20       .idata$6                   0000000140004a20     vcruntimed:VCRUNTIME140D.dll
+ 0002:00000c24       .idata$6                   0000000140004c24     ucrtd:ucrtbased.dll
+ 0002:00000da2       .idata$6                   0000000140004da2     kernel32:KERNEL32.dll
+ 0003:00000050       ?is_initialized_as_dll@@3_NA 0000000140005050     MSVCRTD:utility.obj
+ 0003:00000051       ?module_local_atexit_table_initialized@@3_NA 0000000140005051     MSVCRTD:utility.obj
+ 0003:00000058       ?module_local_atexit_table@@3U_onexit_table_t@@A 0000000140005058     MSVCRTD:utility.obj
+ 0003:00000070       ?module_local_at_quick_exit_table@@3U_onexit_table_t@@A 0000000140005070     MSVCRTD:utility.obj
+ 0003:000000c0       GS_ExceptionRecord         00000001400050c0     MSVCRTD:gs_report.obj
+ 0003:00000160       GS_ContextRecord           0000000140005160     MSVCRTD:gs_report.obj
+ 0004:00000000       $pdata$?Rc4Decrypt@@YAXPEADHPEAE@Z 0000000140006000     Source.obj
+ 0004:0000000c       $pdata$?GetFunction@@YAPEADKK@Z 000000014000600c     Source.obj
+ 0004:00000018       $pdata$?ReadFileContent@@YAPEADAEAPEAUCustomHead@@PEAPEAE@Z 0000000140006018     Source.obj
+ 0004:00000024       $pdata$?ApplySpace@@YAPEADPEADP6APEAXPEAX_KKK@ZPEAUCustomHead@@@Z 0000000140006024     Source.obj
+ 0004:00000030       $pdata$?CopyToMemory@@YAXPEAD0PEAUCustomHead@@@Z 0000000140006030     Source.obj
+ 0004:0000003c       $pdata$?Reloaction@@YAXPEADPEAUCustomHead@@@Z 000000014000603c     Source.obj
+ 0004:00000048       $pdata$?LoadDll@@YAXPEADP6APEAUHINSTANCE__@@PEBD@Z2P6AP6A_JXZPEAU1@1@ZPEAUCustomHead@@@Z 0000000140006048     Source.obj
+ 0004:00000054       $pdata$?DeCompress@@YAPEADPEADPEAUCustomHead@@P6APEAXPEAX_KKK@ZP6AKK2K2KPEAK@Z@Z 0000000140006054     Source.obj
+ 0004:00000060       $pdata$?func@@YAXXZ        0000000140006060     Source.obj
+ 0004:0000006c       $pdata$main                000000014000606c     Source.obj
+ 0004:00000078       $pdata$?configure_argv@__scrt_narrow_argv_policy@@SAHXZ 0000000140006078     MSVCRTD:exe_main.obj
+ 0004:00000084       $pdata$?initialize_environment@__scrt_narrow_environment_policy@@SAHXZ 0000000140006084     MSVCRTD:exe_main.obj
+ 0004:00000090       $pdata$?set_app_type@__scrt_main_policy@@SAXXZ 0000000140006090     MSVCRTD:exe_main.obj
+ 0004:0000009c       $pdata$?set_fmode@__scrt_file_policy@@SAXXZ 000000014000609c     MSVCRTD:exe_main.obj
+ 0004:000000a8       $pdata$?set_commode@__scrt_file_policy@@SAXXZ 00000001400060a8     MSVCRTD:exe_main.obj
+ 0004:000000b4       $pdata$?invoke_main@@YAHXZ 00000001400060b4     MSVCRTD:exe_main.obj
+ 0004:000000c0       $pdata$?pre_c_initialization@@YAHXZ 00000001400060c0     MSVCRTD:exe_main.obj
+ 0004:000000cc       $pdata$?post_pgo_initialization@@YAHXZ 00000001400060cc     MSVCRTD:exe_main.obj
+ 0004:000000d8       $pdata$?pre_cpp_initialization@@YAXXZ 00000001400060d8     MSVCRTD:exe_main.obj
+ 0004:000000e4       $pdata$?__scrt_common_main_seh@@YAHXZ 00000001400060e4     MSVCRTD:exe_main.obj
+ 0004:000000f0       $pdata$?filt$0@?0??__scrt_common_main_seh@@YAHXZ@4HA 00000001400060f0     MSVCRTD:exe_main.obj
+ 0004:000000fc       $pdata$?__scrt_common_main@@YAHXZ 00000001400060fc     MSVCRTD:exe_main.obj
+ 0004:00000108       $pdata$mainCRTStartup      0000000140006108     MSVCRTD:exe_main.obj
+ 0004:00000114       $pdata$atexit              0000000140006114     MSVCRTD:utility.obj
+ 0004:00000120       $pdata$_onexit             0000000140006120     MSVCRTD:utility.obj
+ 0004:0000012c       $pdata$at_quick_exit       000000014000612c     MSVCRTD:utility.obj
+ 0004:00000138       $pdata$__scrt_is_nonwritable_in_current_image 0000000140006138     MSVCRTD:utility.obj
+ 0004:00000144       $pdata$__scrt_is_nonwritable_in_current_image$filt$0 0000000140006144     MSVCRTD:utility.obj
+ 0004:00000150       $pdata$__scrt_acquire_startup_lock 0000000140006150     MSVCRTD:utility.obj
+ 0004:0000015c       $pdata$__scrt_release_startup_lock 000000014000615c     MSVCRTD:utility.obj
+ 0004:00000168       $pdata$__scrt_initialize_crt 0000000140006168     MSVCRTD:utility.obj
+ 0004:00000174       $pdata$__scrt_uninitialize_crt 0000000140006174     MSVCRTD:utility.obj
+ 0004:00000180       $pdata$__scrt_initialize_onexit_tables 0000000140006180     MSVCRTD:utility.obj
+ 0004:0000018c       $pdata$__scrt_dllmain_exception_filter 000000014000618c     MSVCRTD:utility.obj
+ 0004:00000198       $pdata$__scrt_dllmain_before_initialize_c 0000000140006198     MSVCRTD:utility.obj
+ 0004:000001a4       $pdata$__scrt_dllmain_after_initialize_c 00000001400061a4     MSVCRTD:utility.obj
+ 0004:000001b0       $pdata$__scrt_dllmain_uninitialize_c 00000001400061b0     MSVCRTD:utility.obj
+ 0004:000001bc       $pdata$__scrt_dllmain_uninitialize_critical 00000001400061bc     MSVCRTD:utility.obj
+ 0004:000001c8       $pdata$__scrt_dllmain_crt_thread_attach 00000001400061c8     MSVCRTD:utility.obj
+ 0004:000001d4       $pdata$__scrt_dllmain_crt_thread_detach 00000001400061d4     MSVCRTD:utility.obj
+ 0004:000001e0       $pdata$?is_potentially_valid_image_base@@YA_NQEAX@Z 00000001400061e0     MSVCRTD:utility.obj
+ 0004:000001ec       $pdata$?find_pe_section@@YAPEAU_IMAGE_SECTION_HEADER@@QEAE_K@Z 00000001400061ec     MSVCRTD:utility.obj
+ 0004:000001f8       $pdata$??$__crt_fast_decode_pointer@PEAP6AXXZ@@YAPEAP6AXXZQEAP6AXXZ@Z 00000001400061f8     MSVCRTD:utility.obj
+ 0004:00000204       $pdata$??$__crt_fast_encode_pointer@PEAP6AXXZ@@YAPEAP6AXXZQEAP6AXXZ@Z 0000000140006204     MSVCRTD:utility.obj
+ 0004:00000210       $pdata$__security_init_cookie 0000000140006210     MSVCRTD:gs_support.obj
+ 0004:0000021c       $pdata$__get_entropy       000000014000621c     MSVCRTD:gs_support.obj
+ 0004:00000228       $pdata$?__scrt_initialize_type_info@@YAXXZ 0000000140006228     MSVCRTD:tncleanup.obj
+ 0004:00000234       $pdata$?__scrt_uninitialize_type_info@@YAXXZ 0000000140006234     MSVCRTD:tncleanup.obj
+ 0004:00000240       $pdata$__scrt_initialize_default_local_stdio_options 0000000140006240     MSVCRTD:default_local_stdio_options.obj
+ 0004:0000024c       $pdata$__scrt_is_user_matherr_present 000000014000624c     MSVCRTD:matherr_detection.obj
+ 0004:00000258       $pdata$__scrt_get_show_window_mode 0000000140006258     MSVCRTD:utility_desktop.obj
+ 0004:00000264       $pdata$__scrt_is_managed_app 0000000140006264     MSVCRTD:utility_desktop.obj
+ 0004:00000270       $pdata$__scrt_initialize_mta 0000000140006270     MSVCRTD:utility_desktop.obj
+ 0004:0000027c       $pdata$__scrt_set_unhandled_exception_filter 000000014000627c     MSVCRTD:utility_desktop.obj
+ 0004:00000288       $pdata$__scrt_fastfail     0000000140006288     MSVCRTD:utility_desktop.obj
+ 0004:00000294       $pdata$__scrt_unhandled_exception_filter 0000000140006294     MSVCRTD:utility_desktop.obj
+ 0004:000002a0       $pdata$_RTC_Initialize     00000001400062a0     MSVCRTD:initsect.obj
+ 0004:000002ac       $pdata$_RTC_Terminate      00000001400062ac     MSVCRTD:initsect.obj
+ 0004:000002b8       $pdata$ReadNoFence64       00000001400062b8     MSVCRTD:guard_support.obj
+ 0004:000002c4       $pdata$ReadPointerNoFence  00000001400062c4     MSVCRTD:guard_support.obj
+ 0004:000002d0       $pdata$_guard_icall_checks_enforced 00000001400062d0     MSVCRTD:guard_support.obj
+ 0004:000002dc       $pdata$__isa_available_init 00000001400062dc     MSVCRTD:cpu_disp.obj
+ 0004:000002e8       $pdata$__scrt_is_ucrt_dll_in_use 00000001400062e8     MSVCRTD:ucrt_detection.obj
+ 0004:00000300       $pdata$__GSHandlerCheckCommon 0000000140006300     MSVCRTD:gshandler.obj
+ 0004:0000030c       $pdata$__GSHandlerCheck    000000014000630c     MSVCRTD:gshandler.obj
+ 0004:00000324       $pdata$__report_securityfailure 0000000140006324     MSVCRTD:gs_report.obj
+ 0004:00000330       $pdata$__report_securityfailureEx 0000000140006330     MSVCRTD:gs_report.obj
+ 0004:0000033c       $pdata$__report_rangecheckfailure 000000014000633c     MSVCRTD:gs_report.obj
+ 0004:00000348       $pdata$__report_gsfailure  0000000140006348     MSVCRTD:gs_report.obj
+ 0004:00000354       $pdata$capture_current_context 0000000140006354     MSVCRTD:gs_report.obj
+ 0004:00000360       $pdata$capture_previous_context 0000000140006360     MSVCRTD:gs_report.obj
+ 0004:0000036c       $pdata$__raise_securityfailure 000000014000636c     MSVCRTD:gs_report.obj
+ 0005:00000060       $R000000                   0000000140007060     * linker generated manifest res *
@@ -0,0 +1 @@
+?func@@YAXXZ
@@ -0,0 +1,15 @@
+# PE2Shellcode
+
+Converts PE so that it can be then injected just like a normal shellcode.
+
+# How to use
+
+Optional parameter.  
+
+> P2S.exe &lt; path of PE&gt; [output path] [-?]  
+> [-r] Rc4 encrypt  
+> [-c] Compress PE file  
+
+i.e.
+> P2S_x86.exe test.exe test_x86.bin -c -r  
+> P2S_x64.exe test64.exe test_x64.bin -r
@@ -0,0 +1,151 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project DefaultTargets="Build" ToolsVersion="15.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <ItemGroup Label="ProjectConfigurations">
+    <ProjectConfiguration Include="Debug|Win32">
+      <Configuration>Debug</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Release|Win32">
+      <Configuration>Release</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Debug|x64">
+      <Configuration>Debug</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Release|x64">
+      <Configuration>Release</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+  </ItemGroup>
+  <PropertyGroup Label="Globals">
+    <VCProjectVersion>15.0</VCProjectVersion>
+    <ProjectGuid>{0B7FEBF4-FBCE-46E7-B864-398625233D5C}</ProjectGuid>
+    <Keyword>Win32Proj</Keyword>
+    <RootNamespace>Test</RootNamespace>
+    <WindowsTargetPlatformVersion>10.0.18362.0</WindowsTargetPlatformVersion>
+  </PropertyGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseDebugLibraries>true</UseDebugLibraries>
+    <PlatformToolset>v141</PlatformToolset>
+    <CharacterSet>Unicode</CharacterSet>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseDebugLibraries>false</UseDebugLibraries>
+    <PlatformToolset>v141</PlatformToolset>
+    <WholeProgramOptimization>true</WholeProgramOptimization>
+    <CharacterSet>Unicode</CharacterSet>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseDebugLibraries>true</UseDebugLibraries>
+    <PlatformToolset>v141</PlatformToolset>
+    <CharacterSet>Unicode</CharacterSet>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseDebugLibraries>false</UseDebugLibraries>
+    <PlatformToolset>v141</PlatformToolset>
+    <WholeProgramOptimization>true</WholeProgramOptimization>
+    <CharacterSet>Unicode</CharacterSet>
+  </PropertyGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
+  <ImportGroup Label="ExtensionSettings">
+  </ImportGroup>
+  <ImportGroup Label="Shared">
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <PropertyGroup Label="UserMacros" />
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
+    <LinkIncremental>true</LinkIncremental>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
+    <LinkIncremental>true</LinkIncremental>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+    <LinkIncremental>false</LinkIncremental>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
+    <LinkIncremental>false</LinkIncremental>
+  </PropertyGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
+    <ClCompile>
+      <WarningLevel>Level3</WarningLevel>
+      <Optimization>Disabled</Optimization>
+      <SDLCheck>true</SDLCheck>
+      <PreprocessorDefinitions>_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <ConformanceMode>true</ConformanceMode>
+    </ClCompile>
+    <Link>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+      <SubSystem>Console</SubSystem>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
+    <ClCompile>
+      <WarningLevel>Level3</WarningLevel>
+      <Optimization>Disabled</Optimization>
+      <SDLCheck>true</SDLCheck>
+      <PreprocessorDefinitions>WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <ConformanceMode>true</ConformanceMode>
+    </ClCompile>
+    <Link>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+      <SubSystem>Console</SubSystem>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+    <ClCompile>
+      <WarningLevel>Level3</WarningLevel>
+      <Optimization>MaxSpeed</Optimization>
+      <FunctionLevelLinking>true</FunctionLevelLinking>
+      <IntrinsicFunctions>true</IntrinsicFunctions>
+      <SDLCheck>true</SDLCheck>
+      <PreprocessorDefinitions>WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <ConformanceMode>true</ConformanceMode>
+    </ClCompile>
+    <Link>
+      <EnableCOMDATFolding>true</EnableCOMDATFolding>
+      <OptimizeReferences>true</OptimizeReferences>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+      <SubSystem>Console</SubSystem>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
+    <ClCompile>
+      <WarningLevel>Level3</WarningLevel>
+      <Optimization>MaxSpeed</Optimization>
+      <FunctionLevelLinking>true</FunctionLevelLinking>
+      <IntrinsicFunctions>true</IntrinsicFunctions>
+      <SDLCheck>true</SDLCheck>
+      <PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <ConformanceMode>true</ConformanceMode>
+    </ClCompile>
+    <Link>
+      <EnableCOMDATFolding>true</EnableCOMDATFolding>
+      <OptimizeReferences>true</OptimizeReferences>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+      <SubSystem>Console</SubSystem>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemGroup>
+    <ClCompile Include="main.cpp" />
+  </ItemGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
+  <ImportGroup Label="ExtensionTargets">
+  </ImportGroup>
+</Project>
@@ -0,0 +1,22 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <ItemGroup>
+    <Filter Include="源文件">
+      <UniqueIdentifier>{4FC737F1-C7A5-4376-A066-2A32D752A2FF}</UniqueIdentifier>
+      <Extensions>cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx</Extensions>
+    </Filter>
+    <Filter Include="头文件">
+      <UniqueIdentifier>{93995380-89BD-4b04-88EB-625FBE52EBFB}</UniqueIdentifier>
+      <Extensions>h;hh;hpp;hxx;hm;inl;inc;ipp;xsd</Extensions>
+    </Filter>
+    <Filter Include="资源文件">
+      <UniqueIdentifier>{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}</UniqueIdentifier>
+      <Extensions>rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms</Extensions>
+    </Filter>
+  </ItemGroup>
+  <ItemGroup>
+    <ClCompile Include="main.cpp">
+      <Filter>资源文件</Filter>
+    </ClCompile>
+  </ItemGroup>
+</Project>
@@ -0,0 +1,8 @@
+#include <Windows.h>
+#include <iostream>
+
+int main()
+{
+	MessageBoxA(0, "suc", "------", 0);
+	return 0;
+}
@@ -0,0 +1,151 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project DefaultTargets="Build" ToolsVersion="15.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <ItemGroup Label="ProjectConfigurations">
+    <ProjectConfiguration Include="Debug|Win32">
+      <Configuration>Debug</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Release|Win32">
+      <Configuration>Release</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Debug|x64">
+      <Configuration>Debug</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Release|x64">
+      <Configuration>Release</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+  </ItemGroup>
+  <PropertyGroup Label="Globals">
+    <VCProjectVersion>15.0</VCProjectVersion>
+    <ProjectGuid>{4A4DA453-788F-4D22-9A09-2134143DA1E3}</ProjectGuid>
+    <Keyword>Win32Proj</Keyword>
+    <RootNamespace>TestBin</RootNamespace>
+    <WindowsTargetPlatformVersion>10.0.18362.0</WindowsTargetPlatformVersion>
+  </PropertyGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseDebugLibraries>true</UseDebugLibraries>
+    <PlatformToolset>v141</PlatformToolset>
+    <CharacterSet>Unicode</CharacterSet>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseDebugLibraries>false</UseDebugLibraries>
+    <PlatformToolset>v141</PlatformToolset>
+    <WholeProgramOptimization>true</WholeProgramOptimization>
+    <CharacterSet>Unicode</CharacterSet>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseDebugLibraries>true</UseDebugLibraries>
+    <PlatformToolset>v141</PlatformToolset>
+    <CharacterSet>Unicode</CharacterSet>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseDebugLibraries>false</UseDebugLibraries>
+    <PlatformToolset>v141</PlatformToolset>
+    <WholeProgramOptimization>true</WholeProgramOptimization>
+    <CharacterSet>Unicode</CharacterSet>
+  </PropertyGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
+  <ImportGroup Label="ExtensionSettings">
+  </ImportGroup>
+  <ImportGroup Label="Shared">
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <PropertyGroup Label="UserMacros" />
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
+    <LinkIncremental>true</LinkIncremental>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
+    <LinkIncremental>true</LinkIncremental>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+    <LinkIncremental>false</LinkIncremental>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
+    <LinkIncremental>false</LinkIncremental>
+  </PropertyGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
+    <ClCompile>
+      <WarningLevel>Level3</WarningLevel>
+      <Optimization>Disabled</Optimization>
+      <SDLCheck>true</SDLCheck>
+      <PreprocessorDefinitions>_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <ConformanceMode>true</ConformanceMode>
+    </ClCompile>
+    <Link>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+      <SubSystem>Console</SubSystem>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
+    <ClCompile>
+      <WarningLevel>Level3</WarningLevel>
+      <Optimization>Disabled</Optimization>
+      <SDLCheck>true</SDLCheck>
+      <PreprocessorDefinitions>WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <ConformanceMode>true</ConformanceMode>
+    </ClCompile>
+    <Link>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+      <SubSystem>Console</SubSystem>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+    <ClCompile>
+      <WarningLevel>Level3</WarningLevel>
+      <Optimization>MaxSpeed</Optimization>
+      <FunctionLevelLinking>true</FunctionLevelLinking>
+      <IntrinsicFunctions>true</IntrinsicFunctions>
+      <SDLCheck>true</SDLCheck>
+      <PreprocessorDefinitions>WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <ConformanceMode>true</ConformanceMode>
+    </ClCompile>
+    <Link>
+      <EnableCOMDATFolding>true</EnableCOMDATFolding>
+      <OptimizeReferences>true</OptimizeReferences>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+      <SubSystem>Console</SubSystem>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
+    <ClCompile>
+      <WarningLevel>Level3</WarningLevel>
+      <Optimization>MaxSpeed</Optimization>
+      <FunctionLevelLinking>true</FunctionLevelLinking>
+      <IntrinsicFunctions>true</IntrinsicFunctions>
+      <SDLCheck>true</SDLCheck>
+      <PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <ConformanceMode>true</ConformanceMode>
+    </ClCompile>
+    <Link>
+      <EnableCOMDATFolding>true</EnableCOMDATFolding>
+      <OptimizeReferences>true</OptimizeReferences>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+      <SubSystem>Console</SubSystem>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemGroup>
+    <ClCompile Include="main.cpp" />
+  </ItemGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
+  <ImportGroup Label="ExtensionTargets">
+  </ImportGroup>
+</Project>
@@ -0,0 +1,22 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <ItemGroup>
+    <Filter Include="源文件">
+      <UniqueIdentifier>{4FC737F1-C7A5-4376-A066-2A32D752A2FF}</UniqueIdentifier>
+      <Extensions>cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx</Extensions>
+    </Filter>
+    <Filter Include="头文件">
+      <UniqueIdentifier>{93995380-89BD-4b04-88EB-625FBE52EBFB}</UniqueIdentifier>
+      <Extensions>h;hh;hpp;hxx;hm;inl;inc;ipp;xsd</Extensions>
+    </Filter>
+    <Filter Include="资源文件">
+      <UniqueIdentifier>{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}</UniqueIdentifier>
+      <Extensions>rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms</Extensions>
+    </Filter>
+  </ItemGroup>
+  <ItemGroup>
+    <ClCompile Include="main.cpp">
+      <Filter>资源文件</Filter>
+    </ClCompile>
+  </ItemGroup>
+</Project>
@@ -0,0 +1,24 @@
+#include <Windows.h>
+#include <iostream>
+
+int wmain(int argc, char **argv)
+{
+
+#ifdef _WIN64
+	HANDLE hFile = CreateFileA("test_x64.bin", GENERIC_READ, 0, 0, OPEN_EXISTING, NULL, NULL);
+#else
+	HANDLE hFile = CreateFileA("test_x86.bin", GENERIC_READ, 0, 0, OPEN_EXISTING, NULL, NULL);
+#endif // _WIN64
+
+
+	DWORD fileSize = GetFileSize(hFile, NULL);
+
+	void * base = VirtualAlloc(NULL, fileSize, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);
+
+	DWORD dw;
+	ReadFile(hFile, base, fileSize, &dw, NULL);
+
+	((void(*)(void))base)();
+
+	return 0;
+}