3
回答
DLL to C:一个能够把DLL转换为可编译C/C++的代码工具

一个能够把DLL转换为可编译C/C++的代码工具

转换后的部分代码:

/*******************************************************************************
	Generated by: DLL to C version 2.26
	Date: 2016-12-1
	Description: The implementation code for Win32Dll.dll.
	Website: http://www.dll-decompiler.com
	Technical Support: support@dll-decompiler.com
*******************************************************************************/

#include "stdafx.h"
#include "Win32Dll.h"


static HMODULE g_hMoudle;
BOOL (WINAPI *Win32Dll_DllEntryPoint)(HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpReserved);

void* __stdcall Win32Dll_RVA(DWORD rvaAddr)
{
	if(rvaAddr==0)
		return g_hMoudle;
	if(rvaAddr >= 0x1000 && rvaAddr < 0x8000)
		return &Win32Dll_text[rvaAddr - 0x1000];
	if(rvaAddr >= 0x8000 && rvaAddr < 0xA000)
		return &Win32Dll_rdata[rvaAddr - 0x8000];
	if(rvaAddr >= 0xA000 && rvaAddr < 0xC000)
		return &Win32Dll_data[rvaAddr - 0xA000];
	return NULL;
}

BOOL Win32Dll_Init()
{
	HMODULE hDll;
	DWORD oldProtect;
	void (*fInitData)(void*);

	g_hMoudle = GetModuleHandle(0);

	oldProtect = PAGE_EXECUTE_READWRITE;
	VirtualProtect(Win32Dll_text,sizeof(Win32Dll_text),PAGE_EXECUTE_READWRITE,&oldProtect);

	hDll = ::LoadLibraryA("USER32.dll");
	if(!hDll)
		return FALSE;
	*(FARPROC*)Win32Dll_RVA(0x80EC) = ::GetProcAddress(hDll,"MessageBoxA");
	if(!*(FARPROC*)Win32Dll_RVA(0x80EC))
		return FALSE;

	hDll = ::LoadLibraryA("KERNEL32.dll");
	if(!hDll)
		return FALSE;
	*(FARPROC*)Win32Dll_RVA(0x8000) = ::GetProcAddress(hDll,"GetTickCount");
	if(!*(FARPROC*)Win32Dll_RVA(0x8000))
		return FALSE;
	*(FARPROC*)Win32Dll_RVA(0x8004) = ::GetProcAddress(hDll,"GetCurrentThreadId");
	if(!*(FARPROC*)Win32Dll_RVA(0x8004))
		return FALSE;
	*(FARPROC*)Win32Dll_RVA(0x8008) = ::GetProcAddress(hDll,"GetCommandLineA");
	if(!*(FARPROC*)Win32Dll_RVA(0x8008))
		return FALSE;
	*(FARPROC*)Win32Dll_RVA(0x800C) = ::GetProcAddress(hDll,"TerminateProcess");
	if(!*(FARPROC*)Win32Dll_RVA(0x800C))
		return FALSE;
	*(FARPROC*)Win32Dll_RVA(0x8010) = ::GetProcAddress(hDll,"GetCurrentProcess");
	if(!*(FARPROC*)Win32Dll_RVA(0x8010))
		return FALSE;
	*(FARPROC*)Win32Dll_RVA(0x8014) = ::GetProcAddress(hDll,"UnhandledExceptionFilter");
	if(!*(FARPROC*)Win32Dll_RVA(0x8014))
		return FALSE;
	*(FARPROC*)Win32Dll_RVA(0x8018) = ::GetProcAddress(hDll,"SetUnhandledExceptionFilter");
	if(!*(FARPROC*)Win32Dll_RVA(0x8018))
		return FALSE;
	*(FARPROC*)Win32Dll_RVA(0x801C) = ::GetProcAddress(hDll,"IsDebuggerPresent");
	if(!*(FARPROC*)Win32Dll_RVA(0x801C))
		return FALSE;
	*(FARPROC*)Win32Dll_RVA(0x8020) = ::GetProcAddress(hDll,"GetModuleHandleW");
	if(!*(FARPROC*)Win32Dll_RVA(0x8020))
		return FALSE;
	*(FARPROC*)Win32Dll_RVA(0x8024) = ::GetProcAddress(hDll,"GetProcAddress");
	if(!*(FARPROC*)Win32Dll_RVA(0x8024))
		return FALSE;
	*(FARPROC*)Win32Dll_RVA(0x8028) = ::GetProcAddress(hDll,"TlsGetValue");
	if(!*(FARPROC*)Win32Dll_RVA(0x8028))
		return FALSE;
	*(FARPROC*)Win32Dll_RVA(0x802C) = ::GetProcAddress(hDll,"TlsAlloc");
	if(!*(FARPROC*)Win32Dll_RVA(0x802C))
		return FALSE;
	*(FARPROC*)Win32Dll_RVA(0x8030) = ::GetProcAddress(hDll,"TlsSetValue");
	if(!*(FARPROC*)Win32Dll_RVA(0x8030))
		return FALSE;
	*(FARPROC*)Win32Dll_RVA(0x8034) = ::GetProcAddress(hDll,"TlsFree");
	if(!*(FARPROC*)Win32Dll_RVA(0x8034))
		return FALSE;
	*(FARPROC*)Win32Dll_RVA(0x8038) = ::GetProcAddress(hDll,"InterlockedIncrement");
	if(!*(FARPROC*)Win32Dll_RVA(0x8038))
		return FALSE;
	*(FARPROC*)Win32Dll_RVA(0x803C) = ::GetProcAddress(hDll,"SetLastError");
	if(!*(FARPROC*)Win32Dll_RVA(0x803C))
		return FALSE;
	*(FARPROC*)Win32Dll_RVA(0x8040) = ::GetProcAddress(hDll,"GetLastError");
	if(!*(FARPROC*)Win32Dll_RVA(0x8040))
		return FALSE;
	*(FARPROC*)Win32Dll_RVA(0x8044) = ::GetProcAddress(hDll,"InterlockedDecrement");
	if(!*(FARPROC*)Win32Dll_RVA(0x8044))
		return FALSE;
	*(FARPROC*)Win32Dll_RVA(0x8048) = ::GetProcAddress(hDll,"HeapFree");
	if(!*(FARPROC*)Win32Dll_RVA(0x8048))
		return FALSE;
	*(FARPROC*)Win32Dll_RVA(0x804C) = ::GetProcAddress(hDll,"Sleep");
	if(!*(FARPROC*)Win32Dll_RVA(0x804C))
		return FALSE;
	*(FARPROC*)Win32Dll_RVA(0x8050) = ::GetProcAddress(hDll,"ExitProcess");
	if(!*(FARPROC*)Win32Dll_RVA(0x8050))
		return FALSE;
	*(FARPROC*)Win32Dll_RVA(0x8054) = ::GetProcAddress(hDll,"SetHandleCount");
	if(!*(FARPROC*)Win32Dll_RVA(0x8054))
		return FALSE;
	*(FARPROC*)Win32Dll_RVA(0x8058) = ::GetProcAddress(hDll,"GetStdHandle");
	if(!*(FARPROC*)Win32Dll_RVA(0x8058))
		return FALSE;
	*(FARPROC*)Win32Dll_RVA(0x805C) = ::GetProcAddress(hDll,"GetFileType");
	if(!*(FARPROC*)Win32Dll_RVA(0x805C))
		return FALSE;
	*(FARPROC*)Win32Dll_RVA(0x8060) = ::GetProcAddress(hDll,"GetStartupInfoA");
	if(!*(FARPROC*)Win32Dll_RVA(0x8060))
		return FALSE;
	*(FARPROC*)Win32Dll_RVA(0x8064) = ::GetProcAddress(hDll,"DeleteCriticalSection");
	if(!*(FARPROC*)Win32Dll_RVA(0x8064))
		return FALSE;
	*(FARPROC*)Win32Dll_RVA(0x8068) = ::GetProcAddress(hDll,"GetModuleFileNameA");
	if(!*(FARPROC*)Win32Dll_RVA(0x8068))
		return FALSE;
	*(FARPROC*)Win32Dll_RVA(0x806C) = ::GetProcAddress(hDll,"FreeEnvironmentStringsA");
	if(!*(FARPROC*)Win32Dll_RVA(0x806C))
		return FALSE;
	*(FARPROC*)Win32Dll_RVA(0x8070) = ::GetProcAddress(hDll,"GetEnvironmentStrings");
	if(!*(FARPROC*)Win32Dll_RVA(0x8070))
		return FALSE;
	*(FARPROC*)Win32Dll_RVA(0x8074) = ::GetProcAddress(hDll,"FreeEnvironmentStringsW");
	if(!*(FARPROC*)Win32Dll_RVA(0x8074))
		return FALSE;
	*(FARPROC*)Win32Dll_RVA(0x8078) = ::GetProcAddress(hDll,"WideCharToMultiByte");
	if(!*(FARPROC*)Win32Dll_RVA(0x8078))
		return FALSE;
	*(FARPROC*)Win32Dll_RVA(0x807C) = ::GetProcAddress(hDll,"GetEnvironmentStringsW");
	if(!*(FARPROC*)Win32Dll_RVA(0x807C))
		return FALSE;
	*(FARPROC*)Win32Dll_RVA(0x8080) = ::GetProcAddress(hDll,"HeapCreate");
	if(!*(FARPROC*)Win32Dll_RVA(0x8080))
		return FALSE;
	*(FARPROC*)Win32Dll_RVA(0x8084) = ::GetProcAddress(hDll,"HeapDestroy");
	if(!*(FARPROC*)Win32Dll_RVA(0x8084))
		return FALSE;
	*(FARPROC*)Win32Dll_RVA(0x8088) = ::GetProcAddress(hDll,"VirtualFree");
	if(!*(FARPROC*)Win32Dll_RVA(0x8088))
		return FALSE;
	*(FARPROC*)Win32Dll_RVA(0x808C) = ::GetProcAddress(hDll,"QueryPerformanceCounter");
	if(!*(FARPROC*)Win32Dll_RVA(0x808C))
		return FALSE;
	*(FARPROC*)Win32Dll_RVA(0x8090) = ::GetProcAddress(hDll,"GetCurrentProcessId");
	if(!*(FARPROC*)Win32Dll_RVA(0x8090))
		return FALSE;
	*(FARPROC*)Win32Dll_RVA(0x8094) = ::GetProcAddress(hDll,"GetSystemTimeAsFileTime");
	if(!*(FARPROC*)Win32Dll_RVA(0x8094))
		return FALSE;
	*(FARPROC*)Win32Dll_RVA(0x8098) = ::GetProcAddress(hDll,"LeaveCriticalSection");
	if(!*(FARPROC*)Win32Dll_RVA(0x8098))
		return FALSE;
	*(FARPROC*)Win32Dll_RVA(0x809C) = ::GetProcAddress(hDll,"EnterCriticalSection");
	if(!*(FARPROC*)Win32Dll_RVA(0x809C))
		return FALSE;
	*(FARPROC*)Win32Dll_RVA(0x80A0) = ::GetProcAddress(hDll,"GetCPInfo");
	if(!*(FARPROC*)Win32Dll_RVA(0x80A0))
		return FALSE;
	*(FARPROC*)Win32Dll_RVA(0x80A4) = ::GetProcAddress(hDll,"GetACP");
	if(!*(FARPROC*)Win32Dll_RVA(0x80A4))
		return FALSE;
	*(FARPROC*)Win32Dll_RVA(0x80A8) = ::GetProcAddress(hDll,"GetOEMCP");
	if(!*(FARPROC*)Win32Dll_RVA(0x80A8))
		return FALSE;
	*(FARPROC*)Win32Dll_RVA(0x80AC) = ::GetProcAddress(hDll,"IsValidCodePage");
	if(!*(FARPROC*)Win32Dll_RVA(0x80AC))
		return FALSE;
	*(FARPROC*)Win32Dll_RVA(0x80B0) = ::GetProcAddress(hDll,"HeapAlloc");
	if(!*(FARPROC*)Win32Dll_RVA(0x80B0))
		return FALSE;
	*(FARPROC*)Win32Dll_RVA(0x80B4) = ::GetProcAddress(hDll,"VirtualAlloc");
	if(!*(FARPROC*)Win32Dll_RVA(0x80B4))
		return FALSE;
	*(FARPROC*)Win32Dll_RVA(0x80B8) = ::GetProcAddress(hDll,"HeapReAlloc");
	if(!*(FARPROC*)Win32Dll_RVA(0x80B8))
		return FALSE;
	*(FARPROC*)Win32Dll_RVA(0x80BC) = ::GetProcAddress(hDll,"WriteFile");
	if(!*(FARPROC*)Win32Dll_RVA(0x80BC))
		return FALSE;
	*(FARPROC*)Win32Dll_RVA(0x80C0) = ::GetProcAddress(hDll,"LoadLibraryA");
	if(!*(FARPROC*)Win32Dll_RVA(0x80C0))
		return FALSE;
	*(FARPROC*)Win32Dll_RVA(0x80C4) = ::GetProcAddress(hDll,"InitializeCriticalSectionAndSpinCount");
	if(!*(FARPROC*)Win32Dll_RVA(0x80C4))
		return FALSE;
	*(FARPROC*)Win32Dll_RVA(0x80C8) = ::GetProcAddress(hDll,"RtlUnwind");
	if(!*(FARPROC*)Win32Dll_RVA(0x80C8))
		return FALSE;
	*(FARPROC*)Win32Dll_RVA(0x80CC) = ::GetProcAddress(hDll,"GetLocaleInfoA");
	if(!*(FARPROC*)Win32Dll_RVA(0x80CC))
		return FALSE;
	*(FARPROC*)Win32Dll_RVA(0x80D0) = ::GetProcAddress(hDll,"GetStringTypeA");
	if(!*(FARPROC*)Win32Dll_RVA(0x80D0))
		return FALSE;
	*(FARPROC*)Win32Dll_RVA(0x80D4) = ::GetProcAddress(hDll,"MultiByteToWideChar");
	if(!*(FARPROC*)Win32Dll_RVA(0x80D4))
		return FALSE;
	*(FARPROC*)Win32Dll_RVA(0x80D8) = ::GetProcAddress(hDll,"GetStringTypeW");
	if(!*(FARPROC*)Win32Dll_RVA(0x80D8))
		return FALSE;
	*(FARPROC*)Win32Dll_RVA(0x80DC) = ::GetProcAddress(hDll,"LCMapStringA");
	if(!*(FARPROC*)Win32Dll_RVA(0x80DC))
		return FALSE;
	*(FARPROC*)Win32Dll_RVA(0x80E0) = ::GetProcAddress(hDll,"LCMapStringW");
	if(!*(FARPROC*)Win32Dll_RVA(0x80E0))
		return FALSE;
	*(FARPROC*)Win32Dll_RVA(0x80E4) = ::GetProcAddress(hDll,"HeapSize");
	if(!*(FARPROC*)Win32Dll_RVA(0x80E4))
		return FALSE;

	*(FARPROC*)&fInitData = (FARPROC)&Win32Dll_InitData[0];
	fInitData(Win32Dll_RVA);

	VirtualProtect(Win32Dll_text,sizeof(Win32Dll_text),oldProtect,NULL);

	*(FARPROC*)&Win32Dll_DllEntryPoint = (FARPROC)Win32Dll_RVA(0x1263);
	return TRUE;
}

BOOL Win32Dll_LoadLibrary()
{
	return Win32Dll_DllEntryPoint(GetModuleHandle(0), DLL_PROCESS_ATTACH, 0);
}

BOOL Win32Dll_FreeLibrary()
{
	return Win32Dll_DllEntryPoint(GetModuleHandle(0), DLL_PROCESS_DETACH, 0);
}

FARPROC Win32Dll_GetProcAddress(LPCSTR lpProcName)
{
	if(lstrcmpA(lpProcName,"TestFun")==0)
		return (FARPROC)Win32Dll_RVA(0x1010);

	return NULL;
}

可以看出这个工具把一个DLL的每个Section都分割开了,通过函数Win32Dll_RVA可以访问DLL中的任意地址。通过这个工具,可以把DLL嵌入到主程序中,在安装包中可以不用再包含相应的DLL文件。如果觉得有用的话,可以从他们的官方网站Dll Decompiler下载DLL to C。

<无标签>
举报
LazyCoder000
发帖于2年前 3回/948阅
共有3个评论 最后回答: 2年前
还以为可以反汇编出源码结构。
--- 共有 1 条评论 ---
LazyCoder000发现这软件又升级了,最新版本v2.32增加了一个选项“Generate data structures for all data sections”,可以直接生成数据结构 2年前 回复
发现这个软件最近又升级了,竟然可以直接生成数据结构!

最新版本v2.32增加了一个选项“Generate data structures for all data sections”,可以生成各Section的数据结构。

下面是生成的部分数据结构:

#include "stdafx.h"
#include "Win32Dll.h"

#pragma pack(push)
#pragma pack(1)

#ifdef __cplusplus
extern "C" 
#endif
__declspec(align(16)) 
_st_Win32Dll_rdata Win32Dll_rdata = {
	//FARPROC m0_GetTickCount, 0x10008000
	(FARPROC)0x99CE,
	//FARPROC m4_GetCurrentThreadId, 0x10008004
	(FARPROC)0x9736,
	//FARPROC m8_GetCommandLineA, 0x10008008
	(FARPROC)0x974C,
	//FARPROC mC_TerminateProcess, 0x1000800C
	(FARPROC)0x975E,
	//FARPROC m10_GetCurrentProcess, 0x10008010
	(FARPROC)0x9772,
	//FARPROC m14_UnhandledExceptionFilter, 0x10008014
	(FARPROC)0x9786,
	//FARPROC m18_SetUnhandledExceptionFilter, 0x10008018
	(FARPROC)0x97A2,
	//FARPROC m1C_IsDebuggerPresent, 0x1000801C
	(FARPROC)0x97C0,
	//FARPROC m20_GetModuleHandleW, 0x10008020
	(FARPROC)0x97D4,
	//FARPROC m24_GetProcAddress, 0x10008024
	(FARPROC)0x97E8,
	//FARPROC m28_TlsGetValue, 0x10008028
	(FARPROC)0x97FA,
	//FARPROC m2C_TlsAlloc, 0x1000802C
	(FARPROC)0x9808,
	//FARPROC m30_TlsSetValue, 0x10008030
	(FARPROC)0x9814,
	//FARPROC m34_TlsFree, 0x10008034
	(FARPROC)0x9822,
	//FARPROC m38_InterlockedIncrement, 0x10008038
	(FARPROC)0x982C,
	//FARPROC m3C_SetLastError, 0x1000803C
	(FARPROC)0x9844,
	//FARPROC m40_GetLastError, 0x10008040
	(FARPROC)0x9854,
	//FARPROC m44_InterlockedDecrement, 0x10008044
	(FARPROC)0x9864,
	//FARPROC m48_HeapFree, 0x10008048
	(FARPROC)0x987C,
	//FARPROC m4C_Sleep, 0x1000804C
	(FARPROC)0x9888,
	//FARPROC m50_ExitProcess, 0x10008050
	(FARPROC)0x9890,
	//FARPROC m54_SetHandleCount, 0x10008054
	(FARPROC)0x989E,
	//FARPROC m58_GetStdHandle, 0x10008058
	(FARPROC)0x98B0,
	//FARPROC m5C_GetFileType, 0x1000805C
	(FARPROC)0x98C0,
	//FARPROC m60_GetStartupInfoA, 0x10008060
	(FARPROC)0x98CE,
	//FARPROC m64_DeleteCriticalSection, 0x10008064
	(FARPROC)0x98E0,
	//FARPROC m68_GetModuleFileNameA, 0x10008068
	(FARPROC)0x98F8,
	//FARPROC m6C_FreeEnvironmentStringsA, 0x1000806C
	(FARPROC)0x990E,
	//FARPROC m70_GetEnvironmentStrings, 0x10008070
	(FARPROC)0x9928,
	//FARPROC m74_FreeEnvironmentStringsW, 0x10008074
	(FARPROC)0x9940,
	//FARPROC m78_WideCharToMultiByte, 0x10008078
	(FARPROC)0x995A,
	//FARPROC m7C_GetEnvironmentStringsW, 0x1000807C
	(FARPROC)0x9970,
	//FARPROC m80_HeapCreate, 0x10008080
	(FARPROC)0x998A,
	//FARPROC m84_HeapDestroy, 0x10008084
	(FARPROC)0x9998,
	//FARPROC m88_VirtualFree, 0x10008088
	(FARPROC)0x99A6,
	//FARPROC m8C_QueryPerformanceCounter, 0x1000808C
	(FARPROC)0x99B4,
	//FARPROC m90_GetCurrentProcessId, 0x10008090
	(FARPROC)0x99DE,
	//FARPROC m94_GetSystemTimeAsFileTime, 0x10008094
	(FARPROC)0x99F4,
	//FARPROC m98_LeaveCriticalSection, 0x10008098
	(FARPROC)0x9A0E,
	//FARPROC m9C_EnterCriticalSection, 0x1000809C
	(FARPROC)0x9A26,
	//FARPROC mA0_GetCPInfo, 0x100080A0
	(FARPROC)0x9A3E,
	//FARPROC mA4_GetACP, 0x100080A4
	(FARPROC)0x9A4A,
	//FARPROC mA8_GetOEMCP, 0x100080A8
	(FARPROC)0x9A54,
	//FARPROC mAC_IsValidCodePage, 0x100080AC
	(FARPROC)0x9A60,
	//FARPROC mB0_HeapAlloc, 0x100080B0
	(FARPROC)0x9A72,
	//FARPROC mB4_VirtualAlloc, 0x100080B4
	(FARPROC)0x9A7E,
	//FARPROC mB8_HeapReAlloc, 0x100080B8
	(FARPROC)0x9A8E,
	//FARPROC mBC_WriteFile, 0x100080BC
	(FARPROC)0x9A9C,
	//FARPROC mC0_LoadLibraryA, 0x100080C0
	(FARPROC)0x9AA8,
	//FARPROC mC4_InitializeCriticalSectionAndSpinCount, 0x100080C4
	(FARPROC)0x9AB8,
	//FARPROC mC8_RtlUnwind, 0x100080C8
	(FARPROC)0x9AE0,
	//FARPROC mCC_GetLocaleInfoA, 0x100080CC
	(FARPROC)0x9AEC,
	//FARPROC mD0_GetStringTypeA, 0x100080D0
	(FARPROC)0x9AFE,
	//FARPROC mD4_MultiByteToWideChar, 0x100080D4
	(FARPROC)0x9B10,
	//FARPROC mD8_GetStringTypeW, 0x100080D8
	(FARPROC)0x9B26,
	//FARPROC mDC_LCMapStringA, 0x100080DC
	(FARPROC)0x9B38,
	//FARPROC mE0_LCMapStringW, 0x100080E0
	(FARPROC)0x9B48,
	//FARPROC mE4_HeapSize, 0x100080E4
	(FARPROC)0x9B58,
	//UCHAR mE8[0x4], 0x100080E8
	{0x00,},
	//FARPROC mEC_MessageBoxA, 0x100080EC
	(FARPROC)0x971C,
	//UCHAR mF0[0x10], 0x100080F0
	{0x00,},
	//LPVOID m100_ptr, 0x10008100
	&Win32Dll_text[0x263A],
	//LPVOID m104_ptr, 0x10008104
	&Win32Dll_text[0x39BE],
	//LPVOID m108_ptr, 0x10008108
	&Win32Dll_text[0x5948],
	//UCHAR m10C[0x34], 0x1000810C
	{0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x87,0x10,0xE7,'R',0x00,0x00,0x00,0x00,0x02,0x00,0x00,0x00,'^',0x00,0x00,0x00,0xD8,0x92,0x00,0x00,0xD8,'z',},
	//LPVOID m140_ptr, 0x10008140
	Win32Dll_data.mC78_buf,
	//LPVOID m144_ptr, 0x10008144
	Win32Dll_data.mCD0_buf,
	//CHAR m148_str[14], 0x10008148
	"EncodePointer",
	//UCHAR m156[0x1E], 0x10008156
	{0x00,0x00,'K',0x00,'E',0x00,'R',0x00,'N',0x00,'E',0x00,'L',0x00,'3',0x00,'2',0x00,'.',0x00,'D',0x00,'L',0x00,'L',},
	//CHAR m174_str[14], 0x10008174
	"DecodePointer",
	//UCHAR m182[0x2], 0x10008182
	{0x00,},
	//CHAR m184_str[8], 0x10008184
	"FlsFree",
	//CHAR m18C_str[12], 0x1000818C
	"FlsSetValue",
	//CHAR m198_str[12], 0x10008198
	"FlsGetValue",
	//CHAR m1A4_str[9], 0x100081A4
	"FlsAlloc",
	//UCHAR m1AD[0x3], 0x100081AD
	{0x00,},
	//CHAR m1B0_str[15], 0x100081B0
	"CorExitProcess",
	...



顶部