diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index c25e2f008..c54c1981b 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -20,21 +20,18 @@ jobs: rust: stable target: x86_64-unknown-linux-gnu vcpkg_openssl_triplet: x64-linux-release - args: "--features=openssl-static" - build: macos os: macos-latest rust: stable target: x86_64-apple-darwin vcpkg_openssl_triplet: x64-osx-release - args: "--features=openssl-static" - build: windows os: windows-latest rust: stable target: x86_64-pc-windows-msvc vcpkg_openssl_triplet: x64-windows-static - args: "" steps: - name: Checkout sources @@ -63,7 +60,7 @@ jobs: token: ${{ github.token }} - name: Build - run: cargo build --bin yr --profile release-lto --target ${{ matrix.target }} ${{ matrix.args }} + run: cargo build --bin yr --profile release-lto --target ${{ matrix.target }} env: RUSTFLAGS: "-C target-feature=+crt-static" OPENSSL_DIR: "${{ github.workspace }}/vcpkg/installed/${{ matrix.vcpkg_openssl_triplet }}" diff --git a/Cargo.lock b/Cargo.lock index 07b98f19f..c477a56da 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -171,43 +171,64 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "ca6c635b3aa665c649ad1415f1573c85957dfa47690ec27aebe7ec17efe3c643" [[package]] -name = "async-trait" -version = "0.1.79" +name = "asn1-rs" +version = "0.6.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "a507401cad91ec6a857ed5513a2073c82a9b9048762b885bb98655b306964681" +checksum = "22ad1373757efa0f70ec53939aabc7152e1591cb485208052993070ac8d2429d" +dependencies = [ + "asn1-rs-derive", + "asn1-rs-impl", + "displaydoc", + "nom 7.1.3", + "num-traits", + "rusticata-macros", + "thiserror", + "time", +] + +[[package]] +name = "asn1-rs-derive" +version = "0.5.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "7378575ff571966e99a744addeff0bff98b8ada0dedf1956d59e634db95eaac1" dependencies = [ "proc-macro2", "quote", "syn 2.0.55", + "synstructure", ] [[package]] -name = "atty" -version = "0.2.14" +name = "asn1-rs-impl" +version = "0.2.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d9b39be18770d11421cdb1b9947a45dd3f37e93092cbf377614828a319d5fee8" +checksum = "7b18050c2cd6fe86c3a76584ef5e0baf286d038cda203eb6223df2cc413565f7" dependencies = [ - "hermit-abi 0.1.19", - "libc", - "winapi", + "proc-macro2", + "quote", + "syn 2.0.55", ] [[package]] -name = "authenticode-parser" -version = "0.5.0" +name = "async-trait" +version = "0.1.79" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b04c8a6168fa3d7733652b4604dbad1c0587b16382ad24b082d2de7ee7296087" +checksum = "a507401cad91ec6a857ed5513a2073c82a9b9048762b885bb98655b306964681" dependencies = [ - "authenticode-parser-sys", + "proc-macro2", + "quote", + "syn 2.0.55", ] [[package]] -name = "authenticode-parser-sys" -version = "0.5.0" +name = "atty" +version = "0.2.14" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d6fec48978e90f3740da7ba30f501beb08d1729dabdcc685e163226b564f3737" +checksum = "d9b39be18770d11421cdb1b9947a45dd3f37e93092cbf377614828a319d5fee8" dependencies = [ - "cc", + "hermit-abi 0.1.19", + "libc", + "winapi", ] [[package]] @@ -231,6 +252,12 @@ dependencies = [ "rustc-demangle", ] +[[package]] +name = "base16ct" +version = "0.2.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "4c7f02d4ea65f2c1853089ffd8d2787bdbc63de2f0d29dedbcf8ccdfa0ccd4cf" + [[package]] name = "base64" version = "0.13.1" @@ -620,6 +647,12 @@ dependencies = [ "windows-sys 0.52.0", ] +[[package]] +name = "const-oid" +version = "0.9.6" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "c2459377285ad874054d797f3ccebf984978aa39129f6eafde5cdc8315b612f8" + [[package]] name = "const-random" version = "0.1.18" @@ -900,6 +933,18 @@ version = "0.2.2" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "7a81dae078cea95a014a339291cec439d2f232ebe854a9d672b796c6afafa9b7" +[[package]] +name = "crypto-bigint" +version = "0.5.5" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "0dc92fb57ca44df6db8059111ab3af99a63d5d0f8375d9972e319a379c6bab76" +dependencies = [ + "generic-array", + "rand_core", + "subtle", + "zeroize", +] + [[package]] name = "crypto-common" version = "0.1.6" @@ -955,6 +1000,12 @@ dependencies = [ "syn 1.0.109", ] +[[package]] +name = "data-encoding" +version = "2.5.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "7e962a19be5cfc3f3bf6dd8f61eb50107f356ad6270fbb3ed41476571db78be5" + [[package]] name = "debugid" version = "0.8.0" @@ -970,6 +1021,31 @@ version = "0.3.2" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "5729f5117e208430e437df2f4843f5e5952997175992d1414f94c57d61e270b4" +[[package]] +name = "der" +version = "0.7.9" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "f55bf8e7b65898637379c1b74eb1551107c8294ed26d855ceb9fd1a09cfc9bc0" +dependencies = [ + "const-oid", + "pem-rfc7468", + "zeroize", +] + +[[package]] +name = "der-parser" +version = "9.0.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "5cd0a5c643689626bec213c4d8bd4d96acc8ffdb4ad4bb6bc16abf27d5f4b553" +dependencies = [ + "asn1-rs", + "displaydoc", + "nom 7.1.3", + "num-bigint", + "num-traits", + "rusticata-macros", +] + [[package]] name = "deranged" version = "0.3.11" @@ -1001,6 +1077,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292" dependencies = [ "block-buffer 0.10.4", + "const-oid", "crypto-common", "subtle", ] @@ -1046,12 +1123,74 @@ dependencies = [ "winapi", ] +[[package]] +name = "displaydoc" +version = "0.2.4" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "487585f4d0c6655fe74905e2504d8ad6908e4db67f744eb140876906c2f3175d" +dependencies = [ + "proc-macro2", + "quote", + "syn 2.0.55", +] + +[[package]] +name = "dsa" +version = "0.6.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "48bc224a9084ad760195584ce5abb3c2c34a225fa312a128ad245a6b412b7689" +dependencies = [ + "digest 0.10.7", + "num-bigint-dig", + "num-traits", + "pkcs8", + "rfc6979", + "sha2 0.10.8", + "signature", + "zeroize", +] + +[[package]] +name = "ecdsa" +version = "0.16.9" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "ee27f32b5c5292967d2d4a9d7f1e0b0aed2c15daded5a60300e4abb9d8020bca" +dependencies = [ + "der", + "digest 0.10.7", + "elliptic-curve", + "rfc6979", + "signature", + "spki", +] + [[package]] name = "either" version = "1.10.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "11157ac094ffbdde99aa67b23417ebdd801842852b500e395a45a9c0aac03e4a" +[[package]] +name = "elliptic-curve" +version = "0.13.8" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "b5e6043086bf7973472e0c7dff2142ea0b680d30e18d9cc40f267efbf222bd47" +dependencies = [ + "base16ct", + "crypto-bigint", + "digest 0.10.7", + "ff", + "generic-array", + "group", + "hkdf", + "pem-rfc7468", + "pkcs8", + "rand_core", + "sec1", + "subtle", + "zeroize", +] + [[package]] name = "enable-ansi-support" version = "0.2.1" @@ -1154,6 +1293,16 @@ version = "2.0.2" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "658bd65b1cf4c852a3cc96f18a8ce7b5640f6b703f905c7d74532294c2a63984" +[[package]] +name = "ff" +version = "0.13.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "ded41244b729663b1e574f1b4fb731469f69f79c17667b5d776b16cda0479449" +dependencies = [ + "rand_core", + "subtle", +] + [[package]] name = "filedescriptor" version = "0.8.2" @@ -1275,6 +1424,7 @@ checksum = "85649ca51fd72272d7821adaf274ad91c288277713d9c18820d8499a7ff69e9a" dependencies = [ "typenum", "version_check", + "zeroize", ] [[package]] @@ -1352,6 +1502,17 @@ dependencies = [ "yansi 1.0.1", ] +[[package]] +name = "group" +version = "0.13.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "f0f9ef7462f7c099f518d754361858f86d8a07af53ba9af0fe635bbccb151a63" +dependencies = [ + "ff", + "rand_core", + "subtle", +] + [[package]] name = "hashbrown" version = "0.12.3" @@ -1418,6 +1579,15 @@ version = "0.4.3" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70" +[[package]] +name = "hkdf" +version = "0.12.4" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "7b5f8eb2ad728638ea2c7d47a21db23b7b58a72ed6a38256b8a1849f15fbbdf7" +dependencies = [ + "hmac", +] + [[package]] name = "hmac" version = "0.12.1" @@ -1668,6 +1838,9 @@ name = "lazy_static" version = "1.4.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "e2abad23fbc42b3700f2f279844dc832adb2b2eb069b2df918f455c4e18cc646" +dependencies = [ + "spin 0.5.2", +] [[package]] name = "leb128" @@ -1681,6 +1854,12 @@ version = "0.2.153" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "9c198f91728a82281a64e1f4f9eeb25d82cb32a5de251c6bd1b5154d63a8e7bd" +[[package]] +name = "libm" +version = "0.2.8" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "4ec2a862134d2a7d32d7983ddcdd1c4923530833c9f2ea1a44fc5fa473989058" + [[package]] name = "libredox" version = "0.0.1" @@ -1842,10 +2021,14 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "3e2e65a1a2e43cfcb47a895c4c8b10d1f4a61097f9f254f183aee60cad9c651d" [[package]] -name = "md5" -version = "0.7.0" +name = "md-5" +version = "0.10.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "490cc448043f947bae3cbee9c203358d62dbee0db12107a74be5c30ccfd09771" +checksum = "d89e7ee0cfbedfc4da3340218492196241d89eefb6dab27de5df917a6d2e78cf" +dependencies = [ + "cfg-if", + "digest 0.10.7", +] [[package]] name = "memchr" @@ -2008,6 +2191,23 @@ dependencies = [ "num-traits", ] +[[package]] +name = "num-bigint-dig" +version = "0.8.4" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "dc84195820f291c7697304f3cbdadd1cb7199c0efc917ff5eafd71225c136151" +dependencies = [ + "byteorder", + "lazy_static", + "libm", + "num-integer", + "num-iter", + "num-traits", + "rand", + "smallvec", + "zeroize", +] + [[package]] name = "num-complex" version = "0.4.5" @@ -2094,6 +2294,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "da0df0e5185db44f69b44f26786fe401b6c293d1907744beaa7fa62b2e5a517a" dependencies = [ "autocfg", + "libm", ] [[package]] @@ -2108,6 +2309,15 @@ dependencies = [ "memchr", ] +[[package]] +name = "oid-registry" +version = "0.7.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "1c958dd45046245b9c3c2547369bb634eb461670b2e7e0de552905801a648d1d" +dependencies = [ + "asn1-rs", +] + [[package]] name = "once_cell" version = "1.19.0" @@ -2144,6 +2354,30 @@ version = "6.6.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "e2355d85b9a3786f481747ced0e0ff2ba35213a1f9bd406ed906554d7af805a1" +[[package]] +name = "p256" +version = "0.13.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "c9863ad85fa8f4460f9c48cb909d38a0d689dba1f6f6988a5e3e0d31071bcd4b" +dependencies = [ + "ecdsa", + "elliptic-curve", + "primeorder", + "sha2 0.10.8", +] + +[[package]] +name = "p384" +version = "0.13.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "70786f51bcc69f6a4c0360e063a4cac5419ef7c5cd5b3c99ad70f3be5ba79209" +dependencies = [ + "ecdsa", + "elliptic-curve", + "primeorder", + "sha2 0.10.8", +] + [[package]] name = "parking_lot" version = "0.12.1" @@ -2222,6 +2456,15 @@ dependencies = [ "sha2 0.10.8", ] +[[package]] +name = "pem-rfc7468" +version = "0.7.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "88b39c9bfcfc231068454382784bb460aae594343fb030d46e9f50a645418412" +dependencies = [ + "base64ct", +] + [[package]] name = "pest" version = "2.7.8" @@ -2337,6 +2580,27 @@ dependencies = [ "siphasher", ] +[[package]] +name = "pkcs1" +version = "0.7.5" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "c8ffb9f10fa047879315e6625af03c164b16962a5368d724ed16323b68ace47f" +dependencies = [ + "der", + "pkcs8", + "spki", +] + +[[package]] +name = "pkcs8" +version = "0.10.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "f950b2377845cebe5cf8b5165cb3cc1a5e0fa5cfa3e1f7f55707d8fd82e0a7b7" +dependencies = [ + "der", + "spki", +] + [[package]] name = "pkg-config" version = "0.3.30" @@ -2376,6 +2640,12 @@ dependencies = [ "thiserror", ] +[[package]] +name = "ppv-lite86" +version = "0.2.17" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "5b40af805b3121feab8a3c29f04d8ad262fa8e0561883e7653e024ae4479e6de" + [[package]] name = "pretty_assertions" version = "1.4.0" @@ -2386,6 +2656,15 @@ dependencies = [ "yansi 0.5.1", ] +[[package]] +name = "primeorder" +version = "0.13.6" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "353e1ca18966c16d9deb1c69278edbc5f194139612772bd9537af60ac231e1e6" +dependencies = [ + "elliptic-curve", +] + [[package]] name = "proc-macro2" version = "1.0.79" @@ -2580,6 +2859,17 @@ version = "0.8.5" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "34af8d1a0e25924bc5b7c43c079c942339d8f0a8b57c39049bef581b46327404" dependencies = [ + "rand_chacha", + "rand_core", +] + +[[package]] +name = "rand_chacha" +version = "0.3.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "e6c10a63a0fa32252be49d21e7709d4d4baf8d231c2dbce1eaa8141b9b127d88" +dependencies = [ + "ppv-lite86", "rand_core", ] @@ -2588,6 +2878,9 @@ name = "rand_core" version = "0.6.4" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "ec0be4795e2f6a28069bec0b5ff3e2ac9bafc99e6a9a7dc3547996c5c816922c" +dependencies = [ + "getrandom", +] [[package]] name = "rayon" @@ -2683,6 +2976,16 @@ version = "0.8.3" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "adad44e29e4c806119491a7f06f03de4d1af22c3a680dd47f1e6e179439d1f56" +[[package]] +name = "rfc6979" +version = "0.4.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "f8dd2a808d456c4a54e300a23e9f5a67e122c3024119acbfd73e3bf664491cb2" +dependencies = [ + "hmac", + "subtle", +] + [[package]] name = "rgb" version = "0.8.37" @@ -2692,12 +2995,47 @@ dependencies = [ "bytemuck", ] +[[package]] +name = "ring" +version = "0.17.8" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "c17fa4cb658e3583423e915b9f3acc01cceaee1860e33d59ebae66adc3a2dc0d" +dependencies = [ + "cc", + "cfg-if", + "getrandom", + "libc", + "spin 0.9.8", + "untrusted", + "windows-sys 0.52.0", +] + [[package]] name = "roxmltree" version = "0.19.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "3cd14fd5e3b777a7422cca79358c57a8f6e3a703d9ac187448d0daf220c2407f" +[[package]] +name = "rsa" +version = "0.9.6" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "5d0e5124fcb30e76a7e79bfee683a2746db83784b86289f6251b54b7950a0dfc" +dependencies = [ + "const-oid", + "digest 0.10.7", + "num-bigint-dig", + "num-integer", + "num-traits", + "pkcs1", + "pkcs8", + "rand_core", + "signature", + "spki", + "subtle", + "zeroize", +] + [[package]] name = "rustc-demangle" version = "0.1.23" @@ -2710,6 +3048,15 @@ version = "1.1.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "08d43f7aa6b08d49f382cde6a7982047c3426db949b1424bc4b7ec9ae12c6ce2" +[[package]] +name = "rusticata-macros" +version = "4.1.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "faf0c4a6ece9950b9abdb62b1cfcf2a68b3b67a10ba445b3bb85be2a293d0632" +dependencies = [ + "nom 7.1.3", +] + [[package]] name = "rustix" version = "0.38.32" @@ -2750,6 +3097,20 @@ version = "1.2.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49" +[[package]] +name = "sec1" +version = "0.7.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "d3e97a565f76233a6003f9f5c54be1d9c5bdfa3eccfb189469f11ec4901c47dc" +dependencies = [ + "base16ct", + "der", + "generic-array", + "pkcs8", + "subtle", + "zeroize", +] + [[package]] name = "semver" version = "0.11.0" @@ -2904,6 +3265,16 @@ dependencies = [ "libc", ] +[[package]] +name = "signature" +version = "2.2.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "77549399552de45a898a580c1b41d445bf730df867cc44e6c0233bbc4b8329de" +dependencies = [ + "digest 0.10.7", + "rand_core", +] + [[package]] name = "similar" version = "2.4.0" @@ -2960,6 +3331,28 @@ dependencies = [ "serde", ] +[[package]] +name = "spin" +version = "0.5.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "6e63cff320ae2c57904679ba7cb63280a3dc4613885beafb148ee7bf9aa9042d" + +[[package]] +name = "spin" +version = "0.9.8" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "6980e8d7511241f8acf4aebddbb1ff938df5eebe98691418c4468d0b72a96a67" + +[[package]] +name = "spki" +version = "0.7.3" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "d91ed6c858b01f942cd56b37a94b3e0a1798290327d1236e4d9cf4eaca44d29d" +dependencies = [ + "base64ct", + "der", +] + [[package]] name = "sptr" version = "0.3.2" @@ -3105,6 +3498,17 @@ dependencies = [ "unicode-ident", ] +[[package]] +name = "synstructure" +version = "0.13.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "c8af7666ab7b6390ab78131fb5b0fce11d6b7a6951602017c35fa82800708971" +dependencies = [ + "proc-macro2", + "quote", + "syn 2.0.55", +] + [[package]] name = "tap" version = "1.0.1" @@ -3235,10 +3639,12 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "c8248b6521bb14bc45b4067159b9b6ad792e2d6d754d6c41fb50e29fefe38749" dependencies = [ "deranged", + "itoa", "num-conv", "powerfmt", "serde", "time-core", + "time-macros", ] [[package]] @@ -3247,6 +3653,16 @@ version = "0.1.2" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "ef927ca75afb808a4d64dd374f00a2adf8d0fcff8e7b184af886c3c87ec4a3f3" +[[package]] +name = "time-macros" +version = "0.2.17" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "7ba3a3ef41e6672a2f0f001392bb5dcd3ff0a9992d618ca761a11c3121547774" +dependencies = [ + "num-conv", + "time-core", +] + [[package]] name = "tiny-keccak" version = "2.0.2" @@ -3356,6 +3772,12 @@ version = "0.2.3" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "c7de7d73e1754487cb58364ee906a499937a0dfabd86bcb980fa99ec8c8fa2ce" +[[package]] +name = "untrusted" +version = "0.9.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "8ecb6da28b8a351d773b68d5825ac39017e680750f980f3a1a85cd8dd28a47c1" + [[package]] name = "utf8parse" version = "0.2.1" @@ -4214,6 +4636,24 @@ dependencies = [ "tap", ] +[[package]] +name = "x509-parser" +version = "0.16.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "fcbc162f30700d6f3f82a24bf7cc62ffe7caea42c0b2cba8bf7f3ae50cf51f69" +dependencies = [ + "asn1-rs", + "data-encoding", + "der-parser", + "lazy_static", + "nom 7.1.3", + "oid-registry", + "ring", + "rusticata-macros", + "thiserror", + "time", +] + [[package]] name = "yaml-rust" version = "0.4.5" @@ -4243,13 +4683,17 @@ dependencies = [ "anyhow", "array-bytes", "ascii_tree", - "authenticode-parser", "base64 0.22.0", "bincode", "bitmask", "bitvec", "bstr 1.9.1", + "const-oid", "crc32fast", + "der-parser", + "digest 0.10.7", + "dsa", + "ecdsa", "fmmap", "globwalk", "goldenfile", @@ -4262,12 +4706,14 @@ dependencies = [ "linkme", "log", "magic", - "md5", + "md-5", "memchr", "memx", "nom 7.1.3", "num-derive 0.4.2", "num-traits", + "p256", + "p384", "pretty_assertions", "protobuf", "protobuf-codegen", @@ -4276,6 +4722,7 @@ dependencies = [ "regex-automata 0.4.6", "regex-syntax 0.8.3", "roxmltree", + "rsa", "rustc-hash", "serde", "serde_json", @@ -4287,6 +4734,7 @@ dependencies = [ "uuid", "walrus", "wasmtime", + "x509-parser", "yansi 1.0.1", "yara-x-macros", "yara-x-parser", @@ -4432,6 +4880,12 @@ dependencies = [ "syn 2.0.55", ] +[[package]] +name = "zeroize" +version = "1.7.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "525b4ec142c6b68a2d10f01f7bbf6755599ca3f81ea53b8431b7dd348f5fdb2d" + [[package]] name = "zip" version = "0.6.6" diff --git a/Cargo.toml b/Cargo.toml index f113d93a9..9f37ca674 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -35,7 +35,6 @@ annotate-snippets = "0.11.1" anyhow = "1.0.81" array-bytes = "6.2.2" ascii_tree = "0.1.1" -authenticode-parser = "0.5.0" base64 = "0.22.0" bincode = "1.3.3" bitmask = "0.5.0" @@ -45,7 +44,12 @@ cbindgen = "0.26.0" chrono = "0.4.35" clap = "4.5.3" clap_complete = "4.5.1" +const-oid = "0.9.6" crc32fast = "1.4.0" +der-parser = "9.0.0" +digest = "0.10.7" +dsa = "0.6.3" +ecdsa = "0.16.9" enable-ansi-support = "0.2.1" env_logger = "0.11.3" fmmap = "0.3.3" @@ -60,7 +64,7 @@ lazy_static = "1.4.0" line-span = "0.1.5" linkme = "0.3.25" log = "0.4.21" -md5 = "0.7.0" +md-5 = "0.10.6" sha1 = "0.10.6" sha2 = "0.10.8" # Using tlsh-fixed instead of tlsh because tlsh-fixed includes a fix for this @@ -72,6 +76,8 @@ memx = "0.1.28" nom = "7.1.3" num-traits = "0.2.18" num-derive = "0.4.2" +p256 = "0.13.2" +p384 = "0.13.0" pest = "2.7.8" pest_derive = "2.7.8" pretty_assertions = "1.4.0" @@ -84,6 +90,7 @@ rayon = "1.5.3" regex-syntax = "0.8.3" regex-automata = "0.4.6" roxmltree = "0.19.0" +rsa = "0.9.6" rustc-hash = "1.1.0" smallvec = "1.13.2" serde = "1.0" @@ -92,6 +99,7 @@ thiserror = "1.0.58" uuid = "1.4.1" walrus = "0.20.2" wasmtime = "19.0.1" +x509-parser = "0.16.0" yaml-rust = "0.4.5" yansi = "1.0.1" yara-x = { path = "lib" } diff --git a/lib/Cargo.toml b/lib/Cargo.toml index 1c8e4c67f..a1cb1a13d 100644 --- a/lib/Cargo.toml +++ b/lib/Cargo.toml @@ -20,19 +20,6 @@ exclude = [ ] [features] -# When this feature is enabled the OpenSSL library is linked statically. -# However, you need to specify the path where the library and its header files -# are located by setting the environment variable OPENSSL_DIR. For example: -# -# OPENSSL_DIR=/usr/local/Cellar/openssl@3/3.2.0_1/ cargo build --features=openssl-static -# -# The directory specified in OPENSSL_DIR must contain subdirectories /include -# and /lib. The latter must contain `libcrypto.a`. -# -# You can also set OPENSSL_INCLUDE_DIR and OPENSSL_LIB_DIR, for setting the -# two directories independently. -openssl-static = ['authenticode-parser/openssl-static'] - # Enables constant folding. When constant folding is enabled, expressions # like `2+2+2` and `true or false`, whose value can be determined at compile # time, will be reduced to its final value, instead of producing code that @@ -62,6 +49,12 @@ logging = ["dep:log"] # scan. Notice that profiling itself has a noticeable impact on performance. rules-profiling = ["logging"] + +# When enabled use the logic included in the `x509-parser` crate for verifying +# certificates. If not enabled we use our ouwn logic. This is disabled by +# default. +x509-parser-verify = ['x509-parser/verify'] + # Features for enabling/disabling modules. # # For each module we have a `-module` feature that controls whether @@ -81,12 +74,13 @@ dotnet-module = [ elf-module = [ "dep:tlsh-fixed", "dep:nom", + "dep:md-5", ] # The `hash` module provides functions for computing md5, sha1, sha-256, # crc32 and checksum. hash-module = [ - "dep:md5", + "dep:md-5", "dep:sha1", "dep:sha2", "dep:crc32fast", @@ -115,8 +109,19 @@ math-module = [] # The `pe` module parses PE files. pe-module = [ - "dep:authenticode-parser", + "dep:const-oid", + "dep:der-parser", + "dep:digest", + "dep:dsa", + "dep:ecdsa", "dep:nom", + "dep:rsa", + "dep:md-5", + "dep:p256", + "dep:p384", + "dep:sha1", + "dep:sha2", + "dep:x509-parser" ] # The `string` modules offer some functions for parsing strings as integers, @@ -162,13 +167,17 @@ aho-corasick = { workspace = true, features = ["logging"] } anyhow = { workspace = true } array-bytes = { workspace = true } ascii_tree = { workspace = true } -authenticode-parser = { workspace = true, optional = true } base64 = { workspace = true } bincode = { workspace = true } bitmask = { workspace = true } bitvec = { workspace = true } bstr = { workspace = true, features = ["serde"] } +const-oid = { workspace = true, optional = true, features = ["db"] } crc32fast = { workspace = true, optional = true } +der-parser = { workspace = true, optional = true, features = ["bigint"] } +digest = { workspace = true, optional = true } +dsa = { workspace = true, optional = true } +ecdsa = { workspace = true, optional = true } fmmap = { workspace = true } indexmap = { workspace = true, features = ["serde"] } intaglio = { workspace = true } @@ -176,20 +185,23 @@ itertools = { workspace = true } lazy_static = { workspace = true } linkme = { workspace = true } log = { workspace = true, optional = true } -md5 = { workspace = true, optional = true } -sha1 = { workspace = true, optional = true } -sha2 = { workspace = true, optional = true } +md-5 = { workspace = true, optional = true, features = ["oid"] } +sha1 = { workspace = true, optional = true, features = ["oid"] } +sha2 = { workspace = true, optional = true, features = ["oid"] } magic = { workspace = true, optional = true } memchr = { workspace = true } memx = { workspace = true } nom = { workspace = true, optional = true } num-derive = { workspace = true } num-traits = { workspace = true } +p384 = { workspace = true, optional = true, features = ["ecdsa"] } +p256 = { workspace = true, optional = true, features = ["ecdsa"] } protobuf = { workspace = true } rustc-hash = { workspace = true } regex-syntax = { workspace = true } regex-automata = { workspace = true } roxmltree = { workspace = true, optional = true } +rsa = { workspace = true, optional = true } smallvec = { workspace = true, features = ["serde"] } serde = { workspace = true, features = ["rc"] } serde_json = { workspace = true } @@ -198,6 +210,7 @@ tlsh-fixed = { workspace = true, optional = true } uuid = { workspace = true, optional = true, features = ["v4"] } walrus = { workspace = true } wasmtime = { workspace = true, features = ["cranelift", "parallel-compilation"] } +x509-parser = { workspace = true, optional = true } yansi = { workspace = true } yara-x-macros = { workspace = true } yara-x-parser = { workspace = true } diff --git a/lib/src/modules/elf/mod.rs b/lib/src/modules/elf/mod.rs index 265296207..d3e1f318b 100644 --- a/lib/src/modules/elf/mod.rs +++ b/lib/src/modules/elf/mod.rs @@ -6,6 +6,7 @@ and sections information, exported symbols, target platform, etc. use itertools::Itertools; use lazy_static::lazy_static; +use md5::{Digest, Md5}; use rustc_hash::FxHashSet; use tlsh_fixed as tlsh; @@ -45,7 +46,10 @@ fn import_md5(ctx: &mut ScanContext) -> Option { .sorted() .join(","); - let digest = format!("{:x}", md5::compute(comma_separated_names)); + let mut hasher = Md5::new(); + hasher.update(comma_separated_names.as_bytes()); + + let digest = format!("{:x}", hasher.finalize()); Some(RuntimeString::new(digest)) } diff --git a/lib/src/modules/hash/mod.rs b/lib/src/modules/hash/mod.rs index 429c23143..6c21b0a6b 100644 --- a/lib/src/modules/hash/mod.rs +++ b/lib/src/modules/hash/mod.rs @@ -1,6 +1,6 @@ use std::cell::RefCell; -use md5 as md5_hash; +use md5::Md5; use rustc_hash::FxHashMap; use sha1::Sha1; use sha2::{Digest, Sha256}; @@ -59,7 +59,11 @@ fn md5_data( let range = offset.try_into().ok()?..(offset + size).try_into().ok()?; let data = ctx.scanned_data().get(range)?; - let digest = format!("{:x}", md5_hash::compute(data)); + let mut hasher = Md5::new(); + + hasher.update(data); + + let digest = format!("{:x}", hasher.finalize()); MD5_CACHE.with(|cache| { cache.borrow_mut().insert((offset, size), digest.clone()); @@ -70,10 +74,10 @@ fn md5_data( #[module_export(name = "md5")] fn md5_str(ctx: &mut ScanContext, s: RuntimeString) -> Option { - Some(RuntimeString::new(format!( - "{:x}", - md5_hash::compute(s.as_bstr(ctx)) - ))) + let mut hasher = Md5::new(); + hasher.update(s.as_bstr(ctx)); + + Some(RuntimeString::new(format!("{:x}", hasher.finalize()))) } #[module_export(name = "sha1")] diff --git a/lib/src/modules/pe/asn1.rs b/lib/src/modules/pe/asn1.rs new file mode 100644 index 000000000..bfca55191 --- /dev/null +++ b/lib/src/modules/pe/asn1.rs @@ -0,0 +1,657 @@ +use std::borrow::Cow; + +use array_bytes::bytes2hex; +use const_oid::db::{rfc4519, rfc5912}; +use const_oid::ObjectIdentifier; + +use der_parser::asn1_rs::{Any, FromBer, FromDer, OptTaggedParser}; +use der_parser::ber::*; +use der_parser::error::Error::BerValueError; +use der_parser::error::{BerError, BerResult}; +use der_parser::nom; +use der_parser::nom::branch::alt; +use der_parser::nom::combinator::{consumed, map_res}; +use der_parser::nom::Err::Incomplete; +use der_parser::nom::IResult; +use der_parser::nom::Parser; +use der_parser::num_bigint::BigUint; +use der_parser::{asn1_rs, parse_ber, Oid}; + +use digest::Digest; +use sha1::Sha1; + +use x509_parser::certificate::X509Certificate; +use x509_parser::error::X509Error; +use x509_parser::prelude::{AlgorithmIdentifier, X509CertificateParser}; +use x509_parser::x509::X509Name; + +#[rustfmt::skip] +#[allow(dead_code)] +pub mod oid { + use const_oid::ObjectIdentifier; + + pub const JURISDICTION_L: ObjectIdentifier = + ObjectIdentifier::new_unwrap("1.3.6.1.4.1.311.60.2.1.1"); + + pub const JURISDICTION_ST: ObjectIdentifier = + ObjectIdentifier::new_unwrap("1.3.6.1.4.1.311.60.2.1.2"); + + pub const JURISDICTION_C: ObjectIdentifier = + ObjectIdentifier::new_unwrap("1.3.6.1.4.1.311.60.2.1.3"); + + pub const MS_SPC_NESTED_SIGNATURE: ObjectIdentifier = + ObjectIdentifier::new_unwrap("1.3.6.1.4.1.311.2.4.1"); + + pub const MS_SPC_INDIRECT_DATA_OBJID: ObjectIdentifier = + ObjectIdentifier::new_unwrap("1.3.6.1.4.1.311.2.1.4"); + + pub const MS_SPC_OPUS_INFO: ObjectIdentifier = + ObjectIdentifier::new_unwrap("1.3.6.1.4.1.311.2.1.12"); + + pub const MS_COUNTERSIGN: ObjectIdentifier = + ObjectIdentifier::new_unwrap("1.3.6.1.4.1.311.3.3.1"); + + /// Similar to 1.2.840.113549.1.1.5. Obsolete, but still present in some files + /// like: 111aeddc6a6dbf64b28cb565aa12af9ee3cc0a56ce31e4da0068cf6b474c3288 + pub const SHA1_WITH_RSA_ENCRYPTION_OBSOLETE: ObjectIdentifier = + ObjectIdentifier::new_unwrap("1.3.14.3.2.29"); + +} + +#[inline] +pub fn oid_to_object_identifier(oid: &Oid) -> ObjectIdentifier { + ObjectIdentifier::from_bytes(oid.as_bytes()).unwrap() +} + +pub fn oid_to_str(oid: &Oid) -> Cow<'static, str> { + match oid_to_object_identifier(oid) { + rfc5912::ID_MD_5 => Cow::Borrowed("md5"), + rfc5912::ID_SHA_1 => Cow::Borrowed("sha1"), + rfc5912::ID_SHA_256 => Cow::Borrowed("sha256"), + rfc5912::ID_SHA_384 => Cow::Borrowed("sha384"), + rfc5912::ID_SHA_512 => Cow::Borrowed("sha512"), + rfc5912::MD_5_WITH_RSA_ENCRYPTION => { + Cow::Borrowed("md5WithRSAEncryption") + } + oid::SHA1_WITH_RSA_ENCRYPTION_OBSOLETE + | rfc5912::SHA_1_WITH_RSA_ENCRYPTION => { + Cow::Borrowed("sha1WithRSAEncryption") + } + rfc5912::SHA_256_WITH_RSA_ENCRYPTION => { + Cow::Borrowed("sha256WithRSAEncryption") + } + rfc5912::SHA_384_WITH_RSA_ENCRYPTION => { + Cow::Borrowed("sha384WithRSAEncryption") + } + rfc5912::SHA_512_WITH_RSA_ENCRYPTION => { + Cow::Borrowed("sha512WithRSAEncryption") + } + rfc5912::DSA_WITH_SHA_1 => Cow::Borrowed("dsaWithSHA1"), + rfc5912::DSA_WITH_SHA_224 => Cow::Borrowed("dsa_with_SHA224"), + rfc5912::DSA_WITH_SHA_256 => Cow::Borrowed("dsa_with_SHA256"), + rfc4519::C => Cow::Borrowed("C"), + rfc4519::COMMON_NAME => Cow::Borrowed("CN"), + rfc4519::O => Cow::Borrowed("O"), + rfc4519::OU => Cow::Borrowed("OU"), + rfc4519::ST => Cow::Borrowed("ST"), + // OIDs not included in const_oid. + oid::JURISDICTION_C => Cow::Borrowed("jurisdictionC"), + oid::JURISDICTION_L => Cow::Borrowed("jurisdictionL"), + oid::JURISDICTION_ST => Cow::Borrowed("jurisdictionST"), + // In the default case try to use the string representation provided by + // the `const-oid` crate. Panics if this fails. + oid => { + if let Some(name) = const_oid::db::DB.by_oid(&oid) { + Cow::Borrowed(name) + } else { + Cow::Owned(oid.to_string()) + } + } + } +} + +pub struct ContentInfo<'a> { + pub content_type: ObjectIdentifier, + pub content: Any<'a>, +} + +impl<'a> ContentInfo<'a> { + pub fn parse(data: &'a [u8]) -> BerResult { + parse_ber_sequence_defined_g(|i, _| Self::parse_inner(i))(data) + } + + pub fn from_ber( + data: &'a [u8], + ) -> Result> { + Self::parse(data).map(|(_, content_info)| content_info) + } + + fn parse_inner(data: &'a [u8]) -> BerResult { + let (remainder, content_type) = parse_ber_oid(data)?; + let (remainder, content) = + parse_ber_tagged_explicit_g(0, |content, _| { + parse_ber_any(content) + })(remainder)?; + + Ok(( + remainder, + Self { + content_type: oid_to_object_identifier(content_type.as_oid()?), + content, + }, + )) + } +} + +impl<'a> TryFrom<&Any<'a>> for ContentInfo<'a> { + type Error = asn1_rs::Error; + + fn try_from(any: &Any<'a>) -> Result { + any.tag().assert_eq(asn1_rs::Tag::Sequence)?; + Ok(Self::parse_inner(any.data).map(|(_, ci)| ci)?) + } +} + +pub struct Certificate<'a> { + pub x509: X509Certificate<'a>, + pub thumbprint: String, +} + +/// [SignedData][1] structure. +/// +/// ```text +/// SignedData ::= SEQUENCE { +/// version CMSVersion, +/// digestAlgorithms DigestAlgorithmIdentifiers, +/// encapContentInfo EncapsulatedContentInfo, +/// certificates [0] IMPLICIT CertificateSet OPTIONAL, +/// crls [1] IMPLICIT RevocationInfoChoices OPTIONAL, +/// signerInfos SignerInfos +/// } +/// +/// DigestAlgorithmIdentifiers ::= SET OF DigestAlgorithmIdentifier +/// +/// SignerInfos ::= SET OF SignerInfo +/// ``` +/// +/// [1]: https://datatracker.ietf.org/doc/html/rfc5652#section-5.1 +pub struct SignedData<'a> { + pub version: i32, + pub digest_algorithms: Vec>, + pub content_info: ContentInfo<'a>, + pub certificates: Vec>, + /// In general `SignedData` can be signed by multiple signers and therefore + /// can contain multiple `SignerInfo` structures. However, in the case of + /// Authenticode there's only one signer. + pub signer_infos: Vec>, +} + +impl<'a> SignedData<'a> { + fn parse_inner(input: &'a [u8]) -> BerResult { + let (remainder, version) = parse_ber_integer(input)?; + + let (remainder, digest_algorithms) = + parse_ber_set_of_v(AlgorithmIdentifier::from_ber)(remainder) + .map_err(|_| BerValueError)?; + + let (remainder, content_info) = ContentInfo::parse(remainder)?; + + let (remainder, certificates) = OptTaggedParser::from(0) + .parse_ber(remainder, |_, raw_certs| { + Self::parse_certificates(raw_certs) + }) + .map_err(|_| BerValueError)?; + + let (remainder, _revocation_info) = OptTaggedParser::from(1) + .parse_ber(remainder, |_, data| parse_ber(data))?; + + let (remainder, signer_infos) = + parse_ber_set_of_v(SignerInfo::parse)(remainder)?; + + Ok(( + remainder, + Self { + version: version.as_i32()?, + certificates: certificates.unwrap_or_default(), + signer_infos, + digest_algorithms, + content_info, + }, + )) + } + + fn parse_certificates( + input: &[u8], + ) -> IResult<&[u8], Vec, X509Error> { + let mut remainder = input; + let mut certificates = Vec::new(); + + // A parser that returns both the parsed certificate, and the + // raw bytes consumed by the certificate parser. + let mut cert_parser = + consumed(|input| X509CertificateParser::new().parse(input)); + + loop { + remainder = match cert_parser(remainder) { + Ok((remainder, (cert_bytes, cert))) => { + certificates.push(Certificate { + x509: cert, + thumbprint: bytes2hex("", Sha1::digest(cert_bytes)), + }); + remainder + } + Err(Incomplete(_)) => { + return Ok((remainder, certificates)); + } + Err(err) => return Err(err), + } + } + } +} + +impl<'a> TryFrom> for SignedData<'a> { + type Error = asn1_rs::Error; + + fn try_from(any: Any<'a>) -> Result { + any.tag().assert_eq(asn1_rs::Tag::Sequence)?; + Ok(Self::parse_inner(any.data).map(|(_, ci)| ci)?) + } +} + +/// [SignerInfo][1] structure. +/// +/// ```text +/// SignerInfo ::= SEQUENCE { +/// version CMSVersion, +/// sid SignerIdentifier, +/// digestAlgorithm DigestAlgorithmIdentifier, +/// signedAttrs [0] IMPLICIT SignedAttributes OPTIONAL, +/// signatureAlgorithm SignatureAlgorithmIdentifier, +/// signature SignatureValue, +/// unsignedAttrs [1] IMPLICIT UnsignedAttributes OPTIONAL +/// } +/// ``` +/// +/// [1]: https://datatracker.ietf.org/doc/html/rfc5652#section-5.3 +pub struct SignerInfo<'a> { + pub version: i32, + /// Unsigned attributes that contain information about the signer. + /// These attributes are not protected by the signature, they are usually + /// added after the signature has been generated. For example, they + /// contain countersignatures, which are signatures of the signatures. + pub unsigned_attrs: Vec>, + /// Signed attributes that contain information about the signer. + /// These attributes can't be tampered without invalidating the + /// signature in `signature`. + pub signed_attrs: Vec>, + /// The raw bytes of the signed attributes, as they appear in the PE + /// files. Used for computing the digest during the validation process. + pub raw_signed_attrs: &'a [u8], + pub issuer: X509Name<'a>, + /// The serial number of the certificate that signed this structure. The + /// produced signature is stored in the `signature` field. + pub serial_number: BigUint, + /// The digest algorithm used during the signing process. This digest + /// algorithm is applied to the DER encoding of the signed attributes + /// in the `signed_attrs` field. Then the digest itself is signed. + pub digest_algorithm: AlgorithmIdentifier<'a>, + /// The signature algorithm (RSA, DSA, ECDSA) used for producing the + /// signature. + pub signature_algorithm: AlgorithmIdentifier<'a>, + /// The signature itself. This signature can be validated by using + /// the public key stored in the certified identified by `serial_number`. + pub signature: &'a [u8], +} + +impl<'a> SignerInfo<'a> { + pub fn parse(input: &'a [u8]) -> BerResult { + parse_ber_sequence_defined_g(|input: &[u8], _| { + Self::parse_inner(input) + })(input) + } + + pub fn parse_inner(input: &'a [u8]) -> BerResult { + let (remainder, version) = parse_ber_integer(input)?; + + let (remainder, (issuer, serial_number)) = + Self::parse_issuer_and_serial_number(remainder)?; + + let (remainder, digest_algorithm) = + AlgorithmIdentifier::from_ber(remainder) + .map_err(|_| BerValueError)?; + + let (remainder, signed_attrs) = OptTaggedParser::from(0).parse_ber( + remainder, + |_, raw_attrs| { + let (remainder, parsed_attrs) = + Self::parse_attributes(raw_attrs)?; + + Ok((remainder, (raw_attrs, parsed_attrs))) + }, + )?; + + let (remainder, signature_algorithm) = + AlgorithmIdentifier::from_ber(remainder) + .map_err(|_| BerValueError)?; + + let (remainder, signature) = parse_ber_octetstring(remainder)?; + + let (remainder, unsigned_attrs) = OptTaggedParser::from(1) + .parse_ber(remainder, |_, raw_attrs| { + Self::parse_attributes(raw_attrs) + })?; + + let (raw_signed_attrs, signed_attrs) = + signed_attrs.unwrap_or_default(); + + Ok(( + remainder, + Self { + version: version.as_i32()?, + signed_attrs, + raw_signed_attrs, + unsigned_attrs: unsigned_attrs.unwrap_or_default(), + signature: signature.content.as_slice()?, + issuer, + serial_number, + digest_algorithm, + signature_algorithm, + }, + )) + } + + /// Returns the value of the signed attribute with a given OID. + /// + /// An attribute can have multiple values, but in Authenticode + /// signatures all the attributes we need to work with have a + /// single value. This function retrieves the attribute and its + /// first value in a single step. + pub fn get_signed_attr(&self, oid: &ObjectIdentifier) -> Option<&Any<'a>> { + self.signed_attrs + .iter() + .find(|attr| attr.attr_type.eq(oid)) + .and_then(|attr| attr.attr_values.first()) + } + + fn parse_issuer_and_serial_number( + input: &[u8], + ) -> BerResult<(X509Name, BigUint)> { + parse_ber_sequence_defined_g(|input: &[u8], _| { + let (remainder, issuer) = + X509Name::from_der(input).map_err(|_| BerValueError)?; + + let (remainder, serial) = parse_ber_integer(remainder)?; + + // RFC 5280 4.1.2.2: "The serial number MUST be a positive integer" + // however, many CAs do not respect this and send integers with MSB + // set, so we do not use `as_biguint()`. + let serial = BigUint::from_bytes_be(serial.content.as_slice()?); + + Ok((remainder, (issuer, serial))) + })(input) + } + + fn parse_attributes(input: &[u8]) -> BerResult> { + let mut remainder = input; + let mut attributes = Vec::new(); + loop { + remainder = match Attribute::parse(remainder) { + Ok((remainder, attr)) => { + attributes.push(attr); + remainder + } + Err(Incomplete(_)) => return Ok((remainder, attributes)), + Err(err) => return Err(err), + } + } + } +} + +impl<'a> TryFrom<&Any<'a>> for SignerInfo<'a> { + type Error = asn1_rs::Error; + + fn try_from(any: &Any<'a>) -> Result { + any.tag().assert_eq(asn1_rs::Tag::Sequence)?; + Ok(Self::parse_inner(any.data).map(|(_, si)| si)?) + } +} + +/// [Attribute][1] structure. +/// +/// ```text +/// Attribute ::= SEQUENCE { +/// attrType OBJECT IDENTIFIER, +/// attrValues SET OF AttributeValue +/// } +/// +/// AttributeValue ::= ANY +/// ``` +/// +/// [1]: https://datatracker.ietf.org/doc/html/rfc5652#section-5.3 +pub struct Attribute<'a> { + pub attr_type: ObjectIdentifier, + pub attr_values: Vec>, +} + +impl<'a> Attribute<'a> { + pub fn parse(input: &'a [u8]) -> BerResult { + parse_ber_sequence_defined_g(|data: &[u8], _| { + let (remainder, attr_type) = parse_ber_oid(data)?; + let (remainder, attr_values) = + parse_ber_set_of_v(parse_ber_any)(remainder)?; + + Ok(( + remainder, + Self { + attr_type: oid_to_object_identifier(attr_type.as_oid()?), + attr_values, + }, + )) + })(input) + } +} + +/// [SpcIndirectDataContent][1] structure. +/// +/// ```text +/// SpcIndirectDataContent ::= SEQUENCE { +/// data SpcAttributeTypeAndOptionalValue, +/// messageDigest DigestInfo +/// } +/// ``` +/// +/// [1]: https://learn.microsoft.com/en-us/openspecs/office_file_formats/ms-oshared/1537695a-28f0-4828-8b7b-d6dab62b8030 +pub struct SpcIndirectDataContent<'a> { + pub message_digest: DigestInfo<'a>, +} + +impl<'a> SpcIndirectDataContent<'a> { + pub fn parse_inner(input: &'a [u8]) -> BerResult { + let (remainder, _data) = parse_ber(input)?; + let (remainder, message_digest) = DigestInfo::parse(remainder)?; + + Ok((remainder, Self { message_digest })) + } +} + +impl<'a> TryFrom> for SpcIndirectDataContent<'a> { + type Error = asn1_rs::Error; + + fn try_from(any: Any<'a>) -> Result { + any.tag().assert_eq(Tag::Sequence)?; + Ok(Self::parse_inner(any.data).map(|(_, ci)| ci)?) + } +} + +/// [DigestInfo][1] structure +/// +/// ```text +/// DigestInfo ::= SEQUENCE { +/// digestAlgorithm AlgorithmIdentifier, +/// digest OCTETSTRING +/// } +/// ``` +/// +/// [1]: https://learn.microsoft.com/en-us/openspecs/office_file_formats/ms-oshared/1537695a-28f0-4828-8b7b-d6dab62b8030 +pub struct DigestInfo<'a> { + pub algorithm: AlgorithmIdentifier<'a>, + pub digest: &'a [u8], +} + +impl<'a> DigestInfo<'a> { + pub fn parse(input: &'a [u8]) -> BerResult { + parse_ber_sequence_defined_g(|input: &[u8], _| { + let (remainder, algorithm) = AlgorithmIdentifier::from_ber(input) + .map_err(|_| BerValueError)?; + let (remainder, digest) = parse_ber_octetstring(remainder)?; + Ok((remainder, Self { algorithm, digest: digest.as_slice()? })) + })(input) + } +} + +/// [SpcSpOpusInfo][1] structure +/// +/// ```text +/// SpcSpOpusInfo ::= SEQUENCE { +/// programName [0] EXPLICIT SpcString OPTIONAL, +/// moreInfo [1] EXPLICIT SpcLink OPTIONAL, +/// } +/// ``` +/// +/// [1]: https://learn.microsoft.com/en-us/openspecs/office_file_formats/ms-oshared/91755632-4b0d-44ca-89a9-9699afbbd268 +pub struct SpcSpOpusInfo { + pub program_name: Option, +} + +impl SpcSpOpusInfo { + fn parse_inner(input: &[u8]) -> BerResult { + let (remainder, program_name) = OptTaggedParser::from(0) + .parse_ber(input, |_, content| Self::parse_spc_string(content))?; + + let (remainder, _more_info) = + OptTaggedParser::from(1).parse_ber(remainder, |_, content| { + let (rem, value) = parse_ber(content)?; + Ok((rem, value)) + })?; + + Ok((remainder, Self { program_name })) + } + + fn parse_spc_string(input: &[u8]) -> BerResult { + alt(( + map_res( + parse_ber_tagged_implicit( + 0, + parse_ber_content(Tag::BmpString), + ), + |s| string_from_utf16be(s.as_slice()?).ok_or(BerValueError), + ), + map_res( + parse_ber_tagged_implicit( + 1, + parse_ber_content(Tag::Ia5String), + ), + |s| Ok::(String::from(s.as_str()?)), + ), + ))(input) + } +} + +impl TryFrom<&Any<'_>> for SpcSpOpusInfo { + type Error = asn1_rs::Error; + + fn try_from(any: &Any) -> Result { + Ok(Self::parse_inner(any.data).map(|(_, ci)| ci)?) + } +} + +/// [TSTInfo][1] structure. +/// +/// ```text +/// TSTInfo ::= SEQUENCE { +/// version INTEGER { v1(1) }, +/// policy TSAPolicyId, +/// messageImprint MessageImprint, +/// -- MUST have the same value as the similar field in +/// -- TimeStampReq +/// serialNumber INTEGER, +/// -- Time-Stamping users MUST be ready to accommodate integers +/// -- up to 160 bits. +/// genTime GeneralizedTime, +/// accuracy Accuracy OPTIONAL, +/// ordering BOOLEAN DEFAULT FALSE, +/// nonce INTEGER OPTIONAL, +/// -- MUST be present if the similar field was present +/// -- in TimeStampReq. In that case it MUST have the same value. +/// tsa [0] GeneralName OPTIONAL, +/// extensions [1] IMPLICIT Extensions OPTIONAL } +/// +/// +/// MessageImprint ::= SEQUENCE { +/// hashAlgorithm AlgorithmIdentifier, +/// hashedMessage OCTET STRING } +/// ``` +/// +/// [1]: https://datatracker.ietf.org/doc/html/rfc3161 +pub struct TstInfo<'a> { + pub hash_algorithm: AlgorithmIdentifier<'a>, + pub hashed_message: &'a [u8], +} + +impl<'a> TstInfo<'a> { + pub fn from_ber( + data: &'a [u8], + ) -> Result> { + Self::parse(data).map(|(_, tst_info)| tst_info) + } + + pub fn parse(input: &'a [u8]) -> BerResult { + parse_ber_sequence_defined_g(|input: &[u8], _| { + let (remainder, _version) = parse_ber_integer(input)?; + let (remainder, _policy) = parse_ber(remainder)?; + + let (remainder, (hash_algorithm, hashed_message)) = + Self::parse_message_imprint(remainder)?; + + // Ignore the remaining fields, we don't need them. + + Ok((remainder, Self { hash_algorithm, hashed_message })) + })(input) + } + + fn parse_message_imprint( + input: &'a [u8], + ) -> BerResult<(AlgorithmIdentifier, &'a [u8])> { + parse_ber_sequence_defined_g(|input: &[u8], _| { + let (remainder, hash_algorithm) = + AlgorithmIdentifier::from_ber(input) + .map_err(|_| BerValueError)?; + + let (remainder, hashed_message) = parse_ber(remainder)?; + + Ok((remainder, (hash_algorithm, hashed_message.as_slice()?))) + })(input) + } +} + +/// Tries to create a string from a byte slice that contains the UTF-16BE +/// representation of the string. +/// +/// There's a `String::from_utf16be` function that is currently unstable. If +/// it becomes stable we can use it and remove this function. +/// +/// https://doc.rust-lang.org/alloc/string/struct.String.html#method.from_utf16be +fn string_from_utf16be(v: &[u8]) -> Option { + if v.len() % 2 != 0 { + return None; + } + + let codepoints = v + .chunks_exact(2) + .map(|chunk| u16::from_be_bytes([chunk[0], chunk[1]])); + + let x: String = + char::decode_utf16(codepoints).collect::>().ok()?; + + Some(x) +} diff --git a/lib/src/modules/pe/authenticode.rs b/lib/src/modules/pe/authenticode.rs new file mode 100644 index 000000000..33279ca86 --- /dev/null +++ b/lib/src/modules/pe/authenticode.rs @@ -0,0 +1,1114 @@ +use std::borrow::Cow; +use std::fmt::Write; + +use array_bytes::bytes2hex; +use const_oid::db::{rfc5911, rfc5912, rfc6268}; +use const_oid::{AssociatedOid, ObjectIdentifier}; +use der_parser::asn1_rs::{Set, Tag, ToDer, UtcTime}; +use digest::{Digest, Output}; +use dsa::Components; +use ecdsa::signature::hazmat::PrehashVerifier; +use itertools::Itertools; +use md5::Md5; +use nom::AsBytes; +use protobuf::MessageField; +use rsa::traits::SignatureScheme; +use rsa::Pkcs1v15Sign; +use sha1::Sha1; +use sha2::{Sha256, Sha384, Sha512}; +use thiserror::Error; +use x509_parser::certificate::X509Certificate; +use x509_parser::der_parser::num_bigint::BigUint; +use x509_parser::x509::{AlgorithmIdentifier, SubjectPublicKeyInfo, X509Name}; + +use crate::modules::pe::asn1::{ + oid, oid_to_object_identifier, oid_to_str, Attribute, Certificate, + ContentInfo, DigestInfo, SignedData, SignerInfo, SpcIndirectDataContent, + SpcSpOpusInfo, TstInfo, +}; +use crate::modules::protos; + +/// Error returned by [`AuthenticodeParser::parse`]. +#[derive(Clone, Debug, Eq, PartialEq)] +pub enum ParseError { + /// The signature data is not valid [`ContentInfo`]. + InvalidContentInfo, + + /// The content type is not signed data (1.2.840.113549.1.7.2) + InvalidContentType(String), + + /// The content info is not valid [`SignedData`]. + InvalidSignedData, + + /// The version of [`SignedData`] is not 1. + InvalidSignedDataVersion(i32), + + /// The number of digest algorithms is not 1. + InvalidNumDigestAlgorithms(usize), + + /// The encapsulated content type does not match [`SPC_INDIRECT_DATA_OBJID`]. + InvalidEncapsulatedContentType(String), + + /// The encapsulated content is not valid [`SpcIndirectDataContent`]. + InvalidSpcIndirectDataContent, + + /// The number of signer infos is not 1. + InvalidNumSignerInfo, + + /// The `contentType` authenticated attribute is missing. + MissingContentTypeAuthenticatedAttribute, + + /// The attribute containing the Authenticode digest is + /// missing. + MissingAuthenticodeDigest, +} + +/// Trait implemented by any type that is able to compute the Authenticode +/// hash for a PE file. +pub trait AuthenticodeHasher { + /// Computes the Authenticode digest. + /// + /// The `digest` argument is any type implementing the [`digest::Update`] + /// trait, like [`Md5`], [`Sha1`] and [`Sha256`]. It should be newly created + /// digest that hasn't being updated with any data yet. When this function + /// returns the digest's output is the Authenticode hash. + fn hash(&self, digest: &mut dyn digest::Update) -> Option<()>; +} + +/// Parses Authenticode signatures in a PE file. +/// +/// Some resources for understanding Authenticode signatures: +/// https://blog.trailofbits.com/2020/05/27/verifying-windows-binaries-without-windows/ +/// https://docs.clamav.net/appendix/Authenticode.html +/// https://download.microsoft.com/download/9/c/5/9c5b2167-8017-4bae-9fde-d599bac8184a/authenticode_pe.docx +pub struct AuthenticodeParser {} + +impl AuthenticodeParser { + /// Parses Authenticode signatures from DER-encoded bytes. + pub fn parse<'a>( + input: &'a [u8], + authenticode_hasher: &impl AuthenticodeHasher, + ) -> Result>, ParseError> { + let content_info = ContentInfo::from_ber(input) + .map_err(|_| ParseError::InvalidContentInfo)?; + + Self::parse_content_info(content_info, authenticode_hasher) + } + + fn parse_content_info<'a>( + content_info: ContentInfo<'a>, + authenticode_hasher: &impl AuthenticodeHasher, + ) -> Result>, ParseError> { + if content_info.content_type != rfc5911::ID_SIGNED_DATA { + return Err(ParseError::InvalidContentType( + content_info.content_type.to_string(), + )); + } + + let mut signed_data: SignedData = content_info + .content + .try_into() + .map_err(|_| ParseError::InvalidSignedData)?; + + if signed_data.version != 1 { + return Err(ParseError::InvalidSignedDataVersion( + signed_data.version, + )); + } + + // According to the specification, SignedData must contain exactly one + // digest algorithm, and it must match the one specified in SignerInfo. + if signed_data.digest_algorithms.len() != 1 { + return Err(ParseError::InvalidNumDigestAlgorithms( + signed_data.digest_algorithms.len(), + )); + } + + // The content in `SignedData` must be a `SpcIndirectDataContent` + // structure. + if signed_data.content_info.content_type + != oid::MS_SPC_INDIRECT_DATA_OBJID + { + return Err(ParseError::InvalidEncapsulatedContentType( + signed_data.content_info.content_type.to_string(), + )); + } + + // According to the Authenticode specification there's exactly one + // signer info, take it. + let signer_info = match signed_data.signer_infos.pop() { + Some(si) => si, + None => return Err(ParseError::InvalidNumSignerInfo), + }; + + // No signer infos after taking the only one. + if !signed_data.signer_infos.is_empty() { + return Err(ParseError::InvalidNumSignerInfo); + } + + // `SignerInfo` must have a signed attribute that contains the + // Authenticode digest. This attribute is identified by OID + // 1.2.840.113549.1.9.4. + let signer_info_digest = match signer_info + .get_signed_attr(&rfc5911::ID_MESSAGE_DIGEST) + .map(|value| value.data.as_bytes()) + { + Some(md) => md, + None => return Err(ParseError::MissingAuthenticodeDigest), + }; + + if signer_info.get_signed_attr(&rfc5911::ID_CONTENT_TYPE).is_none() { + return Err(ParseError::MissingContentTypeAuthenticatedAttribute); + } + + // `SignerInfo` can have a signed attribute that contains information + // about the signed program in a `SpcSpOpusInfo` struct. + let opus_info: Option = signer_info + .get_signed_attr(&oid::MS_SPC_OPUS_INFO) + .and_then(|value| value.try_into().ok()); + + let signed_data_raw = signed_data.content_info.content.data; + + // Extract the `SpcIndirectDataContent` structure from `SignedData`. + let indirect_data: SpcIndirectDataContent = + match signed_data.content_info.content.try_into() { + Ok(idc) => idc, + Err(_) => { + return Err(ParseError::InvalidSpcIndirectDataContent) + } + }; + + // Extract all the certificates contained in `SignedData`, more + // certificates from nested signatures and countersignatures will + // be added later to this vector. + let mut certificates: Vec = signed_data.certificates; + + let mut nested_signatures = Vec::new(); + let mut countersignatures = Vec::new(); + + for attr in signer_info.unsigned_attrs.iter() { + match attr.attr_type { + // SignerInfo can have unsigned attributes containing nested + // Authenticode signatures. These attributes are identified by + // OID 1.3.6.1.4.1.311.2.4.1 and their values are `ContentInfo` + // structures. Find those attributes, parse their values, and + // append the resulting signatures to `nested_signatures`. + oid::MS_SPC_NESTED_SIGNATURE => { + for value in &attr.attr_values { + if let Ok(content_info) = value.try_into() { + if let Ok(nested) = Self::parse_content_info( + content_info, + authenticode_hasher, + ) { + nested_signatures.extend(nested); + } + }; + } + } + oid::MS_COUNTERSIGN => { + Self::parse_ms_countersignature_attr( + &signer_info, + attr, + &mut certificates, + &mut countersignatures, + )?; + } + rfc5911::ID_COUNTERSIGNATURE => { + Self::parse_pkcs9_countersignature_attr( + &signer_info, + attr, + &mut certificates, + &mut countersignatures, + )?; + } + _ => {} + } + } + + // Compute the Authenticode hash by ourselves. This hash will be + // compared later with the one included in the PE file. + let computed_authenticode_hash = + match oid_to_object_identifier(signer_info.digest_algorithm.oid()) + { + rfc5912::ID_MD_5 => { + let mut md5 = Md5::default(); + authenticode_hasher.hash(&mut md5); + md5.finalize().to_vec() + } + rfc5912::ID_SHA_1 => { + let mut sha1 = Sha1::default(); + authenticode_hasher.hash(&mut sha1); + sha1.finalize().to_vec() + } + rfc5912::ID_SHA_256 => { + let mut sha256 = Sha256::default(); + authenticode_hasher.hash(&mut sha256); + sha256.finalize().to_vec() + } + rfc5912::ID_SHA_384 => { + let mut sha384 = Sha384::default(); + authenticode_hasher.hash(&mut sha384); + sha384.finalize().to_vec() + } + rfc5912::ID_SHA_512 => { + let mut sha512 = Sha512::default(); + authenticode_hasher.hash(&mut sha512); + sha512.finalize().to_vec() + } + oid => unimplemented!("{:?}", oid), + }; + + let authenticode_digest = indirect_data.message_digest; + + // The Authenticode signature is verified if: + // + // * The hash stored in the Authenticode signature matches the actual + // hash that we computed by ourselves. + // * The content of the `SignedData` structure (which contains the + // authenticode hash) has not been tampered. This is verified by + // comparing the hash of the content with the one stored in the + // signed attribute MESSAGE_DIGEST stored in `SignerInfo`. + // * The `SignerInfo` struct has not been tampered, which is verified + // by `verify_signer_info`. + // + let verified = authenticode_digest.digest + == computed_authenticode_hash.as_slice() + && verify_message_digest( + &signer_info.digest_algorithm, + signed_data_raw, + signer_info_digest, + ) + && verify_signer_info(&signer_info, certificates.as_slice()); + + let mut signatures = Vec::with_capacity(nested_signatures.len() + 1); + + signatures.push(AuthenticodeSignature { + computed_authenticode_hash, + program_name: opus_info.and_then(|oi| oi.program_name), + authenticode_digest, + signer_info, + signer_info_digest, + countersignatures, + certificates, + verified, + }); + + signatures.append(&mut nested_signatures); + + Ok(signatures) + } + + fn parse_ms_countersignature_attr<'a>( + si: &SignerInfo<'a>, + attr: &Attribute<'a>, + certificates: &mut Vec>, + countersignatures: &mut Vec>, + ) -> Result<(), ParseError> { + for value in &attr.attr_values { + let ci: ContentInfo = match value.try_into() { + Ok(ci) => ci, + Err(_) => continue, + }; + + let sd: SignedData = match ci.content.try_into() { + Ok(sd) => sd, + Err(_) => continue, + }; + + certificates.extend(sd.certificates); + + let cs_si = sd.signer_infos.first().unwrap(); + + let mut countersignature = Self::pkcs9_countersignature(cs_si)?; + + let tst = + match TstInfo::from_ber(sd.content_info.content.as_bytes()) { + Ok(tst_info) => tst_info, + Err(_) => continue, + }; + + countersignature.digest_alg = oid_to_str(tst.hash_algorithm.oid()); + countersignature.digest = tst.hashed_message; + + countersignature.verified = + verify_message_digest( + &tst.hash_algorithm, + si.signature, + tst.hashed_message, + ) && verify_signer_info(cs_si, certificates.as_slice()); + + countersignatures.push(countersignature); + } + + Ok(()) + } + + fn parse_pkcs9_countersignature_attr<'a>( + si: &SignerInfo<'a>, + attr: &Attribute<'a>, + certificates: &mut Vec>, + countersignatures: &mut Vec>, + ) -> Result<(), ParseError> { + for value in &attr.attr_values { + if let Ok(cs_si) = value.try_into() { + let mut countersignature = + Self::pkcs9_countersignature(&cs_si)?; + + countersignature.verified = + verify_message_digest( + &cs_si.digest_algorithm, + si.signature, + countersignature.digest, + ) && verify_signer_info(&cs_si, certificates.as_slice()); + + countersignatures.push(countersignature); + } + } + + Ok(()) + } + + fn pkcs9_countersignature<'a>( + si: &SignerInfo<'a>, + ) -> Result, ParseError> { + let mut digest = None; + let mut signing_time = None; + + for attr in &si.signed_attrs { + match attr.attr_type { + rfc6268::ID_MESSAGE_DIGEST => { + digest = attr.attr_values.first().map(|v| v.data); + } + rfc6268::ID_SIGNING_TIME => { + signing_time = attr + .attr_values + .first() + .and_then(|v| v.try_into().ok()) + .and_then(|t: UtcTime| t.utc_adjusted_datetime().ok()) + .map(|t| t.unix_timestamp()); + } + _ => {} + } + } + + let digest = match digest { + Some(digest) => digest, + None => return Err(ParseError::MissingAuthenticodeDigest), + }; + + Ok(AuthenticodeCountersign { + signer: si.serial_number.clone(), + digest_alg: oid_to_str(si.digest_algorithm.oid()), + digest, + signing_time, + verified: false, + }) + } +} + +pub struct AuthenticodeCountersign<'a> { + signer: BigUint, + digest_alg: Cow<'static, str>, + digest: &'a [u8], + signing_time: Option, + verified: bool, +} + +pub struct AuthenticodeSignature<'a> { + signer_info: SignerInfo<'a>, + signer_info_digest: &'a [u8], + authenticode_digest: DigestInfo<'a>, + certificates: Vec>, + countersignatures: Vec>, + program_name: Option, + computed_authenticode_hash: Vec, + verified: bool, +} + +impl<'a> AuthenticodeSignature<'a> { + /// Get the Authenticode hash stored in the PE file. + #[inline] + pub fn stored_authenticode_hash(&self) -> &[u8] { + self.authenticode_digest.digest + } + + /// Get the Authenticode hash computed by ourselves. + #[inline] + pub fn computed_authenticode_hash(&self) -> &[u8] { + self.computed_authenticode_hash.as_slice() + } + + /// Get the name of the Authenticode hash algorithm. + pub fn authenticode_hash_algorithm(&self) -> Cow<'static, str> { + oid_to_str(self.authenticode_digest.algorithm.oid()) + } + + #[inline] + pub fn signer_info_digest_alg(&self) -> Cow<'static, str> { + oid_to_str(self.signer_info.digest_algorithm.oid()) + } + + #[inline] + pub fn signer_info_digest(&self) -> String { + bytes2hex("", self.signer_info_digest.as_bytes()) + } + + #[inline] + pub fn certificates(&self) -> &[Certificate<'a>] { + self.certificates.as_slice() + } + + #[inline] + pub fn chain(&self) -> impl Iterator> { + CertificateChain::new(self.certificates(), |cert| { + cert.tbs_certificate.issuer.eq(self.issuer()) + }) + } + + #[inline] + pub fn countersignatures( + &self, + ) -> impl Iterator> { + self.countersignatures.iter() + } + + pub fn issuer(&self) -> &X509Name<'a> { + &self.signer_info.issuer + } + + /// Returns `true` if the [`AuthenticodeSignature`] is valid. + /// + /// A valid Authenticode signature must comply with the following requisites: + /// + /// * The Authenticode hash included in the file (in the `message_digest` + /// field of [`SpcIndirectDataContent`]) must match the hash computed by + /// ourselves using [`PE::authenticode_hash`]. This ensures that the file + /// has not been modified. + /// + /// * The message digest stored the signed attribute [`rfc6268::ID_MESSAGE_DIGEST`] + /// of [`SignerInfo`], must match the one computed by ourselves by hashing + /// the `econtent` field in [`EncapsulatedContentInfo`]. This ensures that + /// the Authenticode hash included in the file has not been tampered. + /// + /// * The signature in [`SignerInfo`] must be valid. This signature is the + /// result of signing the hash of the DER encoding of the signed + /// attributes in [`SignerInfo`] with the private key of the signing + /// certificate. We compute this hash by ourselves, and then use the + /// public key included in the signing certificate to verify that the + /// signature is valid. This ensures that the signed attributes in + /// [`SignerInfo`], including the message digest has not been tampered. + /// + /// * The certificate that signed the [`SignerInfo`] struct must be valid, + /// which implies that the chain of trust for that certificate must be + /// validated, until we found a self-signed certificate or a certificate + /// that is not included in the PE file. This last certificate is always + /// considered valid. + pub fn verified(&self) -> bool { + self.verified + } +} + +impl From<&AuthenticodeSignature<'_>> for protos::pe::Signature { + fn from(value: &AuthenticodeSignature) -> Self { + let mut sig = protos::pe::Signature::new(); + + sig.set_digest(bytes2hex("", value.stored_authenticode_hash())); + sig.set_digest_alg(value.authenticode_hash_algorithm().into_owned()); + sig.set_file_digest(bytes2hex("", value.computed_authenticode_hash())); + sig.set_verified(value.verified()); + + sig.certificates.extend( + value.certificates().iter().map(protos::pe::Certificate::from), + ); + + for cs in value.countersignatures() { + let mut pbcs = protos::pe::CounterSignature::from(cs); + pbcs.chain = CertificateChain::new(value.certificates(), |cert| { + cert.tbs_certificate.serial == cs.signer + }) + .map(protos::pe::Certificate::from) + .collect(); + sig.countersignatures.push(pbcs); + } + + sig.set_number_of_certificates( + sig.certificates.len().try_into().unwrap(), + ); + + sig.set_number_of_countersignatures( + sig.countersignatures.len().try_into().unwrap(), + ); + + let mut signer_info = protos::pe::SignerInfo::new(); + + signer_info + .set_digest_alg(value.signer_info_digest_alg().into_owned()); + + signer_info.set_digest(value.signer_info_digest()); + + if let Some(program_name) = &value.program_name { + signer_info.set_program_name(program_name.clone()) + } + + signer_info + .chain + .extend(value.chain().map(protos::pe::Certificate::from)); + + sig.signer_info = MessageField::from(Some(signer_info)); + + // Some fields from the first certificate in the chain are replicated + // in the `pe::Signature` structure for backward compatibility. The + // `chain` field in `SignerInfo` didn't exist in previous versions of + // YARA. + if let Some(signer_info) = sig.signer_info.as_ref() { + if let Some(cert) = signer_info.chain.first() { + sig.version = cert.version; + sig.thumbprint = cert.thumbprint.clone(); + sig.issuer = cert.issuer.clone(); + sig.subject = cert.subject.clone(); + sig.serial = cert.serial.clone(); + sig.not_after = cert.not_after; + sig.not_before = cert.not_before; + sig.algorithm = cert.algorithm.clone(); + sig.algorithm_oid = cert.algorithm_oid.clone(); + } + } + + sig + } +} + +impl From<&AuthenticodeCountersign<'_>> for protos::pe::CounterSignature { + fn from(value: &AuthenticodeCountersign<'_>) -> Self { + let mut cs = protos::pe::CounterSignature::new(); + + cs.set_digest(bytes2hex("", value.digest)); + cs.set_digest_alg(value.digest_alg.to_string()); + cs.set_verified(value.verified); + cs.sign_time = value.signing_time; + + cs + } +} + +impl From<&Certificate<'_>> for protos::pe::Certificate { + fn from(value: &Certificate) -> Self { + let mut cert = protos::pe::Certificate::new(); + + // Versions are 0-based, add 1 for getting the actual version. + cert.set_version(value.x509.tbs_certificate.version.0 as i64 + 1); + cert.set_issuer(format_name(&value.x509.tbs_certificate.issuer)); + cert.set_subject(format_name(&value.x509.tbs_certificate.subject)); + cert.set_serial(value.x509.raw_serial_as_string()); + + cert.set_algorithm_oid(format!( + "{}", + value.x509.signature_algorithm.algorithm + )); + + cert.set_algorithm( + oid_to_str(&value.x509.signature_algorithm.algorithm).into_owned(), + ); + + cert.set_thumbprint(value.thumbprint.clone()); + + cert.set_not_before( + value.x509.tbs_certificate.validity.not_before.timestamp(), + ); + + cert.set_not_after( + value.x509.tbs_certificate.validity.not_after.timestamp(), + ); + + cert + } +} + +/// Produces a printable string for a x509 name. +/// +/// The [`X509Name`] type implements the [`std::fmt::Display`] trait, but the +/// resulting string follows the [RFC 4514], resulting in something like: +/// +/// ```text +/// CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA +/// ``` +/// +/// However, the format traditionally used by YARA is inherited from OpenSSL +/// and looks like: +/// +/// ```text +/// /C=ZA/ST=Western Cape/L=Durbanville/O=Thawte/OU=Thawte Certification/CN=Thawte Timestamping CA +/// ``` +/// +/// [RFC 4514]: https://datatracker.ietf.org/doc/html/rfc4514 +fn format_name(name: &X509Name) -> String { + let mut n = String::new(); + for rdn in name.iter_rdn() { + write!(n, "/").unwrap(); + for atv in rdn.iter() { + let key = oid_to_str(atv.attr_type()); + let attr_val = atv.attr_value(); + // Not using `atv.as_str()` because it doesn't take into account + // the `Tag::TeletexString` case. + let val = match attr_val.tag() { + Tag::PrintableString => { + attr_val.as_printablestring().ok().map(|s| s.string()) + } + Tag::Utf8String => { + attr_val.as_utf8string().ok().map(|s| s.string()) + } + Tag::Ia5String => { + attr_val.as_ia5string().ok().map(|s| s.string()) + } + Tag::TeletexString => { + attr_val.as_teletexstring().ok().map(|s| s.string()) + } + _ => None, + }; + match (key, val) { + (key, Some(val)) => { + write!(n, "{}=", key).unwrap(); + for char in val.chars() { + n.write_char(char).unwrap(); + } + } + (key, None) => { + write!(n, "{}=#", key).unwrap(); + for c in attr_val.data { + write!(n, "{:02x}", c).unwrap(); + } + } + } + } + } + + n +} + +/// Given a hashing algorithm and a message, compute the message's hash +/// and compare it with `digest`. The function returns `true` if they match. +fn verify_message_digest( + algorithm: &AlgorithmIdentifier, + message: &[u8], + digest: &[u8], +) -> bool { + match oid_to_object_identifier(algorithm.oid()) { + rfc5912::ID_SHA_1 => Sha1::digest(message).as_slice() == digest, + rfc5912::ID_SHA_256 => Sha256::digest(message).as_slice() == digest, + rfc5912::ID_SHA_384 => Sha384::digest(message).as_slice() == digest, + rfc5912::ID_SHA_512 => Sha512::digest(message).as_slice() == digest, + rfc5912::ID_MD_5 => Md5::digest(message).as_slice() == digest, + _ => unimplemented!("{:?}", algorithm.oid()), + } +} + +/// Verifies that the [`SignerInfo`] struct is valid. +/// +/// `SignerInfo` contains information about the signer of some data stored in +/// the content field of a [`SignedData`] structure. This information is stored +/// in signed and unsigned attributes of `SignerInfo`. Signed attributes are +/// protected from tampering by a digital signature, which is computed by +/// hashing the attributes first, and then signing the hash. The resulting +/// signature is added `SignerInfo` itself. This signature can be verified by +/// using the public key included in the certificate identified by +/// [`SignerInfo::serial_number`]. +/// +/// This function makes sure that: +/// +/// * The signature of `SignerInfo` is correct. +/// * The certificate that produced the signature for `SignerInfo` is also +/// correct. +/// +/// The verification of the certificate includes the verification of the whole +/// certificate chain, until reaching a self-signed certificate or some +/// certificate that was signed by an "external" one (a certificate that is not +/// included in the PE). +fn verify_signer_info(si: &SignerInfo, certs: &[Certificate<'_>]) -> bool { + // Get a certificate chain that starts with the certificate that signed + // the data that this SignerInfo refers to. This chain goes from the + // signing certificate up in the chain of truth until a self-signed + // certificate or some "external" certificate. + let cert_chain = CertificateChain::new(certs, |cert| { + cert.tbs_certificate.serial.eq(&si.serial_number) + }); + + // Make sure that whole certificate chain is valid. + if !cert_chain.verify() { + return false; + } + + // Search for the certificate that signed the digest. + let signing_cert = match certs + .iter() + .map(|cert| &cert.x509) + .find(|cert| cert.tbs_certificate.serial.eq(&si.serial_number)) + { + Some(cert) => cert, + None => return false, + }; + + // Obtain the public key included in the certificate. + let spki = &signing_cert.tbs_certificate.subject_pki; + let key = match PublicKey::try_from(spki) { + Ok(key) => key, + Err(_) => return false, + }; + + // We need to compute the hash for the signed attributes. This is a hash of + // the DER encoding of the attributes, however, the computation of the hash + // is not straightforward. One may think that the hash can be computed over + // the bytes in the PE file that correspond to the DER encoding of the + // attributes, but that's not the case. In fact, the PE file doesn't + // contain the exact byte sequence that must be hashed. + // + // This is the ASN.1 definition for the signed attributes: + // + // SignedAttributes ::= SET SIZE (1..MAX) OF Attribute + // + // Normally, the raw bytes of an ASN.1 `SET` start with 0x31 (the tag + // associated to sets), followed by the set size, and the set contents. + // The raw bytes would be `0x31 [size] [content]`. But ASN.1 encoding is + // context-sensitive, which means that the 0x31 tag can be missing if + // SignedAttributes is used in a parent structure using implicit + // tagging, for instance: + // + // signedAttrs `[0]` IMPLICIT SignedAttributes OPTIONAL, + // + // Within the SignerInfo structure, the tag 0 identifies the signedAttrs + // field, when this tag is found, the ASN.1 parser already knows that + // a SignedAttributes follows, and it already knows that it's a SET, + // therefore the 0x31 is not necessary. The raw bytes are: + // + // 0xA0 [size] [content] + // + // `0xA0` is the raw encoding for `[0]`. + // + // In resume, the PE file has: + // + // 0xA0 [size] [content] + // + // But the hash is computed for: + // + // 0x31 [size] [content] + // + let attrs_set = Set::new(Cow::Borrowed(si.raw_signed_attrs)); + + // Verify that the signature in `SignerInfo` is correct. + match oid_to_object_identifier(si.digest_algorithm.oid()) { + rfc5912::ID_MD_5 => { + let mut md5 = Md5::default(); + attrs_set.write_der(&mut md5).unwrap(); + key.verify_digest::(md5.finalize(), si.signature) + } + rfc5912::ID_SHA_1 => { + let mut sha1 = Sha1::default(); + attrs_set.write_der(&mut sha1).unwrap(); + key.verify_digest::(sha1.finalize(), si.signature) + } + rfc5912::ID_SHA_256 => { + let mut sha256 = Sha256::default(); + attrs_set.write_der(&mut sha256).unwrap(); + key.verify_digest::(sha256.finalize(), si.signature) + } + rfc5912::ID_SHA_384 => { + let mut sha384 = Sha384::default(); + attrs_set.write_der(&mut sha384).unwrap(); + key.verify_digest::(sha384.finalize(), si.signature) + } + rfc5912::ID_SHA_512 => { + let mut sha512 = Sha512::default(); + attrs_set.write_der(&mut sha512).unwrap(); + key.verify_digest::(sha512.finalize(), si.signature) + } + + oid => unimplemented!("{:?}", oid), + } +} + +/// Represents a certificate chain. +/// +/// A certificate chain starts with an initial certificate, and contains the +/// certificate that signed the initial certificate, the certificate that +/// signed the signer, and so on, until finding a self-signed certificate, or +/// a certificate that is signed by some external certificate that is not +/// contained in the PE file. +struct CertificateChain<'a, 'b> { + certs: &'b [Certificate<'a>], + next: Option<&'b Certificate<'a>>, +} + +impl<'a, 'b> CertificateChain<'a, 'b> { + /// Creates a new certificate chain. + /// + /// This function receives a pool of certificates in the `certs` arguments, + /// and a `predicate` that identifies the initial certificate in the chain. + /// The initial certificate will be the first certificate in the pool that + /// matches the predicate. + pub fn new

(certs: &'b [Certificate<'a>], predicate: P) -> Self + where + P: Fn(&X509Certificate<'_>) -> bool, + { + let next = certs.iter().find(|cert| predicate(&cert.x509)); + Self { certs, next } + } + + /// Returns `true` if the certificate chain is valid. + /// + /// A certificate is considered valid if it is correctly signed by a parent + /// certificate that is included in the PE file, and the parent certificate + /// is also valid. The validation process goes up the chain of trust until + /// finding a self-signed certificate or a certificate that is signed by + /// some other certificate that is not included in the PE. + /// + /// When the last certificate in the chain is one that is signed by an + /// external certificate (not included in the PE) no attempt is made to + /// continue the validation by retrieving the external certificate from the + /// operating system certificate store. + pub fn verify(self) -> bool { + // Iterate over the chain taking a certificate and its signer on each + // iteration. + for (signed, signer) in self.tuple_windows() { + // When `x509-parser-verify` feature verify certificate signatures + // using the `x509_parser` crate. + #[cfg(feature = "x509-parser-verify")] + { + if x509_parser::verify::verify_signature( + &signer.x509.subject_pki, + &signed.x509.signature_algorithm, + &signed.x509.signature_value, + signed.x509.tbs_certificate.as_ref(), + ) + .is_err() + { + return false; + } + } + + // When `x509-parser-verify` feature is not enabled, use our + // own logic. + #[cfg(not(feature = "x509-parser-verify"))] + { + let key = match PublicKey::try_from( + &signer.x509.tbs_certificate.subject_pki, + ) { + Ok(key) => key, + Err(_) => return false, + }; + + if !key.verify( + &signed.x509.signature_algorithm, + signed.x509.tbs_certificate.as_ref(), + signed.x509.signature_value.as_ref(), + ) { + return false; + } + } + } + + true + } +} + +impl<'a, 'b> Iterator for CertificateChain<'a, 'b> { + type Item = &'b Certificate<'a>; + + fn next(&mut self) -> Option { + let next = self.next; + if let Some(next) = self.next { + // When the certificate is self-signed issuer == subject, in that + // case we can't keep going up the chain. + if next.x509.tbs_certificate.subject + == next.x509.tbs_certificate.issuer + { + self.next = None + } else { + self.next = self.certs.iter().find(|c| { + c.x509.tbs_certificate.subject + == next.x509.tbs_certificate.issuer + }); + } + } + next + } +} + +/// Represents public key found in certificate. +enum PublicKey { + Rsa(rsa::RsaPublicKey), + Dsa(dsa::VerifyingKey), + EcdsaP256(p256::ecdsa::VerifyingKey), + EcdsaP384(p384::ecdsa::VerifyingKey), +} + +#[derive(Error, Debug)] +enum PublicKeyError { + #[error("PKCS1 error")] + Pkcs1(#[from] rsa::pkcs1::Error), + + #[error("PKCS8 error")] + Pkcs8(#[from] rsa::pkcs8::spki::Error), + + #[error("DER parsing error")] + Der(#[from] der_parser::error::Error), + + #[error("ECDSA error")] + Ecdsa(#[from] ecdsa::Error), + + #[error("DER parsing error")] + Nom(#[from] nom::Err), + + #[error("Missing algorithm parameters")] + MissingAlgorithmParameters, + + #[error("Unknown ECDSA curve")] + UnknownEcdsaCurve(ObjectIdentifier), + + #[error("Unknown encryption algorithm")] + UnknownAlgorithm(ObjectIdentifier), +} + +impl TryFrom<&SubjectPublicKeyInfo<'_>> for PublicKey { + type Error = PublicKeyError; + + fn try_from(spki: &SubjectPublicKeyInfo<'_>) -> Result { + match oid_to_object_identifier(spki.algorithm.oid()) { + rfc5912::RSA_ENCRYPTION => { + use rsa::pkcs1::DecodeRsaPublicKey; + Ok(Self::Rsa(rsa::RsaPublicKey::from_pkcs1_der( + spki.subject_public_key.as_ref(), + )?)) + } + rfc5912::ID_DSA => { + let parameters = spki + .algorithm + .parameters + .as_ref() + .ok_or(Self::Error::MissingAlgorithmParameters)?; + + let key_bytes = spki.subject_public_key.as_ref(); + + use der_parser::ber::parse_ber_integer; + let (_, y) = parse_ber_integer(key_bytes)?; + let (rem, p) = parse_ber_integer(parameters.data)?; + let (rem, q) = parse_ber_integer(rem)?; + let (_, g) = parse_ber_integer(rem)?; + + let p = dsa::BigUint::from_bytes_be(p.content.as_slice()?); + let q = dsa::BigUint::from_bytes_be(q.content.as_slice()?); + let g = dsa::BigUint::from_bytes_be(g.content.as_slice()?); + let y = dsa::BigUint::from_bytes_be(y.content.as_slice()?); + + let components = Components::from_components(p, q, g)?; + let key = dsa::VerifyingKey::from_components(components, y)?; + + Ok(Self::Dsa(key)) + } + rfc5912::ID_EC_PUBLIC_KEY => { + let curve: der_parser::asn1_rs::Oid = spki + .algorithm + .parameters + .as_ref() + .ok_or(Self::Error::MissingAlgorithmParameters)? + .try_into()?; + + match oid_to_object_identifier(&curve) { + rfc5912::SECP_256_R_1 => Ok(Self::EcdsaP256( + p256::ecdsa::VerifyingKey::try_from( + spki.subject_public_key.as_ref(), + )?, + )), + rfc5912::SECP_384_R_1 => Ok(Self::EcdsaP384( + p384::ecdsa::VerifyingKey::try_from( + spki.subject_public_key.as_ref(), + )?, + )), + oid => Err(Self::Error::UnknownEcdsaCurve(oid)), + } + } + oid => Err(Self::Error::UnknownAlgorithm(oid)), + } + } +} + +impl PublicKey { + #[cfg(not(feature = "x509-parser-verify"))] + fn verify( + &self, + digest_algorithm: &AlgorithmIdentifier, + message: &[u8], + signature: &[u8], + ) -> bool { + match oid_to_object_identifier(digest_algorithm.oid()) { + rfc5912::ID_MD_5 | rfc5912::MD_5_WITH_RSA_ENCRYPTION => { + self.verify_impl::(message, signature) + } + rfc5912::ID_SHA_1 + | rfc5912::DSA_WITH_SHA_1 + | rfc5912::SHA_1_WITH_RSA_ENCRYPTION + | oid::SHA1_WITH_RSA_ENCRYPTION_OBSOLETE => { + self.verify_impl::(message, signature) + } + rfc5912::ID_SHA_256 + | rfc5912::SHA_256_WITH_RSA_ENCRYPTION + | rfc5912::DSA_WITH_SHA_256 + | rfc5912::ECDSA_WITH_SHA_256 => { + self.verify_impl::(message, signature) + } + rfc5912::ID_SHA_384 + | rfc5912::SHA_384_WITH_RSA_ENCRYPTION + | rfc5912::ECDSA_WITH_SHA_384 => { + self.verify_impl::(message, signature) + } + rfc5912::ID_SHA_512 + | rfc5912::SHA_512_WITH_RSA_ENCRYPTION + | rfc5912::ECDSA_WITH_SHA_512 => { + self.verify_impl::(message, signature) + } + _ => unimplemented!("{:?}", digest_algorithm.oid()), + } + } + + #[cfg(not(feature = "x509-parser-verify"))] + fn verify_impl( + &self, + message: &[u8], + signature: &[u8], + ) -> bool { + let digest = D::digest(message); + self.verify_digest::(digest, signature) + } + + fn verify_digest( + &self, + hash: Output, + signature: &[u8], + ) -> bool { + match self { + Self::Rsa(key) => { + if Pkcs1v15Sign::new::() + .verify(key, hash.as_slice(), signature) + .is_ok() + { + return true; + } + Pkcs1v15Sign::new_unprefixed() + .verify(key, hash.as_slice(), signature) + .is_ok() + } + Self::Dsa(key) => { + use dsa::pkcs8::der::Decode; + dsa::Signature::from_der(signature).is_ok_and(|s| { + key.verify_prehash(hash.as_slice(), &s).is_ok() + }) + } + Self::EcdsaP256(key) => ecdsa::Signature::from_der(signature) + .is_ok_and(|s| { + key.verify_prehash(hash.as_slice(), &s).is_ok() + }), + Self::EcdsaP384(key) => ecdsa::Signature::from_der(signature) + .is_ok_and(|s| { + key.verify_prehash(hash.as_slice(), &s).is_ok() + }), + } + } +} diff --git a/lib/src/modules/pe/mod.rs b/lib/src/modules/pe/mod.rs index 183b5a5c0..52b19fec5 100644 --- a/lib/src/modules/pe/mod.rs +++ b/lib/src/modules/pe/mod.rs @@ -8,6 +8,7 @@ use std::rc::Rc; use std::slice::Iter; use bstr::BStr; +use digest::Digest; use itertools::Itertools; use nom::branch::alt; use nom::character::complete::u8; @@ -22,6 +23,8 @@ use crate::types::Struct; #[cfg(test)] mod tests; +mod asn1; +mod authenticode; pub mod parser; mod rva2off; @@ -211,7 +214,7 @@ fn imphash(ctx: &mut ScanContext) -> Option { return None; } - let mut md5_hash = md5::Context::new(); + let mut md5_hash = md5::Md5::default(); let mut first = true; for import in &pe.import_details { @@ -224,16 +227,19 @@ fn imphash(ctx: &mut ScanContext) -> Option { } for func in &import.functions { if !first { - md5_hash.consume(","); + Digest::update(&mut md5_hash, ",".as_bytes()) } - md5_hash.consume(dll_name); - md5_hash.consume("."); - md5_hash.consume(func.name.as_deref().unwrap().to_lowercase()); + Digest::update(&mut md5_hash, dll_name); + Digest::update(&mut md5_hash, ".".as_bytes()); + Digest::update( + &mut md5_hash, + func.name.as_deref().unwrap().to_lowercase().as_bytes(), + ); first = false; } } - let digest = format!("{:x}", md5_hash.compute()); + let digest = format!("{:x}", md5_hash.finalize()); Some(RuntimeString::new(digest)) } diff --git a/lib/src/modules/pe/parser.rs b/lib/src/modules/pe/parser.rs index 3409207af..d972b50b6 100644 --- a/lib/src/modules/pe/parser.rs +++ b/lib/src/modules/pe/parser.rs @@ -3,27 +3,29 @@ use std::cmp::min; use std::collections::{HashMap, VecDeque}; use std::default::Default; use std::iter::zip; +use std::mem; use std::str::{from_utf8, FromStr}; use std::sync::OnceLock; -use array_bytes::bytes2hex; -use authenticode_parser::{ - Authenticode, AuthenticodeArray, AuthenticodeVerify, - CounterSignatureVerify, -}; use bstr::{BStr, ByteSlice}; +use digest; use itertools::Itertools; use memchr::memmem; use nom::branch::{alt, permutation}; use nom::bytes::complete::{take, take_till}; use nom::combinator::{cond, consumed, iterator, map, opt, success, verify}; use nom::error::ErrorKind; -use nom::multi::{count, fold_many1, length_data, many0, many1, many_m_n}; +use nom::multi::{ + count, fold_many0, fold_many1, length_data, many0, many1, many_m_n, +}; use nom::number::complete::{le_u16, le_u32, le_u64, u8}; use nom::sequence::tuple; use nom::{Err, IResult, Parser, ToUsize}; use protobuf::{EnumOrUnknown, MessageField}; +use crate::modules::pe::authenticode::{ + AuthenticodeHasher, AuthenticodeParser, AuthenticodeSignature, +}; use crate::modules::pe::rva2off; use crate::modules::protos; @@ -33,12 +35,6 @@ type Error<'a> = nom::error::Error<&'a [u8]>; /// that DLL. type DllImports<'a> = Vec<(&'a str, Vec)>; -/// The initialization token needed by the authenticode_parser library must be -/// created only once per process, and it must be done in a thread-safe way. -static AUTHENTICODE_INIT_TOKEN: OnceLock< - authenticode_parser::InitializationToken, -> = OnceLock::new(); - /// Represents a Windows Portable Executable (PE) file. /// /// New instances of this type are created by parsing the content of a PE @@ -75,7 +71,7 @@ pub struct PE<'a> { resources: OnceCell>)>>, /// PE authenticode signatures. - signatures: OnceCell>, + signatures: OnceCell>>>, /// PE directory entries. Directory entries are parsed lazily when /// [`PE::get_dir_entries`] is called for the first time. @@ -107,6 +103,96 @@ pub struct PE<'a> { pub optional_hdr: OptionalHeader, } +impl AuthenticodeHasher for PE<'_> { + /// Compute an Authenticode hash for this PE file. + /// + /// The Authenticode covers all the data in the PE file except: + /// + /// * The checksum in the PE header + /// * The security entry in the data directory (which points to the certificate table) + /// * The certificate table. + /// + /// The algorithm is described in [1] and [2]. + /// + /// [1]: https://learn.microsoft.com/en-us/windows/win32/debug/pe-format#process-for-generating-the-authenticode-pe-image-hash + /// [2]: https://download.microsoft.com/download/9/c/5/9c5b2167-8017-4bae-9fde-d599bac8184a/authenticode_pe.docx + fn hash(&self, digest: &mut dyn digest::Update) -> Option<()> { + // Offset within the PE file where the checksum field is located. The + // checksum is skipped while computing the digest. + let checksum_offset = self.dos_stub.len() + + Self::SIZE_OF_PE_SIGNATURE + + Self::SIZE_OF_FILE_HEADER + + 64_usize; + + // Offset of the security entry in the data directory. This entry is skipped + // while computing the digest. + let security_data_offset = self.dos_stub.len() + + Self::SIZE_OF_PE_SIGNATURE + + Self::SIZE_OF_FILE_HEADER + + if self.optional_hdr.magic == Self::IMAGE_NT_OPTIONAL_HDR32_MAGIC + { + Self::SIZE_OF_OPT_HEADER_32 + } else { + Self::SIZE_OF_OPT_HEADER_64 + } + + Self::SIZE_OF_DIR_ENTRY * Self::IMAGE_DIRECTORY_ENTRY_SECURITY; + + let (_, cert_table_size, _) = self + .get_dir_entry_data(Self::IMAGE_DIRECTORY_ENTRY_SECURITY, true)?; + + // Hash from start of the file to the checksum. + digest.update(self.data.get(0..checksum_offset)?); + + // Hash from the end of the checksum to the start of the security entry + // in the data directory. + digest.update(self.data.get( + checksum_offset + mem::size_of::()..security_data_offset, + )?); + + // Hash from the end of the security entry in the data directory to the + // end of the PE header. + digest.update(self.data.get( + security_data_offset + Self::SIZE_OF_DIR_ENTRY + ..self.optional_hdr.size_of_headers as usize, + )?); + + // Sections must be sorted by `raw_data_offset`. + let sections = self + .sections + .iter() + .sorted_unstable_by_key(|section| section.raw_data_offset); + + let mut sum_of_bytes_hashed = + self.optional_hdr.size_of_headers as usize; + + // Hash each section's data. + for section in sections { + let section_start = section.raw_data_offset as usize; + let section_size = section.raw_data_size as usize; + let section_end = section_start.saturating_add(section_size); + let section_bytes = self.data.get(section_start..section_end)?; + + digest.update(section_bytes); + + sum_of_bytes_hashed = + sum_of_bytes_hashed.checked_add(section_size)?; + } + + let extra_hash_len = self + .data + .len() + .checked_sub(cert_table_size as usize)? + .checked_sub(sum_of_bytes_hashed)?; + + digest.update(self.data.get( + sum_of_bytes_hashed + ..sum_of_bytes_hashed.checked_add(extra_hash_len)?, + )?); + + Some(()) + } +} + impl<'a> PE<'a> { /// Given the content of PE file, parses it and returns a [`PE`] object /// representing the file. @@ -311,7 +397,7 @@ impl<'a> PE<'a> { /// Returns the RVA, size and data associated to a given directory entry. /// - /// The returned tuple is `(rva, size, data)`, where `rva` and `size` are + /// The returned tuple is `(addr, size, data)`, where `addr` and `size` are /// the ones indicated in the directory entry, and `data` is a slice that /// contains the file's content from that RVA to the end of the file if /// `strict_size` is false. Otherwise, the slice will be limited to the @@ -335,22 +421,28 @@ impl<'a> PE<'a> { // overly strict here and only parse entries which are less than // `number_of_rva_and_sizes` we run the risk of missing otherwise // perfectly valid files. - let dir_entry = self .directory .get(index * Self::SIZE_OF_DIR_ENTRY..) .and_then(|entry| Self::parse_dir_entry(entry).ok()) .map(|(_reminder, entry)| entry)?; - let start = self.rva_to_offset(dir_entry.addr)? as usize; + // The IMAGE_DIRECTORY_ENTRY_SECURITY is the only one where the `addr` + // field is not an RVA, but a file offset, so we don't need to convert + // it to offset. + let start = if index == Self::IMAGE_DIRECTORY_ENTRY_SECURITY { + dir_entry.addr + } else { + self.rva_to_offset(dir_entry.addr)? + }; let end = if strict_size { - min(self.data.len(), start.saturating_add(dir_entry.size as usize)) + min(self.data.len(), start.saturating_add(dir_entry.size) as usize) } else { self.data.len() }; - let data = self.data.get(start..end)?; + let data = self.data.get(start as usize..end)?; Some((dir_entry.addr, dir_entry.size, data)) } @@ -397,14 +489,12 @@ impl<'a> PE<'a> { } /// Returns the authenticode signatures in this PE. - pub fn get_signatures(&self) -> &[Authenticode<'_>] { - if let Some(array) = - self.signatures.get_or_init(|| self.parse_signatures()) - { - array.signatures() - } else { - &[] - } + pub fn get_signatures(&self) -> &[AuthenticodeSignature<'a>] { + self.signatures + .get_or_init(|| self.parse_signatures()) + .as_ref() + .map(|s| s.as_slice()) + .unwrap_or(&[]) } } @@ -415,6 +505,7 @@ impl<'a> PE<'a> { pub const IMAGE_DIRECTORY_ENTRY_EXPORT: usize = 0; pub const IMAGE_DIRECTORY_ENTRY_IMPORT: usize = 1; pub const IMAGE_DIRECTORY_ENTRY_RESOURCE: usize = 2; + pub const IMAGE_DIRECTORY_ENTRY_SECURITY: usize = 4; pub const IMAGE_DIRECTORY_ENTRY_DEBUG: usize = 6; pub const IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT: usize = 13; pub const IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR: usize = 14; @@ -424,8 +515,20 @@ impl<'a> PE<'a> { const RICH_TAG: &'static [u8] = &[0x52_u8, 0x69, 0x63, 0x68]; const DANS_TAG: u32 = 0x536e6144; - const SIZE_OF_PE_SIGNATURE: usize = 4; // size of PE signature (PE\0\0). - const SIZE_OF_FILE_HEADER: usize = 20; // size of IMAGE_FILE_HEADER + // size of PE signature (PE\0\0). + const SIZE_OF_PE_SIGNATURE: usize = 4; + + // size of IMAGE_FILE_HEADER + const SIZE_OF_FILE_HEADER: usize = 20; + + // size of IMAGE_OPTIONAL_HEADER for 32-bit files. + // Without data directory entries. + const SIZE_OF_OPT_HEADER_32: usize = 96; + + // size of IMAGE_OPTIONAL_HEADER for 64-bit files. + // Without data directory entries. + const SIZE_OF_OPT_HEADER_64: usize = 112; + const SIZE_OF_DIR_ENTRY: usize = 8; const SIZE_OF_SYMBOL: u32 = 18; @@ -1153,7 +1256,7 @@ impl<'a> PE<'a> { // Read the structure's length and round it up to a 32-bits // boundary. let (_, length) = le_u16(input)?; - let length = Self::round_up(length); + let length = Self::round_up::<4, _>(length); // Read the structure's bytes. let (remainder, structure) = take(length)(input)?; @@ -1171,7 +1274,7 @@ impl<'a> PE<'a> { // aligning the rest of the structure to a 32-bits boundary. // Here we get the length of the data consumed so far and round // it up to a 32-bits boundary. - let alignment = Self::round_up(consumed.len()); + let alignment = Self::round_up::<4, _>(consumed.len()); // Then take `alignment` bytes from the start of the structure. The // remaining bytes contain the value and children. @@ -1225,9 +1328,9 @@ impl<'a> PE<'a> { } } - /// Round up an offset to the next 32-bit boundary. - fn round_up(offset: O) -> usize { - offset.to_usize().div_ceil(4) * 4 + /// Round up a `value` to the `ROUND_TO` byte boundary. + fn round_up(value: O) -> usize { + value.to_usize().div_ceil(ROUND_TO) * ROUND_TO } /// Parses the PE resources. @@ -1371,11 +1474,67 @@ impl<'a> PE<'a> { Some((resources_info, resources)) } - fn parse_signatures(&self) -> Option { - let token = AUTHENTICODE_INIT_TOKEN.get_or_init(|| unsafe { - authenticode_parser::InitializationToken::new() - }); - authenticode_parser::parse_pe(token, self.data) + /// Parses the PE Authenticode signatures. + fn parse_signatures(&self) -> Option>> { + let (_, _, cert_table) = self + .get_dir_entry_data(Self::IMAGE_DIRECTORY_ENTRY_SECURITY, true)?; + + // The certificate table is an array of WIN_CERTIFICATE structures. + let signatures = fold_many0( + self.win_cert_parser(), + Vec::new, + |mut acc: Vec<_>, signatures| { + acc.extend(signatures); + acc + }, + )(cert_table) + .map(|(_, cert)| cert) + .ok()?; + + Some(signatures) + } + + /// Returns a parser that parses a WIN_CERTIFICATE structure. + fn win_cert_parser( + &self, + ) -> impl FnMut(&'a [u8]) -> IResult<&'a [u8], Vec> + '_ + { + move |input: &'a [u8]| { + // Parse the WIN_CERTIFICATE structure. + let (remainder, (length, _revision, _cert_type)) = + tuple(( + le_u32::<&[u8], Error>, // length + le_u16, // revision, should be WIN_CERT_REVISION_1_0 (0x0100) + le_u16, // certificate type + ))(input)?; + + // The length includes the header, compute the length of the signature. + let signature_length: u32 = + length.checked_sub(8).ok_or_else(|| { + Err::Error(Error::new(input, ErrorKind::Fail)) + })?; + + let (_, signature_data) = take(signature_length)(remainder)?; + let (_, signatures) = self.signature_parser()(signature_data)?; + + // The next WIN_CERTIFICATE is aligned to the next 8-bytes boundary. + let (remainder, _) = take(Self::round_up::<8, _>(length))(input)?; + + Ok((remainder, signatures)) + } + } + + /// Returns a parser that parses the PKCS#7 blob that containing an + /// Authenticode signature. + fn signature_parser( + &self, + ) -> impl FnMut(&'a [u8]) -> IResult<&'a [u8], Vec> + '_ + { + move |input: &'a [u8]| { + let signatures = AuthenticodeParser::parse(input, self) + .map_err(|_| Err::Error(Error::new(input, ErrorKind::Fail)))?; + Ok((&[], signatures)) + } } fn parse_dir_entries(&self) -> Option> { @@ -1531,10 +1690,10 @@ impl<'a> PE<'a> { /// Parses PE imports. fn parse_imports(&self) -> Option)>> { - let (rva, _, import_data) = self + let (addr, _, import_data) = self .get_dir_entry_data(Self::IMAGE_DIRECTORY_ENTRY_IMPORT, false)?; - if rva == 0 { + if addr == 0 { return None; } @@ -1545,12 +1704,12 @@ impl<'a> PE<'a> { fn parse_delayed_imports( &self, ) -> Option)>> { - let (rva, _, import_data) = self.get_dir_entry_data( + let (addr, _, import_data) = self.get_dir_entry_data( Self::IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT, true, )?; - if rva == 0 { + if addr == 0 { return None; } @@ -2351,150 +2510,6 @@ impl From<&Section<'_>> for protos::pe::Section { } } -impl From<&authenticode_parser::Authenticode<'_>> for protos::pe::Signature { - fn from(value: &authenticode_parser::Authenticode) -> Self { - let mut sig = protos::pe::Signature::new(); - - sig.digest = value.digest().map(|v| bytes2hex("", v)); - sig.digest_alg = value - .digest_alg() - .and_then(|v| String::from_utf8(v.to_vec()).ok()); - - sig.file_digest = value.file_digest().map(|v| bytes2hex("", v)); - - sig.certificates - .extend(value.certs().iter().map(protos::pe::Certificate::from)); - - sig.countersignatures.extend( - value.countersigs().iter().map(protos::pe::CounterSignature::from), - ); - - sig.signer_info = MessageField::from_option( - value.signer().map(protos::pe::SignerInfo::from), - ); - - sig.set_number_of_certificates( - sig.certificates.len().try_into().unwrap(), - ); - - sig.set_number_of_countersignatures( - sig.countersignatures.len().try_into().unwrap(), - ); - - sig.set_verified( - value - .verify_flags() - .is_some_and(|flags| flags == AuthenticodeVerify::Valid), - ); - - // Some fields from the first certificate in the chain are replicated - // in the `pe::Signature` structure for backward compatibility. The - // `chain` field in `SignerInfo` didn't exist in previous versions of - // YARA. - if let Some(signer_info) = sig.signer_info.as_ref() { - if let Some(cert) = signer_info.chain.first() { - sig.version = cert.version; - sig.thumbprint = cert.thumbprint.clone(); - sig.issuer = cert.issuer.clone(); - sig.subject = cert.subject.clone(); - sig.serial = cert.serial.clone(); - sig.not_after = cert.not_after; - sig.not_before = cert.not_before; - sig.algorithm = cert.algorithm.clone(); - sig.algorithm_oid = cert.algorithm_oid.clone(); - } - } - - sig - } -} - -impl From> for protos::pe::SignerInfo { - fn from(value: authenticode_parser::Signer) -> Self { - let mut signer_info = protos::pe::SignerInfo::new(); - - signer_info.digest = value.digest().map(|v| bytes2hex("", v)); - signer_info.digest_alg = value - .digest_alg() - .and_then(|v| String::from_utf8(v.to_vec()).ok()); - - signer_info.program_name = value - .program_name() - .and_then(|v| String::from_utf8(v.to_vec()).ok()); - - signer_info.chain.extend( - value - .certificate_chain() - .iter() - .map(protos::pe::Certificate::from), - ); - - signer_info - } -} - -impl From<&authenticode_parser::Countersignature<'_>> - for protos::pe::CounterSignature -{ - fn from(value: &authenticode_parser::Countersignature) -> Self { - let mut cs = protos::pe::CounterSignature::new(); - - cs.digest = value.digest().map(|v| bytes2hex("", v)); - cs.digest_alg = value - .digest_alg() - .and_then(|v| String::from_utf8(v.to_vec()).ok()); - - cs.set_verified( - value - .verify_flags() - .is_some_and(|flags| flags == CounterSignatureVerify::Valid), - ); - - cs.set_sign_time(value.sign_time()); - - cs.chain.extend( - value - .certificate_chain() - .iter() - .map(protos::pe::Certificate::from), - ); - - cs - } -} - -impl From<&authenticode_parser::Certificate<'_>> for protos::pe::Certificate { - fn from(value: &authenticode_parser::Certificate) -> Self { - let mut cert = protos::pe::Certificate::new(); - - // Versions are 0-based, add 1 for getting the actual version. - cert.set_version(value.version() + 1); - - cert.issuer = - value.issuer().and_then(|v| String::from_utf8(v.to_vec()).ok()); - - cert.subject = - value.subject().and_then(|v| String::from_utf8(v.to_vec()).ok()); - - cert.serial = - value.serial().and_then(|v| String::from_utf8(v.to_vec()).ok()); - - cert.algorithm = - value.sig_alg().and_then(|v| String::from_utf8(v.to_vec()).ok()); - - cert.algorithm_oid = value - .sig_alg_oid() - .and_then(|v| String::from_utf8(v.to_vec()).ok()); - - cert.thumbprint = value.sha1().map(|v| bytes2hex("", v)); - - cert.set_not_before(value.not_before()); - cert.set_not_after(value.not_after()); - - cert - } -} - impl rva2off::Section for Section<'_> { fn virtual_address(&self) -> u32 { self.virtual_address diff --git a/lib/src/modules/pe/tests/testdata/00a1067fc96eb2c1d440bb5b44b32f43b9900fdd3a65c985d65a63b8f1535ef5.in.zip b/lib/src/modules/pe/tests/testdata/00a1067fc96eb2c1d440bb5b44b32f43b9900fdd3a65c985d65a63b8f1535ef5.in.zip new file mode 100644 index 000000000..cec838aa1 Binary files /dev/null and b/lib/src/modules/pe/tests/testdata/00a1067fc96eb2c1d440bb5b44b32f43b9900fdd3a65c985d65a63b8f1535ef5.in.zip differ diff --git a/lib/src/modules/pe/tests/testdata/00a1067fc96eb2c1d440bb5b44b32f43b9900fdd3a65c985d65a63b8f1535ef5.out b/lib/src/modules/pe/tests/testdata/00a1067fc96eb2c1d440bb5b44b32f43b9900fdd3a65c985d65a63b8f1535ef5.out new file mode 100644 index 000000000..d4a60bcbd --- /dev/null +++ b/lib/src/modules/pe/tests/testdata/00a1067fc96eb2c1d440bb5b44b32f43b9900fdd3a65c985d65a63b8f1535ef5.out @@ -0,0 +1,463 @@ +is_pe: true +machine: MACHINE_AMD64 +subsystem: SUBSYSTEM_WINDOWS_GUI +os_version: + major: 5 + minor: 2 +subsystem_version: + major: 5 + minor: 2 +image_version: + major: 0 + minor: 0 +linker_version: + major: 14 + minor: 0 +opthdr_magic: IMAGE_NT_OPTIONAL_HDR64_MAGIC +characteristics: 35 +dll_characteristics: 33056 +timestamp: 1527751881 # 2018-05-31 07:31:21 UTC +image_base: 5368709120 +checksum: 121515 +base_of_code: 4096 +entry_point: 2376 +entry_point_raw: 5448 +section_alignment: 4096 +file_alignment: 512 +loader_flags: 0 +size_of_optional_header: 240 +size_of_code: 40960 +size_of_initialized_data: 48640 +size_of_uninitialized_data: 0 +size_of_image: 102400 +size_of_headers: 1024 +size_of_stack_reserve: 1048576 +size_of_stack_commit: 4096 +size_of_heap_reserve: 1048576 +size_of_heap_commit: 4096 +pointer_to_symbol_table: 0 +win32_version_value: 0 +number_of_symbols: 0 +number_of_rva_and_sizes: 16 +number_of_sections: 6 +number_of_imported_functions: 72 +number_of_delayed_imported_functions: 0 +number_of_resources: 2 +number_of_version_infos: 0 +number_of_imports: 1 +number_of_delayed_imports: 0 +number_of_exports: 0 +number_of_signatures: 1 +rich_signature: + offset: 128 + length: 112 + key: 1468968837 + raw_data: "\xc1\xce\xe0\x04\x85\xaf\x8eW\x85\xaf\x8eW\x85\xaf\x8eW13\x7fW\x81\xaf\x8eW13}W\xfd\xaf\x8eW13|W\x88\xaf\x8eW\xbe\xf1\x8dV\x82\xaf\x8eW\xbe\xf1\x8bV\x99\xaf\x8eW\xbe\xf1\x8aV\x97\xaf\x8eW\x8c\xd7\x1dW\x86\xaf\x8eW\x85\xaf\x8fW\xd9\xaf\x8eW\x12\xf1\x8bV\x87\xaf\x8eW\x17\xf1qW\x84\xaf\x8eW\x85\xaf\x19W\x84\xaf\x8eW\x12\xf1\x8cV\x84\xaf\x8eW" + clear_data: "DanS\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb4\x9c\xf1\x00\x04\x00\x00\x00\xb4\x9c\xf3\x00x\x00\x00\x00\xb4\x9c\xf2\x00\r\x00\x00\x00;^\x03\x01\x07\x00\x00\x00;^\x05\x01\x1c\x00\x00\x00;^\x04\x01\x12\x00\x00\x00\tx\x93\x00\x03\x00\x00\x00\x00\x00\x01\x00\\\x00\x00\x00\x97^\x05\x01\x02\x00\x00\x00\x92^\xff\x00\x01\x00\x00\x00\x00\x00\x97\x00\x01\x00\x00\x00\x97^\x02\x01\x01\x00\x00\x00" + tools: + - toolid: 241 + version: 40116 + times: 4 + - toolid: 243 + version: 40116 + times: 120 + - toolid: 242 + version: 40116 + times: 13 + - toolid: 259 + version: 24123 + times: 7 + - toolid: 261 + version: 24123 + times: 28 + - toolid: 260 + version: 24123 + times: 18 + - toolid: 147 + version: 30729 + times: 3 + - toolid: 1 + version: 0 + times: 92 + - toolid: 261 + version: 24215 + times: 2 + - toolid: 255 + version: 24210 + times: 1 + - toolid: 151 + version: 0 + times: 1 + - toolid: 258 + version: 24215 + times: 1 +pdb_path: "D:\\MyProject\\StreetPlayer\\ExtraProgram\\KillPot\\x64\\Release\\KillPot64.pdb" +sections: + - name: ".text" + full_name: ".text" + characteristics: 1610612768 + raw_data_size: 40960 + raw_data_offset: 1024 + virtual_address: 4096 + virtual_size: 40464 + pointer_to_relocations: 0 + pointer_to_line_numbers: 0 + number_of_relocations: 0 + number_of_line_numbers: 0 + - name: ".rdata" + full_name: ".rdata" + characteristics: 1073741888 + raw_data_size: 35840 + raw_data_offset: 41984 + virtual_address: 45056 + virtual_size: 35448 + pointer_to_relocations: 0 + pointer_to_line_numbers: 0 + number_of_relocations: 0 + number_of_line_numbers: 0 + - name: ".data" + full_name: ".data" + characteristics: 3221225536 + raw_data_size: 2560 + raw_data_offset: 77824 + virtual_address: 81920 + virtual_size: 7112 + pointer_to_relocations: 0 + pointer_to_line_numbers: 0 + number_of_relocations: 0 + number_of_line_numbers: 0 + - name: ".pdata" + full_name: ".pdata" + characteristics: 1073741888 + raw_data_size: 3072 + raw_data_offset: 80384 + virtual_address: 90112 + virtual_size: 3036 + pointer_to_relocations: 0 + pointer_to_line_numbers: 0 + number_of_relocations: 0 + number_of_line_numbers: 0 + - name: ".gfids" + full_name: ".gfids" + characteristics: 1073741888 + raw_data_size: 512 + raw_data_offset: 83456 + virtual_address: 94208 + virtual_size: 160 + pointer_to_relocations: 0 + pointer_to_line_numbers: 0 + number_of_relocations: 0 + number_of_line_numbers: 0 + - name: ".rsrc" + full_name: ".rsrc" + characteristics: 1073741888 + raw_data_size: 2048 + raw_data_offset: 83968 + virtual_address: 98304 + virtual_size: 2008 + pointer_to_relocations: 0 + pointer_to_line_numbers: 0 + number_of_relocations: 0 + number_of_line_numbers: 0 +data_directories: + - virtual_address: 0 + size: 0 + - virtual_address: 78516 + size: 40 + - virtual_address: 98304 + size: 2008 + - virtual_address: 90112 + size: 3036 + - virtual_address: 86016 + size: 6072 + - virtual_address: 0 + size: 0 + - virtual_address: 74880 + size: 84 + - virtual_address: 0 + size: 0 + - virtual_address: 0 + size: 0 + - virtual_address: 0 + size: 0 + - virtual_address: 74976 + size: 148 + - virtual_address: 0 + size: 0 + - virtual_address: 45056 + size: 584 + - virtual_address: 0 + size: 0 + - virtual_address: 0 + size: 0 + - virtual_address: 0 + size: 0 +resource_timestamp: 0 # 1970-01-01 00:00:00 UTC +resource_version: + major: 0 + minor: 0 +resources: + - length: 899 + rva: 99408 + offset: 85072 + type: RESOURCE_TYPE_MANIFEST + id: 1 + language: 1033 + - length: 987 + rva: 98416 + offset: 84080 + type: RESOURCE_TYPE_MANIFEST + id: 1 + language: 1042 +import_details: + - library_name: "KERNEL32.dll" + number_of_functions: 72 + functions: + - name: "OpenProcess" + rva: 45056 + - name: "TerminateProcess" + rva: 45064 + - name: "GetExitCodeProcess" + rva: 45072 + - name: "CloseHandle" + rva: 45080 + - name: "CreateToolhelp32Snapshot" + rva: 45088 + - name: "Process32FirstW" + rva: 45096 + - name: "Process32NextW" + rva: 45104 + - name: "Module32FirstW" + rva: 45112 + - name: "Module32NextW" + rva: 45120 + - name: "RtlCaptureContext" + rva: 45128 + - name: "RtlLookupFunctionEntry" + rva: 45136 + - name: "RtlVirtualUnwind" + rva: 45144 + - name: "UnhandledExceptionFilter" + rva: 45152 + - name: "SetUnhandledExceptionFilter" + rva: 45160 + - name: "GetCurrentProcess" + rva: 45168 + - name: "IsProcessorFeaturePresent" + rva: 45176 + - name: "QueryPerformanceCounter" + rva: 45184 + - name: "GetCurrentProcessId" + rva: 45192 + - name: "GetCurrentThreadId" + rva: 45200 + - name: "GetSystemTimeAsFileTime" + rva: 45208 + - name: "InitializeSListHead" + rva: 45216 + - name: "IsDebuggerPresent" + rva: 45224 + - name: "GetStartupInfoW" + rva: 45232 + - name: "GetModuleHandleW" + rva: 45240 + - name: "RtlUnwindEx" + rva: 45248 + - name: "GetLastError" + rva: 45256 + - name: "SetLastError" + rva: 45264 + - name: "EnterCriticalSection" + rva: 45272 + - name: "LeaveCriticalSection" + rva: 45280 + - name: "DeleteCriticalSection" + rva: 45288 + - name: "InitializeCriticalSectionAndSpinCount" + rva: 45296 + - name: "TlsAlloc" + rva: 45304 + - name: "TlsGetValue" + rva: 45312 + - name: "TlsSetValue" + rva: 45320 + - name: "TlsFree" + rva: 45328 + - name: "FreeLibrary" + rva: 45336 + - name: "GetProcAddress" + rva: 45344 + - name: "LoadLibraryExW" + rva: 45352 + - name: "GetStdHandle" + rva: 45360 + - name: "WriteFile" + rva: 45368 + - name: "GetModuleFileNameW" + rva: 45376 + - name: "MultiByteToWideChar" + rva: 45384 + - name: "WideCharToMultiByte" + rva: 45392 + - name: "ExitProcess" + rva: 45400 + - name: "GetModuleHandleExW" + rva: 45408 + - name: "GetACP" + rva: 45416 + - name: "HeapFree" + rva: 45424 + - name: "HeapAlloc" + rva: 45432 + - name: "FindClose" + rva: 45440 + - name: "FindFirstFileExW" + rva: 45448 + - name: "FindNextFileW" + rva: 45456 + - name: "IsValidCodePage" + rva: 45464 + - name: "GetOEMCP" + rva: 45472 + - name: "GetCPInfo" + rva: 45480 + - name: "GetCommandLineA" + rva: 45488 + - name: "GetCommandLineW" + rva: 45496 + - name: "GetEnvironmentStringsW" + rva: 45504 + - name: "FreeEnvironmentStringsW" + rva: 45512 + - name: "LCMapStringW" + rva: 45520 + - name: "SetStdHandle" + rva: 45528 + - name: "GetFileType" + rva: 45536 + - name: "GetStringTypeW" + rva: 45544 + - name: "GetProcessHeap" + rva: 45552 + - name: "HeapSize" + rva: 45560 + - name: "HeapReAlloc" + rva: 45568 + - name: "FlushFileBuffers" + rva: 45576 + - name: "GetConsoleCP" + rva: 45584 + - name: "GetConsoleMode" + rva: 45592 + - name: "SetFilePointerEx" + rva: 45600 + - name: "WriteConsoleW" + rva: 45608 + - name: "CreateFileW" + rva: 45616 + - name: "RaiseException" + rva: 45624 +is_signed: true +signatures: + - subject: "/C=KR/ST=Jeju-do/L=Jeju-si/O=Kakao corp./CN=Kakao corp." + issuer: "/C=US/O=Symantec Corporation/OU=Symantec Trust Network/CN=Symantec Class 3 SHA256 Code Signing CA" + thumbprint: "3cdab4a20d8b7df798159e227ac98aaf6977f93b" + version: 3 + algorithm: "sha256WithRSAEncryption" + algorithm_oid: "1.2.840.113549.1.1.11" + serial: "71:d8:85:b4:fe:8c:c7:14:7b:ef:a5:33:62:8e:e3:31" + not_before: 1509580800 # 2017-11-02 00:00:00 UTC + not_after: 1549065599 # 2019-02-01 23:59:59 UTC + verified: true + digest_alg: "md5" + digest: "3f3e2ded38ad379857f6dcc42ed85854" + file_digest: "3f3e2ded38ad379857f6dcc42ed85854" + number_of_certificates: 4 + number_of_countersignatures: 1 + signer_info: + program_name: "PotPlayer" + digest: "d4d1962645fb5a5beb8d20c3d50105a8" + digest_alg: "md5" + chain: + - issuer: "/C=US/O=Symantec Corporation/OU=Symantec Trust Network/CN=Symantec Class 3 SHA256 Code Signing CA" + subject: "/C=KR/ST=Jeju-do/L=Jeju-si/O=Kakao corp./CN=Kakao corp." + thumbprint: "3cdab4a20d8b7df798159e227ac98aaf6977f93b" + version: 3 + algorithm: "sha256WithRSAEncryption" + algorithm_oid: "1.2.840.113549.1.1.11" + serial: "71:d8:85:b4:fe:8c:c7:14:7b:ef:a5:33:62:8e:e3:31" + not_before: 1509580800 # 2017-11-02 00:00:00 UTC + not_after: 1549065599 # 2019-02-01 23:59:59 UTC + - issuer: "/C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=(c) 2006 VeriSign, Inc. - For authorized use only/CN=VeriSign Class 3 Public Primary Certification Authority - G5" + subject: "/C=US/O=Symantec Corporation/OU=Symantec Trust Network/CN=Symantec Class 3 SHA256 Code Signing CA" + thumbprint: "007790f6561dad89b0bcd85585762495e358f8a5" + version: 3 + algorithm: "sha256WithRSAEncryption" + algorithm_oid: "1.2.840.113549.1.1.11" + serial: "3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a" + not_before: 1386633600 # 2013-12-10 00:00:00 UTC + not_after: 1702166399 # 2023-12-09 23:59:59 UTC + certificates: + - issuer: "/C=ZA/ST=Western Cape/L=Durbanville/O=Thawte/OU=Thawte Certification/CN=Thawte Timestamping CA" + subject: "/C=US/O=Symantec Corporation/CN=Symantec Time Stamping Services CA - G2" + thumbprint: "6c07453ffdda08b83707c09b82fb3d15f35336b1" + version: 3 + algorithm: "sha1WithRSAEncryption" + algorithm_oid: "1.2.840.113549.1.1.5" + serial: "7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b" + not_before: 1356048000 # 2012-12-21 00:00:00 UTC + not_after: 1609372799 # 2020-12-30 23:59:59 UTC + - issuer: "/C=US/O=Symantec Corporation/CN=Symantec Time Stamping Services CA - G2" + subject: "/C=US/O=Symantec Corporation/CN=Symantec Time Stamping Services Signer - G4" + thumbprint: "65439929b67973eb192d6ff243e6767adf0834e4" + version: 3 + algorithm: "sha1WithRSAEncryption" + algorithm_oid: "1.2.840.113549.1.1.5" + serial: "0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50" + not_before: 1350518400 # 2012-10-18 00:00:00 UTC + not_after: 1609286399 # 2020-12-29 23:59:59 UTC + - issuer: "/C=US/O=Symantec Corporation/OU=Symantec Trust Network/CN=Symantec Class 3 SHA256 Code Signing CA" + subject: "/C=KR/ST=Jeju-do/L=Jeju-si/O=Kakao corp./CN=Kakao corp." + thumbprint: "3cdab4a20d8b7df798159e227ac98aaf6977f93b" + version: 3 + algorithm: "sha256WithRSAEncryption" + algorithm_oid: "1.2.840.113549.1.1.11" + serial: "71:d8:85:b4:fe:8c:c7:14:7b:ef:a5:33:62:8e:e3:31" + not_before: 1509580800 # 2017-11-02 00:00:00 UTC + not_after: 1549065599 # 2019-02-01 23:59:59 UTC + - issuer: "/C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=(c) 2006 VeriSign, Inc. - For authorized use only/CN=VeriSign Class 3 Public Primary Certification Authority - G5" + subject: "/C=US/O=Symantec Corporation/OU=Symantec Trust Network/CN=Symantec Class 3 SHA256 Code Signing CA" + thumbprint: "007790f6561dad89b0bcd85585762495e358f8a5" + version: 3 + algorithm: "sha256WithRSAEncryption" + algorithm_oid: "1.2.840.113549.1.1.11" + serial: "3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a" + not_before: 1386633600 # 2013-12-10 00:00:00 UTC + not_after: 1702166399 # 2023-12-09 23:59:59 UTC + countersignatures: + - verified: true + sign_time: 1527751928 # 2018-05-31 07:32:08 UTC + digest: "c7aaa562bef28b00380e0b416297e3e7777d3d2e" + digest_alg: "sha1" + chain: + - issuer: "/C=US/O=Symantec Corporation/CN=Symantec Time Stamping Services CA - G2" + subject: "/C=US/O=Symantec Corporation/CN=Symantec Time Stamping Services Signer - G4" + thumbprint: "65439929b67973eb192d6ff243e6767adf0834e4" + version: 3 + algorithm: "sha1WithRSAEncryption" + algorithm_oid: "1.2.840.113549.1.1.5" + serial: "0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50" + not_before: 1350518400 # 2012-10-18 00:00:00 UTC + not_after: 1609286399 # 2020-12-29 23:59:59 UTC + - issuer: "/C=ZA/ST=Western Cape/L=Durbanville/O=Thawte/OU=Thawte Certification/CN=Thawte Timestamping CA" + subject: "/C=US/O=Symantec Corporation/CN=Symantec Time Stamping Services CA - G2" + thumbprint: "6c07453ffdda08b83707c09b82fb3d15f35336b1" + version: 3 + algorithm: "sha1WithRSAEncryption" + algorithm_oid: "1.2.840.113549.1.1.5" + serial: "7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b" + not_before: 1356048000 # 2012-12-21 00:00:00 UTC + not_after: 1609372799 # 2020-12-30 23:59:59 UTC +overlay: + offset: 86016 + size: 6072 \ No newline at end of file diff --git a/lib/src/modules/pe/tests/testdata/111aeddc6a6dbf64b28cb565aa12af9ee3cc0a56ce31e4da0068cf6b474c3288.in.zip b/lib/src/modules/pe/tests/testdata/111aeddc6a6dbf64b28cb565aa12af9ee3cc0a56ce31e4da0068cf6b474c3288.in.zip new file mode 100644 index 000000000..02c07cf58 Binary files /dev/null and b/lib/src/modules/pe/tests/testdata/111aeddc6a6dbf64b28cb565aa12af9ee3cc0a56ce31e4da0068cf6b474c3288.in.zip differ diff --git a/lib/src/modules/pe/tests/testdata/111aeddc6a6dbf64b28cb565aa12af9ee3cc0a56ce31e4da0068cf6b474c3288.out b/lib/src/modules/pe/tests/testdata/111aeddc6a6dbf64b28cb565aa12af9ee3cc0a56ce31e4da0068cf6b474c3288.out new file mode 100644 index 000000000..0c6f7d249 --- /dev/null +++ b/lib/src/modules/pe/tests/testdata/111aeddc6a6dbf64b28cb565aa12af9ee3cc0a56ce31e4da0068cf6b474c3288.out @@ -0,0 +1,734 @@ +is_pe: true +machine: MACHINE_I386 +subsystem: SUBSYSTEM_WINDOWS_GUI +os_version: + major: 5 + minor: 1 +subsystem_version: + major: 4 + minor: 0 +image_version: + major: 5 + minor: 1 +linker_version: + major: 7 + minor: 0 +opthdr_magic: IMAGE_NT_OPTIONAL_HDR32_MAGIC +characteristics: 271 +dll_characteristics: 32768 +timestamp: 998098977 # 2001-08-18 01:42:57 UTC +image_base: 16777216 +checksum: 330575 +base_of_code: 4096 +base_of_data: 40960 +entry_point: 20062 +entry_point_raw: 23134 +section_alignment: 4096 +file_alignment: 512 +loader_flags: 0 +size_of_optional_header: 224 +size_of_code: 34816 +size_of_initialized_data: 246272 +size_of_uninitialized_data: 0 +size_of_image: 294912 +size_of_headers: 1024 +size_of_stack_reserve: 262144 +size_of_stack_commit: 4096 +size_of_heap_reserve: 1048576 +size_of_heap_commit: 4096 +pointer_to_symbol_table: 0 +win32_version_value: 0 +number_of_symbols: 0 +number_of_rva_and_sizes: 16 +number_of_sections: 3 +number_of_imported_functions: 126 +number_of_delayed_imported_functions: 0 +number_of_resources: 31 +number_of_version_infos: 8 +number_of_imports: 6 +number_of_delayed_imports: 0 +number_of_exports: 0 +number_of_signatures: 1 +version_info: + "CompanyName": "Microsoft Corporation" + "FileDescription": "DirectX 9.0 Web setup" + "FileVersion": "9.29.1962.0" + "InternalName": "DXWebSetup" + "LegalCopyright": "Copyright (c) Microsoft Corporation. All rights reserved." + "OriginalFilename": "dxwebsetup.exe" + "ProductName": "Microsoft® Windows® Operating System" + "ProductVersion": "9.29.1962.0" +version_info_list: + - key: "CompanyName" + value: "Microsoft Corporation" + - key: "FileDescription" + value: "DirectX 9.0 Web setup" + - key: "FileVersion" + value: "9.29.1962.0" + - key: "InternalName" + value: "DXWebSetup" + - key: "LegalCopyright" + value: "Copyright (c) Microsoft Corporation. All rights reserved." + - key: "OriginalFilename" + value: "dxwebsetup.exe" + - key: "ProductName" + value: "Microsoft® Windows® Operating System" + - key: "ProductVersion" + value: "9.29.1962.0" +rich_signature: + offset: 128 + length: 56 + key: 2278776681 + raw_data: "->\xbd\xd4i_\xd3\x87i_\xd3\x87i_\xd3\x87\x93|\xca\x87d_\xd3\x87i_\xd2\x87\x17_\xd3\x87\xfe|\x96\x87h_\xd3\x87\xb3|\xcf\x87q_\xd3\x87\x93|\xee\x87h_\xd3\x87" + clear_data: "DanS\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xfa#\x19\x00\r\x00\x00\x00\x00\x00\x01\x00~\x00\x00\x00\x97#E\x00\x01\x00\x00\x00\xda#\x1c\x00\x18\x00\x00\x00\xfa#=\x00\x01\x00\x00\x00" + tools: + - toolid: 25 + version: 9210 + times: 13 + - toolid: 1 + version: 0 + times: 126 + - toolid: 69 + version: 9111 + times: 1 + - toolid: 28 + version: 9178 + times: 24 + - toolid: 61 + version: 9210 + times: 1 +pdb_path: "wextract.pdb" +sections: + - name: ".text" + full_name: ".text" + characteristics: 1610612768 + raw_data_size: 34816 + raw_data_offset: 1024 + virtual_address: 4096 + virtual_size: 34330 + pointer_to_relocations: 0 + pointer_to_line_numbers: 0 + number_of_relocations: 0 + number_of_line_numbers: 0 + - name: ".data" + full_name: ".data" + characteristics: 3221225536 + raw_data_size: 1024 + raw_data_offset: 35840 + virtual_address: 40960 + virtual_size: 7140 + pointer_to_relocations: 0 + pointer_to_line_numbers: 0 + number_of_relocations: 0 + number_of_line_numbers: 0 + - name: ".rsrc" + full_name: ".rsrc" + characteristics: 1073741888 + raw_data_size: 245248 + raw_data_offset: 36864 + virtual_address: 49152 + virtual_size: 245760 + pointer_to_relocations: 0 + pointer_to_line_numbers: 0 + number_of_relocations: 0 + number_of_line_numbers: 0 +data_directories: + - virtual_address: 0 + size: 0 + - virtual_address: 35504 + size: 140 + - virtual_address: 49152 + size: 245128 + - virtual_address: 0 + size: 0 + - virtual_address: 282112 + size: 5976 + - virtual_address: 0 + size: 0 + - virtual_address: 4624 + size: 28 + - virtual_address: 0 + size: 0 + - virtual_address: 0 + size: 0 + - virtual_address: 0 + size: 0 + - virtual_address: 0 + size: 0 + - virtual_address: 0 + size: 0 + - virtual_address: 4096 + size: 528 + - virtual_address: 0 + size: 0 + - virtual_address: 0 + size: 0 + - virtual_address: 0 + size: 0 +resource_timestamp: 1773781709 # 2026-03-17 21:08:29 UTC +resource_version: + major: 4 + minor: 0 +resources: + - length: 11802 + rva: 51104 + offset: 38816 + id: 3001 + language: 1033 + type_string: "A\x00V\x00I\x00" + - length: 744 + rva: 62908 + offset: 50620 + type: RESOURCE_TYPE_ICON + id: 1 + language: 1033 + - length: 296 + rva: 63652 + offset: 51364 + type: RESOURCE_TYPE_ICON + id: 2 + language: 1033 + - length: 716 + rva: 63948 + offset: 51660 + type: RESOURCE_TYPE_DIALOG + id: 2001 + language: 1033 + - length: 394 + rva: 64664 + offset: 52376 + type: RESOURCE_TYPE_DIALOG + id: 2002 + language: 1033 + - length: 320 + rva: 65060 + offset: 52772 + type: RESOURCE_TYPE_DIALOG + id: 2003 + language: 1033 + - length: 406 + rva: 65380 + offset: 53092 + type: RESOURCE_TYPE_DIALOG + id: 2004 + language: 1033 + - length: 270 + rva: 65788 + offset: 53500 + type: RESOURCE_TYPE_DIALOG + id: 2005 + language: 1033 + - length: 250 + rva: 66060 + offset: 53772 + type: RESOURCE_TYPE_DIALOG + id: 2006 + language: 1033 + - length: 140 + rva: 66312 + offset: 54024 + type: RESOURCE_TYPE_STRING + id: 63 + language: 1033 + - length: 1312 + rva: 66452 + offset: 54164 + type: RESOURCE_TYPE_STRING + id: 76 + language: 1033 + - length: 1484 + rva: 67764 + offset: 55476 + type: RESOURCE_TYPE_STRING + id: 77 + language: 1033 + - length: 1200 + rva: 69248 + offset: 56960 + type: RESOURCE_TYPE_STRING + id: 80 + language: 1033 + - length: 1098 + rva: 70448 + offset: 58160 + type: RESOURCE_TYPE_STRING + id: 83 + language: 1033 + - length: 974 + rva: 71548 + offset: 59260 + type: RESOURCE_TYPE_STRING + id: 85 + language: 1033 + - length: 30 + rva: 72524 + offset: 60236 + type: RESOURCE_TYPE_RCDATA + language: 1033 + name_string: "A\x00D\x00M\x00Q\x00C\x00M\x00D\x00" + - length: 220645 + rva: 72556 + offset: 60268 + type: RESOURCE_TYPE_RCDATA + language: 1033 + name_string: "C\x00A\x00B\x00I\x00N\x00E\x00T\x00" + - length: 4 + rva: 293204 + offset: 280916 + type: RESOURCE_TYPE_RCDATA + language: 1033 + name_string: "E\x00X\x00T\x00R\x00A\x00C\x00T\x00O\x00P\x00T\x00" + - length: 36 + rva: 293208 + offset: 280920 + type: RESOURCE_TYPE_RCDATA + language: 1033 + name_string: "F\x00I\x00L\x00E\x00S\x00I\x00Z\x00E\x00S\x00" + - length: 7 + rva: 293244 + offset: 280956 + type: RESOURCE_TYPE_RCDATA + language: 1033 + name_string: "F\x00I\x00N\x00I\x00S\x00H\x00M\x00S\x00G\x00" + - length: 7 + rva: 293252 + offset: 280964 + type: RESOURCE_TYPE_RCDATA + language: 1033 + name_string: "L\x00I\x00C\x00E\x00N\x00S\x00E\x00" + - length: 4 + rva: 293260 + offset: 280972 + type: RESOURCE_TYPE_RCDATA + language: 1033 + name_string: "P\x00A\x00C\x00K\x00I\x00N\x00S\x00T\x00S\x00P\x00A\x00C\x00E\x00" + - length: 7 + rva: 293264 + offset: 280976 + type: RESOURCE_TYPE_RCDATA + language: 1033 + name_string: "P\x00O\x00S\x00T\x00R\x00U\x00N\x00P\x00R\x00O\x00G\x00R\x00A\x00M\x00" + - length: 4 + rva: 293272 + offset: 280984 + type: RESOURCE_TYPE_RCDATA + language: 1033 + name_string: "R\x00E\x00B\x00O\x00O\x00T\x00" + - length: 15 + rva: 293276 + offset: 280988 + type: RESOURCE_TYPE_RCDATA + language: 1033 + name_string: "R\x00U\x00N\x00P\x00R\x00O\x00G\x00R\x00A\x00M\x00" + - length: 4 + rva: 293292 + offset: 281004 + type: RESOURCE_TYPE_RCDATA + language: 1033 + name_string: "S\x00H\x00O\x00W\x00W\x00I\x00N\x00D\x00O\x00W\x00" + - length: 22 + rva: 293296 + offset: 281008 + type: RESOURCE_TYPE_RCDATA + language: 1033 + name_string: "T\x00I\x00T\x00L\x00E\x00" + - length: 7 + rva: 293320 + offset: 281032 + type: RESOURCE_TYPE_RCDATA + language: 1033 + name_string: "U\x00P\x00R\x00O\x00M\x00P\x00T\x00" + - length: 30 + rva: 293328 + offset: 281040 + type: RESOURCE_TYPE_RCDATA + language: 1033 + name_string: "U\x00S\x00R\x00Q\x00C\x00M\x00D\x00" + - length: 34 + rva: 293360 + offset: 281072 + type: RESOURCE_TYPE_GROUP_ICON + id: 3000 + language: 1033 + - length: 884 + rva: 293396 + offset: 281108 + type: RESOURCE_TYPE_VERSION + id: 1 + language: 1033 +import_details: + - library_name: "ADVAPI32.dll" + number_of_functions: 14 + functions: + - name: "FreeSid" + rva: 4096 + - name: "AllocateAndInitializeSid" + rva: 4100 + - name: "EqualSid" + rva: 4104 + - name: "GetTokenInformation" + rva: 4108 + - name: "OpenProcessToken" + rva: 4112 + - name: "AdjustTokenPrivileges" + rva: 4116 + - name: "LookupPrivilegeValueA" + rva: 4120 + - name: "RegCloseKey" + rva: 4124 + - name: "RegDeleteValueA" + rva: 4128 + - name: "RegOpenKeyExA" + rva: 4132 + - name: "RegSetValueExA" + rva: 4136 + - name: "RegQueryValueExA" + rva: 4140 + - name: "RegCreateKeyExA" + rva: 4144 + - name: "RegQueryInfoKeyA" + rva: 4148 + - library_name: "KERNEL32.dll" + number_of_functions: 76 + functions: + - name: "LocalFree" + rva: 4172 + - name: "LocalAlloc" + rva: 4176 + - name: "GetLastError" + rva: 4180 + - name: "GetCurrentProcess" + rva: 4184 + - name: "GetModuleFileNameA" + rva: 4188 + - name: "lstrlenA" + rva: 4192 + - name: "GetSystemDirectoryA" + rva: 4196 + - name: "RemoveDirectoryA" + rva: 4200 + - name: "FindClose" + rva: 4204 + - name: "FindNextFileA" + rva: 4208 + - name: "DeleteFileA" + rva: 4212 + - name: "SetFileAttributesA" + rva: 4216 + - name: "lstrcmpA" + rva: 4220 + - name: "FindFirstFileA" + rva: 4224 + - name: "lstrcatA" + rva: 4228 + - name: "lstrcpyA" + rva: 4232 + - name: "_lclose" + rva: 4236 + - name: "_llseek" + rva: 4240 + - name: "_lopen" + rva: 4244 + - name: "WritePrivateProfileStringA" + rva: 4248 + - name: "GetWindowsDirectoryA" + rva: 4252 + - name: "CreateDirectoryA" + rva: 4256 + - name: "GetFileAttributesA" + rva: 4260 + - name: "ExpandEnvironmentStringsA" + rva: 4264 + - name: "IsDBCSLeadByte" + rva: 4268 + - name: "GetShortPathNameA" + rva: 4272 + - name: "GetPrivateProfileStringA" + rva: 4276 + - name: "GetPrivateProfileIntA" + rva: 4280 + - name: "lstrcmpiA" + rva: 4284 + - name: "GetProcAddress" + rva: 4288 + - name: "GlobalUnlock" + rva: 4292 + - name: "GlobalLock" + rva: 4296 + - name: "GlobalAlloc" + rva: 4300 + - name: "FreeResource" + rva: 4304 + - name: "CloseHandle" + rva: 4308 + - name: "LoadResource" + rva: 4312 + - name: "SizeofResource" + rva: 4316 + - name: "FindResourceA" + rva: 4320 + - name: "ReadFile" + rva: 4324 + - name: "WriteFile" + rva: 4328 + - name: "SetFilePointer" + rva: 4332 + - name: "SetFileTime" + rva: 4336 + - name: "LocalFileTimeToFileTime" + rva: 4340 + - name: "DosDateTimeToFileTime" + rva: 4344 + - name: "SetCurrentDirectoryA" + rva: 4348 + - name: "GetTempFileNameA" + rva: 4352 + - name: "ExitProcess" + rva: 4356 + - name: "CreateFileA" + rva: 4360 + - name: "LoadLibraryExA" + rva: 4364 + - name: "lstrcpynA" + rva: 4368 + - name: "GetVolumeInformationA" + rva: 4372 + - name: "FormatMessageA" + rva: 4376 + - name: "GetCurrentDirectoryA" + rva: 4380 + - name: "GetVersionExA" + rva: 4384 + - name: "GetExitCodeProcess" + rva: 4388 + - name: "WaitForSingleObject" + rva: 4392 + - name: "CreateProcessA" + rva: 4396 + - name: "GetTempPathA" + rva: 4400 + - name: "GetSystemInfo" + rva: 4404 + - name: "CreateMutexA" + rva: 4408 + - name: "SetEvent" + rva: 4412 + - name: "CreateEventA" + rva: 4416 + - name: "CreateThread" + rva: 4420 + - name: "ResetEvent" + rva: 4424 + - name: "TerminateThread" + rva: 4428 + - name: "GetDriveTypeA" + rva: 4432 + - name: "GetModuleHandleA" + rva: 4436 + - name: "GetStartupInfoA" + rva: 4440 + - name: "GetCommandLineA" + rva: 4444 + - name: "LockResource" + rva: 4448 + - name: "LoadLibraryA" + rva: 4452 + - name: "GetDiskFreeSpaceA" + rva: 4456 + - name: "MulDiv" + rva: 4460 + - name: "EnumResourceLanguagesA" + rva: 4464 + - name: "FreeLibrary" + rva: 4468 + - name: "GlobalFree" + rva: 4472 + - library_name: "GDI32.dll" + number_of_functions: 1 + functions: + - name: "GetDeviceCaps" + rva: 4164 + - library_name: "USER32.dll" + number_of_functions: 31 + functions: + - name: "ExitWindowsEx" + rva: 4480 + - name: "wsprintfA" + rva: 4484 + - name: "CharNextA" + rva: 4488 + - name: "CharUpperA" + rva: 4492 + - name: "CharPrevA" + rva: 4496 + - name: "SetWindowLongA" + rva: 4500 + - name: "GetWindowLongA" + rva: 4504 + - name: "CallWindowProcA" + rva: 4508 + - name: "DispatchMessageA" + rva: 4512 + - name: "MsgWaitForMultipleObjects" + rva: 4516 + - name: "PeekMessageA" + rva: 4520 + - name: "SendMessageA" + rva: 4524 + - name: "SetWindowPos" + rva: 4528 + - name: "ReleaseDC" + rva: 4532 + - name: "GetDC" + rva: 4536 + - name: "GetWindowRect" + rva: 4540 + - name: "SendDlgItemMessageA" + rva: 4544 + - name: "GetDlgItem" + rva: 4548 + - name: "SetForegroundWindow" + rva: 4552 + - name: "SetWindowTextA" + rva: 4556 + - name: "MessageBoxA" + rva: 4560 + - name: "DialogBoxIndirectParamA" + rva: 4564 + - name: "ShowWindow" + rva: 4568 + - name: "EnableWindow" + rva: 4572 + - name: "GetDlgItemTextA" + rva: 4576 + - name: "EndDialog" + rva: 4580 + - name: "GetDesktopWindow" + rva: 4584 + - name: "MessageBeep" + rva: 4588 + - name: "SetDlgItemTextA" + rva: 4592 + - name: "LoadStringA" + rva: 4596 + - name: "GetSystemMetrics" + rva: 4600 + - library_name: "COMCTL32.dll" + number_of_functions: 1 + functions: + - name: "ord17" + ordinal: 17 + rva: 4156 + - library_name: "VERSION.dll" + number_of_functions: 3 + functions: + - name: "GetFileVersionInfoA" + rva: 4608 + - name: "VerQueryValueA" + rva: 4612 + - name: "GetFileVersionInfoSizeA" + rva: 4616 +is_signed: true +signatures: + - subject: "/C=US/ST=Washington/L=Redmond/O=Microsoft Corporation/OU=MOPR/CN=Microsoft Corporation" + issuer: "/C=US/ST=Washington/L=Redmond/O=Microsoft Corporation/CN=Microsoft Code Signing PCA" + thumbprint: "9617094a1cfb59ae7c1f7dfdb6739e4e7c40508f" + version: 3 + algorithm: "sha1WithRSAEncryption" + algorithm_oid: "1.2.840.113549.1.1.5" + serial: "61:01:cf:3e:00:00:00:00:00:0f" + not_before: 1260225629 # 2009-12-07 22:40:29 UTC + not_after: 1299537629 # 2011-03-07 22:40:29 UTC + verified: true + digest_alg: "sha1" + digest: "47b88536046e466d2f58b318fd1843f0b84b28d3" + file_digest: "47b88536046e466d2f58b318fd1843f0b84b28d3" + number_of_certificates: 4 + number_of_countersignatures: 1 + signer_info: + program_name: "DirectX SDK" + digest: "44238f27912fcf43d31b231b3615db4f4cd51eb6" + digest_alg: "sha1" + chain: + - issuer: "/C=US/ST=Washington/L=Redmond/O=Microsoft Corporation/CN=Microsoft Code Signing PCA" + subject: "/C=US/ST=Washington/L=Redmond/O=Microsoft Corporation/OU=MOPR/CN=Microsoft Corporation" + thumbprint: "9617094a1cfb59ae7c1f7dfdb6739e4e7c40508f" + version: 3 + algorithm: "sha1WithRSAEncryption" + algorithm_oid: "1.2.840.113549.1.1.5" + serial: "61:01:cf:3e:00:00:00:00:00:0f" + not_before: 1260225629 # 2009-12-07 22:40:29 UTC + not_after: 1299537629 # 2011-03-07 22:40:29 UTC + - issuer: "/OU=Copyright (c) 1997 Microsoft Corp./OU=Microsoft Corporation/CN=Microsoft Root Authority" + subject: "/C=US/ST=Washington/L=Redmond/O=Microsoft Corporation/CN=Microsoft Code Signing PCA" + thumbprint: "3036e3b25b88a55b86fc90e6e9eaad5081445166" + version: 3 + algorithm: "sha1WithRSAEncryption" + algorithm_oid: "1.3.14.3.2.29" + serial: "2e:ab:11:dc:50:ff:5c:9d:cb:c0" + not_before: 1187821862 # 2007-08-22 22:31:02 UTC + not_after: 1345878000 # 2012-08-25 07:00:00 UTC + certificates: + - issuer: "/OU=Copyright (c) 1997 Microsoft Corp./OU=Microsoft Corporation/CN=Microsoft Root Authority" + subject: "/C=US/ST=Washington/L=Redmond/O=Microsoft Corporation/CN=Microsoft Code Signing PCA" + thumbprint: "3036e3b25b88a55b86fc90e6e9eaad5081445166" + version: 3 + algorithm: "sha1WithRSAEncryption" + algorithm_oid: "1.3.14.3.2.29" + serial: "2e:ab:11:dc:50:ff:5c:9d:cb:c0" + not_before: 1187821862 # 2007-08-22 22:31:02 UTC + not_after: 1345878000 # 2012-08-25 07:00:00 UTC + - issuer: "/C=US/ST=Washington/L=Redmond/O=Microsoft Corporation/CN=Microsoft Code Signing PCA" + subject: "/C=US/ST=Washington/L=Redmond/O=Microsoft Corporation/OU=MOPR/CN=Microsoft Corporation" + thumbprint: "9617094a1cfb59ae7c1f7dfdb6739e4e7c40508f" + version: 3 + algorithm: "sha1WithRSAEncryption" + algorithm_oid: "1.2.840.113549.1.1.5" + serial: "61:01:cf:3e:00:00:00:00:00:0f" + not_before: 1260225629 # 2009-12-07 22:40:29 UTC + not_after: 1299537629 # 2011-03-07 22:40:29 UTC + - issuer: "/OU=Copyright (c) 1997 Microsoft Corp./OU=Microsoft Corporation/CN=Microsoft Root Authority" + subject: "/C=US/ST=Washington/L=Redmond/O=Microsoft Corporation/CN=Microsoft Timestamping PCA" + thumbprint: "3ea99a60058275e0ed83b892a909449f8c33b245" + version: 3 + algorithm: "sha1WithRSAEncryption" + algorithm_oid: "1.2.840.113549.1.1.5" + serial: "6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2" + not_before: 1158368687 # 2006-09-16 01:04:47 UTC + not_after: 1568530800 # 2019-09-15 07:00:00 UTC + - issuer: "/C=US/ST=Washington/L=Redmond/O=Microsoft Corporation/CN=Microsoft Timestamping PCA" + subject: "/C=US/ST=Washington/L=Redmond/O=Microsoft Corporation/OU=MOPR/OU=nCipher DSE ESN:85D3-305C-5BCF/CN=Microsoft Time-Stamp Service" + thumbprint: "4d6f357f0e6434da97b1afc540fb6fdd0e85a89f" + version: 3 + algorithm: "sha1WithRSAEncryption" + algorithm_oid: "1.2.840.113549.1.1.5" + serial: "61:05:a2:30:00:00:00:00:00:08" + not_before: 1217012475 # 2008-07-25 19:01:15 UTC + not_after: 1374779475 # 2013-07-25 19:11:15 UTC + countersignatures: + - verified: true + sign_time: 1275479951 # 2010-06-02 11:59:11 UTC + digest: "8816bffcc2a048cf661dc8d8b32648bdc20ab06e" + digest_alg: "sha1" + chain: + - issuer: "/C=US/ST=Washington/L=Redmond/O=Microsoft Corporation/CN=Microsoft Timestamping PCA" + subject: "/C=US/ST=Washington/L=Redmond/O=Microsoft Corporation/OU=MOPR/OU=nCipher DSE ESN:85D3-305C-5BCF/CN=Microsoft Time-Stamp Service" + thumbprint: "4d6f357f0e6434da97b1afc540fb6fdd0e85a89f" + version: 3 + algorithm: "sha1WithRSAEncryption" + algorithm_oid: "1.2.840.113549.1.1.5" + serial: "61:05:a2:30:00:00:00:00:00:08" + not_before: 1217012475 # 2008-07-25 19:01:15 UTC + not_after: 1374779475 # 2013-07-25 19:11:15 UTC + - issuer: "/OU=Copyright (c) 1997 Microsoft Corp./OU=Microsoft Corporation/CN=Microsoft Root Authority" + subject: "/C=US/ST=Washington/L=Redmond/O=Microsoft Corporation/CN=Microsoft Timestamping PCA" + thumbprint: "3ea99a60058275e0ed83b892a909449f8c33b245" + version: 3 + algorithm: "sha1WithRSAEncryption" + algorithm_oid: "1.2.840.113549.1.1.5" + serial: "6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2" + not_before: 1158368687 # 2006-09-16 01:04:47 UTC + not_after: 1568530800 # 2019-09-15 07:00:00 UTC +overlay: + offset: 282112 + size: 5976 \ No newline at end of file diff --git a/lib/src/modules/pe/tests/testdata/616095160dd4b1556848907729606d0de3cfa34938eb76a1412c49a9082962ee.out b/lib/src/modules/pe/tests/testdata/616095160dd4b1556848907729606d0de3cfa34938eb76a1412c49a9082962ee.out index 6e009581b..224768071 100644 --- a/lib/src/modules/pe/tests/testdata/616095160dd4b1556848907729606d0de3cfa34938eb76a1412c49a9082962ee.out +++ b/lib/src/modules/pe/tests/testdata/616095160dd4b1556848907729606d0de3cfa34938eb76a1412c49a9082962ee.out @@ -414,7 +414,7 @@ import_details: rva: 70312 is_signed: true signatures: - - subject: "/C=DE/ST=Bayern/L=Geretsried/O=Quality First Software GmbH/serialNumber=HRB 140833/CN=Quality First Software GmbH/businessCategory=Private Organization/jurisdictionL=M\\xC3\\xBCnchen/jurisdictionST=Bayern/jurisdictionC=DE" + - subject: "/C=DE/ST=Bayern/L=Geretsried/O=Quality First Software GmbH/serialNumber=HRB 140833/CN=Quality First Software GmbH/businessCategory=Private Organization/jurisdictionL=München/jurisdictionST=Bayern/jurisdictionC=DE" issuer: "/C=US/ST=Texas/L=Houston/O=SSL Corp/CN=SSL.com EV Code Signing Intermediate CA ECC R2" thumbprint: "6a63f4e957aa5867f33916e8f57019c2b9987478" version: 3 @@ -434,7 +434,7 @@ signatures: digest_alg: "sha384" chain: - issuer: "/C=US/ST=Texas/L=Houston/O=SSL Corp/CN=SSL.com EV Code Signing Intermediate CA ECC R2" - subject: "/C=DE/ST=Bayern/L=Geretsried/O=Quality First Software GmbH/serialNumber=HRB 140833/CN=Quality First Software GmbH/businessCategory=Private Organization/jurisdictionL=M\\xC3\\xBCnchen/jurisdictionST=Bayern/jurisdictionC=DE" + subject: "/C=DE/ST=Bayern/L=Geretsried/O=Quality First Software GmbH/serialNumber=HRB 140833/CN=Quality First Software GmbH/businessCategory=Private Organization/jurisdictionL=München/jurisdictionST=Bayern/jurisdictionC=DE" thumbprint: "6a63f4e957aa5867f33916e8f57019c2b9987478" version: 3 algorithm: "ecdsa-with-SHA384" @@ -462,7 +462,7 @@ signatures: not_before: 1551987465 # 2019-03-07 19:37:45 UTC not_after: 2025027465 # 2034-03-03 19:37:45 UTC - issuer: "/C=US/ST=Texas/L=Houston/O=SSL Corp/CN=SSL.com EV Code Signing Intermediate CA ECC R2" - subject: "/C=DE/ST=Bayern/L=Geretsried/O=Quality First Software GmbH/serialNumber=HRB 140833/CN=Quality First Software GmbH/businessCategory=Private Organization/jurisdictionL=M\\xC3\\xBCnchen/jurisdictionST=Bayern/jurisdictionC=DE" + subject: "/C=DE/ST=Bayern/L=Geretsried/O=Quality First Software GmbH/serialNumber=HRB 140833/CN=Quality First Software GmbH/businessCategory=Private Organization/jurisdictionL=München/jurisdictionST=Bayern/jurisdictionC=DE" thumbprint: "6a63f4e957aa5867f33916e8f57019c2b9987478" version: 3 algorithm: "ecdsa-with-SHA384" diff --git a/lib/src/modules/pe/tests/testdata/6758569a317d95008a9a5641376335c737bc0900393f89f93b8f3c9a265dc790.in.zip b/lib/src/modules/pe/tests/testdata/6758569a317d95008a9a5641376335c737bc0900393f89f93b8f3c9a265dc790.in.zip new file mode 100644 index 000000000..1828b3b4f Binary files /dev/null and b/lib/src/modules/pe/tests/testdata/6758569a317d95008a9a5641376335c737bc0900393f89f93b8f3c9a265dc790.in.zip differ diff --git a/lib/src/modules/pe/tests/testdata/6758569a317d95008a9a5641376335c737bc0900393f89f93b8f3c9a265dc790.out b/lib/src/modules/pe/tests/testdata/6758569a317d95008a9a5641376335c737bc0900393f89f93b8f3c9a265dc790.out new file mode 100644 index 000000000..524b247e4 --- /dev/null +++ b/lib/src/modules/pe/tests/testdata/6758569a317d95008a9a5641376335c737bc0900393f89f93b8f3c9a265dc790.out @@ -0,0 +1,506 @@ +is_pe: true +machine: MACHINE_I386 +subsystem: SUBSYSTEM_WINDOWS_CUI +os_version: + major: 4 + minor: 0 +subsystem_version: + major: 4 + minor: 0 +image_version: + major: 1 + minor: 0 +linker_version: + major: 2 + minor: 26 +opthdr_magic: IMAGE_NT_OPTIONAL_HDR32_MAGIC +characteristics: 783 +dll_characteristics: 1344 +timestamp: 1655157631 # 2022-06-13 22:00:31 UTC +image_base: 4194304 +checksum: 340992 +base_of_code: 4096 +base_of_data: 24576 +entry_point: 1648 +entry_point_raw: 4720 +section_alignment: 4096 +file_alignment: 512 +loader_flags: 0 +size_of_optional_header: 224 +size_of_code: 17920 +size_of_initialized_data: 271872 +size_of_uninitialized_data: 36352 +size_of_image: 344064 +size_of_headers: 1024 +size_of_stack_reserve: 2097152 +size_of_stack_commit: 4096 +size_of_heap_reserve: 1048576 +size_of_heap_commit: 4096 +pointer_to_symbol_table: 0 +win32_version_value: 0 +number_of_symbols: 0 +number_of_rva_and_sizes: 16 +number_of_sections: 6 +number_of_imported_functions: 67 +number_of_delayed_imported_functions: 0 +number_of_resources: 26 +number_of_version_infos: 0 +number_of_imports: 5 +number_of_delayed_imports: 0 +number_of_exports: 0 +number_of_signatures: 1 +sections: + - name: ".text" + full_name: ".text" + characteristics: 1613758496 + raw_data_size: 17920 + raw_data_offset: 1024 + virtual_address: 4096 + virtual_size: 17512 + pointer_to_relocations: 0 + pointer_to_line_numbers: 0 + number_of_relocations: 0 + number_of_line_numbers: 0 + - name: ".data" + full_name: ".data" + characteristics: 3224371264 + raw_data_size: 512 + raw_data_offset: 18944 + virtual_address: 24576 + virtual_size: 48 + pointer_to_relocations: 0 + pointer_to_line_numbers: 0 + number_of_relocations: 0 + number_of_line_numbers: 0 + - name: ".rdata" + full_name: ".rdata" + characteristics: 1076887616 + raw_data_size: 2048 + raw_data_offset: 19456 + virtual_address: 28672 + virtual_size: 1584 + pointer_to_relocations: 0 + pointer_to_line_numbers: 0 + number_of_relocations: 0 + number_of_line_numbers: 0 + - name: ".bss" + full_name: ".bss" + characteristics: 3224371328 + raw_data_size: 0 + raw_data_offset: 0 + virtual_address: 32768 + virtual_size: 36352 + pointer_to_relocations: 0 + pointer_to_line_numbers: 0 + number_of_relocations: 0 + number_of_line_numbers: 0 + - name: ".idata" + full_name: ".idata" + characteristics: 3224371264 + raw_data_size: 2560 + raw_data_offset: 21504 + virtual_address: 69632 + virtual_size: 2096 + pointer_to_relocations: 0 + pointer_to_line_numbers: 0 + number_of_relocations: 0 + number_of_line_numbers: 0 + - name: ".rsrc" + full_name: ".rsrc" + characteristics: 3224371264 + raw_data_size: 266752 + raw_data_offset: 24064 + virtual_address: 73728 + virtual_size: 266504 + pointer_to_relocations: 0 + pointer_to_line_numbers: 0 + number_of_relocations: 0 + number_of_line_numbers: 0 +data_directories: + - virtual_address: 0 + size: 0 + - virtual_address: 69632 + size: 2096 + - virtual_address: 73728 + size: 266504 + - virtual_address: 0 + size: 0 + - virtual_address: 290816 + size: 1760 + - virtual_address: 0 + size: 0 + - virtual_address: 0 + size: 0 + - virtual_address: 0 + size: 0 + - virtual_address: 0 + size: 0 + - virtual_address: 0 + size: 0 + - virtual_address: 0 + size: 0 + - virtual_address: 0 + size: 0 + - virtual_address: 70060 + size: 308 + - virtual_address: 0 + size: 0 + - virtual_address: 0 + size: 0 + - virtual_address: 0 + size: 0 +resource_timestamp: 0 # 1970-01-01 00:00:00 UTC +resource_version: + major: 0 + minor: 0 +resources: + - length: 1128 + rva: 75064 + offset: 25400 + type: RESOURCE_TYPE_ICON + id: 1 + language: 1024 + - length: 2440 + rva: 76192 + offset: 26528 + type: RESOURCE_TYPE_ICON + id: 2 + language: 1024 + - length: 4264 + rva: 78632 + offset: 28968 + type: RESOURCE_TYPE_ICON + id: 3 + language: 1024 + - length: 9640 + rva: 82896 + offset: 33232 + type: RESOURCE_TYPE_ICON + id: 4 + language: 1024 + - length: 16936 + rva: 92536 + offset: 42872 + type: RESOURCE_TYPE_ICON + id: 5 + language: 1024 + - length: 26600 + rva: 109472 + offset: 59808 + type: RESOURCE_TYPE_ICON + id: 6 + language: 1024 + - length: 38056 + rva: 136072 + offset: 86408 + type: RESOURCE_TYPE_ICON + id: 7 + language: 1024 + - length: 52008 + rva: 174128 + offset: 124464 + type: RESOURCE_TYPE_ICON + id: 8 + language: 1024 + - length: 67624 + rva: 226136 + offset: 176472 + type: RESOURCE_TYPE_ICON + id: 9 + language: 1024 + - length: 43190 + rva: 293760 + offset: 244096 + type: RESOURCE_TYPE_ICON + id: 10 + language: 1024 + - length: 6 + rva: 336952 + offset: 287288 + type: RESOURCE_TYPE_RCDATA + id: 2 + language: 1024 + - length: 2 + rva: 336960 + offset: 287296 + type: RESOURCE_TYPE_RCDATA + id: 8 + language: 1024 + - length: 10 + rva: 336968 + offset: 287304 + type: RESOURCE_TYPE_RCDATA + id: 10 + language: 1024 + - length: 18 + rva: 336984 + offset: 287320 + type: RESOURCE_TYPE_RCDATA + id: 14 + language: 1024 + - length: 24 + rva: 337008 + offset: 287344 + type: RESOURCE_TYPE_RCDATA + id: 15 + language: 1024 + - length: 2601 + rva: 337032 + offset: 287368 + type: RESOURCE_TYPE_RCDATA + id: 16 + language: 1024 + - length: 2 + rva: 339640 + offset: 289976 + type: RESOURCE_TYPE_RCDATA + id: 18 + language: 1024 + - length: 4 + rva: 339648 + offset: 289984 + type: RESOURCE_TYPE_RCDATA + id: 20 + language: 1024 + - length: 26 + rva: 339656 + offset: 289992 + type: RESOURCE_TYPE_RCDATA + id: 21 + language: 1024 + - length: 44 + rva: 339688 + offset: 290024 + type: RESOURCE_TYPE_RCDATA + id: 22 + language: 1024 + - length: 2 + rva: 339736 + offset: 290072 + type: RESOURCE_TYPE_RCDATA + id: 30 + language: 1024 + - length: 50 + rva: 339744 + offset: 290080 + type: RESOURCE_TYPE_RCDATA + id: 101 + language: 1024 + - length: 115 + rva: 339800 + offset: 290136 + type: RESOURCE_TYPE_RCDATA + id: 102 + language: 1024 + - length: 53 + rva: 339920 + offset: 290256 + type: RESOURCE_TYPE_RCDATA + id: 103 + language: 1024 + - length: 104 + rva: 339976 + offset: 290312 + type: RESOURCE_TYPE_RCDATA + id: 104 + language: 1024 + - length: 146 + rva: 340080 + offset: 290416 + type: RESOURCE_TYPE_GROUP_ICON + id: 1 + language: 1024 +import_details: + - library_name: "ADVAPI32.DLL" + number_of_functions: 4 + functions: + - name: "RegCloseKey" + rva: 70064 + - name: "RegEnumKeyExA" + rva: 70068 + - name: "RegOpenKeyExA" + rva: 70072 + - name: "RegQueryValueExA" + rva: 70076 + - library_name: "KERNEL32.dll" + number_of_functions: 23 + functions: + - name: "CloseHandle" + rva: 70088 + - name: "CreateMutexA" + rva: 70092 + - name: "CreateProcessA" + rva: 70096 + - name: "ExitProcess" + rva: 70100 + - name: "FindResourceExA" + rva: 70104 + - name: "FormatMessageA" + rva: 70108 + - name: "GetCommandLineA" + rva: 70112 + - name: "GetCurrentDirectoryA" + rva: 70116 + - name: "GetCurrentProcess" + rva: 70120 + - name: "GetEnvironmentVariableA" + rva: 70124 + - name: "GetExitCodeProcess" + rva: 70128 + - name: "GetLastError" + rva: 70132 + - name: "GetModuleFileNameA" + rva: 70136 + - name: "GetModuleHandleA" + rva: 70140 + - name: "GetProcAddress" + rva: 70144 + - name: "GlobalMemoryStatusEx" + rva: 70148 + - name: "LoadResource" + rva: 70152 + - name: "LocalFree" + rva: 70156 + - name: "LockResource" + rva: 70160 + - name: "SetEnvironmentVariableA" + rva: 70164 + - name: "SetLastError" + rva: 70168 + - name: "SetUnhandledExceptionFilter" + rva: 70172 + - name: "WaitForSingleObject" + rva: 70176 + - library_name: "msvcrt.dll" + number_of_functions: 38 + functions: + - name: "__getmainargs" + rva: 70188 + - name: "__p__environ" + rva: 70192 + - name: "__p__fmode" + rva: 70196 + - name: "__set_app_type" + rva: 70200 + - name: "_cexit" + rva: 70204 + - name: "_chdir" + rva: 70208 + - name: "_close" + rva: 70212 + - name: "_findclose" + rva: 70216 + - name: "_findfirst" + rva: 70220 + - name: "_findnext" + rva: 70224 + - name: "_iob" + rva: 70228 + - name: "_itoa" + rva: 70232 + - name: "_onexit" + rva: 70236 + - name: "_open" + rva: 70240 + - name: "_read" + rva: 70244 + - name: "_setmode" + rva: 70248 + - name: "_stat" + rva: 70252 + - name: "atexit" + rva: 70256 + - name: "atoi" + rva: 70260 + - name: "fclose" + rva: 70264 + - name: "fopen" + rva: 70268 + - name: "fprintf" + rva: 70272 + - name: "fwrite" + rva: 70276 + - name: "memset" + rva: 70280 + - name: "printf" + rva: 70284 + - name: "puts" + rva: 70288 + - name: "signal" + rva: 70292 + - name: "strcat" + rva: 70296 + - name: "strchr" + rva: 70300 + - name: "strcmp" + rva: 70304 + - name: "strcpy" + rva: 70308 + - name: "strlen" + rva: 70312 + - name: "strncat" + rva: 70316 + - name: "strncpy" + rva: 70320 + - name: "strpbrk" + rva: 70324 + - name: "strrchr" + rva: 70328 + - name: "strstr" + rva: 70332 + - name: "strtok" + rva: 70336 + - library_name: "SHELL32.DLL" + number_of_functions: 1 + functions: + - name: "ShellExecuteA" + rva: 70348 + - library_name: "USER32.dll" + number_of_functions: 1 + functions: + - name: "MessageBoxA" + rva: 70360 +is_signed: true +signatures: + - subject: "/C=DE/L=Berlin/O=Open Source/OU=JSIDPlay2/CN=JSIDPlay2" + issuer: "/C=DE/L=Berlin/O=Open Source/OU=JSIDPlay2/CN=JSIDPlay2" + thumbprint: "758bc86feadbd23a2c8fbdaa63779115eadbd905" + version: 3 + algorithm: "dsa_with_SHA256" + algorithm_oid: "2.16.840.1.101.3.4.3.2" + serial: "33:82:2c:5d" + not_before: 1655157631 # 2022-06-13 22:00:31 UTC + not_after: 1686693631 # 2023-06-13 22:00:31 UTC + verified: true + digest_alg: "sha256" + digest: "066dd89dfe23283d2feb029bcec19c31e41082584d57bd9940bfcafb83419677" + file_digest: "066dd89dfe23283d2feb029bcec19c31e41082584d57bd9940bfcafb83419677" + number_of_certificates: 1 + number_of_countersignatures: 0 + signer_info: + program_name: "JSIDPlay2" + digest: "01a9b8d4bb48229806d6425d6a1aed0dbdd55f8aaaa6c92c2a450902187abc34" + digest_alg: "sha256" + chain: + - issuer: "/C=DE/L=Berlin/O=Open Source/OU=JSIDPlay2/CN=JSIDPlay2" + subject: "/C=DE/L=Berlin/O=Open Source/OU=JSIDPlay2/CN=JSIDPlay2" + thumbprint: "758bc86feadbd23a2c8fbdaa63779115eadbd905" + version: 3 + algorithm: "dsa_with_SHA256" + algorithm_oid: "2.16.840.1.101.3.4.3.2" + serial: "33:82:2c:5d" + not_before: 1655157631 # 2022-06-13 22:00:31 UTC + not_after: 1686693631 # 2023-06-13 22:00:31 UTC + certificates: + - issuer: "/C=DE/L=Berlin/O=Open Source/OU=JSIDPlay2/CN=JSIDPlay2" + subject: "/C=DE/L=Berlin/O=Open Source/OU=JSIDPlay2/CN=JSIDPlay2" + thumbprint: "758bc86feadbd23a2c8fbdaa63779115eadbd905" + version: 3 + algorithm: "dsa_with_SHA256" + algorithm_oid: "2.16.840.1.101.3.4.3.2" + serial: "33:82:2c:5d" + not_before: 1655157631 # 2022-06-13 22:00:31 UTC + not_after: 1686693631 # 2023-06-13 22:00:31 UTC +overlay: + offset: 290816 + size: 1760 \ No newline at end of file diff --git a/lib/src/modules/pe/tests/testdata/6d3bbd6f3b6e11d83526c08e3ccdf0663afed2728226ad5ec6707d4dd7d2e64e.in.zip b/lib/src/modules/pe/tests/testdata/6d3bbd6f3b6e11d83526c08e3ccdf0663afed2728226ad5ec6707d4dd7d2e64e.in.zip new file mode 100644 index 000000000..e228e5ba3 Binary files /dev/null and b/lib/src/modules/pe/tests/testdata/6d3bbd6f3b6e11d83526c08e3ccdf0663afed2728226ad5ec6707d4dd7d2e64e.in.zip differ diff --git a/lib/src/modules/pe/tests/testdata/6d3bbd6f3b6e11d83526c08e3ccdf0663afed2728226ad5ec6707d4dd7d2e64e.out b/lib/src/modules/pe/tests/testdata/6d3bbd6f3b6e11d83526c08e3ccdf0663afed2728226ad5ec6707d4dd7d2e64e.out new file mode 100644 index 000000000..23c5760ed --- /dev/null +++ b/lib/src/modules/pe/tests/testdata/6d3bbd6f3b6e11d83526c08e3ccdf0663afed2728226ad5ec6707d4dd7d2e64e.out @@ -0,0 +1,299 @@ +is_pe: true +machine: MACHINE_AMD64 +subsystem: SUBSYSTEM_WINDOWS_GUI +os_version: + major: 4 + minor: 0 +subsystem_version: + major: 6 + minor: 0 +image_version: + major: 0 + minor: 0 +linker_version: + major: 48 + minor: 0 +opthdr_magic: IMAGE_NT_OPTIONAL_HDR64_MAGIC +characteristics: 34 +dll_characteristics: 34144 +timestamp: 1712829193 # 2024-04-11 09:53:13 UTC +image_base: 5368709120 +checksum: 36819 +base_of_code: 8192 +entry_point: 0 +entry_point_raw: 0 +section_alignment: 8192 +file_alignment: 512 +loader_flags: 0 +size_of_optional_header: 240 +size_of_code: 2560 +size_of_initialized_data: 2048 +size_of_uninitialized_data: 0 +size_of_image: 24576 +size_of_headers: 512 +size_of_stack_reserve: 4194304 +size_of_stack_commit: 16384 +size_of_heap_reserve: 1048576 +size_of_heap_commit: 8192 +pointer_to_symbol_table: 0 +win32_version_value: 0 +number_of_symbols: 0 +number_of_rva_and_sizes: 16 +number_of_sections: 2 +number_of_imported_functions: 0 +number_of_delayed_imported_functions: 0 +number_of_resources: 2 +number_of_version_infos: 11 +number_of_imports: 0 +number_of_delayed_imports: 0 +number_of_exports: 0 +number_of_signatures: 1 +version_info: + "Assembly Version": "5.6.0.1" + "Comments": "Continuous Testing Tool for .NET" + "CompanyName": "Remco Software Ltd" + "FileDescription": " " + "FileVersion": "5.6.0.1" + "InternalName": "nCrunch.TaskRunner46.x64.exe" + "LegalCopyright": "© 2010-2024 Remco Software Ltd" + "LegalTrademarks": "" + "OriginalFilename": "nCrunch.TaskRunner46.x64.exe" + "ProductName": "NCrunch" + "ProductVersion": "5.6.0.1" +version_info_list: + - key: "Comments" + value: "Continuous Testing Tool for .NET" + - key: "CompanyName" + value: "Remco Software Ltd" + - key: "FileDescription" + value: " " + - key: "FileVersion" + value: "5.6.0.1" + - key: "InternalName" + value: "nCrunch.TaskRunner46.x64.exe" + - key: "LegalCopyright" + value: "© 2010-2024 Remco Software Ltd" + - key: "LegalTrademarks" + value: "" + - key: "OriginalFilename" + value: "nCrunch.TaskRunner46.x64.exe" + - key: "ProductName" + value: "NCrunch" + - key: "ProductVersion" + value: "5.6.0.1" + - key: "Assembly Version" + value: "5.6.0.1" +pdb_path: "D:\\BuildAgent\\work\\31f27687fbb308be\\nCrunch.TaskRunner\\46.x64\\obj\\x64\\Release\\nCrunch.TaskRunner46.x64.pdb" +sections: + - name: ".text" + full_name: ".text" + characteristics: 1610612768 + raw_data_size: 2560 + raw_data_offset: 512 + virtual_address: 8192 + virtual_size: 2260 + pointer_to_relocations: 0 + pointer_to_line_numbers: 0 + number_of_relocations: 0 + number_of_line_numbers: 0 + - name: ".rsrc" + full_name: ".rsrc" + characteristics: 1073741888 + raw_data_size: 2048 + raw_data_offset: 3072 + virtual_address: 16384 + virtual_size: 1624 + pointer_to_relocations: 0 + pointer_to_line_numbers: 0 + number_of_relocations: 0 + number_of_line_numbers: 0 +data_directories: + - virtual_address: 0 + size: 0 + - virtual_address: 0 + size: 0 + - virtual_address: 16384 + size: 1624 + - virtual_address: 0 + size: 0 + - virtual_address: 5120 + size: 9064 + - virtual_address: 0 + size: 0 + - virtual_address: 10140 + size: 28 + - virtual_address: 0 + size: 0 + - virtual_address: 0 + size: 0 + - virtual_address: 0 + size: 0 + - virtual_address: 0 + size: 0 + - virtual_address: 0 + size: 0 + - virtual_address: 0 + size: 0 + - virtual_address: 0 + size: 0 + - virtual_address: 8192 + size: 72 + - virtual_address: 0 + size: 0 +resource_timestamp: 0 # 1970-01-01 00:00:00 UTC +resource_version: + major: 0 + minor: 0 +resources: + - length: 968 + rva: 16528 + offset: 3216 + type: RESOURCE_TYPE_VERSION + id: 1 + language: 0 + - length: 490 + rva: 17512 + offset: 4200 + type: RESOURCE_TYPE_MANIFEST + id: 1 + language: 0 +is_signed: true +signatures: + - subject: "/C=NZ/ST=Auckland/O=Remco Software Ltd/CN=Remco Software Ltd" + issuer: "/C=GB/O=Sectigo Limited/CN=Sectigo Public Code Signing CA E36" + thumbprint: "e8fe81981a0fc85d3ce02b09b88d6e6c08dfca5e" + version: 3 + algorithm: "ecdsa-with-SHA256" + algorithm_oid: "1.2.840.10045.4.3.2" + serial: "66:44:c2:5e:50:8b:bf:5f:a1:b1:e4:30:be:02:6a:3d" + not_before: 1683158400 # 2023-05-04 00:00:00 UTC + not_after: 1785801599 # 2026-08-03 23:59:59 UTC + verified: true + digest_alg: "sha1" + digest: "060371e73bbdc18a21434b222a5e4de53bdb7127" + file_digest: "060371e73bbdc18a21434b222a5e4de53bdb7127" + number_of_certificates: 6 + number_of_countersignatures: 1 + signer_info: + program_name: "NCrunch for Visual Studio" + digest: "8bae3e1a555b4f3c0c1e8eb44a9f19d024e95357" + digest_alg: "sha1" + chain: + - issuer: "/C=GB/O=Sectigo Limited/CN=Sectigo Public Code Signing CA E36" + subject: "/C=NZ/ST=Auckland/O=Remco Software Ltd/CN=Remco Software Ltd" + thumbprint: "e8fe81981a0fc85d3ce02b09b88d6e6c08dfca5e" + version: 3 + algorithm: "ecdsa-with-SHA256" + algorithm_oid: "1.2.840.10045.4.3.2" + serial: "66:44:c2:5e:50:8b:bf:5f:a1:b1:e4:30:be:02:6a:3d" + not_before: 1683158400 # 2023-05-04 00:00:00 UTC + not_after: 1785801599 # 2026-08-03 23:59:59 UTC + - issuer: "/C=GB/O=Sectigo Limited/CN=Sectigo Public Code Signing Root E46" + subject: "/C=GB/O=Sectigo Limited/CN=Sectigo Public Code Signing CA E36" + thumbprint: "418293b3ee931f1452bca30e4a587e7124853e86" + version: 3 + algorithm: "ecdsa-with-SHA384" + algorithm_oid: "1.2.840.10045.4.3.3" + serial: "36:02:61:76:36:e7:03:4b:9c:c1:fc:5f:fe:ac:2d:54" + not_before: 1616371200 # 2021-03-22 00:00:00 UTC + not_after: 2089756799 # 2036-03-21 23:59:59 UTC + - issuer: "/C=GB/ST=Greater Manchester/L=Salford/O=Comodo CA Limited/CN=AAA Certificate Services" + subject: "/C=GB/O=Sectigo Limited/CN=Sectigo Public Code Signing Root E46" + thumbprint: "b50cb42cacc0ebe698fe39cbd48b481a5a16851f" + version: 3 + algorithm: "sha384WithRSAEncryption" + algorithm_oid: "1.2.840.113549.1.1.12" + serial: "00:d5:b3:60:02:89:59:a2:7f:84:65:c9:e6:b1:8d:ba:cb" + not_before: 1677542400 # 2023-02-28 00:00:00 UTC + not_after: 1861919999 # 2028-12-31 23:59:59 UTC + certificates: + - issuer: "/C=GB/O=Sectigo Limited/CN=Sectigo Public Code Signing Root E46" + subject: "/C=GB/O=Sectigo Limited/CN=Sectigo Public Code Signing CA E36" + thumbprint: "418293b3ee931f1452bca30e4a587e7124853e86" + version: 3 + algorithm: "ecdsa-with-SHA384" + algorithm_oid: "1.2.840.10045.4.3.3" + serial: "36:02:61:76:36:e7:03:4b:9c:c1:fc:5f:fe:ac:2d:54" + not_before: 1616371200 # 2021-03-22 00:00:00 UTC + not_after: 2089756799 # 2036-03-21 23:59:59 UTC + - issuer: "/C=GB/O=Sectigo Limited/CN=Sectigo Public Code Signing CA E36" + subject: "/C=NZ/ST=Auckland/O=Remco Software Ltd/CN=Remco Software Ltd" + thumbprint: "e8fe81981a0fc85d3ce02b09b88d6e6c08dfca5e" + version: 3 + algorithm: "ecdsa-with-SHA256" + algorithm_oid: "1.2.840.10045.4.3.2" + serial: "66:44:c2:5e:50:8b:bf:5f:a1:b1:e4:30:be:02:6a:3d" + not_before: 1683158400 # 2023-05-04 00:00:00 UTC + not_after: 1785801599 # 2026-08-03 23:59:59 UTC + - issuer: "/C=GB/ST=Greater Manchester/L=Salford/O=Comodo CA Limited/CN=AAA Certificate Services" + subject: "/C=GB/O=Sectigo Limited/CN=Sectigo Public Code Signing Root E46" + thumbprint: "b50cb42cacc0ebe698fe39cbd48b481a5a16851f" + version: 3 + algorithm: "sha384WithRSAEncryption" + algorithm_oid: "1.2.840.113549.1.1.12" + serial: "00:d5:b3:60:02:89:59:a2:7f:84:65:c9:e6:b1:8d:ba:cb" + not_before: 1677542400 # 2023-02-28 00:00:00 UTC + not_after: 1861919999 # 2028-12-31 23:59:59 UTC + - issuer: "/C=US/O=DigiCert, Inc./CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA" + subject: "/C=US/O=DigiCert, Inc./CN=DigiCert Timestamp 2023" + thumbprint: "66f02b32c2c2c90f825dceaa8ac9c64f199ccf40" + version: 3 + algorithm: "sha256WithRSAEncryption" + algorithm_oid: "1.2.840.113549.1.1.11" + serial: "05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16" + not_before: 1689292800 # 2023-07-14 00:00:00 UTC + not_after: 2044396799 # 2034-10-13 23:59:59 UTC + - issuer: "/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert Trusted Root G4" + subject: "/C=US/O=DigiCert, Inc./CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA" + thumbprint: "b6c8af834d4e53b673c76872aa8c950c7c54df5f" + version: 3 + algorithm: "sha256WithRSAEncryption" + algorithm_oid: "1.2.840.113549.1.1.11" + serial: "07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b" + not_before: 1647993600 # 2022-03-23 00:00:00 UTC + not_after: 2121379199 # 2037-03-22 23:59:59 UTC + - issuer: "/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert Assured ID Root CA" + subject: "/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert Trusted Root G4" + thumbprint: "a99d5b79e9f1cda59cdab6373169d5353f5874c6" + version: 3 + algorithm: "sha384WithRSAEncryption" + algorithm_oid: "1.2.840.113549.1.1.12" + serial: "0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a" + not_before: 1659312000 # 2022-08-01 00:00:00 UTC + not_after: 1952035199 # 2031-11-09 23:59:59 UTC + countersignatures: + - verified: true + sign_time: 1712829194 # 2024-04-11 09:53:14 UTC + digest: "5dd8b869f1aacca4797503e081f18b033049faf1" + digest_alg: "sha1" + chain: + - issuer: "/C=US/O=DigiCert, Inc./CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA" + subject: "/C=US/O=DigiCert, Inc./CN=DigiCert Timestamp 2023" + thumbprint: "66f02b32c2c2c90f825dceaa8ac9c64f199ccf40" + version: 3 + algorithm: "sha256WithRSAEncryption" + algorithm_oid: "1.2.840.113549.1.1.11" + serial: "05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16" + not_before: 1689292800 # 2023-07-14 00:00:00 UTC + not_after: 2044396799 # 2034-10-13 23:59:59 UTC + - issuer: "/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert Trusted Root G4" + subject: "/C=US/O=DigiCert, Inc./CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA" + thumbprint: "b6c8af834d4e53b673c76872aa8c950c7c54df5f" + version: 3 + algorithm: "sha256WithRSAEncryption" + algorithm_oid: "1.2.840.113549.1.1.11" + serial: "07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b" + not_before: 1647993600 # 2022-03-23 00:00:00 UTC + not_after: 2121379199 # 2037-03-22 23:59:59 UTC + - issuer: "/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert Assured ID Root CA" + subject: "/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert Trusted Root G4" + thumbprint: "a99d5b79e9f1cda59cdab6373169d5353f5874c6" + version: 3 + algorithm: "sha384WithRSAEncryption" + algorithm_oid: "1.2.840.113549.1.1.12" + serial: "0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a" + not_before: 1659312000 # 2022-08-01 00:00:00 UTC + not_after: 1952035199 # 2031-11-09 23:59:59 UTC +overlay: + offset: 5120 + size: 9064 \ No newline at end of file diff --git a/lib/src/modules/pe/tests/testdata/70211a3f90376bbc61f49c22a63075d1d4ddd53f0aefa976216c46e6ba39a9f4.in.zip b/lib/src/modules/pe/tests/testdata/70211a3f90376bbc61f49c22a63075d1d4ddd53f0aefa976216c46e6ba39a9f4.in.zip new file mode 100644 index 000000000..a5ace81cd Binary files /dev/null and b/lib/src/modules/pe/tests/testdata/70211a3f90376bbc61f49c22a63075d1d4ddd53f0aefa976216c46e6ba39a9f4.in.zip differ diff --git a/lib/src/modules/pe/tests/testdata/70211a3f90376bbc61f49c22a63075d1d4ddd53f0aefa976216c46e6ba39a9f4.out b/lib/src/modules/pe/tests/testdata/70211a3f90376bbc61f49c22a63075d1d4ddd53f0aefa976216c46e6ba39a9f4.out new file mode 100644 index 000000000..1ac50de2e --- /dev/null +++ b/lib/src/modules/pe/tests/testdata/70211a3f90376bbc61f49c22a63075d1d4ddd53f0aefa976216c46e6ba39a9f4.out @@ -0,0 +1,634 @@ +is_pe: true +machine: MACHINE_AMD64 +subsystem: SUBSYSTEM_NATIVE +os_version: + major: 6 + minor: 1 +subsystem_version: + major: 6 + minor: 1 +image_version: + major: 6 + minor: 1 +linker_version: + major: 9 + minor: 0 +opthdr_magic: IMAGE_NT_OPTIONAL_HDR64_MAGIC +characteristics: 34 +dll_characteristics: 0 +timestamp: 1459189242 # 2016-03-28 18:20:42 UTC +image_base: 65536 +checksum: 81108 +base_of_code: 4096 +entry_point: 23652 +entry_point_raw: 36964 +section_alignment: 4096 +file_alignment: 512 +loader_flags: 0 +size_of_optional_header: 240 +size_of_code: 21504 +size_of_initialized_data: 5632 +size_of_uninitialized_data: 0 +size_of_image: 45056 +size_of_headers: 1024 +size_of_stack_reserve: 262144 +size_of_stack_commit: 4096 +size_of_heap_reserve: 1048576 +size_of_heap_commit: 4096 +pointer_to_symbol_table: 0 +win32_version_value: 0 +number_of_symbols: 0 +number_of_rva_and_sizes: 16 +number_of_sections: 7 +number_of_imported_functions: 83 +number_of_delayed_imported_functions: 0 +number_of_resources: 1 +number_of_version_infos: 7 +number_of_imports: 2 +number_of_delayed_imports: 0 +number_of_exports: 0 +number_of_signatures: 2 +version_info: + "CompanyName": "wj32" + "FileDescription": "KProcessHacker" + "FileVersion": "3.0" + "LegalCopyright": "Licensed under the GNU GPL, v3." + "OriginalFilename": "kprocesshacker.sys" + "ProductName": "KProcessHacker" + "ProductVersion": "3.0" +version_info_list: + - key: "CompanyName" + value: "wj32" + - key: "FileDescription" + value: "KProcessHacker" + - key: "FileVersion" + value: "3.0" + - key: "LegalCopyright" + value: "Licensed under the GNU GPL, v3." + - key: "OriginalFilename" + value: "kprocesshacker.sys" + - key: "ProductName" + value: "KProcessHacker" + - key: "ProductVersion" + value: "3.0" +rich_signature: + offset: 128 + length: 72 + key: 4259651297 + raw_data: "\xa5\x7f\x8b\xae\xe1\x1e\xe5\xfd\xe1\x1e\xe5\xfd\xe1\x1e\xe5\xfd\xe1\x1e\xe4\xfd\xb5\x1e\xe5\xfd\xe8fv\xfd\xe4\x1e\xe5\xfd\xe8fp\xfd\xe2\x1e\xe5\xfd\xe8ff\xfd\xe4\x1e\xe5\xfd\xe8fl\xfd\xea\x1e\xe5\xfd\xe8fq\xfd\xe0\x1e\xe5\xfd\xe8ft\xfd\xe0\x1e\xe5\xfd" + clear_data: "DanS\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00T\x00\x00\x00\tx\x93\x00\x05\x00\x00\x00\tx\x95\x00\x03\x00\x00\x00\tx\x83\x00\x05\x00\x00\x00\tx\x89\x00\x0b\x00\x00\x00\tx\x94\x00\x01\x00\x00\x00\tx\x91\x00\x01\x00\x00\x00" + tools: + - toolid: 1 + version: 0 + times: 84 + - toolid: 147 + version: 30729 + times: 5 + - toolid: 149 + version: 30729 + times: 3 + - toolid: 131 + version: 30729 + times: 5 + - toolid: 137 + version: 30729 + times: 11 + - toolid: 148 + version: 30729 + times: 1 + - toolid: 145 + version: 30729 + times: 1 +pdb_path: "d:\\projects\\processhacker2\\kprocesshacker\\bin\\amd64\\kprocesshacker.pdb" +sections: + - name: ".text" + full_name: ".text" + characteristics: 1744830496 + raw_data_size: 4096 + raw_data_offset: 1024 + virtual_address: 4096 + virtual_size: 4000 + pointer_to_relocations: 0 + pointer_to_line_numbers: 0 + number_of_relocations: 0 + number_of_line_numbers: 0 + - name: ".rdata" + full_name: ".rdata" + characteristics: 1207959616 + raw_data_size: 2560 + raw_data_offset: 5120 + virtual_address: 8192 + virtual_size: 2516 + pointer_to_relocations: 0 + pointer_to_line_numbers: 0 + number_of_relocations: 0 + number_of_line_numbers: 0 + - name: ".data" + full_name: ".data" + characteristics: 3355443264 + raw_data_size: 512 + raw_data_offset: 7680 + virtual_address: 12288 + virtual_size: 728 + pointer_to_relocations: 0 + pointer_to_line_numbers: 0 + number_of_relocations: 0 + number_of_line_numbers: 0 + - name: ".pdata" + full_name: ".pdata" + characteristics: 1207959616 + raw_data_size: 1024 + raw_data_offset: 8192 + virtual_address: 16384 + virtual_size: 564 + pointer_to_relocations: 0 + pointer_to_line_numbers: 0 + number_of_relocations: 0 + number_of_line_numbers: 0 + - name: "PAGE" + full_name: "PAGE" + characteristics: 1610612768 + raw_data_size: 14336 + raw_data_offset: 9216 + virtual_address: 20480 + virtual_size: 13902 + pointer_to_relocations: 0 + pointer_to_line_numbers: 0 + number_of_relocations: 0 + number_of_line_numbers: 0 + - name: "INIT" + full_name: "INIT" + characteristics: 3791650848 + raw_data_size: 3072 + raw_data_offset: 23552 + virtual_address: 36864 + virtual_size: 2720 + pointer_to_relocations: 0 + pointer_to_line_numbers: 0 + number_of_relocations: 0 + number_of_line_numbers: 0 + - name: ".rsrc" + full_name: ".rsrc" + characteristics: 1107296320 + raw_data_size: 1024 + raw_data_offset: 26624 + virtual_address: 40960 + virtual_size: 760 + pointer_to_relocations: 0 + pointer_to_line_numbers: 0 + number_of_relocations: 0 + number_of_line_numbers: 0 +data_directories: + - virtual_address: 0 + size: 0 + - virtual_address: 36996 + size: 60 + - virtual_address: 40960 + size: 760 + - virtual_address: 16384 + size: 564 + - virtual_address: 27648 + size: 17560 + - virtual_address: 0 + size: 0 + - virtual_address: 8880 + size: 28 + - virtual_address: 0 + size: 0 + - virtual_address: 0 + size: 0 + - virtual_address: 0 + size: 0 + - virtual_address: 0 + size: 0 + - virtual_address: 0 + size: 0 + - virtual_address: 8192 + size: 680 + - virtual_address: 0 + size: 0 + - virtual_address: 0 + size: 0 + - virtual_address: 0 + size: 0 +resource_timestamp: 0 # 1970-01-01 00:00:00 UTC +resource_version: + major: 0 + minor: 0 +resources: + - length: 664 + rva: 41056 + offset: 26720 + type: RESOURCE_TYPE_VERSION + id: 1 + language: 1033 +import_details: + - library_name: "ntoskrnl.exe" + number_of_functions: 73 + functions: + - name: "SePrivilegeCheck" + rva: 8280 + - name: "ZwOpenKey" + rva: 8288 + - name: "ProbeForRead" + rva: 8296 + - name: "RtlGetVersion" + rva: 8304 + - name: "PsProcessType" + rva: 8312 + - name: "ObOpenObjectByName" + rva: 8320 + - name: "ObGetObjectType" + rva: 8328 + - name: "PsReleaseProcessExitSynchronization" + rva: 8336 + - name: "ZwQueryObject" + rva: 8344 + - name: "RtlEqualUnicodeString" + rva: 8352 + - name: "KeUnstackDetachProcess" + rva: 8360 + - name: "ExEnumHandleTable" + rva: 8368 + - name: "ObQueryNameString" + rva: 8376 + - name: "IoFileObjectType" + rva: 8384 + - name: "IoDriverObjectType" + rva: 8392 + - name: "ExfUnblockPushLock" + rva: 8400 + - name: "ObReferenceObjectByHandle" + rva: 8408 + - name: "PsAcquireProcessExitSynchronization" + rva: 8416 + - name: "PsInitialSystemProcess" + rva: 8424 + - name: "ObSetHandleAttributes" + rva: 8432 + - name: "ZwQueryInformationProcess" + rva: 8440 + - name: "ObfDereferenceObject" + rva: 8448 + - name: "ExAllocatePoolWithQuotaTag" + rva: 8456 + - name: "ZwQueryInformationThread" + rva: 8464 + - name: "ObOpenObjectByPointer" + rva: 8472 + - name: "KeStackAttachProcess" + rva: 8480 + - name: "PsLookupProcessByProcessId" + rva: 8488 + - name: "PsJobType" + rva: 8496 + - name: "PsReferencePrimaryToken" + rva: 8504 + - name: "SeTokenObjectType" + rva: 8512 + - name: "IoCreateDevice" + rva: 8520 + - name: "PsGetProcessJob" + rva: 8528 + - name: "PsLookupProcessThreadByCid" + rva: 8536 + - name: "ZwTerminateProcess" + rva: 8544 + - name: "PsDereferencePrimaryToken" + rva: 8552 + - name: "IoThreadToProcess" + rva: 8560 + - name: "RtlWalkFrameChain" + rva: 8568 + - name: "KeInitializeApc" + rva: 8576 + - name: "KeSetEvent" + rva: 8584 + - name: "KeInsertQueueApc" + rva: 8592 + - name: "KeWaitForSingleObject" + rva: 8600 + - name: "PsThreadType" + rva: 8608 + - name: "PsLookupThreadByThreadId" + rva: 8616 + - name: "ZwQuerySystemInformation" + rva: 8624 + - name: "ZwQueryVirtualMemory" + rva: 8632 + - name: "ExReleaseFastMutex" + rva: 8640 + - name: "ExAcquireFastMutex" + rva: 8648 + - name: "ZwReadFile" + rva: 8656 + - name: "MmHighestUserAddress" + rva: 8664 + - name: "SeLocateProcessImageName" + rva: 8672 + - name: "KeDelayExecutionThread" + rva: 8680 + - name: "ZwCreateFile" + rva: 8688 + - name: "RtlRandomEx" + rva: 8696 + - name: "ZwQueryInformationFile" + rva: 8704 + - name: "MmUnmapLockedPages" + rva: 8712 + - name: "ExRaiseStatus" + rva: 8720 + - name: "MmMapLockedPagesSpecifyCache" + rva: 8728 + - name: "MmProbeAndLockPages" + rva: 8736 + - name: "MmUnlockPages" + rva: 8744 + - name: "MmIsAddressValid" + rva: 8752 + - name: "KeBugCheckEx" + rva: 8760 + - name: "PsGetCurrentProcessId" + rva: 8768 + - name: "IofCompleteRequest" + rva: 8776 + - name: "ZwClose" + rva: 8784 + - name: "ZwQueryValueKey" + rva: 8792 + - name: "KeInitializeEvent" + rva: 8800 + - name: "ProbeForWrite" + rva: 8808 + - name: "IoDeleteDevice" + rva: 8816 + - name: "RtlInitUnicodeString" + rva: 8824 + - name: "ExFreePoolWithTag" + rva: 8832 + - name: "IoGetCurrentProcess" + rva: 8840 + - name: "ExAllocatePoolWithTag" + rva: 8848 + - name: "__C_specific_handler" + rva: 8856 + - library_name: "ksecdd.sys" + number_of_functions: 10 + functions: + - name: "BCryptCreateHash" + rva: 8192 + - name: "BCryptDestroyKey" + rva: 8200 + - name: "BCryptImportKeyPair" + rva: 8208 + - name: "BCryptCloseAlgorithmProvider" + rva: 8216 + - name: "BCryptVerifySignature" + rva: 8224 + - name: "BCryptFinishHash" + rva: 8232 + - name: "BCryptHashData" + rva: 8240 + - name: "BCryptDestroyHash" + rva: 8248 + - name: "BCryptOpenAlgorithmProvider" + rva: 8256 + - name: "BCryptGetProperty" + rva: 8264 +is_signed: true +signatures: + - subject: "/C=AU/ST=New South Wales/L=Sydney/O=Wen Jia Liu/CN=Wen Jia Liu" + issuer: "/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert High Assurance Code Signing CA-1" + thumbprint: "32387aec09eb287f202e98398189b460f4c61a0d" + version: 3 + algorithm: "sha1WithRSAEncryption" + algorithm_oid: "1.2.840.113549.1.1.5" + serial: "0f:f1:ef:66:bd:62:1c:65:b7:4b:4d:e4:14:25:71:7f" + not_before: 1383091200 # 2013-10-30 00:00:00 UTC + not_after: 1483531200 # 2017-01-04 12:00:00 UTC + verified: true + digest_alg: "sha1" + digest: "c2b8c1b34f09a91efe196f646ef7f9a11190fb8e" + file_digest: "c2b8c1b34f09a91efe196f646ef7f9a11190fb8e" + number_of_certificates: 5 + number_of_countersignatures: 1 + signer_info: + digest: "9bb6c4bf0a838bf7ea75e48e9e82581deb6d48ed" + digest_alg: "sha1" + chain: + - issuer: "/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert High Assurance Code Signing CA-1" + subject: "/C=AU/ST=New South Wales/L=Sydney/O=Wen Jia Liu/CN=Wen Jia Liu" + thumbprint: "32387aec09eb287f202e98398189b460f4c61a0d" + version: 3 + algorithm: "sha1WithRSAEncryption" + algorithm_oid: "1.2.840.113549.1.1.5" + serial: "0f:f1:ef:66:bd:62:1c:65:b7:4b:4d:e4:14:25:71:7f" + not_before: 1383091200 # 2013-10-30 00:00:00 UTC + not_after: 1483531200 # 2017-01-04 12:00:00 UTC + - issuer: "/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert High Assurance EV Root CA" + subject: "/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert High Assurance Code Signing CA-1" + thumbprint: "e308f829dc77e80af15edd4151ea47c59399ab46" + version: 3 + algorithm: "sha1WithRSAEncryption" + algorithm_oid: "1.2.840.113549.1.1.5" + serial: "02:c4:d1:e5:8a:4a:68:0c:56:8d:a3:04:7e:7e:4d:5f" + not_before: 1297425600 # 2011-02-11 12:00:00 UTC + not_after: 1770724800 # 2026-02-10 12:00:00 UTC + - issuer: "/C=US/ST=Washington/L=Redmond/O=Microsoft Corporation/CN=Microsoft Code Verification Root" + subject: "/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert High Assurance EV Root CA" + thumbprint: "2f2513af3992db0a3f79709ff8143b3f7bd2d143" + version: 3 + algorithm: "sha1WithRSAEncryption" + algorithm_oid: "1.2.840.113549.1.1.5" + serial: "61:20:4d:b4:00:00:00:00:00:27" + not_before: 1302896733 # 2011-04-15 19:45:33 UTC + not_after: 1618516533 # 2021-04-15 19:55:33 UTC + certificates: + - issuer: "/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert High Assurance Code Signing CA-1" + subject: "/C=AU/ST=New South Wales/L=Sydney/O=Wen Jia Liu/CN=Wen Jia Liu" + thumbprint: "32387aec09eb287f202e98398189b460f4c61a0d" + version: 3 + algorithm: "sha1WithRSAEncryption" + algorithm_oid: "1.2.840.113549.1.1.5" + serial: "0f:f1:ef:66:bd:62:1c:65:b7:4b:4d:e4:14:25:71:7f" + not_before: 1383091200 # 2013-10-30 00:00:00 UTC + not_after: 1483531200 # 2017-01-04 12:00:00 UTC + - issuer: "/C=US/ST=Washington/L=Redmond/O=Microsoft Corporation/CN=Microsoft Code Verification Root" + subject: "/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert High Assurance EV Root CA" + thumbprint: "2f2513af3992db0a3f79709ff8143b3f7bd2d143" + version: 3 + algorithm: "sha1WithRSAEncryption" + algorithm_oid: "1.2.840.113549.1.1.5" + serial: "61:20:4d:b4:00:00:00:00:00:27" + not_before: 1302896733 # 2011-04-15 19:45:33 UTC + not_after: 1618516533 # 2021-04-15 19:55:33 UTC + - issuer: "/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert Assured ID CA-1" + subject: "/C=US/O=DigiCert/CN=DigiCert Timestamp Responder" + thumbprint: "614d271d9102e30169822487fde5de00a352b01d" + version: 3 + algorithm: "sha1WithRSAEncryption" + algorithm_oid: "1.2.840.113549.1.1.5" + serial: "03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66" + not_before: 1413936000 # 2014-10-22 00:00:00 UTC + not_after: 1729555200 # 2024-10-22 00:00:00 UTC + - issuer: "/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert High Assurance EV Root CA" + subject: "/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert High Assurance Code Signing CA-1" + thumbprint: "e308f829dc77e80af15edd4151ea47c59399ab46" + version: 3 + algorithm: "sha1WithRSAEncryption" + algorithm_oid: "1.2.840.113549.1.1.5" + serial: "02:c4:d1:e5:8a:4a:68:0c:56:8d:a3:04:7e:7e:4d:5f" + not_before: 1297425600 # 2011-02-11 12:00:00 UTC + not_after: 1770724800 # 2026-02-10 12:00:00 UTC + - issuer: "/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert Assured ID Root CA" + subject: "/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert Assured ID CA-1" + thumbprint: "19a09b5a36f4dd99727df783c17a51231a56c117" + version: 3 + algorithm: "sha1WithRSAEncryption" + algorithm_oid: "1.2.840.113549.1.1.5" + serial: "06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b" + not_before: 1163116800 # 2006-11-10 00:00:00 UTC + not_after: 1636502400 # 2021-11-10 00:00:00 UTC + countersignatures: + - verified: true + sign_time: 1459189265 # 2016-03-28 18:21:05 UTC + digest: "e0e1b26a21dda2a4d57236182a51cd3162e502fa" + digest_alg: "sha1" + chain: + - issuer: "/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert Assured ID CA-1" + subject: "/C=US/O=DigiCert/CN=DigiCert Timestamp Responder" + thumbprint: "614d271d9102e30169822487fde5de00a352b01d" + version: 3 + algorithm: "sha1WithRSAEncryption" + algorithm_oid: "1.2.840.113549.1.1.5" + serial: "03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66" + not_before: 1413936000 # 2014-10-22 00:00:00 UTC + not_after: 1729555200 # 2024-10-22 00:00:00 UTC + - issuer: "/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert Assured ID Root CA" + subject: "/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert Assured ID CA-1" + thumbprint: "19a09b5a36f4dd99727df783c17a51231a56c117" + version: 3 + algorithm: "sha1WithRSAEncryption" + algorithm_oid: "1.2.840.113549.1.1.5" + serial: "06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b" + not_before: 1163116800 # 2006-11-10 00:00:00 UTC + not_after: 1636502400 # 2021-11-10 00:00:00 UTC + - subject: "/C=AU/ST=New South Wales/L=Sydney/O=Wen Jia Liu/CN=Wen Jia Liu" + issuer: "/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert SHA2 High Assurance Code Signing CA" + thumbprint: "190d956129dde6972d46f46ef98bd86b982e6633" + version: 3 + algorithm: "sha256WithRSAEncryption" + algorithm_oid: "1.2.840.113549.1.1.11" + serial: "04:0c:b4:1e:4f:b3:70:c4:5c:43:44:76:51:62:58:2f" + not_before: 1383091200 # 2013-10-30 00:00:00 UTC + not_after: 1483531200 # 2017-01-04 12:00:00 UTC + verified: true + digest_alg: "sha256" + digest: "4ee2a56c1592ff0e951b452c0de064eba05b7c98e3add04c8aa3b4a84eb797a5" + file_digest: "4ee2a56c1592ff0e951b452c0de064eba05b7c98e3add04c8aa3b4a84eb797a5" + number_of_certificates: 5 + number_of_countersignatures: 1 + signer_info: + digest: "1939ad5ec9ec5c1ac5b360973aadb5b2308b8e98f36f9684bc874b56b67d6657" + digest_alg: "sha256" + chain: + - issuer: "/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert SHA2 High Assurance Code Signing CA" + subject: "/C=AU/ST=New South Wales/L=Sydney/O=Wen Jia Liu/CN=Wen Jia Liu" + thumbprint: "190d956129dde6972d46f46ef98bd86b982e6633" + version: 3 + algorithm: "sha256WithRSAEncryption" + algorithm_oid: "1.2.840.113549.1.1.11" + serial: "04:0c:b4:1e:4f:b3:70:c4:5c:43:44:76:51:62:58:2f" + not_before: 1383091200 # 2013-10-30 00:00:00 UTC + not_after: 1483531200 # 2017-01-04 12:00:00 UTC + - issuer: "/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert High Assurance EV Root CA" + subject: "/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert SHA2 High Assurance Code Signing CA" + thumbprint: "f7e0f449f1a2594f88856c0758f8e6f627e5f5a2" + version: 3 + algorithm: "sha256WithRSAEncryption" + algorithm_oid: "1.2.840.113549.1.1.11" + serial: "0b:7e:10:90:3c:38:49:0f:fa:2f:67:9a:87:a1:a7:b9" + not_before: 1382443200 # 2013-10-22 12:00:00 UTC + not_after: 1855828800 # 2028-10-22 12:00:00 UTC + - issuer: "/C=US/ST=Washington/L=Redmond/O=Microsoft Corporation/CN=Microsoft Code Verification Root" + subject: "/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert High Assurance EV Root CA" + thumbprint: "2f2513af3992db0a3f79709ff8143b3f7bd2d143" + version: 3 + algorithm: "sha1WithRSAEncryption" + algorithm_oid: "1.2.840.113549.1.1.5" + serial: "61:20:4d:b4:00:00:00:00:00:27" + not_before: 1302896733 # 2011-04-15 19:45:33 UTC + not_after: 1618516533 # 2021-04-15 19:55:33 UTC + certificates: + - issuer: "/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert SHA2 High Assurance Code Signing CA" + subject: "/C=AU/ST=New South Wales/L=Sydney/O=Wen Jia Liu/CN=Wen Jia Liu" + thumbprint: "190d956129dde6972d46f46ef98bd86b982e6633" + version: 3 + algorithm: "sha256WithRSAEncryption" + algorithm_oid: "1.2.840.113549.1.1.11" + serial: "04:0c:b4:1e:4f:b3:70:c4:5c:43:44:76:51:62:58:2f" + not_before: 1383091200 # 2013-10-30 00:00:00 UTC + not_after: 1483531200 # 2017-01-04 12:00:00 UTC + - issuer: "/C=US/ST=Washington/L=Redmond/O=Microsoft Corporation/CN=Microsoft Code Verification Root" + subject: "/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert High Assurance EV Root CA" + thumbprint: "2f2513af3992db0a3f79709ff8143b3f7bd2d143" + version: 3 + algorithm: "sha1WithRSAEncryption" + algorithm_oid: "1.2.840.113549.1.1.5" + serial: "61:20:4d:b4:00:00:00:00:00:27" + not_before: 1302896733 # 2011-04-15 19:45:33 UTC + not_after: 1618516533 # 2021-04-15 19:55:33 UTC + - issuer: "/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert High Assurance EV Root CA" + subject: "/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert SHA2 High Assurance Code Signing CA" + thumbprint: "f7e0f449f1a2594f88856c0758f8e6f627e5f5a2" + version: 3 + algorithm: "sha256WithRSAEncryption" + algorithm_oid: "1.2.840.113549.1.1.11" + serial: "0b:7e:10:90:3c:38:49:0f:fa:2f:67:9a:87:a1:a7:b9" + not_before: 1382443200 # 2013-10-22 12:00:00 UTC + not_after: 1855828800 # 2028-10-22 12:00:00 UTC + - issuer: "/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert SHA2 Assured ID Timestamping CA" + subject: "/C=US/O=DigiCert, Inc./CN=DigiCert SHA2 Timestamp Responder" + thumbprint: "c636f4dda87cee3d8263bf9a2514b4533468d75e" + version: 3 + algorithm: "sha256WithRSAEncryption" + algorithm_oid: "1.2.840.113549.1.1.11" + serial: "02:ce:42:94:59:02:a4:f3:c0:40:b0:ff:77:93:d1:4f" + not_before: 1450915200 # 2015-12-24 00:00:00 UTC + not_after: 1736208000 # 2025-01-07 00:00:00 UTC + - issuer: "/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert Assured ID Root CA" + subject: "/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert SHA2 Assured ID Timestamping CA" + thumbprint: "3ba63a6e4841355772debef9cdcf4d5af353a297" + version: 3 + algorithm: "sha256WithRSAEncryption" + algorithm_oid: "1.2.840.113549.1.1.11" + serial: "0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15" + not_before: 1452168000 # 2016-01-07 12:00:00 UTC + not_after: 1925553600 # 2031-01-07 12:00:00 UTC + countersignatures: + - verified: true + sign_time: 1459189265 # 2016-03-28 18:21:05 UTC + digest: "8d2adfc11c43947d5ea6b7e81429acf0429930be60fd70c41c26e8e7c5b17aee" + digest_alg: "sha256" + chain: + - issuer: "/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert SHA2 Assured ID Timestamping CA" + subject: "/C=US/O=DigiCert, Inc./CN=DigiCert SHA2 Timestamp Responder" + thumbprint: "c636f4dda87cee3d8263bf9a2514b4533468d75e" + version: 3 + algorithm: "sha256WithRSAEncryption" + algorithm_oid: "1.2.840.113549.1.1.11" + serial: "02:ce:42:94:59:02:a4:f3:c0:40:b0:ff:77:93:d1:4f" + not_before: 1450915200 # 2015-12-24 00:00:00 UTC + not_after: 1736208000 # 2025-01-07 00:00:00 UTC + - issuer: "/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert Assured ID Root CA" + subject: "/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert SHA2 Assured ID Timestamping CA" + thumbprint: "3ba63a6e4841355772debef9cdcf4d5af353a297" + version: 3 + algorithm: "sha256WithRSAEncryption" + algorithm_oid: "1.2.840.113549.1.1.11" + serial: "0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15" + not_before: 1452168000 # 2016-01-07 12:00:00 UTC + not_after: 1925553600 # 2031-01-07 12:00:00 UTC +overlay: + offset: 27648 + size: 17560 \ No newline at end of file diff --git a/lib/src/modules/pe/tests/testdata/7bd1de9bcd32c628d326e7647645c6df8c1ed548b36888e95f8a5b581fc4b35e.in.zip b/lib/src/modules/pe/tests/testdata/7bd1de9bcd32c628d326e7647645c6df8c1ed548b36888e95f8a5b581fc4b35e.in.zip new file mode 100644 index 000000000..aa8597e12 Binary files /dev/null and b/lib/src/modules/pe/tests/testdata/7bd1de9bcd32c628d326e7647645c6df8c1ed548b36888e95f8a5b581fc4b35e.in.zip differ diff --git a/lib/src/modules/pe/tests/testdata/7bd1de9bcd32c628d326e7647645c6df8c1ed548b36888e95f8a5b581fc4b35e.out b/lib/src/modules/pe/tests/testdata/7bd1de9bcd32c628d326e7647645c6df8c1ed548b36888e95f8a5b581fc4b35e.out new file mode 100644 index 000000000..bff43dde0 --- /dev/null +++ b/lib/src/modules/pe/tests/testdata/7bd1de9bcd32c628d326e7647645c6df8c1ed548b36888e95f8a5b581fc4b35e.out @@ -0,0 +1,295 @@ +is_pe: true +machine: MACHINE_AMD64 +subsystem: SUBSYSTEM_WINDOWS_GUI +os_version: + major: 6 + minor: 0 +subsystem_version: + major: 6 + minor: 0 +image_version: + major: 0 + minor: 0 +linker_version: + major: 14 + minor: 38 +opthdr_magic: IMAGE_NT_OPTIONAL_HDR64_MAGIC +characteristics: 8226 +dll_characteristics: 352 +timestamp: 1709628808 # 2024-03-05 08:53:28 UTC +image_base: 6442450944 +checksum: 59800 +base_of_code: 4096 +entry_point: 1024 +entry_point_raw: 4096 +dll_name: "vcruntime140_1.dll" +export_timestamp: 4294967295 # 2106-02-07 06:28:15 UTC +section_alignment: 4096 +file_alignment: 512 +loader_flags: 0 +size_of_optional_header: 240 +size_of_code: 1024 +size_of_initialized_data: 5632 +size_of_uninitialized_data: 0 +size_of_image: 24576 +size_of_headers: 1024 +size_of_stack_reserve: 1048576 +size_of_stack_commit: 4096 +size_of_heap_reserve: 1048576 +size_of_heap_commit: 4096 +pointer_to_symbol_table: 0 +win32_version_value: 0 +number_of_symbols: 0 +number_of_rva_and_sizes: 16 +number_of_sections: 5 +number_of_imported_functions: 10 +number_of_delayed_imported_functions: 0 +number_of_resources: 2 +number_of_version_infos: 8 +number_of_imports: 2 +number_of_delayed_imports: 0 +number_of_exports: 3 +number_of_signatures: 1 +version_info: + "CompanyName": "TEAM R2R" + "FileDescription": "Witches\' Magic For Ableton Live" + "FileVersion": "1.0.0.1" + "InternalName": "vcruntime140_1.dll" + "LegalCopyright": "Copyright (C) 2024 TEAM R2R" + "OriginalFilename": "vcruntime140_1.dll" + "ProductName": "Witches\' Magic For Ableton Live" + "ProductVersion": "1.0.0.1" +version_info_list: + - key: "CompanyName" + value: "TEAM R2R" + - key: "FileDescription" + value: "Witches\' Magic For Ableton Live" + - key: "FileVersion" + value: "1.0.0.1" + - key: "InternalName" + value: "vcruntime140_1.dll" + - key: "LegalCopyright" + value: "Copyright (C) 2024 TEAM R2R" + - key: "OriginalFilename" + value: "vcruntime140_1.dll" + - key: "ProductName" + value: "Witches\' Magic For Ableton Live" + - key: "ProductVersion" + value: "1.0.0.1" +rich_signature: + offset: 128 + length: 72 + key: 3048884457 + raw_data: "\xad)\xd4\xe6\xe9H\xba\xb5\xe9H\xba\xb5\xe9H\xba\xb5\xa20\xbb\xb4\xecH\xba\xb5\xe9H\xbb\xb5\xe3H\xba\xb5\x84\xc9\xbe\xb4\xe8H\xba\xb5\x84\xc9\xba\xb4\xe8H\xba\xb5\x84\xc9E\xb5\xe8H\xba\xb5\xe9H-\xb5\xe8H\xba\xb5\x84\xc9\xb8\xb4\xe8H\xba\xb5" + clear_data: "DanS\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00Kx\x01\x01\x05\x00\x00\x00\x00\x00\x01\x00\n\x00\x00\x00m\x81\x04\x01\x01\x00\x00\x00m\x81\x00\x01\x01\x00\x00\x00m\x81\xff\x00\x01\x00\x00\x00\x00\x00\x97\x00\x01\x00\x00\x00m\x81\x02\x01\x01\x00\x00\x00" + tools: + - toolid: 257 + version: 30795 + times: 5 + - toolid: 1 + version: 0 + times: 10 + - toolid: 260 + version: 33133 + times: 1 + - toolid: 256 + version: 33133 + times: 1 + - toolid: 255 + version: 33133 + times: 1 + - toolid: 151 + version: 0 + times: 1 + - toolid: 258 + version: 33133 + times: 1 +sections: + - name: ".text" + full_name: ".text" + characteristics: 1610612768 + raw_data_size: 1024 + raw_data_offset: 1024 + virtual_address: 4096 + virtual_size: 602 + pointer_to_relocations: 0 + pointer_to_line_numbers: 0 + number_of_relocations: 0 + number_of_line_numbers: 0 + - name: ".rdata" + full_name: ".rdata" + characteristics: 1073741888 + raw_data_size: 3072 + raw_data_offset: 2048 + virtual_address: 8192 + virtual_size: 2862 + pointer_to_relocations: 0 + pointer_to_line_numbers: 0 + number_of_relocations: 0 + number_of_line_numbers: 0 + - name: ".data" + full_name: ".data" + characteristics: 3221225536 + raw_data_size: 512 + raw_data_offset: 5120 + virtual_address: 12288 + virtual_size: 104 + pointer_to_relocations: 0 + pointer_to_line_numbers: 0 + number_of_relocations: 0 + number_of_line_numbers: 0 + - name: ".pdata" + full_name: ".pdata" + characteristics: 1073741888 + raw_data_size: 512 + raw_data_offset: 5632 + virtual_address: 16384 + virtual_size: 36 + pointer_to_relocations: 0 + pointer_to_line_numbers: 0 + number_of_relocations: 0 + number_of_line_numbers: 0 + - name: ".rsrc" + full_name: ".rsrc" + characteristics: 1073741888 + raw_data_size: 1536 + raw_data_offset: 6144 + virtual_address: 20480 + virtual_size: 1360 + pointer_to_relocations: 0 + pointer_to_line_numbers: 0 + number_of_relocations: 0 + number_of_line_numbers: 0 +data_directories: + - virtual_address: 10560 + size: 140 + - virtual_address: 10700 + size: 60 + - virtual_address: 20480 + size: 1360 + - virtual_address: 16384 + size: 36 + - virtual_address: 7680 + size: 1432 + - virtual_address: 0 + size: 0 + - virtual_address: 10144 + size: 28 + - virtual_address: 0 + size: 0 + - virtual_address: 0 + size: 0 + - virtual_address: 0 + size: 0 + - virtual_address: 0 + size: 0 + - virtual_address: 0 + size: 0 + - virtual_address: 8192 + size: 96 + - virtual_address: 0 + size: 0 + - virtual_address: 0 + size: 0 + - virtual_address: 0 + size: 0 +resource_timestamp: 0 # 1970-01-01 00:00:00 UTC +resource_version: + major: 0 + minor: 0 +resources: + - length: 816 + rva: 20640 + offset: 6304 + type: RESOURCE_TYPE_VERSION + id: 1 + language: 1033 + - length: 381 + rva: 21456 + offset: 7120 + type: RESOURCE_TYPE_MANIFEST + id: 2 + language: 1033 +import_details: + - library_name: "SHLWAPI.dll" + number_of_functions: 1 + functions: + - name: "PathStripPathW" + rva: 8272 + - library_name: "KERNEL32.dll" + number_of_functions: 9 + functions: + - name: "GetModuleHandleA" + rva: 8192 + - name: "lstrcatW" + rva: 8200 + - name: "GetSystemDirectoryW" + rva: 8208 + - name: "VirtualProtect" + rva: 8216 + - name: "FreeLibrary" + rva: 8224 + - name: "GetModuleFileNameW" + rva: 8232 + - name: "LoadLibraryW" + rva: 8240 + - name: "GetProcAddress" + rva: 8248 + - name: "lstrcmpW" + rva: 8256 +export_details: + - name: "__CxxFrameHandler4" + ordinal: 1 + rva: 4140 + offset: 1068 + - name: "__NLG_Dispatch2" + ordinal: 2 + rva: 4148 + offset: 1076 + - name: "__NLG_Return2" + ordinal: 3 + rva: 4156 + offset: 1084 +is_signed: true +signatures: + - subject: "/C=JP/O=R2R/CN=R2R" + issuer: "/CN=R2RCA" + thumbprint: "004d47889e493832b4fe1db48e95ba7c0dcaa83a" + version: 3 + algorithm: "sha512WithRSAEncryption" + algorithm_oid: "1.2.840.113549.1.1.13" + serial: "a2:30:db:c7:17:28:5b:a2:4d:01:a0:7d:03:79:12:ce" + not_before: 1609426800 # 2020-12-31 15:00:00 UTC + not_after: 4102326000 # 2099-12-30 15:00:00 UTC + verified: true + digest_alg: "sha512" + digest: "9d8c6f3e677451a7a20c4b7ec6d0b27f8247483f2024a27c8e29c29cd8d8354e3cf2f206c262403bb2fda6112596f2ededd0a5d4af365f81da47c20aa7564b2f" + file_digest: "9d8c6f3e677451a7a20c4b7ec6d0b27f8247483f2024a27c8e29c29cd8d8354e3cf2f206c262403bb2fda6112596f2ededd0a5d4af365f81da47c20aa7564b2f" + number_of_certificates: 1 + number_of_countersignatures: 0 + signer_info: + digest: "b4db2dd0c6c7f015cbdbc469536fc4665d9f0c16fdc3fc73e7d49bfb97ac4dcbdd194a4614a2bbb80c8b1632ba0c0d80bf2cedd6f51497010ad6fd87f05c8882" + digest_alg: "sha512" + chain: + - issuer: "/CN=R2RCA" + subject: "/C=JP/O=R2R/CN=R2R" + thumbprint: "004d47889e493832b4fe1db48e95ba7c0dcaa83a" + version: 3 + algorithm: "sha512WithRSAEncryption" + algorithm_oid: "1.2.840.113549.1.1.13" + serial: "a2:30:db:c7:17:28:5b:a2:4d:01:a0:7d:03:79:12:ce" + not_before: 1609426800 # 2020-12-31 15:00:00 UTC + not_after: 4102326000 # 2099-12-30 15:00:00 UTC + certificates: + - issuer: "/CN=R2RCA" + subject: "/C=JP/O=R2R/CN=R2R" + thumbprint: "004d47889e493832b4fe1db48e95ba7c0dcaa83a" + version: 3 + algorithm: "sha512WithRSAEncryption" + algorithm_oid: "1.2.840.113549.1.1.13" + serial: "a2:30:db:c7:17:28:5b:a2:4d:01:a0:7d:03:79:12:ce" + not_before: 1609426800 # 2020-12-31 15:00:00 UTC + not_after: 4102326000 # 2099-12-30 15:00:00 UTC +overlay: + offset: 7680 + size: 1432 \ No newline at end of file diff --git a/lib/src/modules/pe/tests/testdata/9d8196aa4afce055daa9edb3130efa9e3ddb8b19f6d664e95f8d0e103866ea22.in.zip b/lib/src/modules/pe/tests/testdata/9d8196aa4afce055daa9edb3130efa9e3ddb8b19f6d664e95f8d0e103866ea22.in.zip new file mode 100644 index 000000000..5dc363988 Binary files /dev/null and b/lib/src/modules/pe/tests/testdata/9d8196aa4afce055daa9edb3130efa9e3ddb8b19f6d664e95f8d0e103866ea22.in.zip differ diff --git a/lib/src/modules/pe/tests/testdata/9d8196aa4afce055daa9edb3130efa9e3ddb8b19f6d664e95f8d0e103866ea22.out b/lib/src/modules/pe/tests/testdata/9d8196aa4afce055daa9edb3130efa9e3ddb8b19f6d664e95f8d0e103866ea22.out new file mode 100644 index 000000000..340c5af3a --- /dev/null +++ b/lib/src/modules/pe/tests/testdata/9d8196aa4afce055daa9edb3130efa9e3ddb8b19f6d664e95f8d0e103866ea22.out @@ -0,0 +1,18221 @@ +is_pe: true +machine: MACHINE_AMD64 +subsystem: SUBSYSTEM_WINDOWS_GUI +os_version: + major: 6 + minor: 0 +subsystem_version: + major: 6 + minor: 0 +image_version: + major: 0 + minor: 0 +linker_version: + major: 14 + minor: 34 +opthdr_magic: IMAGE_NT_OPTIONAL_HDR64_MAGIC +characteristics: 8226 +dll_characteristics: 352 +timestamp: 1700014107 # 2023-11-15 02:08:27 UTC +image_base: 65536 +checksum: 274295 +base_of_code: 4096 +entry_point: 29256 +entry_point_raw: 32328 +dll_name: "AVEDLL.dll" +export_timestamp: 4294967295 # 2106-02-07 06:28:15 UTC +section_alignment: 4096 +file_alignment: 512 +loader_flags: 0 +size_of_optional_header: 240 +size_of_code: 83968 +size_of_initialized_data: 84992 +size_of_uninitialized_data: 0 +size_of_image: 188416 +size_of_headers: 1024 +size_of_stack_reserve: 262144 +size_of_stack_commit: 4096 +size_of_heap_reserve: 1048576 +size_of_heap_commit: 4096 +pointer_to_symbol_table: 0 +win32_version_value: 0 +number_of_symbols: 0 +number_of_rva_and_sizes: 16 +number_of_sections: 7 +number_of_imported_functions: 79 +number_of_delayed_imported_functions: 0 +number_of_resources: 1 +number_of_version_infos: 19 +number_of_imports: 5 +number_of_delayed_imports: 0 +number_of_exports: 5800 +number_of_signatures: 4 +version_info: + "AHEVC Version": "AHEVC_VERSION_MAJOR.AHEVC_VERSION_MINOR" + "AVE Version": "18.4" + "CompanyName": "Advanced Micro Devices, Inc. " + "DEM Version": "6.0" + "Description": "Radeon Longhorn x64 AMD AVE Driver Component" + "ENCR Version": "1.0" + "FileDescription": "Radeon AMD AVE Driver Component" + "FileVersion": "18.4.6.0" + "InternalName": "amdave64.dll" + "LegalCopyright": "Copyright (c) 2009 Advanced Micro Devices, Inc." + "LegalTrademarks": "Radeon (TM) is a Trademark of Advanced Micro Devices, Inc." + "OriginalFilename": "amdave64.dll" + "PrivateBuild": "Built by foreman on ps-wbm-608 on 11/14/23 at 21:08" + "ProductName": "Advanced Micro Devices, Inc. Radeon AMD AVE Driver Component" + "ProductVersion": "18.4.6.0" + "SpecialBuild": "DevStudio Build" + "UVEASW Version": "1.2" + "UVEH264 Version": "17.2" + "UVEHEVC Version": "16.0" +version_info_list: + - key: "CompanyName" + value: "Advanced Micro Devices, Inc. " + - key: "Description" + value: "Radeon Longhorn x64 AMD AVE Driver Component" + - key: "FileDescription" + value: "Radeon AMD AVE Driver Component" + - key: "FileVersion" + value: "18.4.6.0" + - key: "InternalName" + value: "amdave64.dll" + - key: "LegalCopyright" + value: "Copyright (c) 2009 Advanced Micro Devices, Inc." + - key: "LegalTrademarks" + value: "Radeon (TM) is a Trademark of Advanced Micro Devices, Inc." + - key: "OriginalFilename" + value: "amdave64.dll" + - key: "PrivateBuild" + value: "Built by foreman on ps-wbm-608 on 11/14/23 at 21:08" + - key: "ProductName" + value: "Advanced Micro Devices, Inc. Radeon AMD AVE Driver Component" + - key: "ProductVersion" + value: "18.4.6.0" + - key: "SpecialBuild" + value: "DevStudio Build" + - key: "AVE Version" + value: "18.4" + - key: "DEM Version" + value: "6.0" + - key: "UVEHEVC Version" + value: "16.0" + - key: "UVEH264 Version" + value: "17.2" + - key: "AHEVC Version" + value: "AHEVC_VERSION_MAJOR.AHEVC_VERSION_MINOR" + - key: "ENCR Version" + value: "1.0" + - key: "UVEASW Version" + value: "1.2" +rich_signature: + offset: 128 + length: 112 + key: 1232202501 + raw_data: "A\x8a\x1f\x1a\x05\xebqI\x05\xebqI\x05\xebqIV\x94tH\x83\xebqIJ\x97tH$\xebqIJ\x97uH\t\xebqIJ\x97rH\r\xebqIV\x94rH\x03\xebqIV\x94pH\x0e\xebqI\x05\xebpId\xebqIV\x94uH\t\xebqI\xb8\x97xH\x10\xebqI\xb8\x97qH\x04\xebqI\xb8\x97\x8eI\x04\xebqI\xb8\x97sH\x04\xebqI" + clear_data: "DanS\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00S\x7f\x05\x01\x86\x00\x00\x00O|\x05\x01!\x00\x00\x00O|\x04\x01\x0c\x00\x00\x00O|\x03\x01\x08\x00\x00\x00S\x7f\x03\x01\x06\x00\x00\x00S\x7f\x01\x01\x0b\x00\x00\x00\x00\x00\x01\x00a\x00\x00\x00S\x7f\x04\x01\x0c\x00\x00\x00\xbd|\t\x01\x15\x00\x00\x00\xbd|\x00\x01\x01\x00\x00\x00\xbd|\xff\x00\x01\x00\x00\x00\xbd|\x02\x01\x01\x00\x00\x00" + tools: + - toolid: 261 + version: 32595 + times: 134 + - toolid: 261 + version: 31823 + times: 33 + - toolid: 260 + version: 31823 + times: 12 + - toolid: 259 + version: 31823 + times: 8 + - toolid: 259 + version: 32595 + times: 6 + - toolid: 257 + version: 32595 + times: 11 + - toolid: 1 + version: 0 + times: 97 + - toolid: 260 + version: 32595 + times: 12 + - toolid: 265 + version: 31933 + times: 21 + - toolid: 256 + version: 31933 + times: 1 + - toolid: 255 + version: 31933 + times: 1 + - toolid: 258 + version: 31933 + times: 1 +pdb_path: "c:\\constructicon\\builds\\gfx\\seven\\23.20\\drivers\\dx\\shared\\mva_vhd\\ave\\dll\\build\\wNow64a\\B_rel\\amduve64.pdb" +sections: + - name: ".text" + full_name: ".text" + characteristics: 1610612768 + raw_data_size: 83968 + raw_data_offset: 1024 + virtual_address: 4096 + virtual_size: 83600 + pointer_to_relocations: 0 + pointer_to_line_numbers: 0 + number_of_relocations: 0 + number_of_line_numbers: 0 + - name: ".rdata" + full_name: ".rdata" + characteristics: 1073741888 + raw_data_size: 66048 + raw_data_offset: 84992 + virtual_address: 90112 + virtual_size: 65578 + pointer_to_relocations: 0 + pointer_to_line_numbers: 0 + number_of_relocations: 0 + number_of_line_numbers: 0 + - name: ".data" + full_name: ".data" + characteristics: 3221225536 + raw_data_size: 3072 + raw_data_offset: 151040 + virtual_address: 159744 + virtual_size: 7536 + pointer_to_relocations: 0 + pointer_to_line_numbers: 0 + number_of_relocations: 0 + number_of_line_numbers: 0 + - name: ".pdata" + full_name: ".pdata" + characteristics: 1073741888 + raw_data_size: 6656 + raw_data_offset: 154112 + virtual_address: 167936 + virtual_size: 6564 + pointer_to_relocations: 0 + pointer_to_line_numbers: 0 + number_of_relocations: 0 + number_of_line_numbers: 0 + - name: "_RDATA" + full_name: "_RDATA" + characteristics: 1073741888 + raw_data_size: 512 + raw_data_offset: 160768 + virtual_address: 176128 + virtual_size: 348 + pointer_to_relocations: 0 + pointer_to_line_numbers: 0 + number_of_relocations: 0 + number_of_line_numbers: 0 + - name: ".rsrc" + full_name: ".rsrc" + characteristics: 1073741888 + raw_data_size: 2048 + raw_data_offset: 161280 + virtual_address: 180224 + virtual_size: 1912 + pointer_to_relocations: 0 + pointer_to_line_numbers: 0 + number_of_relocations: 0 + number_of_line_numbers: 0 + - name: ".reloc" + full_name: ".reloc" + characteristics: 1107296320 + raw_data_size: 2048 + raw_data_offset: 163328 + virtual_address: 184320 + virtual_size: 1656 + pointer_to_relocations: 0 + pointer_to_line_numbers: 0 + number_of_relocations: 0 + number_of_line_numbers: 0 +data_directories: + - virtual_address: 130112 + size: 23252 + - virtual_address: 153364 + size: 120 + - virtual_address: 180224 + size: 1912 + - virtual_address: 167936 + size: 6564 + - virtual_address: 165376 + size: 44192 + - virtual_address: 184320 + size: 1656 + - virtual_address: 121536 + size: 112 + - virtual_address: 0 + size: 0 + - virtual_address: 0 + size: 0 + - virtual_address: 0 + size: 0 + - virtual_address: 121216 + size: 320 + - virtual_address: 0 + size: 0 + - virtual_address: 90112 + size: 672 + - virtual_address: 0 + size: 0 + - virtual_address: 0 + size: 0 + - virtual_address: 0 + size: 0 +resource_timestamp: 0 # 1970-01-01 00:00:00 UTC +resource_version: + major: 0 + minor: 0 +resources: + - length: 1812 + rva: 180320 + offset: 161376 + type: RESOURCE_TYPE_VERSION + id: 1 + language: 1033 +import_details: + - library_name: "KERNEL32.dll" + number_of_functions: 75 + functions: + - name: "VerifyVersionInfoA" + rva: 90112 + - name: "VerSetConditionMask" + rva: 90120 + - name: "LoadLibraryA" + rva: 90128 + - name: "GetProcAddress" + rva: 90136 + - name: "CloseHandle" + rva: 90144 + - name: "CreateFileW" + rva: 90152 + - name: "SetFilePointerEx" + rva: 90160 + - name: "GetConsoleMode" + rva: 90168 + - name: "GetConsoleOutputCP" + rva: 90176 + - name: "QueryPerformanceCounter" + rva: 90184 + - name: "GetCurrentProcessId" + rva: 90192 + - name: "GetCurrentThreadId" + rva: 90200 + - name: "GetSystemTimeAsFileTime" + rva: 90208 + - name: "InitializeSListHead" + rva: 90216 + - name: "RtlCaptureContext" + rva: 90224 + - name: "RtlLookupFunctionEntry" + rva: 90232 + - name: "RtlVirtualUnwind" + rva: 90240 + - name: "IsDebuggerPresent" + rva: 90248 + - name: "UnhandledExceptionFilter" + rva: 90256 + - name: "SetUnhandledExceptionFilter" + rva: 90264 + - name: "GetStartupInfoW" + rva: 90272 + - name: "IsProcessorFeaturePresent" + rva: 90280 + - name: "GetModuleHandleW" + rva: 90288 + - name: "RtlUnwindEx" + rva: 90296 + - name: "RtlPcToFileHeader" + rva: 90304 + - name: "RaiseException" + rva: 90312 + - name: "InterlockedFlushSList" + rva: 90320 + - name: "GetLastError" + rva: 90328 + - name: "SetLastError" + rva: 90336 + - name: "EnterCriticalSection" + rva: 90344 + - name: "LeaveCriticalSection" + rva: 90352 + - name: "DeleteCriticalSection" + rva: 90360 + - name: "InitializeCriticalSectionAndSpinCount" + rva: 90368 + - name: "TlsAlloc" + rva: 90376 + - name: "TlsGetValue" + rva: 90384 + - name: "TlsSetValue" + rva: 90392 + - name: "TlsFree" + rva: 90400 + - name: "FreeLibrary" + rva: 90408 + - name: "LoadLibraryExW" + rva: 90416 + - name: "EncodePointer" + rva: 90424 + - name: "GetCurrentProcess" + rva: 90432 + - name: "ExitProcess" + rva: 90440 + - name: "TerminateProcess" + rva: 90448 + - name: "GetModuleHandleExW" + rva: 90456 + - name: "GetModuleFileNameW" + rva: 90464 + - name: "HeapAlloc" + rva: 90472 + - name: "HeapFree" + rva: 90480 + - name: "FindClose" + rva: 90488 + - name: "FindFirstFileExW" + rva: 90496 + - name: "FindNextFileW" + rva: 90504 + - name: "IsValidCodePage" + rva: 90512 + - name: "GetACP" + rva: 90520 + - name: "GetOEMCP" + rva: 90528 + - name: "GetCPInfo" + rva: 90536 + - name: "GetCommandLineA" + rva: 90544 + - name: "GetCommandLineW" + rva: 90552 + - name: "MultiByteToWideChar" + rva: 90560 + - name: "WideCharToMultiByte" + rva: 90568 + - name: "GetEnvironmentStringsW" + rva: 90576 + - name: "FreeEnvironmentStringsW" + rva: 90584 + - name: "FlsAlloc" + rva: 90592 + - name: "FlsGetValue" + rva: 90600 + - name: "FlsSetValue" + rva: 90608 + - name: "FlsFree" + rva: 90616 + - name: "LCMapStringW" + rva: 90624 + - name: "GetProcessHeap" + rva: 90632 + - name: "GetStdHandle" + rva: 90640 + - name: "GetFileType" + rva: 90648 + - name: "GetStringTypeW" + rva: 90656 + - name: "HeapSize" + rva: 90664 + - name: "HeapReAlloc" + rva: 90672 + - name: "SetStdHandle" + rva: 90680 + - name: "FlushFileBuffers" + rva: 90688 + - name: "WriteFile" + rva: 90696 + - name: "WriteConsoleW" + rva: 90704 + - library_name: "USER32.dll" + number_of_functions: 1 + functions: + - name: "GetDesktopWindow" + rva: 90720 + - library_name: "dxva2.dll" + number_of_functions: 1 + functions: + - name: "DXVA2CreateVideoService" + rva: 90768 + - library_name: "d3d11.dll" + number_of_functions: 1 + functions: + - name: "D3D11CreateDevice" + rva: 90736 + - library_name: "dxgi.dll" + number_of_functions: 1 + functions: + - name: "CreateDXGIFactory" + rva: 90752 +export_details: + - ordinal: 1300 + rva: 8224 + offset: 5152 + - ordinal: 1301 + rva: 8848 + offset: 5776 + - ordinal: 1302 + rva: 10160 + offset: 7088 + - ordinal: 1303 + rva: 10288 + offset: 7216 + - ordinal: 1304 + rva: 10416 + offset: 7344 + - ordinal: 1305 + rva: 10544 + offset: 7472 + - ordinal: 1306 + rva: 10672 + offset: 7600 + - ordinal: 1307 + rva: 10800 + offset: 7728 + - ordinal: 1308 + rva: 10928 + offset: 7856 + - ordinal: 1309 + rva: 9072 + offset: 6000 + - ordinal: 1310 + rva: 0 + offset: 0 + - ordinal: 1311 + rva: 0 + offset: 0 + - ordinal: 1312 + rva: 0 + offset: 0 + - ordinal: 1313 + rva: 0 + offset: 0 + - ordinal: 1314 + rva: 0 + offset: 0 + - ordinal: 1315 + rva: 0 + offset: 0 + - ordinal: 1316 + rva: 0 + offset: 0 + - ordinal: 1317 + rva: 0 + offset: 0 + - ordinal: 1318 + rva: 0 + offset: 0 + - ordinal: 1319 + rva: 0 + offset: 0 + - ordinal: 1320 + rva: 0 + offset: 0 + - ordinal: 1321 + rva: 0 + offset: 0 + - ordinal: 1322 + rva: 0 + offset: 0 + - ordinal: 1323 + rva: 0 + offset: 0 + - ordinal: 1324 + rva: 0 + offset: 0 + - ordinal: 1325 + rva: 0 + offset: 0 + - ordinal: 1326 + rva: 0 + offset: 0 + - ordinal: 1327 + rva: 0 + offset: 0 + - ordinal: 1328 + rva: 0 + offset: 0 + - ordinal: 1329 + rva: 0 + offset: 0 + - ordinal: 1330 + rva: 0 + offset: 0 + - ordinal: 1331 + rva: 0 + offset: 0 + - ordinal: 1332 + rva: 0 + offset: 0 + - ordinal: 1333 + rva: 0 + offset: 0 + - ordinal: 1334 + rva: 0 + offset: 0 + - ordinal: 1335 + rva: 0 + offset: 0 + - ordinal: 1336 + rva: 0 + offset: 0 + - ordinal: 1337 + rva: 0 + offset: 0 + - ordinal: 1338 + rva: 0 + offset: 0 + - ordinal: 1339 + rva: 0 + offset: 0 + - ordinal: 1340 + rva: 0 + offset: 0 + - ordinal: 1341 + rva: 0 + offset: 0 + - ordinal: 1342 + rva: 0 + offset: 0 + - ordinal: 1343 + rva: 0 + offset: 0 + - ordinal: 1344 + rva: 0 + offset: 0 + - ordinal: 1345 + rva: 0 + offset: 0 + - ordinal: 1346 + rva: 0 + offset: 0 + - ordinal: 1347 + rva: 0 + offset: 0 + - ordinal: 1348 + rva: 0 + offset: 0 + - ordinal: 1349 + rva: 0 + offset: 0 + - ordinal: 1350 + rva: 0 + offset: 0 + - ordinal: 1351 + rva: 0 + offset: 0 + - ordinal: 1352 + rva: 0 + offset: 0 + - ordinal: 1353 + rva: 0 + offset: 0 + - ordinal: 1354 + rva: 0 + offset: 0 + - ordinal: 1355 + rva: 0 + offset: 0 + - ordinal: 1356 + rva: 0 + offset: 0 + - ordinal: 1357 + rva: 0 + offset: 0 + - ordinal: 1358 + rva: 0 + offset: 0 + - ordinal: 1359 + rva: 0 + offset: 0 + - ordinal: 1360 + rva: 0 + offset: 0 + - ordinal: 1361 + rva: 0 + offset: 0 + - ordinal: 1362 + rva: 0 + offset: 0 + - ordinal: 1363 + rva: 0 + offset: 0 + - ordinal: 1364 + rva: 0 + offset: 0 + - ordinal: 1365 + rva: 0 + offset: 0 + - ordinal: 1366 + rva: 0 + offset: 0 + - ordinal: 1367 + rva: 0 + offset: 0 + - ordinal: 1368 + rva: 0 + offset: 0 + - ordinal: 1369 + rva: 0 + offset: 0 + - ordinal: 1370 + rva: 0 + offset: 0 + - ordinal: 1371 + rva: 0 + offset: 0 + - ordinal: 1372 + rva: 0 + offset: 0 + - ordinal: 1373 + rva: 0 + offset: 0 + - ordinal: 1374 + rva: 0 + offset: 0 + - ordinal: 1375 + rva: 0 + offset: 0 + - ordinal: 1376 + rva: 0 + offset: 0 + - ordinal: 1377 + rva: 0 + offset: 0 + - ordinal: 1378 + rva: 0 + offset: 0 + - ordinal: 1379 + rva: 0 + offset: 0 + - ordinal: 1380 + rva: 0 + offset: 0 + - ordinal: 1381 + rva: 0 + offset: 0 + - ordinal: 1382 + rva: 0 + offset: 0 + - ordinal: 1383 + rva: 0 + offset: 0 + - ordinal: 1384 + rva: 0 + offset: 0 + - ordinal: 1385 + rva: 0 + offset: 0 + - ordinal: 1386 + rva: 0 + offset: 0 + - ordinal: 1387 + rva: 0 + offset: 0 + - ordinal: 1388 + rva: 0 + offset: 0 + - ordinal: 1389 + rva: 0 + offset: 0 + - ordinal: 1390 + rva: 0 + offset: 0 + - ordinal: 1391 + rva: 0 + offset: 0 + - ordinal: 1392 + rva: 0 + offset: 0 + - ordinal: 1393 + rva: 0 + offset: 0 + - ordinal: 1394 + rva: 0 + offset: 0 + - ordinal: 1395 + rva: 0 + offset: 0 + - ordinal: 1396 + rva: 0 + offset: 0 + - ordinal: 1397 + rva: 0 + offset: 0 + - ordinal: 1398 + rva: 0 + offset: 0 + - ordinal: 1399 + rva: 0 + offset: 0 + - ordinal: 1400 + rva: 0 + offset: 0 + - ordinal: 1401 + rva: 0 + offset: 0 + - ordinal: 1402 + rva: 0 + offset: 0 + - ordinal: 1403 + rva: 0 + offset: 0 + - ordinal: 1404 + rva: 0 + offset: 0 + - ordinal: 1405 + rva: 0 + offset: 0 + - ordinal: 1406 + rva: 0 + offset: 0 + - ordinal: 1407 + rva: 0 + offset: 0 + - ordinal: 1408 + rva: 0 + offset: 0 + - ordinal: 1409 + rva: 0 + offset: 0 + - ordinal: 1410 + rva: 0 + offset: 0 + - ordinal: 1411 + rva: 0 + offset: 0 + - ordinal: 1412 + rva: 0 + offset: 0 + - ordinal: 1413 + rva: 0 + offset: 0 + - ordinal: 1414 + rva: 0 + offset: 0 + - ordinal: 1415 + rva: 0 + offset: 0 + - ordinal: 1416 + rva: 0 + offset: 0 + - ordinal: 1417 + rva: 0 + offset: 0 + - ordinal: 1418 + rva: 0 + offset: 0 + - ordinal: 1419 + rva: 0 + offset: 0 + - ordinal: 1420 + rva: 0 + offset: 0 + - ordinal: 1421 + rva: 0 + offset: 0 + - ordinal: 1422 + rva: 0 + offset: 0 + - ordinal: 1423 + rva: 0 + offset: 0 + - ordinal: 1424 + rva: 0 + offset: 0 + - ordinal: 1425 + rva: 0 + offset: 0 + - ordinal: 1426 + rva: 0 + offset: 0 + - ordinal: 1427 + rva: 0 + offset: 0 + - ordinal: 1428 + rva: 0 + offset: 0 + - ordinal: 1429 + rva: 0 + offset: 0 + - ordinal: 1430 + rva: 0 + offset: 0 + - ordinal: 1431 + rva: 0 + offset: 0 + - ordinal: 1432 + rva: 0 + offset: 0 + - ordinal: 1433 + rva: 0 + offset: 0 + - ordinal: 1434 + rva: 0 + offset: 0 + - ordinal: 1435 + rva: 0 + offset: 0 + - ordinal: 1436 + rva: 0 + offset: 0 + - ordinal: 1437 + rva: 0 + offset: 0 + - ordinal: 1438 + rva: 0 + offset: 0 + - ordinal: 1439 + rva: 0 + offset: 0 + - ordinal: 1440 + rva: 0 + offset: 0 + - ordinal: 1441 + rva: 0 + offset: 0 + - ordinal: 1442 + rva: 0 + offset: 0 + - ordinal: 1443 + rva: 0 + offset: 0 + - ordinal: 1444 + rva: 0 + offset: 0 + - ordinal: 1445 + rva: 0 + offset: 0 + - ordinal: 1446 + rva: 0 + offset: 0 + - ordinal: 1447 + rva: 0 + offset: 0 + - ordinal: 1448 + rva: 0 + offset: 0 + - ordinal: 1449 + rva: 0 + offset: 0 + - ordinal: 1450 + rva: 0 + offset: 0 + - ordinal: 1451 + rva: 0 + offset: 0 + - ordinal: 1452 + rva: 0 + offset: 0 + - ordinal: 1453 + rva: 0 + offset: 0 + - ordinal: 1454 + rva: 0 + offset: 0 + - ordinal: 1455 + rva: 0 + offset: 0 + - ordinal: 1456 + rva: 0 + offset: 0 + - ordinal: 1457 + rva: 0 + offset: 0 + - ordinal: 1458 + rva: 0 + offset: 0 + - ordinal: 1459 + rva: 0 + offset: 0 + - ordinal: 1460 + rva: 0 + offset: 0 + - ordinal: 1461 + rva: 0 + offset: 0 + - ordinal: 1462 + rva: 0 + offset: 0 + - ordinal: 1463 + rva: 0 + offset: 0 + - ordinal: 1464 + rva: 0 + offset: 0 + - ordinal: 1465 + rva: 0 + offset: 0 + - ordinal: 1466 + rva: 0 + offset: 0 + - ordinal: 1467 + rva: 0 + offset: 0 + - ordinal: 1468 + rva: 0 + offset: 0 + - ordinal: 1469 + rva: 0 + offset: 0 + - ordinal: 1470 + rva: 0 + offset: 0 + - ordinal: 1471 + rva: 0 + offset: 0 + - ordinal: 1472 + rva: 0 + offset: 0 + - ordinal: 1473 + rva: 0 + offset: 0 + - ordinal: 1474 + rva: 0 + offset: 0 + - ordinal: 1475 + rva: 0 + offset: 0 + - ordinal: 1476 + rva: 0 + offset: 0 + - ordinal: 1477 + rva: 0 + offset: 0 + - ordinal: 1478 + rva: 0 + offset: 0 + - ordinal: 1479 + rva: 0 + offset: 0 + - ordinal: 1480 + rva: 0 + offset: 0 + - ordinal: 1481 + rva: 0 + offset: 0 + - ordinal: 1482 + rva: 0 + offset: 0 + - ordinal: 1483 + rva: 0 + offset: 0 + - ordinal: 1484 + rva: 0 + offset: 0 + - ordinal: 1485 + rva: 0 + offset: 0 + - ordinal: 1486 + rva: 0 + offset: 0 + - ordinal: 1487 + rva: 0 + offset: 0 + - ordinal: 1488 + rva: 0 + offset: 0 + - ordinal: 1489 + rva: 0 + offset: 0 + - ordinal: 1490 + rva: 0 + offset: 0 + - ordinal: 1491 + rva: 0 + offset: 0 + - ordinal: 1492 + rva: 0 + offset: 0 + - ordinal: 1493 + rva: 0 + offset: 0 + - ordinal: 1494 + rva: 0 + offset: 0 + - ordinal: 1495 + rva: 0 + offset: 0 + - ordinal: 1496 + rva: 0 + offset: 0 + - ordinal: 1497 + rva: 0 + offset: 0 + - ordinal: 1498 + rva: 0 + offset: 0 + - ordinal: 1499 + rva: 0 + offset: 0 + - ordinal: 1500 + rva: 0 + offset: 0 + - ordinal: 1501 + rva: 0 + offset: 0 + - ordinal: 1502 + rva: 0 + offset: 0 + - ordinal: 1503 + rva: 0 + offset: 0 + - ordinal: 1504 + rva: 0 + offset: 0 + - ordinal: 1505 + rva: 0 + offset: 0 + - ordinal: 1506 + rva: 0 + offset: 0 + - ordinal: 1507 + rva: 0 + offset: 0 + - ordinal: 1508 + rva: 0 + offset: 0 + - ordinal: 1509 + rva: 0 + offset: 0 + - ordinal: 1510 + rva: 0 + offset: 0 + - ordinal: 1511 + rva: 0 + offset: 0 + - ordinal: 1512 + rva: 0 + offset: 0 + - ordinal: 1513 + rva: 0 + offset: 0 + - ordinal: 1514 + rva: 0 + offset: 0 + - ordinal: 1515 + rva: 0 + offset: 0 + - ordinal: 1516 + rva: 0 + offset: 0 + - ordinal: 1517 + rva: 0 + offset: 0 + - ordinal: 1518 + rva: 0 + offset: 0 + - ordinal: 1519 + rva: 0 + offset: 0 + - ordinal: 1520 + rva: 0 + offset: 0 + - ordinal: 1521 + rva: 0 + offset: 0 + - ordinal: 1522 + rva: 0 + offset: 0 + - ordinal: 1523 + rva: 0 + offset: 0 + - ordinal: 1524 + rva: 0 + offset: 0 + - ordinal: 1525 + rva: 0 + offset: 0 + - ordinal: 1526 + rva: 0 + offset: 0 + - ordinal: 1527 + rva: 0 + offset: 0 + - ordinal: 1528 + rva: 0 + offset: 0 + - ordinal: 1529 + rva: 0 + offset: 0 + - ordinal: 1530 + rva: 0 + offset: 0 + - ordinal: 1531 + rva: 0 + offset: 0 + - ordinal: 1532 + rva: 0 + offset: 0 + - ordinal: 1533 + rva: 0 + offset: 0 + - ordinal: 1534 + rva: 0 + offset: 0 + - ordinal: 1535 + rva: 0 + offset: 0 + - ordinal: 1536 + rva: 0 + offset: 0 + - ordinal: 1537 + rva: 0 + offset: 0 + - ordinal: 1538 + rva: 0 + offset: 0 + - ordinal: 1539 + rva: 0 + offset: 0 + - ordinal: 1540 + rva: 0 + offset: 0 + - ordinal: 1541 + rva: 0 + offset: 0 + - ordinal: 1542 + rva: 0 + offset: 0 + - ordinal: 1543 + rva: 0 + offset: 0 + - ordinal: 1544 + rva: 0 + offset: 0 + - ordinal: 1545 + rva: 0 + offset: 0 + - ordinal: 1546 + rva: 0 + offset: 0 + - ordinal: 1547 + rva: 0 + offset: 0 + - ordinal: 1548 + rva: 0 + offset: 0 + - ordinal: 1549 + rva: 0 + offset: 0 + - ordinal: 1550 + rva: 0 + offset: 0 + - ordinal: 1551 + rva: 0 + offset: 0 + - ordinal: 1552 + rva: 0 + offset: 0 + - ordinal: 1553 + rva: 0 + offset: 0 + - ordinal: 1554 + rva: 0 + offset: 0 + - ordinal: 1555 + rva: 0 + offset: 0 + - ordinal: 1556 + rva: 0 + offset: 0 + - ordinal: 1557 + rva: 0 + offset: 0 + - ordinal: 1558 + rva: 0 + offset: 0 + - ordinal: 1559 + rva: 0 + offset: 0 + - ordinal: 1560 + rva: 0 + offset: 0 + - ordinal: 1561 + rva: 0 + offset: 0 + - ordinal: 1562 + rva: 0 + offset: 0 + - ordinal: 1563 + rva: 0 + offset: 0 + - ordinal: 1564 + rva: 0 + offset: 0 + - ordinal: 1565 + rva: 0 + offset: 0 + - ordinal: 1566 + rva: 0 + offset: 0 + - ordinal: 1567 + rva: 0 + offset: 0 + - ordinal: 1568 + rva: 0 + offset: 0 + - ordinal: 1569 + rva: 0 + offset: 0 + - ordinal: 1570 + rva: 0 + offset: 0 + - ordinal: 1571 + rva: 0 + offset: 0 + - ordinal: 1572 + rva: 0 + offset: 0 + - ordinal: 1573 + rva: 0 + offset: 0 + - ordinal: 1574 + rva: 0 + offset: 0 + - ordinal: 1575 + rva: 0 + offset: 0 + - ordinal: 1576 + rva: 0 + offset: 0 + - ordinal: 1577 + rva: 0 + offset: 0 + - ordinal: 1578 + rva: 0 + offset: 0 + - ordinal: 1579 + rva: 0 + offset: 0 + - ordinal: 1580 + rva: 0 + offset: 0 + - ordinal: 1581 + rva: 0 + offset: 0 + - ordinal: 1582 + rva: 0 + offset: 0 + - ordinal: 1583 + rva: 0 + offset: 0 + - ordinal: 1584 + rva: 0 + offset: 0 + - ordinal: 1585 + rva: 0 + offset: 0 + - ordinal: 1586 + rva: 0 + offset: 0 + - ordinal: 1587 + rva: 0 + offset: 0 + - ordinal: 1588 + rva: 0 + offset: 0 + - ordinal: 1589 + rva: 0 + offset: 0 + - ordinal: 1590 + rva: 0 + offset: 0 + - ordinal: 1591 + rva: 0 + offset: 0 + - ordinal: 1592 + rva: 0 + offset: 0 + - ordinal: 1593 + rva: 0 + offset: 0 + - ordinal: 1594 + rva: 0 + offset: 0 + - ordinal: 1595 + rva: 0 + offset: 0 + - ordinal: 1596 + rva: 0 + offset: 0 + - ordinal: 1597 + rva: 0 + offset: 0 + - ordinal: 1598 + rva: 0 + offset: 0 + - ordinal: 1599 + rva: 0 + offset: 0 + - ordinal: 1600 + rva: 0 + offset: 0 + - ordinal: 1601 + rva: 0 + offset: 0 + - ordinal: 1602 + rva: 0 + offset: 0 + - ordinal: 1603 + rva: 0 + offset: 0 + - ordinal: 1604 + rva: 0 + offset: 0 + - ordinal: 1605 + rva: 0 + offset: 0 + - ordinal: 1606 + rva: 0 + offset: 0 + - ordinal: 1607 + rva: 0 + offset: 0 + - ordinal: 1608 + rva: 0 + offset: 0 + - ordinal: 1609 + rva: 0 + offset: 0 + - ordinal: 1610 + rva: 0 + offset: 0 + - ordinal: 1611 + rva: 0 + offset: 0 + - ordinal: 1612 + rva: 0 + offset: 0 + - ordinal: 1613 + rva: 0 + offset: 0 + - ordinal: 1614 + rva: 0 + offset: 0 + - ordinal: 1615 + rva: 0 + offset: 0 + - ordinal: 1616 + rva: 0 + offset: 0 + - ordinal: 1617 + rva: 0 + offset: 0 + - ordinal: 1618 + rva: 0 + offset: 0 + - ordinal: 1619 + rva: 0 + offset: 0 + - ordinal: 1620 + rva: 0 + offset: 0 + - ordinal: 1621 + rva: 0 + offset: 0 + - ordinal: 1622 + rva: 0 + offset: 0 + - ordinal: 1623 + rva: 0 + offset: 0 + - ordinal: 1624 + rva: 0 + offset: 0 + - ordinal: 1625 + rva: 0 + offset: 0 + - ordinal: 1626 + rva: 0 + offset: 0 + - ordinal: 1627 + rva: 0 + offset: 0 + - ordinal: 1628 + rva: 0 + offset: 0 + - ordinal: 1629 + rva: 0 + offset: 0 + - ordinal: 1630 + rva: 0 + offset: 0 + - ordinal: 1631 + rva: 0 + offset: 0 + - ordinal: 1632 + rva: 0 + offset: 0 + - ordinal: 1633 + rva: 0 + offset: 0 + - ordinal: 1634 + rva: 0 + offset: 0 + - ordinal: 1635 + rva: 0 + offset: 0 + - ordinal: 1636 + rva: 0 + offset: 0 + - ordinal: 1637 + rva: 0 + offset: 0 + - ordinal: 1638 + rva: 0 + offset: 0 + - ordinal: 1639 + rva: 0 + offset: 0 + - ordinal: 1640 + rva: 0 + offset: 0 + - ordinal: 1641 + rva: 0 + offset: 0 + - ordinal: 1642 + rva: 0 + offset: 0 + - ordinal: 1643 + rva: 0 + offset: 0 + - ordinal: 1644 + rva: 0 + offset: 0 + - ordinal: 1645 + rva: 0 + offset: 0 + - ordinal: 1646 + rva: 0 + offset: 0 + - ordinal: 1647 + rva: 0 + offset: 0 + - ordinal: 1648 + rva: 0 + offset: 0 + - ordinal: 1649 + rva: 0 + offset: 0 + - ordinal: 1650 + rva: 0 + offset: 0 + - ordinal: 1651 + rva: 0 + offset: 0 + - ordinal: 1652 + rva: 0 + offset: 0 + - ordinal: 1653 + rva: 0 + offset: 0 + - ordinal: 1654 + rva: 0 + offset: 0 + - ordinal: 1655 + rva: 0 + offset: 0 + - ordinal: 1656 + rva: 0 + offset: 0 + - ordinal: 1657 + rva: 0 + offset: 0 + - ordinal: 1658 + rva: 0 + offset: 0 + - ordinal: 1659 + rva: 0 + offset: 0 + - ordinal: 1660 + rva: 0 + offset: 0 + - ordinal: 1661 + rva: 0 + offset: 0 + - ordinal: 1662 + rva: 0 + offset: 0 + - ordinal: 1663 + rva: 0 + offset: 0 + - ordinal: 1664 + rva: 0 + offset: 0 + - ordinal: 1665 + rva: 0 + offset: 0 + - ordinal: 1666 + rva: 0 + offset: 0 + - ordinal: 1667 + rva: 0 + offset: 0 + - ordinal: 1668 + rva: 0 + offset: 0 + - ordinal: 1669 + rva: 0 + offset: 0 + - ordinal: 1670 + rva: 0 + offset: 0 + - ordinal: 1671 + rva: 0 + offset: 0 + - ordinal: 1672 + rva: 0 + offset: 0 + - ordinal: 1673 + rva: 0 + offset: 0 + - ordinal: 1674 + rva: 0 + offset: 0 + - ordinal: 1675 + rva: 0 + offset: 0 + - ordinal: 1676 + rva: 0 + offset: 0 + - ordinal: 1677 + rva: 0 + offset: 0 + - ordinal: 1678 + rva: 0 + offset: 0 + - ordinal: 1679 + rva: 0 + offset: 0 + - ordinal: 1680 + rva: 0 + offset: 0 + - ordinal: 1681 + rva: 0 + offset: 0 + - ordinal: 1682 + rva: 0 + offset: 0 + - ordinal: 1683 + rva: 0 + offset: 0 + - ordinal: 1684 + rva: 0 + offset: 0 + - ordinal: 1685 + rva: 0 + offset: 0 + - ordinal: 1686 + rva: 0 + offset: 0 + - ordinal: 1687 + rva: 0 + offset: 0 + - ordinal: 1688 + rva: 0 + offset: 0 + - ordinal: 1689 + rva: 0 + offset: 0 + - ordinal: 1690 + rva: 0 + offset: 0 + - ordinal: 1691 + rva: 0 + offset: 0 + - ordinal: 1692 + rva: 0 + offset: 0 + - ordinal: 1693 + rva: 0 + offset: 0 + - ordinal: 1694 + rva: 0 + offset: 0 + - ordinal: 1695 + rva: 0 + offset: 0 + - ordinal: 1696 + rva: 0 + offset: 0 + - ordinal: 1697 + rva: 0 + offset: 0 + - ordinal: 1698 + rva: 0 + offset: 0 + - ordinal: 1699 + rva: 0 + offset: 0 + - ordinal: 1700 + rva: 0 + offset: 0 + - ordinal: 1701 + rva: 0 + offset: 0 + - ordinal: 1702 + rva: 0 + offset: 0 + - ordinal: 1703 + rva: 0 + offset: 0 + - ordinal: 1704 + rva: 0 + offset: 0 + - ordinal: 1705 + rva: 0 + offset: 0 + - ordinal: 1706 + rva: 0 + offset: 0 + - ordinal: 1707 + rva: 0 + offset: 0 + - ordinal: 1708 + rva: 0 + offset: 0 + - ordinal: 1709 + rva: 0 + offset: 0 + - ordinal: 1710 + rva: 0 + offset: 0 + - ordinal: 1711 + rva: 0 + offset: 0 + - ordinal: 1712 + rva: 0 + offset: 0 + - ordinal: 1713 + rva: 0 + offset: 0 + - ordinal: 1714 + rva: 0 + offset: 0 + - ordinal: 1715 + rva: 0 + offset: 0 + - ordinal: 1716 + rva: 0 + offset: 0 + - ordinal: 1717 + rva: 0 + offset: 0 + - ordinal: 1718 + rva: 0 + offset: 0 + - ordinal: 1719 + rva: 0 + offset: 0 + - ordinal: 1720 + rva: 0 + offset: 0 + - ordinal: 1721 + rva: 0 + offset: 0 + - ordinal: 1722 + rva: 0 + offset: 0 + - ordinal: 1723 + rva: 0 + offset: 0 + - ordinal: 1724 + rva: 0 + offset: 0 + - ordinal: 1725 + rva: 0 + offset: 0 + - ordinal: 1726 + rva: 0 + offset: 0 + - ordinal: 1727 + rva: 0 + offset: 0 + - ordinal: 1728 + rva: 0 + offset: 0 + - ordinal: 1729 + rva: 0 + offset: 0 + - ordinal: 1730 + rva: 0 + offset: 0 + - ordinal: 1731 + rva: 0 + offset: 0 + - ordinal: 1732 + rva: 0 + offset: 0 + - ordinal: 1733 + rva: 0 + offset: 0 + - ordinal: 1734 + rva: 0 + offset: 0 + - ordinal: 1735 + rva: 0 + offset: 0 + - ordinal: 1736 + rva: 0 + offset: 0 + - ordinal: 1737 + rva: 0 + offset: 0 + - ordinal: 1738 + rva: 0 + offset: 0 + - ordinal: 1739 + rva: 0 + offset: 0 + - ordinal: 1740 + rva: 0 + offset: 0 + - ordinal: 1741 + rva: 0 + offset: 0 + - ordinal: 1742 + rva: 0 + offset: 0 + - ordinal: 1743 + rva: 0 + offset: 0 + - ordinal: 1744 + rva: 0 + offset: 0 + - ordinal: 1745 + rva: 0 + offset: 0 + - ordinal: 1746 + rva: 0 + offset: 0 + - ordinal: 1747 + rva: 0 + offset: 0 + - ordinal: 1748 + rva: 0 + offset: 0 + - ordinal: 1749 + rva: 0 + offset: 0 + - ordinal: 1750 + rva: 0 + offset: 0 + - ordinal: 1751 + rva: 0 + offset: 0 + - ordinal: 1752 + rva: 0 + offset: 0 + - ordinal: 1753 + rva: 0 + offset: 0 + - ordinal: 1754 + rva: 0 + offset: 0 + - ordinal: 1755 + rva: 0 + offset: 0 + - ordinal: 1756 + rva: 0 + offset: 0 + - ordinal: 1757 + rva: 0 + offset: 0 + - ordinal: 1758 + rva: 0 + offset: 0 + - ordinal: 1759 + rva: 0 + offset: 0 + - ordinal: 1760 + rva: 0 + offset: 0 + - ordinal: 1761 + rva: 0 + offset: 0 + - ordinal: 1762 + rva: 0 + offset: 0 + - ordinal: 1763 + rva: 0 + offset: 0 + - ordinal: 1764 + rva: 0 + offset: 0 + - ordinal: 1765 + rva: 0 + offset: 0 + - ordinal: 1766 + rva: 0 + offset: 0 + - ordinal: 1767 + rva: 0 + offset: 0 + - ordinal: 1768 + rva: 0 + offset: 0 + - ordinal: 1769 + rva: 0 + offset: 0 + - ordinal: 1770 + rva: 0 + offset: 0 + - ordinal: 1771 + rva: 0 + offset: 0 + - ordinal: 1772 + rva: 0 + offset: 0 + - ordinal: 1773 + rva: 0 + offset: 0 + - ordinal: 1774 + rva: 0 + offset: 0 + - ordinal: 1775 + rva: 0 + offset: 0 + - ordinal: 1776 + rva: 0 + offset: 0 + - ordinal: 1777 + rva: 0 + offset: 0 + - ordinal: 1778 + rva: 0 + offset: 0 + - ordinal: 1779 + rva: 0 + offset: 0 + - ordinal: 1780 + rva: 0 + offset: 0 + - ordinal: 1781 + rva: 0 + offset: 0 + - ordinal: 1782 + rva: 0 + offset: 0 + - ordinal: 1783 + rva: 0 + offset: 0 + - ordinal: 1784 + rva: 0 + offset: 0 + - ordinal: 1785 + rva: 0 + offset: 0 + - ordinal: 1786 + rva: 0 + offset: 0 + - ordinal: 1787 + rva: 0 + offset: 0 + - ordinal: 1788 + rva: 0 + offset: 0 + - ordinal: 1789 + rva: 0 + offset: 0 + - ordinal: 1790 + rva: 0 + offset: 0 + - ordinal: 1791 + rva: 0 + offset: 0 + - ordinal: 1792 + rva: 0 + offset: 0 + - ordinal: 1793 + rva: 0 + offset: 0 + - ordinal: 1794 + rva: 0 + offset: 0 + - ordinal: 1795 + rva: 0 + offset: 0 + - ordinal: 1796 + rva: 0 + offset: 0 + - ordinal: 1797 + rva: 0 + offset: 0 + - ordinal: 1798 + rva: 0 + offset: 0 + - ordinal: 1799 + rva: 0 + offset: 0 + - ordinal: 1800 + rva: 0 + offset: 0 + - ordinal: 1801 + rva: 0 + offset: 0 + - ordinal: 1802 + rva: 0 + offset: 0 + - ordinal: 1803 + rva: 0 + offset: 0 + - ordinal: 1804 + rva: 0 + offset: 0 + - ordinal: 1805 + rva: 0 + offset: 0 + - ordinal: 1806 + rva: 0 + offset: 0 + - ordinal: 1807 + rva: 0 + offset: 0 + - ordinal: 1808 + rva: 0 + offset: 0 + - ordinal: 1809 + rva: 0 + offset: 0 + - ordinal: 1810 + rva: 0 + offset: 0 + - ordinal: 1811 + rva: 0 + offset: 0 + - ordinal: 1812 + rva: 0 + offset: 0 + - ordinal: 1813 + rva: 0 + offset: 0 + - ordinal: 1814 + rva: 0 + offset: 0 + - ordinal: 1815 + rva: 0 + offset: 0 + - ordinal: 1816 + rva: 0 + offset: 0 + - ordinal: 1817 + rva: 0 + offset: 0 + - ordinal: 1818 + rva: 0 + offset: 0 + - ordinal: 1819 + rva: 0 + offset: 0 + - ordinal: 1820 + rva: 0 + offset: 0 + - ordinal: 1821 + rva: 0 + offset: 0 + - ordinal: 1822 + rva: 0 + offset: 0 + - ordinal: 1823 + rva: 0 + offset: 0 + - ordinal: 1824 + rva: 0 + offset: 0 + - ordinal: 1825 + rva: 0 + offset: 0 + - ordinal: 1826 + rva: 0 + offset: 0 + - ordinal: 1827 + rva: 0 + offset: 0 + - ordinal: 1828 + rva: 0 + offset: 0 + - ordinal: 1829 + rva: 0 + offset: 0 + - ordinal: 1830 + rva: 0 + offset: 0 + - ordinal: 1831 + rva: 0 + offset: 0 + - ordinal: 1832 + rva: 0 + offset: 0 + - ordinal: 1833 + rva: 0 + offset: 0 + - ordinal: 1834 + rva: 0 + offset: 0 + - ordinal: 1835 + rva: 0 + offset: 0 + - ordinal: 1836 + rva: 0 + offset: 0 + - ordinal: 1837 + rva: 0 + offset: 0 + - ordinal: 1838 + rva: 0 + offset: 0 + - ordinal: 1839 + rva: 0 + offset: 0 + - ordinal: 1840 + rva: 0 + offset: 0 + - ordinal: 1841 + rva: 0 + offset: 0 + - ordinal: 1842 + rva: 0 + offset: 0 + - ordinal: 1843 + rva: 0 + offset: 0 + - ordinal: 1844 + rva: 0 + offset: 0 + - ordinal: 1845 + rva: 0 + offset: 0 + - ordinal: 1846 + rva: 0 + offset: 0 + - ordinal: 1847 + rva: 0 + offset: 0 + - ordinal: 1848 + rva: 0 + offset: 0 + - ordinal: 1849 + rva: 0 + offset: 0 + - ordinal: 1850 + rva: 0 + offset: 0 + - ordinal: 1851 + rva: 0 + offset: 0 + - ordinal: 1852 + rva: 0 + offset: 0 + - ordinal: 1853 + rva: 0 + offset: 0 + - ordinal: 1854 + rva: 0 + offset: 0 + - ordinal: 1855 + rva: 0 + offset: 0 + - ordinal: 1856 + rva: 0 + offset: 0 + - ordinal: 1857 + rva: 0 + offset: 0 + - ordinal: 1858 + rva: 0 + offset: 0 + - ordinal: 1859 + rva: 0 + offset: 0 + - ordinal: 1860 + rva: 0 + offset: 0 + - ordinal: 1861 + rva: 0 + offset: 0 + - ordinal: 1862 + rva: 0 + offset: 0 + - ordinal: 1863 + rva: 0 + offset: 0 + - ordinal: 1864 + rva: 0 + offset: 0 + - ordinal: 1865 + rva: 0 + offset: 0 + - ordinal: 1866 + rva: 0 + offset: 0 + - ordinal: 1867 + rva: 0 + offset: 0 + - ordinal: 1868 + rva: 0 + offset: 0 + - ordinal: 1869 + rva: 0 + offset: 0 + - ordinal: 1870 + rva: 0 + offset: 0 + - ordinal: 1871 + rva: 0 + offset: 0 + - ordinal: 1872 + rva: 0 + offset: 0 + - ordinal: 1873 + rva: 0 + offset: 0 + - ordinal: 1874 + rva: 0 + offset: 0 + - ordinal: 1875 + rva: 0 + offset: 0 + - ordinal: 1876 + rva: 0 + offset: 0 + - ordinal: 1877 + rva: 0 + offset: 0 + - ordinal: 1878 + rva: 0 + offset: 0 + - ordinal: 1879 + rva: 0 + offset: 0 + - ordinal: 1880 + rva: 0 + offset: 0 + - ordinal: 1881 + rva: 0 + offset: 0 + - ordinal: 1882 + rva: 0 + offset: 0 + - ordinal: 1883 + rva: 0 + offset: 0 + - ordinal: 1884 + rva: 0 + offset: 0 + - ordinal: 1885 + rva: 0 + offset: 0 + - ordinal: 1886 + rva: 0 + offset: 0 + - ordinal: 1887 + rva: 0 + offset: 0 + - ordinal: 1888 + rva: 0 + offset: 0 + - ordinal: 1889 + rva: 0 + offset: 0 + - ordinal: 1890 + rva: 0 + offset: 0 + - ordinal: 1891 + rva: 0 + offset: 0 + - ordinal: 1892 + rva: 0 + offset: 0 + - ordinal: 1893 + rva: 0 + offset: 0 + - ordinal: 1894 + rva: 0 + offset: 0 + - ordinal: 1895 + rva: 0 + offset: 0 + - ordinal: 1896 + rva: 0 + offset: 0 + - ordinal: 1897 + rva: 0 + offset: 0 + - ordinal: 1898 + rva: 0 + offset: 0 + - ordinal: 1899 + rva: 0 + offset: 0 + - ordinal: 1900 + rva: 0 + offset: 0 + - ordinal: 1901 + rva: 0 + offset: 0 + - ordinal: 1902 + rva: 0 + offset: 0 + - ordinal: 1903 + rva: 0 + offset: 0 + - ordinal: 1904 + rva: 0 + offset: 0 + - ordinal: 1905 + rva: 0 + offset: 0 + - ordinal: 1906 + rva: 0 + offset: 0 + - ordinal: 1907 + rva: 0 + offset: 0 + - ordinal: 1908 + rva: 0 + offset: 0 + - ordinal: 1909 + rva: 0 + offset: 0 + - ordinal: 1910 + rva: 0 + offset: 0 + - ordinal: 1911 + rva: 0 + offset: 0 + - ordinal: 1912 + rva: 0 + offset: 0 + - ordinal: 1913 + rva: 0 + offset: 0 + - ordinal: 1914 + rva: 0 + offset: 0 + - ordinal: 1915 + rva: 0 + offset: 0 + - ordinal: 1916 + rva: 0 + offset: 0 + - ordinal: 1917 + rva: 0 + offset: 0 + - ordinal: 1918 + rva: 0 + offset: 0 + - ordinal: 1919 + rva: 0 + offset: 0 + - ordinal: 1920 + rva: 0 + offset: 0 + - ordinal: 1921 + rva: 0 + offset: 0 + - ordinal: 1922 + rva: 0 + offset: 0 + - ordinal: 1923 + rva: 0 + offset: 0 + - ordinal: 1924 + rva: 0 + offset: 0 + - ordinal: 1925 + rva: 0 + offset: 0 + - ordinal: 1926 + rva: 0 + offset: 0 + - ordinal: 1927 + rva: 0 + offset: 0 + - ordinal: 1928 + rva: 0 + offset: 0 + - ordinal: 1929 + rva: 0 + offset: 0 + - ordinal: 1930 + rva: 0 + offset: 0 + - ordinal: 1931 + rva: 0 + offset: 0 + - ordinal: 1932 + rva: 0 + offset: 0 + - ordinal: 1933 + rva: 0 + offset: 0 + - ordinal: 1934 + rva: 0 + offset: 0 + - ordinal: 1935 + rva: 0 + offset: 0 + - ordinal: 1936 + rva: 0 + offset: 0 + - ordinal: 1937 + rva: 0 + offset: 0 + - ordinal: 1938 + rva: 0 + offset: 0 + - ordinal: 1939 + rva: 0 + offset: 0 + - ordinal: 1940 + rva: 0 + offset: 0 + - ordinal: 1941 + rva: 0 + offset: 0 + - ordinal: 1942 + rva: 0 + offset: 0 + - ordinal: 1943 + rva: 0 + offset: 0 + - ordinal: 1944 + rva: 0 + offset: 0 + - ordinal: 1945 + rva: 0 + offset: 0 + - ordinal: 1946 + rva: 0 + offset: 0 + - ordinal: 1947 + rva: 0 + offset: 0 + - ordinal: 1948 + rva: 0 + offset: 0 + - ordinal: 1949 + rva: 0 + offset: 0 + - ordinal: 1950 + rva: 0 + offset: 0 + - ordinal: 1951 + rva: 0 + offset: 0 + - ordinal: 1952 + rva: 0 + offset: 0 + - ordinal: 1953 + rva: 0 + offset: 0 + - ordinal: 1954 + rva: 0 + offset: 0 + - ordinal: 1955 + rva: 0 + offset: 0 + - ordinal: 1956 + rva: 0 + offset: 0 + - ordinal: 1957 + rva: 0 + offset: 0 + - ordinal: 1958 + rva: 0 + offset: 0 + - ordinal: 1959 + rva: 0 + offset: 0 + - ordinal: 1960 + rva: 0 + offset: 0 + - ordinal: 1961 + rva: 0 + offset: 0 + - ordinal: 1962 + rva: 0 + offset: 0 + - ordinal: 1963 + rva: 0 + offset: 0 + - ordinal: 1964 + rva: 0 + offset: 0 + - ordinal: 1965 + rva: 0 + offset: 0 + - ordinal: 1966 + rva: 0 + offset: 0 + - ordinal: 1967 + rva: 0 + offset: 0 + - ordinal: 1968 + rva: 0 + offset: 0 + - ordinal: 1969 + rva: 0 + offset: 0 + - ordinal: 1970 + rva: 0 + offset: 0 + - ordinal: 1971 + rva: 0 + offset: 0 + - ordinal: 1972 + rva: 0 + offset: 0 + - ordinal: 1973 + rva: 0 + offset: 0 + - ordinal: 1974 + rva: 0 + offset: 0 + - ordinal: 1975 + rva: 0 + offset: 0 + - ordinal: 1976 + rva: 0 + offset: 0 + - ordinal: 1977 + rva: 0 + offset: 0 + - ordinal: 1978 + rva: 0 + offset: 0 + - ordinal: 1979 + rva: 0 + offset: 0 + - ordinal: 1980 + rva: 0 + offset: 0 + - ordinal: 1981 + rva: 0 + offset: 0 + - ordinal: 1982 + rva: 0 + offset: 0 + - ordinal: 1983 + rva: 0 + offset: 0 + - ordinal: 1984 + rva: 0 + offset: 0 + - ordinal: 1985 + rva: 0 + offset: 0 + - ordinal: 1986 + rva: 0 + offset: 0 + - ordinal: 1987 + rva: 0 + offset: 0 + - ordinal: 1988 + rva: 0 + offset: 0 + - ordinal: 1989 + rva: 0 + offset: 0 + - ordinal: 1990 + rva: 0 + offset: 0 + - ordinal: 1991 + rva: 0 + offset: 0 + - ordinal: 1992 + rva: 0 + offset: 0 + - ordinal: 1993 + rva: 0 + offset: 0 + - ordinal: 1994 + rva: 0 + offset: 0 + - ordinal: 1995 + rva: 0 + offset: 0 + - ordinal: 1996 + rva: 0 + offset: 0 + - ordinal: 1997 + rva: 0 + offset: 0 + - ordinal: 1998 + rva: 0 + offset: 0 + - ordinal: 1999 + rva: 0 + offset: 0 + - ordinal: 2000 + rva: 22608 + offset: 19536 + - ordinal: 2001 + rva: 23152 + offset: 20080 + - ordinal: 2002 + rva: 23344 + offset: 20272 + - ordinal: 2003 + rva: 23520 + offset: 20448 + - ordinal: 2004 + rva: 23696 + offset: 20624 + - ordinal: 2005 + rva: 24064 + offset: 20992 + - ordinal: 2006 + rva: 0 + offset: 0 + - ordinal: 2007 + rva: 0 + offset: 0 + - ordinal: 2008 + rva: 0 + offset: 0 + - ordinal: 2009 + rva: 0 + offset: 0 + - ordinal: 2010 + rva: 0 + offset: 0 + - ordinal: 2011 + rva: 0 + offset: 0 + - ordinal: 2012 + rva: 0 + offset: 0 + - ordinal: 2013 + rva: 0 + offset: 0 + - ordinal: 2014 + rva: 0 + offset: 0 + - ordinal: 2015 + rva: 0 + offset: 0 + - ordinal: 2016 + rva: 0 + offset: 0 + - ordinal: 2017 + rva: 0 + offset: 0 + - ordinal: 2018 + rva: 0 + offset: 0 + - ordinal: 2019 + rva: 0 + offset: 0 + - ordinal: 2020 + rva: 0 + offset: 0 + - ordinal: 2021 + rva: 0 + offset: 0 + - ordinal: 2022 + rva: 0 + offset: 0 + - ordinal: 2023 + rva: 0 + offset: 0 + - ordinal: 2024 + rva: 0 + offset: 0 + - ordinal: 2025 + rva: 0 + offset: 0 + - ordinal: 2026 + rva: 0 + offset: 0 + - ordinal: 2027 + rva: 0 + offset: 0 + - ordinal: 2028 + rva: 0 + offset: 0 + - ordinal: 2029 + rva: 0 + offset: 0 + - ordinal: 2030 + rva: 0 + offset: 0 + - ordinal: 2031 + rva: 0 + offset: 0 + - ordinal: 2032 + rva: 0 + offset: 0 + - ordinal: 2033 + rva: 0 + offset: 0 + - ordinal: 2034 + rva: 0 + offset: 0 + - ordinal: 2035 + rva: 0 + offset: 0 + - ordinal: 2036 + rva: 0 + offset: 0 + - ordinal: 2037 + rva: 0 + offset: 0 + - ordinal: 2038 + rva: 0 + offset: 0 + - ordinal: 2039 + rva: 0 + offset: 0 + - ordinal: 2040 + rva: 0 + offset: 0 + - ordinal: 2041 + rva: 0 + offset: 0 + - ordinal: 2042 + rva: 0 + offset: 0 + - ordinal: 2043 + rva: 0 + offset: 0 + - ordinal: 2044 + rva: 0 + offset: 0 + - ordinal: 2045 + rva: 0 + offset: 0 + - ordinal: 2046 + rva: 0 + offset: 0 + - ordinal: 2047 + rva: 0 + offset: 0 + - ordinal: 2048 + rva: 0 + offset: 0 + - ordinal: 2049 + rva: 0 + offset: 0 + - ordinal: 2050 + rva: 0 + offset: 0 + - ordinal: 2051 + rva: 0 + offset: 0 + - ordinal: 2052 + rva: 0 + offset: 0 + - ordinal: 2053 + rva: 0 + offset: 0 + - ordinal: 2054 + rva: 0 + offset: 0 + - ordinal: 2055 + rva: 0 + offset: 0 + - ordinal: 2056 + rva: 0 + offset: 0 + - ordinal: 2057 + rva: 0 + offset: 0 + - ordinal: 2058 + rva: 0 + offset: 0 + - ordinal: 2059 + rva: 0 + offset: 0 + - ordinal: 2060 + rva: 0 + offset: 0 + - ordinal: 2061 + rva: 0 + offset: 0 + - ordinal: 2062 + rva: 0 + offset: 0 + - ordinal: 2063 + rva: 0 + offset: 0 + - ordinal: 2064 + rva: 0 + offset: 0 + - ordinal: 2065 + rva: 0 + offset: 0 + - ordinal: 2066 + rva: 0 + offset: 0 + - ordinal: 2067 + rva: 0 + offset: 0 + - ordinal: 2068 + rva: 0 + offset: 0 + - ordinal: 2069 + rva: 0 + offset: 0 + - ordinal: 2070 + rva: 0 + offset: 0 + - ordinal: 2071 + rva: 0 + offset: 0 + - ordinal: 2072 + rva: 0 + offset: 0 + - ordinal: 2073 + rva: 0 + offset: 0 + - ordinal: 2074 + rva: 0 + offset: 0 + - ordinal: 2075 + rva: 0 + offset: 0 + - ordinal: 2076 + rva: 0 + offset: 0 + - ordinal: 2077 + rva: 0 + offset: 0 + - ordinal: 2078 + rva: 0 + offset: 0 + - ordinal: 2079 + rva: 0 + offset: 0 + - ordinal: 2080 + rva: 0 + offset: 0 + - ordinal: 2081 + rva: 0 + offset: 0 + - ordinal: 2082 + rva: 0 + offset: 0 + - ordinal: 2083 + rva: 0 + offset: 0 + - ordinal: 2084 + rva: 0 + offset: 0 + - ordinal: 2085 + rva: 0 + offset: 0 + - ordinal: 2086 + rva: 0 + offset: 0 + - ordinal: 2087 + rva: 0 + offset: 0 + - ordinal: 2088 + rva: 0 + offset: 0 + - ordinal: 2089 + rva: 0 + offset: 0 + - ordinal: 2090 + rva: 0 + offset: 0 + - ordinal: 2091 + rva: 0 + offset: 0 + - ordinal: 2092 + rva: 0 + offset: 0 + - ordinal: 2093 + rva: 0 + offset: 0 + - ordinal: 2094 + rva: 0 + offset: 0 + - ordinal: 2095 + rva: 0 + offset: 0 + - ordinal: 2096 + rva: 0 + offset: 0 + - ordinal: 2097 + rva: 0 + offset: 0 + - ordinal: 2098 + rva: 0 + offset: 0 + - ordinal: 2099 + rva: 0 + offset: 0 + - ordinal: 2100 + rva: 0 + offset: 0 + - ordinal: 2101 + rva: 0 + offset: 0 + - ordinal: 2102 + rva: 0 + offset: 0 + - ordinal: 2103 + rva: 0 + offset: 0 + - ordinal: 2104 + rva: 0 + offset: 0 + - ordinal: 2105 + rva: 0 + offset: 0 + - ordinal: 2106 + rva: 0 + offset: 0 + - ordinal: 2107 + rva: 0 + offset: 0 + - ordinal: 2108 + rva: 0 + offset: 0 + - ordinal: 2109 + rva: 0 + offset: 0 + - ordinal: 2110 + rva: 0 + offset: 0 + - ordinal: 2111 + rva: 0 + offset: 0 + - ordinal: 2112 + rva: 0 + offset: 0 + - ordinal: 2113 + rva: 0 + offset: 0 + - ordinal: 2114 + rva: 0 + offset: 0 + - ordinal: 2115 + rva: 0 + offset: 0 + - ordinal: 2116 + rva: 0 + offset: 0 + - ordinal: 2117 + rva: 0 + offset: 0 + - ordinal: 2118 + rva: 0 + offset: 0 + - ordinal: 2119 + rva: 0 + offset: 0 + - ordinal: 2120 + rva: 0 + offset: 0 + - ordinal: 2121 + rva: 0 + offset: 0 + - ordinal: 2122 + rva: 0 + offset: 0 + - ordinal: 2123 + rva: 0 + offset: 0 + - ordinal: 2124 + rva: 0 + offset: 0 + - ordinal: 2125 + rva: 0 + offset: 0 + - ordinal: 2126 + rva: 0 + offset: 0 + - ordinal: 2127 + rva: 0 + offset: 0 + - ordinal: 2128 + rva: 0 + offset: 0 + - ordinal: 2129 + rva: 0 + offset: 0 + - ordinal: 2130 + rva: 0 + offset: 0 + - ordinal: 2131 + rva: 0 + offset: 0 + - ordinal: 2132 + rva: 0 + offset: 0 + - ordinal: 2133 + rva: 0 + offset: 0 + - ordinal: 2134 + rva: 0 + offset: 0 + - ordinal: 2135 + rva: 0 + offset: 0 + - ordinal: 2136 + rva: 0 + offset: 0 + - ordinal: 2137 + rva: 0 + offset: 0 + - ordinal: 2138 + rva: 0 + offset: 0 + - ordinal: 2139 + rva: 0 + offset: 0 + - ordinal: 2140 + rva: 0 + offset: 0 + - ordinal: 2141 + rva: 0 + offset: 0 + - ordinal: 2142 + rva: 0 + offset: 0 + - ordinal: 2143 + rva: 0 + offset: 0 + - ordinal: 2144 + rva: 0 + offset: 0 + - ordinal: 2145 + rva: 0 + offset: 0 + - ordinal: 2146 + rva: 0 + offset: 0 + - ordinal: 2147 + rva: 0 + offset: 0 + - ordinal: 2148 + rva: 0 + offset: 0 + - ordinal: 2149 + rva: 0 + offset: 0 + - ordinal: 2150 + rva: 0 + offset: 0 + - ordinal: 2151 + rva: 0 + offset: 0 + - ordinal: 2152 + rva: 0 + offset: 0 + - ordinal: 2153 + rva: 0 + offset: 0 + - ordinal: 2154 + rva: 0 + offset: 0 + - ordinal: 2155 + rva: 0 + offset: 0 + - ordinal: 2156 + rva: 0 + offset: 0 + - ordinal: 2157 + rva: 0 + offset: 0 + - ordinal: 2158 + rva: 0 + offset: 0 + - ordinal: 2159 + rva: 0 + offset: 0 + - ordinal: 2160 + rva: 0 + offset: 0 + - ordinal: 2161 + rva: 0 + offset: 0 + - ordinal: 2162 + rva: 0 + offset: 0 + - ordinal: 2163 + rva: 0 + offset: 0 + - ordinal: 2164 + rva: 0 + offset: 0 + - ordinal: 2165 + rva: 0 + offset: 0 + - ordinal: 2166 + rva: 0 + offset: 0 + - ordinal: 2167 + rva: 0 + offset: 0 + - ordinal: 2168 + rva: 0 + offset: 0 + - ordinal: 2169 + rva: 0 + offset: 0 + - ordinal: 2170 + rva: 0 + offset: 0 + - ordinal: 2171 + rva: 0 + offset: 0 + - ordinal: 2172 + rva: 0 + offset: 0 + - ordinal: 2173 + rva: 0 + offset: 0 + - ordinal: 2174 + rva: 0 + offset: 0 + - ordinal: 2175 + rva: 0 + offset: 0 + - ordinal: 2176 + rva: 0 + offset: 0 + - ordinal: 2177 + rva: 0 + offset: 0 + - ordinal: 2178 + rva: 0 + offset: 0 + - ordinal: 2179 + rva: 0 + offset: 0 + - ordinal: 2180 + rva: 0 + offset: 0 + - ordinal: 2181 + rva: 0 + offset: 0 + - ordinal: 2182 + rva: 0 + offset: 0 + - ordinal: 2183 + rva: 0 + offset: 0 + - ordinal: 2184 + rva: 0 + offset: 0 + - ordinal: 2185 + rva: 0 + offset: 0 + - ordinal: 2186 + rva: 0 + offset: 0 + - ordinal: 2187 + rva: 0 + offset: 0 + - ordinal: 2188 + rva: 0 + offset: 0 + - ordinal: 2189 + rva: 0 + offset: 0 + - ordinal: 2190 + rva: 0 + offset: 0 + - ordinal: 2191 + rva: 0 + offset: 0 + - ordinal: 2192 + rva: 0 + offset: 0 + - ordinal: 2193 + rva: 0 + offset: 0 + - ordinal: 2194 + rva: 0 + offset: 0 + - ordinal: 2195 + rva: 0 + offset: 0 + - ordinal: 2196 + rva: 0 + offset: 0 + - ordinal: 2197 + rva: 0 + offset: 0 + - ordinal: 2198 + rva: 0 + offset: 0 + - ordinal: 2199 + rva: 0 + offset: 0 + - ordinal: 2200 + rva: 0 + offset: 0 + - ordinal: 2201 + rva: 0 + offset: 0 + - ordinal: 2202 + rva: 0 + offset: 0 + - ordinal: 2203 + rva: 0 + offset: 0 + - ordinal: 2204 + rva: 0 + offset: 0 + - ordinal: 2205 + rva: 0 + offset: 0 + - ordinal: 2206 + rva: 0 + offset: 0 + - ordinal: 2207 + rva: 0 + offset: 0 + - ordinal: 2208 + rva: 0 + offset: 0 + - ordinal: 2209 + rva: 0 + offset: 0 + - ordinal: 2210 + rva: 0 + offset: 0 + - ordinal: 2211 + rva: 0 + offset: 0 + - ordinal: 2212 + rva: 0 + offset: 0 + - ordinal: 2213 + rva: 0 + offset: 0 + - ordinal: 2214 + rva: 0 + offset: 0 + - ordinal: 2215 + rva: 0 + offset: 0 + - ordinal: 2216 + rva: 0 + offset: 0 + - ordinal: 2217 + rva: 0 + offset: 0 + - ordinal: 2218 + rva: 0 + offset: 0 + - ordinal: 2219 + rva: 0 + offset: 0 + - ordinal: 2220 + rva: 0 + offset: 0 + - ordinal: 2221 + rva: 0 + offset: 0 + - ordinal: 2222 + rva: 0 + offset: 0 + - ordinal: 2223 + rva: 0 + offset: 0 + - ordinal: 2224 + rva: 0 + offset: 0 + - ordinal: 2225 + rva: 0 + offset: 0 + - ordinal: 2226 + rva: 0 + offset: 0 + - ordinal: 2227 + rva: 0 + offset: 0 + - ordinal: 2228 + rva: 0 + offset: 0 + - ordinal: 2229 + rva: 0 + offset: 0 + - ordinal: 2230 + rva: 0 + offset: 0 + - ordinal: 2231 + rva: 0 + offset: 0 + - ordinal: 2232 + rva: 0 + offset: 0 + - ordinal: 2233 + rva: 0 + offset: 0 + - ordinal: 2234 + rva: 0 + offset: 0 + - ordinal: 2235 + rva: 0 + offset: 0 + - ordinal: 2236 + rva: 0 + offset: 0 + - ordinal: 2237 + rva: 0 + offset: 0 + - ordinal: 2238 + rva: 0 + offset: 0 + - ordinal: 2239 + rva: 0 + offset: 0 + - ordinal: 2240 + rva: 0 + offset: 0 + - ordinal: 2241 + rva: 0 + offset: 0 + - ordinal: 2242 + rva: 0 + offset: 0 + - ordinal: 2243 + rva: 0 + offset: 0 + - ordinal: 2244 + rva: 0 + offset: 0 + - ordinal: 2245 + rva: 0 + offset: 0 + - ordinal: 2246 + rva: 0 + offset: 0 + - ordinal: 2247 + rva: 0 + offset: 0 + - ordinal: 2248 + rva: 0 + offset: 0 + - ordinal: 2249 + rva: 0 + offset: 0 + - ordinal: 2250 + rva: 0 + offset: 0 + - ordinal: 2251 + rva: 0 + offset: 0 + - ordinal: 2252 + rva: 0 + offset: 0 + - ordinal: 2253 + rva: 0 + offset: 0 + - ordinal: 2254 + rva: 0 + offset: 0 + - ordinal: 2255 + rva: 0 + offset: 0 + - ordinal: 2256 + rva: 0 + offset: 0 + - ordinal: 2257 + rva: 0 + offset: 0 + - ordinal: 2258 + rva: 0 + offset: 0 + - ordinal: 2259 + rva: 0 + offset: 0 + - ordinal: 2260 + rva: 0 + offset: 0 + - ordinal: 2261 + rva: 0 + offset: 0 + - ordinal: 2262 + rva: 0 + offset: 0 + - ordinal: 2263 + rva: 0 + offset: 0 + - ordinal: 2264 + rva: 0 + offset: 0 + - ordinal: 2265 + rva: 0 + offset: 0 + - ordinal: 2266 + rva: 0 + offset: 0 + - ordinal: 2267 + rva: 0 + offset: 0 + - ordinal: 2268 + rva: 0 + offset: 0 + - ordinal: 2269 + rva: 0 + offset: 0 + - ordinal: 2270 + rva: 0 + offset: 0 + - ordinal: 2271 + rva: 0 + offset: 0 + - ordinal: 2272 + rva: 0 + offset: 0 + - ordinal: 2273 + rva: 0 + offset: 0 + - ordinal: 2274 + rva: 0 + offset: 0 + - ordinal: 2275 + rva: 0 + offset: 0 + - ordinal: 2276 + rva: 0 + offset: 0 + - ordinal: 2277 + rva: 0 + offset: 0 + - ordinal: 2278 + rva: 0 + offset: 0 + - ordinal: 2279 + rva: 0 + offset: 0 + - ordinal: 2280 + rva: 0 + offset: 0 + - ordinal: 2281 + rva: 0 + offset: 0 + - ordinal: 2282 + rva: 0 + offset: 0 + - ordinal: 2283 + rva: 0 + offset: 0 + - ordinal: 2284 + rva: 0 + offset: 0 + - ordinal: 2285 + rva: 0 + offset: 0 + - ordinal: 2286 + rva: 0 + offset: 0 + - ordinal: 2287 + rva: 0 + offset: 0 + - ordinal: 2288 + rva: 0 + offset: 0 + - ordinal: 2289 + rva: 0 + offset: 0 + - ordinal: 2290 + rva: 0 + offset: 0 + - ordinal: 2291 + rva: 0 + offset: 0 + - ordinal: 2292 + rva: 0 + offset: 0 + - ordinal: 2293 + rva: 0 + offset: 0 + - ordinal: 2294 + rva: 0 + offset: 0 + - ordinal: 2295 + rva: 0 + offset: 0 + - ordinal: 2296 + rva: 0 + offset: 0 + - ordinal: 2297 + rva: 0 + offset: 0 + - ordinal: 2298 + rva: 0 + offset: 0 + - ordinal: 2299 + rva: 0 + offset: 0 + - ordinal: 2300 + rva: 0 + offset: 0 + - ordinal: 2301 + rva: 0 + offset: 0 + - ordinal: 2302 + rva: 0 + offset: 0 + - ordinal: 2303 + rva: 0 + offset: 0 + - ordinal: 2304 + rva: 0 + offset: 0 + - ordinal: 2305 + rva: 0 + offset: 0 + - ordinal: 2306 + rva: 0 + offset: 0 + - ordinal: 2307 + rva: 0 + offset: 0 + - ordinal: 2308 + rva: 0 + offset: 0 + - ordinal: 2309 + rva: 0 + offset: 0 + - ordinal: 2310 + rva: 0 + offset: 0 + - ordinal: 2311 + rva: 0 + offset: 0 + - ordinal: 2312 + rva: 0 + offset: 0 + - ordinal: 2313 + rva: 0 + offset: 0 + - ordinal: 2314 + rva: 0 + offset: 0 + - ordinal: 2315 + rva: 0 + offset: 0 + - ordinal: 2316 + rva: 0 + offset: 0 + - ordinal: 2317 + rva: 0 + offset: 0 + - ordinal: 2318 + rva: 0 + offset: 0 + - ordinal: 2319 + rva: 0 + offset: 0 + - ordinal: 2320 + rva: 0 + offset: 0 + - ordinal: 2321 + rva: 0 + offset: 0 + - ordinal: 2322 + rva: 0 + offset: 0 + - ordinal: 2323 + rva: 0 + offset: 0 + - ordinal: 2324 + rva: 0 + offset: 0 + - ordinal: 2325 + rva: 0 + offset: 0 + - ordinal: 2326 + rva: 0 + offset: 0 + - ordinal: 2327 + rva: 0 + offset: 0 + - ordinal: 2328 + rva: 0 + offset: 0 + - ordinal: 2329 + rva: 0 + offset: 0 + - ordinal: 2330 + rva: 0 + offset: 0 + - ordinal: 2331 + rva: 0 + offset: 0 + - ordinal: 2332 + rva: 0 + offset: 0 + - ordinal: 2333 + rva: 0 + offset: 0 + - ordinal: 2334 + rva: 0 + offset: 0 + - ordinal: 2335 + rva: 0 + offset: 0 + - ordinal: 2336 + rva: 0 + offset: 0 + - ordinal: 2337 + rva: 0 + offset: 0 + - ordinal: 2338 + rva: 0 + offset: 0 + - ordinal: 2339 + rva: 0 + offset: 0 + - ordinal: 2340 + rva: 0 + offset: 0 + - ordinal: 2341 + rva: 0 + offset: 0 + - ordinal: 2342 + rva: 0 + offset: 0 + - ordinal: 2343 + rva: 0 + offset: 0 + - ordinal: 2344 + rva: 0 + offset: 0 + - ordinal: 2345 + rva: 0 + offset: 0 + - ordinal: 2346 + rva: 0 + offset: 0 + - ordinal: 2347 + rva: 0 + offset: 0 + - ordinal: 2348 + rva: 0 + offset: 0 + - ordinal: 2349 + rva: 0 + offset: 0 + - ordinal: 2350 + rva: 0 + offset: 0 + - ordinal: 2351 + rva: 0 + offset: 0 + - ordinal: 2352 + rva: 0 + offset: 0 + - ordinal: 2353 + rva: 0 + offset: 0 + - ordinal: 2354 + rva: 0 + offset: 0 + - ordinal: 2355 + rva: 0 + offset: 0 + - ordinal: 2356 + rva: 0 + offset: 0 + - ordinal: 2357 + rva: 0 + offset: 0 + - ordinal: 2358 + rva: 0 + offset: 0 + - ordinal: 2359 + rva: 0 + offset: 0 + - ordinal: 2360 + rva: 0 + offset: 0 + - ordinal: 2361 + rva: 0 + offset: 0 + - ordinal: 2362 + rva: 0 + offset: 0 + - ordinal: 2363 + rva: 0 + offset: 0 + - ordinal: 2364 + rva: 0 + offset: 0 + - ordinal: 2365 + rva: 0 + offset: 0 + - ordinal: 2366 + rva: 0 + offset: 0 + - ordinal: 2367 + rva: 0 + offset: 0 + - ordinal: 2368 + rva: 0 + offset: 0 + - ordinal: 2369 + rva: 0 + offset: 0 + - ordinal: 2370 + rva: 0 + offset: 0 + - ordinal: 2371 + rva: 0 + offset: 0 + - ordinal: 2372 + rva: 0 + offset: 0 + - ordinal: 2373 + rva: 0 + offset: 0 + - ordinal: 2374 + rva: 0 + offset: 0 + - ordinal: 2375 + rva: 0 + offset: 0 + - ordinal: 2376 + rva: 0 + offset: 0 + - ordinal: 2377 + rva: 0 + offset: 0 + - ordinal: 2378 + rva: 0 + offset: 0 + - ordinal: 2379 + rva: 0 + offset: 0 + - ordinal: 2380 + rva: 0 + offset: 0 + - ordinal: 2381 + rva: 0 + offset: 0 + - ordinal: 2382 + rva: 0 + offset: 0 + - ordinal: 2383 + rva: 0 + offset: 0 + - ordinal: 2384 + rva: 0 + offset: 0 + - ordinal: 2385 + rva: 0 + offset: 0 + - ordinal: 2386 + rva: 0 + offset: 0 + - ordinal: 2387 + rva: 0 + offset: 0 + - ordinal: 2388 + rva: 0 + offset: 0 + - ordinal: 2389 + rva: 0 + offset: 0 + - ordinal: 2390 + rva: 0 + offset: 0 + - ordinal: 2391 + rva: 0 + offset: 0 + - ordinal: 2392 + rva: 0 + offset: 0 + - ordinal: 2393 + rva: 0 + offset: 0 + - ordinal: 2394 + rva: 0 + offset: 0 + - ordinal: 2395 + rva: 0 + offset: 0 + - ordinal: 2396 + rva: 0 + offset: 0 + - ordinal: 2397 + rva: 0 + offset: 0 + - ordinal: 2398 + rva: 0 + offset: 0 + - ordinal: 2399 + rva: 0 + offset: 0 + - ordinal: 2400 + rva: 0 + offset: 0 + - ordinal: 2401 + rva: 0 + offset: 0 + - ordinal: 2402 + rva: 0 + offset: 0 + - ordinal: 2403 + rva: 0 + offset: 0 + - ordinal: 2404 + rva: 0 + offset: 0 + - ordinal: 2405 + rva: 0 + offset: 0 + - ordinal: 2406 + rva: 0 + offset: 0 + - ordinal: 2407 + rva: 0 + offset: 0 + - ordinal: 2408 + rva: 0 + offset: 0 + - ordinal: 2409 + rva: 0 + offset: 0 + - ordinal: 2410 + rva: 0 + offset: 0 + - ordinal: 2411 + rva: 0 + offset: 0 + - ordinal: 2412 + rva: 0 + offset: 0 + - ordinal: 2413 + rva: 0 + offset: 0 + - ordinal: 2414 + rva: 0 + offset: 0 + - ordinal: 2415 + rva: 0 + offset: 0 + - ordinal: 2416 + rva: 0 + offset: 0 + - ordinal: 2417 + rva: 0 + offset: 0 + - ordinal: 2418 + rva: 0 + offset: 0 + - ordinal: 2419 + rva: 0 + offset: 0 + - ordinal: 2420 + rva: 0 + offset: 0 + - ordinal: 2421 + rva: 0 + offset: 0 + - ordinal: 2422 + rva: 0 + offset: 0 + - ordinal: 2423 + rva: 0 + offset: 0 + - ordinal: 2424 + rva: 0 + offset: 0 + - ordinal: 2425 + rva: 0 + offset: 0 + - ordinal: 2426 + rva: 0 + offset: 0 + - ordinal: 2427 + rva: 0 + offset: 0 + - ordinal: 2428 + rva: 0 + offset: 0 + - ordinal: 2429 + rva: 0 + offset: 0 + - ordinal: 2430 + rva: 0 + offset: 0 + - ordinal: 2431 + rva: 0 + offset: 0 + - ordinal: 2432 + rva: 0 + offset: 0 + - ordinal: 2433 + rva: 0 + offset: 0 + - ordinal: 2434 + rva: 0 + offset: 0 + - ordinal: 2435 + rva: 0 + offset: 0 + - ordinal: 2436 + rva: 0 + offset: 0 + - ordinal: 2437 + rva: 0 + offset: 0 + - ordinal: 2438 + rva: 0 + offset: 0 + - ordinal: 2439 + rva: 0 + offset: 0 + - ordinal: 2440 + rva: 0 + offset: 0 + - ordinal: 2441 + rva: 0 + offset: 0 + - ordinal: 2442 + rva: 0 + offset: 0 + - ordinal: 2443 + rva: 0 + offset: 0 + - ordinal: 2444 + rva: 0 + offset: 0 + - ordinal: 2445 + rva: 0 + offset: 0 + - ordinal: 2446 + rva: 0 + offset: 0 + - ordinal: 2447 + rva: 0 + offset: 0 + - ordinal: 2448 + rva: 0 + offset: 0 + - ordinal: 2449 + rva: 0 + offset: 0 + - ordinal: 2450 + rva: 0 + offset: 0 + - ordinal: 2451 + rva: 0 + offset: 0 + - ordinal: 2452 + rva: 0 + offset: 0 + - ordinal: 2453 + rva: 0 + offset: 0 + - ordinal: 2454 + rva: 0 + offset: 0 + - ordinal: 2455 + rva: 0 + offset: 0 + - ordinal: 2456 + rva: 0 + offset: 0 + - ordinal: 2457 + rva: 0 + offset: 0 + - ordinal: 2458 + rva: 0 + offset: 0 + - ordinal: 2459 + rva: 0 + offset: 0 + - ordinal: 2460 + rva: 0 + offset: 0 + - ordinal: 2461 + rva: 0 + offset: 0 + - ordinal: 2462 + rva: 0 + offset: 0 + - ordinal: 2463 + rva: 0 + offset: 0 + - ordinal: 2464 + rva: 0 + offset: 0 + - ordinal: 2465 + rva: 0 + offset: 0 + - ordinal: 2466 + rva: 0 + offset: 0 + - ordinal: 2467 + rva: 0 + offset: 0 + - ordinal: 2468 + rva: 0 + offset: 0 + - ordinal: 2469 + rva: 0 + offset: 0 + - ordinal: 2470 + rva: 0 + offset: 0 + - ordinal: 2471 + rva: 0 + offset: 0 + - ordinal: 2472 + rva: 0 + offset: 0 + - ordinal: 2473 + rva: 0 + offset: 0 + - ordinal: 2474 + rva: 0 + offset: 0 + - ordinal: 2475 + rva: 0 + offset: 0 + - ordinal: 2476 + rva: 0 + offset: 0 + - ordinal: 2477 + rva: 0 + offset: 0 + - ordinal: 2478 + rva: 0 + offset: 0 + - ordinal: 2479 + rva: 0 + offset: 0 + - ordinal: 2480 + rva: 0 + offset: 0 + - ordinal: 2481 + rva: 0 + offset: 0 + - ordinal: 2482 + rva: 0 + offset: 0 + - ordinal: 2483 + rva: 0 + offset: 0 + - ordinal: 2484 + rva: 0 + offset: 0 + - ordinal: 2485 + rva: 0 + offset: 0 + - ordinal: 2486 + rva: 0 + offset: 0 + - ordinal: 2487 + rva: 0 + offset: 0 + - ordinal: 2488 + rva: 0 + offset: 0 + - ordinal: 2489 + rva: 0 + offset: 0 + - ordinal: 2490 + rva: 0 + offset: 0 + - ordinal: 2491 + rva: 0 + offset: 0 + - ordinal: 2492 + rva: 0 + offset: 0 + - ordinal: 2493 + rva: 0 + offset: 0 + - ordinal: 2494 + rva: 0 + offset: 0 + - ordinal: 2495 + rva: 0 + offset: 0 + - ordinal: 2496 + rva: 0 + offset: 0 + - ordinal: 2497 + rva: 0 + offset: 0 + - ordinal: 2498 + rva: 0 + offset: 0 + - ordinal: 2499 + rva: 0 + offset: 0 + - ordinal: 2500 + rva: 0 + offset: 0 + - ordinal: 2501 + rva: 0 + offset: 0 + - ordinal: 2502 + rva: 0 + offset: 0 + - ordinal: 2503 + rva: 0 + offset: 0 + - ordinal: 2504 + rva: 0 + offset: 0 + - ordinal: 2505 + rva: 0 + offset: 0 + - ordinal: 2506 + rva: 0 + offset: 0 + - ordinal: 2507 + rva: 0 + offset: 0 + - ordinal: 2508 + rva: 0 + offset: 0 + - ordinal: 2509 + rva: 0 + offset: 0 + - ordinal: 2510 + rva: 0 + offset: 0 + - ordinal: 2511 + rva: 0 + offset: 0 + - ordinal: 2512 + rva: 0 + offset: 0 + - ordinal: 2513 + rva: 0 + offset: 0 + - ordinal: 2514 + rva: 0 + offset: 0 + - ordinal: 2515 + rva: 0 + offset: 0 + - ordinal: 2516 + rva: 0 + offset: 0 + - ordinal: 2517 + rva: 0 + offset: 0 + - ordinal: 2518 + rva: 0 + offset: 0 + - ordinal: 2519 + rva: 0 + offset: 0 + - ordinal: 2520 + rva: 0 + offset: 0 + - ordinal: 2521 + rva: 0 + offset: 0 + - ordinal: 2522 + rva: 0 + offset: 0 + - ordinal: 2523 + rva: 0 + offset: 0 + - ordinal: 2524 + rva: 0 + offset: 0 + - ordinal: 2525 + rva: 0 + offset: 0 + - ordinal: 2526 + rva: 0 + offset: 0 + - ordinal: 2527 + rva: 0 + offset: 0 + - ordinal: 2528 + rva: 0 + offset: 0 + - ordinal: 2529 + rva: 0 + offset: 0 + - ordinal: 2530 + rva: 0 + offset: 0 + - ordinal: 2531 + rva: 0 + offset: 0 + - ordinal: 2532 + rva: 0 + offset: 0 + - ordinal: 2533 + rva: 0 + offset: 0 + - ordinal: 2534 + rva: 0 + offset: 0 + - ordinal: 2535 + rva: 0 + offset: 0 + - ordinal: 2536 + rva: 0 + offset: 0 + - ordinal: 2537 + rva: 0 + offset: 0 + - ordinal: 2538 + rva: 0 + offset: 0 + - ordinal: 2539 + rva: 0 + offset: 0 + - ordinal: 2540 + rva: 0 + offset: 0 + - ordinal: 2541 + rva: 0 + offset: 0 + - ordinal: 2542 + rva: 0 + offset: 0 + - ordinal: 2543 + rva: 0 + offset: 0 + - ordinal: 2544 + rva: 0 + offset: 0 + - ordinal: 2545 + rva: 0 + offset: 0 + - ordinal: 2546 + rva: 0 + offset: 0 + - ordinal: 2547 + rva: 0 + offset: 0 + - ordinal: 2548 + rva: 0 + offset: 0 + - ordinal: 2549 + rva: 0 + offset: 0 + - ordinal: 2550 + rva: 0 + offset: 0 + - ordinal: 2551 + rva: 0 + offset: 0 + - ordinal: 2552 + rva: 0 + offset: 0 + - ordinal: 2553 + rva: 0 + offset: 0 + - ordinal: 2554 + rva: 0 + offset: 0 + - ordinal: 2555 + rva: 0 + offset: 0 + - ordinal: 2556 + rva: 0 + offset: 0 + - ordinal: 2557 + rva: 0 + offset: 0 + - ordinal: 2558 + rva: 0 + offset: 0 + - ordinal: 2559 + rva: 0 + offset: 0 + - ordinal: 2560 + rva: 0 + offset: 0 + - ordinal: 2561 + rva: 0 + offset: 0 + - ordinal: 2562 + rva: 0 + offset: 0 + - ordinal: 2563 + rva: 0 + offset: 0 + - ordinal: 2564 + rva: 0 + offset: 0 + - ordinal: 2565 + rva: 0 + offset: 0 + - ordinal: 2566 + rva: 0 + offset: 0 + - ordinal: 2567 + rva: 0 + offset: 0 + - ordinal: 2568 + rva: 0 + offset: 0 + - ordinal: 2569 + rva: 0 + offset: 0 + - ordinal: 2570 + rva: 0 + offset: 0 + - ordinal: 2571 + rva: 0 + offset: 0 + - ordinal: 2572 + rva: 0 + offset: 0 + - ordinal: 2573 + rva: 0 + offset: 0 + - ordinal: 2574 + rva: 0 + offset: 0 + - ordinal: 2575 + rva: 0 + offset: 0 + - ordinal: 2576 + rva: 0 + offset: 0 + - ordinal: 2577 + rva: 0 + offset: 0 + - ordinal: 2578 + rva: 0 + offset: 0 + - ordinal: 2579 + rva: 0 + offset: 0 + - ordinal: 2580 + rva: 0 + offset: 0 + - ordinal: 2581 + rva: 0 + offset: 0 + - ordinal: 2582 + rva: 0 + offset: 0 + - ordinal: 2583 + rva: 0 + offset: 0 + - ordinal: 2584 + rva: 0 + offset: 0 + - ordinal: 2585 + rva: 0 + offset: 0 + - ordinal: 2586 + rva: 0 + offset: 0 + - ordinal: 2587 + rva: 0 + offset: 0 + - ordinal: 2588 + rva: 0 + offset: 0 + - ordinal: 2589 + rva: 0 + offset: 0 + - ordinal: 2590 + rva: 0 + offset: 0 + - ordinal: 2591 + rva: 0 + offset: 0 + - ordinal: 2592 + rva: 0 + offset: 0 + - ordinal: 2593 + rva: 0 + offset: 0 + - ordinal: 2594 + rva: 0 + offset: 0 + - ordinal: 2595 + rva: 0 + offset: 0 + - ordinal: 2596 + rva: 0 + offset: 0 + - ordinal: 2597 + rva: 0 + offset: 0 + - ordinal: 2598 + rva: 0 + offset: 0 + - ordinal: 2599 + rva: 0 + offset: 0 + - ordinal: 2600 + rva: 0 + offset: 0 + - ordinal: 2601 + rva: 0 + offset: 0 + - ordinal: 2602 + rva: 0 + offset: 0 + - ordinal: 2603 + rva: 0 + offset: 0 + - ordinal: 2604 + rva: 0 + offset: 0 + - ordinal: 2605 + rva: 0 + offset: 0 + - ordinal: 2606 + rva: 0 + offset: 0 + - ordinal: 2607 + rva: 0 + offset: 0 + - ordinal: 2608 + rva: 0 + offset: 0 + - ordinal: 2609 + rva: 0 + offset: 0 + - ordinal: 2610 + rva: 0 + offset: 0 + - ordinal: 2611 + rva: 0 + offset: 0 + - ordinal: 2612 + rva: 0 + offset: 0 + - ordinal: 2613 + rva: 0 + offset: 0 + - ordinal: 2614 + rva: 0 + offset: 0 + - ordinal: 2615 + rva: 0 + offset: 0 + - ordinal: 2616 + rva: 0 + offset: 0 + - ordinal: 2617 + rva: 0 + offset: 0 + - ordinal: 2618 + rva: 0 + offset: 0 + - ordinal: 2619 + rva: 0 + offset: 0 + - ordinal: 2620 + rva: 0 + offset: 0 + - ordinal: 2621 + rva: 0 + offset: 0 + - ordinal: 2622 + rva: 0 + offset: 0 + - ordinal: 2623 + rva: 0 + offset: 0 + - ordinal: 2624 + rva: 0 + offset: 0 + - ordinal: 2625 + rva: 0 + offset: 0 + - ordinal: 2626 + rva: 0 + offset: 0 + - ordinal: 2627 + rva: 0 + offset: 0 + - ordinal: 2628 + rva: 0 + offset: 0 + - ordinal: 2629 + rva: 0 + offset: 0 + - ordinal: 2630 + rva: 0 + offset: 0 + - ordinal: 2631 + rva: 0 + offset: 0 + - ordinal: 2632 + rva: 0 + offset: 0 + - ordinal: 2633 + rva: 0 + offset: 0 + - ordinal: 2634 + rva: 0 + offset: 0 + - ordinal: 2635 + rva: 0 + offset: 0 + - ordinal: 2636 + rva: 0 + offset: 0 + - ordinal: 2637 + rva: 0 + offset: 0 + - ordinal: 2638 + rva: 0 + offset: 0 + - ordinal: 2639 + rva: 0 + offset: 0 + - ordinal: 2640 + rva: 0 + offset: 0 + - ordinal: 2641 + rva: 0 + offset: 0 + - ordinal: 2642 + rva: 0 + offset: 0 + - ordinal: 2643 + rva: 0 + offset: 0 + - ordinal: 2644 + rva: 0 + offset: 0 + - ordinal: 2645 + rva: 0 + offset: 0 + - ordinal: 2646 + rva: 0 + offset: 0 + - ordinal: 2647 + rva: 0 + offset: 0 + - ordinal: 2648 + rva: 0 + offset: 0 + - ordinal: 2649 + rva: 0 + offset: 0 + - ordinal: 2650 + rva: 0 + offset: 0 + - ordinal: 2651 + rva: 0 + offset: 0 + - ordinal: 2652 + rva: 0 + offset: 0 + - ordinal: 2653 + rva: 0 + offset: 0 + - ordinal: 2654 + rva: 0 + offset: 0 + - ordinal: 2655 + rva: 0 + offset: 0 + - ordinal: 2656 + rva: 0 + offset: 0 + - ordinal: 2657 + rva: 0 + offset: 0 + - ordinal: 2658 + rva: 0 + offset: 0 + - ordinal: 2659 + rva: 0 + offset: 0 + - ordinal: 2660 + rva: 0 + offset: 0 + - ordinal: 2661 + rva: 0 + offset: 0 + - ordinal: 2662 + rva: 0 + offset: 0 + - ordinal: 2663 + rva: 0 + offset: 0 + - ordinal: 2664 + rva: 0 + offset: 0 + - ordinal: 2665 + rva: 0 + offset: 0 + - ordinal: 2666 + rva: 0 + offset: 0 + - ordinal: 2667 + rva: 0 + offset: 0 + - ordinal: 2668 + rva: 0 + offset: 0 + - ordinal: 2669 + rva: 0 + offset: 0 + - ordinal: 2670 + rva: 0 + offset: 0 + - ordinal: 2671 + rva: 0 + offset: 0 + - ordinal: 2672 + rva: 0 + offset: 0 + - ordinal: 2673 + rva: 0 + offset: 0 + - ordinal: 2674 + rva: 0 + offset: 0 + - ordinal: 2675 + rva: 0 + offset: 0 + - ordinal: 2676 + rva: 0 + offset: 0 + - ordinal: 2677 + rva: 0 + offset: 0 + - ordinal: 2678 + rva: 0 + offset: 0 + - ordinal: 2679 + rva: 0 + offset: 0 + - ordinal: 2680 + rva: 0 + offset: 0 + - ordinal: 2681 + rva: 0 + offset: 0 + - ordinal: 2682 + rva: 0 + offset: 0 + - ordinal: 2683 + rva: 0 + offset: 0 + - ordinal: 2684 + rva: 0 + offset: 0 + - ordinal: 2685 + rva: 0 + offset: 0 + - ordinal: 2686 + rva: 0 + offset: 0 + - ordinal: 2687 + rva: 0 + offset: 0 + - ordinal: 2688 + rva: 0 + offset: 0 + - ordinal: 2689 + rva: 0 + offset: 0 + - ordinal: 2690 + rva: 0 + offset: 0 + - ordinal: 2691 + rva: 0 + offset: 0 + - ordinal: 2692 + rva: 0 + offset: 0 + - ordinal: 2693 + rva: 0 + offset: 0 + - ordinal: 2694 + rva: 0 + offset: 0 + - ordinal: 2695 + rva: 0 + offset: 0 + - ordinal: 2696 + rva: 0 + offset: 0 + - ordinal: 2697 + rva: 0 + offset: 0 + - ordinal: 2698 + rva: 0 + offset: 0 + - ordinal: 2699 + rva: 0 + offset: 0 + - ordinal: 2700 + rva: 0 + offset: 0 + - ordinal: 2701 + rva: 0 + offset: 0 + - ordinal: 2702 + rva: 0 + offset: 0 + - ordinal: 2703 + rva: 0 + offset: 0 + - ordinal: 2704 + rva: 0 + offset: 0 + - ordinal: 2705 + rva: 0 + offset: 0 + - ordinal: 2706 + rva: 0 + offset: 0 + - ordinal: 2707 + rva: 0 + offset: 0 + - ordinal: 2708 + rva: 0 + offset: 0 + - ordinal: 2709 + rva: 0 + offset: 0 + - ordinal: 2710 + rva: 0 + offset: 0 + - ordinal: 2711 + rva: 0 + offset: 0 + - ordinal: 2712 + rva: 0 + offset: 0 + - ordinal: 2713 + rva: 0 + offset: 0 + - ordinal: 2714 + rva: 0 + offset: 0 + - ordinal: 2715 + rva: 0 + offset: 0 + - ordinal: 2716 + rva: 0 + offset: 0 + - ordinal: 2717 + rva: 0 + offset: 0 + - ordinal: 2718 + rva: 0 + offset: 0 + - ordinal: 2719 + rva: 0 + offset: 0 + - ordinal: 2720 + rva: 0 + offset: 0 + - ordinal: 2721 + rva: 0 + offset: 0 + - ordinal: 2722 + rva: 0 + offset: 0 + - ordinal: 2723 + rva: 0 + offset: 0 + - ordinal: 2724 + rva: 0 + offset: 0 + - ordinal: 2725 + rva: 0 + offset: 0 + - ordinal: 2726 + rva: 0 + offset: 0 + - ordinal: 2727 + rva: 0 + offset: 0 + - ordinal: 2728 + rva: 0 + offset: 0 + - ordinal: 2729 + rva: 0 + offset: 0 + - ordinal: 2730 + rva: 0 + offset: 0 + - ordinal: 2731 + rva: 0 + offset: 0 + - ordinal: 2732 + rva: 0 + offset: 0 + - ordinal: 2733 + rva: 0 + offset: 0 + - ordinal: 2734 + rva: 0 + offset: 0 + - ordinal: 2735 + rva: 0 + offset: 0 + - ordinal: 2736 + rva: 0 + offset: 0 + - ordinal: 2737 + rva: 0 + offset: 0 + - ordinal: 2738 + rva: 0 + offset: 0 + - ordinal: 2739 + rva: 0 + offset: 0 + - ordinal: 2740 + rva: 0 + offset: 0 + - ordinal: 2741 + rva: 0 + offset: 0 + - ordinal: 2742 + rva: 0 + offset: 0 + - ordinal: 2743 + rva: 0 + offset: 0 + - ordinal: 2744 + rva: 0 + offset: 0 + - ordinal: 2745 + rva: 0 + offset: 0 + - ordinal: 2746 + rva: 0 + offset: 0 + - ordinal: 2747 + rva: 0 + offset: 0 + - ordinal: 2748 + rva: 0 + offset: 0 + - ordinal: 2749 + rva: 0 + offset: 0 + - ordinal: 2750 + rva: 0 + offset: 0 + - ordinal: 2751 + rva: 0 + offset: 0 + - ordinal: 2752 + rva: 0 + offset: 0 + - ordinal: 2753 + rva: 0 + offset: 0 + - ordinal: 2754 + rva: 0 + offset: 0 + - ordinal: 2755 + rva: 0 + offset: 0 + - ordinal: 2756 + rva: 0 + offset: 0 + - ordinal: 2757 + rva: 0 + offset: 0 + - ordinal: 2758 + rva: 0 + offset: 0 + - ordinal: 2759 + rva: 0 + offset: 0 + - ordinal: 2760 + rva: 0 + offset: 0 + - ordinal: 2761 + rva: 0 + offset: 0 + - ordinal: 2762 + rva: 0 + offset: 0 + - ordinal: 2763 + rva: 0 + offset: 0 + - ordinal: 2764 + rva: 0 + offset: 0 + - ordinal: 2765 + rva: 0 + offset: 0 + - ordinal: 2766 + rva: 0 + offset: 0 + - ordinal: 2767 + rva: 0 + offset: 0 + - ordinal: 2768 + rva: 0 + offset: 0 + - ordinal: 2769 + rva: 0 + offset: 0 + - ordinal: 2770 + rva: 0 + offset: 0 + - ordinal: 2771 + rva: 0 + offset: 0 + - ordinal: 2772 + rva: 0 + offset: 0 + - ordinal: 2773 + rva: 0 + offset: 0 + - ordinal: 2774 + rva: 0 + offset: 0 + - ordinal: 2775 + rva: 0 + offset: 0 + - ordinal: 2776 + rva: 0 + offset: 0 + - ordinal: 2777 + rva: 0 + offset: 0 + - ordinal: 2778 + rva: 0 + offset: 0 + - ordinal: 2779 + rva: 0 + offset: 0 + - ordinal: 2780 + rva: 0 + offset: 0 + - ordinal: 2781 + rva: 0 + offset: 0 + - ordinal: 2782 + rva: 0 + offset: 0 + - ordinal: 2783 + rva: 0 + offset: 0 + - ordinal: 2784 + rva: 0 + offset: 0 + - ordinal: 2785 + rva: 0 + offset: 0 + - ordinal: 2786 + rva: 0 + offset: 0 + - ordinal: 2787 + rva: 0 + offset: 0 + - ordinal: 2788 + rva: 0 + offset: 0 + - ordinal: 2789 + rva: 0 + offset: 0 + - ordinal: 2790 + rva: 0 + offset: 0 + - ordinal: 2791 + rva: 0 + offset: 0 + - ordinal: 2792 + rva: 0 + offset: 0 + - ordinal: 2793 + rva: 0 + offset: 0 + - ordinal: 2794 + rva: 0 + offset: 0 + - ordinal: 2795 + rva: 0 + offset: 0 + - ordinal: 2796 + rva: 0 + offset: 0 + - ordinal: 2797 + rva: 0 + offset: 0 + - ordinal: 2798 + rva: 0 + offset: 0 + - ordinal: 2799 + rva: 0 + offset: 0 + - ordinal: 2800 + rva: 0 + offset: 0 + - ordinal: 2801 + rva: 0 + offset: 0 + - ordinal: 2802 + rva: 0 + offset: 0 + - ordinal: 2803 + rva: 0 + offset: 0 + - ordinal: 2804 + rva: 0 + offset: 0 + - ordinal: 2805 + rva: 0 + offset: 0 + - ordinal: 2806 + rva: 0 + offset: 0 + - ordinal: 2807 + rva: 0 + offset: 0 + - ordinal: 2808 + rva: 0 + offset: 0 + - ordinal: 2809 + rva: 0 + offset: 0 + - ordinal: 2810 + rva: 0 + offset: 0 + - ordinal: 2811 + rva: 0 + offset: 0 + - ordinal: 2812 + rva: 0 + offset: 0 + - ordinal: 2813 + rva: 0 + offset: 0 + - ordinal: 2814 + rva: 0 + offset: 0 + - ordinal: 2815 + rva: 0 + offset: 0 + - ordinal: 2816 + rva: 0 + offset: 0 + - ordinal: 2817 + rva: 0 + offset: 0 + - ordinal: 2818 + rva: 0 + offset: 0 + - ordinal: 2819 + rva: 0 + offset: 0 + - ordinal: 2820 + rva: 0 + offset: 0 + - ordinal: 2821 + rva: 0 + offset: 0 + - ordinal: 2822 + rva: 0 + offset: 0 + - ordinal: 2823 + rva: 0 + offset: 0 + - ordinal: 2824 + rva: 0 + offset: 0 + - ordinal: 2825 + rva: 0 + offset: 0 + - ordinal: 2826 + rva: 0 + offset: 0 + - ordinal: 2827 + rva: 0 + offset: 0 + - ordinal: 2828 + rva: 0 + offset: 0 + - ordinal: 2829 + rva: 0 + offset: 0 + - ordinal: 2830 + rva: 0 + offset: 0 + - ordinal: 2831 + rva: 0 + offset: 0 + - ordinal: 2832 + rva: 0 + offset: 0 + - ordinal: 2833 + rva: 0 + offset: 0 + - ordinal: 2834 + rva: 0 + offset: 0 + - ordinal: 2835 + rva: 0 + offset: 0 + - ordinal: 2836 + rva: 0 + offset: 0 + - ordinal: 2837 + rva: 0 + offset: 0 + - ordinal: 2838 + rva: 0 + offset: 0 + - ordinal: 2839 + rva: 0 + offset: 0 + - ordinal: 2840 + rva: 0 + offset: 0 + - ordinal: 2841 + rva: 0 + offset: 0 + - ordinal: 2842 + rva: 0 + offset: 0 + - ordinal: 2843 + rva: 0 + offset: 0 + - ordinal: 2844 + rva: 0 + offset: 0 + - ordinal: 2845 + rva: 0 + offset: 0 + - ordinal: 2846 + rva: 0 + offset: 0 + - ordinal: 2847 + rva: 0 + offset: 0 + - ordinal: 2848 + rva: 0 + offset: 0 + - ordinal: 2849 + rva: 0 + offset: 0 + - ordinal: 2850 + rva: 0 + offset: 0 + - ordinal: 2851 + rva: 0 + offset: 0 + - ordinal: 2852 + rva: 0 + offset: 0 + - ordinal: 2853 + rva: 0 + offset: 0 + - ordinal: 2854 + rva: 0 + offset: 0 + - ordinal: 2855 + rva: 0 + offset: 0 + - ordinal: 2856 + rva: 0 + offset: 0 + - ordinal: 2857 + rva: 0 + offset: 0 + - ordinal: 2858 + rva: 0 + offset: 0 + - ordinal: 2859 + rva: 0 + offset: 0 + - ordinal: 2860 + rva: 0 + offset: 0 + - ordinal: 2861 + rva: 0 + offset: 0 + - ordinal: 2862 + rva: 0 + offset: 0 + - ordinal: 2863 + rva: 0 + offset: 0 + - ordinal: 2864 + rva: 0 + offset: 0 + - ordinal: 2865 + rva: 0 + offset: 0 + - ordinal: 2866 + rva: 0 + offset: 0 + - ordinal: 2867 + rva: 0 + offset: 0 + - ordinal: 2868 + rva: 0 + offset: 0 + - ordinal: 2869 + rva: 0 + offset: 0 + - ordinal: 2870 + rva: 0 + offset: 0 + - ordinal: 2871 + rva: 0 + offset: 0 + - ordinal: 2872 + rva: 0 + offset: 0 + - ordinal: 2873 + rva: 0 + offset: 0 + - ordinal: 2874 + rva: 0 + offset: 0 + - ordinal: 2875 + rva: 0 + offset: 0 + - ordinal: 2876 + rva: 0 + offset: 0 + - ordinal: 2877 + rva: 0 + offset: 0 + - ordinal: 2878 + rva: 0 + offset: 0 + - ordinal: 2879 + rva: 0 + offset: 0 + - ordinal: 2880 + rva: 0 + offset: 0 + - ordinal: 2881 + rva: 0 + offset: 0 + - ordinal: 2882 + rva: 0 + offset: 0 + - ordinal: 2883 + rva: 0 + offset: 0 + - ordinal: 2884 + rva: 0 + offset: 0 + - ordinal: 2885 + rva: 0 + offset: 0 + - ordinal: 2886 + rva: 0 + offset: 0 + - ordinal: 2887 + rva: 0 + offset: 0 + - ordinal: 2888 + rva: 0 + offset: 0 + - ordinal: 2889 + rva: 0 + offset: 0 + - ordinal: 2890 + rva: 0 + offset: 0 + - ordinal: 2891 + rva: 0 + offset: 0 + - ordinal: 2892 + rva: 0 + offset: 0 + - ordinal: 2893 + rva: 0 + offset: 0 + - ordinal: 2894 + rva: 0 + offset: 0 + - ordinal: 2895 + rva: 0 + offset: 0 + - ordinal: 2896 + rva: 0 + offset: 0 + - ordinal: 2897 + rva: 0 + offset: 0 + - ordinal: 2898 + rva: 0 + offset: 0 + - ordinal: 2899 + rva: 0 + offset: 0 + - ordinal: 2900 + rva: 0 + offset: 0 + - ordinal: 2901 + rva: 0 + offset: 0 + - ordinal: 2902 + rva: 0 + offset: 0 + - ordinal: 2903 + rva: 0 + offset: 0 + - ordinal: 2904 + rva: 0 + offset: 0 + - ordinal: 2905 + rva: 0 + offset: 0 + - ordinal: 2906 + rva: 0 + offset: 0 + - ordinal: 2907 + rva: 0 + offset: 0 + - ordinal: 2908 + rva: 0 + offset: 0 + - ordinal: 2909 + rva: 0 + offset: 0 + - ordinal: 2910 + rva: 0 + offset: 0 + - ordinal: 2911 + rva: 0 + offset: 0 + - ordinal: 2912 + rva: 0 + offset: 0 + - ordinal: 2913 + rva: 0 + offset: 0 + - ordinal: 2914 + rva: 0 + offset: 0 + - ordinal: 2915 + rva: 0 + offset: 0 + - ordinal: 2916 + rva: 0 + offset: 0 + - ordinal: 2917 + rva: 0 + offset: 0 + - ordinal: 2918 + rva: 0 + offset: 0 + - ordinal: 2919 + rva: 0 + offset: 0 + - ordinal: 2920 + rva: 0 + offset: 0 + - ordinal: 2921 + rva: 0 + offset: 0 + - ordinal: 2922 + rva: 0 + offset: 0 + - ordinal: 2923 + rva: 0 + offset: 0 + - ordinal: 2924 + rva: 0 + offset: 0 + - ordinal: 2925 + rva: 0 + offset: 0 + - ordinal: 2926 + rva: 0 + offset: 0 + - ordinal: 2927 + rva: 0 + offset: 0 + - ordinal: 2928 + rva: 0 + offset: 0 + - ordinal: 2929 + rva: 0 + offset: 0 + - ordinal: 2930 + rva: 0 + offset: 0 + - ordinal: 2931 + rva: 0 + offset: 0 + - ordinal: 2932 + rva: 0 + offset: 0 + - ordinal: 2933 + rva: 0 + offset: 0 + - ordinal: 2934 + rva: 0 + offset: 0 + - ordinal: 2935 + rva: 0 + offset: 0 + - ordinal: 2936 + rva: 0 + offset: 0 + - ordinal: 2937 + rva: 0 + offset: 0 + - ordinal: 2938 + rva: 0 + offset: 0 + - ordinal: 2939 + rva: 0 + offset: 0 + - ordinal: 2940 + rva: 0 + offset: 0 + - ordinal: 2941 + rva: 0 + offset: 0 + - ordinal: 2942 + rva: 0 + offset: 0 + - ordinal: 2943 + rva: 0 + offset: 0 + - ordinal: 2944 + rva: 0 + offset: 0 + - ordinal: 2945 + rva: 0 + offset: 0 + - ordinal: 2946 + rva: 0 + offset: 0 + - ordinal: 2947 + rva: 0 + offset: 0 + - ordinal: 2948 + rva: 0 + offset: 0 + - ordinal: 2949 + rva: 0 + offset: 0 + - ordinal: 2950 + rva: 0 + offset: 0 + - ordinal: 2951 + rva: 0 + offset: 0 + - ordinal: 2952 + rva: 0 + offset: 0 + - ordinal: 2953 + rva: 0 + offset: 0 + - ordinal: 2954 + rva: 0 + offset: 0 + - ordinal: 2955 + rva: 0 + offset: 0 + - ordinal: 2956 + rva: 0 + offset: 0 + - ordinal: 2957 + rva: 0 + offset: 0 + - ordinal: 2958 + rva: 0 + offset: 0 + - ordinal: 2959 + rva: 0 + offset: 0 + - ordinal: 2960 + rva: 0 + offset: 0 + - ordinal: 2961 + rva: 0 + offset: 0 + - ordinal: 2962 + rva: 0 + offset: 0 + - ordinal: 2963 + rva: 0 + offset: 0 + - ordinal: 2964 + rva: 0 + offset: 0 + - ordinal: 2965 + rva: 0 + offset: 0 + - ordinal: 2966 + rva: 0 + offset: 0 + - ordinal: 2967 + rva: 0 + offset: 0 + - ordinal: 2968 + rva: 0 + offset: 0 + - ordinal: 2969 + rva: 0 + offset: 0 + - ordinal: 2970 + rva: 0 + offset: 0 + - ordinal: 2971 + rva: 0 + offset: 0 + - ordinal: 2972 + rva: 0 + offset: 0 + - ordinal: 2973 + rva: 0 + offset: 0 + - ordinal: 2974 + rva: 0 + offset: 0 + - ordinal: 2975 + rva: 0 + offset: 0 + - ordinal: 2976 + rva: 0 + offset: 0 + - ordinal: 2977 + rva: 0 + offset: 0 + - ordinal: 2978 + rva: 0 + offset: 0 + - ordinal: 2979 + rva: 0 + offset: 0 + - ordinal: 2980 + rva: 0 + offset: 0 + - ordinal: 2981 + rva: 0 + offset: 0 + - ordinal: 2982 + rva: 0 + offset: 0 + - ordinal: 2983 + rva: 0 + offset: 0 + - ordinal: 2984 + rva: 0 + offset: 0 + - ordinal: 2985 + rva: 0 + offset: 0 + - ordinal: 2986 + rva: 0 + offset: 0 + - ordinal: 2987 + rva: 0 + offset: 0 + - ordinal: 2988 + rva: 0 + offset: 0 + - ordinal: 2989 + rva: 0 + offset: 0 + - ordinal: 2990 + rva: 0 + offset: 0 + - ordinal: 2991 + rva: 0 + offset: 0 + - ordinal: 2992 + rva: 0 + offset: 0 + - ordinal: 2993 + rva: 0 + offset: 0 + - ordinal: 2994 + rva: 0 + offset: 0 + - ordinal: 2995 + rva: 0 + offset: 0 + - ordinal: 2996 + rva: 0 + offset: 0 + - ordinal: 2997 + rva: 0 + offset: 0 + - ordinal: 2998 + rva: 0 + offset: 0 + - ordinal: 2999 + rva: 0 + offset: 0 + - ordinal: 3000 + rva: 0 + offset: 0 + - ordinal: 3001 + rva: 29456 + offset: 26384 + - ordinal: 3002 + rva: 29904 + offset: 26832 + - ordinal: 3003 + rva: 29952 + offset: 26880 + - ordinal: 3004 + rva: 30112 + offset: 27040 + - ordinal: 3005 + rva: 30256 + offset: 27184 + - ordinal: 3006 + rva: 30480 + offset: 27408 + - ordinal: 3007 + rva: 30608 + offset: 27536 + - ordinal: 3008 + rva: 0 + offset: 0 + - ordinal: 3009 + rva: 0 + offset: 0 + - ordinal: 3010 + rva: 0 + offset: 0 + - ordinal: 3011 + rva: 0 + offset: 0 + - ordinal: 3012 + rva: 0 + offset: 0 + - ordinal: 3013 + rva: 0 + offset: 0 + - ordinal: 3014 + rva: 0 + offset: 0 + - ordinal: 3015 + rva: 0 + offset: 0 + - ordinal: 3016 + rva: 0 + offset: 0 + - ordinal: 3017 + rva: 0 + offset: 0 + - ordinal: 3018 + rva: 0 + offset: 0 + - ordinal: 3019 + rva: 0 + offset: 0 + - ordinal: 3020 + rva: 0 + offset: 0 + - ordinal: 3021 + rva: 0 + offset: 0 + - ordinal: 3022 + rva: 0 + offset: 0 + - ordinal: 3023 + rva: 0 + offset: 0 + - ordinal: 3024 + rva: 0 + offset: 0 + - ordinal: 3025 + rva: 0 + offset: 0 + - ordinal: 3026 + rva: 0 + offset: 0 + - ordinal: 3027 + rva: 0 + offset: 0 + - ordinal: 3028 + rva: 0 + offset: 0 + - ordinal: 3029 + rva: 0 + offset: 0 + - ordinal: 3030 + rva: 0 + offset: 0 + - ordinal: 3031 + rva: 0 + offset: 0 + - ordinal: 3032 + rva: 0 + offset: 0 + - ordinal: 3033 + rva: 0 + offset: 0 + - ordinal: 3034 + rva: 0 + offset: 0 + - ordinal: 3035 + rva: 0 + offset: 0 + - ordinal: 3036 + rva: 0 + offset: 0 + - ordinal: 3037 + rva: 0 + offset: 0 + - ordinal: 3038 + rva: 0 + offset: 0 + - ordinal: 3039 + rva: 0 + offset: 0 + - ordinal: 3040 + rva: 0 + offset: 0 + - ordinal: 3041 + rva: 0 + offset: 0 + - ordinal: 3042 + rva: 0 + offset: 0 + - ordinal: 3043 + rva: 0 + offset: 0 + - ordinal: 3044 + rva: 0 + offset: 0 + - ordinal: 3045 + rva: 0 + offset: 0 + - ordinal: 3046 + rva: 0 + offset: 0 + - ordinal: 3047 + rva: 0 + offset: 0 + - ordinal: 3048 + rva: 0 + offset: 0 + - ordinal: 3049 + rva: 0 + offset: 0 + - ordinal: 3050 + rva: 0 + offset: 0 + - ordinal: 3051 + rva: 0 + offset: 0 + - ordinal: 3052 + rva: 0 + offset: 0 + - ordinal: 3053 + rva: 0 + offset: 0 + - ordinal: 3054 + rva: 0 + offset: 0 + - ordinal: 3055 + rva: 0 + offset: 0 + - ordinal: 3056 + rva: 0 + offset: 0 + - ordinal: 3057 + rva: 0 + offset: 0 + - ordinal: 3058 + rva: 0 + offset: 0 + - ordinal: 3059 + rva: 0 + offset: 0 + - ordinal: 3060 + rva: 0 + offset: 0 + - ordinal: 3061 + rva: 0 + offset: 0 + - ordinal: 3062 + rva: 0 + offset: 0 + - ordinal: 3063 + rva: 0 + offset: 0 + - ordinal: 3064 + rva: 0 + offset: 0 + - ordinal: 3065 + rva: 0 + offset: 0 + - ordinal: 3066 + rva: 0 + offset: 0 + - ordinal: 3067 + rva: 0 + offset: 0 + - ordinal: 3068 + rva: 0 + offset: 0 + - ordinal: 3069 + rva: 0 + offset: 0 + - ordinal: 3070 + rva: 0 + offset: 0 + - ordinal: 3071 + rva: 0 + offset: 0 + - ordinal: 3072 + rva: 0 + offset: 0 + - ordinal: 3073 + rva: 0 + offset: 0 + - ordinal: 3074 + rva: 0 + offset: 0 + - ordinal: 3075 + rva: 0 + offset: 0 + - ordinal: 3076 + rva: 0 + offset: 0 + - ordinal: 3077 + rva: 0 + offset: 0 + - ordinal: 3078 + rva: 0 + offset: 0 + - ordinal: 3079 + rva: 0 + offset: 0 + - ordinal: 3080 + rva: 0 + offset: 0 + - ordinal: 3081 + rva: 0 + offset: 0 + - ordinal: 3082 + rva: 0 + offset: 0 + - ordinal: 3083 + rva: 0 + offset: 0 + - ordinal: 3084 + rva: 0 + offset: 0 + - ordinal: 3085 + rva: 0 + offset: 0 + - ordinal: 3086 + rva: 0 + offset: 0 + - ordinal: 3087 + rva: 0 + offset: 0 + - ordinal: 3088 + rva: 0 + offset: 0 + - ordinal: 3089 + rva: 0 + offset: 0 + - ordinal: 3090 + rva: 0 + offset: 0 + - ordinal: 3091 + rva: 0 + offset: 0 + - ordinal: 3092 + rva: 0 + offset: 0 + - ordinal: 3093 + rva: 0 + offset: 0 + - ordinal: 3094 + rva: 0 + offset: 0 + - ordinal: 3095 + rva: 0 + offset: 0 + - ordinal: 3096 + rva: 0 + offset: 0 + - ordinal: 3097 + rva: 0 + offset: 0 + - ordinal: 3098 + rva: 0 + offset: 0 + - ordinal: 3099 + rva: 0 + offset: 0 + - ordinal: 3100 + rva: 0 + offset: 0 + - ordinal: 3101 + rva: 0 + offset: 0 + - ordinal: 3102 + rva: 0 + offset: 0 + - ordinal: 3103 + rva: 0 + offset: 0 + - ordinal: 3104 + rva: 0 + offset: 0 + - ordinal: 3105 + rva: 0 + offset: 0 + - ordinal: 3106 + rva: 0 + offset: 0 + - ordinal: 3107 + rva: 0 + offset: 0 + - ordinal: 3108 + rva: 0 + offset: 0 + - ordinal: 3109 + rva: 0 + offset: 0 + - ordinal: 3110 + rva: 0 + offset: 0 + - ordinal: 3111 + rva: 0 + offset: 0 + - ordinal: 3112 + rva: 0 + offset: 0 + - ordinal: 3113 + rva: 0 + offset: 0 + - ordinal: 3114 + rva: 0 + offset: 0 + - ordinal: 3115 + rva: 0 + offset: 0 + - ordinal: 3116 + rva: 0 + offset: 0 + - ordinal: 3117 + rva: 0 + offset: 0 + - ordinal: 3118 + rva: 0 + offset: 0 + - ordinal: 3119 + rva: 0 + offset: 0 + - ordinal: 3120 + rva: 0 + offset: 0 + - ordinal: 3121 + rva: 0 + offset: 0 + - ordinal: 3122 + rva: 0 + offset: 0 + - ordinal: 3123 + rva: 0 + offset: 0 + - ordinal: 3124 + rva: 0 + offset: 0 + - ordinal: 3125 + rva: 0 + offset: 0 + - ordinal: 3126 + rva: 0 + offset: 0 + - ordinal: 3127 + rva: 0 + offset: 0 + - ordinal: 3128 + rva: 0 + offset: 0 + - ordinal: 3129 + rva: 0 + offset: 0 + - ordinal: 3130 + rva: 0 + offset: 0 + - ordinal: 3131 + rva: 0 + offset: 0 + - ordinal: 3132 + rva: 0 + offset: 0 + - ordinal: 3133 + rva: 0 + offset: 0 + - ordinal: 3134 + rva: 0 + offset: 0 + - ordinal: 3135 + rva: 0 + offset: 0 + - ordinal: 3136 + rva: 0 + offset: 0 + - ordinal: 3137 + rva: 0 + offset: 0 + - ordinal: 3138 + rva: 0 + offset: 0 + - ordinal: 3139 + rva: 0 + offset: 0 + - ordinal: 3140 + rva: 0 + offset: 0 + - ordinal: 3141 + rva: 0 + offset: 0 + - ordinal: 3142 + rva: 0 + offset: 0 + - ordinal: 3143 + rva: 0 + offset: 0 + - ordinal: 3144 + rva: 0 + offset: 0 + - ordinal: 3145 + rva: 0 + offset: 0 + - ordinal: 3146 + rva: 0 + offset: 0 + - ordinal: 3147 + rva: 0 + offset: 0 + - ordinal: 3148 + rva: 0 + offset: 0 + - ordinal: 3149 + rva: 0 + offset: 0 + - ordinal: 3150 + rva: 0 + offset: 0 + - ordinal: 3151 + rva: 0 + offset: 0 + - ordinal: 3152 + rva: 0 + offset: 0 + - ordinal: 3153 + rva: 0 + offset: 0 + - ordinal: 3154 + rva: 0 + offset: 0 + - ordinal: 3155 + rva: 0 + offset: 0 + - ordinal: 3156 + rva: 0 + offset: 0 + - ordinal: 3157 + rva: 0 + offset: 0 + - ordinal: 3158 + rva: 0 + offset: 0 + - ordinal: 3159 + rva: 0 + offset: 0 + - ordinal: 3160 + rva: 0 + offset: 0 + - ordinal: 3161 + rva: 0 + offset: 0 + - ordinal: 3162 + rva: 0 + offset: 0 + - ordinal: 3163 + rva: 0 + offset: 0 + - ordinal: 3164 + rva: 0 + offset: 0 + - ordinal: 3165 + rva: 0 + offset: 0 + - ordinal: 3166 + rva: 0 + offset: 0 + - ordinal: 3167 + rva: 0 + offset: 0 + - ordinal: 3168 + rva: 0 + offset: 0 + - ordinal: 3169 + rva: 0 + offset: 0 + - ordinal: 3170 + rva: 0 + offset: 0 + - ordinal: 3171 + rva: 0 + offset: 0 + - ordinal: 3172 + rva: 0 + offset: 0 + - ordinal: 3173 + rva: 0 + offset: 0 + - ordinal: 3174 + rva: 0 + offset: 0 + - ordinal: 3175 + rva: 0 + offset: 0 + - ordinal: 3176 + rva: 0 + offset: 0 + - ordinal: 3177 + rva: 0 + offset: 0 + - ordinal: 3178 + rva: 0 + offset: 0 + - ordinal: 3179 + rva: 0 + offset: 0 + - ordinal: 3180 + rva: 0 + offset: 0 + - ordinal: 3181 + rva: 0 + offset: 0 + - ordinal: 3182 + rva: 0 + offset: 0 + - ordinal: 3183 + rva: 0 + offset: 0 + - ordinal: 3184 + rva: 0 + offset: 0 + - ordinal: 3185 + rva: 0 + offset: 0 + - ordinal: 3186 + rva: 0 + offset: 0 + - ordinal: 3187 + rva: 0 + offset: 0 + - ordinal: 3188 + rva: 0 + offset: 0 + - ordinal: 3189 + rva: 0 + offset: 0 + - ordinal: 3190 + rva: 0 + offset: 0 + - ordinal: 3191 + rva: 0 + offset: 0 + - ordinal: 3192 + rva: 0 + offset: 0 + - ordinal: 3193 + rva: 0 + offset: 0 + - ordinal: 3194 + rva: 0 + offset: 0 + - ordinal: 3195 + rva: 0 + offset: 0 + - ordinal: 3196 + rva: 0 + offset: 0 + - ordinal: 3197 + rva: 0 + offset: 0 + - ordinal: 3198 + rva: 0 + offset: 0 + - ordinal: 3199 + rva: 0 + offset: 0 + - ordinal: 3200 + rva: 0 + offset: 0 + - ordinal: 3201 + rva: 0 + offset: 0 + - ordinal: 3202 + rva: 0 + offset: 0 + - ordinal: 3203 + rva: 0 + offset: 0 + - ordinal: 3204 + rva: 0 + offset: 0 + - ordinal: 3205 + rva: 0 + offset: 0 + - ordinal: 3206 + rva: 0 + offset: 0 + - ordinal: 3207 + rva: 0 + offset: 0 + - ordinal: 3208 + rva: 0 + offset: 0 + - ordinal: 3209 + rva: 0 + offset: 0 + - ordinal: 3210 + rva: 0 + offset: 0 + - ordinal: 3211 + rva: 0 + offset: 0 + - ordinal: 3212 + rva: 0 + offset: 0 + - ordinal: 3213 + rva: 0 + offset: 0 + - ordinal: 3214 + rva: 0 + offset: 0 + - ordinal: 3215 + rva: 0 + offset: 0 + - ordinal: 3216 + rva: 0 + offset: 0 + - ordinal: 3217 + rva: 0 + offset: 0 + - ordinal: 3218 + rva: 0 + offset: 0 + - ordinal: 3219 + rva: 0 + offset: 0 + - ordinal: 3220 + rva: 0 + offset: 0 + - ordinal: 3221 + rva: 0 + offset: 0 + - ordinal: 3222 + rva: 0 + offset: 0 + - ordinal: 3223 + rva: 0 + offset: 0 + - ordinal: 3224 + rva: 0 + offset: 0 + - ordinal: 3225 + rva: 0 + offset: 0 + - ordinal: 3226 + rva: 0 + offset: 0 + - ordinal: 3227 + rva: 0 + offset: 0 + - ordinal: 3228 + rva: 0 + offset: 0 + - ordinal: 3229 + rva: 0 + offset: 0 + - ordinal: 3230 + rva: 0 + offset: 0 + - ordinal: 3231 + rva: 0 + offset: 0 + - ordinal: 3232 + rva: 0 + offset: 0 + - ordinal: 3233 + rva: 0 + offset: 0 + - ordinal: 3234 + rva: 0 + offset: 0 + - ordinal: 3235 + rva: 0 + offset: 0 + - ordinal: 3236 + rva: 0 + offset: 0 + - ordinal: 3237 + rva: 0 + offset: 0 + - ordinal: 3238 + rva: 0 + offset: 0 + - ordinal: 3239 + rva: 0 + offset: 0 + - ordinal: 3240 + rva: 0 + offset: 0 + - ordinal: 3241 + rva: 0 + offset: 0 + - ordinal: 3242 + rva: 0 + offset: 0 + - ordinal: 3243 + rva: 0 + offset: 0 + - ordinal: 3244 + rva: 0 + offset: 0 + - ordinal: 3245 + rva: 0 + offset: 0 + - ordinal: 3246 + rva: 0 + offset: 0 + - ordinal: 3247 + rva: 0 + offset: 0 + - ordinal: 3248 + rva: 0 + offset: 0 + - ordinal: 3249 + rva: 0 + offset: 0 + - ordinal: 3250 + rva: 0 + offset: 0 + - ordinal: 3251 + rva: 0 + offset: 0 + - ordinal: 3252 + rva: 0 + offset: 0 + - ordinal: 3253 + rva: 0 + offset: 0 + - ordinal: 3254 + rva: 0 + offset: 0 + - ordinal: 3255 + rva: 0 + offset: 0 + - ordinal: 3256 + rva: 0 + offset: 0 + - ordinal: 3257 + rva: 0 + offset: 0 + - ordinal: 3258 + rva: 0 + offset: 0 + - ordinal: 3259 + rva: 0 + offset: 0 + - ordinal: 3260 + rva: 0 + offset: 0 + - ordinal: 3261 + rva: 0 + offset: 0 + - ordinal: 3262 + rva: 0 + offset: 0 + - ordinal: 3263 + rva: 0 + offset: 0 + - ordinal: 3264 + rva: 0 + offset: 0 + - ordinal: 3265 + rva: 0 + offset: 0 + - ordinal: 3266 + rva: 0 + offset: 0 + - ordinal: 3267 + rva: 0 + offset: 0 + - ordinal: 3268 + rva: 0 + offset: 0 + - ordinal: 3269 + rva: 0 + offset: 0 + - ordinal: 3270 + rva: 0 + offset: 0 + - ordinal: 3271 + rva: 0 + offset: 0 + - ordinal: 3272 + rva: 0 + offset: 0 + - ordinal: 3273 + rva: 0 + offset: 0 + - ordinal: 3274 + rva: 0 + offset: 0 + - ordinal: 3275 + rva: 0 + offset: 0 + - ordinal: 3276 + rva: 0 + offset: 0 + - ordinal: 3277 + rva: 0 + offset: 0 + - ordinal: 3278 + rva: 0 + offset: 0 + - ordinal: 3279 + rva: 0 + offset: 0 + - ordinal: 3280 + rva: 0 + offset: 0 + - ordinal: 3281 + rva: 0 + offset: 0 + - ordinal: 3282 + rva: 0 + offset: 0 + - ordinal: 3283 + rva: 0 + offset: 0 + - ordinal: 3284 + rva: 0 + offset: 0 + - ordinal: 3285 + rva: 0 + offset: 0 + - ordinal: 3286 + rva: 0 + offset: 0 + - ordinal: 3287 + rva: 0 + offset: 0 + - ordinal: 3288 + rva: 0 + offset: 0 + - ordinal: 3289 + rva: 0 + offset: 0 + - ordinal: 3290 + rva: 0 + offset: 0 + - ordinal: 3291 + rva: 0 + offset: 0 + - ordinal: 3292 + rva: 0 + offset: 0 + - ordinal: 3293 + rva: 0 + offset: 0 + - ordinal: 3294 + rva: 0 + offset: 0 + - ordinal: 3295 + rva: 0 + offset: 0 + - ordinal: 3296 + rva: 0 + offset: 0 + - ordinal: 3297 + rva: 0 + offset: 0 + - ordinal: 3298 + rva: 0 + offset: 0 + - ordinal: 3299 + rva: 0 + offset: 0 + - ordinal: 3300 + rva: 0 + offset: 0 + - ordinal: 3301 + rva: 0 + offset: 0 + - ordinal: 3302 + rva: 0 + offset: 0 + - ordinal: 3303 + rva: 0 + offset: 0 + - ordinal: 3304 + rva: 0 + offset: 0 + - ordinal: 3305 + rva: 0 + offset: 0 + - ordinal: 3306 + rva: 0 + offset: 0 + - ordinal: 3307 + rva: 0 + offset: 0 + - ordinal: 3308 + rva: 0 + offset: 0 + - ordinal: 3309 + rva: 0 + offset: 0 + - ordinal: 3310 + rva: 0 + offset: 0 + - ordinal: 3311 + rva: 0 + offset: 0 + - ordinal: 3312 + rva: 0 + offset: 0 + - ordinal: 3313 + rva: 0 + offset: 0 + - ordinal: 3314 + rva: 0 + offset: 0 + - ordinal: 3315 + rva: 0 + offset: 0 + - ordinal: 3316 + rva: 0 + offset: 0 + - ordinal: 3317 + rva: 0 + offset: 0 + - ordinal: 3318 + rva: 0 + offset: 0 + - ordinal: 3319 + rva: 0 + offset: 0 + - ordinal: 3320 + rva: 0 + offset: 0 + - ordinal: 3321 + rva: 0 + offset: 0 + - ordinal: 3322 + rva: 0 + offset: 0 + - ordinal: 3323 + rva: 0 + offset: 0 + - ordinal: 3324 + rva: 0 + offset: 0 + - ordinal: 3325 + rva: 0 + offset: 0 + - ordinal: 3326 + rva: 0 + offset: 0 + - ordinal: 3327 + rva: 0 + offset: 0 + - ordinal: 3328 + rva: 0 + offset: 0 + - ordinal: 3329 + rva: 0 + offset: 0 + - ordinal: 3330 + rva: 0 + offset: 0 + - ordinal: 3331 + rva: 0 + offset: 0 + - ordinal: 3332 + rva: 0 + offset: 0 + - ordinal: 3333 + rva: 0 + offset: 0 + - ordinal: 3334 + rva: 0 + offset: 0 + - ordinal: 3335 + rva: 0 + offset: 0 + - ordinal: 3336 + rva: 0 + offset: 0 + - ordinal: 3337 + rva: 0 + offset: 0 + - ordinal: 3338 + rva: 0 + offset: 0 + - ordinal: 3339 + rva: 0 + offset: 0 + - ordinal: 3340 + rva: 0 + offset: 0 + - ordinal: 3341 + rva: 0 + offset: 0 + - ordinal: 3342 + rva: 0 + offset: 0 + - ordinal: 3343 + rva: 0 + offset: 0 + - ordinal: 3344 + rva: 0 + offset: 0 + - ordinal: 3345 + rva: 0 + offset: 0 + - ordinal: 3346 + rva: 0 + offset: 0 + - ordinal: 3347 + rva: 0 + offset: 0 + - ordinal: 3348 + rva: 0 + offset: 0 + - ordinal: 3349 + rva: 0 + offset: 0 + - ordinal: 3350 + rva: 0 + offset: 0 + - ordinal: 3351 + rva: 0 + offset: 0 + - ordinal: 3352 + rva: 0 + offset: 0 + - ordinal: 3353 + rva: 0 + offset: 0 + - ordinal: 3354 + rva: 0 + offset: 0 + - ordinal: 3355 + rva: 0 + offset: 0 + - ordinal: 3356 + rva: 0 + offset: 0 + - ordinal: 3357 + rva: 0 + offset: 0 + - ordinal: 3358 + rva: 0 + offset: 0 + - ordinal: 3359 + rva: 0 + offset: 0 + - ordinal: 3360 + rva: 0 + offset: 0 + - ordinal: 3361 + rva: 0 + offset: 0 + - ordinal: 3362 + rva: 0 + offset: 0 + - ordinal: 3363 + rva: 0 + offset: 0 + - ordinal: 3364 + rva: 0 + offset: 0 + - ordinal: 3365 + rva: 0 + offset: 0 + - ordinal: 3366 + rva: 0 + offset: 0 + - ordinal: 3367 + rva: 0 + offset: 0 + - ordinal: 3368 + rva: 0 + offset: 0 + - ordinal: 3369 + rva: 0 + offset: 0 + - ordinal: 3370 + rva: 0 + offset: 0 + - ordinal: 3371 + rva: 0 + offset: 0 + - ordinal: 3372 + rva: 0 + offset: 0 + - ordinal: 3373 + rva: 0 + offset: 0 + - ordinal: 3374 + rva: 0 + offset: 0 + - ordinal: 3375 + rva: 0 + offset: 0 + - ordinal: 3376 + rva: 0 + offset: 0 + - ordinal: 3377 + rva: 0 + offset: 0 + - ordinal: 3378 + rva: 0 + offset: 0 + - ordinal: 3379 + rva: 0 + offset: 0 + - ordinal: 3380 + rva: 0 + offset: 0 + - ordinal: 3381 + rva: 0 + offset: 0 + - ordinal: 3382 + rva: 0 + offset: 0 + - ordinal: 3383 + rva: 0 + offset: 0 + - ordinal: 3384 + rva: 0 + offset: 0 + - ordinal: 3385 + rva: 0 + offset: 0 + - ordinal: 3386 + rva: 0 + offset: 0 + - ordinal: 3387 + rva: 0 + offset: 0 + - ordinal: 3388 + rva: 0 + offset: 0 + - ordinal: 3389 + rva: 0 + offset: 0 + - ordinal: 3390 + rva: 0 + offset: 0 + - ordinal: 3391 + rva: 0 + offset: 0 + - ordinal: 3392 + rva: 0 + offset: 0 + - ordinal: 3393 + rva: 0 + offset: 0 + - ordinal: 3394 + rva: 0 + offset: 0 + - ordinal: 3395 + rva: 0 + offset: 0 + - ordinal: 3396 + rva: 0 + offset: 0 + - ordinal: 3397 + rva: 0 + offset: 0 + - ordinal: 3398 + rva: 0 + offset: 0 + - ordinal: 3399 + rva: 0 + offset: 0 + - ordinal: 3400 + rva: 0 + offset: 0 + - ordinal: 3401 + rva: 0 + offset: 0 + - ordinal: 3402 + rva: 0 + offset: 0 + - ordinal: 3403 + rva: 0 + offset: 0 + - ordinal: 3404 + rva: 0 + offset: 0 + - ordinal: 3405 + rva: 0 + offset: 0 + - ordinal: 3406 + rva: 0 + offset: 0 + - ordinal: 3407 + rva: 0 + offset: 0 + - ordinal: 3408 + rva: 0 + offset: 0 + - ordinal: 3409 + rva: 0 + offset: 0 + - ordinal: 3410 + rva: 0 + offset: 0 + - ordinal: 3411 + rva: 0 + offset: 0 + - ordinal: 3412 + rva: 0 + offset: 0 + - ordinal: 3413 + rva: 0 + offset: 0 + - ordinal: 3414 + rva: 0 + offset: 0 + - ordinal: 3415 + rva: 0 + offset: 0 + - ordinal: 3416 + rva: 0 + offset: 0 + - ordinal: 3417 + rva: 0 + offset: 0 + - ordinal: 3418 + rva: 0 + offset: 0 + - ordinal: 3419 + rva: 0 + offset: 0 + - ordinal: 3420 + rva: 0 + offset: 0 + - ordinal: 3421 + rva: 0 + offset: 0 + - ordinal: 3422 + rva: 0 + offset: 0 + - ordinal: 3423 + rva: 0 + offset: 0 + - ordinal: 3424 + rva: 0 + offset: 0 + - ordinal: 3425 + rva: 0 + offset: 0 + - ordinal: 3426 + rva: 0 + offset: 0 + - ordinal: 3427 + rva: 0 + offset: 0 + - ordinal: 3428 + rva: 0 + offset: 0 + - ordinal: 3429 + rva: 0 + offset: 0 + - ordinal: 3430 + rva: 0 + offset: 0 + - ordinal: 3431 + rva: 0 + offset: 0 + - ordinal: 3432 + rva: 0 + offset: 0 + - ordinal: 3433 + rva: 0 + offset: 0 + - ordinal: 3434 + rva: 0 + offset: 0 + - ordinal: 3435 + rva: 0 + offset: 0 + - ordinal: 3436 + rva: 0 + offset: 0 + - ordinal: 3437 + rva: 0 + offset: 0 + - ordinal: 3438 + rva: 0 + offset: 0 + - ordinal: 3439 + rva: 0 + offset: 0 + - ordinal: 3440 + rva: 0 + offset: 0 + - ordinal: 3441 + rva: 0 + offset: 0 + - ordinal: 3442 + rva: 0 + offset: 0 + - ordinal: 3443 + rva: 0 + offset: 0 + - ordinal: 3444 + rva: 0 + offset: 0 + - ordinal: 3445 + rva: 0 + offset: 0 + - ordinal: 3446 + rva: 0 + offset: 0 + - ordinal: 3447 + rva: 0 + offset: 0 + - ordinal: 3448 + rva: 0 + offset: 0 + - ordinal: 3449 + rva: 0 + offset: 0 + - ordinal: 3450 + rva: 0 + offset: 0 + - ordinal: 3451 + rva: 0 + offset: 0 + - ordinal: 3452 + rva: 0 + offset: 0 + - ordinal: 3453 + rva: 0 + offset: 0 + - ordinal: 3454 + rva: 0 + offset: 0 + - ordinal: 3455 + rva: 0 + offset: 0 + - ordinal: 3456 + rva: 0 + offset: 0 + - ordinal: 3457 + rva: 0 + offset: 0 + - ordinal: 3458 + rva: 0 + offset: 0 + - ordinal: 3459 + rva: 0 + offset: 0 + - ordinal: 3460 + rva: 0 + offset: 0 + - ordinal: 3461 + rva: 0 + offset: 0 + - ordinal: 3462 + rva: 0 + offset: 0 + - ordinal: 3463 + rva: 0 + offset: 0 + - ordinal: 3464 + rva: 0 + offset: 0 + - ordinal: 3465 + rva: 0 + offset: 0 + - ordinal: 3466 + rva: 0 + offset: 0 + - ordinal: 3467 + rva: 0 + offset: 0 + - ordinal: 3468 + rva: 0 + offset: 0 + - ordinal: 3469 + rva: 0 + offset: 0 + - ordinal: 3470 + rva: 0 + offset: 0 + - ordinal: 3471 + rva: 0 + offset: 0 + - ordinal: 3472 + rva: 0 + offset: 0 + - ordinal: 3473 + rva: 0 + offset: 0 + - ordinal: 3474 + rva: 0 + offset: 0 + - ordinal: 3475 + rva: 0 + offset: 0 + - ordinal: 3476 + rva: 0 + offset: 0 + - ordinal: 3477 + rva: 0 + offset: 0 + - ordinal: 3478 + rva: 0 + offset: 0 + - ordinal: 3479 + rva: 0 + offset: 0 + - ordinal: 3480 + rva: 0 + offset: 0 + - ordinal: 3481 + rva: 0 + offset: 0 + - ordinal: 3482 + rva: 0 + offset: 0 + - ordinal: 3483 + rva: 0 + offset: 0 + - ordinal: 3484 + rva: 0 + offset: 0 + - ordinal: 3485 + rva: 0 + offset: 0 + - ordinal: 3486 + rva: 0 + offset: 0 + - ordinal: 3487 + rva: 0 + offset: 0 + - ordinal: 3488 + rva: 0 + offset: 0 + - ordinal: 3489 + rva: 0 + offset: 0 + - ordinal: 3490 + rva: 0 + offset: 0 + - ordinal: 3491 + rva: 0 + offset: 0 + - ordinal: 3492 + rva: 0 + offset: 0 + - ordinal: 3493 + rva: 0 + offset: 0 + - ordinal: 3494 + rva: 0 + offset: 0 + - ordinal: 3495 + rva: 0 + offset: 0 + - ordinal: 3496 + rva: 0 + offset: 0 + - ordinal: 3497 + rva: 0 + offset: 0 + - ordinal: 3498 + rva: 0 + offset: 0 + - ordinal: 3499 + rva: 0 + offset: 0 + - ordinal: 3500 + rva: 0 + offset: 0 + - ordinal: 3501 + rva: 0 + offset: 0 + - ordinal: 3502 + rva: 0 + offset: 0 + - ordinal: 3503 + rva: 0 + offset: 0 + - ordinal: 3504 + rva: 0 + offset: 0 + - ordinal: 3505 + rva: 0 + offset: 0 + - ordinal: 3506 + rva: 0 + offset: 0 + - ordinal: 3507 + rva: 0 + offset: 0 + - ordinal: 3508 + rva: 0 + offset: 0 + - ordinal: 3509 + rva: 0 + offset: 0 + - ordinal: 3510 + rva: 0 + offset: 0 + - ordinal: 3511 + rva: 0 + offset: 0 + - ordinal: 3512 + rva: 0 + offset: 0 + - ordinal: 3513 + rva: 0 + offset: 0 + - ordinal: 3514 + rva: 0 + offset: 0 + - ordinal: 3515 + rva: 0 + offset: 0 + - ordinal: 3516 + rva: 0 + offset: 0 + - ordinal: 3517 + rva: 0 + offset: 0 + - ordinal: 3518 + rva: 0 + offset: 0 + - ordinal: 3519 + rva: 0 + offset: 0 + - ordinal: 3520 + rva: 0 + offset: 0 + - ordinal: 3521 + rva: 0 + offset: 0 + - ordinal: 3522 + rva: 0 + offset: 0 + - ordinal: 3523 + rva: 0 + offset: 0 + - ordinal: 3524 + rva: 0 + offset: 0 + - ordinal: 3525 + rva: 0 + offset: 0 + - ordinal: 3526 + rva: 0 + offset: 0 + - ordinal: 3527 + rva: 0 + offset: 0 + - ordinal: 3528 + rva: 0 + offset: 0 + - ordinal: 3529 + rva: 0 + offset: 0 + - ordinal: 3530 + rva: 0 + offset: 0 + - ordinal: 3531 + rva: 0 + offset: 0 + - ordinal: 3532 + rva: 0 + offset: 0 + - ordinal: 3533 + rva: 0 + offset: 0 + - ordinal: 3534 + rva: 0 + offset: 0 + - ordinal: 3535 + rva: 0 + offset: 0 + - ordinal: 3536 + rva: 0 + offset: 0 + - ordinal: 3537 + rva: 0 + offset: 0 + - ordinal: 3538 + rva: 0 + offset: 0 + - ordinal: 3539 + rva: 0 + offset: 0 + - ordinal: 3540 + rva: 0 + offset: 0 + - ordinal: 3541 + rva: 0 + offset: 0 + - ordinal: 3542 + rva: 0 + offset: 0 + - ordinal: 3543 + rva: 0 + offset: 0 + - ordinal: 3544 + rva: 0 + offset: 0 + - ordinal: 3545 + rva: 0 + offset: 0 + - ordinal: 3546 + rva: 0 + offset: 0 + - ordinal: 3547 + rva: 0 + offset: 0 + - ordinal: 3548 + rva: 0 + offset: 0 + - ordinal: 3549 + rva: 0 + offset: 0 + - ordinal: 3550 + rva: 0 + offset: 0 + - ordinal: 3551 + rva: 0 + offset: 0 + - ordinal: 3552 + rva: 0 + offset: 0 + - ordinal: 3553 + rva: 0 + offset: 0 + - ordinal: 3554 + rva: 0 + offset: 0 + - ordinal: 3555 + rva: 0 + offset: 0 + - ordinal: 3556 + rva: 0 + offset: 0 + - ordinal: 3557 + rva: 0 + offset: 0 + - ordinal: 3558 + rva: 0 + offset: 0 + - ordinal: 3559 + rva: 0 + offset: 0 + - ordinal: 3560 + rva: 0 + offset: 0 + - ordinal: 3561 + rva: 0 + offset: 0 + - ordinal: 3562 + rva: 0 + offset: 0 + - ordinal: 3563 + rva: 0 + offset: 0 + - ordinal: 3564 + rva: 0 + offset: 0 + - ordinal: 3565 + rva: 0 + offset: 0 + - ordinal: 3566 + rva: 0 + offset: 0 + - ordinal: 3567 + rva: 0 + offset: 0 + - ordinal: 3568 + rva: 0 + offset: 0 + - ordinal: 3569 + rva: 0 + offset: 0 + - ordinal: 3570 + rva: 0 + offset: 0 + - ordinal: 3571 + rva: 0 + offset: 0 + - ordinal: 3572 + rva: 0 + offset: 0 + - ordinal: 3573 + rva: 0 + offset: 0 + - ordinal: 3574 + rva: 0 + offset: 0 + - ordinal: 3575 + rva: 0 + offset: 0 + - ordinal: 3576 + rva: 0 + offset: 0 + - ordinal: 3577 + rva: 0 + offset: 0 + - ordinal: 3578 + rva: 0 + offset: 0 + - ordinal: 3579 + rva: 0 + offset: 0 + - ordinal: 3580 + rva: 0 + offset: 0 + - ordinal: 3581 + rva: 0 + offset: 0 + - ordinal: 3582 + rva: 0 + offset: 0 + - ordinal: 3583 + rva: 0 + offset: 0 + - ordinal: 3584 + rva: 0 + offset: 0 + - ordinal: 3585 + rva: 0 + offset: 0 + - ordinal: 3586 + rva: 0 + offset: 0 + - ordinal: 3587 + rva: 0 + offset: 0 + - ordinal: 3588 + rva: 0 + offset: 0 + - ordinal: 3589 + rva: 0 + offset: 0 + - ordinal: 3590 + rva: 0 + offset: 0 + - ordinal: 3591 + rva: 0 + offset: 0 + - ordinal: 3592 + rva: 0 + offset: 0 + - ordinal: 3593 + rva: 0 + offset: 0 + - ordinal: 3594 + rva: 0 + offset: 0 + - ordinal: 3595 + rva: 0 + offset: 0 + - ordinal: 3596 + rva: 0 + offset: 0 + - ordinal: 3597 + rva: 0 + offset: 0 + - ordinal: 3598 + rva: 0 + offset: 0 + - ordinal: 3599 + rva: 0 + offset: 0 + - ordinal: 3600 + rva: 0 + offset: 0 + - ordinal: 3601 + rva: 0 + offset: 0 + - ordinal: 3602 + rva: 0 + offset: 0 + - ordinal: 3603 + rva: 0 + offset: 0 + - ordinal: 3604 + rva: 0 + offset: 0 + - ordinal: 3605 + rva: 0 + offset: 0 + - ordinal: 3606 + rva: 0 + offset: 0 + - ordinal: 3607 + rva: 0 + offset: 0 + - ordinal: 3608 + rva: 0 + offset: 0 + - ordinal: 3609 + rva: 0 + offset: 0 + - ordinal: 3610 + rva: 0 + offset: 0 + - ordinal: 3611 + rva: 0 + offset: 0 + - ordinal: 3612 + rva: 0 + offset: 0 + - ordinal: 3613 + rva: 0 + offset: 0 + - ordinal: 3614 + rva: 0 + offset: 0 + - ordinal: 3615 + rva: 0 + offset: 0 + - ordinal: 3616 + rva: 0 + offset: 0 + - ordinal: 3617 + rva: 0 + offset: 0 + - ordinal: 3618 + rva: 0 + offset: 0 + - ordinal: 3619 + rva: 0 + offset: 0 + - ordinal: 3620 + rva: 0 + offset: 0 + - ordinal: 3621 + rva: 0 + offset: 0 + - ordinal: 3622 + rva: 0 + offset: 0 + - ordinal: 3623 + rva: 0 + offset: 0 + - ordinal: 3624 + rva: 0 + offset: 0 + - ordinal: 3625 + rva: 0 + offset: 0 + - ordinal: 3626 + rva: 0 + offset: 0 + - ordinal: 3627 + rva: 0 + offset: 0 + - ordinal: 3628 + rva: 0 + offset: 0 + - ordinal: 3629 + rva: 0 + offset: 0 + - ordinal: 3630 + rva: 0 + offset: 0 + - ordinal: 3631 + rva: 0 + offset: 0 + - ordinal: 3632 + rva: 0 + offset: 0 + - ordinal: 3633 + rva: 0 + offset: 0 + - ordinal: 3634 + rva: 0 + offset: 0 + - ordinal: 3635 + rva: 0 + offset: 0 + - ordinal: 3636 + rva: 0 + offset: 0 + - ordinal: 3637 + rva: 0 + offset: 0 + - ordinal: 3638 + rva: 0 + offset: 0 + - ordinal: 3639 + rva: 0 + offset: 0 + - ordinal: 3640 + rva: 0 + offset: 0 + - ordinal: 3641 + rva: 0 + offset: 0 + - ordinal: 3642 + rva: 0 + offset: 0 + - ordinal: 3643 + rva: 0 + offset: 0 + - ordinal: 3644 + rva: 0 + offset: 0 + - ordinal: 3645 + rva: 0 + offset: 0 + - ordinal: 3646 + rva: 0 + offset: 0 + - ordinal: 3647 + rva: 0 + offset: 0 + - ordinal: 3648 + rva: 0 + offset: 0 + - ordinal: 3649 + rva: 0 + offset: 0 + - ordinal: 3650 + rva: 0 + offset: 0 + - ordinal: 3651 + rva: 0 + offset: 0 + - ordinal: 3652 + rva: 0 + offset: 0 + - ordinal: 3653 + rva: 0 + offset: 0 + - ordinal: 3654 + rva: 0 + offset: 0 + - ordinal: 3655 + rva: 0 + offset: 0 + - ordinal: 3656 + rva: 0 + offset: 0 + - ordinal: 3657 + rva: 0 + offset: 0 + - ordinal: 3658 + rva: 0 + offset: 0 + - ordinal: 3659 + rva: 0 + offset: 0 + - ordinal: 3660 + rva: 0 + offset: 0 + - ordinal: 3661 + rva: 0 + offset: 0 + - ordinal: 3662 + rva: 0 + offset: 0 + - ordinal: 3663 + rva: 0 + offset: 0 + - ordinal: 3664 + rva: 0 + offset: 0 + - ordinal: 3665 + rva: 0 + offset: 0 + - ordinal: 3666 + rva: 0 + offset: 0 + - ordinal: 3667 + rva: 0 + offset: 0 + - ordinal: 3668 + rva: 0 + offset: 0 + - ordinal: 3669 + rva: 0 + offset: 0 + - ordinal: 3670 + rva: 0 + offset: 0 + - ordinal: 3671 + rva: 0 + offset: 0 + - ordinal: 3672 + rva: 0 + offset: 0 + - ordinal: 3673 + rva: 0 + offset: 0 + - ordinal: 3674 + rva: 0 + offset: 0 + - ordinal: 3675 + rva: 0 + offset: 0 + - ordinal: 3676 + rva: 0 + offset: 0 + - ordinal: 3677 + rva: 0 + offset: 0 + - ordinal: 3678 + rva: 0 + offset: 0 + - ordinal: 3679 + rva: 0 + offset: 0 + - ordinal: 3680 + rva: 0 + offset: 0 + - ordinal: 3681 + rva: 0 + offset: 0 + - ordinal: 3682 + rva: 0 + offset: 0 + - ordinal: 3683 + rva: 0 + offset: 0 + - ordinal: 3684 + rva: 0 + offset: 0 + - ordinal: 3685 + rva: 0 + offset: 0 + - ordinal: 3686 + rva: 0 + offset: 0 + - ordinal: 3687 + rva: 0 + offset: 0 + - ordinal: 3688 + rva: 0 + offset: 0 + - ordinal: 3689 + rva: 0 + offset: 0 + - ordinal: 3690 + rva: 0 + offset: 0 + - ordinal: 3691 + rva: 0 + offset: 0 + - ordinal: 3692 + rva: 0 + offset: 0 + - ordinal: 3693 + rva: 0 + offset: 0 + - ordinal: 3694 + rva: 0 + offset: 0 + - ordinal: 3695 + rva: 0 + offset: 0 + - ordinal: 3696 + rva: 0 + offset: 0 + - ordinal: 3697 + rva: 0 + offset: 0 + - ordinal: 3698 + rva: 0 + offset: 0 + - ordinal: 3699 + rva: 0 + offset: 0 + - ordinal: 3700 + rva: 0 + offset: 0 + - ordinal: 3701 + rva: 0 + offset: 0 + - ordinal: 3702 + rva: 0 + offset: 0 + - ordinal: 3703 + rva: 0 + offset: 0 + - ordinal: 3704 + rva: 0 + offset: 0 + - ordinal: 3705 + rva: 0 + offset: 0 + - ordinal: 3706 + rva: 0 + offset: 0 + - ordinal: 3707 + rva: 0 + offset: 0 + - ordinal: 3708 + rva: 0 + offset: 0 + - ordinal: 3709 + rva: 0 + offset: 0 + - ordinal: 3710 + rva: 0 + offset: 0 + - ordinal: 3711 + rva: 0 + offset: 0 + - ordinal: 3712 + rva: 0 + offset: 0 + - ordinal: 3713 + rva: 0 + offset: 0 + - ordinal: 3714 + rva: 0 + offset: 0 + - ordinal: 3715 + rva: 0 + offset: 0 + - ordinal: 3716 + rva: 0 + offset: 0 + - ordinal: 3717 + rva: 0 + offset: 0 + - ordinal: 3718 + rva: 0 + offset: 0 + - ordinal: 3719 + rva: 0 + offset: 0 + - ordinal: 3720 + rva: 0 + offset: 0 + - ordinal: 3721 + rva: 0 + offset: 0 + - ordinal: 3722 + rva: 0 + offset: 0 + - ordinal: 3723 + rva: 0 + offset: 0 + - ordinal: 3724 + rva: 0 + offset: 0 + - ordinal: 3725 + rva: 0 + offset: 0 + - ordinal: 3726 + rva: 0 + offset: 0 + - ordinal: 3727 + rva: 0 + offset: 0 + - ordinal: 3728 + rva: 0 + offset: 0 + - ordinal: 3729 + rva: 0 + offset: 0 + - ordinal: 3730 + rva: 0 + offset: 0 + - ordinal: 3731 + rva: 0 + offset: 0 + - ordinal: 3732 + rva: 0 + offset: 0 + - ordinal: 3733 + rva: 0 + offset: 0 + - ordinal: 3734 + rva: 0 + offset: 0 + - ordinal: 3735 + rva: 0 + offset: 0 + - ordinal: 3736 + rva: 0 + offset: 0 + - ordinal: 3737 + rva: 0 + offset: 0 + - ordinal: 3738 + rva: 0 + offset: 0 + - ordinal: 3739 + rva: 0 + offset: 0 + - ordinal: 3740 + rva: 0 + offset: 0 + - ordinal: 3741 + rva: 0 + offset: 0 + - ordinal: 3742 + rva: 0 + offset: 0 + - ordinal: 3743 + rva: 0 + offset: 0 + - ordinal: 3744 + rva: 0 + offset: 0 + - ordinal: 3745 + rva: 0 + offset: 0 + - ordinal: 3746 + rva: 0 + offset: 0 + - ordinal: 3747 + rva: 0 + offset: 0 + - ordinal: 3748 + rva: 0 + offset: 0 + - ordinal: 3749 + rva: 0 + offset: 0 + - ordinal: 3750 + rva: 0 + offset: 0 + - ordinal: 3751 + rva: 0 + offset: 0 + - ordinal: 3752 + rva: 0 + offset: 0 + - ordinal: 3753 + rva: 0 + offset: 0 + - ordinal: 3754 + rva: 0 + offset: 0 + - ordinal: 3755 + rva: 0 + offset: 0 + - ordinal: 3756 + rva: 0 + offset: 0 + - ordinal: 3757 + rva: 0 + offset: 0 + - ordinal: 3758 + rva: 0 + offset: 0 + - ordinal: 3759 + rva: 0 + offset: 0 + - ordinal: 3760 + rva: 0 + offset: 0 + - ordinal: 3761 + rva: 0 + offset: 0 + - ordinal: 3762 + rva: 0 + offset: 0 + - ordinal: 3763 + rva: 0 + offset: 0 + - ordinal: 3764 + rva: 0 + offset: 0 + - ordinal: 3765 + rva: 0 + offset: 0 + - ordinal: 3766 + rva: 0 + offset: 0 + - ordinal: 3767 + rva: 0 + offset: 0 + - ordinal: 3768 + rva: 0 + offset: 0 + - ordinal: 3769 + rva: 0 + offset: 0 + - ordinal: 3770 + rva: 0 + offset: 0 + - ordinal: 3771 + rva: 0 + offset: 0 + - ordinal: 3772 + rva: 0 + offset: 0 + - ordinal: 3773 + rva: 0 + offset: 0 + - ordinal: 3774 + rva: 0 + offset: 0 + - ordinal: 3775 + rva: 0 + offset: 0 + - ordinal: 3776 + rva: 0 + offset: 0 + - ordinal: 3777 + rva: 0 + offset: 0 + - ordinal: 3778 + rva: 0 + offset: 0 + - ordinal: 3779 + rva: 0 + offset: 0 + - ordinal: 3780 + rva: 0 + offset: 0 + - ordinal: 3781 + rva: 0 + offset: 0 + - ordinal: 3782 + rva: 0 + offset: 0 + - ordinal: 3783 + rva: 0 + offset: 0 + - ordinal: 3784 + rva: 0 + offset: 0 + - ordinal: 3785 + rva: 0 + offset: 0 + - ordinal: 3786 + rva: 0 + offset: 0 + - ordinal: 3787 + rva: 0 + offset: 0 + - ordinal: 3788 + rva: 0 + offset: 0 + - ordinal: 3789 + rva: 0 + offset: 0 + - ordinal: 3790 + rva: 0 + offset: 0 + - ordinal: 3791 + rva: 0 + offset: 0 + - ordinal: 3792 + rva: 0 + offset: 0 + - ordinal: 3793 + rva: 0 + offset: 0 + - ordinal: 3794 + rva: 0 + offset: 0 + - ordinal: 3795 + rva: 0 + offset: 0 + - ordinal: 3796 + rva: 0 + offset: 0 + - ordinal: 3797 + rva: 0 + offset: 0 + - ordinal: 3798 + rva: 0 + offset: 0 + - ordinal: 3799 + rva: 0 + offset: 0 + - ordinal: 3800 + rva: 0 + offset: 0 + - ordinal: 3801 + rva: 0 + offset: 0 + - ordinal: 3802 + rva: 0 + offset: 0 + - ordinal: 3803 + rva: 0 + offset: 0 + - ordinal: 3804 + rva: 0 + offset: 0 + - ordinal: 3805 + rva: 0 + offset: 0 + - ordinal: 3806 + rva: 0 + offset: 0 + - ordinal: 3807 + rva: 0 + offset: 0 + - ordinal: 3808 + rva: 0 + offset: 0 + - ordinal: 3809 + rva: 0 + offset: 0 + - ordinal: 3810 + rva: 0 + offset: 0 + - ordinal: 3811 + rva: 0 + offset: 0 + - ordinal: 3812 + rva: 0 + offset: 0 + - ordinal: 3813 + rva: 0 + offset: 0 + - ordinal: 3814 + rva: 0 + offset: 0 + - ordinal: 3815 + rva: 0 + offset: 0 + - ordinal: 3816 + rva: 0 + offset: 0 + - ordinal: 3817 + rva: 0 + offset: 0 + - ordinal: 3818 + rva: 0 + offset: 0 + - ordinal: 3819 + rva: 0 + offset: 0 + - ordinal: 3820 + rva: 0 + offset: 0 + - ordinal: 3821 + rva: 0 + offset: 0 + - ordinal: 3822 + rva: 0 + offset: 0 + - ordinal: 3823 + rva: 0 + offset: 0 + - ordinal: 3824 + rva: 0 + offset: 0 + - ordinal: 3825 + rva: 0 + offset: 0 + - ordinal: 3826 + rva: 0 + offset: 0 + - ordinal: 3827 + rva: 0 + offset: 0 + - ordinal: 3828 + rva: 0 + offset: 0 + - ordinal: 3829 + rva: 0 + offset: 0 + - ordinal: 3830 + rva: 0 + offset: 0 + - ordinal: 3831 + rva: 0 + offset: 0 + - ordinal: 3832 + rva: 0 + offset: 0 + - ordinal: 3833 + rva: 0 + offset: 0 + - ordinal: 3834 + rva: 0 + offset: 0 + - ordinal: 3835 + rva: 0 + offset: 0 + - ordinal: 3836 + rva: 0 + offset: 0 + - ordinal: 3837 + rva: 0 + offset: 0 + - ordinal: 3838 + rva: 0 + offset: 0 + - ordinal: 3839 + rva: 0 + offset: 0 + - ordinal: 3840 + rva: 0 + offset: 0 + - ordinal: 3841 + rva: 0 + offset: 0 + - ordinal: 3842 + rva: 0 + offset: 0 + - ordinal: 3843 + rva: 0 + offset: 0 + - ordinal: 3844 + rva: 0 + offset: 0 + - ordinal: 3845 + rva: 0 + offset: 0 + - ordinal: 3846 + rva: 0 + offset: 0 + - ordinal: 3847 + rva: 0 + offset: 0 + - ordinal: 3848 + rva: 0 + offset: 0 + - ordinal: 3849 + rva: 0 + offset: 0 + - ordinal: 3850 + rva: 0 + offset: 0 + - ordinal: 3851 + rva: 0 + offset: 0 + - ordinal: 3852 + rva: 0 + offset: 0 + - ordinal: 3853 + rva: 0 + offset: 0 + - ordinal: 3854 + rva: 0 + offset: 0 + - ordinal: 3855 + rva: 0 + offset: 0 + - ordinal: 3856 + rva: 0 + offset: 0 + - ordinal: 3857 + rva: 0 + offset: 0 + - ordinal: 3858 + rva: 0 + offset: 0 + - ordinal: 3859 + rva: 0 + offset: 0 + - ordinal: 3860 + rva: 0 + offset: 0 + - ordinal: 3861 + rva: 0 + offset: 0 + - ordinal: 3862 + rva: 0 + offset: 0 + - ordinal: 3863 + rva: 0 + offset: 0 + - ordinal: 3864 + rva: 0 + offset: 0 + - ordinal: 3865 + rva: 0 + offset: 0 + - ordinal: 3866 + rva: 0 + offset: 0 + - ordinal: 3867 + rva: 0 + offset: 0 + - ordinal: 3868 + rva: 0 + offset: 0 + - ordinal: 3869 + rva: 0 + offset: 0 + - ordinal: 3870 + rva: 0 + offset: 0 + - ordinal: 3871 + rva: 0 + offset: 0 + - ordinal: 3872 + rva: 0 + offset: 0 + - ordinal: 3873 + rva: 0 + offset: 0 + - ordinal: 3874 + rva: 0 + offset: 0 + - ordinal: 3875 + rva: 0 + offset: 0 + - ordinal: 3876 + rva: 0 + offset: 0 + - ordinal: 3877 + rva: 0 + offset: 0 + - ordinal: 3878 + rva: 0 + offset: 0 + - ordinal: 3879 + rva: 0 + offset: 0 + - ordinal: 3880 + rva: 0 + offset: 0 + - ordinal: 3881 + rva: 0 + offset: 0 + - ordinal: 3882 + rva: 0 + offset: 0 + - ordinal: 3883 + rva: 0 + offset: 0 + - ordinal: 3884 + rva: 0 + offset: 0 + - ordinal: 3885 + rva: 0 + offset: 0 + - ordinal: 3886 + rva: 0 + offset: 0 + - ordinal: 3887 + rva: 0 + offset: 0 + - ordinal: 3888 + rva: 0 + offset: 0 + - ordinal: 3889 + rva: 0 + offset: 0 + - ordinal: 3890 + rva: 0 + offset: 0 + - ordinal: 3891 + rva: 0 + offset: 0 + - ordinal: 3892 + rva: 0 + offset: 0 + - ordinal: 3893 + rva: 0 + offset: 0 + - ordinal: 3894 + rva: 0 + offset: 0 + - ordinal: 3895 + rva: 0 + offset: 0 + - ordinal: 3896 + rva: 0 + offset: 0 + - ordinal: 3897 + rva: 0 + offset: 0 + - ordinal: 3898 + rva: 0 + offset: 0 + - ordinal: 3899 + rva: 0 + offset: 0 + - ordinal: 3900 + rva: 0 + offset: 0 + - ordinal: 3901 + rva: 0 + offset: 0 + - ordinal: 3902 + rva: 0 + offset: 0 + - ordinal: 3903 + rva: 0 + offset: 0 + - ordinal: 3904 + rva: 0 + offset: 0 + - ordinal: 3905 + rva: 0 + offset: 0 + - ordinal: 3906 + rva: 0 + offset: 0 + - ordinal: 3907 + rva: 0 + offset: 0 + - ordinal: 3908 + rva: 0 + offset: 0 + - ordinal: 3909 + rva: 0 + offset: 0 + - ordinal: 3910 + rva: 0 + offset: 0 + - ordinal: 3911 + rva: 0 + offset: 0 + - ordinal: 3912 + rva: 0 + offset: 0 + - ordinal: 3913 + rva: 0 + offset: 0 + - ordinal: 3914 + rva: 0 + offset: 0 + - ordinal: 3915 + rva: 0 + offset: 0 + - ordinal: 3916 + rva: 0 + offset: 0 + - ordinal: 3917 + rva: 0 + offset: 0 + - ordinal: 3918 + rva: 0 + offset: 0 + - ordinal: 3919 + rva: 0 + offset: 0 + - ordinal: 3920 + rva: 0 + offset: 0 + - ordinal: 3921 + rva: 0 + offset: 0 + - ordinal: 3922 + rva: 0 + offset: 0 + - ordinal: 3923 + rva: 0 + offset: 0 + - ordinal: 3924 + rva: 0 + offset: 0 + - ordinal: 3925 + rva: 0 + offset: 0 + - ordinal: 3926 + rva: 0 + offset: 0 + - ordinal: 3927 + rva: 0 + offset: 0 + - ordinal: 3928 + rva: 0 + offset: 0 + - ordinal: 3929 + rva: 0 + offset: 0 + - ordinal: 3930 + rva: 0 + offset: 0 + - ordinal: 3931 + rva: 0 + offset: 0 + - ordinal: 3932 + rva: 0 + offset: 0 + - ordinal: 3933 + rva: 0 + offset: 0 + - ordinal: 3934 + rva: 0 + offset: 0 + - ordinal: 3935 + rva: 0 + offset: 0 + - ordinal: 3936 + rva: 0 + offset: 0 + - ordinal: 3937 + rva: 0 + offset: 0 + - ordinal: 3938 + rva: 0 + offset: 0 + - ordinal: 3939 + rva: 0 + offset: 0 + - ordinal: 3940 + rva: 0 + offset: 0 + - ordinal: 3941 + rva: 0 + offset: 0 + - ordinal: 3942 + rva: 0 + offset: 0 + - ordinal: 3943 + rva: 0 + offset: 0 + - ordinal: 3944 + rva: 0 + offset: 0 + - ordinal: 3945 + rva: 0 + offset: 0 + - ordinal: 3946 + rva: 0 + offset: 0 + - ordinal: 3947 + rva: 0 + offset: 0 + - ordinal: 3948 + rva: 0 + offset: 0 + - ordinal: 3949 + rva: 0 + offset: 0 + - ordinal: 3950 + rva: 0 + offset: 0 + - ordinal: 3951 + rva: 0 + offset: 0 + - ordinal: 3952 + rva: 0 + offset: 0 + - ordinal: 3953 + rva: 0 + offset: 0 + - ordinal: 3954 + rva: 0 + offset: 0 + - ordinal: 3955 + rva: 0 + offset: 0 + - ordinal: 3956 + rva: 0 + offset: 0 + - ordinal: 3957 + rva: 0 + offset: 0 + - ordinal: 3958 + rva: 0 + offset: 0 + - ordinal: 3959 + rva: 0 + offset: 0 + - ordinal: 3960 + rva: 0 + offset: 0 + - ordinal: 3961 + rva: 0 + offset: 0 + - ordinal: 3962 + rva: 0 + offset: 0 + - ordinal: 3963 + rva: 0 + offset: 0 + - ordinal: 3964 + rva: 0 + offset: 0 + - ordinal: 3965 + rva: 0 + offset: 0 + - ordinal: 3966 + rva: 0 + offset: 0 + - ordinal: 3967 + rva: 0 + offset: 0 + - ordinal: 3968 + rva: 0 + offset: 0 + - ordinal: 3969 + rva: 0 + offset: 0 + - ordinal: 3970 + rva: 0 + offset: 0 + - ordinal: 3971 + rva: 0 + offset: 0 + - ordinal: 3972 + rva: 0 + offset: 0 + - ordinal: 3973 + rva: 0 + offset: 0 + - ordinal: 3974 + rva: 0 + offset: 0 + - ordinal: 3975 + rva: 0 + offset: 0 + - ordinal: 3976 + rva: 0 + offset: 0 + - ordinal: 3977 + rva: 0 + offset: 0 + - ordinal: 3978 + rva: 0 + offset: 0 + - ordinal: 3979 + rva: 0 + offset: 0 + - ordinal: 3980 + rva: 0 + offset: 0 + - ordinal: 3981 + rva: 0 + offset: 0 + - ordinal: 3982 + rva: 0 + offset: 0 + - ordinal: 3983 + rva: 0 + offset: 0 + - ordinal: 3984 + rva: 0 + offset: 0 + - ordinal: 3985 + rva: 0 + offset: 0 + - ordinal: 3986 + rva: 0 + offset: 0 + - ordinal: 3987 + rva: 0 + offset: 0 + - ordinal: 3988 + rva: 0 + offset: 0 + - ordinal: 3989 + rva: 0 + offset: 0 + - ordinal: 3990 + rva: 0 + offset: 0 + - ordinal: 3991 + rva: 0 + offset: 0 + - ordinal: 3992 + rva: 0 + offset: 0 + - ordinal: 3993 + rva: 0 + offset: 0 + - ordinal: 3994 + rva: 0 + offset: 0 + - ordinal: 3995 + rva: 0 + offset: 0 + - ordinal: 3996 + rva: 0 + offset: 0 + - ordinal: 3997 + rva: 0 + offset: 0 + - ordinal: 3998 + rva: 0 + offset: 0 + - ordinal: 3999 + rva: 0 + offset: 0 + - ordinal: 4000 + rva: 24240 + offset: 21168 + - ordinal: 4001 + rva: 24592 + offset: 21520 + - ordinal: 4002 + rva: 24768 + offset: 21696 + - ordinal: 4003 + rva: 24928 + offset: 21856 + - ordinal: 4004 + rva: 25328 + offset: 22256 + - ordinal: 4005 + rva: 0 + offset: 0 + - ordinal: 4006 + rva: 0 + offset: 0 + - ordinal: 4007 + rva: 0 + offset: 0 + - ordinal: 4008 + rva: 0 + offset: 0 + - ordinal: 4009 + rva: 0 + offset: 0 + - ordinal: 4010 + rva: 0 + offset: 0 + - ordinal: 4011 + rva: 0 + offset: 0 + - ordinal: 4012 + rva: 0 + offset: 0 + - ordinal: 4013 + rva: 0 + offset: 0 + - ordinal: 4014 + rva: 0 + offset: 0 + - ordinal: 4015 + rva: 0 + offset: 0 + - ordinal: 4016 + rva: 0 + offset: 0 + - ordinal: 4017 + rva: 0 + offset: 0 + - ordinal: 4018 + rva: 0 + offset: 0 + - ordinal: 4019 + rva: 0 + offset: 0 + - ordinal: 4020 + rva: 0 + offset: 0 + - ordinal: 4021 + rva: 0 + offset: 0 + - ordinal: 4022 + rva: 0 + offset: 0 + - ordinal: 4023 + rva: 0 + offset: 0 + - ordinal: 4024 + rva: 0 + offset: 0 + - ordinal: 4025 + rva: 0 + offset: 0 + - ordinal: 4026 + rva: 0 + offset: 0 + - ordinal: 4027 + rva: 0 + offset: 0 + - ordinal: 4028 + rva: 0 + offset: 0 + - ordinal: 4029 + rva: 0 + offset: 0 + - ordinal: 4030 + rva: 0 + offset: 0 + - ordinal: 4031 + rva: 0 + offset: 0 + - ordinal: 4032 + rva: 0 + offset: 0 + - ordinal: 4033 + rva: 0 + offset: 0 + - ordinal: 4034 + rva: 0 + offset: 0 + - ordinal: 4035 + rva: 0 + offset: 0 + - ordinal: 4036 + rva: 0 + offset: 0 + - ordinal: 4037 + rva: 0 + offset: 0 + - ordinal: 4038 + rva: 0 + offset: 0 + - ordinal: 4039 + rva: 0 + offset: 0 + - ordinal: 4040 + rva: 0 + offset: 0 + - ordinal: 4041 + rva: 0 + offset: 0 + - ordinal: 4042 + rva: 0 + offset: 0 + - ordinal: 4043 + rva: 0 + offset: 0 + - ordinal: 4044 + rva: 0 + offset: 0 + - ordinal: 4045 + rva: 0 + offset: 0 + - ordinal: 4046 + rva: 0 + offset: 0 + - ordinal: 4047 + rva: 0 + offset: 0 + - ordinal: 4048 + rva: 0 + offset: 0 + - ordinal: 4049 + rva: 0 + offset: 0 + - ordinal: 4050 + rva: 0 + offset: 0 + - ordinal: 4051 + rva: 0 + offset: 0 + - ordinal: 4052 + rva: 0 + offset: 0 + - ordinal: 4053 + rva: 0 + offset: 0 + - ordinal: 4054 + rva: 0 + offset: 0 + - ordinal: 4055 + rva: 0 + offset: 0 + - ordinal: 4056 + rva: 0 + offset: 0 + - ordinal: 4057 + rva: 0 + offset: 0 + - ordinal: 4058 + rva: 0 + offset: 0 + - ordinal: 4059 + rva: 0 + offset: 0 + - ordinal: 4060 + rva: 0 + offset: 0 + - ordinal: 4061 + rva: 0 + offset: 0 + - ordinal: 4062 + rva: 0 + offset: 0 + - ordinal: 4063 + rva: 0 + offset: 0 + - ordinal: 4064 + rva: 0 + offset: 0 + - ordinal: 4065 + rva: 0 + offset: 0 + - ordinal: 4066 + rva: 0 + offset: 0 + - ordinal: 4067 + rva: 0 + offset: 0 + - ordinal: 4068 + rva: 0 + offset: 0 + - ordinal: 4069 + rva: 0 + offset: 0 + - ordinal: 4070 + rva: 0 + offset: 0 + - ordinal: 4071 + rva: 0 + offset: 0 + - ordinal: 4072 + rva: 0 + offset: 0 + - ordinal: 4073 + rva: 0 + offset: 0 + - ordinal: 4074 + rva: 0 + offset: 0 + - ordinal: 4075 + rva: 0 + offset: 0 + - ordinal: 4076 + rva: 0 + offset: 0 + - ordinal: 4077 + rva: 0 + offset: 0 + - ordinal: 4078 + rva: 0 + offset: 0 + - ordinal: 4079 + rva: 0 + offset: 0 + - ordinal: 4080 + rva: 0 + offset: 0 + - ordinal: 4081 + rva: 0 + offset: 0 + - ordinal: 4082 + rva: 0 + offset: 0 + - ordinal: 4083 + rva: 0 + offset: 0 + - ordinal: 4084 + rva: 0 + offset: 0 + - ordinal: 4085 + rva: 0 + offset: 0 + - ordinal: 4086 + rva: 0 + offset: 0 + - ordinal: 4087 + rva: 0 + offset: 0 + - ordinal: 4088 + rva: 0 + offset: 0 + - ordinal: 4089 + rva: 0 + offset: 0 + - ordinal: 4090 + rva: 0 + offset: 0 + - ordinal: 4091 + rva: 0 + offset: 0 + - ordinal: 4092 + rva: 0 + offset: 0 + - ordinal: 4093 + rva: 0 + offset: 0 + - ordinal: 4094 + rva: 0 + offset: 0 + - ordinal: 4095 + rva: 0 + offset: 0 + - ordinal: 4096 + rva: 0 + offset: 0 + - ordinal: 4097 + rva: 0 + offset: 0 + - ordinal: 4098 + rva: 0 + offset: 0 + - ordinal: 4099 + rva: 0 + offset: 0 + - ordinal: 4100 + rva: 0 + offset: 0 + - ordinal: 4101 + rva: 0 + offset: 0 + - ordinal: 4102 + rva: 0 + offset: 0 + - ordinal: 4103 + rva: 0 + offset: 0 + - ordinal: 4104 + rva: 0 + offset: 0 + - ordinal: 4105 + rva: 0 + offset: 0 + - ordinal: 4106 + rva: 0 + offset: 0 + - ordinal: 4107 + rva: 0 + offset: 0 + - ordinal: 4108 + rva: 0 + offset: 0 + - ordinal: 4109 + rva: 0 + offset: 0 + - ordinal: 4110 + rva: 0 + offset: 0 + - ordinal: 4111 + rva: 0 + offset: 0 + - ordinal: 4112 + rva: 0 + offset: 0 + - ordinal: 4113 + rva: 0 + offset: 0 + - ordinal: 4114 + rva: 0 + offset: 0 + - ordinal: 4115 + rva: 0 + offset: 0 + - ordinal: 4116 + rva: 0 + offset: 0 + - ordinal: 4117 + rva: 0 + offset: 0 + - ordinal: 4118 + rva: 0 + offset: 0 + - ordinal: 4119 + rva: 0 + offset: 0 + - ordinal: 4120 + rva: 0 + offset: 0 + - ordinal: 4121 + rva: 0 + offset: 0 + - ordinal: 4122 + rva: 0 + offset: 0 + - ordinal: 4123 + rva: 0 + offset: 0 + - ordinal: 4124 + rva: 0 + offset: 0 + - ordinal: 4125 + rva: 0 + offset: 0 + - ordinal: 4126 + rva: 0 + offset: 0 + - ordinal: 4127 + rva: 0 + offset: 0 + - ordinal: 4128 + rva: 0 + offset: 0 + - ordinal: 4129 + rva: 0 + offset: 0 + - ordinal: 4130 + rva: 0 + offset: 0 + - ordinal: 4131 + rva: 0 + offset: 0 + - ordinal: 4132 + rva: 0 + offset: 0 + - ordinal: 4133 + rva: 0 + offset: 0 + - ordinal: 4134 + rva: 0 + offset: 0 + - ordinal: 4135 + rva: 0 + offset: 0 + - ordinal: 4136 + rva: 0 + offset: 0 + - ordinal: 4137 + rva: 0 + offset: 0 + - ordinal: 4138 + rva: 0 + offset: 0 + - ordinal: 4139 + rva: 0 + offset: 0 + - ordinal: 4140 + rva: 0 + offset: 0 + - ordinal: 4141 + rva: 0 + offset: 0 + - ordinal: 4142 + rva: 0 + offset: 0 + - ordinal: 4143 + rva: 0 + offset: 0 + - ordinal: 4144 + rva: 0 + offset: 0 + - ordinal: 4145 + rva: 0 + offset: 0 + - ordinal: 4146 + rva: 0 + offset: 0 + - ordinal: 4147 + rva: 0 + offset: 0 + - ordinal: 4148 + rva: 0 + offset: 0 + - ordinal: 4149 + rva: 0 + offset: 0 + - ordinal: 4150 + rva: 0 + offset: 0 + - ordinal: 4151 + rva: 0 + offset: 0 + - ordinal: 4152 + rva: 0 + offset: 0 + - ordinal: 4153 + rva: 0 + offset: 0 + - ordinal: 4154 + rva: 0 + offset: 0 + - ordinal: 4155 + rva: 0 + offset: 0 + - ordinal: 4156 + rva: 0 + offset: 0 + - ordinal: 4157 + rva: 0 + offset: 0 + - ordinal: 4158 + rva: 0 + offset: 0 + - ordinal: 4159 + rva: 0 + offset: 0 + - ordinal: 4160 + rva: 0 + offset: 0 + - ordinal: 4161 + rva: 0 + offset: 0 + - ordinal: 4162 + rva: 0 + offset: 0 + - ordinal: 4163 + rva: 0 + offset: 0 + - ordinal: 4164 + rva: 0 + offset: 0 + - ordinal: 4165 + rva: 0 + offset: 0 + - ordinal: 4166 + rva: 0 + offset: 0 + - ordinal: 4167 + rva: 0 + offset: 0 + - ordinal: 4168 + rva: 0 + offset: 0 + - ordinal: 4169 + rva: 0 + offset: 0 + - ordinal: 4170 + rva: 0 + offset: 0 + - ordinal: 4171 + rva: 0 + offset: 0 + - ordinal: 4172 + rva: 0 + offset: 0 + - ordinal: 4173 + rva: 0 + offset: 0 + - ordinal: 4174 + rva: 0 + offset: 0 + - ordinal: 4175 + rva: 0 + offset: 0 + - ordinal: 4176 + rva: 0 + offset: 0 + - ordinal: 4177 + rva: 0 + offset: 0 + - ordinal: 4178 + rva: 0 + offset: 0 + - ordinal: 4179 + rva: 0 + offset: 0 + - ordinal: 4180 + rva: 0 + offset: 0 + - ordinal: 4181 + rva: 0 + offset: 0 + - ordinal: 4182 + rva: 0 + offset: 0 + - ordinal: 4183 + rva: 0 + offset: 0 + - ordinal: 4184 + rva: 0 + offset: 0 + - ordinal: 4185 + rva: 0 + offset: 0 + - ordinal: 4186 + rva: 0 + offset: 0 + - ordinal: 4187 + rva: 0 + offset: 0 + - ordinal: 4188 + rva: 0 + offset: 0 + - ordinal: 4189 + rva: 0 + offset: 0 + - ordinal: 4190 + rva: 0 + offset: 0 + - ordinal: 4191 + rva: 0 + offset: 0 + - ordinal: 4192 + rva: 0 + offset: 0 + - ordinal: 4193 + rva: 0 + offset: 0 + - ordinal: 4194 + rva: 0 + offset: 0 + - ordinal: 4195 + rva: 0 + offset: 0 + - ordinal: 4196 + rva: 0 + offset: 0 + - ordinal: 4197 + rva: 0 + offset: 0 + - ordinal: 4198 + rva: 0 + offset: 0 + - ordinal: 4199 + rva: 0 + offset: 0 + - ordinal: 4200 + rva: 0 + offset: 0 + - ordinal: 4201 + rva: 0 + offset: 0 + - ordinal: 4202 + rva: 0 + offset: 0 + - ordinal: 4203 + rva: 0 + offset: 0 + - ordinal: 4204 + rva: 0 + offset: 0 + - ordinal: 4205 + rva: 0 + offset: 0 + - ordinal: 4206 + rva: 0 + offset: 0 + - ordinal: 4207 + rva: 0 + offset: 0 + - ordinal: 4208 + rva: 0 + offset: 0 + - ordinal: 4209 + rva: 0 + offset: 0 + - ordinal: 4210 + rva: 0 + offset: 0 + - ordinal: 4211 + rva: 0 + offset: 0 + - ordinal: 4212 + rva: 0 + offset: 0 + - ordinal: 4213 + rva: 0 + offset: 0 + - ordinal: 4214 + rva: 0 + offset: 0 + - ordinal: 4215 + rva: 0 + offset: 0 + - ordinal: 4216 + rva: 0 + offset: 0 + - ordinal: 4217 + rva: 0 + offset: 0 + - ordinal: 4218 + rva: 0 + offset: 0 + - ordinal: 4219 + rva: 0 + offset: 0 + - ordinal: 4220 + rva: 0 + offset: 0 + - ordinal: 4221 + rva: 0 + offset: 0 + - ordinal: 4222 + rva: 0 + offset: 0 + - ordinal: 4223 + rva: 0 + offset: 0 + - ordinal: 4224 + rva: 0 + offset: 0 + - ordinal: 4225 + rva: 0 + offset: 0 + - ordinal: 4226 + rva: 0 + offset: 0 + - ordinal: 4227 + rva: 0 + offset: 0 + - ordinal: 4228 + rva: 0 + offset: 0 + - ordinal: 4229 + rva: 0 + offset: 0 + - ordinal: 4230 + rva: 0 + offset: 0 + - ordinal: 4231 + rva: 0 + offset: 0 + - ordinal: 4232 + rva: 0 + offset: 0 + - ordinal: 4233 + rva: 0 + offset: 0 + - ordinal: 4234 + rva: 0 + offset: 0 + - ordinal: 4235 + rva: 0 + offset: 0 + - ordinal: 4236 + rva: 0 + offset: 0 + - ordinal: 4237 + rva: 0 + offset: 0 + - ordinal: 4238 + rva: 0 + offset: 0 + - ordinal: 4239 + rva: 0 + offset: 0 + - ordinal: 4240 + rva: 0 + offset: 0 + - ordinal: 4241 + rva: 0 + offset: 0 + - ordinal: 4242 + rva: 0 + offset: 0 + - ordinal: 4243 + rva: 0 + offset: 0 + - ordinal: 4244 + rva: 0 + offset: 0 + - ordinal: 4245 + rva: 0 + offset: 0 + - ordinal: 4246 + rva: 0 + offset: 0 + - ordinal: 4247 + rva: 0 + offset: 0 + - ordinal: 4248 + rva: 0 + offset: 0 + - ordinal: 4249 + rva: 0 + offset: 0 + - ordinal: 4250 + rva: 0 + offset: 0 + - ordinal: 4251 + rva: 0 + offset: 0 + - ordinal: 4252 + rva: 0 + offset: 0 + - ordinal: 4253 + rva: 0 + offset: 0 + - ordinal: 4254 + rva: 0 + offset: 0 + - ordinal: 4255 + rva: 0 + offset: 0 + - ordinal: 4256 + rva: 0 + offset: 0 + - ordinal: 4257 + rva: 0 + offset: 0 + - ordinal: 4258 + rva: 0 + offset: 0 + - ordinal: 4259 + rva: 0 + offset: 0 + - ordinal: 4260 + rva: 0 + offset: 0 + - ordinal: 4261 + rva: 0 + offset: 0 + - ordinal: 4262 + rva: 0 + offset: 0 + - ordinal: 4263 + rva: 0 + offset: 0 + - ordinal: 4264 + rva: 0 + offset: 0 + - ordinal: 4265 + rva: 0 + offset: 0 + - ordinal: 4266 + rva: 0 + offset: 0 + - ordinal: 4267 + rva: 0 + offset: 0 + - ordinal: 4268 + rva: 0 + offset: 0 + - ordinal: 4269 + rva: 0 + offset: 0 + - ordinal: 4270 + rva: 0 + offset: 0 + - ordinal: 4271 + rva: 0 + offset: 0 + - ordinal: 4272 + rva: 0 + offset: 0 + - ordinal: 4273 + rva: 0 + offset: 0 + - ordinal: 4274 + rva: 0 + offset: 0 + - ordinal: 4275 + rva: 0 + offset: 0 + - ordinal: 4276 + rva: 0 + offset: 0 + - ordinal: 4277 + rva: 0 + offset: 0 + - ordinal: 4278 + rva: 0 + offset: 0 + - ordinal: 4279 + rva: 0 + offset: 0 + - ordinal: 4280 + rva: 0 + offset: 0 + - ordinal: 4281 + rva: 0 + offset: 0 + - ordinal: 4282 + rva: 0 + offset: 0 + - ordinal: 4283 + rva: 0 + offset: 0 + - ordinal: 4284 + rva: 0 + offset: 0 + - ordinal: 4285 + rva: 0 + offset: 0 + - ordinal: 4286 + rva: 0 + offset: 0 + - ordinal: 4287 + rva: 0 + offset: 0 + - ordinal: 4288 + rva: 0 + offset: 0 + - ordinal: 4289 + rva: 0 + offset: 0 + - ordinal: 4290 + rva: 0 + offset: 0 + - ordinal: 4291 + rva: 0 + offset: 0 + - ordinal: 4292 + rva: 0 + offset: 0 + - ordinal: 4293 + rva: 0 + offset: 0 + - ordinal: 4294 + rva: 0 + offset: 0 + - ordinal: 4295 + rva: 0 + offset: 0 + - ordinal: 4296 + rva: 0 + offset: 0 + - ordinal: 4297 + rva: 0 + offset: 0 + - ordinal: 4298 + rva: 0 + offset: 0 + - ordinal: 4299 + rva: 0 + offset: 0 + - ordinal: 4300 + rva: 0 + offset: 0 + - ordinal: 4301 + rva: 0 + offset: 0 + - ordinal: 4302 + rva: 0 + offset: 0 + - ordinal: 4303 + rva: 0 + offset: 0 + - ordinal: 4304 + rva: 0 + offset: 0 + - ordinal: 4305 + rva: 0 + offset: 0 + - ordinal: 4306 + rva: 0 + offset: 0 + - ordinal: 4307 + rva: 0 + offset: 0 + - ordinal: 4308 + rva: 0 + offset: 0 + - ordinal: 4309 + rva: 0 + offset: 0 + - ordinal: 4310 + rva: 0 + offset: 0 + - ordinal: 4311 + rva: 0 + offset: 0 + - ordinal: 4312 + rva: 0 + offset: 0 + - ordinal: 4313 + rva: 0 + offset: 0 + - ordinal: 4314 + rva: 0 + offset: 0 + - ordinal: 4315 + rva: 0 + offset: 0 + - ordinal: 4316 + rva: 0 + offset: 0 + - ordinal: 4317 + rva: 0 + offset: 0 + - ordinal: 4318 + rva: 0 + offset: 0 + - ordinal: 4319 + rva: 0 + offset: 0 + - ordinal: 4320 + rva: 0 + offset: 0 + - ordinal: 4321 + rva: 0 + offset: 0 + - ordinal: 4322 + rva: 0 + offset: 0 + - ordinal: 4323 + rva: 0 + offset: 0 + - ordinal: 4324 + rva: 0 + offset: 0 + - ordinal: 4325 + rva: 0 + offset: 0 + - ordinal: 4326 + rva: 0 + offset: 0 + - ordinal: 4327 + rva: 0 + offset: 0 + - ordinal: 4328 + rva: 0 + offset: 0 + - ordinal: 4329 + rva: 0 + offset: 0 + - ordinal: 4330 + rva: 0 + offset: 0 + - ordinal: 4331 + rva: 0 + offset: 0 + - ordinal: 4332 + rva: 0 + offset: 0 + - ordinal: 4333 + rva: 0 + offset: 0 + - ordinal: 4334 + rva: 0 + offset: 0 + - ordinal: 4335 + rva: 0 + offset: 0 + - ordinal: 4336 + rva: 0 + offset: 0 + - ordinal: 4337 + rva: 0 + offset: 0 + - ordinal: 4338 + rva: 0 + offset: 0 + - ordinal: 4339 + rva: 0 + offset: 0 + - ordinal: 4340 + rva: 0 + offset: 0 + - ordinal: 4341 + rva: 0 + offset: 0 + - ordinal: 4342 + rva: 0 + offset: 0 + - ordinal: 4343 + rva: 0 + offset: 0 + - ordinal: 4344 + rva: 0 + offset: 0 + - ordinal: 4345 + rva: 0 + offset: 0 + - ordinal: 4346 + rva: 0 + offset: 0 + - ordinal: 4347 + rva: 0 + offset: 0 + - ordinal: 4348 + rva: 0 + offset: 0 + - ordinal: 4349 + rva: 0 + offset: 0 + - ordinal: 4350 + rva: 0 + offset: 0 + - ordinal: 4351 + rva: 0 + offset: 0 + - ordinal: 4352 + rva: 0 + offset: 0 + - ordinal: 4353 + rva: 0 + offset: 0 + - ordinal: 4354 + rva: 0 + offset: 0 + - ordinal: 4355 + rva: 0 + offset: 0 + - ordinal: 4356 + rva: 0 + offset: 0 + - ordinal: 4357 + rva: 0 + offset: 0 + - ordinal: 4358 + rva: 0 + offset: 0 + - ordinal: 4359 + rva: 0 + offset: 0 + - ordinal: 4360 + rva: 0 + offset: 0 + - ordinal: 4361 + rva: 0 + offset: 0 + - ordinal: 4362 + rva: 0 + offset: 0 + - ordinal: 4363 + rva: 0 + offset: 0 + - ordinal: 4364 + rva: 0 + offset: 0 + - ordinal: 4365 + rva: 0 + offset: 0 + - ordinal: 4366 + rva: 0 + offset: 0 + - ordinal: 4367 + rva: 0 + offset: 0 + - ordinal: 4368 + rva: 0 + offset: 0 + - ordinal: 4369 + rva: 0 + offset: 0 + - ordinal: 4370 + rva: 0 + offset: 0 + - ordinal: 4371 + rva: 0 + offset: 0 + - ordinal: 4372 + rva: 0 + offset: 0 + - ordinal: 4373 + rva: 0 + offset: 0 + - ordinal: 4374 + rva: 0 + offset: 0 + - ordinal: 4375 + rva: 0 + offset: 0 + - ordinal: 4376 + rva: 0 + offset: 0 + - ordinal: 4377 + rva: 0 + offset: 0 + - ordinal: 4378 + rva: 0 + offset: 0 + - ordinal: 4379 + rva: 0 + offset: 0 + - ordinal: 4380 + rva: 0 + offset: 0 + - ordinal: 4381 + rva: 0 + offset: 0 + - ordinal: 4382 + rva: 0 + offset: 0 + - ordinal: 4383 + rva: 0 + offset: 0 + - ordinal: 4384 + rva: 0 + offset: 0 + - ordinal: 4385 + rva: 0 + offset: 0 + - ordinal: 4386 + rva: 0 + offset: 0 + - ordinal: 4387 + rva: 0 + offset: 0 + - ordinal: 4388 + rva: 0 + offset: 0 + - ordinal: 4389 + rva: 0 + offset: 0 + - ordinal: 4390 + rva: 0 + offset: 0 + - ordinal: 4391 + rva: 0 + offset: 0 + - ordinal: 4392 + rva: 0 + offset: 0 + - ordinal: 4393 + rva: 0 + offset: 0 + - ordinal: 4394 + rva: 0 + offset: 0 + - ordinal: 4395 + rva: 0 + offset: 0 + - ordinal: 4396 + rva: 0 + offset: 0 + - ordinal: 4397 + rva: 0 + offset: 0 + - ordinal: 4398 + rva: 0 + offset: 0 + - ordinal: 4399 + rva: 0 + offset: 0 + - ordinal: 4400 + rva: 0 + offset: 0 + - ordinal: 4401 + rva: 0 + offset: 0 + - ordinal: 4402 + rva: 0 + offset: 0 + - ordinal: 4403 + rva: 0 + offset: 0 + - ordinal: 4404 + rva: 0 + offset: 0 + - ordinal: 4405 + rva: 0 + offset: 0 + - ordinal: 4406 + rva: 0 + offset: 0 + - ordinal: 4407 + rva: 0 + offset: 0 + - ordinal: 4408 + rva: 0 + offset: 0 + - ordinal: 4409 + rva: 0 + offset: 0 + - ordinal: 4410 + rva: 0 + offset: 0 + - ordinal: 4411 + rva: 0 + offset: 0 + - ordinal: 4412 + rva: 0 + offset: 0 + - ordinal: 4413 + rva: 0 + offset: 0 + - ordinal: 4414 + rva: 0 + offset: 0 + - ordinal: 4415 + rva: 0 + offset: 0 + - ordinal: 4416 + rva: 0 + offset: 0 + - ordinal: 4417 + rva: 0 + offset: 0 + - ordinal: 4418 + rva: 0 + offset: 0 + - ordinal: 4419 + rva: 0 + offset: 0 + - ordinal: 4420 + rva: 0 + offset: 0 + - ordinal: 4421 + rva: 0 + offset: 0 + - ordinal: 4422 + rva: 0 + offset: 0 + - ordinal: 4423 + rva: 0 + offset: 0 + - ordinal: 4424 + rva: 0 + offset: 0 + - ordinal: 4425 + rva: 0 + offset: 0 + - ordinal: 4426 + rva: 0 + offset: 0 + - ordinal: 4427 + rva: 0 + offset: 0 + - ordinal: 4428 + rva: 0 + offset: 0 + - ordinal: 4429 + rva: 0 + offset: 0 + - ordinal: 4430 + rva: 0 + offset: 0 + - ordinal: 4431 + rva: 0 + offset: 0 + - ordinal: 4432 + rva: 0 + offset: 0 + - ordinal: 4433 + rva: 0 + offset: 0 + - ordinal: 4434 + rva: 0 + offset: 0 + - ordinal: 4435 + rva: 0 + offset: 0 + - ordinal: 4436 + rva: 0 + offset: 0 + - ordinal: 4437 + rva: 0 + offset: 0 + - ordinal: 4438 + rva: 0 + offset: 0 + - ordinal: 4439 + rva: 0 + offset: 0 + - ordinal: 4440 + rva: 0 + offset: 0 + - ordinal: 4441 + rva: 0 + offset: 0 + - ordinal: 4442 + rva: 0 + offset: 0 + - ordinal: 4443 + rva: 0 + offset: 0 + - ordinal: 4444 + rva: 0 + offset: 0 + - ordinal: 4445 + rva: 0 + offset: 0 + - ordinal: 4446 + rva: 0 + offset: 0 + - ordinal: 4447 + rva: 0 + offset: 0 + - ordinal: 4448 + rva: 0 + offset: 0 + - ordinal: 4449 + rva: 0 + offset: 0 + - ordinal: 4450 + rva: 0 + offset: 0 + - ordinal: 4451 + rva: 0 + offset: 0 + - ordinal: 4452 + rva: 0 + offset: 0 + - ordinal: 4453 + rva: 0 + offset: 0 + - ordinal: 4454 + rva: 0 + offset: 0 + - ordinal: 4455 + rva: 0 + offset: 0 + - ordinal: 4456 + rva: 0 + offset: 0 + - ordinal: 4457 + rva: 0 + offset: 0 + - ordinal: 4458 + rva: 0 + offset: 0 + - ordinal: 4459 + rva: 0 + offset: 0 + - ordinal: 4460 + rva: 0 + offset: 0 + - ordinal: 4461 + rva: 0 + offset: 0 + - ordinal: 4462 + rva: 0 + offset: 0 + - ordinal: 4463 + rva: 0 + offset: 0 + - ordinal: 4464 + rva: 0 + offset: 0 + - ordinal: 4465 + rva: 0 + offset: 0 + - ordinal: 4466 + rva: 0 + offset: 0 + - ordinal: 4467 + rva: 0 + offset: 0 + - ordinal: 4468 + rva: 0 + offset: 0 + - ordinal: 4469 + rva: 0 + offset: 0 + - ordinal: 4470 + rva: 0 + offset: 0 + - ordinal: 4471 + rva: 0 + offset: 0 + - ordinal: 4472 + rva: 0 + offset: 0 + - ordinal: 4473 + rva: 0 + offset: 0 + - ordinal: 4474 + rva: 0 + offset: 0 + - ordinal: 4475 + rva: 0 + offset: 0 + - ordinal: 4476 + rva: 0 + offset: 0 + - ordinal: 4477 + rva: 0 + offset: 0 + - ordinal: 4478 + rva: 0 + offset: 0 + - ordinal: 4479 + rva: 0 + offset: 0 + - ordinal: 4480 + rva: 0 + offset: 0 + - ordinal: 4481 + rva: 0 + offset: 0 + - ordinal: 4482 + rva: 0 + offset: 0 + - ordinal: 4483 + rva: 0 + offset: 0 + - ordinal: 4484 + rva: 0 + offset: 0 + - ordinal: 4485 + rva: 0 + offset: 0 + - ordinal: 4486 + rva: 0 + offset: 0 + - ordinal: 4487 + rva: 0 + offset: 0 + - ordinal: 4488 + rva: 0 + offset: 0 + - ordinal: 4489 + rva: 0 + offset: 0 + - ordinal: 4490 + rva: 0 + offset: 0 + - ordinal: 4491 + rva: 0 + offset: 0 + - ordinal: 4492 + rva: 0 + offset: 0 + - ordinal: 4493 + rva: 0 + offset: 0 + - ordinal: 4494 + rva: 0 + offset: 0 + - ordinal: 4495 + rva: 0 + offset: 0 + - ordinal: 4496 + rva: 0 + offset: 0 + - ordinal: 4497 + rva: 0 + offset: 0 + - ordinal: 4498 + rva: 0 + offset: 0 + - ordinal: 4499 + rva: 0 + offset: 0 + - ordinal: 4500 + rva: 0 + offset: 0 + - ordinal: 4501 + rva: 0 + offset: 0 + - ordinal: 4502 + rva: 0 + offset: 0 + - ordinal: 4503 + rva: 0 + offset: 0 + - ordinal: 4504 + rva: 0 + offset: 0 + - ordinal: 4505 + rva: 0 + offset: 0 + - ordinal: 4506 + rva: 0 + offset: 0 + - ordinal: 4507 + rva: 0 + offset: 0 + - ordinal: 4508 + rva: 0 + offset: 0 + - ordinal: 4509 + rva: 0 + offset: 0 + - ordinal: 4510 + rva: 0 + offset: 0 + - ordinal: 4511 + rva: 0 + offset: 0 + - ordinal: 4512 + rva: 0 + offset: 0 + - ordinal: 4513 + rva: 0 + offset: 0 + - ordinal: 4514 + rva: 0 + offset: 0 + - ordinal: 4515 + rva: 0 + offset: 0 + - ordinal: 4516 + rva: 0 + offset: 0 + - ordinal: 4517 + rva: 0 + offset: 0 + - ordinal: 4518 + rva: 0 + offset: 0 + - ordinal: 4519 + rva: 0 + offset: 0 + - ordinal: 4520 + rva: 0 + offset: 0 + - ordinal: 4521 + rva: 0 + offset: 0 + - ordinal: 4522 + rva: 0 + offset: 0 + - ordinal: 4523 + rva: 0 + offset: 0 + - ordinal: 4524 + rva: 0 + offset: 0 + - ordinal: 4525 + rva: 0 + offset: 0 + - ordinal: 4526 + rva: 0 + offset: 0 + - ordinal: 4527 + rva: 0 + offset: 0 + - ordinal: 4528 + rva: 0 + offset: 0 + - ordinal: 4529 + rva: 0 + offset: 0 + - ordinal: 4530 + rva: 0 + offset: 0 + - ordinal: 4531 + rva: 0 + offset: 0 + - ordinal: 4532 + rva: 0 + offset: 0 + - ordinal: 4533 + rva: 0 + offset: 0 + - ordinal: 4534 + rva: 0 + offset: 0 + - ordinal: 4535 + rva: 0 + offset: 0 + - ordinal: 4536 + rva: 0 + offset: 0 + - ordinal: 4537 + rva: 0 + offset: 0 + - ordinal: 4538 + rva: 0 + offset: 0 + - ordinal: 4539 + rva: 0 + offset: 0 + - ordinal: 4540 + rva: 0 + offset: 0 + - ordinal: 4541 + rva: 0 + offset: 0 + - ordinal: 4542 + rva: 0 + offset: 0 + - ordinal: 4543 + rva: 0 + offset: 0 + - ordinal: 4544 + rva: 0 + offset: 0 + - ordinal: 4545 + rva: 0 + offset: 0 + - ordinal: 4546 + rva: 0 + offset: 0 + - ordinal: 4547 + rva: 0 + offset: 0 + - ordinal: 4548 + rva: 0 + offset: 0 + - ordinal: 4549 + rva: 0 + offset: 0 + - ordinal: 4550 + rva: 0 + offset: 0 + - ordinal: 4551 + rva: 0 + offset: 0 + - ordinal: 4552 + rva: 0 + offset: 0 + - ordinal: 4553 + rva: 0 + offset: 0 + - ordinal: 4554 + rva: 0 + offset: 0 + - ordinal: 4555 + rva: 0 + offset: 0 + - ordinal: 4556 + rva: 0 + offset: 0 + - ordinal: 4557 + rva: 0 + offset: 0 + - ordinal: 4558 + rva: 0 + offset: 0 + - ordinal: 4559 + rva: 0 + offset: 0 + - ordinal: 4560 + rva: 0 + offset: 0 + - ordinal: 4561 + rva: 0 + offset: 0 + - ordinal: 4562 + rva: 0 + offset: 0 + - ordinal: 4563 + rva: 0 + offset: 0 + - ordinal: 4564 + rva: 0 + offset: 0 + - ordinal: 4565 + rva: 0 + offset: 0 + - ordinal: 4566 + rva: 0 + offset: 0 + - ordinal: 4567 + rva: 0 + offset: 0 + - ordinal: 4568 + rva: 0 + offset: 0 + - ordinal: 4569 + rva: 0 + offset: 0 + - ordinal: 4570 + rva: 0 + offset: 0 + - ordinal: 4571 + rva: 0 + offset: 0 + - ordinal: 4572 + rva: 0 + offset: 0 + - ordinal: 4573 + rva: 0 + offset: 0 + - ordinal: 4574 + rva: 0 + offset: 0 + - ordinal: 4575 + rva: 0 + offset: 0 + - ordinal: 4576 + rva: 0 + offset: 0 + - ordinal: 4577 + rva: 0 + offset: 0 + - ordinal: 4578 + rva: 0 + offset: 0 + - ordinal: 4579 + rva: 0 + offset: 0 + - ordinal: 4580 + rva: 0 + offset: 0 + - ordinal: 4581 + rva: 0 + offset: 0 + - ordinal: 4582 + rva: 0 + offset: 0 + - ordinal: 4583 + rva: 0 + offset: 0 + - ordinal: 4584 + rva: 0 + offset: 0 + - ordinal: 4585 + rva: 0 + offset: 0 + - ordinal: 4586 + rva: 0 + offset: 0 + - ordinal: 4587 + rva: 0 + offset: 0 + - ordinal: 4588 + rva: 0 + offset: 0 + - ordinal: 4589 + rva: 0 + offset: 0 + - ordinal: 4590 + rva: 0 + offset: 0 + - ordinal: 4591 + rva: 0 + offset: 0 + - ordinal: 4592 + rva: 0 + offset: 0 + - ordinal: 4593 + rva: 0 + offset: 0 + - ordinal: 4594 + rva: 0 + offset: 0 + - ordinal: 4595 + rva: 0 + offset: 0 + - ordinal: 4596 + rva: 0 + offset: 0 + - ordinal: 4597 + rva: 0 + offset: 0 + - ordinal: 4598 + rva: 0 + offset: 0 + - ordinal: 4599 + rva: 0 + offset: 0 + - ordinal: 4600 + rva: 0 + offset: 0 + - ordinal: 4601 + rva: 0 + offset: 0 + - ordinal: 4602 + rva: 0 + offset: 0 + - ordinal: 4603 + rva: 0 + offset: 0 + - ordinal: 4604 + rva: 0 + offset: 0 + - ordinal: 4605 + rva: 0 + offset: 0 + - ordinal: 4606 + rva: 0 + offset: 0 + - ordinal: 4607 + rva: 0 + offset: 0 + - ordinal: 4608 + rva: 0 + offset: 0 + - ordinal: 4609 + rva: 0 + offset: 0 + - ordinal: 4610 + rva: 0 + offset: 0 + - ordinal: 4611 + rva: 0 + offset: 0 + - ordinal: 4612 + rva: 0 + offset: 0 + - ordinal: 4613 + rva: 0 + offset: 0 + - ordinal: 4614 + rva: 0 + offset: 0 + - ordinal: 4615 + rva: 0 + offset: 0 + - ordinal: 4616 + rva: 0 + offset: 0 + - ordinal: 4617 + rva: 0 + offset: 0 + - ordinal: 4618 + rva: 0 + offset: 0 + - ordinal: 4619 + rva: 0 + offset: 0 + - ordinal: 4620 + rva: 0 + offset: 0 + - ordinal: 4621 + rva: 0 + offset: 0 + - ordinal: 4622 + rva: 0 + offset: 0 + - ordinal: 4623 + rva: 0 + offset: 0 + - ordinal: 4624 + rva: 0 + offset: 0 + - ordinal: 4625 + rva: 0 + offset: 0 + - ordinal: 4626 + rva: 0 + offset: 0 + - ordinal: 4627 + rva: 0 + offset: 0 + - ordinal: 4628 + rva: 0 + offset: 0 + - ordinal: 4629 + rva: 0 + offset: 0 + - ordinal: 4630 + rva: 0 + offset: 0 + - ordinal: 4631 + rva: 0 + offset: 0 + - ordinal: 4632 + rva: 0 + offset: 0 + - ordinal: 4633 + rva: 0 + offset: 0 + - ordinal: 4634 + rva: 0 + offset: 0 + - ordinal: 4635 + rva: 0 + offset: 0 + - ordinal: 4636 + rva: 0 + offset: 0 + - ordinal: 4637 + rva: 0 + offset: 0 + - ordinal: 4638 + rva: 0 + offset: 0 + - ordinal: 4639 + rva: 0 + offset: 0 + - ordinal: 4640 + rva: 0 + offset: 0 + - ordinal: 4641 + rva: 0 + offset: 0 + - ordinal: 4642 + rva: 0 + offset: 0 + - ordinal: 4643 + rva: 0 + offset: 0 + - ordinal: 4644 + rva: 0 + offset: 0 + - ordinal: 4645 + rva: 0 + offset: 0 + - ordinal: 4646 + rva: 0 + offset: 0 + - ordinal: 4647 + rva: 0 + offset: 0 + - ordinal: 4648 + rva: 0 + offset: 0 + - ordinal: 4649 + rva: 0 + offset: 0 + - ordinal: 4650 + rva: 0 + offset: 0 + - ordinal: 4651 + rva: 0 + offset: 0 + - ordinal: 4652 + rva: 0 + offset: 0 + - ordinal: 4653 + rva: 0 + offset: 0 + - ordinal: 4654 + rva: 0 + offset: 0 + - ordinal: 4655 + rva: 0 + offset: 0 + - ordinal: 4656 + rva: 0 + offset: 0 + - ordinal: 4657 + rva: 0 + offset: 0 + - ordinal: 4658 + rva: 0 + offset: 0 + - ordinal: 4659 + rva: 0 + offset: 0 + - ordinal: 4660 + rva: 0 + offset: 0 + - ordinal: 4661 + rva: 0 + offset: 0 + - ordinal: 4662 + rva: 0 + offset: 0 + - ordinal: 4663 + rva: 0 + offset: 0 + - ordinal: 4664 + rva: 0 + offset: 0 + - ordinal: 4665 + rva: 0 + offset: 0 + - ordinal: 4666 + rva: 0 + offset: 0 + - ordinal: 4667 + rva: 0 + offset: 0 + - ordinal: 4668 + rva: 0 + offset: 0 + - ordinal: 4669 + rva: 0 + offset: 0 + - ordinal: 4670 + rva: 0 + offset: 0 + - ordinal: 4671 + rva: 0 + offset: 0 + - ordinal: 4672 + rva: 0 + offset: 0 + - ordinal: 4673 + rva: 0 + offset: 0 + - ordinal: 4674 + rva: 0 + offset: 0 + - ordinal: 4675 + rva: 0 + offset: 0 + - ordinal: 4676 + rva: 0 + offset: 0 + - ordinal: 4677 + rva: 0 + offset: 0 + - ordinal: 4678 + rva: 0 + offset: 0 + - ordinal: 4679 + rva: 0 + offset: 0 + - ordinal: 4680 + rva: 0 + offset: 0 + - ordinal: 4681 + rva: 0 + offset: 0 + - ordinal: 4682 + rva: 0 + offset: 0 + - ordinal: 4683 + rva: 0 + offset: 0 + - ordinal: 4684 + rva: 0 + offset: 0 + - ordinal: 4685 + rva: 0 + offset: 0 + - ordinal: 4686 + rva: 0 + offset: 0 + - ordinal: 4687 + rva: 0 + offset: 0 + - ordinal: 4688 + rva: 0 + offset: 0 + - ordinal: 4689 + rva: 0 + offset: 0 + - ordinal: 4690 + rva: 0 + offset: 0 + - ordinal: 4691 + rva: 0 + offset: 0 + - ordinal: 4692 + rva: 0 + offset: 0 + - ordinal: 4693 + rva: 0 + offset: 0 + - ordinal: 4694 + rva: 0 + offset: 0 + - ordinal: 4695 + rva: 0 + offset: 0 + - ordinal: 4696 + rva: 0 + offset: 0 + - ordinal: 4697 + rva: 0 + offset: 0 + - ordinal: 4698 + rva: 0 + offset: 0 + - ordinal: 4699 + rva: 0 + offset: 0 + - ordinal: 4700 + rva: 0 + offset: 0 + - ordinal: 4701 + rva: 0 + offset: 0 + - ordinal: 4702 + rva: 0 + offset: 0 + - ordinal: 4703 + rva: 0 + offset: 0 + - ordinal: 4704 + rva: 0 + offset: 0 + - ordinal: 4705 + rva: 0 + offset: 0 + - ordinal: 4706 + rva: 0 + offset: 0 + - ordinal: 4707 + rva: 0 + offset: 0 + - ordinal: 4708 + rva: 0 + offset: 0 + - ordinal: 4709 + rva: 0 + offset: 0 + - ordinal: 4710 + rva: 0 + offset: 0 + - ordinal: 4711 + rva: 0 + offset: 0 + - ordinal: 4712 + rva: 0 + offset: 0 + - ordinal: 4713 + rva: 0 + offset: 0 + - ordinal: 4714 + rva: 0 + offset: 0 + - ordinal: 4715 + rva: 0 + offset: 0 + - ordinal: 4716 + rva: 0 + offset: 0 + - ordinal: 4717 + rva: 0 + offset: 0 + - ordinal: 4718 + rva: 0 + offset: 0 + - ordinal: 4719 + rva: 0 + offset: 0 + - ordinal: 4720 + rva: 0 + offset: 0 + - ordinal: 4721 + rva: 0 + offset: 0 + - ordinal: 4722 + rva: 0 + offset: 0 + - ordinal: 4723 + rva: 0 + offset: 0 + - ordinal: 4724 + rva: 0 + offset: 0 + - ordinal: 4725 + rva: 0 + offset: 0 + - ordinal: 4726 + rva: 0 + offset: 0 + - ordinal: 4727 + rva: 0 + offset: 0 + - ordinal: 4728 + rva: 0 + offset: 0 + - ordinal: 4729 + rva: 0 + offset: 0 + - ordinal: 4730 + rva: 0 + offset: 0 + - ordinal: 4731 + rva: 0 + offset: 0 + - ordinal: 4732 + rva: 0 + offset: 0 + - ordinal: 4733 + rva: 0 + offset: 0 + - ordinal: 4734 + rva: 0 + offset: 0 + - ordinal: 4735 + rva: 0 + offset: 0 + - ordinal: 4736 + rva: 0 + offset: 0 + - ordinal: 4737 + rva: 0 + offset: 0 + - ordinal: 4738 + rva: 0 + offset: 0 + - ordinal: 4739 + rva: 0 + offset: 0 + - ordinal: 4740 + rva: 0 + offset: 0 + - ordinal: 4741 + rva: 0 + offset: 0 + - ordinal: 4742 + rva: 0 + offset: 0 + - ordinal: 4743 + rva: 0 + offset: 0 + - ordinal: 4744 + rva: 0 + offset: 0 + - ordinal: 4745 + rva: 0 + offset: 0 + - ordinal: 4746 + rva: 0 + offset: 0 + - ordinal: 4747 + rva: 0 + offset: 0 + - ordinal: 4748 + rva: 0 + offset: 0 + - ordinal: 4749 + rva: 0 + offset: 0 + - ordinal: 4750 + rva: 0 + offset: 0 + - ordinal: 4751 + rva: 0 + offset: 0 + - ordinal: 4752 + rva: 0 + offset: 0 + - ordinal: 4753 + rva: 0 + offset: 0 + - ordinal: 4754 + rva: 0 + offset: 0 + - ordinal: 4755 + rva: 0 + offset: 0 + - ordinal: 4756 + rva: 0 + offset: 0 + - ordinal: 4757 + rva: 0 + offset: 0 + - ordinal: 4758 + rva: 0 + offset: 0 + - ordinal: 4759 + rva: 0 + offset: 0 + - ordinal: 4760 + rva: 0 + offset: 0 + - ordinal: 4761 + rva: 0 + offset: 0 + - ordinal: 4762 + rva: 0 + offset: 0 + - ordinal: 4763 + rva: 0 + offset: 0 + - ordinal: 4764 + rva: 0 + offset: 0 + - ordinal: 4765 + rva: 0 + offset: 0 + - ordinal: 4766 + rva: 0 + offset: 0 + - ordinal: 4767 + rva: 0 + offset: 0 + - ordinal: 4768 + rva: 0 + offset: 0 + - ordinal: 4769 + rva: 0 + offset: 0 + - ordinal: 4770 + rva: 0 + offset: 0 + - ordinal: 4771 + rva: 0 + offset: 0 + - ordinal: 4772 + rva: 0 + offset: 0 + - ordinal: 4773 + rva: 0 + offset: 0 + - ordinal: 4774 + rva: 0 + offset: 0 + - ordinal: 4775 + rva: 0 + offset: 0 + - ordinal: 4776 + rva: 0 + offset: 0 + - ordinal: 4777 + rva: 0 + offset: 0 + - ordinal: 4778 + rva: 0 + offset: 0 + - ordinal: 4779 + rva: 0 + offset: 0 + - ordinal: 4780 + rva: 0 + offset: 0 + - ordinal: 4781 + rva: 0 + offset: 0 + - ordinal: 4782 + rva: 0 + offset: 0 + - ordinal: 4783 + rva: 0 + offset: 0 + - ordinal: 4784 + rva: 0 + offset: 0 + - ordinal: 4785 + rva: 0 + offset: 0 + - ordinal: 4786 + rva: 0 + offset: 0 + - ordinal: 4787 + rva: 0 + offset: 0 + - ordinal: 4788 + rva: 0 + offset: 0 + - ordinal: 4789 + rva: 0 + offset: 0 + - ordinal: 4790 + rva: 0 + offset: 0 + - ordinal: 4791 + rva: 0 + offset: 0 + - ordinal: 4792 + rva: 0 + offset: 0 + - ordinal: 4793 + rva: 0 + offset: 0 + - ordinal: 4794 + rva: 0 + offset: 0 + - ordinal: 4795 + rva: 0 + offset: 0 + - ordinal: 4796 + rva: 0 + offset: 0 + - ordinal: 4797 + rva: 0 + offset: 0 + - ordinal: 4798 + rva: 0 + offset: 0 + - ordinal: 4799 + rva: 0 + offset: 0 + - ordinal: 4800 + rva: 0 + offset: 0 + - ordinal: 4801 + rva: 0 + offset: 0 + - ordinal: 4802 + rva: 0 + offset: 0 + - ordinal: 4803 + rva: 0 + offset: 0 + - ordinal: 4804 + rva: 0 + offset: 0 + - ordinal: 4805 + rva: 0 + offset: 0 + - ordinal: 4806 + rva: 0 + offset: 0 + - ordinal: 4807 + rva: 0 + offset: 0 + - ordinal: 4808 + rva: 0 + offset: 0 + - ordinal: 4809 + rva: 0 + offset: 0 + - ordinal: 4810 + rva: 0 + offset: 0 + - ordinal: 4811 + rva: 0 + offset: 0 + - ordinal: 4812 + rva: 0 + offset: 0 + - ordinal: 4813 + rva: 0 + offset: 0 + - ordinal: 4814 + rva: 0 + offset: 0 + - ordinal: 4815 + rva: 0 + offset: 0 + - ordinal: 4816 + rva: 0 + offset: 0 + - ordinal: 4817 + rva: 0 + offset: 0 + - ordinal: 4818 + rva: 0 + offset: 0 + - ordinal: 4819 + rva: 0 + offset: 0 + - ordinal: 4820 + rva: 0 + offset: 0 + - ordinal: 4821 + rva: 0 + offset: 0 + - ordinal: 4822 + rva: 0 + offset: 0 + - ordinal: 4823 + rva: 0 + offset: 0 + - ordinal: 4824 + rva: 0 + offset: 0 + - ordinal: 4825 + rva: 0 + offset: 0 + - ordinal: 4826 + rva: 0 + offset: 0 + - ordinal: 4827 + rva: 0 + offset: 0 + - ordinal: 4828 + rva: 0 + offset: 0 + - ordinal: 4829 + rva: 0 + offset: 0 + - ordinal: 4830 + rva: 0 + offset: 0 + - ordinal: 4831 + rva: 0 + offset: 0 + - ordinal: 4832 + rva: 0 + offset: 0 + - ordinal: 4833 + rva: 0 + offset: 0 + - ordinal: 4834 + rva: 0 + offset: 0 + - ordinal: 4835 + rva: 0 + offset: 0 + - ordinal: 4836 + rva: 0 + offset: 0 + - ordinal: 4837 + rva: 0 + offset: 0 + - ordinal: 4838 + rva: 0 + offset: 0 + - ordinal: 4839 + rva: 0 + offset: 0 + - ordinal: 4840 + rva: 0 + offset: 0 + - ordinal: 4841 + rva: 0 + offset: 0 + - ordinal: 4842 + rva: 0 + offset: 0 + - ordinal: 4843 + rva: 0 + offset: 0 + - ordinal: 4844 + rva: 0 + offset: 0 + - ordinal: 4845 + rva: 0 + offset: 0 + - ordinal: 4846 + rva: 0 + offset: 0 + - ordinal: 4847 + rva: 0 + offset: 0 + - ordinal: 4848 + rva: 0 + offset: 0 + - ordinal: 4849 + rva: 0 + offset: 0 + - ordinal: 4850 + rva: 0 + offset: 0 + - ordinal: 4851 + rva: 0 + offset: 0 + - ordinal: 4852 + rva: 0 + offset: 0 + - ordinal: 4853 + rva: 0 + offset: 0 + - ordinal: 4854 + rva: 0 + offset: 0 + - ordinal: 4855 + rva: 0 + offset: 0 + - ordinal: 4856 + rva: 0 + offset: 0 + - ordinal: 4857 + rva: 0 + offset: 0 + - ordinal: 4858 + rva: 0 + offset: 0 + - ordinal: 4859 + rva: 0 + offset: 0 + - ordinal: 4860 + rva: 0 + offset: 0 + - ordinal: 4861 + rva: 0 + offset: 0 + - ordinal: 4862 + rva: 0 + offset: 0 + - ordinal: 4863 + rva: 0 + offset: 0 + - ordinal: 4864 + rva: 0 + offset: 0 + - ordinal: 4865 + rva: 0 + offset: 0 + - ordinal: 4866 + rva: 0 + offset: 0 + - ordinal: 4867 + rva: 0 + offset: 0 + - ordinal: 4868 + rva: 0 + offset: 0 + - ordinal: 4869 + rva: 0 + offset: 0 + - ordinal: 4870 + rva: 0 + offset: 0 + - ordinal: 4871 + rva: 0 + offset: 0 + - ordinal: 4872 + rva: 0 + offset: 0 + - ordinal: 4873 + rva: 0 + offset: 0 + - ordinal: 4874 + rva: 0 + offset: 0 + - ordinal: 4875 + rva: 0 + offset: 0 + - ordinal: 4876 + rva: 0 + offset: 0 + - ordinal: 4877 + rva: 0 + offset: 0 + - ordinal: 4878 + rva: 0 + offset: 0 + - ordinal: 4879 + rva: 0 + offset: 0 + - ordinal: 4880 + rva: 0 + offset: 0 + - ordinal: 4881 + rva: 0 + offset: 0 + - ordinal: 4882 + rva: 0 + offset: 0 + - ordinal: 4883 + rva: 0 + offset: 0 + - ordinal: 4884 + rva: 0 + offset: 0 + - ordinal: 4885 + rva: 0 + offset: 0 + - ordinal: 4886 + rva: 0 + offset: 0 + - ordinal: 4887 + rva: 0 + offset: 0 + - ordinal: 4888 + rva: 0 + offset: 0 + - ordinal: 4889 + rva: 0 + offset: 0 + - ordinal: 4890 + rva: 0 + offset: 0 + - ordinal: 4891 + rva: 0 + offset: 0 + - ordinal: 4892 + rva: 0 + offset: 0 + - ordinal: 4893 + rva: 0 + offset: 0 + - ordinal: 4894 + rva: 0 + offset: 0 + - ordinal: 4895 + rva: 0 + offset: 0 + - ordinal: 4896 + rva: 0 + offset: 0 + - ordinal: 4897 + rva: 0 + offset: 0 + - ordinal: 4898 + rva: 0 + offset: 0 + - ordinal: 4899 + rva: 0 + offset: 0 + - ordinal: 4900 + rva: 0 + offset: 0 + - ordinal: 4901 + rva: 0 + offset: 0 + - ordinal: 4902 + rva: 0 + offset: 0 + - ordinal: 4903 + rva: 0 + offset: 0 + - ordinal: 4904 + rva: 0 + offset: 0 + - ordinal: 4905 + rva: 0 + offset: 0 + - ordinal: 4906 + rva: 0 + offset: 0 + - ordinal: 4907 + rva: 0 + offset: 0 + - ordinal: 4908 + rva: 0 + offset: 0 + - ordinal: 4909 + rva: 0 + offset: 0 + - ordinal: 4910 + rva: 0 + offset: 0 + - ordinal: 4911 + rva: 0 + offset: 0 + - ordinal: 4912 + rva: 0 + offset: 0 + - ordinal: 4913 + rva: 0 + offset: 0 + - ordinal: 4914 + rva: 0 + offset: 0 + - ordinal: 4915 + rva: 0 + offset: 0 + - ordinal: 4916 + rva: 0 + offset: 0 + - ordinal: 4917 + rva: 0 + offset: 0 + - ordinal: 4918 + rva: 0 + offset: 0 + - ordinal: 4919 + rva: 0 + offset: 0 + - ordinal: 4920 + rva: 0 + offset: 0 + - ordinal: 4921 + rva: 0 + offset: 0 + - ordinal: 4922 + rva: 0 + offset: 0 + - ordinal: 4923 + rva: 0 + offset: 0 + - ordinal: 4924 + rva: 0 + offset: 0 + - ordinal: 4925 + rva: 0 + offset: 0 + - ordinal: 4926 + rva: 0 + offset: 0 + - ordinal: 4927 + rva: 0 + offset: 0 + - ordinal: 4928 + rva: 0 + offset: 0 + - ordinal: 4929 + rva: 0 + offset: 0 + - ordinal: 4930 + rva: 0 + offset: 0 + - ordinal: 4931 + rva: 0 + offset: 0 + - ordinal: 4932 + rva: 0 + offset: 0 + - ordinal: 4933 + rva: 0 + offset: 0 + - ordinal: 4934 + rva: 0 + offset: 0 + - ordinal: 4935 + rva: 0 + offset: 0 + - ordinal: 4936 + rva: 0 + offset: 0 + - ordinal: 4937 + rva: 0 + offset: 0 + - ordinal: 4938 + rva: 0 + offset: 0 + - ordinal: 4939 + rva: 0 + offset: 0 + - ordinal: 4940 + rva: 0 + offset: 0 + - ordinal: 4941 + rva: 0 + offset: 0 + - ordinal: 4942 + rva: 0 + offset: 0 + - ordinal: 4943 + rva: 0 + offset: 0 + - ordinal: 4944 + rva: 0 + offset: 0 + - ordinal: 4945 + rva: 0 + offset: 0 + - ordinal: 4946 + rva: 0 + offset: 0 + - ordinal: 4947 + rva: 0 + offset: 0 + - ordinal: 4948 + rva: 0 + offset: 0 + - ordinal: 4949 + rva: 0 + offset: 0 + - ordinal: 4950 + rva: 0 + offset: 0 + - ordinal: 4951 + rva: 0 + offset: 0 + - ordinal: 4952 + rva: 0 + offset: 0 + - ordinal: 4953 + rva: 0 + offset: 0 + - ordinal: 4954 + rva: 0 + offset: 0 + - ordinal: 4955 + rva: 0 + offset: 0 + - ordinal: 4956 + rva: 0 + offset: 0 + - ordinal: 4957 + rva: 0 + offset: 0 + - ordinal: 4958 + rva: 0 + offset: 0 + - ordinal: 4959 + rva: 0 + offset: 0 + - ordinal: 4960 + rva: 0 + offset: 0 + - ordinal: 4961 + rva: 0 + offset: 0 + - ordinal: 4962 + rva: 0 + offset: 0 + - ordinal: 4963 + rva: 0 + offset: 0 + - ordinal: 4964 + rva: 0 + offset: 0 + - ordinal: 4965 + rva: 0 + offset: 0 + - ordinal: 4966 + rva: 0 + offset: 0 + - ordinal: 4967 + rva: 0 + offset: 0 + - ordinal: 4968 + rva: 0 + offset: 0 + - ordinal: 4969 + rva: 0 + offset: 0 + - ordinal: 4970 + rva: 0 + offset: 0 + - ordinal: 4971 + rva: 0 + offset: 0 + - ordinal: 4972 + rva: 0 + offset: 0 + - ordinal: 4973 + rva: 0 + offset: 0 + - ordinal: 4974 + rva: 0 + offset: 0 + - ordinal: 4975 + rva: 0 + offset: 0 + - ordinal: 4976 + rva: 0 + offset: 0 + - ordinal: 4977 + rva: 0 + offset: 0 + - ordinal: 4978 + rva: 0 + offset: 0 + - ordinal: 4979 + rva: 0 + offset: 0 + - ordinal: 4980 + rva: 0 + offset: 0 + - ordinal: 4981 + rva: 0 + offset: 0 + - ordinal: 4982 + rva: 0 + offset: 0 + - ordinal: 4983 + rva: 0 + offset: 0 + - ordinal: 4984 + rva: 0 + offset: 0 + - ordinal: 4985 + rva: 0 + offset: 0 + - ordinal: 4986 + rva: 0 + offset: 0 + - ordinal: 4987 + rva: 0 + offset: 0 + - ordinal: 4988 + rva: 0 + offset: 0 + - ordinal: 4989 + rva: 0 + offset: 0 + - ordinal: 4990 + rva: 0 + offset: 0 + - ordinal: 4991 + rva: 0 + offset: 0 + - ordinal: 4992 + rva: 0 + offset: 0 + - ordinal: 4993 + rva: 0 + offset: 0 + - ordinal: 4994 + rva: 0 + offset: 0 + - ordinal: 4995 + rva: 0 + offset: 0 + - ordinal: 4996 + rva: 0 + offset: 0 + - ordinal: 4997 + rva: 0 + offset: 0 + - ordinal: 4998 + rva: 0 + offset: 0 + - ordinal: 4999 + rva: 0 + offset: 0 + - ordinal: 5000 + rva: 0 + offset: 0 + - ordinal: 5001 + rva: 0 + offset: 0 + - ordinal: 5002 + rva: 0 + offset: 0 + - ordinal: 5003 + rva: 0 + offset: 0 + - ordinal: 5004 + rva: 0 + offset: 0 + - ordinal: 5005 + rva: 0 + offset: 0 + - ordinal: 5006 + rva: 0 + offset: 0 + - ordinal: 5007 + rva: 0 + offset: 0 + - ordinal: 5008 + rva: 0 + offset: 0 + - ordinal: 5009 + rva: 0 + offset: 0 + - ordinal: 5010 + rva: 0 + offset: 0 + - ordinal: 5011 + rva: 0 + offset: 0 + - ordinal: 5012 + rva: 0 + offset: 0 + - ordinal: 5013 + rva: 0 + offset: 0 + - ordinal: 5014 + rva: 0 + offset: 0 + - ordinal: 5015 + rva: 0 + offset: 0 + - ordinal: 5016 + rva: 0 + offset: 0 + - ordinal: 5017 + rva: 0 + offset: 0 + - ordinal: 5018 + rva: 0 + offset: 0 + - ordinal: 5019 + rva: 0 + offset: 0 + - ordinal: 5020 + rva: 0 + offset: 0 + - ordinal: 5021 + rva: 0 + offset: 0 + - ordinal: 5022 + rva: 0 + offset: 0 + - ordinal: 5023 + rva: 0 + offset: 0 + - ordinal: 5024 + rva: 0 + offset: 0 + - ordinal: 5025 + rva: 0 + offset: 0 + - ordinal: 5026 + rva: 0 + offset: 0 + - ordinal: 5027 + rva: 0 + offset: 0 + - ordinal: 5028 + rva: 0 + offset: 0 + - ordinal: 5029 + rva: 0 + offset: 0 + - ordinal: 5030 + rva: 0 + offset: 0 + - ordinal: 5031 + rva: 0 + offset: 0 + - ordinal: 5032 + rva: 0 + offset: 0 + - ordinal: 5033 + rva: 0 + offset: 0 + - ordinal: 5034 + rva: 0 + offset: 0 + - ordinal: 5035 + rva: 0 + offset: 0 + - ordinal: 5036 + rva: 0 + offset: 0 + - ordinal: 5037 + rva: 0 + offset: 0 + - ordinal: 5038 + rva: 0 + offset: 0 + - ordinal: 5039 + rva: 0 + offset: 0 + - ordinal: 5040 + rva: 0 + offset: 0 + - ordinal: 5041 + rva: 0 + offset: 0 + - ordinal: 5042 + rva: 0 + offset: 0 + - ordinal: 5043 + rva: 0 + offset: 0 + - ordinal: 5044 + rva: 0 + offset: 0 + - ordinal: 5045 + rva: 0 + offset: 0 + - ordinal: 5046 + rva: 0 + offset: 0 + - ordinal: 5047 + rva: 0 + offset: 0 + - ordinal: 5048 + rva: 0 + offset: 0 + - ordinal: 5049 + rva: 0 + offset: 0 + - ordinal: 5050 + rva: 0 + offset: 0 + - ordinal: 5051 + rva: 0 + offset: 0 + - ordinal: 5052 + rva: 0 + offset: 0 + - ordinal: 5053 + rva: 0 + offset: 0 + - ordinal: 5054 + rva: 0 + offset: 0 + - ordinal: 5055 + rva: 0 + offset: 0 + - ordinal: 5056 + rva: 0 + offset: 0 + - ordinal: 5057 + rva: 0 + offset: 0 + - ordinal: 5058 + rva: 0 + offset: 0 + - ordinal: 5059 + rva: 0 + offset: 0 + - ordinal: 5060 + rva: 0 + offset: 0 + - ordinal: 5061 + rva: 0 + offset: 0 + - ordinal: 5062 + rva: 0 + offset: 0 + - ordinal: 5063 + rva: 0 + offset: 0 + - ordinal: 5064 + rva: 0 + offset: 0 + - ordinal: 5065 + rva: 0 + offset: 0 + - ordinal: 5066 + rva: 0 + offset: 0 + - ordinal: 5067 + rva: 0 + offset: 0 + - ordinal: 5068 + rva: 0 + offset: 0 + - ordinal: 5069 + rva: 0 + offset: 0 + - ordinal: 5070 + rva: 0 + offset: 0 + - ordinal: 5071 + rva: 0 + offset: 0 + - ordinal: 5072 + rva: 0 + offset: 0 + - ordinal: 5073 + rva: 0 + offset: 0 + - ordinal: 5074 + rva: 0 + offset: 0 + - ordinal: 5075 + rva: 0 + offset: 0 + - ordinal: 5076 + rva: 0 + offset: 0 + - ordinal: 5077 + rva: 0 + offset: 0 + - ordinal: 5078 + rva: 0 + offset: 0 + - ordinal: 5079 + rva: 0 + offset: 0 + - ordinal: 5080 + rva: 0 + offset: 0 + - ordinal: 5081 + rva: 0 + offset: 0 + - ordinal: 5082 + rva: 0 + offset: 0 + - ordinal: 5083 + rva: 0 + offset: 0 + - ordinal: 5084 + rva: 0 + offset: 0 + - ordinal: 5085 + rva: 0 + offset: 0 + - ordinal: 5086 + rva: 0 + offset: 0 + - ordinal: 5087 + rva: 0 + offset: 0 + - ordinal: 5088 + rva: 0 + offset: 0 + - ordinal: 5089 + rva: 0 + offset: 0 + - ordinal: 5090 + rva: 0 + offset: 0 + - ordinal: 5091 + rva: 0 + offset: 0 + - ordinal: 5092 + rva: 0 + offset: 0 + - ordinal: 5093 + rva: 0 + offset: 0 + - ordinal: 5094 + rva: 0 + offset: 0 + - ordinal: 5095 + rva: 0 + offset: 0 + - ordinal: 5096 + rva: 0 + offset: 0 + - ordinal: 5097 + rva: 0 + offset: 0 + - ordinal: 5098 + rva: 0 + offset: 0 + - ordinal: 5099 + rva: 0 + offset: 0 + - ordinal: 5100 + rva: 0 + offset: 0 + - ordinal: 5101 + rva: 0 + offset: 0 + - ordinal: 5102 + rva: 0 + offset: 0 + - ordinal: 5103 + rva: 0 + offset: 0 + - ordinal: 5104 + rva: 0 + offset: 0 + - ordinal: 5105 + rva: 0 + offset: 0 + - ordinal: 5106 + rva: 0 + offset: 0 + - ordinal: 5107 + rva: 0 + offset: 0 + - ordinal: 5108 + rva: 0 + offset: 0 + - ordinal: 5109 + rva: 0 + offset: 0 + - ordinal: 5110 + rva: 0 + offset: 0 + - ordinal: 5111 + rva: 0 + offset: 0 + - ordinal: 5112 + rva: 0 + offset: 0 + - ordinal: 5113 + rva: 0 + offset: 0 + - ordinal: 5114 + rva: 0 + offset: 0 + - ordinal: 5115 + rva: 0 + offset: 0 + - ordinal: 5116 + rva: 0 + offset: 0 + - ordinal: 5117 + rva: 0 + offset: 0 + - ordinal: 5118 + rva: 0 + offset: 0 + - ordinal: 5119 + rva: 0 + offset: 0 + - ordinal: 5120 + rva: 0 + offset: 0 + - ordinal: 5121 + rva: 0 + offset: 0 + - ordinal: 5122 + rva: 0 + offset: 0 + - ordinal: 5123 + rva: 0 + offset: 0 + - ordinal: 5124 + rva: 0 + offset: 0 + - ordinal: 5125 + rva: 0 + offset: 0 + - ordinal: 5126 + rva: 0 + offset: 0 + - ordinal: 5127 + rva: 0 + offset: 0 + - ordinal: 5128 + rva: 0 + offset: 0 + - ordinal: 5129 + rva: 0 + offset: 0 + - ordinal: 5130 + rva: 0 + offset: 0 + - ordinal: 5131 + rva: 0 + offset: 0 + - ordinal: 5132 + rva: 0 + offset: 0 + - ordinal: 5133 + rva: 0 + offset: 0 + - ordinal: 5134 + rva: 0 + offset: 0 + - ordinal: 5135 + rva: 0 + offset: 0 + - ordinal: 5136 + rva: 0 + offset: 0 + - ordinal: 5137 + rva: 0 + offset: 0 + - ordinal: 5138 + rva: 0 + offset: 0 + - ordinal: 5139 + rva: 0 + offset: 0 + - ordinal: 5140 + rva: 0 + offset: 0 + - ordinal: 5141 + rva: 0 + offset: 0 + - ordinal: 5142 + rva: 0 + offset: 0 + - ordinal: 5143 + rva: 0 + offset: 0 + - ordinal: 5144 + rva: 0 + offset: 0 + - ordinal: 5145 + rva: 0 + offset: 0 + - ordinal: 5146 + rva: 0 + offset: 0 + - ordinal: 5147 + rva: 0 + offset: 0 + - ordinal: 5148 + rva: 0 + offset: 0 + - ordinal: 5149 + rva: 0 + offset: 0 + - ordinal: 5150 + rva: 0 + offset: 0 + - ordinal: 5151 + rva: 0 + offset: 0 + - ordinal: 5152 + rva: 0 + offset: 0 + - ordinal: 5153 + rva: 0 + offset: 0 + - ordinal: 5154 + rva: 0 + offset: 0 + - ordinal: 5155 + rva: 0 + offset: 0 + - ordinal: 5156 + rva: 0 + offset: 0 + - ordinal: 5157 + rva: 0 + offset: 0 + - ordinal: 5158 + rva: 0 + offset: 0 + - ordinal: 5159 + rva: 0 + offset: 0 + - ordinal: 5160 + rva: 0 + offset: 0 + - ordinal: 5161 + rva: 0 + offset: 0 + - ordinal: 5162 + rva: 0 + offset: 0 + - ordinal: 5163 + rva: 0 + offset: 0 + - ordinal: 5164 + rva: 0 + offset: 0 + - ordinal: 5165 + rva: 0 + offset: 0 + - ordinal: 5166 + rva: 0 + offset: 0 + - ordinal: 5167 + rva: 0 + offset: 0 + - ordinal: 5168 + rva: 0 + offset: 0 + - ordinal: 5169 + rva: 0 + offset: 0 + - ordinal: 5170 + rva: 0 + offset: 0 + - ordinal: 5171 + rva: 0 + offset: 0 + - ordinal: 5172 + rva: 0 + offset: 0 + - ordinal: 5173 + rva: 0 + offset: 0 + - ordinal: 5174 + rva: 0 + offset: 0 + - ordinal: 5175 + rva: 0 + offset: 0 + - ordinal: 5176 + rva: 0 + offset: 0 + - ordinal: 5177 + rva: 0 + offset: 0 + - ordinal: 5178 + rva: 0 + offset: 0 + - ordinal: 5179 + rva: 0 + offset: 0 + - ordinal: 5180 + rva: 0 + offset: 0 + - ordinal: 5181 + rva: 0 + offset: 0 + - ordinal: 5182 + rva: 0 + offset: 0 + - ordinal: 5183 + rva: 0 + offset: 0 + - ordinal: 5184 + rva: 0 + offset: 0 + - ordinal: 5185 + rva: 0 + offset: 0 + - ordinal: 5186 + rva: 0 + offset: 0 + - ordinal: 5187 + rva: 0 + offset: 0 + - ordinal: 5188 + rva: 0 + offset: 0 + - ordinal: 5189 + rva: 0 + offset: 0 + - ordinal: 5190 + rva: 0 + offset: 0 + - ordinal: 5191 + rva: 0 + offset: 0 + - ordinal: 5192 + rva: 0 + offset: 0 + - ordinal: 5193 + rva: 0 + offset: 0 + - ordinal: 5194 + rva: 0 + offset: 0 + - ordinal: 5195 + rva: 0 + offset: 0 + - ordinal: 5196 + rva: 0 + offset: 0 + - ordinal: 5197 + rva: 0 + offset: 0 + - ordinal: 5198 + rva: 0 + offset: 0 + - ordinal: 5199 + rva: 0 + offset: 0 + - ordinal: 5200 + rva: 0 + offset: 0 + - ordinal: 5201 + rva: 0 + offset: 0 + - ordinal: 5202 + rva: 0 + offset: 0 + - ordinal: 5203 + rva: 0 + offset: 0 + - ordinal: 5204 + rva: 0 + offset: 0 + - ordinal: 5205 + rva: 0 + offset: 0 + - ordinal: 5206 + rva: 0 + offset: 0 + - ordinal: 5207 + rva: 0 + offset: 0 + - ordinal: 5208 + rva: 0 + offset: 0 + - ordinal: 5209 + rva: 0 + offset: 0 + - ordinal: 5210 + rva: 0 + offset: 0 + - ordinal: 5211 + rva: 0 + offset: 0 + - ordinal: 5212 + rva: 0 + offset: 0 + - ordinal: 5213 + rva: 0 + offset: 0 + - ordinal: 5214 + rva: 0 + offset: 0 + - ordinal: 5215 + rva: 0 + offset: 0 + - ordinal: 5216 + rva: 0 + offset: 0 + - ordinal: 5217 + rva: 0 + offset: 0 + - ordinal: 5218 + rva: 0 + offset: 0 + - ordinal: 5219 + rva: 0 + offset: 0 + - ordinal: 5220 + rva: 0 + offset: 0 + - ordinal: 5221 + rva: 0 + offset: 0 + - ordinal: 5222 + rva: 0 + offset: 0 + - ordinal: 5223 + rva: 0 + offset: 0 + - ordinal: 5224 + rva: 0 + offset: 0 + - ordinal: 5225 + rva: 0 + offset: 0 + - ordinal: 5226 + rva: 0 + offset: 0 + - ordinal: 5227 + rva: 0 + offset: 0 + - ordinal: 5228 + rva: 0 + offset: 0 + - ordinal: 5229 + rva: 0 + offset: 0 + - ordinal: 5230 + rva: 0 + offset: 0 + - ordinal: 5231 + rva: 0 + offset: 0 + - ordinal: 5232 + rva: 0 + offset: 0 + - ordinal: 5233 + rva: 0 + offset: 0 + - ordinal: 5234 + rva: 0 + offset: 0 + - ordinal: 5235 + rva: 0 + offset: 0 + - ordinal: 5236 + rva: 0 + offset: 0 + - ordinal: 5237 + rva: 0 + offset: 0 + - ordinal: 5238 + rva: 0 + offset: 0 + - ordinal: 5239 + rva: 0 + offset: 0 + - ordinal: 5240 + rva: 0 + offset: 0 + - ordinal: 5241 + rva: 0 + offset: 0 + - ordinal: 5242 + rva: 0 + offset: 0 + - ordinal: 5243 + rva: 0 + offset: 0 + - ordinal: 5244 + rva: 0 + offset: 0 + - ordinal: 5245 + rva: 0 + offset: 0 + - ordinal: 5246 + rva: 0 + offset: 0 + - ordinal: 5247 + rva: 0 + offset: 0 + - ordinal: 5248 + rva: 0 + offset: 0 + - ordinal: 5249 + rva: 0 + offset: 0 + - ordinal: 5250 + rva: 0 + offset: 0 + - ordinal: 5251 + rva: 0 + offset: 0 + - ordinal: 5252 + rva: 0 + offset: 0 + - ordinal: 5253 + rva: 0 + offset: 0 + - ordinal: 5254 + rva: 0 + offset: 0 + - ordinal: 5255 + rva: 0 + offset: 0 + - ordinal: 5256 + rva: 0 + offset: 0 + - ordinal: 5257 + rva: 0 + offset: 0 + - ordinal: 5258 + rva: 0 + offset: 0 + - ordinal: 5259 + rva: 0 + offset: 0 + - ordinal: 5260 + rva: 0 + offset: 0 + - ordinal: 5261 + rva: 0 + offset: 0 + - ordinal: 5262 + rva: 0 + offset: 0 + - ordinal: 5263 + rva: 0 + offset: 0 + - ordinal: 5264 + rva: 0 + offset: 0 + - ordinal: 5265 + rva: 0 + offset: 0 + - ordinal: 5266 + rva: 0 + offset: 0 + - ordinal: 5267 + rva: 0 + offset: 0 + - ordinal: 5268 + rva: 0 + offset: 0 + - ordinal: 5269 + rva: 0 + offset: 0 + - ordinal: 5270 + rva: 0 + offset: 0 + - ordinal: 5271 + rva: 0 + offset: 0 + - ordinal: 5272 + rva: 0 + offset: 0 + - ordinal: 5273 + rva: 0 + offset: 0 + - ordinal: 5274 + rva: 0 + offset: 0 + - ordinal: 5275 + rva: 0 + offset: 0 + - ordinal: 5276 + rva: 0 + offset: 0 + - ordinal: 5277 + rva: 0 + offset: 0 + - ordinal: 5278 + rva: 0 + offset: 0 + - ordinal: 5279 + rva: 0 + offset: 0 + - ordinal: 5280 + rva: 0 + offset: 0 + - ordinal: 5281 + rva: 0 + offset: 0 + - ordinal: 5282 + rva: 0 + offset: 0 + - ordinal: 5283 + rva: 0 + offset: 0 + - ordinal: 5284 + rva: 0 + offset: 0 + - ordinal: 5285 + rva: 0 + offset: 0 + - ordinal: 5286 + rva: 0 + offset: 0 + - ordinal: 5287 + rva: 0 + offset: 0 + - ordinal: 5288 + rva: 0 + offset: 0 + - ordinal: 5289 + rva: 0 + offset: 0 + - ordinal: 5290 + rva: 0 + offset: 0 + - ordinal: 5291 + rva: 0 + offset: 0 + - ordinal: 5292 + rva: 0 + offset: 0 + - ordinal: 5293 + rva: 0 + offset: 0 + - ordinal: 5294 + rva: 0 + offset: 0 + - ordinal: 5295 + rva: 0 + offset: 0 + - ordinal: 5296 + rva: 0 + offset: 0 + - ordinal: 5297 + rva: 0 + offset: 0 + - ordinal: 5298 + rva: 0 + offset: 0 + - ordinal: 5299 + rva: 0 + offset: 0 + - ordinal: 5300 + rva: 0 + offset: 0 + - ordinal: 5301 + rva: 0 + offset: 0 + - ordinal: 5302 + rva: 0 + offset: 0 + - ordinal: 5303 + rva: 0 + offset: 0 + - ordinal: 5304 + rva: 0 + offset: 0 + - ordinal: 5305 + rva: 0 + offset: 0 + - ordinal: 5306 + rva: 0 + offset: 0 + - ordinal: 5307 + rva: 0 + offset: 0 + - ordinal: 5308 + rva: 0 + offset: 0 + - ordinal: 5309 + rva: 0 + offset: 0 + - ordinal: 5310 + rva: 0 + offset: 0 + - ordinal: 5311 + rva: 0 + offset: 0 + - ordinal: 5312 + rva: 0 + offset: 0 + - ordinal: 5313 + rva: 0 + offset: 0 + - ordinal: 5314 + rva: 0 + offset: 0 + - ordinal: 5315 + rva: 0 + offset: 0 + - ordinal: 5316 + rva: 0 + offset: 0 + - ordinal: 5317 + rva: 0 + offset: 0 + - ordinal: 5318 + rva: 0 + offset: 0 + - ordinal: 5319 + rva: 0 + offset: 0 + - ordinal: 5320 + rva: 0 + offset: 0 + - ordinal: 5321 + rva: 0 + offset: 0 + - ordinal: 5322 + rva: 0 + offset: 0 + - ordinal: 5323 + rva: 0 + offset: 0 + - ordinal: 5324 + rva: 0 + offset: 0 + - ordinal: 5325 + rva: 0 + offset: 0 + - ordinal: 5326 + rva: 0 + offset: 0 + - ordinal: 5327 + rva: 0 + offset: 0 + - ordinal: 5328 + rva: 0 + offset: 0 + - ordinal: 5329 + rva: 0 + offset: 0 + - ordinal: 5330 + rva: 0 + offset: 0 + - ordinal: 5331 + rva: 0 + offset: 0 + - ordinal: 5332 + rva: 0 + offset: 0 + - ordinal: 5333 + rva: 0 + offset: 0 + - ordinal: 5334 + rva: 0 + offset: 0 + - ordinal: 5335 + rva: 0 + offset: 0 + - ordinal: 5336 + rva: 0 + offset: 0 + - ordinal: 5337 + rva: 0 + offset: 0 + - ordinal: 5338 + rva: 0 + offset: 0 + - ordinal: 5339 + rva: 0 + offset: 0 + - ordinal: 5340 + rva: 0 + offset: 0 + - ordinal: 5341 + rva: 0 + offset: 0 + - ordinal: 5342 + rva: 0 + offset: 0 + - ordinal: 5343 + rva: 0 + offset: 0 + - ordinal: 5344 + rva: 0 + offset: 0 + - ordinal: 5345 + rva: 0 + offset: 0 + - ordinal: 5346 + rva: 0 + offset: 0 + - ordinal: 5347 + rva: 0 + offset: 0 + - ordinal: 5348 + rva: 0 + offset: 0 + - ordinal: 5349 + rva: 0 + offset: 0 + - ordinal: 5350 + rva: 0 + offset: 0 + - ordinal: 5351 + rva: 0 + offset: 0 + - ordinal: 5352 + rva: 0 + offset: 0 + - ordinal: 5353 + rva: 0 + offset: 0 + - ordinal: 5354 + rva: 0 + offset: 0 + - ordinal: 5355 + rva: 0 + offset: 0 + - ordinal: 5356 + rva: 0 + offset: 0 + - ordinal: 5357 + rva: 0 + offset: 0 + - ordinal: 5358 + rva: 0 + offset: 0 + - ordinal: 5359 + rva: 0 + offset: 0 + - ordinal: 5360 + rva: 0 + offset: 0 + - ordinal: 5361 + rva: 0 + offset: 0 + - ordinal: 5362 + rva: 0 + offset: 0 + - ordinal: 5363 + rva: 0 + offset: 0 + - ordinal: 5364 + rva: 0 + offset: 0 + - ordinal: 5365 + rva: 0 + offset: 0 + - ordinal: 5366 + rva: 0 + offset: 0 + - ordinal: 5367 + rva: 0 + offset: 0 + - ordinal: 5368 + rva: 0 + offset: 0 + - ordinal: 5369 + rva: 0 + offset: 0 + - ordinal: 5370 + rva: 0 + offset: 0 + - ordinal: 5371 + rva: 0 + offset: 0 + - ordinal: 5372 + rva: 0 + offset: 0 + - ordinal: 5373 + rva: 0 + offset: 0 + - ordinal: 5374 + rva: 0 + offset: 0 + - ordinal: 5375 + rva: 0 + offset: 0 + - ordinal: 5376 + rva: 0 + offset: 0 + - ordinal: 5377 + rva: 0 + offset: 0 + - ordinal: 5378 + rva: 0 + offset: 0 + - ordinal: 5379 + rva: 0 + offset: 0 + - ordinal: 5380 + rva: 0 + offset: 0 + - ordinal: 5381 + rva: 0 + offset: 0 + - ordinal: 5382 + rva: 0 + offset: 0 + - ordinal: 5383 + rva: 0 + offset: 0 + - ordinal: 5384 + rva: 0 + offset: 0 + - ordinal: 5385 + rva: 0 + offset: 0 + - ordinal: 5386 + rva: 0 + offset: 0 + - ordinal: 5387 + rva: 0 + offset: 0 + - ordinal: 5388 + rva: 0 + offset: 0 + - ordinal: 5389 + rva: 0 + offset: 0 + - ordinal: 5390 + rva: 0 + offset: 0 + - ordinal: 5391 + rva: 0 + offset: 0 + - ordinal: 5392 + rva: 0 + offset: 0 + - ordinal: 5393 + rva: 0 + offset: 0 + - ordinal: 5394 + rva: 0 + offset: 0 + - ordinal: 5395 + rva: 0 + offset: 0 + - ordinal: 5396 + rva: 0 + offset: 0 + - ordinal: 5397 + rva: 0 + offset: 0 + - ordinal: 5398 + rva: 0 + offset: 0 + - ordinal: 5399 + rva: 0 + offset: 0 + - ordinal: 5400 + rva: 0 + offset: 0 + - ordinal: 5401 + rva: 0 + offset: 0 + - ordinal: 5402 + rva: 0 + offset: 0 + - ordinal: 5403 + rva: 0 + offset: 0 + - ordinal: 5404 + rva: 0 + offset: 0 + - ordinal: 5405 + rva: 0 + offset: 0 + - ordinal: 5406 + rva: 0 + offset: 0 + - ordinal: 5407 + rva: 0 + offset: 0 + - ordinal: 5408 + rva: 0 + offset: 0 + - ordinal: 5409 + rva: 0 + offset: 0 + - ordinal: 5410 + rva: 0 + offset: 0 + - ordinal: 5411 + rva: 0 + offset: 0 + - ordinal: 5412 + rva: 0 + offset: 0 + - ordinal: 5413 + rva: 0 + offset: 0 + - ordinal: 5414 + rva: 0 + offset: 0 + - ordinal: 5415 + rva: 0 + offset: 0 + - ordinal: 5416 + rva: 0 + offset: 0 + - ordinal: 5417 + rva: 0 + offset: 0 + - ordinal: 5418 + rva: 0 + offset: 0 + - ordinal: 5419 + rva: 0 + offset: 0 + - ordinal: 5420 + rva: 0 + offset: 0 + - ordinal: 5421 + rva: 0 + offset: 0 + - ordinal: 5422 + rva: 0 + offset: 0 + - ordinal: 5423 + rva: 0 + offset: 0 + - ordinal: 5424 + rva: 0 + offset: 0 + - ordinal: 5425 + rva: 0 + offset: 0 + - ordinal: 5426 + rva: 0 + offset: 0 + - ordinal: 5427 + rva: 0 + offset: 0 + - ordinal: 5428 + rva: 0 + offset: 0 + - ordinal: 5429 + rva: 0 + offset: 0 + - ordinal: 5430 + rva: 0 + offset: 0 + - ordinal: 5431 + rva: 0 + offset: 0 + - ordinal: 5432 + rva: 0 + offset: 0 + - ordinal: 5433 + rva: 0 + offset: 0 + - ordinal: 5434 + rva: 0 + offset: 0 + - ordinal: 5435 + rva: 0 + offset: 0 + - ordinal: 5436 + rva: 0 + offset: 0 + - ordinal: 5437 + rva: 0 + offset: 0 + - ordinal: 5438 + rva: 0 + offset: 0 + - ordinal: 5439 + rva: 0 + offset: 0 + - ordinal: 5440 + rva: 0 + offset: 0 + - ordinal: 5441 + rva: 0 + offset: 0 + - ordinal: 5442 + rva: 0 + offset: 0 + - ordinal: 5443 + rva: 0 + offset: 0 + - ordinal: 5444 + rva: 0 + offset: 0 + - ordinal: 5445 + rva: 0 + offset: 0 + - ordinal: 5446 + rva: 0 + offset: 0 + - ordinal: 5447 + rva: 0 + offset: 0 + - ordinal: 5448 + rva: 0 + offset: 0 + - ordinal: 5449 + rva: 0 + offset: 0 + - ordinal: 5450 + rva: 0 + offset: 0 + - ordinal: 5451 + rva: 0 + offset: 0 + - ordinal: 5452 + rva: 0 + offset: 0 + - ordinal: 5453 + rva: 0 + offset: 0 + - ordinal: 5454 + rva: 0 + offset: 0 + - ordinal: 5455 + rva: 0 + offset: 0 + - ordinal: 5456 + rva: 0 + offset: 0 + - ordinal: 5457 + rva: 0 + offset: 0 + - ordinal: 5458 + rva: 0 + offset: 0 + - ordinal: 5459 + rva: 0 + offset: 0 + - ordinal: 5460 + rva: 0 + offset: 0 + - ordinal: 5461 + rva: 0 + offset: 0 + - ordinal: 5462 + rva: 0 + offset: 0 + - ordinal: 5463 + rva: 0 + offset: 0 + - ordinal: 5464 + rva: 0 + offset: 0 + - ordinal: 5465 + rva: 0 + offset: 0 + - ordinal: 5466 + rva: 0 + offset: 0 + - ordinal: 5467 + rva: 0 + offset: 0 + - ordinal: 5468 + rva: 0 + offset: 0 + - ordinal: 5469 + rva: 0 + offset: 0 + - ordinal: 5470 + rva: 0 + offset: 0 + - ordinal: 5471 + rva: 0 + offset: 0 + - ordinal: 5472 + rva: 0 + offset: 0 + - ordinal: 5473 + rva: 0 + offset: 0 + - ordinal: 5474 + rva: 0 + offset: 0 + - ordinal: 5475 + rva: 0 + offset: 0 + - ordinal: 5476 + rva: 0 + offset: 0 + - ordinal: 5477 + rva: 0 + offset: 0 + - ordinal: 5478 + rva: 0 + offset: 0 + - ordinal: 5479 + rva: 0 + offset: 0 + - ordinal: 5480 + rva: 0 + offset: 0 + - ordinal: 5481 + rva: 0 + offset: 0 + - ordinal: 5482 + rva: 0 + offset: 0 + - ordinal: 5483 + rva: 0 + offset: 0 + - ordinal: 5484 + rva: 0 + offset: 0 + - ordinal: 5485 + rva: 0 + offset: 0 + - ordinal: 5486 + rva: 0 + offset: 0 + - ordinal: 5487 + rva: 0 + offset: 0 + - ordinal: 5488 + rva: 0 + offset: 0 + - ordinal: 5489 + rva: 0 + offset: 0 + - ordinal: 5490 + rva: 0 + offset: 0 + - ordinal: 5491 + rva: 0 + offset: 0 + - ordinal: 5492 + rva: 0 + offset: 0 + - ordinal: 5493 + rva: 0 + offset: 0 + - ordinal: 5494 + rva: 0 + offset: 0 + - ordinal: 5495 + rva: 0 + offset: 0 + - ordinal: 5496 + rva: 0 + offset: 0 + - ordinal: 5497 + rva: 0 + offset: 0 + - ordinal: 5498 + rva: 0 + offset: 0 + - ordinal: 5499 + rva: 0 + offset: 0 + - ordinal: 5500 + rva: 0 + offset: 0 + - ordinal: 5501 + rva: 0 + offset: 0 + - ordinal: 5502 + rva: 0 + offset: 0 + - ordinal: 5503 + rva: 0 + offset: 0 + - ordinal: 5504 + rva: 0 + offset: 0 + - ordinal: 5505 + rva: 0 + offset: 0 + - ordinal: 5506 + rva: 0 + offset: 0 + - ordinal: 5507 + rva: 0 + offset: 0 + - ordinal: 5508 + rva: 0 + offset: 0 + - ordinal: 5509 + rva: 0 + offset: 0 + - ordinal: 5510 + rva: 0 + offset: 0 + - ordinal: 5511 + rva: 0 + offset: 0 + - ordinal: 5512 + rva: 0 + offset: 0 + - ordinal: 5513 + rva: 0 + offset: 0 + - ordinal: 5514 + rva: 0 + offset: 0 + - ordinal: 5515 + rva: 0 + offset: 0 + - ordinal: 5516 + rva: 0 + offset: 0 + - ordinal: 5517 + rva: 0 + offset: 0 + - ordinal: 5518 + rva: 0 + offset: 0 + - ordinal: 5519 + rva: 0 + offset: 0 + - ordinal: 5520 + rva: 0 + offset: 0 + - ordinal: 5521 + rva: 0 + offset: 0 + - ordinal: 5522 + rva: 0 + offset: 0 + - ordinal: 5523 + rva: 0 + offset: 0 + - ordinal: 5524 + rva: 0 + offset: 0 + - ordinal: 5525 + rva: 0 + offset: 0 + - ordinal: 5526 + rva: 0 + offset: 0 + - ordinal: 5527 + rva: 0 + offset: 0 + - ordinal: 5528 + rva: 0 + offset: 0 + - ordinal: 5529 + rva: 0 + offset: 0 + - ordinal: 5530 + rva: 0 + offset: 0 + - ordinal: 5531 + rva: 0 + offset: 0 + - ordinal: 5532 + rva: 0 + offset: 0 + - ordinal: 5533 + rva: 0 + offset: 0 + - ordinal: 5534 + rva: 0 + offset: 0 + - ordinal: 5535 + rva: 0 + offset: 0 + - ordinal: 5536 + rva: 0 + offset: 0 + - ordinal: 5537 + rva: 0 + offset: 0 + - ordinal: 5538 + rva: 0 + offset: 0 + - ordinal: 5539 + rva: 0 + offset: 0 + - ordinal: 5540 + rva: 0 + offset: 0 + - ordinal: 5541 + rva: 0 + offset: 0 + - ordinal: 5542 + rva: 0 + offset: 0 + - ordinal: 5543 + rva: 0 + offset: 0 + - ordinal: 5544 + rva: 0 + offset: 0 + - ordinal: 5545 + rva: 0 + offset: 0 + - ordinal: 5546 + rva: 0 + offset: 0 + - ordinal: 5547 + rva: 0 + offset: 0 + - ordinal: 5548 + rva: 0 + offset: 0 + - ordinal: 5549 + rva: 0 + offset: 0 + - ordinal: 5550 + rva: 0 + offset: 0 + - ordinal: 5551 + rva: 0 + offset: 0 + - ordinal: 5552 + rva: 0 + offset: 0 + - ordinal: 5553 + rva: 0 + offset: 0 + - ordinal: 5554 + rva: 0 + offset: 0 + - ordinal: 5555 + rva: 0 + offset: 0 + - ordinal: 5556 + rva: 0 + offset: 0 + - ordinal: 5557 + rva: 0 + offset: 0 + - ordinal: 5558 + rva: 0 + offset: 0 + - ordinal: 5559 + rva: 0 + offset: 0 + - ordinal: 5560 + rva: 0 + offset: 0 + - ordinal: 5561 + rva: 0 + offset: 0 + - ordinal: 5562 + rva: 0 + offset: 0 + - ordinal: 5563 + rva: 0 + offset: 0 + - ordinal: 5564 + rva: 0 + offset: 0 + - ordinal: 5565 + rva: 0 + offset: 0 + - ordinal: 5566 + rva: 0 + offset: 0 + - ordinal: 5567 + rva: 0 + offset: 0 + - ordinal: 5568 + rva: 0 + offset: 0 + - ordinal: 5569 + rva: 0 + offset: 0 + - ordinal: 5570 + rva: 0 + offset: 0 + - ordinal: 5571 + rva: 0 + offset: 0 + - ordinal: 5572 + rva: 0 + offset: 0 + - ordinal: 5573 + rva: 0 + offset: 0 + - ordinal: 5574 + rva: 0 + offset: 0 + - ordinal: 5575 + rva: 0 + offset: 0 + - ordinal: 5576 + rva: 0 + offset: 0 + - ordinal: 5577 + rva: 0 + offset: 0 + - ordinal: 5578 + rva: 0 + offset: 0 + - ordinal: 5579 + rva: 0 + offset: 0 + - ordinal: 5580 + rva: 0 + offset: 0 + - ordinal: 5581 + rva: 0 + offset: 0 + - ordinal: 5582 + rva: 0 + offset: 0 + - ordinal: 5583 + rva: 0 + offset: 0 + - ordinal: 5584 + rva: 0 + offset: 0 + - ordinal: 5585 + rva: 0 + offset: 0 + - ordinal: 5586 + rva: 0 + offset: 0 + - ordinal: 5587 + rva: 0 + offset: 0 + - ordinal: 5588 + rva: 0 + offset: 0 + - ordinal: 5589 + rva: 0 + offset: 0 + - ordinal: 5590 + rva: 0 + offset: 0 + - ordinal: 5591 + rva: 0 + offset: 0 + - ordinal: 5592 + rva: 0 + offset: 0 + - ordinal: 5593 + rva: 0 + offset: 0 + - ordinal: 5594 + rva: 0 + offset: 0 + - ordinal: 5595 + rva: 0 + offset: 0 + - ordinal: 5596 + rva: 0 + offset: 0 + - ordinal: 5597 + rva: 0 + offset: 0 + - ordinal: 5598 + rva: 0 + offset: 0 + - ordinal: 5599 + rva: 0 + offset: 0 + - ordinal: 5600 + rva: 0 + offset: 0 + - ordinal: 5601 + rva: 0 + offset: 0 + - ordinal: 5602 + rva: 0 + offset: 0 + - ordinal: 5603 + rva: 0 + offset: 0 + - ordinal: 5604 + rva: 0 + offset: 0 + - ordinal: 5605 + rva: 0 + offset: 0 + - ordinal: 5606 + rva: 0 + offset: 0 + - ordinal: 5607 + rva: 0 + offset: 0 + - ordinal: 5608 + rva: 0 + offset: 0 + - ordinal: 5609 + rva: 0 + offset: 0 + - ordinal: 5610 + rva: 0 + offset: 0 + - ordinal: 5611 + rva: 0 + offset: 0 + - ordinal: 5612 + rva: 0 + offset: 0 + - ordinal: 5613 + rva: 0 + offset: 0 + - ordinal: 5614 + rva: 0 + offset: 0 + - ordinal: 5615 + rva: 0 + offset: 0 + - ordinal: 5616 + rva: 0 + offset: 0 + - ordinal: 5617 + rva: 0 + offset: 0 + - ordinal: 5618 + rva: 0 + offset: 0 + - ordinal: 5619 + rva: 0 + offset: 0 + - ordinal: 5620 + rva: 0 + offset: 0 + - ordinal: 5621 + rva: 0 + offset: 0 + - ordinal: 5622 + rva: 0 + offset: 0 + - ordinal: 5623 + rva: 0 + offset: 0 + - ordinal: 5624 + rva: 0 + offset: 0 + - ordinal: 5625 + rva: 0 + offset: 0 + - ordinal: 5626 + rva: 0 + offset: 0 + - ordinal: 5627 + rva: 0 + offset: 0 + - ordinal: 5628 + rva: 0 + offset: 0 + - ordinal: 5629 + rva: 0 + offset: 0 + - ordinal: 5630 + rva: 0 + offset: 0 + - ordinal: 5631 + rva: 0 + offset: 0 + - ordinal: 5632 + rva: 0 + offset: 0 + - ordinal: 5633 + rva: 0 + offset: 0 + - ordinal: 5634 + rva: 0 + offset: 0 + - ordinal: 5635 + rva: 0 + offset: 0 + - ordinal: 5636 + rva: 0 + offset: 0 + - ordinal: 5637 + rva: 0 + offset: 0 + - ordinal: 5638 + rva: 0 + offset: 0 + - ordinal: 5639 + rva: 0 + offset: 0 + - ordinal: 5640 + rva: 0 + offset: 0 + - ordinal: 5641 + rva: 0 + offset: 0 + - ordinal: 5642 + rva: 0 + offset: 0 + - ordinal: 5643 + rva: 0 + offset: 0 + - ordinal: 5644 + rva: 0 + offset: 0 + - ordinal: 5645 + rva: 0 + offset: 0 + - ordinal: 5646 + rva: 0 + offset: 0 + - ordinal: 5647 + rva: 0 + offset: 0 + - ordinal: 5648 + rva: 0 + offset: 0 + - ordinal: 5649 + rva: 0 + offset: 0 + - ordinal: 5650 + rva: 0 + offset: 0 + - ordinal: 5651 + rva: 0 + offset: 0 + - ordinal: 5652 + rva: 0 + offset: 0 + - ordinal: 5653 + rva: 0 + offset: 0 + - ordinal: 5654 + rva: 0 + offset: 0 + - ordinal: 5655 + rva: 0 + offset: 0 + - ordinal: 5656 + rva: 0 + offset: 0 + - ordinal: 5657 + rva: 0 + offset: 0 + - ordinal: 5658 + rva: 0 + offset: 0 + - ordinal: 5659 + rva: 0 + offset: 0 + - ordinal: 5660 + rva: 0 + offset: 0 + - ordinal: 5661 + rva: 0 + offset: 0 + - ordinal: 5662 + rva: 0 + offset: 0 + - ordinal: 5663 + rva: 0 + offset: 0 + - ordinal: 5664 + rva: 0 + offset: 0 + - ordinal: 5665 + rva: 0 + offset: 0 + - ordinal: 5666 + rva: 0 + offset: 0 + - ordinal: 5667 + rva: 0 + offset: 0 + - ordinal: 5668 + rva: 0 + offset: 0 + - ordinal: 5669 + rva: 0 + offset: 0 + - ordinal: 5670 + rva: 0 + offset: 0 + - ordinal: 5671 + rva: 0 + offset: 0 + - ordinal: 5672 + rva: 0 + offset: 0 + - ordinal: 5673 + rva: 0 + offset: 0 + - ordinal: 5674 + rva: 0 + offset: 0 + - ordinal: 5675 + rva: 0 + offset: 0 + - ordinal: 5676 + rva: 0 + offset: 0 + - ordinal: 5677 + rva: 0 + offset: 0 + - ordinal: 5678 + rva: 0 + offset: 0 + - ordinal: 5679 + rva: 0 + offset: 0 + - ordinal: 5680 + rva: 0 + offset: 0 + - ordinal: 5681 + rva: 0 + offset: 0 + - ordinal: 5682 + rva: 0 + offset: 0 + - ordinal: 5683 + rva: 0 + offset: 0 + - ordinal: 5684 + rva: 0 + offset: 0 + - ordinal: 5685 + rva: 0 + offset: 0 + - ordinal: 5686 + rva: 0 + offset: 0 + - ordinal: 5687 + rva: 0 + offset: 0 + - ordinal: 5688 + rva: 0 + offset: 0 + - ordinal: 5689 + rva: 0 + offset: 0 + - ordinal: 5690 + rva: 0 + offset: 0 + - ordinal: 5691 + rva: 0 + offset: 0 + - ordinal: 5692 + rva: 0 + offset: 0 + - ordinal: 5693 + rva: 0 + offset: 0 + - ordinal: 5694 + rva: 0 + offset: 0 + - ordinal: 5695 + rva: 0 + offset: 0 + - ordinal: 5696 + rva: 0 + offset: 0 + - ordinal: 5697 + rva: 0 + offset: 0 + - ordinal: 5698 + rva: 0 + offset: 0 + - ordinal: 5699 + rva: 0 + offset: 0 + - ordinal: 5700 + rva: 0 + offset: 0 + - ordinal: 5701 + rva: 0 + offset: 0 + - ordinal: 5702 + rva: 0 + offset: 0 + - ordinal: 5703 + rva: 0 + offset: 0 + - ordinal: 5704 + rva: 0 + offset: 0 + - ordinal: 5705 + rva: 0 + offset: 0 + - ordinal: 5706 + rva: 0 + offset: 0 + - ordinal: 5707 + rva: 0 + offset: 0 + - ordinal: 5708 + rva: 0 + offset: 0 + - ordinal: 5709 + rva: 0 + offset: 0 + - ordinal: 5710 + rva: 0 + offset: 0 + - ordinal: 5711 + rva: 0 + offset: 0 + - ordinal: 5712 + rva: 0 + offset: 0 + - ordinal: 5713 + rva: 0 + offset: 0 + - ordinal: 5714 + rva: 0 + offset: 0 + - ordinal: 5715 + rva: 0 + offset: 0 + - ordinal: 5716 + rva: 0 + offset: 0 + - ordinal: 5717 + rva: 0 + offset: 0 + - ordinal: 5718 + rva: 0 + offset: 0 + - ordinal: 5719 + rva: 0 + offset: 0 + - ordinal: 5720 + rva: 0 + offset: 0 + - ordinal: 5721 + rva: 0 + offset: 0 + - ordinal: 5722 + rva: 0 + offset: 0 + - ordinal: 5723 + rva: 0 + offset: 0 + - ordinal: 5724 + rva: 0 + offset: 0 + - ordinal: 5725 + rva: 0 + offset: 0 + - ordinal: 5726 + rva: 0 + offset: 0 + - ordinal: 5727 + rva: 0 + offset: 0 + - ordinal: 5728 + rva: 0 + offset: 0 + - ordinal: 5729 + rva: 0 + offset: 0 + - ordinal: 5730 + rva: 0 + offset: 0 + - ordinal: 5731 + rva: 0 + offset: 0 + - ordinal: 5732 + rva: 0 + offset: 0 + - ordinal: 5733 + rva: 0 + offset: 0 + - ordinal: 5734 + rva: 0 + offset: 0 + - ordinal: 5735 + rva: 0 + offset: 0 + - ordinal: 5736 + rva: 0 + offset: 0 + - ordinal: 5737 + rva: 0 + offset: 0 + - ordinal: 5738 + rva: 0 + offset: 0 + - ordinal: 5739 + rva: 0 + offset: 0 + - ordinal: 5740 + rva: 0 + offset: 0 + - ordinal: 5741 + rva: 0 + offset: 0 + - ordinal: 5742 + rva: 0 + offset: 0 + - ordinal: 5743 + rva: 0 + offset: 0 + - ordinal: 5744 + rva: 0 + offset: 0 + - ordinal: 5745 + rva: 0 + offset: 0 + - ordinal: 5746 + rva: 0 + offset: 0 + - ordinal: 5747 + rva: 0 + offset: 0 + - ordinal: 5748 + rva: 0 + offset: 0 + - ordinal: 5749 + rva: 0 + offset: 0 + - ordinal: 5750 + rva: 0 + offset: 0 + - ordinal: 5751 + rva: 0 + offset: 0 + - ordinal: 5752 + rva: 0 + offset: 0 + - ordinal: 5753 + rva: 0 + offset: 0 + - ordinal: 5754 + rva: 0 + offset: 0 + - ordinal: 5755 + rva: 0 + offset: 0 + - ordinal: 5756 + rva: 0 + offset: 0 + - ordinal: 5757 + rva: 0 + offset: 0 + - ordinal: 5758 + rva: 0 + offset: 0 + - ordinal: 5759 + rva: 0 + offset: 0 + - ordinal: 5760 + rva: 0 + offset: 0 + - ordinal: 5761 + rva: 0 + offset: 0 + - ordinal: 5762 + rva: 0 + offset: 0 + - ordinal: 5763 + rva: 0 + offset: 0 + - ordinal: 5764 + rva: 0 + offset: 0 + - ordinal: 5765 + rva: 0 + offset: 0 + - ordinal: 5766 + rva: 0 + offset: 0 + - ordinal: 5767 + rva: 0 + offset: 0 + - ordinal: 5768 + rva: 0 + offset: 0 + - ordinal: 5769 + rva: 0 + offset: 0 + - ordinal: 5770 + rva: 0 + offset: 0 + - ordinal: 5771 + rva: 0 + offset: 0 + - ordinal: 5772 + rva: 0 + offset: 0 + - ordinal: 5773 + rva: 0 + offset: 0 + - ordinal: 5774 + rva: 0 + offset: 0 + - ordinal: 5775 + rva: 0 + offset: 0 + - ordinal: 5776 + rva: 0 + offset: 0 + - ordinal: 5777 + rva: 0 + offset: 0 + - ordinal: 5778 + rva: 0 + offset: 0 + - ordinal: 5779 + rva: 0 + offset: 0 + - ordinal: 5780 + rva: 0 + offset: 0 + - ordinal: 5781 + rva: 0 + offset: 0 + - ordinal: 5782 + rva: 0 + offset: 0 + - ordinal: 5783 + rva: 0 + offset: 0 + - ordinal: 5784 + rva: 0 + offset: 0 + - ordinal: 5785 + rva: 0 + offset: 0 + - ordinal: 5786 + rva: 0 + offset: 0 + - ordinal: 5787 + rva: 0 + offset: 0 + - ordinal: 5788 + rva: 0 + offset: 0 + - ordinal: 5789 + rva: 0 + offset: 0 + - ordinal: 5790 + rva: 0 + offset: 0 + - ordinal: 5791 + rva: 0 + offset: 0 + - ordinal: 5792 + rva: 0 + offset: 0 + - ordinal: 5793 + rva: 0 + offset: 0 + - ordinal: 5794 + rva: 0 + offset: 0 + - ordinal: 5795 + rva: 0 + offset: 0 + - ordinal: 5796 + rva: 0 + offset: 0 + - ordinal: 5797 + rva: 0 + offset: 0 + - ordinal: 5798 + rva: 0 + offset: 0 + - ordinal: 5799 + rva: 0 + offset: 0 + - ordinal: 5800 + rva: 0 + offset: 0 + - ordinal: 5801 + rva: 0 + offset: 0 + - ordinal: 5802 + rva: 0 + offset: 0 + - ordinal: 5803 + rva: 0 + offset: 0 + - ordinal: 5804 + rva: 0 + offset: 0 + - ordinal: 5805 + rva: 0 + offset: 0 + - ordinal: 5806 + rva: 0 + offset: 0 + - ordinal: 5807 + rva: 0 + offset: 0 + - ordinal: 5808 + rva: 0 + offset: 0 + - ordinal: 5809 + rva: 0 + offset: 0 + - ordinal: 5810 + rva: 0 + offset: 0 + - ordinal: 5811 + rva: 0 + offset: 0 + - ordinal: 5812 + rva: 0 + offset: 0 + - ordinal: 5813 + rva: 0 + offset: 0 + - ordinal: 5814 + rva: 0 + offset: 0 + - ordinal: 5815 + rva: 0 + offset: 0 + - ordinal: 5816 + rva: 0 + offset: 0 + - ordinal: 5817 + rva: 0 + offset: 0 + - ordinal: 5818 + rva: 0 + offset: 0 + - ordinal: 5819 + rva: 0 + offset: 0 + - ordinal: 5820 + rva: 0 + offset: 0 + - ordinal: 5821 + rva: 0 + offset: 0 + - ordinal: 5822 + rva: 0 + offset: 0 + - ordinal: 5823 + rva: 0 + offset: 0 + - ordinal: 5824 + rva: 0 + offset: 0 + - ordinal: 5825 + rva: 0 + offset: 0 + - ordinal: 5826 + rva: 0 + offset: 0 + - ordinal: 5827 + rva: 0 + offset: 0 + - ordinal: 5828 + rva: 0 + offset: 0 + - ordinal: 5829 + rva: 0 + offset: 0 + - ordinal: 5830 + rva: 0 + offset: 0 + - ordinal: 5831 + rva: 0 + offset: 0 + - ordinal: 5832 + rva: 0 + offset: 0 + - ordinal: 5833 + rva: 0 + offset: 0 + - ordinal: 5834 + rva: 0 + offset: 0 + - ordinal: 5835 + rva: 0 + offset: 0 + - ordinal: 5836 + rva: 0 + offset: 0 + - ordinal: 5837 + rva: 0 + offset: 0 + - ordinal: 5838 + rva: 0 + offset: 0 + - ordinal: 5839 + rva: 0 + offset: 0 + - ordinal: 5840 + rva: 0 + offset: 0 + - ordinal: 5841 + rva: 0 + offset: 0 + - ordinal: 5842 + rva: 0 + offset: 0 + - ordinal: 5843 + rva: 0 + offset: 0 + - ordinal: 5844 + rva: 0 + offset: 0 + - ordinal: 5845 + rva: 0 + offset: 0 + - ordinal: 5846 + rva: 0 + offset: 0 + - ordinal: 5847 + rva: 0 + offset: 0 + - ordinal: 5848 + rva: 0 + offset: 0 + - ordinal: 5849 + rva: 0 + offset: 0 + - ordinal: 5850 + rva: 0 + offset: 0 + - ordinal: 5851 + rva: 0 + offset: 0 + - ordinal: 5852 + rva: 0 + offset: 0 + - ordinal: 5853 + rva: 0 + offset: 0 + - ordinal: 5854 + rva: 0 + offset: 0 + - ordinal: 5855 + rva: 0 + offset: 0 + - ordinal: 5856 + rva: 0 + offset: 0 + - ordinal: 5857 + rva: 0 + offset: 0 + - ordinal: 5858 + rva: 0 + offset: 0 + - ordinal: 5859 + rva: 0 + offset: 0 + - ordinal: 5860 + rva: 0 + offset: 0 + - ordinal: 5861 + rva: 0 + offset: 0 + - ordinal: 5862 + rva: 0 + offset: 0 + - ordinal: 5863 + rva: 0 + offset: 0 + - ordinal: 5864 + rva: 0 + offset: 0 + - ordinal: 5865 + rva: 0 + offset: 0 + - ordinal: 5866 + rva: 0 + offset: 0 + - ordinal: 5867 + rva: 0 + offset: 0 + - ordinal: 5868 + rva: 0 + offset: 0 + - ordinal: 5869 + rva: 0 + offset: 0 + - ordinal: 5870 + rva: 0 + offset: 0 + - ordinal: 5871 + rva: 0 + offset: 0 + - ordinal: 5872 + rva: 0 + offset: 0 + - ordinal: 5873 + rva: 0 + offset: 0 + - ordinal: 5874 + rva: 0 + offset: 0 + - ordinal: 5875 + rva: 0 + offset: 0 + - ordinal: 5876 + rva: 0 + offset: 0 + - ordinal: 5877 + rva: 0 + offset: 0 + - ordinal: 5878 + rva: 0 + offset: 0 + - ordinal: 5879 + rva: 0 + offset: 0 + - ordinal: 5880 + rva: 0 + offset: 0 + - ordinal: 5881 + rva: 0 + offset: 0 + - ordinal: 5882 + rva: 0 + offset: 0 + - ordinal: 5883 + rva: 0 + offset: 0 + - ordinal: 5884 + rva: 0 + offset: 0 + - ordinal: 5885 + rva: 0 + offset: 0 + - ordinal: 5886 + rva: 0 + offset: 0 + - ordinal: 5887 + rva: 0 + offset: 0 + - ordinal: 5888 + rva: 0 + offset: 0 + - ordinal: 5889 + rva: 0 + offset: 0 + - ordinal: 5890 + rva: 0 + offset: 0 + - ordinal: 5891 + rva: 0 + offset: 0 + - ordinal: 5892 + rva: 0 + offset: 0 + - ordinal: 5893 + rva: 0 + offset: 0 + - ordinal: 5894 + rva: 0 + offset: 0 + - ordinal: 5895 + rva: 0 + offset: 0 + - ordinal: 5896 + rva: 0 + offset: 0 + - ordinal: 5897 + rva: 0 + offset: 0 + - ordinal: 5898 + rva: 0 + offset: 0 + - ordinal: 5899 + rva: 0 + offset: 0 + - ordinal: 5900 + rva: 0 + offset: 0 + - ordinal: 5901 + rva: 0 + offset: 0 + - ordinal: 5902 + rva: 0 + offset: 0 + - ordinal: 5903 + rva: 0 + offset: 0 + - ordinal: 5904 + rva: 0 + offset: 0 + - ordinal: 5905 + rva: 0 + offset: 0 + - ordinal: 5906 + rva: 0 + offset: 0 + - ordinal: 5907 + rva: 0 + offset: 0 + - ordinal: 5908 + rva: 0 + offset: 0 + - ordinal: 5909 + rva: 0 + offset: 0 + - ordinal: 5910 + rva: 0 + offset: 0 + - ordinal: 5911 + rva: 0 + offset: 0 + - ordinal: 5912 + rva: 0 + offset: 0 + - ordinal: 5913 + rva: 0 + offset: 0 + - ordinal: 5914 + rva: 0 + offset: 0 + - ordinal: 5915 + rva: 0 + offset: 0 + - ordinal: 5916 + rva: 0 + offset: 0 + - ordinal: 5917 + rva: 0 + offset: 0 + - ordinal: 5918 + rva: 0 + offset: 0 + - ordinal: 5919 + rva: 0 + offset: 0 + - ordinal: 5920 + rva: 0 + offset: 0 + - ordinal: 5921 + rva: 0 + offset: 0 + - ordinal: 5922 + rva: 0 + offset: 0 + - ordinal: 5923 + rva: 0 + offset: 0 + - ordinal: 5924 + rva: 0 + offset: 0 + - ordinal: 5925 + rva: 0 + offset: 0 + - ordinal: 5926 + rva: 0 + offset: 0 + - ordinal: 5927 + rva: 0 + offset: 0 + - ordinal: 5928 + rva: 0 + offset: 0 + - ordinal: 5929 + rva: 0 + offset: 0 + - ordinal: 5930 + rva: 0 + offset: 0 + - ordinal: 5931 + rva: 0 + offset: 0 + - ordinal: 5932 + rva: 0 + offset: 0 + - ordinal: 5933 + rva: 0 + offset: 0 + - ordinal: 5934 + rva: 0 + offset: 0 + - ordinal: 5935 + rva: 0 + offset: 0 + - ordinal: 5936 + rva: 0 + offset: 0 + - ordinal: 5937 + rva: 0 + offset: 0 + - ordinal: 5938 + rva: 0 + offset: 0 + - ordinal: 5939 + rva: 0 + offset: 0 + - ordinal: 5940 + rva: 0 + offset: 0 + - ordinal: 5941 + rva: 0 + offset: 0 + - ordinal: 5942 + rva: 0 + offset: 0 + - ordinal: 5943 + rva: 0 + offset: 0 + - ordinal: 5944 + rva: 0 + offset: 0 + - ordinal: 5945 + rva: 0 + offset: 0 + - ordinal: 5946 + rva: 0 + offset: 0 + - ordinal: 5947 + rva: 0 + offset: 0 + - ordinal: 5948 + rva: 0 + offset: 0 + - ordinal: 5949 + rva: 0 + offset: 0 + - ordinal: 5950 + rva: 0 + offset: 0 + - ordinal: 5951 + rva: 0 + offset: 0 + - ordinal: 5952 + rva: 0 + offset: 0 + - ordinal: 5953 + rva: 0 + offset: 0 + - ordinal: 5954 + rva: 0 + offset: 0 + - ordinal: 5955 + rva: 0 + offset: 0 + - ordinal: 5956 + rva: 0 + offset: 0 + - ordinal: 5957 + rva: 0 + offset: 0 + - ordinal: 5958 + rva: 0 + offset: 0 + - ordinal: 5959 + rva: 0 + offset: 0 + - ordinal: 5960 + rva: 0 + offset: 0 + - ordinal: 5961 + rva: 0 + offset: 0 + - ordinal: 5962 + rva: 0 + offset: 0 + - ordinal: 5963 + rva: 0 + offset: 0 + - ordinal: 5964 + rva: 0 + offset: 0 + - ordinal: 5965 + rva: 0 + offset: 0 + - ordinal: 5966 + rva: 0 + offset: 0 + - ordinal: 5967 + rva: 0 + offset: 0 + - ordinal: 5968 + rva: 0 + offset: 0 + - ordinal: 5969 + rva: 0 + offset: 0 + - ordinal: 5970 + rva: 0 + offset: 0 + - ordinal: 5971 + rva: 0 + offset: 0 + - ordinal: 5972 + rva: 0 + offset: 0 + - ordinal: 5973 + rva: 0 + offset: 0 + - ordinal: 5974 + rva: 0 + offset: 0 + - ordinal: 5975 + rva: 0 + offset: 0 + - ordinal: 5976 + rva: 0 + offset: 0 + - ordinal: 5977 + rva: 0 + offset: 0 + - ordinal: 5978 + rva: 0 + offset: 0 + - ordinal: 5979 + rva: 0 + offset: 0 + - ordinal: 5980 + rva: 0 + offset: 0 + - ordinal: 5981 + rva: 0 + offset: 0 + - ordinal: 5982 + rva: 0 + offset: 0 + - ordinal: 5983 + rva: 0 + offset: 0 + - ordinal: 5984 + rva: 0 + offset: 0 + - ordinal: 5985 + rva: 0 + offset: 0 + - ordinal: 5986 + rva: 0 + offset: 0 + - ordinal: 5987 + rva: 0 + offset: 0 + - ordinal: 5988 + rva: 0 + offset: 0 + - ordinal: 5989 + rva: 0 + offset: 0 + - ordinal: 5990 + rva: 0 + offset: 0 + - ordinal: 5991 + rva: 0 + offset: 0 + - ordinal: 5992 + rva: 0 + offset: 0 + - ordinal: 5993 + rva: 0 + offset: 0 + - ordinal: 5994 + rva: 0 + offset: 0 + - ordinal: 5995 + rva: 0 + offset: 0 + - ordinal: 5996 + rva: 0 + offset: 0 + - ordinal: 5997 + rva: 0 + offset: 0 + - ordinal: 5998 + rva: 0 + offset: 0 + - ordinal: 5999 + rva: 0 + offset: 0 + - ordinal: 6000 + rva: 0 + offset: 0 + - ordinal: 6001 + rva: 0 + offset: 0 + - ordinal: 6002 + rva: 0 + offset: 0 + - ordinal: 6003 + rva: 0 + offset: 0 + - ordinal: 6004 + rva: 0 + offset: 0 + - ordinal: 6005 + rva: 0 + offset: 0 + - ordinal: 6006 + rva: 0 + offset: 0 + - ordinal: 6007 + rva: 0 + offset: 0 + - ordinal: 6008 + rva: 0 + offset: 0 + - ordinal: 6009 + rva: 0 + offset: 0 + - ordinal: 6010 + rva: 0 + offset: 0 + - ordinal: 6011 + rva: 0 + offset: 0 + - ordinal: 6012 + rva: 0 + offset: 0 + - ordinal: 6013 + rva: 0 + offset: 0 + - ordinal: 6014 + rva: 0 + offset: 0 + - ordinal: 6015 + rva: 0 + offset: 0 + - ordinal: 6016 + rva: 0 + offset: 0 + - ordinal: 6017 + rva: 0 + offset: 0 + - ordinal: 6018 + rva: 0 + offset: 0 + - ordinal: 6019 + rva: 0 + offset: 0 + - ordinal: 6020 + rva: 0 + offset: 0 + - ordinal: 6021 + rva: 0 + offset: 0 + - ordinal: 6022 + rva: 0 + offset: 0 + - ordinal: 6023 + rva: 0 + offset: 0 + - ordinal: 6024 + rva: 0 + offset: 0 + - ordinal: 6025 + rva: 0 + offset: 0 + - ordinal: 6026 + rva: 0 + offset: 0 + - ordinal: 6027 + rva: 0 + offset: 0 + - ordinal: 6028 + rva: 0 + offset: 0 + - ordinal: 6029 + rva: 0 + offset: 0 + - ordinal: 6030 + rva: 0 + offset: 0 + - ordinal: 6031 + rva: 0 + offset: 0 + - ordinal: 6032 + rva: 0 + offset: 0 + - ordinal: 6033 + rva: 0 + offset: 0 + - ordinal: 6034 + rva: 0 + offset: 0 + - ordinal: 6035 + rva: 0 + offset: 0 + - ordinal: 6036 + rva: 0 + offset: 0 + - ordinal: 6037 + rva: 0 + offset: 0 + - ordinal: 6038 + rva: 0 + offset: 0 + - ordinal: 6039 + rva: 0 + offset: 0 + - ordinal: 6040 + rva: 0 + offset: 0 + - ordinal: 6041 + rva: 0 + offset: 0 + - ordinal: 6042 + rva: 0 + offset: 0 + - ordinal: 6043 + rva: 0 + offset: 0 + - ordinal: 6044 + rva: 0 + offset: 0 + - ordinal: 6045 + rva: 0 + offset: 0 + - ordinal: 6046 + rva: 0 + offset: 0 + - ordinal: 6047 + rva: 0 + offset: 0 + - ordinal: 6048 + rva: 0 + offset: 0 + - ordinal: 6049 + rva: 0 + offset: 0 + - ordinal: 6050 + rva: 0 + offset: 0 + - ordinal: 6051 + rva: 0 + offset: 0 + - ordinal: 6052 + rva: 0 + offset: 0 + - ordinal: 6053 + rva: 0 + offset: 0 + - ordinal: 6054 + rva: 0 + offset: 0 + - ordinal: 6055 + rva: 0 + offset: 0 + - ordinal: 6056 + rva: 0 + offset: 0 + - ordinal: 6057 + rva: 0 + offset: 0 + - ordinal: 6058 + rva: 0 + offset: 0 + - ordinal: 6059 + rva: 0 + offset: 0 + - ordinal: 6060 + rva: 0 + offset: 0 + - ordinal: 6061 + rva: 0 + offset: 0 + - ordinal: 6062 + rva: 0 + offset: 0 + - ordinal: 6063 + rva: 0 + offset: 0 + - ordinal: 6064 + rva: 0 + offset: 0 + - ordinal: 6065 + rva: 0 + offset: 0 + - ordinal: 6066 + rva: 0 + offset: 0 + - ordinal: 6067 + rva: 0 + offset: 0 + - ordinal: 6068 + rva: 0 + offset: 0 + - ordinal: 6069 + rva: 0 + offset: 0 + - ordinal: 6070 + rva: 0 + offset: 0 + - ordinal: 6071 + rva: 0 + offset: 0 + - ordinal: 6072 + rva: 0 + offset: 0 + - ordinal: 6073 + rva: 0 + offset: 0 + - ordinal: 6074 + rva: 0 + offset: 0 + - ordinal: 6075 + rva: 0 + offset: 0 + - ordinal: 6076 + rva: 0 + offset: 0 + - ordinal: 6077 + rva: 0 + offset: 0 + - ordinal: 6078 + rva: 0 + offset: 0 + - ordinal: 6079 + rva: 0 + offset: 0 + - ordinal: 6080 + rva: 0 + offset: 0 + - ordinal: 6081 + rva: 0 + offset: 0 + - ordinal: 6082 + rva: 0 + offset: 0 + - ordinal: 6083 + rva: 0 + offset: 0 + - ordinal: 6084 + rva: 0 + offset: 0 + - ordinal: 6085 + rva: 0 + offset: 0 + - ordinal: 6086 + rva: 0 + offset: 0 + - ordinal: 6087 + rva: 0 + offset: 0 + - ordinal: 6088 + rva: 0 + offset: 0 + - ordinal: 6089 + rva: 0 + offset: 0 + - ordinal: 6090 + rva: 0 + offset: 0 + - ordinal: 6091 + rva: 0 + offset: 0 + - ordinal: 6092 + rva: 0 + offset: 0 + - ordinal: 6093 + rva: 0 + offset: 0 + - ordinal: 6094 + rva: 0 + offset: 0 + - ordinal: 6095 + rva: 0 + offset: 0 + - ordinal: 6096 + rva: 0 + offset: 0 + - ordinal: 6097 + rva: 0 + offset: 0 + - ordinal: 6098 + rva: 0 + offset: 0 + - ordinal: 6099 + rva: 0 + offset: 0 + - ordinal: 6100 + rva: 0 + offset: 0 + - ordinal: 6101 + rva: 0 + offset: 0 + - ordinal: 6102 + rva: 0 + offset: 0 + - ordinal: 6103 + rva: 0 + offset: 0 + - ordinal: 6104 + rva: 0 + offset: 0 + - ordinal: 6105 + rva: 0 + offset: 0 + - ordinal: 6106 + rva: 0 + offset: 0 + - ordinal: 6107 + rva: 0 + offset: 0 + - ordinal: 6108 + rva: 0 + offset: 0 + - ordinal: 6109 + rva: 0 + offset: 0 + - ordinal: 6110 + rva: 0 + offset: 0 + - ordinal: 6111 + rva: 0 + offset: 0 + - ordinal: 6112 + rva: 0 + offset: 0 + - ordinal: 6113 + rva: 0 + offset: 0 + - ordinal: 6114 + rva: 0 + offset: 0 + - ordinal: 6115 + rva: 0 + offset: 0 + - ordinal: 6116 + rva: 0 + offset: 0 + - ordinal: 6117 + rva: 0 + offset: 0 + - ordinal: 6118 + rva: 0 + offset: 0 + - ordinal: 6119 + rva: 0 + offset: 0 + - ordinal: 6120 + rva: 0 + offset: 0 + - ordinal: 6121 + rva: 0 + offset: 0 + - ordinal: 6122 + rva: 0 + offset: 0 + - ordinal: 6123 + rva: 0 + offset: 0 + - ordinal: 6124 + rva: 0 + offset: 0 + - ordinal: 6125 + rva: 0 + offset: 0 + - ordinal: 6126 + rva: 0 + offset: 0 + - ordinal: 6127 + rva: 0 + offset: 0 + - ordinal: 6128 + rva: 0 + offset: 0 + - ordinal: 6129 + rva: 0 + offset: 0 + - ordinal: 6130 + rva: 0 + offset: 0 + - ordinal: 6131 + rva: 0 + offset: 0 + - ordinal: 6132 + rva: 0 + offset: 0 + - ordinal: 6133 + rva: 0 + offset: 0 + - ordinal: 6134 + rva: 0 + offset: 0 + - ordinal: 6135 + rva: 0 + offset: 0 + - ordinal: 6136 + rva: 0 + offset: 0 + - ordinal: 6137 + rva: 0 + offset: 0 + - ordinal: 6138 + rva: 0 + offset: 0 + - ordinal: 6139 + rva: 0 + offset: 0 + - ordinal: 6140 + rva: 0 + offset: 0 + - ordinal: 6141 + rva: 0 + offset: 0 + - ordinal: 6142 + rva: 0 + offset: 0 + - ordinal: 6143 + rva: 0 + offset: 0 + - ordinal: 6144 + rva: 0 + offset: 0 + - ordinal: 6145 + rva: 0 + offset: 0 + - ordinal: 6146 + rva: 0 + offset: 0 + - ordinal: 6147 + rva: 0 + offset: 0 + - ordinal: 6148 + rva: 0 + offset: 0 + - ordinal: 6149 + rva: 0 + offset: 0 + - ordinal: 6150 + rva: 0 + offset: 0 + - ordinal: 6151 + rva: 0 + offset: 0 + - ordinal: 6152 + rva: 0 + offset: 0 + - ordinal: 6153 + rva: 0 + offset: 0 + - ordinal: 6154 + rva: 0 + offset: 0 + - ordinal: 6155 + rva: 0 + offset: 0 + - ordinal: 6156 + rva: 0 + offset: 0 + - ordinal: 6157 + rva: 0 + offset: 0 + - ordinal: 6158 + rva: 0 + offset: 0 + - ordinal: 6159 + rva: 0 + offset: 0 + - ordinal: 6160 + rva: 0 + offset: 0 + - ordinal: 6161 + rva: 0 + offset: 0 + - ordinal: 6162 + rva: 0 + offset: 0 + - ordinal: 6163 + rva: 0 + offset: 0 + - ordinal: 6164 + rva: 0 + offset: 0 + - ordinal: 6165 + rva: 0 + offset: 0 + - ordinal: 6166 + rva: 0 + offset: 0 + - ordinal: 6167 + rva: 0 + offset: 0 + - ordinal: 6168 + rva: 0 + offset: 0 + - ordinal: 6169 + rva: 0 + offset: 0 + - ordinal: 6170 + rva: 0 + offset: 0 + - ordinal: 6171 + rva: 0 + offset: 0 + - ordinal: 6172 + rva: 0 + offset: 0 + - ordinal: 6173 + rva: 0 + offset: 0 + - ordinal: 6174 + rva: 0 + offset: 0 + - ordinal: 6175 + rva: 0 + offset: 0 + - ordinal: 6176 + rva: 0 + offset: 0 + - ordinal: 6177 + rva: 0 + offset: 0 + - ordinal: 6178 + rva: 0 + offset: 0 + - ordinal: 6179 + rva: 0 + offset: 0 + - ordinal: 6180 + rva: 0 + offset: 0 + - ordinal: 6181 + rva: 0 + offset: 0 + - ordinal: 6182 + rva: 0 + offset: 0 + - ordinal: 6183 + rva: 0 + offset: 0 + - ordinal: 6184 + rva: 0 + offset: 0 + - ordinal: 6185 + rva: 0 + offset: 0 + - ordinal: 6186 + rva: 0 + offset: 0 + - ordinal: 6187 + rva: 0 + offset: 0 + - ordinal: 6188 + rva: 0 + offset: 0 + - ordinal: 6189 + rva: 0 + offset: 0 + - ordinal: 6190 + rva: 0 + offset: 0 + - ordinal: 6191 + rva: 0 + offset: 0 + - ordinal: 6192 + rva: 0 + offset: 0 + - ordinal: 6193 + rva: 0 + offset: 0 + - ordinal: 6194 + rva: 0 + offset: 0 + - ordinal: 6195 + rva: 0 + offset: 0 + - ordinal: 6196 + rva: 0 + offset: 0 + - ordinal: 6197 + rva: 0 + offset: 0 + - ordinal: 6198 + rva: 0 + offset: 0 + - ordinal: 6199 + rva: 0 + offset: 0 + - ordinal: 6200 + rva: 0 + offset: 0 + - ordinal: 6201 + rva: 0 + offset: 0 + - ordinal: 6202 + rva: 0 + offset: 0 + - ordinal: 6203 + rva: 0 + offset: 0 + - ordinal: 6204 + rva: 0 + offset: 0 + - ordinal: 6205 + rva: 0 + offset: 0 + - ordinal: 6206 + rva: 0 + offset: 0 + - ordinal: 6207 + rva: 0 + offset: 0 + - ordinal: 6208 + rva: 0 + offset: 0 + - ordinal: 6209 + rva: 0 + offset: 0 + - ordinal: 6210 + rva: 0 + offset: 0 + - ordinal: 6211 + rva: 0 + offset: 0 + - ordinal: 6212 + rva: 0 + offset: 0 + - ordinal: 6213 + rva: 0 + offset: 0 + - ordinal: 6214 + rva: 0 + offset: 0 + - ordinal: 6215 + rva: 0 + offset: 0 + - ordinal: 6216 + rva: 0 + offset: 0 + - ordinal: 6217 + rva: 0 + offset: 0 + - ordinal: 6218 + rva: 0 + offset: 0 + - ordinal: 6219 + rva: 0 + offset: 0 + - ordinal: 6220 + rva: 0 + offset: 0 + - ordinal: 6221 + rva: 0 + offset: 0 + - ordinal: 6222 + rva: 0 + offset: 0 + - ordinal: 6223 + rva: 0 + offset: 0 + - ordinal: 6224 + rva: 0 + offset: 0 + - ordinal: 6225 + rva: 0 + offset: 0 + - ordinal: 6226 + rva: 0 + offset: 0 + - ordinal: 6227 + rva: 0 + offset: 0 + - ordinal: 6228 + rva: 0 + offset: 0 + - ordinal: 6229 + rva: 0 + offset: 0 + - ordinal: 6230 + rva: 0 + offset: 0 + - ordinal: 6231 + rva: 0 + offset: 0 + - ordinal: 6232 + rva: 0 + offset: 0 + - ordinal: 6233 + rva: 0 + offset: 0 + - ordinal: 6234 + rva: 0 + offset: 0 + - ordinal: 6235 + rva: 0 + offset: 0 + - ordinal: 6236 + rva: 0 + offset: 0 + - ordinal: 6237 + rva: 0 + offset: 0 + - ordinal: 6238 + rva: 0 + offset: 0 + - ordinal: 6239 + rva: 0 + offset: 0 + - ordinal: 6240 + rva: 0 + offset: 0 + - ordinal: 6241 + rva: 0 + offset: 0 + - ordinal: 6242 + rva: 0 + offset: 0 + - ordinal: 6243 + rva: 0 + offset: 0 + - ordinal: 6244 + rva: 0 + offset: 0 + - ordinal: 6245 + rva: 0 + offset: 0 + - ordinal: 6246 + rva: 0 + offset: 0 + - ordinal: 6247 + rva: 0 + offset: 0 + - ordinal: 6248 + rva: 0 + offset: 0 + - ordinal: 6249 + rva: 0 + offset: 0 + - ordinal: 6250 + rva: 0 + offset: 0 + - ordinal: 6251 + rva: 0 + offset: 0 + - ordinal: 6252 + rva: 0 + offset: 0 + - ordinal: 6253 + rva: 0 + offset: 0 + - ordinal: 6254 + rva: 0 + offset: 0 + - ordinal: 6255 + rva: 0 + offset: 0 + - ordinal: 6256 + rva: 0 + offset: 0 + - ordinal: 6257 + rva: 0 + offset: 0 + - ordinal: 6258 + rva: 0 + offset: 0 + - ordinal: 6259 + rva: 0 + offset: 0 + - ordinal: 6260 + rva: 0 + offset: 0 + - ordinal: 6261 + rva: 0 + offset: 0 + - ordinal: 6262 + rva: 0 + offset: 0 + - ordinal: 6263 + rva: 0 + offset: 0 + - ordinal: 6264 + rva: 0 + offset: 0 + - ordinal: 6265 + rva: 0 + offset: 0 + - ordinal: 6266 + rva: 0 + offset: 0 + - ordinal: 6267 + rva: 0 + offset: 0 + - ordinal: 6268 + rva: 0 + offset: 0 + - ordinal: 6269 + rva: 0 + offset: 0 + - ordinal: 6270 + rva: 0 + offset: 0 + - ordinal: 6271 + rva: 0 + offset: 0 + - ordinal: 6272 + rva: 0 + offset: 0 + - ordinal: 6273 + rva: 0 + offset: 0 + - ordinal: 6274 + rva: 0 + offset: 0 + - ordinal: 6275 + rva: 0 + offset: 0 + - ordinal: 6276 + rva: 0 + offset: 0 + - ordinal: 6277 + rva: 0 + offset: 0 + - ordinal: 6278 + rva: 0 + offset: 0 + - ordinal: 6279 + rva: 0 + offset: 0 + - ordinal: 6280 + rva: 0 + offset: 0 + - ordinal: 6281 + rva: 0 + offset: 0 + - ordinal: 6282 + rva: 0 + offset: 0 + - ordinal: 6283 + rva: 0 + offset: 0 + - ordinal: 6284 + rva: 0 + offset: 0 + - ordinal: 6285 + rva: 0 + offset: 0 + - ordinal: 6286 + rva: 0 + offset: 0 + - ordinal: 6287 + rva: 0 + offset: 0 + - ordinal: 6288 + rva: 0 + offset: 0 + - ordinal: 6289 + rva: 0 + offset: 0 + - ordinal: 6290 + rva: 0 + offset: 0 + - ordinal: 6291 + rva: 0 + offset: 0 + - ordinal: 6292 + rva: 0 + offset: 0 + - ordinal: 6293 + rva: 0 + offset: 0 + - ordinal: 6294 + rva: 0 + offset: 0 + - ordinal: 6295 + rva: 0 + offset: 0 + - ordinal: 6296 + rva: 0 + offset: 0 + - ordinal: 6297 + rva: 0 + offset: 0 + - ordinal: 6298 + rva: 0 + offset: 0 + - ordinal: 6299 + rva: 0 + offset: 0 + - ordinal: 6300 + rva: 0 + offset: 0 + - ordinal: 6301 + rva: 0 + offset: 0 + - ordinal: 6302 + rva: 0 + offset: 0 + - ordinal: 6303 + rva: 0 + offset: 0 + - ordinal: 6304 + rva: 0 + offset: 0 + - ordinal: 6305 + rva: 0 + offset: 0 + - ordinal: 6306 + rva: 0 + offset: 0 + - ordinal: 6307 + rva: 0 + offset: 0 + - ordinal: 6308 + rva: 0 + offset: 0 + - ordinal: 6309 + rva: 0 + offset: 0 + - ordinal: 6310 + rva: 0 + offset: 0 + - ordinal: 6311 + rva: 0 + offset: 0 + - ordinal: 6312 + rva: 0 + offset: 0 + - ordinal: 6313 + rva: 0 + offset: 0 + - ordinal: 6314 + rva: 0 + offset: 0 + - ordinal: 6315 + rva: 0 + offset: 0 + - ordinal: 6316 + rva: 0 + offset: 0 + - ordinal: 6317 + rva: 0 + offset: 0 + - ordinal: 6318 + rva: 0 + offset: 0 + - ordinal: 6319 + rva: 0 + offset: 0 + - ordinal: 6320 + rva: 0 + offset: 0 + - ordinal: 6321 + rva: 0 + offset: 0 + - ordinal: 6322 + rva: 0 + offset: 0 + - ordinal: 6323 + rva: 0 + offset: 0 + - ordinal: 6324 + rva: 0 + offset: 0 + - ordinal: 6325 + rva: 0 + offset: 0 + - ordinal: 6326 + rva: 0 + offset: 0 + - ordinal: 6327 + rva: 0 + offset: 0 + - ordinal: 6328 + rva: 0 + offset: 0 + - ordinal: 6329 + rva: 0 + offset: 0 + - ordinal: 6330 + rva: 0 + offset: 0 + - ordinal: 6331 + rva: 0 + offset: 0 + - ordinal: 6332 + rva: 0 + offset: 0 + - ordinal: 6333 + rva: 0 + offset: 0 + - ordinal: 6334 + rva: 0 + offset: 0 + - ordinal: 6335 + rva: 0 + offset: 0 + - ordinal: 6336 + rva: 0 + offset: 0 + - ordinal: 6337 + rva: 0 + offset: 0 + - ordinal: 6338 + rva: 0 + offset: 0 + - ordinal: 6339 + rva: 0 + offset: 0 + - ordinal: 6340 + rva: 0 + offset: 0 + - ordinal: 6341 + rva: 0 + offset: 0 + - ordinal: 6342 + rva: 0 + offset: 0 + - ordinal: 6343 + rva: 0 + offset: 0 + - ordinal: 6344 + rva: 0 + offset: 0 + - ordinal: 6345 + rva: 0 + offset: 0 + - ordinal: 6346 + rva: 0 + offset: 0 + - ordinal: 6347 + rva: 0 + offset: 0 + - ordinal: 6348 + rva: 0 + offset: 0 + - ordinal: 6349 + rva: 0 + offset: 0 + - ordinal: 6350 + rva: 0 + offset: 0 + - ordinal: 6351 + rva: 0 + offset: 0 + - ordinal: 6352 + rva: 0 + offset: 0 + - ordinal: 6353 + rva: 0 + offset: 0 + - ordinal: 6354 + rva: 0 + offset: 0 + - ordinal: 6355 + rva: 0 + offset: 0 + - ordinal: 6356 + rva: 0 + offset: 0 + - ordinal: 6357 + rva: 0 + offset: 0 + - ordinal: 6358 + rva: 0 + offset: 0 + - ordinal: 6359 + rva: 0 + offset: 0 + - ordinal: 6360 + rva: 0 + offset: 0 + - ordinal: 6361 + rva: 0 + offset: 0 + - ordinal: 6362 + rva: 0 + offset: 0 + - ordinal: 6363 + rva: 0 + offset: 0 + - ordinal: 6364 + rva: 0 + offset: 0 + - ordinal: 6365 + rva: 0 + offset: 0 + - ordinal: 6366 + rva: 0 + offset: 0 + - ordinal: 6367 + rva: 0 + offset: 0 + - ordinal: 6368 + rva: 0 + offset: 0 + - ordinal: 6369 + rva: 0 + offset: 0 + - ordinal: 6370 + rva: 0 + offset: 0 + - ordinal: 6371 + rva: 0 + offset: 0 + - ordinal: 6372 + rva: 0 + offset: 0 + - ordinal: 6373 + rva: 0 + offset: 0 + - ordinal: 6374 + rva: 0 + offset: 0 + - ordinal: 6375 + rva: 0 + offset: 0 + - ordinal: 6376 + rva: 0 + offset: 0 + - ordinal: 6377 + rva: 0 + offset: 0 + - ordinal: 6378 + rva: 0 + offset: 0 + - ordinal: 6379 + rva: 0 + offset: 0 + - ordinal: 6380 + rva: 0 + offset: 0 + - ordinal: 6381 + rva: 0 + offset: 0 + - ordinal: 6382 + rva: 0 + offset: 0 + - ordinal: 6383 + rva: 0 + offset: 0 + - ordinal: 6384 + rva: 0 + offset: 0 + - ordinal: 6385 + rva: 0 + offset: 0 + - ordinal: 6386 + rva: 0 + offset: 0 + - ordinal: 6387 + rva: 0 + offset: 0 + - ordinal: 6388 + rva: 0 + offset: 0 + - ordinal: 6389 + rva: 0 + offset: 0 + - ordinal: 6390 + rva: 0 + offset: 0 + - ordinal: 6391 + rva: 0 + offset: 0 + - ordinal: 6392 + rva: 0 + offset: 0 + - ordinal: 6393 + rva: 0 + offset: 0 + - ordinal: 6394 + rva: 0 + offset: 0 + - ordinal: 6395 + rva: 0 + offset: 0 + - ordinal: 6396 + rva: 0 + offset: 0 + - ordinal: 6397 + rva: 0 + offset: 0 + - ordinal: 6398 + rva: 0 + offset: 0 + - ordinal: 6399 + rva: 0 + offset: 0 + - ordinal: 6400 + rva: 0 + offset: 0 + - ordinal: 6401 + rva: 0 + offset: 0 + - ordinal: 6402 + rva: 0 + offset: 0 + - ordinal: 6403 + rva: 0 + offset: 0 + - ordinal: 6404 + rva: 0 + offset: 0 + - ordinal: 6405 + rva: 0 + offset: 0 + - ordinal: 6406 + rva: 0 + offset: 0 + - ordinal: 6407 + rva: 0 + offset: 0 + - ordinal: 6408 + rva: 0 + offset: 0 + - ordinal: 6409 + rva: 0 + offset: 0 + - ordinal: 6410 + rva: 0 + offset: 0 + - ordinal: 6411 + rva: 0 + offset: 0 + - ordinal: 6412 + rva: 0 + offset: 0 + - ordinal: 6413 + rva: 0 + offset: 0 + - ordinal: 6414 + rva: 0 + offset: 0 + - ordinal: 6415 + rva: 0 + offset: 0 + - ordinal: 6416 + rva: 0 + offset: 0 + - ordinal: 6417 + rva: 0 + offset: 0 + - ordinal: 6418 + rva: 0 + offset: 0 + - ordinal: 6419 + rva: 0 + offset: 0 + - ordinal: 6420 + rva: 0 + offset: 0 + - ordinal: 6421 + rva: 0 + offset: 0 + - ordinal: 6422 + rva: 0 + offset: 0 + - ordinal: 6423 + rva: 0 + offset: 0 + - ordinal: 6424 + rva: 0 + offset: 0 + - ordinal: 6425 + rva: 0 + offset: 0 + - ordinal: 6426 + rva: 0 + offset: 0 + - ordinal: 6427 + rva: 0 + offset: 0 + - ordinal: 6428 + rva: 0 + offset: 0 + - ordinal: 6429 + rva: 0 + offset: 0 + - ordinal: 6430 + rva: 0 + offset: 0 + - ordinal: 6431 + rva: 0 + offset: 0 + - ordinal: 6432 + rva: 0 + offset: 0 + - ordinal: 6433 + rva: 0 + offset: 0 + - ordinal: 6434 + rva: 0 + offset: 0 + - ordinal: 6435 + rva: 0 + offset: 0 + - ordinal: 6436 + rva: 0 + offset: 0 + - ordinal: 6437 + rva: 0 + offset: 0 + - ordinal: 6438 + rva: 0 + offset: 0 + - ordinal: 6439 + rva: 0 + offset: 0 + - ordinal: 6440 + rva: 0 + offset: 0 + - ordinal: 6441 + rva: 0 + offset: 0 + - ordinal: 6442 + rva: 0 + offset: 0 + - ordinal: 6443 + rva: 0 + offset: 0 + - ordinal: 6444 + rva: 0 + offset: 0 + - ordinal: 6445 + rva: 0 + offset: 0 + - ordinal: 6446 + rva: 0 + offset: 0 + - ordinal: 6447 + rva: 0 + offset: 0 + - ordinal: 6448 + rva: 0 + offset: 0 + - ordinal: 6449 + rva: 0 + offset: 0 + - ordinal: 6450 + rva: 0 + offset: 0 + - ordinal: 6451 + rva: 0 + offset: 0 + - ordinal: 6452 + rva: 0 + offset: 0 + - ordinal: 6453 + rva: 0 + offset: 0 + - ordinal: 6454 + rva: 0 + offset: 0 + - ordinal: 6455 + rva: 0 + offset: 0 + - ordinal: 6456 + rva: 0 + offset: 0 + - ordinal: 6457 + rva: 0 + offset: 0 + - ordinal: 6458 + rva: 0 + offset: 0 + - ordinal: 6459 + rva: 0 + offset: 0 + - ordinal: 6460 + rva: 0 + offset: 0 + - ordinal: 6461 + rva: 0 + offset: 0 + - ordinal: 6462 + rva: 0 + offset: 0 + - ordinal: 6463 + rva: 0 + offset: 0 + - ordinal: 6464 + rva: 0 + offset: 0 + - ordinal: 6465 + rva: 0 + offset: 0 + - ordinal: 6466 + rva: 0 + offset: 0 + - ordinal: 6467 + rva: 0 + offset: 0 + - ordinal: 6468 + rva: 0 + offset: 0 + - ordinal: 6469 + rva: 0 + offset: 0 + - ordinal: 6470 + rva: 0 + offset: 0 + - ordinal: 6471 + rva: 0 + offset: 0 + - ordinal: 6472 + rva: 0 + offset: 0 + - ordinal: 6473 + rva: 0 + offset: 0 + - ordinal: 6474 + rva: 0 + offset: 0 + - ordinal: 6475 + rva: 0 + offset: 0 + - ordinal: 6476 + rva: 0 + offset: 0 + - ordinal: 6477 + rva: 0 + offset: 0 + - ordinal: 6478 + rva: 0 + offset: 0 + - ordinal: 6479 + rva: 0 + offset: 0 + - ordinal: 6480 + rva: 0 + offset: 0 + - ordinal: 6481 + rva: 0 + offset: 0 + - ordinal: 6482 + rva: 0 + offset: 0 + - ordinal: 6483 + rva: 0 + offset: 0 + - ordinal: 6484 + rva: 0 + offset: 0 + - ordinal: 6485 + rva: 0 + offset: 0 + - ordinal: 6486 + rva: 0 + offset: 0 + - ordinal: 6487 + rva: 0 + offset: 0 + - ordinal: 6488 + rva: 0 + offset: 0 + - ordinal: 6489 + rva: 0 + offset: 0 + - ordinal: 6490 + rva: 0 + offset: 0 + - ordinal: 6491 + rva: 0 + offset: 0 + - ordinal: 6492 + rva: 0 + offset: 0 + - ordinal: 6493 + rva: 0 + offset: 0 + - ordinal: 6494 + rva: 0 + offset: 0 + - ordinal: 6495 + rva: 0 + offset: 0 + - ordinal: 6496 + rva: 0 + offset: 0 + - ordinal: 6497 + rva: 0 + offset: 0 + - ordinal: 6498 + rva: 0 + offset: 0 + - ordinal: 6499 + rva: 0 + offset: 0 + - ordinal: 6500 + rva: 0 + offset: 0 + - ordinal: 6501 + rva: 0 + offset: 0 + - ordinal: 6502 + rva: 0 + offset: 0 + - ordinal: 6503 + rva: 0 + offset: 0 + - ordinal: 6504 + rva: 0 + offset: 0 + - ordinal: 6505 + rva: 0 + offset: 0 + - ordinal: 6506 + rva: 0 + offset: 0 + - ordinal: 6507 + rva: 0 + offset: 0 + - ordinal: 6508 + rva: 0 + offset: 0 + - ordinal: 6509 + rva: 0 + offset: 0 + - ordinal: 6510 + rva: 0 + offset: 0 + - ordinal: 6511 + rva: 0 + offset: 0 + - ordinal: 6512 + rva: 0 + offset: 0 + - ordinal: 6513 + rva: 0 + offset: 0 + - ordinal: 6514 + rva: 0 + offset: 0 + - ordinal: 6515 + rva: 0 + offset: 0 + - ordinal: 6516 + rva: 0 + offset: 0 + - ordinal: 6517 + rva: 0 + offset: 0 + - ordinal: 6518 + rva: 0 + offset: 0 + - ordinal: 6519 + rva: 0 + offset: 0 + - ordinal: 6520 + rva: 0 + offset: 0 + - ordinal: 6521 + rva: 0 + offset: 0 + - ordinal: 6522 + rva: 0 + offset: 0 + - ordinal: 6523 + rva: 0 + offset: 0 + - ordinal: 6524 + rva: 0 + offset: 0 + - ordinal: 6525 + rva: 0 + offset: 0 + - ordinal: 6526 + rva: 0 + offset: 0 + - ordinal: 6527 + rva: 0 + offset: 0 + - ordinal: 6528 + rva: 0 + offset: 0 + - ordinal: 6529 + rva: 0 + offset: 0 + - ordinal: 6530 + rva: 0 + offset: 0 + - ordinal: 6531 + rva: 0 + offset: 0 + - ordinal: 6532 + rva: 0 + offset: 0 + - ordinal: 6533 + rva: 0 + offset: 0 + - ordinal: 6534 + rva: 0 + offset: 0 + - ordinal: 6535 + rva: 0 + offset: 0 + - ordinal: 6536 + rva: 0 + offset: 0 + - ordinal: 6537 + rva: 0 + offset: 0 + - ordinal: 6538 + rva: 0 + offset: 0 + - ordinal: 6539 + rva: 0 + offset: 0 + - ordinal: 6540 + rva: 0 + offset: 0 + - ordinal: 6541 + rva: 0 + offset: 0 + - ordinal: 6542 + rva: 0 + offset: 0 + - ordinal: 6543 + rva: 0 + offset: 0 + - ordinal: 6544 + rva: 0 + offset: 0 + - ordinal: 6545 + rva: 0 + offset: 0 + - ordinal: 6546 + rva: 0 + offset: 0 + - ordinal: 6547 + rva: 0 + offset: 0 + - ordinal: 6548 + rva: 0 + offset: 0 + - ordinal: 6549 + rva: 0 + offset: 0 + - ordinal: 6550 + rva: 0 + offset: 0 + - ordinal: 6551 + rva: 0 + offset: 0 + - ordinal: 6552 + rva: 0 + offset: 0 + - ordinal: 6553 + rva: 0 + offset: 0 + - ordinal: 6554 + rva: 0 + offset: 0 + - ordinal: 6555 + rva: 0 + offset: 0 + - ordinal: 6556 + rva: 0 + offset: 0 + - ordinal: 6557 + rva: 0 + offset: 0 + - ordinal: 6558 + rva: 0 + offset: 0 + - ordinal: 6559 + rva: 0 + offset: 0 + - ordinal: 6560 + rva: 0 + offset: 0 + - ordinal: 6561 + rva: 0 + offset: 0 + - ordinal: 6562 + rva: 0 + offset: 0 + - ordinal: 6563 + rva: 0 + offset: 0 + - ordinal: 6564 + rva: 0 + offset: 0 + - ordinal: 6565 + rva: 0 + offset: 0 + - ordinal: 6566 + rva: 0 + offset: 0 + - ordinal: 6567 + rva: 0 + offset: 0 + - ordinal: 6568 + rva: 0 + offset: 0 + - ordinal: 6569 + rva: 0 + offset: 0 + - ordinal: 6570 + rva: 0 + offset: 0 + - ordinal: 6571 + rva: 0 + offset: 0 + - ordinal: 6572 + rva: 0 + offset: 0 + - ordinal: 6573 + rva: 0 + offset: 0 + - ordinal: 6574 + rva: 0 + offset: 0 + - ordinal: 6575 + rva: 0 + offset: 0 + - ordinal: 6576 + rva: 0 + offset: 0 + - ordinal: 6577 + rva: 0 + offset: 0 + - ordinal: 6578 + rva: 0 + offset: 0 + - ordinal: 6579 + rva: 0 + offset: 0 + - ordinal: 6580 + rva: 0 + offset: 0 + - ordinal: 6581 + rva: 0 + offset: 0 + - ordinal: 6582 + rva: 0 + offset: 0 + - ordinal: 6583 + rva: 0 + offset: 0 + - ordinal: 6584 + rva: 0 + offset: 0 + - ordinal: 6585 + rva: 0 + offset: 0 + - ordinal: 6586 + rva: 0 + offset: 0 + - ordinal: 6587 + rva: 0 + offset: 0 + - ordinal: 6588 + rva: 0 + offset: 0 + - ordinal: 6589 + rva: 0 + offset: 0 + - ordinal: 6590 + rva: 0 + offset: 0 + - ordinal: 6591 + rva: 0 + offset: 0 + - ordinal: 6592 + rva: 0 + offset: 0 + - ordinal: 6593 + rva: 0 + offset: 0 + - ordinal: 6594 + rva: 0 + offset: 0 + - ordinal: 6595 + rva: 0 + offset: 0 + - ordinal: 6596 + rva: 0 + offset: 0 + - ordinal: 6597 + rva: 0 + offset: 0 + - ordinal: 6598 + rva: 0 + offset: 0 + - ordinal: 6599 + rva: 0 + offset: 0 + - ordinal: 6600 + rva: 0 + offset: 0 + - ordinal: 6601 + rva: 0 + offset: 0 + - ordinal: 6602 + rva: 0 + offset: 0 + - ordinal: 6603 + rva: 0 + offset: 0 + - ordinal: 6604 + rva: 0 + offset: 0 + - ordinal: 6605 + rva: 0 + offset: 0 + - ordinal: 6606 + rva: 0 + offset: 0 + - ordinal: 6607 + rva: 0 + offset: 0 + - ordinal: 6608 + rva: 0 + offset: 0 + - ordinal: 6609 + rva: 0 + offset: 0 + - ordinal: 6610 + rva: 0 + offset: 0 + - ordinal: 6611 + rva: 0 + offset: 0 + - ordinal: 6612 + rva: 0 + offset: 0 + - ordinal: 6613 + rva: 0 + offset: 0 + - ordinal: 6614 + rva: 0 + offset: 0 + - ordinal: 6615 + rva: 0 + offset: 0 + - ordinal: 6616 + rva: 0 + offset: 0 + - ordinal: 6617 + rva: 0 + offset: 0 + - ordinal: 6618 + rva: 0 + offset: 0 + - ordinal: 6619 + rva: 0 + offset: 0 + - ordinal: 6620 + rva: 0 + offset: 0 + - ordinal: 6621 + rva: 0 + offset: 0 + - ordinal: 6622 + rva: 0 + offset: 0 + - ordinal: 6623 + rva: 0 + offset: 0 + - ordinal: 6624 + rva: 0 + offset: 0 + - ordinal: 6625 + rva: 0 + offset: 0 + - ordinal: 6626 + rva: 0 + offset: 0 + - ordinal: 6627 + rva: 0 + offset: 0 + - ordinal: 6628 + rva: 0 + offset: 0 + - ordinal: 6629 + rva: 0 + offset: 0 + - ordinal: 6630 + rva: 0 + offset: 0 + - ordinal: 6631 + rva: 0 + offset: 0 + - ordinal: 6632 + rva: 0 + offset: 0 + - ordinal: 6633 + rva: 0 + offset: 0 + - ordinal: 6634 + rva: 0 + offset: 0 + - ordinal: 6635 + rva: 0 + offset: 0 + - ordinal: 6636 + rva: 0 + offset: 0 + - ordinal: 6637 + rva: 0 + offset: 0 + - ordinal: 6638 + rva: 0 + offset: 0 + - ordinal: 6639 + rva: 0 + offset: 0 + - ordinal: 6640 + rva: 0 + offset: 0 + - ordinal: 6641 + rva: 0 + offset: 0 + - ordinal: 6642 + rva: 0 + offset: 0 + - ordinal: 6643 + rva: 0 + offset: 0 + - ordinal: 6644 + rva: 0 + offset: 0 + - ordinal: 6645 + rva: 0 + offset: 0 + - ordinal: 6646 + rva: 0 + offset: 0 + - ordinal: 6647 + rva: 0 + offset: 0 + - ordinal: 6648 + rva: 0 + offset: 0 + - ordinal: 6649 + rva: 0 + offset: 0 + - ordinal: 6650 + rva: 0 + offset: 0 + - ordinal: 6651 + rva: 0 + offset: 0 + - ordinal: 6652 + rva: 0 + offset: 0 + - ordinal: 6653 + rva: 0 + offset: 0 + - ordinal: 6654 + rva: 0 + offset: 0 + - ordinal: 6655 + rva: 0 + offset: 0 + - ordinal: 6656 + rva: 0 + offset: 0 + - ordinal: 6657 + rva: 0 + offset: 0 + - ordinal: 6658 + rva: 0 + offset: 0 + - ordinal: 6659 + rva: 0 + offset: 0 + - ordinal: 6660 + rva: 0 + offset: 0 + - ordinal: 6661 + rva: 0 + offset: 0 + - ordinal: 6662 + rva: 0 + offset: 0 + - ordinal: 6663 + rva: 0 + offset: 0 + - ordinal: 6664 + rva: 0 + offset: 0 + - ordinal: 6665 + rva: 0 + offset: 0 + - ordinal: 6666 + rva: 0 + offset: 0 + - ordinal: 6667 + rva: 0 + offset: 0 + - ordinal: 6668 + rva: 0 + offset: 0 + - ordinal: 6669 + rva: 0 + offset: 0 + - ordinal: 6670 + rva: 0 + offset: 0 + - ordinal: 6671 + rva: 0 + offset: 0 + - ordinal: 6672 + rva: 0 + offset: 0 + - ordinal: 6673 + rva: 0 + offset: 0 + - ordinal: 6674 + rva: 0 + offset: 0 + - ordinal: 6675 + rva: 0 + offset: 0 + - ordinal: 6676 + rva: 0 + offset: 0 + - ordinal: 6677 + rva: 0 + offset: 0 + - ordinal: 6678 + rva: 0 + offset: 0 + - ordinal: 6679 + rva: 0 + offset: 0 + - ordinal: 6680 + rva: 12128 + offset: 9056 + - ordinal: 6681 + rva: 11376 + offset: 8304 + - ordinal: 6682 + rva: 14752 + offset: 11680 + - ordinal: 6683 + rva: 14624 + offset: 11552 + - ordinal: 6684 + rva: 14432 + offset: 11360 + - ordinal: 6685 + rva: 14304 + offset: 11232 + - ordinal: 6686 + rva: 14176 + offset: 11104 + - ordinal: 6687 + rva: 14048 + offset: 10976 + - ordinal: 6688 + rva: 13920 + offset: 10848 + - ordinal: 6689 + rva: 13792 + offset: 10720 + - ordinal: 6690 + rva: 13664 + offset: 10592 + - ordinal: 6691 + rva: 13536 + offset: 10464 + - ordinal: 6692 + rva: 13408 + offset: 10336 + - ordinal: 6693 + rva: 13248 + offset: 10176 + - ordinal: 6694 + rva: 13088 + offset: 10016 + - ordinal: 6695 + rva: 12864 + offset: 9792 + - ordinal: 6696 + rva: 12736 + offset: 9664 + - ordinal: 6697 + rva: 12608 + offset: 9536 + - ordinal: 6698 + rva: 11664 + offset: 8592 + - ordinal: 6699 + rva: 11072 + offset: 8000 + - ordinal: 6700 + rva: 0 + offset: 0 + - ordinal: 6701 + rva: 0 + offset: 0 + - ordinal: 6702 + rva: 0 + offset: 0 + - ordinal: 6703 + rva: 0 + offset: 0 + - ordinal: 6704 + rva: 0 + offset: 0 + - ordinal: 6705 + rva: 0 + offset: 0 + - ordinal: 6706 + rva: 0 + offset: 0 + - ordinal: 6707 + rva: 0 + offset: 0 + - ordinal: 6708 + rva: 0 + offset: 0 + - ordinal: 6709 + rva: 0 + offset: 0 + - ordinal: 6710 + rva: 0 + offset: 0 + - ordinal: 6711 + rva: 0 + offset: 0 + - ordinal: 6712 + rva: 0 + offset: 0 + - ordinal: 6713 + rva: 0 + offset: 0 + - ordinal: 6714 + rva: 0 + offset: 0 + - ordinal: 6715 + rva: 0 + offset: 0 + - ordinal: 6716 + rva: 0 + offset: 0 + - ordinal: 6717 + rva: 0 + offset: 0 + - ordinal: 6718 + rva: 0 + offset: 0 + - ordinal: 6719 + rva: 0 + offset: 0 + - ordinal: 6720 + rva: 0 + offset: 0 + - ordinal: 6721 + rva: 0 + offset: 0 + - ordinal: 6722 + rva: 0 + offset: 0 + - ordinal: 6723 + rva: 0 + offset: 0 + - ordinal: 6724 + rva: 0 + offset: 0 + - ordinal: 6725 + rva: 0 + offset: 0 + - ordinal: 6726 + rva: 0 + offset: 0 + - ordinal: 6727 + rva: 0 + offset: 0 + - ordinal: 6728 + rva: 0 + offset: 0 + - ordinal: 6729 + rva: 0 + offset: 0 + - ordinal: 6730 + rva: 0 + offset: 0 + - ordinal: 6731 + rva: 0 + offset: 0 + - ordinal: 6732 + rva: 0 + offset: 0 + - ordinal: 6733 + rva: 0 + offset: 0 + - ordinal: 6734 + rva: 0 + offset: 0 + - ordinal: 6735 + rva: 0 + offset: 0 + - ordinal: 6736 + rva: 0 + offset: 0 + - ordinal: 6737 + rva: 0 + offset: 0 + - ordinal: 6738 + rva: 0 + offset: 0 + - ordinal: 6739 + rva: 0 + offset: 0 + - ordinal: 6740 + rva: 0 + offset: 0 + - ordinal: 6741 + rva: 0 + offset: 0 + - ordinal: 6742 + rva: 0 + offset: 0 + - ordinal: 6743 + rva: 0 + offset: 0 + - ordinal: 6744 + rva: 0 + offset: 0 + - ordinal: 6745 + rva: 0 + offset: 0 + - ordinal: 6746 + rva: 0 + offset: 0 + - ordinal: 6747 + rva: 0 + offset: 0 + - ordinal: 6748 + rva: 0 + offset: 0 + - ordinal: 6749 + rva: 0 + offset: 0 + - ordinal: 6750 + rva: 0 + offset: 0 + - ordinal: 6751 + rva: 0 + offset: 0 + - ordinal: 6752 + rva: 0 + offset: 0 + - ordinal: 6753 + rva: 0 + offset: 0 + - ordinal: 6754 + rva: 0 + offset: 0 + - ordinal: 6755 + rva: 0 + offset: 0 + - ordinal: 6756 + rva: 0 + offset: 0 + - ordinal: 6757 + rva: 0 + offset: 0 + - ordinal: 6758 + rva: 0 + offset: 0 + - ordinal: 6759 + rva: 0 + offset: 0 + - ordinal: 6760 + rva: 0 + offset: 0 + - ordinal: 6761 + rva: 0 + offset: 0 + - ordinal: 6762 + rva: 0 + offset: 0 + - ordinal: 6763 + rva: 0 + offset: 0 + - ordinal: 6764 + rva: 0 + offset: 0 + - ordinal: 6765 + rva: 0 + offset: 0 + - ordinal: 6766 + rva: 0 + offset: 0 + - ordinal: 6767 + rva: 0 + offset: 0 + - ordinal: 6768 + rva: 0 + offset: 0 + - ordinal: 6769 + rva: 0 + offset: 0 + - ordinal: 6770 + rva: 0 + offset: 0 + - ordinal: 6771 + rva: 0 + offset: 0 + - ordinal: 6772 + rva: 0 + offset: 0 + - ordinal: 6773 + rva: 0 + offset: 0 + - ordinal: 6774 + rva: 0 + offset: 0 + - ordinal: 6775 + rva: 0 + offset: 0 + - ordinal: 6776 + rva: 0 + offset: 0 + - ordinal: 6777 + rva: 0 + offset: 0 + - ordinal: 6778 + rva: 0 + offset: 0 + - ordinal: 6779 + rva: 0 + offset: 0 + - ordinal: 6780 + rva: 0 + offset: 0 + - ordinal: 6781 + rva: 0 + offset: 0 + - ordinal: 6782 + rva: 16368 + offset: 13296 + - ordinal: 6783 + rva: 16848 + offset: 13776 + - ordinal: 6784 + rva: 17584 + offset: 14512 + - ordinal: 6785 + rva: 17392 + offset: 14320 + - ordinal: 6786 + rva: 17264 + offset: 14192 + - ordinal: 6787 + rva: 17136 + offset: 14064 + - ordinal: 6788 + rva: 13920 + offset: 10848 + - ordinal: 6789 + rva: 13792 + offset: 10720 + - ordinal: 6790 + rva: 13664 + offset: 10592 + - ordinal: 6791 + rva: 13536 + offset: 10464 + - ordinal: 6792 + rva: 13408 + offset: 10336 + - ordinal: 6793 + rva: 13248 + offset: 10176 + - ordinal: 6794 + rva: 13088 + offset: 10016 + - ordinal: 6795 + rva: 12864 + offset: 9792 + - ordinal: 6796 + rva: 12736 + offset: 9664 + - ordinal: 6797 + rva: 12608 + offset: 9536 + - ordinal: 6798 + rva: 15904 + offset: 12832 + - ordinal: 6799 + rva: 15600 + offset: 12528 + - ordinal: 6800 + rva: 0 + offset: 0 + - ordinal: 6801 + rva: 0 + offset: 0 + - ordinal: 6802 + rva: 0 + offset: 0 + - ordinal: 6803 + rva: 0 + offset: 0 + - ordinal: 6804 + rva: 0 + offset: 0 + - ordinal: 6805 + rva: 0 + offset: 0 + - ordinal: 6806 + rva: 0 + offset: 0 + - ordinal: 6807 + rva: 0 + offset: 0 + - ordinal: 6808 + rva: 0 + offset: 0 + - ordinal: 6809 + rva: 0 + offset: 0 + - ordinal: 6810 + rva: 0 + offset: 0 + - ordinal: 6811 + rva: 0 + offset: 0 + - ordinal: 6812 + rva: 0 + offset: 0 + - ordinal: 6813 + rva: 0 + offset: 0 + - ordinal: 6814 + rva: 0 + offset: 0 + - ordinal: 6815 + rva: 0 + offset: 0 + - ordinal: 6816 + rva: 0 + offset: 0 + - ordinal: 6817 + rva: 0 + offset: 0 + - ordinal: 6818 + rva: 0 + offset: 0 + - ordinal: 6819 + rva: 0 + offset: 0 + - ordinal: 6820 + rva: 0 + offset: 0 + - ordinal: 6821 + rva: 0 + offset: 0 + - ordinal: 6822 + rva: 0 + offset: 0 + - ordinal: 6823 + rva: 0 + offset: 0 + - ordinal: 6824 + rva: 0 + offset: 0 + - ordinal: 6825 + rva: 0 + offset: 0 + - ordinal: 6826 + rva: 0 + offset: 0 + - ordinal: 6827 + rva: 0 + offset: 0 + - ordinal: 6828 + rva: 0 + offset: 0 + - ordinal: 6829 + rva: 0 + offset: 0 + - ordinal: 6830 + rva: 0 + offset: 0 + - ordinal: 6831 + rva: 0 + offset: 0 + - ordinal: 6832 + rva: 0 + offset: 0 + - ordinal: 6833 + rva: 0 + offset: 0 + - ordinal: 6834 + rva: 0 + offset: 0 + - ordinal: 6835 + rva: 0 + offset: 0 + - ordinal: 6836 + rva: 0 + offset: 0 + - ordinal: 6837 + rva: 0 + offset: 0 + - ordinal: 6838 + rva: 0 + offset: 0 + - ordinal: 6839 + rva: 0 + offset: 0 + - ordinal: 6840 + rva: 0 + offset: 0 + - ordinal: 6841 + rva: 0 + offset: 0 + - ordinal: 6842 + rva: 0 + offset: 0 + - ordinal: 6843 + rva: 0 + offset: 0 + - ordinal: 6844 + rva: 0 + offset: 0 + - ordinal: 6845 + rva: 0 + offset: 0 + - ordinal: 6846 + rva: 0 + offset: 0 + - ordinal: 6847 + rva: 0 + offset: 0 + - ordinal: 6848 + rva: 0 + offset: 0 + - ordinal: 6849 + rva: 0 + offset: 0 + - ordinal: 6850 + rva: 0 + offset: 0 + - ordinal: 6851 + rva: 0 + offset: 0 + - ordinal: 6852 + rva: 0 + offset: 0 + - ordinal: 6853 + rva: 0 + offset: 0 + - ordinal: 6854 + rva: 0 + offset: 0 + - ordinal: 6855 + rva: 0 + offset: 0 + - ordinal: 6856 + rva: 0 + offset: 0 + - ordinal: 6857 + rva: 0 + offset: 0 + - ordinal: 6858 + rva: 0 + offset: 0 + - ordinal: 6859 + rva: 0 + offset: 0 + - ordinal: 6860 + rva: 0 + offset: 0 + - ordinal: 6861 + rva: 0 + offset: 0 + - ordinal: 6862 + rva: 0 + offset: 0 + - ordinal: 6863 + rva: 0 + offset: 0 + - ordinal: 6864 + rva: 0 + offset: 0 + - ordinal: 6865 + rva: 0 + offset: 0 + - ordinal: 6866 + rva: 0 + offset: 0 + - ordinal: 6867 + rva: 0 + offset: 0 + - ordinal: 6868 + rva: 0 + offset: 0 + - ordinal: 6869 + rva: 0 + offset: 0 + - ordinal: 6870 + rva: 0 + offset: 0 + - ordinal: 6871 + rva: 0 + offset: 0 + - ordinal: 6872 + rva: 0 + offset: 0 + - ordinal: 6873 + rva: 0 + offset: 0 + - ordinal: 6874 + rva: 0 + offset: 0 + - ordinal: 6875 + rva: 0 + offset: 0 + - ordinal: 6876 + rva: 0 + offset: 0 + - ordinal: 6877 + rva: 0 + offset: 0 + - ordinal: 6878 + rva: 0 + offset: 0 + - ordinal: 6879 + rva: 0 + offset: 0 + - ordinal: 6880 + rva: 0 + offset: 0 + - ordinal: 6881 + rva: 0 + offset: 0 + - ordinal: 6882 + rva: 0 + offset: 0 + - ordinal: 6883 + rva: 0 + offset: 0 + - ordinal: 6884 + rva: 14432 + offset: 11360 + - ordinal: 6885 + rva: 14304 + offset: 11232 + - ordinal: 6886 + rva: 14176 + offset: 11104 + - ordinal: 6887 + rva: 14048 + offset: 10976 + - ordinal: 6888 + rva: 13920 + offset: 10848 + - ordinal: 6889 + rva: 13792 + offset: 10720 + - ordinal: 6890 + rva: 13664 + offset: 10592 + - ordinal: 6891 + rva: 13536 + offset: 10464 + - ordinal: 6892 + rva: 13408 + offset: 10336 + - ordinal: 6893 + rva: 13248 + offset: 10176 + - ordinal: 6894 + rva: 13088 + offset: 10016 + - ordinal: 6895 + rva: 19120 + offset: 16048 + - ordinal: 6896 + rva: 12736 + offset: 9664 + - ordinal: 6897 + rva: 12608 + offset: 9536 + - ordinal: 6898 + rva: 20752 + offset: 17680 + - ordinal: 6899 + rva: 20448 + offset: 17376 + - ordinal: 6900 + rva: 0 + offset: 0 + - ordinal: 6901 + rva: 0 + offset: 0 + - ordinal: 6902 + rva: 0 + offset: 0 + - ordinal: 6903 + rva: 0 + offset: 0 + - ordinal: 6904 + rva: 0 + offset: 0 + - ordinal: 6905 + rva: 0 + offset: 0 + - ordinal: 6906 + rva: 0 + offset: 0 + - ordinal: 6907 + rva: 0 + offset: 0 + - ordinal: 6908 + rva: 0 + offset: 0 + - ordinal: 6909 + rva: 0 + offset: 0 + - ordinal: 6910 + rva: 0 + offset: 0 + - ordinal: 6911 + rva: 0 + offset: 0 + - ordinal: 6912 + rva: 0 + offset: 0 + - ordinal: 6913 + rva: 0 + offset: 0 + - ordinal: 6914 + rva: 0 + offset: 0 + - ordinal: 6915 + rva: 0 + offset: 0 + - ordinal: 6916 + rva: 0 + offset: 0 + - ordinal: 6917 + rva: 0 + offset: 0 + - ordinal: 6918 + rva: 0 + offset: 0 + - ordinal: 6919 + rva: 0 + offset: 0 + - ordinal: 6920 + rva: 0 + offset: 0 + - ordinal: 6921 + rva: 0 + offset: 0 + - ordinal: 6922 + rva: 0 + offset: 0 + - ordinal: 6923 + rva: 0 + offset: 0 + - ordinal: 6924 + rva: 0 + offset: 0 + - ordinal: 6925 + rva: 0 + offset: 0 + - ordinal: 6926 + rva: 0 + offset: 0 + - ordinal: 6927 + rva: 0 + offset: 0 + - ordinal: 6928 + rva: 0 + offset: 0 + - ordinal: 6929 + rva: 0 + offset: 0 + - ordinal: 6930 + rva: 0 + offset: 0 + - ordinal: 6931 + rva: 0 + offset: 0 + - ordinal: 6932 + rva: 11056 + offset: 7984 + - ordinal: 6933 + rva: 5024 + offset: 1952 + - ordinal: 6934 + rva: 6336 + offset: 3264 + - ordinal: 6935 + rva: 6208 + offset: 3136 + - ordinal: 6936 + rva: 7232 + offset: 4160 + - ordinal: 6937 + rva: 7104 + offset: 4032 + - ordinal: 6938 + rva: 6976 + offset: 3904 + - ordinal: 6939 + rva: 6848 + offset: 3776 + - ordinal: 6940 + rva: 6720 + offset: 3648 + - ordinal: 6941 + rva: 5824 + offset: 2752 + - ordinal: 6942 + rva: 8096 + offset: 5024 + - ordinal: 6943 + rva: 7968 + offset: 4896 + - ordinal: 6944 + rva: 7840 + offset: 4768 + - ordinal: 6945 + rva: 7488 + offset: 4416 + - ordinal: 6946 + rva: 7360 + offset: 4288 + - ordinal: 6947 + rva: 6592 + offset: 3520 + - ordinal: 6948 + rva: 6464 + offset: 3392 + - ordinal: 6949 + rva: 6080 + offset: 3008 + - ordinal: 6950 + rva: 5952 + offset: 2880 + - ordinal: 6951 + rva: 5696 + offset: 2624 + - ordinal: 6952 + rva: 5520 + offset: 2448 + - ordinal: 6953 + rva: 5152 + offset: 2080 + - ordinal: 6954 + rva: 4896 + offset: 1824 + - ordinal: 6955 + rva: 4768 + offset: 1696 + - ordinal: 6956 + rva: 4640 + offset: 1568 + - ordinal: 6957 + rva: 4576 + offset: 1504 + - ordinal: 6958 + rva: 4112 + offset: 1040 + - ordinal: 6959 + rva: 0 + offset: 0 + - ordinal: 6960 + rva: 0 + offset: 0 + - ordinal: 6961 + rva: 0 + offset: 0 + - ordinal: 6962 + rva: 0 + offset: 0 + - ordinal: 6963 + rva: 0 + offset: 0 + - ordinal: 6964 + rva: 0 + offset: 0 + - ordinal: 6965 + rva: 0 + offset: 0 + - ordinal: 6966 + rva: 0 + offset: 0 + - ordinal: 6967 + rva: 0 + offset: 0 + - ordinal: 6968 + rva: 0 + offset: 0 + - ordinal: 6969 + rva: 0 + offset: 0 + - ordinal: 6970 + rva: 0 + offset: 0 + - ordinal: 6971 + rva: 0 + offset: 0 + - ordinal: 6972 + rva: 0 + offset: 0 + - ordinal: 6973 + rva: 0 + offset: 0 + - ordinal: 6974 + rva: 0 + offset: 0 + - ordinal: 6975 + rva: 0 + offset: 0 + - ordinal: 6976 + rva: 0 + offset: 0 + - ordinal: 6977 + rva: 0 + offset: 0 + - ordinal: 6978 + rva: 0 + offset: 0 + - ordinal: 6979 + rva: 0 + offset: 0 + - ordinal: 6980 + rva: 0 + offset: 0 + - ordinal: 6981 + rva: 0 + offset: 0 + - ordinal: 6982 + rva: 0 + offset: 0 + - ordinal: 6983 + rva: 0 + offset: 0 + - ordinal: 6984 + rva: 0 + offset: 0 + - ordinal: 6985 + rva: 0 + offset: 0 + - ordinal: 6986 + rva: 0 + offset: 0 + - ordinal: 6987 + rva: 0 + offset: 0 + - ordinal: 6988 + rva: 0 + offset: 0 + - ordinal: 6989 + rva: 0 + offset: 0 + - ordinal: 6990 + rva: 0 + offset: 0 + - ordinal: 6991 + rva: 0 + offset: 0 + - ordinal: 6992 + rva: 0 + offset: 0 + - ordinal: 6993 + rva: 0 + offset: 0 + - ordinal: 6994 + rva: 0 + offset: 0 + - ordinal: 6995 + rva: 0 + offset: 0 + - ordinal: 6996 + rva: 0 + offset: 0 + - ordinal: 6997 + rva: 0 + offset: 0 + - ordinal: 6998 + rva: 0 + offset: 0 + - ordinal: 6999 + rva: 0 + offset: 0 + - ordinal: 7000 + rva: 0 + offset: 0 + - ordinal: 7001 + rva: 0 + offset: 0 + - ordinal: 7002 + rva: 0 + offset: 0 + - ordinal: 7003 + rva: 0 + offset: 0 + - ordinal: 7004 + rva: 0 + offset: 0 + - ordinal: 7005 + rva: 0 + offset: 0 + - ordinal: 7006 + rva: 0 + offset: 0 + - ordinal: 7007 + rva: 0 + offset: 0 + - ordinal: 7008 + rva: 0 + offset: 0 + - ordinal: 7009 + rva: 0 + offset: 0 + - ordinal: 7010 + rva: 0 + offset: 0 + - ordinal: 7011 + rva: 0 + offset: 0 + - ordinal: 7012 + rva: 0 + offset: 0 + - ordinal: 7013 + rva: 0 + offset: 0 + - ordinal: 7014 + rva: 0 + offset: 0 + - ordinal: 7015 + rva: 0 + offset: 0 + - ordinal: 7016 + rva: 0 + offset: 0 + - ordinal: 7017 + rva: 0 + offset: 0 + - ordinal: 7018 + rva: 0 + offset: 0 + - ordinal: 7019 + rva: 0 + offset: 0 + - ordinal: 7020 + rva: 0 + offset: 0 + - ordinal: 7021 + rva: 0 + offset: 0 + - ordinal: 7022 + rva: 0 + offset: 0 + - ordinal: 7023 + rva: 0 + offset: 0 + - ordinal: 7024 + rva: 0 + offset: 0 + - ordinal: 7025 + rva: 0 + offset: 0 + - ordinal: 7026 + rva: 0 + offset: 0 + - ordinal: 7027 + rva: 0 + offset: 0 + - ordinal: 7028 + rva: 0 + offset: 0 + - ordinal: 7029 + rva: 0 + offset: 0 + - ordinal: 7030 + rva: 0 + offset: 0 + - ordinal: 7031 + rva: 0 + offset: 0 + - ordinal: 7032 + rva: 0 + offset: 0 + - ordinal: 7033 + rva: 0 + offset: 0 + - ordinal: 7034 + rva: 0 + offset: 0 + - ordinal: 7035 + rva: 0 + offset: 0 + - ordinal: 7036 + rva: 0 + offset: 0 + - ordinal: 7037 + rva: 0 + offset: 0 + - ordinal: 7038 + rva: 0 + offset: 0 + - ordinal: 7039 + rva: 0 + offset: 0 + - ordinal: 7040 + rva: 0 + offset: 0 + - ordinal: 7041 + rva: 0 + offset: 0 + - ordinal: 7042 + rva: 0 + offset: 0 + - ordinal: 7043 + rva: 0 + offset: 0 + - ordinal: 7044 + rva: 0 + offset: 0 + - ordinal: 7045 + rva: 0 + offset: 0 + - ordinal: 7046 + rva: 0 + offset: 0 + - ordinal: 7047 + rva: 0 + offset: 0 + - ordinal: 7048 + rva: 0 + offset: 0 + - ordinal: 7049 + rva: 0 + offset: 0 + - ordinal: 7050 + rva: 0 + offset: 0 + - ordinal: 7051 + rva: 0 + offset: 0 + - ordinal: 7052 + rva: 0 + offset: 0 + - ordinal: 7053 + rva: 0 + offset: 0 + - ordinal: 7054 + rva: 0 + offset: 0 + - ordinal: 7055 + rva: 0 + offset: 0 + - ordinal: 7056 + rva: 0 + offset: 0 + - ordinal: 7057 + rva: 0 + offset: 0 + - ordinal: 7058 + rva: 0 + offset: 0 + - ordinal: 7059 + rva: 0 + offset: 0 + - ordinal: 7060 + rva: 0 + offset: 0 + - ordinal: 7061 + rva: 0 + offset: 0 + - ordinal: 7062 + rva: 0 + offset: 0 + - ordinal: 7063 + rva: 0 + offset: 0 + - ordinal: 7064 + rva: 0 + offset: 0 + - ordinal: 7065 + rva: 0 + offset: 0 + - ordinal: 7066 + rva: 0 + offset: 0 + - ordinal: 7067 + rva: 0 + offset: 0 + - ordinal: 7068 + rva: 0 + offset: 0 + - ordinal: 7069 + rva: 0 + offset: 0 + - ordinal: 7070 + rva: 0 + offset: 0 + - ordinal: 7071 + rva: 0 + offset: 0 + - ordinal: 7072 + rva: 0 + offset: 0 + - ordinal: 7073 + rva: 0 + offset: 0 + - ordinal: 7074 + rva: 0 + offset: 0 + - ordinal: 7075 + rva: 0 + offset: 0 + - ordinal: 7076 + rva: 0 + offset: 0 + - ordinal: 7077 + rva: 0 + offset: 0 + - ordinal: 7078 + rva: 0 + offset: 0 + - ordinal: 7079 + rva: 0 + offset: 0 + - ordinal: 7080 + rva: 0 + offset: 0 + - ordinal: 7081 + rva: 0 + offset: 0 + - ordinal: 7082 + rva: 0 + offset: 0 + - ordinal: 7083 + rva: 0 + offset: 0 + - ordinal: 7084 + rva: 0 + offset: 0 + - ordinal: 7085 + rva: 0 + offset: 0 + - ordinal: 7086 + rva: 0 + offset: 0 + - ordinal: 7087 + rva: 0 + offset: 0 + - ordinal: 7088 + rva: 19600 + offset: 16528 + - ordinal: 7089 + rva: 19472 + offset: 16400 + - ordinal: 7090 + rva: 19344 + offset: 16272 + - ordinal: 7091 + rva: 13536 + offset: 10464 + - ordinal: 7092 + rva: 13408 + offset: 10336 + - ordinal: 7093 + rva: 13248 + offset: 10176 + - ordinal: 7094 + rva: 13088 + offset: 10016 + - ordinal: 7095 + rva: 19120 + offset: 16048 + - ordinal: 7096 + rva: 12736 + offset: 9664 + - ordinal: 7097 + rva: 12608 + offset: 9536 + - ordinal: 7098 + rva: 18672 + offset: 15600 + - ordinal: 7099 + rva: 18368 + offset: 15296 +is_signed: true +signatures: + - subject: "/CN=AMD PMP-PE CB Code Signer v20220131" + issuer: "/DC=com/DC=amd/CN=AMD PVP Certificate Authority v1" + thumbprint: "98006b07f631168df08df9771aa7b2c9e27becb8" + version: 3 + algorithm: "sha1WithRSAEncryption" + algorithm_oid: "1.2.840.113549.1.1.5" + serial: "61:06:84:e2:00:07:00:00:00:64" + not_before: 1643646292 # 2022-01-31 16:24:52 UTC + not_after: 1675182892 # 2023-01-31 16:34:52 UTC + verified: true + digest_alg: "sha1" + digest: "a4c814f6fc0ecf302b231589a8010403b134075b" + file_digest: "a4c814f6fc0ecf302b231589a8010403b134075b" + number_of_certificates: 5 + number_of_countersignatures: 1 + signer_info: + digest: "9d4df99d687ff7c98d93e3c480dff4b58f46cefd" + digest_alg: "sha1" + chain: + - issuer: "/DC=com/DC=amd/CN=AMD PVP Certificate Authority v1" + subject: "/CN=AMD PMP-PE CB Code Signer v20220131" + thumbprint: "98006b07f631168df08df9771aa7b2c9e27becb8" + version: 3 + algorithm: "sha1WithRSAEncryption" + algorithm_oid: "1.2.840.113549.1.1.5" + serial: "61:06:84:e2:00:07:00:00:00:64" + not_before: 1643646292 # 2022-01-31 16:24:52 UTC + not_after: 1675182892 # 2023-01-31 16:34:52 UTC + - issuer: "/CN=Microsoft Digital Media Authority 2005" + subject: "/DC=com/DC=amd/CN=AMD PVP Certificate Authority v1" + thumbprint: "1210c599d6c1823fbde6572ccb301f525c44ac1f" + version: 3 + algorithm: "sha1WithRSAEncryption" + algorithm_oid: "1.2.840.113549.1.1.5" + serial: "61:03:ff:8f:00:07:00:00:00:87" + not_before: 1519946887 # 2018-03-01 23:28:07 UTC + not_after: 1678577887 # 2023-03-11 23:38:07 UTC + certificates: + - issuer: "/DC=com/DC=amd/CN=AMD PVP Certificate Authority v1" + subject: "/CN=AMD PMP-PE CB Code Signer v20220131" + thumbprint: "98006b07f631168df08df9771aa7b2c9e27becb8" + version: 3 + algorithm: "sha1WithRSAEncryption" + algorithm_oid: "1.2.840.113549.1.1.5" + serial: "61:06:84:e2:00:07:00:00:00:64" + not_before: 1643646292 # 2022-01-31 16:24:52 UTC + not_after: 1675182892 # 2023-01-31 16:34:52 UTC + - issuer: "/CN=Microsoft Digital Media Authority 2005" + subject: "/DC=com/DC=amd/CN=AMD PVP Certificate Authority v1" + thumbprint: "1210c599d6c1823fbde6572ccb301f525c44ac1f" + version: 3 + algorithm: "sha1WithRSAEncryption" + algorithm_oid: "1.2.840.113549.1.1.5" + serial: "61:03:ff:8f:00:07:00:00:00:87" + not_before: 1519946887 # 2018-03-01 23:28:07 UTC + not_after: 1678577887 # 2023-03-11 23:38:07 UTC + - issuer: "/C=US/O=DigiCert, Inc./CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA" + subject: "/C=US/O=DigiCert, Inc./CN=DigiCert Timestamp 2023" + thumbprint: "66f02b32c2c2c90f825dceaa8ac9c64f199ccf40" + version: 3 + algorithm: "sha256WithRSAEncryption" + algorithm_oid: "1.2.840.113549.1.1.11" + serial: "05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16" + not_before: 1689292800 # 2023-07-14 00:00:00 UTC + not_after: 2044396799 # 2034-10-13 23:59:59 UTC + - issuer: "/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert Trusted Root G4" + subject: "/C=US/O=DigiCert, Inc./CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA" + thumbprint: "b6c8af834d4e53b673c76872aa8c950c7c54df5f" + version: 3 + algorithm: "sha256WithRSAEncryption" + algorithm_oid: "1.2.840.113549.1.1.11" + serial: "07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b" + not_before: 1647993600 # 2022-03-23 00:00:00 UTC + not_after: 2121379199 # 2037-03-22 23:59:59 UTC + - issuer: "/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert Assured ID Root CA" + subject: "/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert Trusted Root G4" + thumbprint: "a99d5b79e9f1cda59cdab6373169d5353f5874c6" + version: 3 + algorithm: "sha384WithRSAEncryption" + algorithm_oid: "1.2.840.113549.1.1.12" + serial: "0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a" + not_before: 1659312000 # 2022-08-01 00:00:00 UTC + not_after: 1952035199 # 2031-11-09 23:59:59 UTC + countersignatures: + - verified: true + sign_time: 1700015367 # 2023-11-15 02:29:27 UTC + digest: "d82e2c104f3ad8c0bca01e264166ce51bc527cd6" + digest_alg: "sha1" + chain: + - issuer: "/C=US/O=DigiCert, Inc./CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA" + subject: "/C=US/O=DigiCert, Inc./CN=DigiCert Timestamp 2023" + thumbprint: "66f02b32c2c2c90f825dceaa8ac9c64f199ccf40" + version: 3 + algorithm: "sha256WithRSAEncryption" + algorithm_oid: "1.2.840.113549.1.1.11" + serial: "05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16" + not_before: 1689292800 # 2023-07-14 00:00:00 UTC + not_after: 2044396799 # 2034-10-13 23:59:59 UTC + - issuer: "/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert Trusted Root G4" + subject: "/C=US/O=DigiCert, Inc./CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA" + thumbprint: "b6c8af834d4e53b673c76872aa8c950c7c54df5f" + version: 3 + algorithm: "sha256WithRSAEncryption" + algorithm_oid: "1.2.840.113549.1.1.11" + serial: "07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b" + not_before: 1647993600 # 2022-03-23 00:00:00 UTC + not_after: 2121379199 # 2037-03-22 23:59:59 UTC + - issuer: "/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert Assured ID Root CA" + subject: "/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert Trusted Root G4" + thumbprint: "a99d5b79e9f1cda59cdab6373169d5353f5874c6" + version: 3 + algorithm: "sha384WithRSAEncryption" + algorithm_oid: "1.2.840.113549.1.1.12" + serial: "0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a" + not_before: 1659312000 # 2022-08-01 00:00:00 UTC + not_after: 1952035199 # 2031-11-09 23:59:59 UTC + - subject: "/C=US/ST=California/L=Santa Clara/O=Advanced Micro Devices Inc./CN=Advanced Micro Devices Inc." + issuer: "/C=GB/ST=Greater Manchester/L=Salford/O=Sectigo Limited/CN=Sectigo RSA Code Signing CA" + thumbprint: "26f54ee84758ba716117321707bb08b3274a578a" + version: 3 + algorithm: "sha256WithRSAEncryption" + algorithm_oid: "1.2.840.113549.1.1.11" + serial: "53:50:91:e6:ca:b1:3a:f3:93:b5:1e:ad:08:25:f6:27" + not_before: 1620691200 # 2021-05-11 00:00:00 UTC + not_after: 1715385599 # 2024-05-10 23:59:59 UTC + verified: true + digest_alg: "sha256" + digest: "d8c60d76740d929f1aec6237c276a99ea7c3662a5f0dbdf083c6d51fc3aed30a" + file_digest: "d8c60d76740d929f1aec6237c276a99ea7c3662a5f0dbdf083c6d51fc3aed30a" + number_of_certificates: 6 + number_of_countersignatures: 1 + signer_info: + digest: "559123b173730d0b963615ab6a9a0f4211fb89d00ec499f6881f10edd48f3052" + digest_alg: "sha256" + chain: + - issuer: "/C=GB/ST=Greater Manchester/L=Salford/O=Sectigo Limited/CN=Sectigo RSA Code Signing CA" + subject: "/C=US/ST=California/L=Santa Clara/O=Advanced Micro Devices Inc./CN=Advanced Micro Devices Inc." + thumbprint: "26f54ee84758ba716117321707bb08b3274a578a" + version: 3 + algorithm: "sha256WithRSAEncryption" + algorithm_oid: "1.2.840.113549.1.1.11" + serial: "53:50:91:e6:ca:b1:3a:f3:93:b5:1e:ad:08:25:f6:27" + not_before: 1620691200 # 2021-05-11 00:00:00 UTC + not_after: 1715385599 # 2024-05-10 23:59:59 UTC + - issuer: "/C=US/ST=New Jersey/L=Jersey City/O=The USERTRUST Network/CN=USERTrust RSA Certification Authority" + subject: "/C=GB/ST=Greater Manchester/L=Salford/O=Sectigo Limited/CN=Sectigo RSA Code Signing CA" + thumbprint: "94c95da1e850bd85209a4a2af3e1fb1604f9bb66" + version: 3 + algorithm: "sha384WithRSAEncryption" + algorithm_oid: "1.2.840.113549.1.1.12" + serial: "1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a" + not_before: 1541116800 # 2018-11-02 00:00:00 UTC + not_after: 1924991999 # 2030-12-31 23:59:59 UTC + - issuer: "/C=US/ST=Washington/L=Redmond/O=Microsoft Corporation/CN=Microsoft Code Verification Root" + subject: "/C=US/ST=New Jersey/L=Jersey City/O=The USERTRUST Network/CN=USERTrust RSA Certification Authority" + thumbprint: "beb914182a829d0c69556907e37f2799bfffd891" + version: 3 + algorithm: "sha1WithRSAEncryption" + algorithm_oid: "1.2.840.113549.1.1.5" + serial: "33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44" + not_before: 1437599029 # 2015-07-22 21:03:49 UTC + not_after: 1753218229 # 2025-07-22 21:03:49 UTC + certificates: + - issuer: "/C=GB/ST=Greater Manchester/L=Salford/O=Sectigo Limited/CN=Sectigo RSA Code Signing CA" + subject: "/C=US/ST=California/L=Santa Clara/O=Advanced Micro Devices Inc./CN=Advanced Micro Devices Inc." + thumbprint: "26f54ee84758ba716117321707bb08b3274a578a" + version: 3 + algorithm: "sha256WithRSAEncryption" + algorithm_oid: "1.2.840.113549.1.1.11" + serial: "53:50:91:e6:ca:b1:3a:f3:93:b5:1e:ad:08:25:f6:27" + not_before: 1620691200 # 2021-05-11 00:00:00 UTC + not_after: 1715385599 # 2024-05-10 23:59:59 UTC + - issuer: "/C=US/ST=New Jersey/L=Jersey City/O=The USERTRUST Network/CN=USERTrust RSA Certification Authority" + subject: "/C=GB/ST=Greater Manchester/L=Salford/O=Sectigo Limited/CN=Sectigo RSA Code Signing CA" + thumbprint: "94c95da1e850bd85209a4a2af3e1fb1604f9bb66" + version: 3 + algorithm: "sha384WithRSAEncryption" + algorithm_oid: "1.2.840.113549.1.1.12" + serial: "1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a" + not_before: 1541116800 # 2018-11-02 00:00:00 UTC + not_after: 1924991999 # 2030-12-31 23:59:59 UTC + - issuer: "/C=US/ST=Washington/L=Redmond/O=Microsoft Corporation/CN=Microsoft Code Verification Root" + subject: "/C=US/ST=New Jersey/L=Jersey City/O=The USERTRUST Network/CN=USERTrust RSA Certification Authority" + thumbprint: "beb914182a829d0c69556907e37f2799bfffd891" + version: 3 + algorithm: "sha1WithRSAEncryption" + algorithm_oid: "1.2.840.113549.1.1.5" + serial: "33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44" + not_before: 1437599029 # 2015-07-22 21:03:49 UTC + not_after: 1753218229 # 2025-07-22 21:03:49 UTC + - issuer: "/C=US/O=DigiCert, Inc./CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA" + subject: "/C=US/O=DigiCert, Inc./CN=DigiCert Timestamp 2023" + thumbprint: "66f02b32c2c2c90f825dceaa8ac9c64f199ccf40" + version: 3 + algorithm: "sha256WithRSAEncryption" + algorithm_oid: "1.2.840.113549.1.1.11" + serial: "05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16" + not_before: 1689292800 # 2023-07-14 00:00:00 UTC + not_after: 2044396799 # 2034-10-13 23:59:59 UTC + - issuer: "/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert Trusted Root G4" + subject: "/C=US/O=DigiCert, Inc./CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA" + thumbprint: "b6c8af834d4e53b673c76872aa8c950c7c54df5f" + version: 3 + algorithm: "sha256WithRSAEncryption" + algorithm_oid: "1.2.840.113549.1.1.11" + serial: "07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b" + not_before: 1647993600 # 2022-03-23 00:00:00 UTC + not_after: 2121379199 # 2037-03-22 23:59:59 UTC + - issuer: "/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert Assured ID Root CA" + subject: "/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert Trusted Root G4" + thumbprint: "a99d5b79e9f1cda59cdab6373169d5353f5874c6" + version: 3 + algorithm: "sha384WithRSAEncryption" + algorithm_oid: "1.2.840.113549.1.1.12" + serial: "0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a" + not_before: 1659312000 # 2022-08-01 00:00:00 UTC + not_after: 1952035199 # 2031-11-09 23:59:59 UTC + countersignatures: + - verified: true + sign_time: 1700015370 # 2023-11-15 02:29:30 UTC + digest: "8fc84c2bd5aa498b76698c0737ce8902efd766bf5d7a5dbd3eb1033c9bd71522" + digest_alg: "sha256" + chain: + - issuer: "/C=US/O=DigiCert, Inc./CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA" + subject: "/C=US/O=DigiCert, Inc./CN=DigiCert Timestamp 2023" + thumbprint: "66f02b32c2c2c90f825dceaa8ac9c64f199ccf40" + version: 3 + algorithm: "sha256WithRSAEncryption" + algorithm_oid: "1.2.840.113549.1.1.11" + serial: "05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16" + not_before: 1689292800 # 2023-07-14 00:00:00 UTC + not_after: 2044396799 # 2034-10-13 23:59:59 UTC + - issuer: "/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert Trusted Root G4" + subject: "/C=US/O=DigiCert, Inc./CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA" + thumbprint: "b6c8af834d4e53b673c76872aa8c950c7c54df5f" + version: 3 + algorithm: "sha256WithRSAEncryption" + algorithm_oid: "1.2.840.113549.1.1.11" + serial: "07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b" + not_before: 1647993600 # 2022-03-23 00:00:00 UTC + not_after: 2121379199 # 2037-03-22 23:59:59 UTC + - issuer: "/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert Assured ID Root CA" + subject: "/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert Trusted Root G4" + thumbprint: "a99d5b79e9f1cda59cdab6373169d5353f5874c6" + version: 3 + algorithm: "sha384WithRSAEncryption" + algorithm_oid: "1.2.840.113549.1.1.12" + serial: "0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a" + not_before: 1659312000 # 2022-08-01 00:00:00 UTC + not_after: 1952035199 # 2031-11-09 23:59:59 UTC + - subject: "/C=US/ST=Washington/L=Redmond/O=Microsoft Corporation/CN=Microsoft Windows Hardware Compatibility Publisher" + issuer: "/C=US/ST=Washington/L=Redmond/O=Microsoft Corporation/CN=Microsoft Windows Third Party Component CA 2012" + thumbprint: "1935420a805a0cefebecdbe59a391a69db32eab3" + version: 3 + algorithm: "sha256WithRSAEncryption" + algorithm_oid: "1.2.840.113549.1.1.11" + serial: "33:00:00:01:09:5e:de:a2:12:7e:92:81:cc:00:00:00:00:01:09" + not_before: 1694718863 # 2023-09-14 19:14:23 UTC + not_after: 1725477263 # 2024-09-04 19:14:23 UTC + verified: true + digest_alg: "sha256" + digest: "d8c60d76740d929f1aec6237c276a99ea7c3662a5f0dbdf083c6d51fc3aed30a" + file_digest: "d8c60d76740d929f1aec6237c276a99ea7c3662a5f0dbdf083c6d51fc3aed30a" + number_of_certificates: 2 + number_of_countersignatures: 0 + signer_info: + program_name: "Advanced Micro Devices, Inc." + digest: "e26ef3d142bb9053aa7027e34e4de07735a7655a46894f445d4a4dbc6fee40f7" + digest_alg: "sha256" + chain: + - issuer: "/C=US/ST=Washington/L=Redmond/O=Microsoft Corporation/CN=Microsoft Windows Third Party Component CA 2012" + subject: "/C=US/ST=Washington/L=Redmond/O=Microsoft Corporation/CN=Microsoft Windows Hardware Compatibility Publisher" + thumbprint: "1935420a805a0cefebecdbe59a391a69db32eab3" + version: 3 + algorithm: "sha256WithRSAEncryption" + algorithm_oid: "1.2.840.113549.1.1.11" + serial: "33:00:00:01:09:5e:de:a2:12:7e:92:81:cc:00:00:00:00:01:09" + not_before: 1694718863 # 2023-09-14 19:14:23 UTC + not_after: 1725477263 # 2024-09-04 19:14:23 UTC + - issuer: "/C=US/ST=Washington/L=Redmond/O=Microsoft Corporation/CN=Microsoft Root Certificate Authority 2010" + subject: "/C=US/ST=Washington/L=Redmond/O=Microsoft Corporation/CN=Microsoft Windows Third Party Component CA 2012" + thumbprint: "77a10ebf07542725218cd83a01b521c57bc67f73" + version: 3 + algorithm: "sha256WithRSAEncryption" + algorithm_oid: "1.2.840.113549.1.1.11" + serial: "61:0b:aa:c1:00:00:00:00:00:09" + not_before: 1334792918 # 2012-04-18 23:48:38 UTC + not_after: 1808092718 # 2027-04-18 23:58:38 UTC + certificates: + - issuer: "/C=US/ST=Washington/L=Redmond/O=Microsoft Corporation/CN=Microsoft Windows Third Party Component CA 2012" + subject: "/C=US/ST=Washington/L=Redmond/O=Microsoft Corporation/CN=Microsoft Windows Hardware Compatibility Publisher" + thumbprint: "1935420a805a0cefebecdbe59a391a69db32eab3" + version: 3 + algorithm: "sha256WithRSAEncryption" + algorithm_oid: "1.2.840.113549.1.1.11" + serial: "33:00:00:01:09:5e:de:a2:12:7e:92:81:cc:00:00:00:00:01:09" + not_before: 1694718863 # 2023-09-14 19:14:23 UTC + not_after: 1725477263 # 2024-09-04 19:14:23 UTC + - issuer: "/C=US/ST=Washington/L=Redmond/O=Microsoft Corporation/CN=Microsoft Root Certificate Authority 2010" + subject: "/C=US/ST=Washington/L=Redmond/O=Microsoft Corporation/CN=Microsoft Windows Third Party Component CA 2012" + thumbprint: "77a10ebf07542725218cd83a01b521c57bc67f73" + version: 3 + algorithm: "sha256WithRSAEncryption" + algorithm_oid: "1.2.840.113549.1.1.11" + serial: "61:0b:aa:c1:00:00:00:00:00:09" + not_before: 1334792918 # 2012-04-18 23:48:38 UTC + not_after: 1808092718 # 2027-04-18 23:58:38 UTC + - subject: "/C=US/ST=Washington/L=Redmond/O=Microsoft Corporation/CN=Microsoft Windows Hardware Compatibility Publisher" + issuer: "/C=US/ST=Washington/L=Redmond/O=Microsoft Corporation/CN=Microsoft Windows Third Party Component CA 2012" + thumbprint: "1935420a805a0cefebecdbe59a391a69db32eab3" + version: 3 + algorithm: "sha256WithRSAEncryption" + algorithm_oid: "1.2.840.113549.1.1.11" + serial: "33:00:00:01:09:5e:de:a2:12:7e:92:81:cc:00:00:00:00:01:09" + not_before: 1694718863 # 2023-09-14 19:14:23 UTC + not_after: 1725477263 # 2024-09-04 19:14:23 UTC + verified: true + digest_alg: "sha256" + digest: "d8c60d76740d929f1aec6237c276a99ea7c3662a5f0dbdf083c6d51fc3aed30a" + file_digest: "d8c60d76740d929f1aec6237c276a99ea7c3662a5f0dbdf083c6d51fc3aed30a" + number_of_certificates: 2 + number_of_countersignatures: 0 + signer_info: + program_name: "Advanced Micro Devices, Inc." + digest: "e26ef3d142bb9053aa7027e34e4de07735a7655a46894f445d4a4dbc6fee40f7" + digest_alg: "sha256" + chain: + - issuer: "/C=US/ST=Washington/L=Redmond/O=Microsoft Corporation/CN=Microsoft Windows Third Party Component CA 2012" + subject: "/C=US/ST=Washington/L=Redmond/O=Microsoft Corporation/CN=Microsoft Windows Hardware Compatibility Publisher" + thumbprint: "1935420a805a0cefebecdbe59a391a69db32eab3" + version: 3 + algorithm: "sha256WithRSAEncryption" + algorithm_oid: "1.2.840.113549.1.1.11" + serial: "33:00:00:01:09:5e:de:a2:12:7e:92:81:cc:00:00:00:00:01:09" + not_before: 1694718863 # 2023-09-14 19:14:23 UTC + not_after: 1725477263 # 2024-09-04 19:14:23 UTC + - issuer: "/C=US/ST=Washington/L=Redmond/O=Microsoft Corporation/CN=Microsoft Root Certificate Authority 2010" + subject: "/C=US/ST=Washington/L=Redmond/O=Microsoft Corporation/CN=Microsoft Windows Third Party Component CA 2012" + thumbprint: "77a10ebf07542725218cd83a01b521c57bc67f73" + version: 3 + algorithm: "sha256WithRSAEncryption" + algorithm_oid: "1.2.840.113549.1.1.11" + serial: "61:0b:aa:c1:00:00:00:00:00:09" + not_before: 1334792918 # 2012-04-18 23:48:38 UTC + not_after: 1808092718 # 2027-04-18 23:58:38 UTC + certificates: + - issuer: "/C=US/ST=Washington/L=Redmond/O=Microsoft Corporation/CN=Microsoft Windows Third Party Component CA 2012" + subject: "/C=US/ST=Washington/L=Redmond/O=Microsoft Corporation/CN=Microsoft Windows Hardware Compatibility Publisher" + thumbprint: "1935420a805a0cefebecdbe59a391a69db32eab3" + version: 3 + algorithm: "sha256WithRSAEncryption" + algorithm_oid: "1.2.840.113549.1.1.11" + serial: "33:00:00:01:09:5e:de:a2:12:7e:92:81:cc:00:00:00:00:01:09" + not_before: 1694718863 # 2023-09-14 19:14:23 UTC + not_after: 1725477263 # 2024-09-04 19:14:23 UTC + - issuer: "/C=US/ST=Washington/L=Redmond/O=Microsoft Corporation/CN=Microsoft Root Certificate Authority 2010" + subject: "/C=US/ST=Washington/L=Redmond/O=Microsoft Corporation/CN=Microsoft Windows Third Party Component CA 2012" + thumbprint: "77a10ebf07542725218cd83a01b521c57bc67f73" + version: 3 + algorithm: "sha256WithRSAEncryption" + algorithm_oid: "1.2.840.113549.1.1.11" + serial: "61:0b:aa:c1:00:00:00:00:00:09" + not_before: 1334792918 # 2012-04-18 23:48:38 UTC + not_after: 1808092718 # 2027-04-18 23:58:38 UTC +overlay: + offset: 165376 + size: 44192 \ No newline at end of file