2

What is the easiest way to determine the function called in dumpbin output. No PDBs available.

The disassembly:

  004028E2: 8B 1D 70 42 40 00  mov         ebx,dword ptr ds:[00404270h]
  004028E8: 55                 push        ebp
  004028E9: 56                 push        esi
  004028EA: 57                 push        edi
  004028EB: 8B 7C 24 18        mov         edi,dword ptr [esp+18h]
  004028EF: 89 4C 24 10        mov         dword ptr [esp+10h],ecx
  004028F3: 57                 push        edi
  004028F4: 33 F6              xor         esi,esi
  004028F6: FF D3              call        ebx

In this case I know the function is "wcslen" but want to see if there is a good way to resolve this when working in environments where I only have access to Microsoft Visual Studio and not my usual reverse engineering tools. Dumpbin /imports shows

MSVCRT.dll
                40422C Import Address Table
                404C14 Import Name Table
                     0 time date stamp
                     0 Index of first forwarder reference

                   D3 _exit
                   48 _XcptFilter
                  249 exit
                  1E7 _wcmdln
                   8B __wgetmainargs
                  10F _initterm
                   83 __setusermatherr
                   9D _adjust_fdiv
                   6A __p__commode
                   6F __p__fmode
                   81 __set_app_type
                   CA _except_handler3
                   55 __dllonexit
                  186 _onexit
                    E ??1type_info@@UAE@XZ
                   B7 _controlfp
                  2E9 wcsncpy
                  2E6 wcslen
                  2E1 wcscmp
                  2D6 towupper
                   62 __p___argc
                   66 __p___wargv
                  1EA _wcsicmp
                   49 __CxxFrameHandler
                  2C0 strncmp
                  2C1 strncpy
                  2EB wcsrchr
                  2DF wcscat
                  2CB swprintf

Dumpbin /raw shows the following at the address 404270h

00404270: 76 4D 00 00 6C 4D 00 00 60 4D 00 00 52 4D 00 00  vM..lM..`M..RM..

0x4D76 corresponds to wcslen in CFF Explorer -> Import Directory -> MSVCRT.dll -> wcslen OFTs and FTs (IAT) columns with a hint of "2E6"

This is here, but trying to calculate the offset for the wcslen from these addresses.

SECTION HEADER #2
  .rdata name
    102A virtual size
    4000 virtual address (00404000 to 00405029)
    2000 size of raw data
    4000 file pointer to raw data (00004000 to 00005FFF)
       0 file pointer to relocation table
       0 file pointer to line numbers
       0 number of relocations
       0 number of line numbers
40000040 flags
         Initialized Data
         Read Only

RAW DATA #2
  00404000: 82 4E 00 00 A2 4E 00 00 B0 4E 00 00 C0 4E 00 00  .N..¢N..°N..ÀN..
  00404010: D6 4E 00 00 EA 4E 00 00 F8 4E 00 00 08 4F 00 00  ÖN..êN..øN...O..
  00404020: 16 4F 00 00 24 4F 00 00 3A 4F 00 00 4E 4F 00 00  .O..$O..:O..NO..
  00404030: 90 4E 00 00 00 00 00 00 B0 14 00 80 B2 14 00 80  .N......°...²...
  00404040: 9D 0A 00 80 EA 0F 00 80 54 12 00 80 B7 14 00 80  ....ê...T...·...
  00404050: A5 14 00 80 4E 16 00 80 A1 0B 00 80 46 0C 00 80  ¥...N...¡...F...
  00404060: B6 0C 00 80 6B 11 00 80 3B 0C 00 80 B9 0C 00 80  ¶...k...;...¹...
  00404070: A4 0B 00 80 04 0C 00 80 9B 0B 00 80 F1 0E 00 80  ¤...........ñ...
  00404080: F2 0E 00 80 EC 0E 00 80 02 0C 00 80 EB 0F 00 80  ò...ì.......ë...
  00404090: 08 12 00 80 42 11 00 80 95 0E 00 80 31 02 00 80  ....B.......1...
  004040A0: 39 03 00 80 2F 03 00 80 81 02 00 80 90 02 00 80  9.../...........
  004040B0: 68 02 00 80 20 03 00 80 CA 09 00 80 35 0A 00 80  h... ...Ê...5...
  004040C0: 6B 04 00 80 AC 04 00 80 DC 04 00 80 8D 14 00 80  k...¬...Ü.......
  004040D0: 12 11 00 80 EF 12 00 80 80 13 00 80 A0 17 00 80  ....ï...........
  004040E0: E7 06 00 80 9C 14 00 80 43 11 00 80 08 0E 00 80  ç.......C.......
  004040F0: 31 11 00 80 15 0E 00 80 63 09 00 80 DF 07 00 80  1.......c...ß...
  00404100: 75 10 00 80 0A 0A 00 80 A3 17 00 80 E9 0F 00 80  u.......£...é...
  00404110: E8 06 00 80 0D 0D 00 80 75 14 00 80 49 09 00 80  è.......u...I...
  00404120: 25 14 00 80 E2 18 00 80 FB 10 00 80 A6 14 00 80  %...â...û...¦...
  00404130: D1 0E 00 80 DF 12 00 80 53 11 00 80 50 0A 00 80  Ñ...ß...S...P...
  00404140: FF 07 00 80 E4 18 00 80 A0 0E 00 80 C3 13 00 80  ÿ...ä.......Ã...
  00404150: B8 06 00 80 89 14 00 80 86 09 00 80 44 08 00 80  ¸...........D...
  00404160: 99 14 00 80 45 0D 00 80 0D 12 00 80 21 06 00 80  ....E.......!...
  00404170: 77 04 00 80 8D 04 00 80 FA 0A 00 80 5D 03 00 80  w.......ú...]...
  00404180: 1C 02 00 80 37 02 00 80 44 01 00 80 F3 08 00 80  ....7...D...ó...
  00404190: 3A 09 00 80 F6 08 00 80 85 10 00 80 BA 18 00 80  :...ö.......º...
  004041A0: 33 18 00 80 5A 03 00 80 1C 10 00 80 19 02 00 80  3...Z...........
  004041B0: AC 03 00 80 43 18 00 80 1A 02 00 80 60 12 00 80  ¬...C.......`...
  004041C0: 43 09 00 80 F3 02 00 80 D6 01 00 80 1F 0F 00 80  C...ó...Ö.......
  004041D0: 17 02 00 80 99 02 00 80 B3 07 00 80 ED 18 00 80  ........³...í...
  004041E0: 61 01 00 80 A6 0D 00 80 CB 09 00 80 63 01 00 80  a...¦...Ë...c...
  004041F0: AD 04 00 80 54 09 00 80 49 14 00 80 41 04 00 80  ­...T...I...A...
  00404200: 4D 0F 00 80 5F 16 00 80 C8 09 00 80 F2 09 00 80  M..._...È...ò...
  00404210: 80 11 00 80 E3 18 00 80 AD 10 00 80 3B 12 00 80  ....ã...­...;...
  00404220: 28 11 00 80 F9 0D 00 80 00 00 00 00 8A 4D 00 00  (...ù........M..
  00404230: 92 4D 00 00 A0 4D 00 00 A8 4D 00 00 B2 4D 00 00  .M...M..¨M..²M..
  00404240: C4 4D 00 00 D0 4D 00 00 E4 4D 00 00 F4 4D 00 00  ÄM..ÐM..äM..ôM..
  00404250: 04 4E 00 00 12 4E 00 00 24 4E 00 00 44 4E 00 00  .N...N..$N..DN..
  00404260: 52 4E 00 00 5C 4E 00 00 74 4E 00 00 80 4D 00 00  RN..\N..tN...M..
  00404270: 76 4D 00 00 6C 4D 00 00 60 4D 00 00 52 4D 00 00  vM..lM..`M..RM..
  00404280: 44 4D 00 00 38 4D 00 00 24 4D 00 00 1A 4D 00 00  DM..8M..$M...M..
  00404290: 10 4D 00 00 06 4D 00 00 FC 4C 00 00 F0 4C 00 00  .M...M..üL..ðL..
  004042A0: 00 00 00 00 C6 4F 00 00 6E 4F 00 00 7A 4F 00 00  ....ÆO..nO..zO..
  004042B0: 8A 4F 00 00 96 4F 00 00 A6 4F 00 00 BA 4F 00 00  .O...O..¦O..ºO..
  004042C0: 0E 50 00 00 D8 4F 00 00 EC 4F 00 00 FE 4F 00 00  .P..ØO..ìO..þO..
  004042D0: 00 00 00 00 C4 4C 00 00 00 00 00 00 00 00 00 00  ....ÄL..........
  004042E0: 10 1B 40 00 E8 42 40 00 11 01 00 00 00 00 00 00  ..@.èB@.........
  004042F0: 46 E1 00 00 46 E1 00 00 0C 00 00 00 26 2D 40 00  Fá..Fá......&-@.
  00404300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  00404310: 00 00 00 00 00 00 00 00 F8 2D 40 00 50 1B 40 00  ........ø[email protected].@.
  00404320: B0 1D 40 00 A0 1D 40 00 B0 1D 40 00 F2 2D 40 00  °.@...@.°.@.ò-@.
  00404330: EC 2D 40 00 E6 2D 40 00 E0 2D 40 00 DA 2D 40 00  ì-@.æ-@.à-@.Ú-@.
  00404340: D4 2D 40 00 CE 2D 40 00 20 1B 40 00 C8 2D 40 00  Ô-@.Î-@. .@.È-@.
  00404350: C2 2D 40 00 BC 2D 40 00 B6 2D 40 00 B0 2D 40 00  Â-@.¼-@.¶-@.°-@.
  00404360: AA 2D 40 00 A4 2D 40 00 9E 2D 40 00 98 2D 40 00  ª-@.¤[email protected]@..-@.
  00404370: C0 1B 40 00 92 2D 40 00 8C 2D 40 00 86 2D 40 00  À[email protected]@[email protected]@.
  00404380: 80 2D 40 00 7A 2D 40 00 74 2D 40 00 6E 2D 40 00  [email protected]@[email protected]@.
  00404390: 68 2D 40 00 62 2D 40 00 5C 2D 40 00 56 2D 40 00  [email protected]@.\[email protected]@.
  004043A0: 50 2D 40 00 4A 2D 40 00 44 2D 40 00 3E 2D 40 00  [email protected]@.D-@.>-@.
  004043B0: 38 2D 40 00 32 2D 40 00 2C 2D 40 00 00 00 00 00  [email protected]@.,-@.....
  004043C0: C0 1F 40 00 C8 43 40 00 0F 00 00 00 00 00 00 00  À.@.ÈC@.........
  004043D0: 00 00 00 00 00 00 00 00 0C 00 00 00 00 24 40 00  .............$@.
  004043E0: 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  7...............
  004043F0: 23 00 00 00 C0 24 40 00 11 01 00 00 01 00 00 00  #...À$@.........
  00404400: E8 03 00 00 E8 03 00 00 0C 00 00 00 D0 24 40 00  è...è.......Ð$@.
  00404410: 11 01 00 00 00 00 00 00 EB 03 00 00 EB 03 00 00  ........ë...ë...
  00404420: 0C 00 00 00 30 26 40 00 11 01 00 00 00 00 00 00  ....0&@.........
  00404430: EC 03 00 00 EC 03 00 00 0C 00 00 00 60 26 40 00  ì...ì.......`&@.
  00404440: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  00404450: 00 00 00 00 00 00 00 00 76 2E 40 00 10 1F 40 00  ........v.@...@.
  00404460: B0 1D 40 00 A0 1D 40 00 B0 1D 40 00 70 2E 40 00  °.@...@.°[email protected].@.
  00404470: 30 2F 40 00 E6 2D 40 00 E0 2D 40 00 DA 2D 40 00  0/@.æ-@.à-@.Ú-@.
  00404480: D4 2D 40 00 CE 2D 40 00 D0 1F 40 00 C8 2D 40 00  Ô-@.Î-@.Ð.@.È-@.
  00404490: C2 2D 40 00 BC 2D 40 00 B6 2D 40 00 B0 2D 40 00  Â-@.¼-@.¶-@.°-@.
  004044A0: AA 2D 40 00 A4 2D 40 00 9E 2D 40 00 98 2D 40 00  ª-@.¤[email protected]@..-@.
  004044B0: 24 2F 40 00 1E 2F 40 00 18 2F 40 00 12 2F 40 00  $/@../@../@../@.
  004044C0: 0C 2F 40 00 06 2F 40 00 00 2F 40 00 FA 2E 40 00  ./@../@../@.ú.@.
  004044D0: F4 2E 40 00 EE 2E 40 00 E8 2E 40 00 E2 2E 40 00  ô.@.î.@.è.@.â.@.
  004044E0: DC 2E 40 00 30 1F 40 00 70 28 40 00 80 28 40 00  Ü[email protected][email protected](@..(@.
  004044F0: 6A 2E 40 00 D0 2E 40 00 CA 2E 40 00 C4 2E 40 00  j.@.Ð.@.Ê.@.Ä.@.
  00404500: BE 2E 40 00 B8 2E 40 00 7C 2E 40 00 64 2E 40 00  ¾.@.¸.@.|[email protected].@.
  00404510: A6 2E 40 00 5E 2E 40 00 28 2E 40 00 E0 1F 40 00  ¦.@.^.@.(.@.à.@.
  00404520: 58 2E 40 00 52 2E 40 00 4C 2E 40 00 46 2E 40 00  [email protected][email protected][email protected].@.
  00404530: 36 2F 40 00 90 28 40 00 B0 1D 40 00 A0 1D 40 00  6/@..(@.°.@...@.
  00404540: B0 1D 40 00 F2 2D 40 00 30 2F 40 00 E6 2D 40 00  °.@.ò[email protected]/@.æ-@.
  00404550: E0 2D 40 00 DA 2D 40 00 D4 2D 40 00 CE 2D 40 00  à-@.Ú-@.Ô-@.Î-@.
  00404560: 2A 2F 40 00 C8 2D 40 00 C2 2D 40 00 BC 2D 40 00  */@.È-@.Â-@.¼-@.
  00404570: B6 2D 40 00 B0 2D 40 00 AA 2D 40 00 A4 2D 40 00  ¶-@.°-@.ª-@.¤-@.
  00404580: 9E 2D 40 00 98 2D 40 00 24 2F 40 00 1E 2F 40 00  [email protected]@.$/@../@.
  00404590: 18 2F 40 00 12 2F 40 00 0C 2F 40 00 06 2F 40 00  ./@../@../@../@.
  004045A0: 00 2F 40 00 FA 2E 40 00 F4 2E 40 00 EE 2E 40 00  ./@.ú.@.ô.@.î.@.
  004045B0: E8 2E 40 00 E2 2E 40 00 DC 2E 40 00 B0 1D 40 00  è.@.â.@.Ü.@.°.@.
  004045C0: 70 28 40 00 80 28 40 00 D6 2E 40 00 D0 2E 40 00  p(@..(@.Ö.@.Ð.@.
  004045D0: CA 2E 40 00 C4 2E 40 00 BE 2E 40 00 B8 2E 40 00  Ê.@.Ä.@.¾.@.¸.@.
  004045E0: B2 2E 40 00 AC 2E 40 00 A6 2E 40 00 A0 2E 40 00  ².@.¬.@.¦.@...@.
  004045F0: 9A 2E 40 00 94 2E 40 00 8E 2E 40 00 88 2E 40 00  ..@...@...@...@.
  00404600: 82 2E 40 00 B0 28 40 00 B0 1D 40 00 A0 1D 40 00  ..@.°(@.°.@...@.
  00404610: B0 1D 40 00 F2 2D 40 00 30 2F 40 00 E6 2D 40 00  °.@.ò[email protected]/@.æ-@.
  00404620: E0 2D 40 00 DA 2D 40 00 D4 2D 40 00 CE 2D 40 00  à-@.Ú-@.Ô-@.Î-@.
  00404630: 2A 2F 40 00 C8 2D 40 00 C2 2D 40 00 BC 2D 40 00  */@.È-@.Â-@.¼-@.
  00404640: B6 2D 40 00 B0 2D 40 00 AA 2D 40 00 A4 2D 40 00  ¶-@.°-@.ª-@.¤-@.
  00404650: 9E 2D 40 00 98 2D 40 00 24 2F 40 00 1E 2F 40 00  [email protected]@.$/@../@.
  00404660: 18 2F 40 00 12 2F 40 00 0C 2F 40 00 06 2F 40 00  ./@../@../@../@.
  00404670: 00 2F 40 00 FA 2E 40 00 F4 2E 40 00 EE 2E 40 00  ./@.ú.@.ô.@.î.@.
  00404680: E8 2E 40 00 E2 2E 40 00 DC 2E 40 00 B0 1D 40 00  è.@.â.@.Ü.@.°.@.
  00404690: 70 28 40 00 80 28 40 00 D6 2E 40 00 D0 2E 40 00  p(@..(@.Ö.@.Ð.@.
  004046A0: CA 2E 40 00 C4 2E 40 00 BE 2E 40 00 B8 2E 40 00  Ê.@.Ä.@.¾.@.¸.@.
  004046B0: 7C 2E 40 00 AC 2E 40 00 A6 2E 40 00 A0 2E 40 00  |.@.¬.@.¦.@...@.
  004046C0: FF FF FF FF 61 31 40 00 75 31 40 00 08 47 40 00  ÿÿÿÿ[email protected]@..G@.
  004046D0: 10 32 40 00 00 00 00 00 90 63 40 00 00 00 00 00  [email protected]@.....
  004046E0: 00 00 00 00 FF FF FF FF 00 00 00 00 00 00 00 00  ....ÿÿÿÿ........
  004046F0: D8 46 40 00 00 00 00 00 00 00 00 00 00 00 00 00  ØF@.............
  00404700: 01 00 00 00 F0 46 40 00 00 00 00 00 00 00 00 00  ....ðF@.........
  00404710: 00 00 00 00 90 63 40 00 F8 46 40 00 00 00 00 00  .....c@.øF@.....
  00404720: 20 05 93 19 08 00 00 00 40 47 40 00 00 00 00 00   .......@G@.....
  00404730: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  00404740: FF FF FF FF F0 32 40 00 FF FF FF FF FB 32 40 00  ÿÿÿÿð2@.ÿÿÿÿû2@.
  00404750: 01 00 00 00 06 33 40 00 02 00 00 00 11 33 40 00  [email protected]@.
  00404760: 03 00 00 00 1C 33 40 00 04 00 00 00 27 33 40 00  .....3@.....'3@.
  00404770: 05 00 00 00 32 33 40 00 06 00 00 00 3D 33 40 00  ....23@.....=3@.
  00404780: 20 05 93 19 07 00 00 00 A0 47 40 00 00 00 00 00   ........G@.....
  00404790: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  004047A0: FF FF FF FF 60 33 40 00 00 00 00 00 68 33 40 00  ÿÿÿÿ`[email protected]@.
  004047B0: 01 00 00 00 73 33 40 00 02 00 00 00 81 33 40 00  [email protected]@.
  004047C0: 03 00 00 00 8F 33 40 00 04 00 00 00 9D 33 40 00  [email protected]@.
  004047D0: 05 00 00 00 AB 33 40 00 20 05 93 19 08 00 00 00  ....«3@. .......
  004047E0: F8 47 40 00 00 00 00 00 00 00 00 00 00 00 00 00  øG@.............
  004047F0: 00 00 00 00 00 00 00 00 FF FF FF FF D0 33 40 00  ........ÿÿÿÿÐ3@.
  00404800: 00 00 00 00 D8 33 40 00 01 00 00 00 E3 33 40 00  ....Ø3@.....ã3@.
  00404810: 02 00 00 00 F1 33 40 00 03 00 00 00 FF 33 40 00  ....ñ3@.....ÿ3@.
  00404820: 04 00 00 00 0D 34 40 00 05 00 00 00 1B 34 40 00  [email protected]@.
  00404830: 06 00 00 00 29 34 40 00 20 05 93 19 08 00 00 00  ....)4@. .......
  00404840: 58 48 40 00 00 00 00 00 00 00 00 00 00 00 00 00  XH@.............
  00404850: 00 00 00 00 00 00 00 00 FF FF FF FF 50 34 40 00  ........ÿÿÿÿP4@.
  00404860: 00 00 00 00 5B 34 40 00 FF FF FF FF 66 34 40 00  ....[4@.ÿÿÿÿf4@.
  00404870: 02 00 00 00 71 34 40 00 03 00 00 00 7C 34 40 00  ....q4@.....|4@.
  00404880: 03 00 00 00 87 34 40 00 FF FF FF FF 92 34 40 00  .....4@.ÿÿÿÿ.4@.
  00404890: 06 00 00 00 9D 34 40 00 20 05 93 19 02 00 00 00  .....4@. .......
  004048A0: B8 48 40 00 00 00 00 00 00 00 00 00 00 00 00 00  ¸H@.............
  004048B0: 00 00 00 00 00 00 00 00 FF FF FF FF C0 34 40 00  ........ÿÿÿÿÀ4@.
  004048C0: 00 00 00 00 C8 34 40 00 20 05 93 19 07 00 00 00  ....È4@. .......
  004048D0: E8 48 40 00 01 00 00 00 20 49 40 00 00 00 00 00  èH@..... I@.....
  004048E0: 00 00 00 00 00 00 00 00 FF FF FF FF E0 34 40 00  ........ÿÿÿÿà4@.
  004048F0: 00 00 00 00 EB 34 40 00 01 00 00 00 00 00 00 00  ....ë4@.........
  00404900: 02 00 00 00 F3 34 40 00 01 00 00 00 00 00 00 00  ....ó4@.........
  00404910: 04 00 00 00 06 35 40 00 FF FF FF FF FB 34 40 00  .....5@.ÿÿÿÿû4@.
  00404920: 02 00 00 00 03 00 00 00 05 00 00 00 01 00 00 00  ................
  00404930: 38 49 40 00 00 00 00 00 00 00 00 00 A0 61 40 00  [email protected]@.
  00404940: 00 00 00 00 DC 27 40 00 20 05 93 19 01 00 00 00  ....Ü'@. .......
  00404950: 68 49 40 00 00 00 00 00 00 00 00 00 00 00 00 00  hI@.............
  00404960: 00 00 00 00 00 00 00 00 FF FF FF FF 20 35 40 00  ........ÿÿÿÿ 5@.
  00404970: BC 4C 00 00 00 00 00 00 00 00 00 00 D6 4C 00 00  ¼L..........ÖL..
  00404980: D4 42 00 00 20 4A 00 00 00 00 00 00 00 00 00 00  ÔB.. J..........
  00404990: E4 4C 00 00 38 40 00 00 14 4C 00 00 00 00 00 00  ä[email protected]......
  004049A0: 00 00 00 00 38 4E 00 00 2C 42 00 00 E8 49 00 00  ....8N..,B..èI..
  004049B0: 00 00 00 00 00 00 00 00 60 4F 00 00 00 40 00 00  ........`O...@..
  004049C0: 8C 4C 00 00 00 00 00 00 00 00 00 00 1E 50 00 00  .L...........P..
  004049D0: A4 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ¤B..............
  004049E0: 00 00 00 00 00 00 00 00 82 4E 00 00 A2 4E 00 00  .........N..¢N..
  004049F0: B0 4E 00 00 C0 4E 00 00 D6 4E 00 00 EA 4E 00 00  °N..ÀN..ÖN..êN..
  00404A00: F8 4E 00 00 08 4F 00 00 16 4F 00 00 24 4F 00 00  øN...O...O..$O..
  00404A10: 3A 4F 00 00 4E 4F 00 00 90 4E 00 00 00 00 00 00  :O..NO...N......
  00404A20: B0 14 00 80 B2 14 00 80 9D 0A 00 80 EA 0F 00 80  °...².......ê...
  00404A30: 54 12 00 80 B7 14 00 80 A5 14 00 80 4E 16 00 80  T...·...¥...N...
  00404A40: A1 0B 00 80 46 0C 00 80 B6 0C 00 80 6B 11 00 80  ¡...F...¶...k...
  00404A50: 3B 0C 00 80 B9 0C 00 80 A4 0B 00 80 04 0C 00 80  ;...¹...¤.......
  00404A60: 9B 0B 00 80 F1 0E 00 80 F2 0E 00 80 EC 0E 00 80  ....ñ...ò...ì...
  00404A70: 02 0C 00 80 EB 0F 00 80 08 12 00 80 42 11 00 80  ....ë.......B...
  00404A80: 95 0E 00 80 31 02 00 80 39 03 00 80 2F 03 00 80  ....1...9.../...
  00404A90: 81 02 00 80 90 02 00 80 68 02 00 80 20 03 00 80  ........h... ...
  00404AA0: CA 09 00 80 35 0A 00 80 6B 04 00 80 AC 04 00 80  Ê...5...k...¬...
  00404AB0: DC 04 00 80 8D 14 00 80 12 11 00 80 EF 12 00 80  Ü...........ï...
  00404AC0: 80 13 00 80 A0 17 00 80 E7 06 00 80 9C 14 00 80  ........ç.......
  00404AD0: 43 11 00 80 08 0E 00 80 31 11 00 80 15 0E 00 80  C.......1.......
  00404AE0: 63 09 00 80 DF 07 00 80 75 10 00 80 0A 0A 00 80  c...ß...u.......
  00404AF0: A3 17 00 80 E9 0F 00 80 E8 06 00 80 0D 0D 00 80  £...é...è.......
  00404B00: 75 14 00 80 49 09 00 80 25 14 00 80 E2 18 00 80  u...I...%...â...
  00404B10: FB 10 00 80 A6 14 00 80 D1 0E 00 80 DF 12 00 80  û...¦...Ñ...ß...
  00404B20: 53 11 00 80 50 0A 00 80 FF 07 00 80 E4 18 00 80  S...P...ÿ...ä...
  00404B30: A0 0E 00 80 C3 13 00 80 B8 06 00 80 89 14 00 80  ....Ã...¸.......
  00404B40: 86 09 00 80 44 08 00 80 99 14 00 80 45 0D 00 80  ....D.......E...
  00404B50: 0D 12 00 80 21 06 00 80 77 04 00 80 8D 04 00 80  ....!...w.......
  00404B60: FA 0A 00 80 5D 03 00 80 1C 02 00 80 37 02 00 80  ú...].......7...
  00404B70: 44 01 00 80 F3 08 00 80 3A 09 00 80 F6 08 00 80  D...ó...:...ö...
  00404B80: 85 10 00 80 BA 18 00 80 33 18 00 80 5A 03 00 80  ....º...3...Z...
  00404B90: 1C 10 00 80 19 02 00 80 AC 03 00 80 43 18 00 80  ........¬...C...
  00404BA0: 1A 02 00 80 60 12 00 80 43 09 00 80 F3 02 00 80  ....`...C...ó...
  00404BB0: D6 01 00 80 1F 0F 00 80 17 02 00 80 99 02 00 80  Ö...............
  00404BC0: B3 07 00 80 ED 18 00 80 61 01 00 80 A6 0D 00 80  ³...í...a...¦...
  00404BD0: CB 09 00 80 63 01 00 80 AD 04 00 80 54 09 00 80  Ë...c...­...T...
  00404BE0: 49 14 00 80 41 04 00 80 4D 0F 00 80 5F 16 00 80  I...A...M..._...
  00404BF0: C8 09 00 80 F2 09 00 80 80 11 00 80 E3 18 00 80  È...ò.......ã...
  00404C00: AD 10 00 80 3B 12 00 80 28 11 00 80 F9 0D 00 80  ­...;...(...ù...
  00404C10: 00 00 00 00 8A 4D 00 00 92 4D 00 00 A0 4D 00 00  .....M...M...M..
  00404C20: A8 4D 00 00 B2 4D 00 00 C4 4D 00 00 D0 4D 00 00  ¨M..²M..ÄM..ÐM..
  00404C30: E4 4D 00 00 F4 4D 00 00 04 4E 00 00 12 4E 00 00  äM..ôM...N...N..
  00404C40: 24 4E 00 00 44 4E 00 00 52 4E 00 00 5C 4E 00 00  $N..DN..RN..\N..
  00404C50: 74 4E 00 00 80 4D 00 00 76 4D 00 00 6C 4D 00 00  tN...M..vM..lM..
  00404C60: 60 4D 00 00 52 4D 00 00 44 4D 00 00 38 4D 00 00  `M..RM..DM..8M..
  00404C70: 24 4D 00 00 1A 4D 00 00 10 4D 00 00 06 4D 00 00  $M...M...M...M..
  00404C80: FC 4C 00 00 F0 4C 00 00 00 00 00 00 C6 4F 00 00  üL..ðL......ÆO..
  00404C90: 6E 4F 00 00 7A 4F 00 00 8A 4F 00 00 96 4F 00 00  nO..zO...O...O..
  00404CA0: A6 4F 00 00 BA 4F 00 00 0E 50 00 00 D8 4F 00 00  ¦O..ºO...P..ØO..
  00404CB0: EC 4F 00 00 FE 4F 00 00 00 00 00 00 C4 4C 00 00  ìO..þO......ÄL..
  00404CC0: 00 00 00 00 19 00 47 65 74 41 64 61 70 74 65 72  ......GetAdapter
  00404CD0: 73 49 6E 66 6F 00 69 70 68 6C 70 61 70 69 2E 64  sInfo.iphlpapi.d
  00404CE0: 6C 6C 00 00 4D 46 43 34 32 75 2E 44 4C 4C 00 00  ll..MFC42u.DLL..
  00404CF0: CB 02 73 77 70 72 69 6E 74 66 00 00 DF 02 77 63  Ë.swprintf..ß.wc
  00404D00: 73 63 61 74 00 00 EB 02 77 63 73 72 63 68 72 00  scat..ë.wcsrchr.
  00404D10: C1 02 73 74 72 6E 63 70 79 00 C0 02 73 74 72 6E  Á.strncpy.À.strn
  00404D20: 63 6D 70 00 49 00 5F 5F 43 78 78 46 72 61 6D 65  cmp.I.__CxxFrame
  00404D30: 48 61 6E 64 6C 65 72 00 EA 01 5F 77 63 73 69 63  Handler.ê._wcsic
  00404D40: 6D 70 00 00 66 00 5F 5F 70 5F 5F 5F 77 61 72 67  mp..f.__p___warg
  00404D50: 76 00 62 00 5F 5F 70 5F 5F 5F 61 72 67 63 00 00  v.b.__p___argc..
  00404D60: D6 02 74 6F 77 75 70 70 65 72 00 00 E1 02 77 63  Ö.towupper..á.wc
  00404D70: 73 63 6D 70 00 00 E6 02 77 63 73 6C 65 6E 00 00  scmp..æ.wcslen..
  00404D80: E9 02 77 63 73 6E 63 70 79 00 D3 00 5F 65 78 69  é.wcsncpy.Ó._exi
  00404D90: 74 00 48 00 5F 58 63 70 74 46 69 6C 74 65 72 00  t.H._XcptFilter.
  00404DA0: 49 02 65 78 69 74 00 00 E7 01 5F 77 63 6D 64 6C  I.exit..ç._wcmdl
  00404DB0: 6E 00 8B 00 5F 5F 77 67 65 74 6D 61 69 6E 61 72  n...__wgetmainar
  00404DC0: 67 73 00 00 0F 01 5F 69 6E 69 74 74 65 72 6D 00  gs...._initterm.
  00404DD0: 83 00 5F 5F 73 65 74 75 73 65 72 6D 61 74 68 65  ..__setusermathe
  00404DE0: 72 72 00 00 9D 00 5F 61 64 6A 75 73 74 5F 66 64  rr...._adjust_fd
  00404DF0: 69 76 00 00 6A 00 5F 5F 70 5F 5F 63 6F 6D 6D 6F  iv..j.__p__commo
  00404E00: 64 65 00 00 6F 00 5F 5F 70 5F 5F 66 6D 6F 64 65  de..o.__p__fmode
  00404E10: 00 00 81 00 5F 5F 73 65 74 5F 61 70 70 5F 74 79  ....__set_app_ty
  00404E20: 70 65 00 00 CA 00 5F 65 78 63 65 70 74 5F 68 61  pe..Ê._except_ha
  00404E30: 6E 64 6C 65 72 33 00 00 4D 53 56 43 52 54 2E 64  ndler3..MSVCRT.d
  00404E40: 6C 6C 00 00 55 00 5F 5F 64 6C 6C 6F 6E 65 78 69  ll..U.__dllonexi
  00404E50: 74 00 86 01 5F 6F 6E 65 78 69 74 00 0E 00 3F 3F  t..._onexit...??
  00404E60: 31 74 79 70 65 5F 69 6E 66 6F 40 40 55 41 45 40  1type_info@@UAE@
  00404E70: 58 5A 00 00 B7 00 5F 63 6F 6E 74 72 6F 6C 66 70  XZ..·._controlfp
  00404E80: 00 00 2E 00 43 6C 6F 73 65 48 61 6E 64 6C 65 00  ....CloseHandle.
  00404E90: 83 00 44 65 76 69 63 65 49 6F 43 6F 6E 74 72 6F  ..DeviceIoContro
  00404EA0: 6C 00 50 00 43 72 65 61 74 65 46 69 6C 65 57 00  l.P.CreateFileW.
  00404EB0: E0 01 47 65 74 56 65 72 73 69 6F 6E 45 78 57 00  à.GetVersionExW.
  00404EC0: 76 01 47 65 74 4D 6F 64 75 6C 65 46 69 6C 65 4E  v.GetModuleFileN
  00404ED0: 61 6D 65 57 00 00 7A 01 47 65 74 4D 6F 64 75 6C  ameW..z.GetModul
  00404EE0: 65 48 61 6E 64 6C 65 57 00 00 F5 01 47 6C 6F 62  eHandleW..õ.Glob
  00404EF0: 61 6C 46 72 65 65 00 00 00 02 47 6C 6F 62 61 6C  alFree....Global
  00404F00: 55 6E 6C 6F 63 6B 00 00 F9 01 47 6C 6F 62 61 6C  Unlock..ù.Global
  00404F10: 4C 6F 63 6B 00 00 EE 01 47 6C 6F 62 61 6C 41 6C  Lock..î.GlobalAl
  00404F20: 6C 6F 63 00 89 03 57 69 64 65 43 68 61 72 54 6F  loc...WideCharTo
  00404F30: 4D 75 6C 74 69 42 79 74 65 00 0F 01 47 65 74 43  MultiByte...GetC
  00404F40: 6F 6D 70 75 74 65 72 4E 61 6D 65 57 00 00 B0 01  omputerNameW..°.
  00404F50: 47 65 74 53 74 61 72 74 75 70 49 6E 66 6F 57 00  GetStartupInfoW.
  00404F60: 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 BE 01  KERNEL32.dll..¾.
  00404F70: 4C 6F 61 64 49 63 6F 6E 57 00 3F 02 53 65 6E 64  LoadIconW.?.Send
  00404F80: 4D 65 73 73 61 67 65 57 00 00 B6 00 44 72 61 77  MessageW..¶.Draw
  00404F90: 49 63 6F 6E 00 00 FF 00 47 65 74 43 6C 69 65 6E  Icon..ÿ.GetClien
  00404FA0: 74 52 65 63 74 00 5D 01 47 65 74 53 79 73 74 65  tRect.].GetSyste
  00404FB0: 6D 4D 65 74 72 69 63 73 00 00 A6 01 49 73 49 63  mMetrics..¦.IsIc
  00404FC0: 6F 6E 69 63 00 00 42 00 43 6C 6F 73 65 43 6C 69  onic..B.CloseCli
  00404FD0: 70 62 6F 61 72 64 00 00 49 02 53 65 74 43 6C 69  pboard..I.SetCli
  00404FE0: 70 62 6F 61 72 64 44 61 74 61 00 00 C1 00 45 6D  pboardData..Á.Em
  00404FF0: 70 74 79 43 6C 69 70 62 6F 61 72 64 00 00 F5 01  ptyClipboard..õ.
  00405000: 4F 70 65 6E 43 6C 69 70 62 6F 61 72 64 00 C4 00  OpenClipboard.Ä.
  00405010: 45 6E 61 62 6C 65 57 69 6E 64 6F 77 00 00 55 53  EnableWindow..US
  00405020: 45 52 33 32 2E 64 6C 6C 00 00                    ER32.dll..
3
  • 1
    Afaik dumpbin will utilize. Pdb and resolve func names try pointing to a symsrv path if possible and check
    – blabb
    Feb 24, 2023 at 4:52
  • 2
    Find the dll load the dll in dumpbin and add rva 4d76 + base and locate the symbol it is. Import table rva which is showm in /raw
    – blabb
    Feb 24, 2023 at 4:54
  • 1
    ?@404d76 the string wcslen is available in the dump you added mfc42u.dll
    – blabb
    Feb 24, 2023 at 12:23

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.