I have the following line (I use IDA PRO) :
... push (offset aPstorec_dllwne+0Ch) ; lpProcName push esi ; hModule call GetProcAddress_0 ...
When I click on (offset aPstorec_dllwne+0Ch) I use:
seg001:004012F0 ; char aPstorec_dllwne aPstorec_dllwne db 'pstorec.dll, 0 , 'WNetEnumCachedPasswords', 0 , 'MPR.DLL' , 0 , 'SeDebugPrivilege', 0 , 0 , 0 , 0
So my question is: How should I read it to get the info which process is meant? I know that each field of an array is 4 byte and the db at the beginning indicates that. But when I count from zero, I come to the 0 after WNetEnumCachedPasswords. It is wrong, right?