search

0xnobody / vmpdump

A dynamic VMP dumper and import fixer, powered by VTIL.
GNU General Public License v3.0
1.12k stars 209 forks source link

Failed to resolve export #12

Open manojdjoshi opened 3 years ago

manojdjoshi commented 3 years ago

i check two exe both fail Successfully opened process XXX.exe, PID 0x13e8 Selected module: D:\XXX\XXX.XXX5\XXX.exe [!] Warning: Division by immediate zero (IDIV). [!] Warning: Division by immediate zero (IDIV). Found 411 calls to 187 imports Successfully resolved export GetUserObjectInformationW in module USER32.dll Successfully resolved export GetSystemMetrics in module USER32.dll Successfully resolved export FindFirstFileW in module KERNEL32.DLL Successfully resolved export WSARecv in module WS2_32.dll Successfully resolved export RegOpenKeyExW in module ADVAPI32.dll Successfully resolved export LocalFileTimeToFileTime in module KERNEL32.DLL Successfully resolved export GetDeviceCaps in module GDI32.dll Successfully resolved export HideCaret in module USER32.dll Successfully resolved export DosDateTimeToFileTime in module KERNEL32.DLL Successfully resolved export SetEvent in module KERNEL32.DLL Successfully resolved export GetUserNameW in module ADVAPI32.dll Successfully resolved export SetBkColor in module GDI32.dll Successfully resolved export GetTextExtentPointW in module GDI32.dll Successfully resolved export CloseHandle in module KERNEL32.DLL Successfully resolved export CreateRectRgn in module GDI32.dll Successfully resolved export TlsSetValue in module KERNEL32.DLL Successfully resolved export GetProcessHeap in module KERNEL32.DLL Successfully resolved export LPtoDP in module GDI32.dll Successfully resolved export CryptReleaseContext in module ADVAPI32.dll Successfully resolved export CryptExportPKCS8 in module CRYPT32.dll Successfully resolved export CertCloseStore in module CRYPT32.dll Successfully resolved export GetFileAttributesW in module KERNEL32.DLL Successfully resolved export LoadLibraryA in module KERNEL32.DLL Successfully resolved export GetEnvironmentVariableW in module KERNEL32.DLL Successfully resolved export DeleteEnhMetaFile in module GDI32.dll Successfully resolved export CreateThread in module KERNEL32.DLL Successfully resolved export GetKeyboardLayout in module USER32.dll Successfully resolved export CreateFileA in module KERNEL32.DLL Successfully resolved export GetObjectW in module GDI32.dll Successfully resolved export ReadFile in module KERNEL32.DLL Successfully resolved export SetCursor in module USER32.dll Successfully resolved export wsprintfW in module USER32.dll Successfully resolved export RegQueryValueExW in module ADVAPI32.dll Successfully resolved export InvalidateRect in module USER32.dll Successfully resolved export MessageBoxW in module USER32.dll Successfully resolved export MapVirtualKeyExW in module USER32.dll Successfully resolved export PostQueuedCompletionStatus in module KERNEL32.DLL Successfully resolved export FindNextFileW in module KERNEL32.DLL Successfully resolved export GetModuleHandleA in module KERNEL32.DLL Successfully resolved export RegOpenKeyExA in module ADVAPI32.dll Successfully resolved export CLSIDFromProgID in module combase.dll Successfully resolved export SQLExecDirectW in module ODBC32.dll Successfully resolved export RtlUnwindEx in module KERNEL32.DLL Successfully resolved export IsDebuggerPresent in module KERNEL32.DLL Successfully resolved export DeleteDC in module GDI32.dll Successfully resolved export PostMessageW in module USER32.dll Successfully resolved export GetFullPathNameW in module KERNEL32.DLL Successfully resolved export SetFilePointer in module KERNEL32.DLL Successfully resolved export IsProcessorFeaturePresent in module KERNEL32.DLL Successfully resolved export SetConsoleMode in module KERNEL32.DLL Successfully resolved export GetCPInfo in module KERNEL32.DLL Successfully resolved export getsockname in module WS2_32.dll Failed to resolve export for export 0x00007FF6A06EF6DA in module XXX.exe Successfully resolved export SendMessageW in module USER32.dll Successfully resolved export ClosePrinter in module WINSPOOL.DRV Successfully resolved export FlsSetValue in module KERNEL32.DLL Successfully resolved export ControlService in module ADVAPI32.dll Successfully resolved export SetStretchBltMode in module GDI32.dll Successfully resolved export CombineRgn in module GDI32.dll Successfully resolved export InternetReadFile in module WININET.dll Successfully resolved export AcceptEx in module MSWSOCK.DLL Successfully resolved export GetLastError in module KERNEL32.DLL Successfully resolved export gethostbyname in module WS2_32.dll Successfully resolved export EnumDisplaySettingsW in module USER32.dll Successfully resolved export InternetCloseHandle in module WININET.dll Successfully resolved export RegQueryValueExA in module ADVAPI32.dll Successfully resolved export WSAGetLastError in module WS2_32.dll Successfully resolved export GetLocalTime in module KERNEL32.DLL Successfully resolved export Sleep in module KERNEL32.DLL Successfully resolved export SHGetSpecialFolderPathW in module SHELL32.dll Successfully resolved export getservbyname in module WS2_32.dll Successfully resolved export CoCreateInstance in module combase.dll Successfully resolved export ReadConsoleW in module KERNEL32.DLL Successfully resolved export StretchBlt in module GDI32.dll Successfully resolved export RtlVirtualUnwind in module KERNEL32.DLL Successfully resolved export GetTickCount in module KERNEL32.DLL Successfully resolved export ntohl in module WS2_32.dll Successfully resolved export LoadLibraryW in module KERNEL32.DLL Failed to resolve export for export 0x00007FF6A0B18FD3 in module XXX.exe Successfully resolved export RtlAllocateHeap in module ntdll.dll Successfully resolved export LockResource in module KERNEL32.DLL Successfully resolved export InternetCanonicalizeUrlW in module WININET.dll Successfully resolved export SetUnhandledExceptionFilter in module KERNEL32.DLL Successfully resolved export MultiByteToWideChar in module KERNEL32.DLL Successfully resolved export GetWindowRect in module USER32.dll Successfully resolved export GlobalUnlock in module KERNEL32.DLL Successfully resolved export SetTextJustification in module GDI32.dll Successfully resolved export GetComputerNameW in module KERNEL32.DLL Successfully resolved export SysFreeString in module OLEAUT32.dll Successfully resolved export LoadLibraryA in module KERNEL32.DLL Successfully resolved export GetClientRect in module USER32.dll Successfully resolved export RtlLeaveCriticalSection in module ntdll.dll Successfully resolved export RtlEncodePointer in module ntdll.dll Successfully resolved export GetModuleHandleW in module KERNEL32.DLL Successfully resolved export PlayEnhMetaFileRecord in module GDI32.dll Successfully resolved export FormatMessageW in module KERNEL32.DLL Successfully resolved export SetRectRgn in module GDI32.dll Successfully resolved export CreateDirectoryW in module KERNEL32.DLL Successfully resolved export RegCloseKey in module ADVAPI32.dll Successfully resolved export SetFileAttributesW in module KERNEL32.DLL Successfully resolved export CreateIoCompletionPort in module KERNEL32.DLL Successfully resolved export GetProcAddress in module KERNEL32.DLL Successfully resolved export setsockopt in module WSOCK32.dll Successfully resolved export SetWindowTextW in module USER32.dll Successfully resolved export GetTempPathW in module KERNEL32.DLL Successfully resolved export InternetFindNextFileW in module WININET.dll Successfully resolved export bind in module WS2_32.dll Successfully resolved export WriteFile in module KERNEL32.DLL Successfully resolved export MoveWindow in module USER32.dll Successfully resolved export RtlDeleteCriticalSection in module ntdll.dll Successfully resolved export OpenClipboard in module USER32.dll Successfully resolved export FindFirstFileExW in module KERNEL32.DLL Successfully resolved export GetModuleHandleW in module KERNEL32.DLL Successfully resolved export ShowWindow in module USER32.dll Successfully resolved export FreeLibrary in module KERNEL32.DLL Successfully resolved export GetDC in module USER32.dll Successfully resolved export GetCurrentProcessId in module KERNEL32.DLL Successfully resolved export FreeEnvironmentStringsA in module KERNEL32.DLL Successfully resolved export SQLFreeStmt in module ODBC32.dll Successfully resolved export SetRect in module USER32.dll Successfully resolved export RegEnumKeyExA in module ADVAPI32.dll Successfully resolved export DeviceIoControl in module KERNEL32.DLL Successfully resolved export CreateToolhelp32Snapshot in module KERNEL32.DLL Successfully resolved export WaitForSingleObject in module KERNEL32.DLL Successfully resolved export FileTimeToLocalFileTime in module KERNEL32.DLL Successfully resolved export RegDeleteValueW in module ADVAPI32.dll Successfully resolved export SetEnvironmentVariableW in module KERNEL32.DLL Successfully resolved export RegDeleteKeyExA in module ADVAPI32.dll Successfully resolved export CreateCompatibleDC in module GDI32.dll Successfully resolved export GetKeyState in module USER32.dll Successfully resolved export SetUnhandledExceptionFilter in module KERNEL32.DLL Successfully resolved export SelectObject in module GDI32.dll Successfully resolved export CertOpenSystemStoreW in module CRYPT32.dll Successfully resolved export QueryServiceStatus in module ADVAPI32.dll Successfully resolved export SysAllocString in module OLEAUT32.dll Successfully resolved export CreateFileW in module KERNEL32.DLL Successfully resolved export SetSecurityDescriptorDacl in module ADVAPI32.dll Successfully resolved export ResetEvent in module KERNEL32.DLL Successfully resolved export OpenSCManagerW in module ADVAPI32.dll Successfully resolved export CreateServiceW in module ADVAPI32.dll Successfully resolved export FillRect in module USER32.dll Successfully resolved export SetStdHandle in module KERNEL32.DLL Successfully resolved export LocalFree in module KERNEL32.DLL Successfully resolved export GetEnvironmentStringsW in module KERNEL32.DLL Successfully resolved export GetCurrentProcess in module KERNEL32.DLL Successfully resolved export RtlLeaveCriticalSection in module ntdll.dll Successfully resolved export OpenServiceW in module ADVAPI32.dll Successfully resolved export VerQueryValueA in module VERSION.dll Successfully resolved export BeginPaint in module USER32.dll Successfully resolved export FrameRect in module USER32.dll Successfully resolved export GetLastError in module KERNEL32.DLL Successfully resolved export CloseServiceHandle in module ADVAPI32.dll Successfully resolved export OpenProcess in module KERNEL32.DLL Successfully resolved export RealizePalette in module GDI32.dll Successfully resolved export RtlEnterCriticalSection in module ntdll.dll Successfully resolved export FreeLibraryAndExitThread in module KERNEL32.DLL Successfully resolved export GetAcceptExSockaddrs in module MSWSOCK.DLL Successfully resolved export InternetSetOptionW in module WININET.dll Successfully resolved export GetModuleFileNameW in module KERNEL32.DLL Successfully resolved export GetExitCodeThread in module KERNEL32.DLL Successfully resolved export SetGraphicsMode in module GDI32.dll Successfully resolved export RegSetValueExA in module ADVAPI32.dll Successfully resolved export CoCreateGuid in module combase.dll Successfully resolved export MultiByteToWideChar in module KERNEL32.DLL Successfully resolved export GetStockObject in module GDI32.dll Successfully resolved export WSASetLastError in module WS2_32.dll Successfully resolved export CreateProcessW in module KERNEL32.DLL Successfully resolved export RtlUnwindEx in module KERNEL32.DLL Successfully resolved export closesocket in module WS2_32.dll Successfully resolved export CreateFontIndirectW in module GDI32.dll Successfully resolved export PathFindFileNameW in module SHLWAPI.dll Successfully resolved export shutdown in module WS2_32.dll Successfully resolved export SetTextCharacterExtra in module GDI32.dll Successfully resolved export WideCharToMultiByte in module KERNEL32.DLL Successfully resolved export DeleteObject in module GDI32.dll Successfully resolved export FindClose in module KERNEL32.DLL Successfully resolved export LoadCursorW in module USER32.dll Successfully resolved export SetEnhMetaFileBits in module GDI32.dll Successfully resolved export IsValidSid in module ADVAPI32.dll Successfully resolved export SetLastError in module KERNEL32.DLL Successfully resolved export GetTextFaceW in module GDI32.dll Successfully resolved export CryptAcquireContextW in module ADVAPI32.dll Successfully resolved export MoveFileW in module KERNEL32.DLL Successfully resolved export RtlEnterCriticalSection in module ntdll.dll Successfully resolved export CreateEventW in module KERNEL32.DLL Successfully resolved export recvfrom in module WSOCK32.dll Successfully resolved export SQLFetch in module ODBC32.dll Converting 411 calls Successfully converted call @ RVA 0x14fa to thunk @ RVA 0x1608500 Successfully converted call @ RVA 0x1682 to thunk @ RVA 0x16082f8 Successfully converted call @ RVA 0x10c63 to thunk @ RVA 0x16086c8 Successfully converted call @ RVA 0x16673 to thunk @ RVA 0x16086c8 Successfully converted call @ RVA 0x363df to thunk @ RVA 0x1608590 Successfully converted call @ RVA 0x45ed4 to thunk @ RVA 0x16086e8 Successfully converted call @ RVA 0x45f4d to thunk @ RVA 0x16086e8 Successfully converted call @ RVA 0xa669e to thunk @ RVA 0x1608578 Successfully converted call @ RVA 0xa68d1 to thunk @ RVA 0x0 Successfully converted call @ RVA 0xa68f1 to thunk @ RVA 0x1608578 Successfully converted call @ RVA 0xa6ddd to thunk @ RVA 0x1608570 Successfully converted call @ RVA 0xc64ae to thunk @ RVA 0x1608600 Successfully converted call @ RVA 0xc64f3 to thunk @ RVA 0x16085d8 Successfully converted call @ RVA 0xc6505 to thunk @ RVA 0x16085d8 Successfully converted call @ RVA 0xf7827 to thunk @ RVA 0x1608568 Successfully converted call @ RVA 0x10c75b to thunk @ RVA 0x1608568 Successfully converted call @ RVA 0x119e3b to thunk @ RVA 0x1608608 Successfully converted call @ RVA 0x12e2fa to thunk @ RVA 0x1608378 Successfully converted call @ RVA 0x1498fe to thunk @ RVA 0x1608628 Successfully converted call @ RVA 0x149932 to thunk @ RVA 0x16084a8 Successfully converted call @ RVA 0x14a398 to thunk @ RVA 0x1608628 Successfully converted call @ RVA 0x16d346 to thunk @ RVA 0x1608608 Successfully converted call @ RVA 0x16d3b8 to thunk @ RVA 0x1608608 Successfully converted call @ RVA 0x176d38 to thunk @ RVA 0x1608718 Successfully converted call @ RVA 0x1e97c0 to thunk @ RVA 0x1608518 Successfully converted call @ RVA 0x218420 to thunk @ RVA 0x1608660 Successfully converted call @ RVA 0x226aa1 to thunk @ RVA 0x16081d8 Successfully converted call @ RVA 0x27a2c0 to thunk @ RVA 0x1608418 Successfully converted call @ RVA 0x27a5e7 to thunk @ RVA 0x1608458 Successfully converted call @ RVA 0x27aeff to thunk @ RVA 0x1608420 Successfully converted call @ RVA 0x27c438 to thunk @ RVA 0x1608758 Successfully converted call @ RVA 0x27d250 to thunk @ RVA 0x1608780 Successfully converted call @ RVA 0x280bf8 to thunk @ RVA 0x16082c0 Successfully converted call @ RVA 0x280c2c to thunk @ RVA 0x16082c0 Successfully converted call @ RVA 0x287c38 to thunk @ RVA 0x16083d8 Successfully converted call @ RVA 0x2a7645 to thunk @ RVA 0x1608628 Successfully converted call @ RVA 0x2cd3e5 to thunk @ RVA 0x1608518 Successfully converted call @ RVA 0x2d2b57 to thunk @ RVA 0x16084c0 Successfully converted call @ RVA 0x2ddab1 to thunk @ RVA 0x1608390 Successfully converted call @ RVA 0x2f92a3 to thunk @ RVA 0x1608720 Successfully converted call @ RVA 0x301150 to thunk @ RVA 0x1608468 Successfully converted call @ RVA 0x301195 to thunk @ RVA 0x0 Successfully converted call @ RVA 0x3011ca to thunk @ RVA 0x1608580 Successfully converted call @ RVA 0x3017f8 to thunk @ RVA 0x1608700 Successfully converted call @ RVA 0x3025f3 to thunk @ RVA 0x1608450 Successfully converted call @ RVA 0x3070ff to thunk @ RVA 0x1608570 Successfully converted call @ RVA 0x3075d9 to thunk @ RVA 0x1608608 Successfully converted call @ RVA 0x33a5d2 to thunk @ RVA 0x1608420 Successfully converted call @ RVA 0x33a706 to thunk @ RVA 0x16083b0 Successfully converted call @ RVA 0x33b08d to thunk @ RVA 0x16083f0 Successfully converted call @ RVA 0x33b628 to thunk @ RVA 0x16083c0 Successfully converted call @ RVA 0x33b907 to thunk @ RVA 0x1608448 Successfully converted call @ RVA 0x33bab5 to thunk @ RVA 0x16083d0 Successfully converted call @ RVA 0x33bfa7 to thunk @ RVA 0x1608740 Successfully converted call @ RVA 0x33bffa to thunk @ RVA 0x1608708 Successfully converted call @ RVA 0x33c036 to thunk @ RVA 0x16086f8 Successfully converted call @ RVA 0x33c287 to thunk @ RVA 0x16083b8 Successfully converted call @ RVA 0x33c4da to thunk @ RVA 0x1608428 Successfully converted call @ RVA 0x33c825 to thunk @ RVA 0x16083f8 Successfully converted call @ RVA 0x33c9a9 to thunk @ RVA 0x1608778 Successfully converted call @ RVA 0x34b825 to thunk @ RVA 0x1608770 Successfully converted call @ RVA 0x34b890 to thunk @ RVA 0x1608738 Successfully converted call @ RVA 0x34bb50 to thunk @ RVA 0x1608750 Successfully converted call @ RVA 0x34bbd8 to thunk @ RVA 0x1608738 Successfully converted call @ RVA 0x34d0fc to thunk @ RVA 0x1608450 Successfully converted call @ RVA 0x356247 to thunk @ RVA 0x1608390 Successfully converted call @ RVA 0x3564d7 to thunk @ RVA 0x1608390 Successfully converted call @ RVA 0x369d46 to thunk @ RVA 0x1608418 Successfully converted call @ RVA 0x36a02d to thunk @ RVA 0x16083c8 Successfully converted call @ RVA 0x36a1d6 to thunk @ RVA 0x16085d8 Successfully converted call @ RVA 0x36a20f to thunk @ RVA 0x16085d8 Successfully converted call @ RVA 0x36a235 to thunk @ RVA 0x1608600 Successfully converted call @ RVA 0x36a2d2 to thunk @ RVA 0x16085d8 Successfully converted call @ RVA 0x36a2eb to thunk @ RVA 0x16085d8 Successfully converted call @ RVA 0x3736cf to thunk @ RVA 0x16082c0 Successfully converted call @ RVA 0x37380c to thunk @ RVA 0x16082f8 Successfully converted call @ RVA 0x3738a6 to thunk @ RVA 0x16082f8 Successfully converted call @ RVA 0x373b92 to thunk @ RVA 0x16082d8 Successfully converted call @ RVA 0x37489c to thunk @ RVA 0x1608748 Successfully converted call @ RVA 0x37515d to thunk @ RVA 0x1608788 Successfully converted call @ RVA 0x375922 to thunk @ RVA 0x1608750 Successfully converted call @ RVA 0x375934 to thunk @ RVA 0x1608790 !! Stack adjustment failed for call @ RVA 0x375a5a for thunk @ 0x7ff6a0d58430 Failed to convert call @ RVA 0x375a5a Successfully converted call @ RVA 0x3782e9 to thunk @ RVA 0x1608408 Successfully converted call @ RVA 0x3788bf to thunk @ RVA 0x16086f0 Successfully converted call @ RVA 0x38c05e to thunk @ RVA 0x16085a0 Successfully converted call @ RVA 0x38cabd to thunk @ RVA 0x16082f8 Successfully converted call @ RVA 0x38d786 to thunk @ RVA 0x16082f8 Successfully converted call @ RVA 0x38e016 to thunk @ RVA 0x1608428 Successfully converted call @ RVA 0x38e89a to thunk @ RVA 0x16083e0 Successfully converted call @ RVA 0x38e9fa to thunk @ RVA 0x1608400 Successfully converted call @ RVA 0x38ef3b to thunk @ RVA 0x1608580 Successfully converted call @ RVA 0x38fb29 to thunk @ RVA 0x0 Successfully converted call @ RVA 0x38fb4d to thunk @ RVA 0x0 Successfully converted call @ RVA 0x38fbb1 to thunk @ RVA 0x0 Successfully converted call @ RVA 0x390f1e to thunk @ RVA 0x1608600 Successfully converted call @ RVA 0x390ff1 to thunk @ RVA 0x16087a8 Successfully converted call @ RVA 0x391bc2 to thunk @ RVA 0x16082c0 Successfully converted call @ RVA 0x393074 to thunk @ RVA 0x16085e0 Successfully converted call @ RVA 0x396553 to thunk @ RVA 0x16083a0 Successfully converted call @ RVA 0x3a39cd to thunk @ RVA 0x1608518 Successfully converted call @ RVA 0x3a41d7 to thunk @ RVA 0x1608478 Successfully converted call @ RVA 0x3afe0d to thunk @ RVA 0x1608768 Successfully converted call @ RVA 0x3aff4d to thunk @ RVA 0x1608598 Successfully converted call @ RVA 0x3b1c3b to thunk @ RVA 0x16084a0 Successfully converted call @ RVA 0x3b1d70 to thunk @ RVA 0x16084a0 Successfully converted call @ RVA 0x3b2a44 to thunk @ RVA 0x16086d8 Successfully converted call @ RVA 0x3c2e6b to thunk @ RVA 0x1608418 Successfully converted call @ RVA 0x3cc926 to thunk @ RVA 0x16083c8 Successfully converted call @ RVA 0x3ccede to thunk @ RVA 0x16087a0 Successfully converted call @ RVA 0x3f289f to thunk @ RVA 0x1608428 Successfully converted call @ RVA 0x3f2920 to thunk @ RVA 0x1608428 Successfully converted call @ RVA 0x3f29ab to thunk @ RVA 0x1608440 Successfully converted call @ RVA 0x3f2c09 to thunk @ RVA 0x1608428 Successfully converted call @ RVA 0x3f2c46 to thunk @ RVA 0x1608428 Successfully converted call @ RVA 0x3f493e to thunk @ RVA 0x1608788 Successfully converted call @ RVA 0x3f59cc to thunk @ RVA 0x16083e8 Successfully converted call @ RVA 0x3f5ab9 to thunk @ RVA 0x1608428 Successfully converted call @ RVA 0x3f5bdb to thunk @ RVA 0x1608420 Successfully converted call @ RVA 0x3f5f84 to thunk @ RVA 0x1608438 Successfully converted call @ RVA 0x3f6099 to thunk @ RVA 0x1608428 Successfully converted call @ RVA 0x3f6105 to thunk @ RVA 0x16083d8 Successfully converted call @ RVA 0x3f65e4 to thunk @ RVA 0x1608750 Successfully converted call @ RVA 0x3f6e1d to thunk @ RVA 0x1608460 Successfully converted call @ RVA 0x3f7089 to thunk @ RVA 0x1608440 Successfully converted call @ RVA 0x3f70de to thunk @ RVA 0x16083e8 Successfully converted call @ RVA 0x3f71e3 to thunk @ RVA 0x1608760 Successfully converted call @ RVA 0x3f74d9 to thunk @ RVA 0x1608410 Successfully converted call @ RVA 0x3f7b22 to thunk @ RVA 0x1608730 Successfully converted call @ RVA 0x3f7e08 to thunk @ RVA 0x1608730 Successfully converted call @ RVA 0x3f81f8 to thunk @ RVA 0x1608798 Successfully converted call @ RVA 0x3f9020 to thunk @ RVA 0x1608518 Successfully converted call @ RVA 0x3fb4e2 to thunk @ RVA 0x16085b0 Successfully converted call @ RVA 0x3fb5b1 to thunk @ RVA 0x16084a8 Successfully converted call @ RVA 0x3fc0cb to thunk @ RVA 0x16085d8 Successfully converted call @ RVA 0x3fc130 to thunk @ RVA 0x16085b0 Successfully converted call @ RVA 0x3fd24a to thunk @ RVA 0x1608608 Successfully converted call @ RVA 0x3fd25a to thunk @ RVA 0x1608680 Successfully converted call @ RVA 0x3fd68c to thunk @ RVA 0x16085d8 Successfully converted call @ RVA 0x3fd6d5 to thunk @ RVA 0x1608608 Successfully converted call @ RVA 0x3fd6e4 to thunk @ RVA 0x1608680 Successfully converted call @ RVA 0x3ff62c to thunk @ RVA 0x1608558 !! Stack adjustment failed for call @ RVA 0x4007d9 for thunk @ 0x7ff6a0d58548 Failed to convert call @ RVA 0x4007d9 Successfully converted call @ RVA 0x4012fa to thunk @ RVA 0x1608680 Successfully converted call @ RVA 0x40135f to thunk @ RVA 0x1608608 Successfully converted call @ RVA 0x402668 to thunk @ RVA 0x16085d8 Successfully converted call @ RVA 0x4093d6 to thunk @ RVA 0x1608728 Successfully converted call @ RVA 0x4428bd to thunk @ RVA 0x16082d8 Successfully converted call @ RVA 0x443e0f to thunk @ RVA 0x16084a8 Successfully converted call @ RVA 0x44bc28 to thunk @ RVA 0x16083c0 Successfully converted call @ RVA 0x44bdf8 to thunk @ RVA 0x1608458 Successfully converted call @ RVA 0x455c18 to thunk @ RVA 0x1608588 Successfully converted call @ RVA 0x45ec61 to thunk @ RVA 0x16085c8 Successfully converted call @ RVA 0x45ee74 to thunk @ RVA 0x1608690 Successfully converted call @ RVA 0x45f804 to thunk @ RVA 0x1608648 Successfully converted call @ RVA 0x45fb69 to thunk @ RVA 0x16081d0 Successfully converted call @ RVA 0x45fb81 to thunk @ RVA 0x16081d0 Successfully converted call @ RVA 0x45fb9d to thunk @ RVA 0x16081d0 Successfully converted call @ RVA 0x45fcae to thunk @ RVA 0x1608488 Successfully converted call @ RVA 0x46016b to thunk @ RVA 0x16081d0 Successfully converted call @ RVA 0x460469 to thunk @ RVA 0x1608548 Successfully converted call @ RVA 0x460902 to thunk @ RVA 0x16084f8 Successfully converted call @ RVA 0x460b24 to thunk @ RVA 0x16081e0 Successfully converted call @ RVA 0x460b5a to thunk @ RVA 0x16081d0 Successfully converted call @ RVA 0x46f489 to thunk @ RVA 0x1608370 Successfully converted call @ RVA 0x474943 to thunk @ RVA 0x1608548 Successfully converted call @ RVA 0x47541c to thunk @ RVA 0x1608520 Successfully converted call @ RVA 0x47625e to thunk @ RVA 0x1608578 Successfully converted call @ RVA 0x476336 to thunk @ RVA 0x1608600 Successfully converted call @ RVA 0x478d97 to thunk @ RVA 0x1608548 Successfully converted call @ RVA 0x4793f3 to thunk @ RVA 0x16081d0 Successfully converted call @ RVA 0x47a153 to thunk @ RVA 0x16081e8 !! Stack adjustment failed for call @ RVA 0x47a4e2 for thunk @ 0x7ff6a0d58548 Failed to convert call @ RVA 0x47a4e2 Successfully converted call @ RVA 0x47aaec to thunk @ RVA 0x16081c8 Successfully converted call @ RVA 0x47b5ec to thunk @ RVA 0x0 Successfully converted call @ RVA 0x47dc10 to thunk @ RVA 0x1608498 Successfully converted call @ RVA 0x47dc29 to thunk @ RVA 0x1608490 Successfully converted call @ RVA 0x47e698 to thunk @ RVA 0x1608630 Successfully converted call @ RVA 0x4a11d5 to thunk @ RVA 0x1608388 Successfully converted call @ RVA 0x4a13d7 to thunk @ RVA 0x1608388 Successfully converted call @ RVA 0x4a1845 to thunk @ RVA 0x1608390 Successfully converted call @ RVA 0x4a3d9f to thunk @ RVA 0x1608368 Successfully converted call @ RVA 0x4aa90f to thunk @ RVA 0x16086d0 Successfully converted call @ RVA 0x4bdb41 to thunk @ RVA 0x1608278 Successfully converted call @ RVA 0x4c8f3d to thunk @ RVA 0x1608550 Successfully converted call @ RVA 0x4e4d62 to thunk @ RVA 0x1608288 Successfully converted call @ RVA 0x4e5235 to thunk @ RVA 0x16085d8 Successfully converted call @ RVA 0x4e6ccb to thunk @ RVA 0x16082a0 Successfully converted call @ RVA 0x4e6cd5 to thunk @ RVA 0x1608548 Successfully converted call @ RVA 0x4e7170 to thunk @ RVA 0x16082a8 Successfully converted call @ RVA 0x4e8566 to thunk @ RVA 0x1608248 Successfully converted call @ RVA 0x4e875e to thunk @ RVA 0x1608250 Successfully converted call @ RVA 0x4e87b7 to thunk @ RVA 0x1608258 Successfully converted call @ RVA 0x4eb0e3 to thunk @ RVA 0x1608548 Successfully converted call @ RVA 0x4ec212 to thunk @ RVA 0x16085b8 Successfully converted call @ RVA 0x4ec766 to thunk @ RVA 0x16082b0 Successfully converted call @ RVA 0x4edae1 to thunk @ RVA 0x16084a0 Successfully converted call @ RVA 0x4ef2ef to thunk @ RVA 0x16084f0 Successfully converted call @ RVA 0x4efc34 to thunk @ RVA 0x1608298 Successfully converted call @ RVA 0x4efe88 to thunk @ RVA 0x1608280 Successfully converted call @ RVA 0x4efed0 to thunk @ RVA 0x1608280 Successfully converted call @ RVA 0x4f0769 to thunk @ RVA 0x1608628 Successfully converted call @ RVA 0x4f077d to thunk @ RVA 0x1608698 Successfully converted call @ RVA 0x4f0af9 to thunk @ RVA 0x1608280 Successfully converted call @ RVA 0x4f19a3 to thunk @ RVA 0x1608698 Successfully converted call @ RVA 0x4f19e1 to thunk @ RVA 0x16084a8 Successfully converted call @ RVA 0x4f1f58 to thunk @ RVA 0x1608280 Successfully converted call @ RVA 0x4f20e7 to thunk @ RVA 0x16085d0 Successfully converted call @ RVA 0x4f2508 to thunk @ RVA 0x1608628 Successfully converted call @ RVA 0x4f2a9d to thunk @ RVA 0x1608218 Successfully converted call @ RVA 0x4f3094 to thunk @ RVA 0x1608268 Successfully converted call @ RVA 0x4f38f3 to thunk @ RVA 0x16084a0 Successfully converted call @ RVA 0x4f5299 to thunk @ RVA 0x1608570 Successfully converted call @ RVA 0x4f6319 to thunk @ RVA 0x16084d8 Successfully converted call @ RVA 0x4f6ed1 to thunk @ RVA 0x1608280 Successfully converted call @ RVA 0x4fce2f to thunk @ RVA 0x16085b0 Successfully converted call @ RVA 0x4fd151 to thunk @ RVA 0x16085b0 Successfully converted call @ RVA 0x4fd1a2 to thunk @ RVA 0x16085d8 Successfully converted call @ RVA 0x4fdc98 to thunk @ RVA 0x1608608 Successfully converted call @ RVA 0x4fde61 to thunk @ RVA 0x16085b0 Successfully converted call @ RVA 0x4fe237 to thunk @ RVA 0x1608680 Successfully converted call @ RVA 0x4fe3ae to thunk @ RVA 0x16084a8 Successfully converted call @ RVA 0x4fe6b5 to thunk @ RVA 0x1608680 Successfully converted call @ RVA 0x4fe9c4 to thunk @ RVA 0x16085d8 Successfully converted call @ RVA 0x4feb15 to thunk @ RVA 0x16085b0 Successfully converted call @ RVA 0x4febae to thunk @ RVA 0x1608680 Successfully converted call @ RVA 0x4fec9c to thunk @ RVA 0x1608680 Successfully converted call @ RVA 0x4fed70 to thunk @ RVA 0x16085b0 Successfully converted call @ RVA 0x4feddb to thunk @ RVA 0x1608680 Successfully converted call @ RVA 0x4fee1c to thunk @ RVA 0x16085b0 Successfully converted call @ RVA 0x4ff447 to thunk @ RVA 0x1608570 Successfully converted call @ RVA 0x4ffe87 to thunk @ RVA 0x1608548 Successfully converted call @ RVA 0x4ffed0 to thunk @ RVA 0x16082e8 Successfully converted call @ RVA 0x500027 to thunk @ RVA 0x1608330 Successfully converted call @ RVA 0x50008d to thunk @ RVA 0x1608578 Successfully converted call @ RVA 0x5000a5 to thunk @ RVA 0x16085d8 Successfully converted call @ RVA 0x5000d7 to thunk @ RVA 0x1608340 Successfully converted call @ RVA 0x5002cf to thunk @ RVA 0x1608548 Successfully converted call @ RVA 0x500320 to thunk @ RVA 0x1608318 Successfully converted call @ RVA 0x5003f5 to thunk @ RVA 0x1608548 Successfully converted call @ RVA 0x5007e4 to thunk @ RVA 0x1608338 Successfully converted call @ RVA 0x500823 to thunk @ RVA 0x1608340 Successfully converted call @ RVA 0x50087f to thunk @ RVA 0x1608340 Successfully converted call @ RVA 0x500997 to thunk @ RVA 0x1608548 Successfully converted call @ RVA 0x500adf to thunk @ RVA 0x16082e8 Successfully converted call @ RVA 0x500af2 to thunk @ RVA 0x1608548 Successfully converted call @ RVA 0x5011f0 to thunk @ RVA 0x1608308 Successfully converted call @ RVA 0x501236 to thunk @ RVA 0x16082f8 Successfully converted call @ RVA 0x502e77 to thunk @ RVA 0x1608778 Successfully converted call @ RVA 0x502ed6 to thunk @ RVA 0x1608448 Successfully converted call @ RVA 0x51a17d to thunk @ RVA 0x16084c0 Successfully converted call @ RVA 0x5206ca to thunk @ RVA 0x1608710 Successfully converted call @ RVA 0x522006 to thunk @ RVA 0x1608680 Successfully converted call @ RVA 0x525c6d to thunk @ RVA 0x1608550 Successfully converted call @ RVA 0x525cc4 to thunk @ RVA 0x1608550 Successfully converted call @ RVA 0x528eb5 to thunk @ RVA 0x16085d8 Successfully converted call @ RVA 0x52ef68 to thunk @ RVA 0x16085d8 Successfully converted call @ RVA 0x5385ae to thunk @ RVA 0x16082a0 Successfully converted call @ RVA 0x53b0a8 to thunk @ RVA 0x16082d8 Successfully converted call @ RVA 0x53b74b to thunk @ RVA 0x16084a0 Successfully converted call @ RVA 0x53b76c to thunk @ RVA 0x16084a8 Successfully converted call @ RVA 0x53b8e6 to thunk @ RVA 0x16084a0 Successfully converted call @ RVA 0x53b9e9 to thunk @ RVA 0x1608650 Successfully converted call @ RVA 0x53bd78 to thunk @ RVA 0x1608358 Successfully converted call @ RVA 0x53bda3 to thunk @ RVA 0x16082d0 Successfully converted call @ RVA 0x53c412 to thunk @ RVA 0x16085d8 Successfully converted call @ RVA 0x53c53e to thunk @ RVA 0x16086c0 Successfully converted call @ RVA 0x53de57 to thunk @ RVA 0x16084c8 Successfully converted call @ RVA 0x53e16a to thunk @ RVA 0x1608300 Successfully converted call @ RVA 0x53ef03 to thunk @ RVA 0x16082f8 Successfully converted call @ RVA 0x53f134 to thunk @ RVA 0x16082f8 Successfully converted call @ RVA 0x53f249 to thunk @ RVA 0x16082e0 Successfully converted call @ RVA 0x53f507 to thunk @ RVA 0x1608300 Successfully converted call @ RVA 0x53f5ad to thunk @ RVA 0x16082f8 Successfully converted call @ RVA 0x53fe9f to thunk @ RVA 0x0 Successfully converted call @ RVA 0x540224 to thunk @ RVA 0x1608608 Successfully converted call @ RVA 0x540895 to thunk @ RVA 0x16082f8 Successfully converted call @ RVA 0x540cb5 to thunk @ RVA 0x16085d8 Successfully converted call @ RVA 0x540f57 to thunk @ RVA 0x16085d8 Successfully converted call @ RVA 0x54235a to thunk @ RVA 0x1608558 Successfully converted call @ RVA 0x542bba to thunk @ RVA 0x16086a8 Successfully converted call @ RVA 0x5440ae to thunk @ RVA 0x1608328 Successfully converted call @ RVA 0x544b4c to thunk @ RVA 0x16085c0 Successfully converted call @ RVA 0x544f08 to thunk @ RVA 0x16082c8 Successfully converted call @ RVA 0x544fa0 to thunk @ RVA 0x16085d8 Successfully converted call @ RVA 0x555282 to thunk @ RVA 0x16082e0 Successfully converted call @ RVA 0x5552b3 to thunk @ RVA 0x1608300 Successfully converted call @ RVA 0x555828 to thunk @ RVA 0x1608300 Successfully converted call @ RVA 0x555863 to thunk @ RVA 0x16082e0 Successfully converted call @ RVA 0x55588e to thunk @ RVA 0x16082e0 Successfully converted call @ RVA 0x556c9c to thunk @ RVA 0x16084e0 Successfully converted call @ RVA 0x556db2 to thunk @ RVA 0x1608618 Successfully converted call @ RVA 0x559388 to thunk @ RVA 0x16082f8 Successfully converted call @ RVA 0x5593ff to thunk @ RVA 0x1608348 Successfully converted call @ RVA 0x559620 to thunk @ RVA 0x16082e0 Successfully converted call @ RVA 0x5596c5 to thunk @ RVA 0x1608320 Successfully converted call @ RVA 0x55979c to thunk @ RVA 0x1608320 Successfully converted call @ RVA 0x559ddc to thunk @ RVA 0x1608310 Successfully converted call @ RVA 0x559dfe to thunk @ RVA 0x1608310 Successfully converted call @ RVA 0x559f9e to thunk @ RVA 0x1608310 Successfully converted call @ RVA 0x55ba53 to thunk @ RVA 0x1608348 Successfully converted call @ RVA 0x55bcb3 to thunk @ RVA 0x16082f0 Successfully converted call @ RVA 0x55bcf1 to thunk @ RVA 0x16082f8 Successfully converted call @ RVA 0x56a99d to thunk @ RVA 0x16087c0 Successfully converted call @ RVA 0x56aa1d to thunk @ RVA 0x16087e0 Successfully converted call @ RVA 0x56aa6e to thunk @ RVA 0x16087c0 Successfully converted call @ RVA 0x56b3bf to thunk @ RVA 0x1608588 Successfully converted call @ RVA 0x56c694 to thunk @ RVA 0x16087c8 Successfully converted call @ RVA 0x56e17b to thunk @ RVA 0x1608508 Successfully converted call @ RVA 0x56e377 to thunk @ RVA 0x1608600 Successfully converted call @ RVA 0x56e57e to thunk @ RVA 0x16084b0 Successfully converted call @ RVA 0x583345 to thunk @ RVA 0x1608528 Successfully converted call @ RVA 0x583515 to thunk @ RVA 0x1608688 Successfully converted call @ RVA 0x583619 to thunk @ RVA 0x16084a8 Successfully converted call @ RVA 0x589995 to thunk @ RVA 0x16084e8 Successfully converted call @ RVA 0x58a06d to thunk @ RVA 0x1608560 Successfully converted call @ RVA 0x58a0c0 to thunk @ RVA 0x16084e8 Successfully converted call @ RVA 0x58b79f to thunk @ RVA 0x1608548 Successfully converted call @ RVA 0x58c514 to thunk @ RVA 0x16085e8 Successfully converted call @ RVA 0x58c64a to thunk @ RVA 0x1608548 Successfully converted call @ RVA 0x58f012 to thunk @ RVA 0x16085f0 Successfully converted call @ RVA 0x58fc58 to thunk @ RVA 0x1608538 Successfully converted call @ RVA 0x58ff9d to thunk @ RVA 0x1608668 Successfully converted call @ RVA 0x5905f7 to thunk @ RVA 0x1608638 Successfully converted call @ RVA 0x5908f0 to thunk @ RVA 0x16084b8 Successfully converted call @ RVA 0x5911c3 to thunk @ RVA 0x1608658 Successfully converted call @ RVA 0x593120 to thunk @ RVA 0x16084a8 Successfully converted call @ RVA 0x594e93 to thunk @ RVA 0x1608638 Successfully converted call @ RVA 0x595356 to thunk @ RVA 0x16081f8 Successfully converted call @ RVA 0x5953aa to thunk @ RVA 0x1608278 Successfully converted call @ RVA 0x5953b0 to thunk @ RVA 0x1608270 Successfully converted call @ RVA 0x5953bd to thunk @ RVA 0x1608230 Successfully converted call @ RVA 0x5953c3 to thunk @ RVA 0x1608238 Successfully converted call @ RVA 0x5953da to thunk @ RVA 0x16081b8 Successfully converted call @ RVA 0x5953e7 to thunk @ RVA 0x16081b0 Successfully converted call @ RVA 0x5953fe to thunk @ RVA 0x16081a8 Successfully converted call @ RVA 0x59541c to thunk @ RVA 0x1608208 Successfully converted call @ RVA 0x5d5e84 to thunk @ RVA 0x16084d0 Successfully converted call @ RVA 0x5d8cd7 to thunk @ RVA 0x16085d8 Successfully converted call @ RVA 0x5d9222 to thunk @ RVA 0x16083b0 Successfully converted call @ RVA 0x5d993e to thunk @ RVA 0x1608600 Successfully converted call @ RVA 0x5d9b4e to thunk @ RVA 0x1608600 Successfully converted call @ RVA 0x5d9bb5 to thunk @ RVA 0x1608600 Successfully converted call @ RVA 0x5d9ef0 to thunk @ RVA 0x16084a8 Successfully converted call @ RVA 0x5d9fb0 to thunk @ RVA 0x16086d8 Successfully converted call @ RVA 0x5da195 to thunk @ RVA 0x1608280 Successfully converted call @ RVA 0x5da27b to thunk @ RVA 0x1608220 Successfully converted call @ RVA 0x5daa57 to thunk @ RVA 0x1608290 Successfully converted call @ RVA 0x5db2bb to thunk @ RVA 0x1608358 Successfully converted call @ RVA 0x5dcd1d to thunk @ RVA 0x1608530 Successfully converted call @ RVA 0xe189d3 to thunk @ RVA 0x16084c8 Successfully converted call @ RVA 0xe22c8b to thunk @ RVA 0x1608590 Successfully converted call @ RVA 0xe22cf4 to thunk @ RVA 0x16086b8 Successfully converted call @ RVA 0xe2b326 to thunk @ RVA 0x1608548 Successfully converted call @ RVA 0xe2b361 to thunk @ RVA 0x1608540 Successfully converted call @ RVA 0xe2c042 to thunk @ RVA 0x1608588 Successfully converted call @ RVA 0xe2e6d6 to thunk @ RVA 0x1608610 Successfully converted call @ RVA 0xe2e8d8 to thunk @ RVA 0x1608508 Successfully converted call @ RVA 0xe2fa71 to thunk @ RVA 0x16086b8 Successfully converted call @ RVA 0xe2faac to thunk @ RVA 0x16086b8 Successfully converted call @ RVA 0xe2faed to thunk @ RVA 0x16086b8 Successfully converted call @ RVA 0xe3014e to thunk @ RVA 0x1608548 Successfully converted call @ RVA 0xe30e14 to thunk @ RVA 0x16087c0 Successfully converted call @ RVA 0xe3121a to thunk @ RVA 0x1608590 Successfully converted call @ RVA 0xe31305 to thunk @ RVA 0x16087b8 Successfully converted call @ RVA 0xe316ed to thunk @ RVA 0x1608510 Successfully converted call @ RVA 0xe492e9 to thunk @ RVA 0x16087c0 Successfully converted call @ RVA 0xe4c0e5 to thunk @ RVA 0x16087d0 Successfully converted call @ RVA 0xe4d21d to thunk @ RVA 0x16085b0 Successfully converted call @ RVA 0xe697db to thunk @ RVA 0x16087c0 Successfully converted call @ RVA 0xe6ca15 to thunk @ RVA 0x16085b0 Successfully converted call @ RVA 0xe75d29 to thunk @ RVA 0x16087c0 Successfully converted call @ RVA 0xe777cc to thunk @ RVA 0x1608670 Successfully converted call @ RVA 0xe80ac1 to thunk @ RVA 0x1608670 Successfully converted call @ RVA 0xe80f99 to thunk @ RVA 0x16087d0 Successfully converted call @ RVA 0xe81e74 to thunk @ RVA 0x16087c0 Successfully converted call @ RVA 0xe82618 to thunk @ RVA 0x16085b0 Successfully converted call @ RVA 0xe84a9b to thunk @ RVA 0x16087c0 Successfully converted call @ RVA 0xe875e6 to thunk @ RVA 0x16085b0 Successfully converted call @ RVA 0xe8db5b to thunk @ RVA 0x16085b0 Successfully converted call @ RVA 0xe91be4 to thunk @ RVA 0x16087c0 Successfully converted call @ RVA 0xe933f8 to thunk @ RVA 0x1608620 Successfully converted call @ RVA 0xe9e252 to thunk @ RVA 0x16087c0 Successfully converted call @ RVA 0xea4da0 to thunk @ RVA 0x16085b0 Successfully converted call @ RVA 0xed68a0 to thunk @ RVA 0x16087c0 Successfully converted call @ RVA 0xee48f0 to thunk @ RVA 0x16087e0 Successfully converted call @ RVA 0xef02c0 to thunk @ RVA 0x16085b0 Successfully converted call @ RVA 0xef1c7a to thunk @ RVA 0x16087c0 Successfully converted call @ RVA 0xef4ede to thunk @ RVA 0x16087d0 Successfully converted call @ RVA 0xf0af05 to thunk @ RVA 0x16087c0 Successfully converted call @ RVA 0xf0db1e to thunk @ RVA 0x16085b0 Successfully converted call @ RVA 0xf0e271 to thunk @ RVA 0x16087c0 Successfully converted call @ RVA 0xf1ae32 to thunk @ RVA 0x16087d0 Successfully converted call @ RVA 0xf2114b to thunk @ RVA 0x16087d0 Successfully converted call @ RVA 0xf55597 to thunk @ RVA 0x16087c0 Successfully converted call @ RVA 0xf618dc to thunk @ RVA 0x1608670 Successfully converted call @ RVA 0xf69aa6 to thunk @ RVA 0x16087d0 Successfully converted call @ RVA 0xf747bd to thunk @ RVA 0x16085b0 Successfully converted call @ RVA 0xf76b8c to thunk @ RVA 0x16087d0 Successfully converted call @ RVA 0xf9b7a1 to thunk @ RVA 0x16087d0 Successfully converted call @ RVA 0xf9d552 to thunk @ RVA 0x16085b0 Successfully converted call @ RVA 0xfa2f04 to thunk @ RVA 0x16087c0 Successfully converted call @ RVA 0xfa79a6 to thunk @ RVA 0x16085b0 Successfully converted call @ RVA 0xfcdff3 to thunk @ RVA 0x16087e0 Successfully converted call @ RVA 0xfd0bf8 to thunk @ RVA 0x16087e0 Successfully converted call @ RVA 0xfd837e to thunk @ RVA 0x16087d0 Successfully converted call @ RVA 0xfee2e0 to thunk @ RVA 0x16087d0 Successfully converted call @ RVA 0x1001b3f to thunk @ RVA 0x16087d0 Successfully converted call @ RVA 0x100ab52 to thunk @ RVA 0x16087d0 Successfully converted call @ RVA 0x100e6e8 to thunk @ RVA 0x16087c0 !! Stack adjustment failed for call @ RVA 0x15c9701 for thunk @ 0x7ff6a0d58350 Failed to convert call @ RVA 0x15c9701 New ImageBase: 0x7ff69f750000, SizeOfImage: 0x1707000 File written to: D:\XXX\XXX.XXX5\XXX.VMPDump.exe

H:\GOOGLECODE\vmpdump\build\VMPDump\Release>

0xnobody commented 3 years ago

Please upload the target image that is causing these issues.

manojdjoshi commented 3 years ago

Please tell me Solution bro mdj.zip