{
  "schema": "autopoe2.re_extraction/v1",
  "generated_at": "10/09/2026 09:41:47",
  "elapsed_seconds": 12.8,
  "tool": "PyGhidra (Ghidra 12.1.3)",
  "provenance": {
    "binary_path": "bin\\Release\\AutoPOE2_MemProbe.exe",
    "build_id": "6AA21741",
    "time_date_stamp": "0x6AA21741",
    "size_of_image": "0x37000",
    "file_size": 203264,
    "file_sha256": "c6a732e8c254ee3a64753ae329b775da3a8af979140e735d4d08bf88599952f6",
    "section_layout_hash": "0x7CD05D8032D42E11"
  },
  "invariants": {
    "INV-SIG-UNIQUE": "signature chỉ được chấp nhận khi match_count == 1",
    "INV-BUILD-01": "mọi tri thức khóa theo build_id ở trên"
  },
  "result": {
    "image_base": "140000000",
    "memory_blocks": [
      {
        "name": "Headers",
        "start": "140000000",
        "end": "1400003ff",
        "size": 1024,
        "execute": false,
        "write": false,
        "read": true,
        "initialized": true
      },
      {
        "name": ".text",
        "start": "140001000",
        "end": "1400253ff",
        "size": 148480,
        "execute": true,
        "write": false,
        "read": true,
        "initialized": true
      },
      {
        "name": ".rdata",
        "start": "140026000",
        "end": "1400313ff",
        "size": 46080,
        "execute": false,
        "write": false,
        "read": true,
        "initialized": true
      },
      {
        "name": ".data",
        "start": "140032000",
        "end": "140032a2f",
        "size": 2608,
        "execute": false,
        "write": true,
        "read": true,
        "initialized": true
      },
      {
        "name": ".pdata",
        "start": "140033000",
        "end": "1400343ff",
        "size": 5120,
        "execute": false,
        "write": false,
        "read": true,
        "initialized": true
      },
      {
        "name": ".rsrc",
        "start": "140035000",
        "end": "1400351ff",
        "size": 512,
        "execute": false,
        "write": false,
        "read": true,
        "initialized": true
      },
      {
        "name": ".reloc",
        "start": "140036000",
        "end": "1400361ff",
        "size": 512,
        "execute": false,
        "write": false,
        "read": true,
        "initialized": true
      },
      {
        "name": "tdb",
        "start": "ff00000000",
        "end": "ff0000184f",
        "size": 6224,
        "execute": false,
        "write": true,
        "read": true,
        "initialized": true
      }
    ],
    "function_count": 360,
    "scanned_references": 15725,
    "text_block": {
      "name": ".text",
      "start": "140001000",
      "size": 148480
    },
    "distinct_global_slots": 681,
    "candidates": [
      {
        "address": "140026518",
        "block": ".rdata",
        "fan_in": 218,
        "sources": [
          "14000195f",
          "140001c88",
          "140001eec",
          "14000205f",
          "1400021dc",
          "1400023b9",
          "14000342e",
          "1400036ec"
        ],
        "signature": "FF 15 ? ? ? ? 48 83 C0 27 48 83 E0 E0 48 89 48 F8 48 83 C4 38 C3 48 83 C4 38 E9 14 13 02 00 E8 5B B4 01 00",
        "match_count": 0,
        "unique": false,
        "rip_offset": 2,
        "instruction_address": "14000195f",
        "mnemonic": "CALL",
        "pattern_bytes": 37
      },
      {
        "address": "140026608",
        "block": ".rdata",
        "fan_in": 64,
        "sources": [
          "140001158",
          "1400011a8",
          "1400011c4",
          "140001316",
          "1400013f4",
          "14000159b",
          "1400025ba",
          "14000277d"
        ],
        "signature": "FF 15 ? ? ? ? 90 33 D2",
        "match_count": 1,
        "unique": true,
        "rip_offset": 2,
        "instruction_address": "140001158",
        "mnemonic": "CALL",
        "pattern_bytes": 9
      },
      {
        "address": "140028270",
        "block": ".rdata",
        "fan_in": 43,
        "sources": [
          "140007338",
          "140007ed5",
          "14000b798",
          "14000b802",
          "14000b86c",
          "14000b8c7",
          "14000b931",
          "14000b98c"
        ],
        "signature": "66 0F 6F 05 ? ? ? ? F3 ? ? ? ? C6 45 68 00",
        "match_count": 1,
        "unique": true,
        "rip_offset": 4,
        "instruction_address": "140007338",
        "mnemonic": "MOVDQA",
        "pattern_bytes": 17
      },
      {
        "address": "140032000",
        "block": ".data",
        "fan_in": 40,
        "sources": [
          "14000709c",
          "140007b95",
          "140007e57",
          "14000912f",
          "14000bfb8",
          "14000d9e4",
          "14000eeca",
          "14001014c"
        ],
        "signature": "48 8B 05 ? ? ? ? 48 33 C4 48 89 85 ? ? ? ? 4D 8B F1",
        "match_count": 1,
        "unique": true,
        "rip_offset": 3,
        "instruction_address": "14000709c",
        "mnemonic": "MOV",
        "pattern_bytes": 20
      },
      {
        "address": "1400262b0",
        "block": ".rdata",
        "fan_in": 34,
        "sources": [
          "14000722d",
          "14000775c",
          "140008f6b",
          "1400092f3",
          "140009492",
          "14000ad6b",
          "14000bf47",
          "14000c7d0"
        ],
        "signature": "FF 15 ? ? ? ? 48 8D 4D 68",
        "match_count": 1,
        "unique": true,
        "rip_offset": 2,
        "instruction_address": "14000722d",
        "mnemonic": "CALL",
        "pattern_bytes": 10
      },
      {
        "address": "140026380",
        "block": ".rdata",
        "fan_in": 29,
        "sources": [
          "1400071fe",
          "140007720",
          "140008f55",
          "1400092bd",
          "140009454",
          "14000ad55",
          "14000c7ba",
          "14000d4ef"
        ],
        "signature": "48 8B 0D ? ? ? ? E8 46 A1 FF FF",
        "match_count": 1,
        "unique": true,
        "rip_offset": 3,
        "instruction_address": "1400071fe",
        "mnemonic": "MOV",
        "pattern_bytes": 12
      },
      {
        "address": "140026a00",
        "block": ".rdata",
        "fan_in": 26,
        "sources": [
          "140008ab9",
          "14000b1df",
          "14000b232",
          "14000b285",
          "14000b2d8",
          "14000b32b",
          "14000b37e",
          "14000ccf1"
        ],
        "signature": "4C 8D 05 ? ? ? ? BA 20 00 00 00 48 8D 8D ? ? ? ? E8 7F 7C 01 00",
        "match_count": 1,
        "unique": true,
        "rip_offset": 3,
        "instruction_address": "140008ab9",
        "mnemonic": "LEA",
        "pattern_bytes": 24
      },
      {
        "address": "14002738c",
        "block": ".rdata",
        "fan_in": 26,
        "sources": [
          "140009f86",
          "140009fb0",
          "14000a114",
          "14000a13e",
          "14000a2c3",
          "14000a2ed",
          "14000a317",
          "14000a4c0"
        ],
        "signature": "4C 8D 05 ? ? ? ? 48 8B D0 48 8D 8D ? ? ? ? E8 54 76 FF FF",
        "match_count": 1,
        "unique": true,
        "rip_offset": 3,
        "instruction_address": "140009f86",
        "mnemonic": "LEA",
        "pattern_bytes": 22
      },
      {
        "address": "1400269c0",
        "block": ".rdata",
        "fan_in": 23,
        "sources": [
          "1400056b5",
          "1400056bc",
          "140005753",
          "1400073a0",
          "1400073a7",
          "140007443",
          "14000776c",
          "140007924"
        ],
        "signature": "4C 8D 25 ? ? ? ? 4C 89 24 39 48 8B 07 48 63 48 04 8D 91 58 FF FF FF",
        "match_count": 1,
        "unique": true,
        "rip_offset": 3,
        "instruction_address": "1400056b5",
        "mnemonic": "LEA",
        "pattern_bytes": 24
      },
      {
        "address": "140026278",
        "block": ".rdata",
        "fan_in": 22,
        "sources": [
          "140001140",
          "14000123b",
          "140001295",
          "1400012fe",
          "1400013dc",
          "14000148f",
          "1400014c8",
          "1400014f1"
        ],
        "signature": "FF 15 ? ? ? ? 48 8B D0 48 85 C0 74 11 48 8B 08 48 8B 41 08 48 8B CA FF 15 ? ? ? ? 90 33 D2",
        "match_count": 1,
        "unique": true,
        "rip_offset": 2,
        "instruction_address": "140001140",
        "mnemonic": "CALL",
        "pattern_bytes": 33
      },
      {
        "address": "140026030",
        "block": ".rdata",
        "fan_in": 18,
        "sources": [
          "14000dbf0",
          "14000dd51",
          "14001255f",
          "1400125cd",
          "14001261f",
          "1400164c0",
          "140016d50",
          "140016e14"
        ],
        "signature": "FF 15 ? ? ? ? 48 85 C0 0F 84 61 01 00 00",
        "match_count": 1,
        "unique": true,
        "rip_offset": 2,
        "instruction_address": "14000dbf0",
        "mnemonic": "CALL",
        "pattern_bytes": 15
      },
      {
        "address": "140026260",
        "block": ".rdata",
        "fan_in": 17,
        "sources": [
          "14000779d",
          "140007907",
          "140007967",
          "140007a30",
          "140007ac0",
          "140007de5",
          "14000e103",
          "14000e201"
        ],
        "signature": "FF 15 ? ? ? ? 90 48 8B 95 ? ? ? ? 48 83 FA 0F 76 46",
        "match_count": 1,
        "unique": true,
        "rip_offset": 2,
        "instruction_address": "14000779d",
        "mnemonic": "CALL",
        "pattern_bytes": 20
      }
    ],
    "unique_signatures": [
      {
        "address": "140026608",
        "block": ".rdata",
        "fan_in": 64,
        "sources": [
          "140001158",
          "1400011a8",
          "1400011c4",
          "140001316",
          "1400013f4",
          "14000159b",
          "1400025ba",
          "14000277d"
        ],
        "signature": "FF 15 ? ? ? ? 90 33 D2",
        "match_count": 1,
        "unique": true,
        "rip_offset": 2,
        "instruction_address": "140001158",
        "mnemonic": "CALL",
        "pattern_bytes": 9
      },
      {
        "address": "140028270",
        "block": ".rdata",
        "fan_in": 43,
        "sources": [
          "140007338",
          "140007ed5",
          "14000b798",
          "14000b802",
          "14000b86c",
          "14000b8c7",
          "14000b931",
          "14000b98c"
        ],
        "signature": "66 0F 6F 05 ? ? ? ? F3 ? ? ? ? C6 45 68 00",
        "match_count": 1,
        "unique": true,
        "rip_offset": 4,
        "instruction_address": "140007338",
        "mnemonic": "MOVDQA",
        "pattern_bytes": 17
      },
      {
        "address": "140032000",
        "block": ".data",
        "fan_in": 40,
        "sources": [
          "14000709c",
          "140007b95",
          "140007e57",
          "14000912f",
          "14000bfb8",
          "14000d9e4",
          "14000eeca",
          "14001014c"
        ],
        "signature": "48 8B 05 ? ? ? ? 48 33 C4 48 89 85 ? ? ? ? 4D 8B F1",
        "match_count": 1,
        "unique": true,
        "rip_offset": 3,
        "instruction_address": "14000709c",
        "mnemonic": "MOV",
        "pattern_bytes": 20
      },
      {
        "address": "1400262b0",
        "block": ".rdata",
        "fan_in": 34,
        "sources": [
          "14000722d",
          "14000775c",
          "140008f6b",
          "1400092f3",
          "140009492",
          "14000ad6b",
          "14000bf47",
          "14000c7d0"
        ],
        "signature": "FF 15 ? ? ? ? 48 8D 4D 68",
        "match_count": 1,
        "unique": true,
        "rip_offset": 2,
        "instruction_address": "14000722d",
        "mnemonic": "CALL",
        "pattern_bytes": 10
      },
      {
        "address": "140026380",
        "block": ".rdata",
        "fan_in": 29,
        "sources": [
          "1400071fe",
          "140007720",
          "140008f55",
          "1400092bd",
          "140009454",
          "14000ad55",
          "14000c7ba",
          "14000d4ef"
        ],
        "signature": "48 8B 0D ? ? ? ? E8 46 A1 FF FF",
        "match_count": 1,
        "unique": true,
        "rip_offset": 3,
        "instruction_address": "1400071fe",
        "mnemonic": "MOV",
        "pattern_bytes": 12
      },
      {
        "address": "140026a00",
        "block": ".rdata",
        "fan_in": 26,
        "sources": [
          "140008ab9",
          "14000b1df",
          "14000b232",
          "14000b285",
          "14000b2d8",
          "14000b32b",
          "14000b37e",
          "14000ccf1"
        ],
        "signature": "4C 8D 05 ? ? ? ? BA 20 00 00 00 48 8D 8D ? ? ? ? E8 7F 7C 01 00",
        "match_count": 1,
        "unique": true,
        "rip_offset": 3,
        "instruction_address": "140008ab9",
        "mnemonic": "LEA",
        "pattern_bytes": 24
      },
      {
        "address": "14002738c",
        "block": ".rdata",
        "fan_in": 26,
        "sources": [
          "140009f86",
          "140009fb0",
          "14000a114",
          "14000a13e",
          "14000a2c3",
          "14000a2ed",
          "14000a317",
          "14000a4c0"
        ],
        "signature": "4C 8D 05 ? ? ? ? 48 8B D0 48 8D 8D ? ? ? ? E8 54 76 FF FF",
        "match_count": 1,
        "unique": true,
        "rip_offset": 3,
        "instruction_address": "140009f86",
        "mnemonic": "LEA",
        "pattern_bytes": 22
      },
      {
        "address": "1400269c0",
        "block": ".rdata",
        "fan_in": 23,
        "sources": [
          "1400056b5",
          "1400056bc",
          "140005753",
          "1400073a0",
          "1400073a7",
          "140007443",
          "14000776c",
          "140007924"
        ],
        "signature": "4C 8D 25 ? ? ? ? 4C 89 24 39 48 8B 07 48 63 48 04 8D 91 58 FF FF FF",
        "match_count": 1,
        "unique": true,
        "rip_offset": 3,
        "instruction_address": "1400056b5",
        "mnemonic": "LEA",
        "pattern_bytes": 24
      },
      {
        "address": "140026278",
        "block": ".rdata",
        "fan_in": 22,
        "sources": [
          "140001140",
          "14000123b",
          "140001295",
          "1400012fe",
          "1400013dc",
          "14000148f",
          "1400014c8",
          "1400014f1"
        ],
        "signature": "FF 15 ? ? ? ? 48 8B D0 48 85 C0 74 11 48 8B 08 48 8B 41 08 48 8B CA FF 15 ? ? ? ? 90 33 D2",
        "match_count": 1,
        "unique": true,
        "rip_offset": 2,
        "instruction_address": "140001140",
        "mnemonic": "CALL",
        "pattern_bytes": 33
      },
      {
        "address": "140026030",
        "block": ".rdata",
        "fan_in": 18,
        "sources": [
          "14000dbf0",
          "14000dd51",
          "14001255f",
          "1400125cd",
          "14001261f",
          "1400164c0",
          "140016d50",
          "140016e14"
        ],
        "signature": "FF 15 ? ? ? ? 48 85 C0 0F 84 61 01 00 00",
        "match_count": 1,
        "unique": true,
        "rip_offset": 2,
        "instruction_address": "14000dbf0",
        "mnemonic": "CALL",
        "pattern_bytes": 15
      },
      {
        "address": "140026260",
        "block": ".rdata",
        "fan_in": 17,
        "sources": [
          "14000779d",
          "140007907",
          "140007967",
          "140007a30",
          "140007ac0",
          "140007de5",
          "14000e103",
          "14000e201"
        ],
        "signature": "FF 15 ? ? ? ? 90 48 8B 95 ? ? ? ? 48 83 FA 0F 76 46",
        "match_count": 1,
        "unique": true,
        "rip_offset": 2,
        "instruction_address": "14000779d",
        "mnemonic": "CALL",
        "pattern_bytes": 20
      }
    ]
  }
}