aaron/htb-santa-ctf
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity
Files
632fdd5b5320c3dd96897cef87a6360716ca9bef
htb-santa-ctf/pwn/ghidra/pwn.rep/projectState
aaron 632fdd5b53 add reversing challenge
2021-12-02 00:26:01 +01:00

1257 lines
121 KiB
XML
Raw Blame History

<?xml version="1.0" encoding="UTF-8"?>
<PROJECT>
<PROJECT_DATA_XML_NAME NAME="DISPLAY_DATA">
<SAVE_STATE>
<ARRAY NAME="EXPANDED_PATHS" TYPE="string">
<A VALUE="pwn:" />
</ARRAY>
<STATE NAME="SHOW_TABLE" TYPE="boolean" VALUE="false" />
</SAVE_STATE>
</PROJECT_DATA_XML_NAME>
<TOOL_MANAGER ACTIVE_WORKSPACE="Workspace">
<WORKSPACE NAME="Workspace" ACTIVE="true">
<RUNNING_TOOL TOOL_NAME="CodeBrowser">
<ROOT_NODE X_POS="20" Y_POS="23" WIDTH="1880" HEIGHT="1037" EX_STATE="0">
<SPLIT_NODE WIDTH="100" HEIGHT="100" DIVIDER_LOCATION="0" ORIENTATION="VERTICAL">
<SPLIT_NODE WIDTH="1621" HEIGHT="816" DIVIDER_LOCATION="148" ORIENTATION="VERTICAL">
<COMPONENT_NODE TOP_INFO="0">
<COMPONENT_INFO NAME="Entropy" OWNER="EntropyPlugin" TITLE="Entropy" ACTIVE="false" GROUP="Header" INSTANCE_ID="3207819926581772885" />
<COMPONENT_INFO NAME="Overview" OWNER="OverviewPlugin" TITLE="Overview" ACTIVE="false" GROUP="Header" INSTANCE_ID="3207819926581772883" />
</COMPONENT_NODE>
<SPLIT_NODE WIDTH="1878" HEIGHT="934" DIVIDER_LOCATION="143" ORIENTATION="HORIZONTAL">
<SPLIT_NODE WIDTH="268" HEIGHT="934" DIVIDER_LOCATION="640" ORIENTATION="VERTICAL">
<SPLIT_NODE WIDTH="268" HEIGHT="595" DIVIDER_LOCATION="502" ORIENTATION="VERTICAL">
<COMPONENT_NODE TOP_INFO="0">
<COMPONENT_INFO NAME="Program Tree" OWNER="ProgramTreePlugin" TITLE="Program Trees" ACTIVE="true" GROUP="Default" INSTANCE_ID="3435975333167487863" />
</COMPONENT_NODE>
<COMPONENT_NODE TOP_INFO="0">
<COMPONENT_INFO NAME="Symbol Tree" OWNER="SymbolTreePlugin" TITLE="Symbol Tree" ACTIVE="true" GROUP="Default" INSTANCE_ID="3435975333167487867" />
</COMPONENT_NODE>
</SPLIT_NODE>
<COMPONENT_NODE TOP_INFO="0">
<COMPONENT_INFO NAME="DataTypes Provider" OWNER="DataTypeManagerPlugin" TITLE="Data Type Manager" ACTIVE="true" GROUP="Default" INSTANCE_ID="3435975353878961010" />
</COMPONENT_NODE>
</SPLIT_NODE>
<SPLIT_NODE WIDTH="1606" HEIGHT="934" DIVIDER_LOCATION="785" ORIENTATION="VERTICAL">
<SPLIT_NODE WIDTH="1386" HEIGHT="638" DIVIDER_LOCATION="705" ORIENTATION="VERTICAL">
<SPLIT_NODE WIDTH="1606" HEIGHT="730" DIVIDER_LOCATION="569" ORIENTATION="HORIZONTAL">
<COMPONENT_NODE TOP_INFO="0">
<COMPONENT_INFO NAME="Listing" OWNER="CodeBrowserPlugin" TITLE="Listing: mr_snowy" ACTIVE="true" GROUP="Core" INSTANCE_ID="3435975333167487854" />
</COMPONENT_NODE>
<COMPONENT_NODE TOP_INFO="0">
<COMPONENT_INFO NAME="Decompiler" OWNER="DecompilePlugin" TITLE="Decompile: snowman" ACTIVE="true" GROUP="Default" INSTANCE_ID="3435975333167487857" />
<COMPONENT_INFO NAME="Bytes" OWNER="ByteViewerPlugin" TITLE="Bytes: mr_snowy" ACTIVE="true" GROUP="Default" INSTANCE_ID="3435975333167487851" />
<COMPONENT_INFO NAME="Data Window" OWNER="DataWindowPlugin" TITLE="Defined Data" ACTIVE="false" GROUP="Default" INSTANCE_ID="3435975355367938913" />
<COMPONENT_INFO NAME="Defined Strings" OWNER="ViewStringsPlugin" TITLE="Defined Strings" ACTIVE="false" GROUP="Default" INSTANCE_ID="3435975354000595837" />
<COMPONENT_INFO NAME="Equates Table" OWNER="EquateTablePlugin" TITLE="Equates Table" ACTIVE="false" GROUP="Default" INSTANCE_ID="3435975333167487859" />
<COMPONENT_INFO NAME="External Programs" OWNER="ReferencesPlugin" TITLE="External Programs" ACTIVE="false" GROUP="Default" INSTANCE_ID="3435975333167487864" />
<COMPONENT_INFO NAME="Functions Window" OWNER="FunctionWindowPlugin" TITLE="Functions" ACTIVE="false" GROUP="Default" INSTANCE_ID="3435975354000595824" />
<COMPONENT_INFO NAME="Relocation Table" OWNER="RelocationTablePlugin" TITLE="Relocation Table" ACTIVE="false" GROUP="Default" INSTANCE_ID="3435975354000595836" />
</COMPONENT_NODE>
</SPLIT_NODE>
<SPLIT_NODE WIDTH="1386" HEIGHT="189" DIVIDER_LOCATION="495" ORIENTATION="HORIZONTAL">
<COMPONENT_NODE TOP_INFO="0">
<COMPONENT_INFO NAME="Data Type Preview" OWNER="DataTypePreviewPlugin" TITLE="Data Type Preview" ACTIVE="false" GROUP="Default" INSTANCE_ID="3435975354000595823" />
</COMPONENT_NODE>
<COMPONENT_NODE TOP_INFO="0">
<COMPONENT_INFO NAME="Virtual Disassembler - Current Instruction" OWNER="DisassembledViewPlugin" TITLE="Disassembled View" ACTIVE="false" GROUP="Default" INSTANCE_ID="3435975333167487858" />
</COMPONENT_NODE>
</SPLIT_NODE>
</SPLIT_NODE>
<COMPONENT_NODE TOP_INFO="0">
<COMPONENT_INFO NAME="Console" OWNER="ConsolePlugin" TITLE="Console" ACTIVE="true" GROUP="Default" INSTANCE_ID="3435975333167487855" />
<COMPONENT_INFO NAME="Bookmarks" OWNER="BookmarkPlugin" TITLE="Bookmarks" ACTIVE="false" GROUP="Core.Bookmarks" INSTANCE_ID="3435975333167487850" />
</COMPONENT_NODE>
</SPLIT_NODE>
</SPLIT_NODE>
</SPLIT_NODE>
<COMPONENT_NODE TOP_INFO="0">
<COMPONENT_INFO NAME="Function Call Trees" OWNER="CallTreePlugin" TITLE="Function Call Trees" ACTIVE="false" GROUP="Default" INSTANCE_ID="3435975333167487852" />
</COMPONENT_NODE>
</SPLIT_NODE>
<WINDOW_NODE X_POS="426" Y_POS="178" WIDTH="1033" HEIGHT="689">
<COMPONENT_NODE TOP_INFO="0">
<COMPONENT_INFO NAME="Script Manager" OWNER="GhidraScriptMgrPlugin" TITLE="Script Manager" ACTIVE="false" GROUP="Script Group" INSTANCE_ID="3435975333167487865" />
</COMPONENT_NODE>
</WINDOW_NODE>
<WINDOW_NODE X_POS="423" Y_POS="144" WIDTH="927" HEIGHT="370">
<COMPONENT_NODE TOP_INFO="0">
<COMPONENT_INFO NAME="Memory Map" OWNER="MemoryMapPlugin" TITLE="Memory Map" ACTIVE="false" GROUP="Default" INSTANCE_ID="3435975333167487862" />
</COMPONENT_NODE>
</WINDOW_NODE>
<WINDOW_NODE X_POS="383" Y_POS="7" WIDTH="1020" HEIGHT="1038">
<COMPONENT_NODE TOP_INFO="0">
<COMPONENT_INFO NAME="Function Graph" OWNER="FunctionGraphPlugin" TITLE="Function Graph" ACTIVE="false" GROUP="Function Graph" INSTANCE_ID="3435975355367938914" />
</COMPONENT_NODE>
</WINDOW_NODE>
<WINDOW_NODE X_POS="550" Y_POS="206" WIDTH="655" HEIGHT="509">
<COMPONENT_NODE TOP_INFO="0">
<COMPONENT_INFO NAME="Register Manager" OWNER="RegisterPlugin" TITLE="Register Manager" ACTIVE="false" GROUP="Default" INSTANCE_ID="3435975354000595825" />
</COMPONENT_NODE>
</WINDOW_NODE>
<WINDOW_NODE X_POS="287" Y_POS="186" WIDTH="1424" HEIGHT="666">
<SPLIT_NODE WIDTH="1408" HEIGHT="559" DIVIDER_LOCATION="573" ORIENTATION="HORIZONTAL">
<COMPONENT_NODE TOP_INFO="0">
<COMPONENT_INFO NAME="Symbol Table" OWNER="SymbolTablePlugin" TITLE="Symbol Table" ACTIVE="false" GROUP="symbolTable" INSTANCE_ID="3435975354000595838" />
</COMPONENT_NODE>
<COMPONENT_NODE TOP_INFO="0">
<COMPONENT_INFO NAME="Symbol References" OWNER="SymbolTablePlugin" TITLE="Symbol References" ACTIVE="false" GROUP="symbolTable" INSTANCE_ID="3435975354000595839" />
</COMPONENT_NODE>
</SPLIT_NODE>
</WINDOW_NODE>
<WINDOW_NODE X_POS="-1" Y_POS="-1" WIDTH="0" HEIGHT="0">
<COMPONENT_NODE TOP_INFO="0">
<COMPONENT_INFO NAME="Checksum Generator" OWNER="ComputeChecksumsPlugin" TITLE="Checksum Generator" ACTIVE="false" GROUP="Default" INSTANCE_ID="3435975333167487853" />
</COMPONENT_NODE>
</WINDOW_NODE>
<WINDOW_NODE X_POS="-1" Y_POS="-1" WIDTH="0" HEIGHT="0">
<COMPONENT_NODE TOP_INFO="0">
<COMPONENT_INFO NAME="Function Tags" OWNER="FunctionTagPlugin" TITLE="Function Tags" ACTIVE="false" GROUP="Default" INSTANCE_ID="3435975333167487861" />
</COMPONENT_NODE>
</WINDOW_NODE>
<WINDOW_NODE X_POS="-1" Y_POS="-1" WIDTH="0" HEIGHT="0">
<COMPONENT_NODE TOP_INFO="0">
<COMPONENT_INFO NAME="Comment Window" OWNER="CommentWindowPlugin" TITLE="Comments" ACTIVE="false" GROUP="Default" INSTANCE_ID="3435975355367938912" />
</COMPONENT_NODE>
</WINDOW_NODE>
<WINDOW_NODE X_POS="-1" Y_POS="-1" WIDTH="0" HEIGHT="0">
<COMPONENT_NODE TOP_INFO="0">
<COMPONENT_INFO NAME="Python" OWNER="InterpreterPanelPlugin" TITLE="Python" ACTIVE="false" GROUP="Default" INSTANCE_ID="3435975354000595826" />
</COMPONENT_NODE>
</WINDOW_NODE>
<WINDOW_NODE X_POS="0" Y_POS="0" WIDTH="0" HEIGHT="0">
<COMPONENT_NODE TOP_INFO="0">
<COMPONENT_INFO NAME="BundleManager" OWNER="GhidraScriptMgrPlugin" TITLE="Bundle Manager" ACTIVE="false" GROUP="Default" INSTANCE_ID="3435975333167487866" />
</COMPONENT_NODE>
</WINDOW_NODE>
<WINDOW_NODE X_POS="0" Y_POS="0" WIDTH="0" HEIGHT="0">
<COMPONENT_NODE TOP_INFO="0">
<COMPONENT_INFO NAME="Function Call Graph" OWNER="FunctionCallGraphPlugin" TITLE="Function Call Graph" ACTIVE="false" GROUP="Function Call Graph" INSTANCE_ID="3435975333167487868" />
</COMPONENT_NODE>
</WINDOW_NODE>
</ROOT_NODE>
<DATA_STATE>
<PLUGIN NAME="ByteViewerPlugin">
<STATE NAME="X Offset" TYPE="int" VALUE="0" />
<STATE NAME="NAV_ID" TYPE="long" VALUE="3435975333167487851" />
<STATE NAME="Block Column" TYPE="int" VALUE="0" />
<STATE NAME="Y Offset" TYPE="int" VALUE="-1" />
<STATE NAME="Num Disconnected" TYPE="int" VALUE="0" />
<STATE NAME="Block Num" TYPE="int" VALUE="13" />
<STATE NAME="Index" TYPE="int" VALUE="320" />
<STATE NAME="Block Offset" TYPE="string" VALUE="2714" />
</PLUGIN>
<PLUGIN NAME="CodeBrowserPlugin">
<STATE NAME="NAV_ID" TYPE="long" VALUE="3435975333167487854" />
<STATE NAME="_FUNC_ADDRESS" TYPE="string" VALUE="0040146a" />
<STATE NAME="_RETURN_TYPE" TYPE="string" VALUE="undefined" />
<STATE NAME="_ADDRESS" TYPE="string" VALUE="0040146a" />
<STATE NAME="Num Disconnected" TYPE="int" VALUE="0" />
<STATE NAME="_SIGNATURE" TYPE="string" VALUE="undefined __stdcall snowman(undefined8 param_1, undefined4 param_2, undefined4 param_3, undefined4 param_4, undefined4 param_5, undefined4 param_6, undefined4 param_7, undefined4 param_8)" />
<STATE NAME="_CLASSNAME" TYPE="string" VALUE="ghidra.program.util.FunctionReturnTypeFieldLocation" />
<STATE NAME="_COLUMN" TYPE="int" VALUE="0" />
<STATE NAME="_CHAR_OFFSET" TYPE="int" VALUE="0" />
<STATE NAME="_ROW" TYPE="int" VALUE="0" />
<STATE NAME="_BYTE_ADDR" TYPE="string" VALUE="0040146a" />
<STATE NAME="INDEX" TYPE="int" VALUE="3497" />
<STATE NAME="Y_OFFSET" TYPE="int" VALUE="-17" />
</PLUGIN>
<PLUGIN NAME="DecompilePlugin">
<STATE NAME="NAV_ID" TYPE="long" VALUE="3435975333167487857" />
<STATE NAME="_FUNC_ADDRESS" TYPE="string" VALUE="0040146a" />
<STATE NAME="_RETURN_TYPE" TYPE="string" VALUE="undefined" />
<STATE NAME="_ADDRESS" TYPE="string" VALUE="0040146a" />
<STATE NAME="Num Disconnected" TYPE="int" VALUE="0" />
<STATE NAME="_SIGNATURE" TYPE="string" VALUE="undefined snowman(undefined8 param_1, undefined4 param_2, undefined4 param_3, undefined4 param_4, undefined4 param_5, undefined4 param_6, undefined4 param_7, undefined4 param_8)" />
<STATE NAME="_CLASSNAME" TYPE="string" VALUE="ghidra.program.util.FunctionReturnTypeFieldLocation" />
<STATE NAME="_COLUMN" TYPE="int" VALUE="0" />
<STATE NAME="_CHAR_OFFSET" TYPE="int" VALUE="0" />
<STATE NAME="_ROW" TYPE="int" VALUE="0" />
<STATE NAME="_BYTE_ADDR" TYPE="string" VALUE="0040146a" />
<STATE NAME="INDEX" TYPE="int" VALUE="0" />
<STATE NAME="Y_OFFSET" TYPE="int" VALUE="0" />
</PLUGIN>
<PLUGIN NAME="FunctionGraphPlugin">
<STATE NAME="NAV_ID" TYPE="long" VALUE="3435975355367938914" />
<ENUM NAME="EDGE_HOVER_HIGHLIGHT" TYPE="enum" CLASS="ghidra.app.plugin.core.functiongraph.EdgeDisplayType" VALUE="ScopedFlowsFromVertex" />
<STATE NAME="DISPLAY_SATELLITE" TYPE="boolean" VALUE="true" />
<STATE NAME="Disconnected Count" TYPE="int" VALUE="0" />
<STATE NAME="LAYOUT_NAME" TYPE="string" VALUE="ghidra.app.plugin.core.functiongraph.graph.layout.DecompilerNestedLayoutProvider" />
<STATE NAME="DISPLAY_POPUPS" TYPE="boolean" VALUE="true" />
<ENUM NAME="EDGE_SELECTION_HIGHLIGHT" TYPE="enum" CLASS="ghidra.app.plugin.core.functiongraph.EdgeDisplayType" VALUE="AllCycles" />
<STATE NAME="DOCK_SATELLITE" TYPE="boolean" VALUE="true" />
</PLUGIN>
<PLUGIN NAME="NavigationHistoryPlugin">
<XML NAME="HISTORY_LIST_0">
<SAVE_STATE>
<XML NAME="MEMENTO_DATA2">
<SAVE_STATE>
<STATE NAME="_FUNC_ADDRESS" TYPE="string" VALUE="00400acf" />
<STATE NAME="_RETURN_TYPE" TYPE="string" VALUE="undefined" />
<XML NAME="MEMENTO1">
<SAVE_STATE>
<STATE NAME="NAV_ID" TYPE="long" VALUE="3435975333167487857" />
<STATE NAME="_FUNC_ADDRESS" TYPE="string" VALUE="00400acf" />
<STATE NAME="_RETURN_TYPE" TYPE="string" VALUE="undefined" />
<STATE NAME="_ADDRESS" TYPE="string" VALUE="00400acf" />
<STATE NAME="MEMENTO_CLASS" TYPE="string" VALUE="ghidra.app.plugin.core.decompile.DecompilerLocationMemento" />
<STATE NAME="PROGRAM_ID" TYPE="long" VALUE="3435975204127628155" />
<STATE NAME="_SIGNATURE" TYPE="string" VALUE="undefined rainbow(undefined4 param_1, undefined4 param_2, undefined4 param_3, undefined4 param_4, undefined4 param_5, undefined4 param_6, undefined4 param_7, undefined4 param_8, char * param_9, undefined8 param_10, undefined8 param_11, undefined8 param_12, undefined8 param_13, undefined8 param_14, undefined1 param_15)" />
<STATE NAME="_CLASSNAME" TYPE="string" VALUE="ghidra.program.util.FunctionReturnTypeFieldLocation" />
<STATE NAME="_COLUMN" TYPE="int" VALUE="0" />
<STATE NAME="_CHAR_OFFSET" TYPE="int" VALUE="0" />
<STATE NAME="_ROW" TYPE="int" VALUE="0" />
<STATE NAME="_BYTE_ADDR" TYPE="string" VALUE="00400acf" />
<STATE NAME="PROGRAM_PATH_" TYPE="string" VALUE="pwn:/mr_snowy" />
<STATE NAME="INDEX" TYPE="int" VALUE="8" />
<STATE NAME="X_OFFSET" TYPE="int" VALUE="0" />
<STATE NAME="Y_OFFSET" TYPE="int" VALUE="-8" />
</SAVE_STATE>
</XML>
<STATE NAME="_ADDRESS" TYPE="string" VALUE="00400acf" />
<XML NAME="MEMENTO2">
<SAVE_STATE>
<STATE NAME="NAV_ID" TYPE="long" VALUE="3435975333167487854" />
<STATE NAME="_FUNC_ADDRESS" TYPE="string" VALUE="00400acf" />
<STATE NAME="_RETURN_TYPE" TYPE="string" VALUE="undefined" />
<STATE NAME="_ADDRESS" TYPE="string" VALUE="00400acf" />
<STATE NAME="MEMENTO_CLASS" TYPE="string" VALUE="ghidra.app.plugin.core.codebrowser.CodeViewerLocationMemento" />
<STATE NAME="CURSOR_OFFSET" TYPE="int" VALUE="340" />
<STATE NAME="PROGRAM_ID" TYPE="long" VALUE="3435975204127628155" />
<STATE NAME="_SIGNATURE" TYPE="string" VALUE="undefined __stdcall rainbow(undefined4 param_1, undefined4 param_2, undefined4 param_3, undefined4 param_4, undefined4 param_5, undefined4 param_6, undefined4 param_7, undefined4 param_8, char * param_9, undefined8 param_10, undefined8 param_11, undefined8 param_12, undefined8 param_13, undefined8 param_14, undefined1 param_15)" />
<STATE NAME="_CLASSNAME" TYPE="string" VALUE="ghidra.program.util.FunctionReturnTypeFieldLocation" />
<STATE NAME="_COLUMN" TYPE="int" VALUE="0" />
<STATE NAME="_CHAR_OFFSET" TYPE="int" VALUE="0" />
<STATE NAME="_ROW" TYPE="int" VALUE="0" />
<STATE NAME="_BYTE_ADDR" TYPE="string" VALUE="00400acf" />
<STATE NAME="PROGRAM_PATH_" TYPE="string" VALUE="pwn:/mr_snowy" />
</SAVE_STATE>
</XML>
<XML NAME="MEMENTO0">
<SAVE_STATE>
<STATE NAME="NAV_ID" TYPE="long" VALUE="3435975333167487851" />
<STATE NAME="_ADDRESS" TYPE="string" VALUE="00400acf" />
<STATE NAME="Block Num" TYPE="int" VALUE="13" />
<STATE NAME="MEMENTO_CLASS" TYPE="string" VALUE="ghidra.app.plugin.core.byteviewer.ByteViewerLocationMemento" />
<STATE NAME="PROGRAM_ID" TYPE="long" VALUE="3435975204127628155" />
<STATE NAME="_CLASSNAME" TYPE="string" VALUE="ghidra.app.plugin.core.byteviewer.ByteViewerProgramLocation" />
<STATE NAME="_COLUMN" TYPE="int" VALUE="0" />
<STATE NAME="_CHAR_OFFSET" TYPE="int" VALUE="0" />
<STATE NAME="_ROW" TYPE="int" VALUE="0" />
<STATE NAME="_BYTE_ADDR" TYPE="string" VALUE="00400acf" />
<STATE NAME="PROGRAM_PATH_" TYPE="string" VALUE="pwn:/mr_snowy" />
<STATE NAME="INDEX" TYPE="int" VALUE="194" />
<STATE NAME="Y_OFFSET" TYPE="int" VALUE="0" />
<STATE NAME="X_OFFSET" TYPE="int" VALUE="0" />
<STATE NAME="Block Offset" TYPE="string" VALUE="255" />
</SAVE_STATE>
</XML>
<STATE NAME="MEMENTO_CLASS" TYPE="string" VALUE="ghidra.app.plugin.core.gotoquery.DefaultNavigatableLocationMemento" />
<STATE NAME="PROGRAM_ID" TYPE="long" VALUE="3435975204127628155" />
<STATE NAME="_SIGNATURE" TYPE="string" VALUE="undefined rainbow(undefined4 param_1, undefined4 param_2, undefined4 param_3, undefined4 param_4, undefined4 param_5, undefined4 param_6, undefined4 param_7, undefined4 param_8, char * param_9, undefined8 param_10, undefined8 param_11, undefined8 param_12, undefined8 param_13, undefined8 param_14, undefined1 param_15)" />
<STATE NAME="_CLASSNAME" TYPE="string" VALUE="ghidra.program.util.FunctionReturnTypeFieldLocation" />
<STATE NAME="_COLUMN" TYPE="int" VALUE="0" />
<STATE NAME="_CHAR_OFFSET" TYPE="int" VALUE="0" />
<STATE NAME="_ROW" TYPE="int" VALUE="0" />
<STATE NAME="_BYTE_ADDR" TYPE="string" VALUE="00400acf" />
<STATE NAME="NUM_MEMENTOS" TYPE="int" VALUE="3" />
<STATE NAME="PROGRAM_PATH_" TYPE="string" VALUE="pwn:/mr_snowy" />
</SAVE_STATE>
</XML>
<STATE NAME="NAV_ID" TYPE="long" VALUE="-1" />
<XML NAME="MEMENTO_DATA3">
<SAVE_STATE>
<STATE NAME="_FUNC_ADDRESS" TYPE="string" VALUE="0040146a" />
<STATE NAME="_RETURN_TYPE" TYPE="string" VALUE="undefined" />
<XML NAME="MEMENTO1">
<SAVE_STATE>
<STATE NAME="NAV_ID" TYPE="long" VALUE="3435975333167487857" />
<STATE NAME="_FUNC_ADDRESS" TYPE="string" VALUE="0040146a" />
<STATE NAME="_RETURN_TYPE" TYPE="string" VALUE="undefined" />
<STATE NAME="_ADDRESS" TYPE="string" VALUE="0040146a" />
<STATE NAME="MEMENTO_CLASS" TYPE="string" VALUE="ghidra.app.plugin.core.decompile.DecompilerLocationMemento" />
<STATE NAME="PROGRAM_ID" TYPE="long" VALUE="3435975204127628155" />
<STATE NAME="_SIGNATURE" TYPE="string" VALUE="undefined snowman(undefined8 param_1, undefined4 param_2, undefined4 param_3, undefined4 param_4, undefined4 param_5, undefined4 param_6, undefined4 param_7, undefined4 param_8)" />
<STATE NAME="_CLASSNAME" TYPE="string" VALUE="ghidra.program.util.FunctionReturnTypeFieldLocation" />
<STATE NAME="_COLUMN" TYPE="int" VALUE="0" />
<STATE NAME="_CHAR_OFFSET" TYPE="int" VALUE="0" />
<STATE NAME="_ROW" TYPE="int" VALUE="0" />
<STATE NAME="_BYTE_ADDR" TYPE="string" VALUE="0040146a" />
<STATE NAME="PROGRAM_PATH_" TYPE="string" VALUE="pwn:/mr_snowy" />
<STATE NAME="INDEX" TYPE="int" VALUE="0" />
<STATE NAME="X_OFFSET" TYPE="int" VALUE="0" />
<STATE NAME="Y_OFFSET" TYPE="int" VALUE="0" />
</SAVE_STATE>
</XML>
<STATE NAME="_ADDRESS" TYPE="string" VALUE="0040146a" />
<XML NAME="MEMENTO2">
<SAVE_STATE>
<STATE NAME="NAV_ID" TYPE="long" VALUE="3435975333167487854" />
<STATE NAME="_FUNC_ADDRESS" TYPE="string" VALUE="0040146a" />
<STATE NAME="_RETURN_TYPE" TYPE="string" VALUE="undefined" />
<STATE NAME="_ADDRESS" TYPE="string" VALUE="0040146a" />
<STATE NAME="MEMENTO_CLASS" TYPE="string" VALUE="ghidra.app.plugin.core.codebrowser.CodeViewerLocationMemento" />
<STATE NAME="CURSOR_OFFSET" TYPE="int" VALUE="340" />
<STATE NAME="PROGRAM_ID" TYPE="long" VALUE="3435975204127628155" />
<STATE NAME="_SIGNATURE" TYPE="string" VALUE="undefined __stdcall snowman(undefined8 param_1, undefined4 param_2, undefined4 param_3, undefined4 param_4, undefined4 param_5, undefined4 param_6, undefined4 param_7, undefined4 param_8)" />
<STATE NAME="_CLASSNAME" TYPE="string" VALUE="ghidra.program.util.FunctionReturnTypeFieldLocation" />
<STATE NAME="_COLUMN" TYPE="int" VALUE="0" />
<STATE NAME="_CHAR_OFFSET" TYPE="int" VALUE="0" />
<STATE NAME="_ROW" TYPE="int" VALUE="0" />
<STATE NAME="_BYTE_ADDR" TYPE="string" VALUE="0040146a" />
<STATE NAME="PROGRAM_PATH_" TYPE="string" VALUE="pwn:/mr_snowy" />
</SAVE_STATE>
</XML>
<XML NAME="MEMENTO0">
<SAVE_STATE>
<STATE NAME="NAV_ID" TYPE="long" VALUE="3435975333167487851" />
<STATE NAME="_ADDRESS" TYPE="string" VALUE="0040146a" />
<STATE NAME="Block Num" TYPE="int" VALUE="13" />
<STATE NAME="MEMENTO_CLASS" TYPE="string" VALUE="ghidra.app.plugin.core.byteviewer.ByteViewerLocationMemento" />
<STATE NAME="PROGRAM_ID" TYPE="long" VALUE="3435975204127628155" />
<STATE NAME="_CLASSNAME" TYPE="string" VALUE="ghidra.app.plugin.core.byteviewer.ByteViewerProgramLocation" />
<STATE NAME="_COLUMN" TYPE="int" VALUE="0" />
<STATE NAME="_CHAR_OFFSET" TYPE="int" VALUE="0" />
<STATE NAME="_ROW" TYPE="int" VALUE="0" />
<STATE NAME="_BYTE_ADDR" TYPE="string" VALUE="0040146a" />
<STATE NAME="PROGRAM_PATH_" TYPE="string" VALUE="pwn:/mr_snowy" />
<STATE NAME="INDEX" TYPE="int" VALUE="311" />
<STATE NAME="Y_OFFSET" TYPE="int" VALUE="-1" />
<STATE NAME="X_OFFSET" TYPE="int" VALUE="-1" />
<STATE NAME="Block Offset" TYPE="string" VALUE="2714" />
</SAVE_STATE>
</XML>
<STATE NAME="MEMENTO_CLASS" TYPE="string" VALUE="ghidra.app.plugin.core.gotoquery.DefaultNavigatableLocationMemento" />
<STATE NAME="PROGRAM_ID" TYPE="long" VALUE="3435975204127628155" />
<STATE NAME="_SIGNATURE" TYPE="string" VALUE="undefined snowman(undefined8 param_1, undefined4 param_2, undefined4 param_3, undefined4 param_4, undefined4 param_5, undefined4 param_6, undefined4 param_7, undefined4 param_8)" />
<STATE NAME="_CLASSNAME" TYPE="string" VALUE="ghidra.program.util.FunctionReturnTypeFieldLocation" />
<STATE NAME="_COLUMN" TYPE="int" VALUE="0" />
<STATE NAME="_CHAR_OFFSET" TYPE="int" VALUE="0" />
<STATE NAME="_ROW" TYPE="int" VALUE="0" />
<STATE NAME="_BYTE_ADDR" TYPE="string" VALUE="0040146a" />
<STATE NAME="NUM_MEMENTOS" TYPE="int" VALUE="3" />
<STATE NAME="PROGRAM_PATH_" TYPE="string" VALUE="pwn:/mr_snowy" />
</SAVE_STATE>
</XML>
<XML NAME="MEMENTO_DATA0">
<SAVE_STATE>
<ARRAY NAME="_COMMENT" TYPE="string">
<A VALUE="//" />
<A VALUE="// segment_2.1 " />
<A VALUE="// Loadable segment [0x400000 - 0x401cff] (disabled execute bit)" />
<A VALUE="// ram:00400000-ram:00400237" />
<A VALUE="//" />
</ARRAY>
<XML NAME="MEMENTO1">
<SAVE_STATE>
<STATE NAME="NAV_ID" TYPE="long" VALUE="3435975333167487854" />
<ARRAY NAME="_COMMENT" TYPE="string">
<A VALUE="//" />
<A VALUE="// segment_2.1 " />
<A VALUE="// Loadable segment [0x400000 - 0x401cff] (disabled execute bit)" />
<A VALUE="// ram:00400000-ram:00400237" />
<A VALUE="//" />
</ARRAY>
<STATE NAME="_ADDRESS" TYPE="string" VALUE="00400000" />
<STATE NAME="MEMENTO_CLASS" TYPE="string" VALUE="ghidra.app.plugin.core.codebrowser.CodeViewerLocationMemento" />
<STATE NAME="CURSOR_OFFSET" TYPE="int" VALUE="0" />
<STATE NAME="PROGRAM_ID" TYPE="long" VALUE="3435975204127628155" />
<STATE NAME="_CLASSNAME" TYPE="string" VALUE="ghidra.program.util.MemoryBlockStartFieldLocation" />
<STATE NAME="_COLUMN" TYPE="int" VALUE="0" />
<STATE NAME="_CHAR_OFFSET" TYPE="int" VALUE="0" />
<STATE NAME="_ROW" TYPE="int" VALUE="0" />
<STATE NAME="_BYTE_ADDR" TYPE="string" VALUE="00400000" />
<STATE NAME="PROGRAM_PATH_" TYPE="string" VALUE="pwn:/mr_snowy" />
<STATE NAME="_TYPE" TYPE="int" VALUE="-1" />
</SAVE_STATE>
</XML>
<STATE NAME="_ADDRESS" TYPE="string" VALUE="00400000" />
<XML NAME="MEMENTO0">
<SAVE_STATE>
<STATE NAME="NAV_ID" TYPE="long" VALUE="3435975333167487851" />
<STATE NAME="_ADDRESS" TYPE="string" VALUE="00400000" />
<STATE NAME="Block Num" TYPE="int" VALUE="0" />
<STATE NAME="MEMENTO_CLASS" TYPE="string" VALUE="ghidra.app.plugin.core.byteviewer.ByteViewerLocationMemento" />
<STATE NAME="PROGRAM_ID" TYPE="long" VALUE="3435975204127628155" />
<STATE NAME="_CLASSNAME" TYPE="string" VALUE="ghidra.app.plugin.core.byteviewer.ByteViewerProgramLocation" />
<STATE NAME="_COLUMN" TYPE="int" VALUE="0" />
<STATE NAME="_CHAR_OFFSET" TYPE="int" VALUE="0" />
<STATE NAME="_ROW" TYPE="int" VALUE="0" />
<STATE NAME="_BYTE_ADDR" TYPE="string" VALUE="00400000" />
<STATE NAME="PROGRAM_PATH_" TYPE="string" VALUE="pwn:/mr_snowy" />
<STATE NAME="INDEX" TYPE="int" VALUE="0" />
<STATE NAME="Y_OFFSET" TYPE="int" VALUE="0" />
<STATE NAME="X_OFFSET" TYPE="int" VALUE="0" />
<STATE NAME="Block Offset" TYPE="string" VALUE="0" />
</SAVE_STATE>
</XML>
<STATE NAME="MEMENTO_CLASS" TYPE="string" VALUE="ghidra.app.plugin.core.gotoquery.DefaultNavigatableLocationMemento" />
<STATE NAME="PROGRAM_ID" TYPE="long" VALUE="3435975204127628155" />
<STATE NAME="_CLASSNAME" TYPE="string" VALUE="ghidra.program.util.MemoryBlockStartFieldLocation" />
<STATE NAME="_COLUMN" TYPE="int" VALUE="0" />
<STATE NAME="_CHAR_OFFSET" TYPE="int" VALUE="0" />
<STATE NAME="_ROW" TYPE="int" VALUE="0" />
<STATE NAME="_BYTE_ADDR" TYPE="string" VALUE="00400000" />
<STATE NAME="NUM_MEMENTOS" TYPE="int" VALUE="2" />
<STATE NAME="PROGRAM_PATH_" TYPE="string" VALUE="pwn:/mr_snowy" />
<STATE NAME="_TYPE" TYPE="int" VALUE="-1" />
</SAVE_STATE>
</XML>
<STATE NAME="MEMENTO_CLASS1" TYPE="string" VALUE="ghidra.app.plugin.core.gotoquery.DefaultNavigatableLocationMemento" />
<STATE NAME="MEMENTO_CLASS0" TYPE="string" VALUE="ghidra.app.plugin.core.gotoquery.DefaultNavigatableLocationMemento" />
<XML NAME="MEMENTO_DATA1">
<SAVE_STATE>
<STATE NAME="_FUNC_ADDRESS" TYPE="string" VALUE="0040153e" />
<STATE NAME="_RETURN_TYPE" TYPE="string" VALUE="undefined8" />
<XML NAME="MEMENTO1">
<SAVE_STATE>
<STATE NAME="NAV_ID" TYPE="long" VALUE="3435975333167487857" />
<STATE NAME="_FUNC_ADDRESS" TYPE="string" VALUE="0040153e" />
<STATE NAME="_RETURN_TYPE" TYPE="string" VALUE="undefined8" />
<STATE NAME="_ADDRESS" TYPE="string" VALUE="0040153e" />
<STATE NAME="MEMENTO_CLASS" TYPE="string" VALUE="ghidra.app.plugin.core.decompile.DecompilerLocationMemento" />
<STATE NAME="PROGRAM_ID" TYPE="long" VALUE="3435975204127628155" />
<STATE NAME="_SIGNATURE" TYPE="string" VALUE="undefined8 main(undefined8 param_1, undefined4 param_2, undefined4 param_3, undefined4 param_4, undefined4 param_5, undefined4 param_6, undefined4 param_7, undefined4 param_8)" />
<STATE NAME="_CLASSNAME" TYPE="string" VALUE="ghidra.program.util.FunctionReturnTypeFieldLocation" />
<STATE NAME="_COLUMN" TYPE="int" VALUE="0" />
<STATE NAME="_CHAR_OFFSET" TYPE="int" VALUE="0" />
<STATE NAME="_ROW" TYPE="int" VALUE="0" />
<STATE NAME="_BYTE_ADDR" TYPE="string" VALUE="0040153e" />
<STATE NAME="PROGRAM_PATH_" TYPE="string" VALUE="pwn:/mr_snowy" />
<STATE NAME="INDEX" TYPE="int" VALUE="0" />
<STATE NAME="X_OFFSET" TYPE="int" VALUE="0" />
<STATE NAME="Y_OFFSET" TYPE="int" VALUE="0" />
</SAVE_STATE>
</XML>
<STATE NAME="_ADDRESS" TYPE="string" VALUE="0040153e" />
<XML NAME="MEMENTO2">
<SAVE_STATE>
<STATE NAME="NAV_ID" TYPE="long" VALUE="3435975333167487854" />
<STATE NAME="_FUNC_ADDRESS" TYPE="string" VALUE="0040153e" />
<STATE NAME="_RETURN_TYPE" TYPE="string" VALUE="undefined8" />
<STATE NAME="_ADDRESS" TYPE="string" VALUE="0040153e" />
<STATE NAME="MEMENTO_CLASS" TYPE="string" VALUE="ghidra.app.plugin.core.codebrowser.CodeViewerLocationMemento" />
<STATE NAME="CURSOR_OFFSET" TYPE="int" VALUE="340" />
<STATE NAME="PROGRAM_ID" TYPE="long" VALUE="3435975204127628155" />
<STATE NAME="_SIGNATURE" TYPE="string" VALUE="undefined8 __stdcall main(undefined8 param_1, undefined4 param_2, undefined4 param_3, undefined4 param_4, undefined4 param_5, undefined4 param_6, undefined4 param_7, undefined4 param_8)" />
<STATE NAME="_CLASSNAME" TYPE="string" VALUE="ghidra.program.util.FunctionReturnTypeFieldLocation" />
<STATE NAME="_COLUMN" TYPE="int" VALUE="0" />
<STATE NAME="_CHAR_OFFSET" TYPE="int" VALUE="0" />
<STATE NAME="_ROW" TYPE="int" VALUE="0" />
<STATE NAME="_BYTE_ADDR" TYPE="string" VALUE="0040153e" />
<STATE NAME="PROGRAM_PATH_" TYPE="string" VALUE="pwn:/mr_snowy" />
</SAVE_STATE>
</XML>
<XML NAME="MEMENTO0">
<SAVE_STATE>
<STATE NAME="NAV_ID" TYPE="long" VALUE="3435975333167487851" />
<STATE NAME="_ADDRESS" TYPE="string" VALUE="0040153e" />
<STATE NAME="Block Num" TYPE="int" VALUE="13" />
<STATE NAME="MEMENTO_CLASS" TYPE="string" VALUE="ghidra.app.plugin.core.byteviewer.ByteViewerLocationMemento" />
<STATE NAME="PROGRAM_ID" TYPE="long" VALUE="3435975204127628155" />
<STATE NAME="_CLASSNAME" TYPE="string" VALUE="ghidra.app.plugin.core.byteviewer.ByteViewerProgramLocation" />
<STATE NAME="_COLUMN" TYPE="int" VALUE="0" />
<STATE NAME="_CHAR_OFFSET" TYPE="int" VALUE="0" />
<STATE NAME="_ROW" TYPE="int" VALUE="0" />
<STATE NAME="_BYTE_ADDR" TYPE="string" VALUE="0040153e" />
<STATE NAME="PROGRAM_PATH_" TYPE="string" VALUE="pwn:/mr_snowy" />
<STATE NAME="INDEX" TYPE="int" VALUE="324" />
<STATE NAME="Y_OFFSET" TYPE="int" VALUE="-1" />
<STATE NAME="X_OFFSET" TYPE="int" VALUE="-1" />
<STATE NAME="Block Offset" TYPE="string" VALUE="2926" />
</SAVE_STATE>
</XML>
<STATE NAME="MEMENTO_CLASS" TYPE="string" VALUE="ghidra.app.plugin.core.gotoquery.DefaultNavigatableLocationMemento" />
<STATE NAME="PROGRAM_ID" TYPE="long" VALUE="3435975204127628155" />
<STATE NAME="_SIGNATURE" TYPE="string" VALUE="undefined8 main(undefined8 param_1, undefined4 param_2, undefined4 param_3, undefined4 param_4, undefined4 param_5, undefined4 param_6, undefined4 param_7, undefined4 param_8)" />
<STATE NAME="_CLASSNAME" TYPE="string" VALUE="ghidra.program.util.FunctionReturnTypeFieldLocation" />
<STATE NAME="_COLUMN" TYPE="int" VALUE="0" />
<STATE NAME="_CHAR_OFFSET" TYPE="int" VALUE="0" />
<STATE NAME="_ROW" TYPE="int" VALUE="0" />
<STATE NAME="_BYTE_ADDR" TYPE="string" VALUE="0040153e" />
<STATE NAME="NUM_MEMENTOS" TYPE="int" VALUE="3" />
<STATE NAME="PROGRAM_PATH_" TYPE="string" VALUE="pwn:/mr_snowy" />
</SAVE_STATE>
</XML>
<XML NAME="MEMENTO_DATA6">
<SAVE_STATE>
<STATE NAME="_LINE_NUM" TYPE="int" VALUE="8" />
<STATE NAME="_TOKEN_TEXT" TYPE="string" VALUE="setup" />
<STATE NAME="_CHAR_POS" TYPE="int" VALUE="10" />
<XML NAME="MEMENTO1">
<SAVE_STATE>
<STATE NAME="NAV_ID" TYPE="long" VALUE="3435975333167487857" />
<STATE NAME="_LINE_NUM" TYPE="int" VALUE="8" />
<STATE NAME="_TOKEN_TEXT" TYPE="string" VALUE="setup" />
<STATE NAME="_CHAR_POS" TYPE="int" VALUE="10" />
<STATE NAME="_ADDRESS" TYPE="string" VALUE="00401542" />
<STATE NAME="MEMENTO_CLASS" TYPE="string" VALUE="ghidra.app.plugin.core.decompile.DecompilerLocationMemento" />
<STATE NAME="PROGRAM_ID" TYPE="long" VALUE="3435975204127628155" />
<STATE NAME="_FUNCTION_ENTRY" TYPE="string" VALUE="0040153e" />
<STATE NAME="_CLASSNAME" TYPE="string" VALUE="ghidra.app.decompiler.DecompilerLocation" />
<STATE NAME="_COLUMN" TYPE="int" VALUE="0" />
<STATE NAME="_CHAR_OFFSET" TYPE="int" VALUE="0" />
<STATE NAME="_ROW" TYPE="int" VALUE="0" />
<STATE NAME="_BYTE_ADDR" TYPE="string" VALUE="00401542" />
<STATE NAME="PROGRAM_PATH_" TYPE="string" VALUE="pwn:/mr_snowy" />
<STATE NAME="INDEX" TYPE="int" VALUE="0" />
<STATE NAME="X_OFFSET" TYPE="int" VALUE="0" />
<STATE NAME="Y_OFFSET" TYPE="int" VALUE="0" />
</SAVE_STATE>
</XML>
<STATE NAME="_ADDRESS" TYPE="string" VALUE="00401542" />
<XML NAME="MEMENTO2">
<SAVE_STATE>
<STATE NAME="NAV_ID" TYPE="long" VALUE="3435975333167487854" />
<STATE NAME="_CLASSNAME" TYPE="string" VALUE="ghidra.program.util.AddressFieldLocation" />
<STATE NAME="_COLUMN" TYPE="int" VALUE="0" />
<STATE NAME="_CHAR_OFFSET" TYPE="int" VALUE="0" />
<STATE NAME="_ADDRESS" TYPE="string" VALUE="00401542" />
<STATE NAME="_ROW" TYPE="int" VALUE="0" />
<STATE NAME="_BYTE_ADDR" TYPE="string" VALUE="00401542" />
<STATE NAME="MEMENTO_CLASS" TYPE="string" VALUE="ghidra.app.plugin.core.codebrowser.CodeViewerLocationMemento" />
<STATE NAME="PROGRAM_PATH_" TYPE="string" VALUE="pwn:/mr_snowy" />
<STATE NAME="_ADDR_REP" TYPE="string" VALUE="00401542" />
<STATE NAME="CURSOR_OFFSET" TYPE="int" VALUE="612" />
<STATE NAME="PROGRAM_ID" TYPE="long" VALUE="3435975204127628155" />
</SAVE_STATE>
</XML>
<XML NAME="MEMENTO0">
<SAVE_STATE>
<STATE NAME="NAV_ID" TYPE="long" VALUE="3435975333167487851" />
<STATE NAME="_ADDRESS" TYPE="string" VALUE="00401542" />
<STATE NAME="Block Num" TYPE="int" VALUE="13" />
<STATE NAME="MEMENTO_CLASS" TYPE="string" VALUE="ghidra.app.plugin.core.byteviewer.ByteViewerLocationMemento" />
<STATE NAME="PROGRAM_ID" TYPE="long" VALUE="3435975204127628155" />
<STATE NAME="_CLASSNAME" TYPE="string" VALUE="ghidra.app.plugin.core.byteviewer.ByteViewerProgramLocation" />
<STATE NAME="_COLUMN" TYPE="int" VALUE="0" />
<STATE NAME="_CHAR_OFFSET" TYPE="int" VALUE="0" />
<STATE NAME="_ROW" TYPE="int" VALUE="0" />
<STATE NAME="_BYTE_ADDR" TYPE="string" VALUE="00401542" />
<STATE NAME="PROGRAM_PATH_" TYPE="string" VALUE="pwn:/mr_snowy" />
<STATE NAME="INDEX" TYPE="int" VALUE="325" />
<STATE NAME="Y_OFFSET" TYPE="int" VALUE="-1" />
<STATE NAME="X_OFFSET" TYPE="int" VALUE="-1" />
<STATE NAME="Block Offset" TYPE="string" VALUE="2930" />
</SAVE_STATE>
</XML>
<STATE NAME="MEMENTO_CLASS" TYPE="string" VALUE="ghidra.app.plugin.core.gotoquery.DefaultNavigatableLocationMemento" />
<STATE NAME="PROGRAM_ID" TYPE="long" VALUE="3435975204127628155" />
<STATE NAME="_FUNCTION_ENTRY" TYPE="string" VALUE="0040153e" />
<STATE NAME="_CLASSNAME" TYPE="string" VALUE="ghidra.app.decompiler.DecompilerLocation" />
<STATE NAME="_COLUMN" TYPE="int" VALUE="0" />
<STATE NAME="_CHAR_OFFSET" TYPE="int" VALUE="0" />
<STATE NAME="FOCUSED_NAV" TYPE="long" VALUE="3435975333167487857" />
<STATE NAME="_ROW" TYPE="int" VALUE="0" />
<STATE NAME="_BYTE_ADDR" TYPE="string" VALUE="00401542" />
<STATE NAME="NUM_MEMENTOS" TYPE="int" VALUE="3" />
<STATE NAME="PROGRAM_PATH_" TYPE="string" VALUE="pwn:/mr_snowy" />
</SAVE_STATE>
</XML>
<XML NAME="MEMENTO_DATA7">
<SAVE_STATE>
<XML NAME="MEMENTO1">
<SAVE_STATE>
<STATE NAME="NAV_ID" TYPE="long" VALUE="3435975333167487857" />
<STATE NAME="_ADDRESS" TYPE="string" VALUE="004014f1" />
<STATE NAME="MEMENTO_CLASS" TYPE="string" VALUE="ghidra.app.plugin.core.decompile.DecompilerLocationMemento" />
<STATE NAME="PROGRAM_ID" TYPE="long" VALUE="3435975204127628155" />
<STATE NAME="_CLASSNAME" TYPE="string" VALUE="ghidra.program.util.ProgramLocation" />
<STATE NAME="_COLUMN" TYPE="int" VALUE="0" />
<STATE NAME="_CHAR_OFFSET" TYPE="int" VALUE="0" />
<STATE NAME="_ROW" TYPE="int" VALUE="0" />
<STATE NAME="_BYTE_ADDR" TYPE="string" VALUE="004014f1" />
<STATE NAME="PROGRAM_PATH_" TYPE="string" VALUE="pwn:/mr_snowy" />
<STATE NAME="INDEX" TYPE="int" VALUE="0" />
<STATE NAME="X_OFFSET" TYPE="int" VALUE="0" />
<STATE NAME="Y_OFFSET" TYPE="int" VALUE="0" />
</SAVE_STATE>
</XML>
<STATE NAME="_ADDRESS" TYPE="string" VALUE="004014f1" />
<XML NAME="MEMENTO2">
<SAVE_STATE>
<STATE NAME="NAV_ID" TYPE="long" VALUE="3435975333167487854" />
<STATE NAME="_CLASSNAME" TYPE="string" VALUE="ghidra.program.util.AddressFieldLocation" />
<STATE NAME="_COLUMN" TYPE="int" VALUE="0" />
<STATE NAME="_CHAR_OFFSET" TYPE="int" VALUE="0" />
<STATE NAME="_ADDRESS" TYPE="string" VALUE="004014f1" />
<STATE NAME="_ROW" TYPE="int" VALUE="0" />
<STATE NAME="_BYTE_ADDR" TYPE="string" VALUE="004014f1" />
<STATE NAME="MEMENTO_CLASS" TYPE="string" VALUE="ghidra.app.plugin.core.codebrowser.CodeViewerLocationMemento" />
<STATE NAME="PROGRAM_PATH_" TYPE="string" VALUE="pwn:/mr_snowy" />
<STATE NAME="_ADDR_REP" TYPE="string" VALUE="004014f1" />
<STATE NAME="CURSOR_OFFSET" TYPE="int" VALUE="340" />
<STATE NAME="PROGRAM_ID" TYPE="long" VALUE="3435975204127628155" />
</SAVE_STATE>
</XML>
<XML NAME="MEMENTO0">
<SAVE_STATE>
<STATE NAME="NAV_ID" TYPE="long" VALUE="3435975333167487851" />
<STATE NAME="_ADDRESS" TYPE="string" VALUE="004014f1" />
<STATE NAME="Block Num" TYPE="int" VALUE="13" />
<STATE NAME="MEMENTO_CLASS" TYPE="string" VALUE="ghidra.app.plugin.core.byteviewer.ByteViewerLocationMemento" />
<STATE NAME="PROGRAM_ID" TYPE="long" VALUE="3435975204127628155" />
<STATE NAME="_CLASSNAME" TYPE="string" VALUE="ghidra.app.plugin.core.byteviewer.ByteViewerProgramLocation" />
<STATE NAME="_COLUMN" TYPE="int" VALUE="0" />
<STATE NAME="_CHAR_OFFSET" TYPE="int" VALUE="0" />
<STATE NAME="_ROW" TYPE="int" VALUE="0" />
<STATE NAME="_BYTE_ADDR" TYPE="string" VALUE="004014f1" />
<STATE NAME="PROGRAM_PATH_" TYPE="string" VALUE="pwn:/mr_snowy" />
<STATE NAME="INDEX" TYPE="int" VALUE="325" />
<STATE NAME="Y_OFFSET" TYPE="int" VALUE="-1" />
<STATE NAME="X_OFFSET" TYPE="int" VALUE="-1" />
<STATE NAME="Block Offset" TYPE="string" VALUE="2849" />
</SAVE_STATE>
</XML>
<STATE NAME="MEMENTO_CLASS" TYPE="string" VALUE="ghidra.app.plugin.core.gotoquery.DefaultNavigatableLocationMemento" />
<STATE NAME="PROGRAM_ID" TYPE="long" VALUE="3435975204127628155" />
<STATE NAME="_CLASSNAME" TYPE="string" VALUE="ghidra.program.util.ProgramLocation" />
<STATE NAME="_COLUMN" TYPE="int" VALUE="0" />
<STATE NAME="_CHAR_OFFSET" TYPE="int" VALUE="0" />
<STATE NAME="FOCUSED_NAV" TYPE="long" VALUE="3435975333167487857" />
<STATE NAME="_ROW" TYPE="int" VALUE="0" />
<STATE NAME="_BYTE_ADDR" TYPE="string" VALUE="004014f1" />
<STATE NAME="NUM_MEMENTOS" TYPE="int" VALUE="3" />
<STATE NAME="PROGRAM_PATH_" TYPE="string" VALUE="pwn:/mr_snowy" />
</SAVE_STATE>
</XML>
<XML NAME="MEMENTO_DATA4">
<SAVE_STATE>
<STATE NAME="_FUNC_ADDRESS" TYPE="string" VALUE="004014f1" />
<STATE NAME="_RETURN_TYPE" TYPE="string" VALUE="undefined" />
<XML NAME="MEMENTO1">
<SAVE_STATE>
<STATE NAME="NAV_ID" TYPE="long" VALUE="3435975333167487857" />
<STATE NAME="_FUNC_ADDRESS" TYPE="string" VALUE="004014f1" />
<STATE NAME="_RETURN_TYPE" TYPE="string" VALUE="undefined" />
<STATE NAME="_ADDRESS" TYPE="string" VALUE="004014f1" />
<STATE NAME="MEMENTO_CLASS" TYPE="string" VALUE="ghidra.app.plugin.core.decompile.DecompilerLocationMemento" />
<STATE NAME="PROGRAM_ID" TYPE="long" VALUE="3435975204127628155" />
<STATE NAME="_SIGNATURE" TYPE="string" VALUE="undefined setup(void)" />
<STATE NAME="_CLASSNAME" TYPE="string" VALUE="ghidra.program.util.FunctionReturnTypeFieldLocation" />
<STATE NAME="_COLUMN" TYPE="int" VALUE="0" />
<STATE NAME="_CHAR_OFFSET" TYPE="int" VALUE="0" />
<STATE NAME="_ROW" TYPE="int" VALUE="0" />
<STATE NAME="_BYTE_ADDR" TYPE="string" VALUE="004014f1" />
<STATE NAME="PROGRAM_PATH_" TYPE="string" VALUE="pwn:/mr_snowy" />
<STATE NAME="INDEX" TYPE="int" VALUE="0" />
<STATE NAME="X_OFFSET" TYPE="int" VALUE="0" />
<STATE NAME="Y_OFFSET" TYPE="int" VALUE="0" />
</SAVE_STATE>
</XML>
<STATE NAME="_ADDRESS" TYPE="string" VALUE="004014f1" />
<XML NAME="MEMENTO2">
<SAVE_STATE>
<STATE NAME="NAV_ID" TYPE="long" VALUE="3435975333167487854" />
<STATE NAME="_FUNC_ADDRESS" TYPE="string" VALUE="004014f1" />
<STATE NAME="_RETURN_TYPE" TYPE="string" VALUE="undefined" />
<STATE NAME="_ADDRESS" TYPE="string" VALUE="004014f1" />
<STATE NAME="MEMENTO_CLASS" TYPE="string" VALUE="ghidra.app.plugin.core.codebrowser.CodeViewerLocationMemento" />
<STATE NAME="CURSOR_OFFSET" TYPE="int" VALUE="340" />
<STATE NAME="PROGRAM_ID" TYPE="long" VALUE="3435975204127628155" />
<STATE NAME="_SIGNATURE" TYPE="string" VALUE="undefined __stdcall setup(void)" />
<STATE NAME="_CLASSNAME" TYPE="string" VALUE="ghidra.program.util.FunctionReturnTypeFieldLocation" />
<STATE NAME="_COLUMN" TYPE="int" VALUE="0" />
<STATE NAME="_CHAR_OFFSET" TYPE="int" VALUE="0" />
<STATE NAME="_ROW" TYPE="int" VALUE="0" />
<STATE NAME="_BYTE_ADDR" TYPE="string" VALUE="004014f1" />
<STATE NAME="PROGRAM_PATH_" TYPE="string" VALUE="pwn:/mr_snowy" />
</SAVE_STATE>
</XML>
<XML NAME="MEMENTO0">
<SAVE_STATE>
<STATE NAME="NAV_ID" TYPE="long" VALUE="3435975333167487851" />
<STATE NAME="_ADDRESS" TYPE="string" VALUE="004014f1" />
<STATE NAME="Block Num" TYPE="int" VALUE="13" />
<STATE NAME="MEMENTO_CLASS" TYPE="string" VALUE="ghidra.app.plugin.core.byteviewer.ByteViewerLocationMemento" />
<STATE NAME="PROGRAM_ID" TYPE="long" VALUE="3435975204127628155" />
<STATE NAME="_CLASSNAME" TYPE="string" VALUE="ghidra.app.plugin.core.byteviewer.ByteViewerProgramLocation" />
<STATE NAME="_COLUMN" TYPE="int" VALUE="0" />
<STATE NAME="_CHAR_OFFSET" TYPE="int" VALUE="0" />
<STATE NAME="_ROW" TYPE="int" VALUE="0" />
<STATE NAME="_BYTE_ADDR" TYPE="string" VALUE="004014f1" />
<STATE NAME="PROGRAM_PATH_" TYPE="string" VALUE="pwn:/mr_snowy" />
<STATE NAME="INDEX" TYPE="int" VALUE="320" />
<STATE NAME="Y_OFFSET" TYPE="int" VALUE="-1" />
<STATE NAME="X_OFFSET" TYPE="int" VALUE="-1" />
<STATE NAME="Block Offset" TYPE="string" VALUE="2849" />
</SAVE_STATE>
</XML>
<STATE NAME="MEMENTO_CLASS" TYPE="string" VALUE="ghidra.app.plugin.core.gotoquery.DefaultNavigatableLocationMemento" />
<STATE NAME="PROGRAM_ID" TYPE="long" VALUE="3435975204127628155" />
<STATE NAME="_SIGNATURE" TYPE="string" VALUE="undefined setup(void)" />
<STATE NAME="_CLASSNAME" TYPE="string" VALUE="ghidra.program.util.FunctionReturnTypeFieldLocation" />
<STATE NAME="_COLUMN" TYPE="int" VALUE="0" />
<STATE NAME="_CHAR_OFFSET" TYPE="int" VALUE="0" />
<STATE NAME="_ROW" TYPE="int" VALUE="0" />
<STATE NAME="_BYTE_ADDR" TYPE="string" VALUE="004014f1" />
<STATE NAME="NUM_MEMENTOS" TYPE="int" VALUE="3" />
<STATE NAME="PROGRAM_PATH_" TYPE="string" VALUE="pwn:/mr_snowy" />
</SAVE_STATE>
</XML>
<XML NAME="MEMENTO_DATA5">
<SAVE_STATE>
<STATE NAME="_FUNC_ADDRESS" TYPE="string" VALUE="0040153e" />
<STATE NAME="_RETURN_TYPE" TYPE="string" VALUE="undefined8" />
<XML NAME="MEMENTO1">
<SAVE_STATE>
<STATE NAME="NAV_ID" TYPE="long" VALUE="3435975333167487857" />
<STATE NAME="_FUNC_ADDRESS" TYPE="string" VALUE="004014f1" />
<STATE NAME="_RETURN_TYPE" TYPE="string" VALUE="undefined" />
<STATE NAME="_ADDRESS" TYPE="string" VALUE="004014f1" />
<STATE NAME="MEMENTO_CLASS" TYPE="string" VALUE="ghidra.app.plugin.core.decompile.DecompilerLocationMemento" />
<STATE NAME="PROGRAM_ID" TYPE="long" VALUE="3435975204127628155" />
<STATE NAME="_SIGNATURE" TYPE="string" VALUE="undefined setup(void)" />
<STATE NAME="_CLASSNAME" TYPE="string" VALUE="ghidra.program.util.FunctionReturnTypeFieldLocation" />
<STATE NAME="_COLUMN" TYPE="int" VALUE="0" />
<STATE NAME="_CHAR_OFFSET" TYPE="int" VALUE="0" />
<STATE NAME="_ROW" TYPE="int" VALUE="0" />
<STATE NAME="_BYTE_ADDR" TYPE="string" VALUE="004014f1" />
<STATE NAME="PROGRAM_PATH_" TYPE="string" VALUE="pwn:/mr_snowy" />
<STATE NAME="INDEX" TYPE="int" VALUE="0" />
<STATE NAME="X_OFFSET" TYPE="int" VALUE="0" />
<STATE NAME="Y_OFFSET" TYPE="int" VALUE="0" />
</SAVE_STATE>
</XML>
<STATE NAME="_ADDRESS" TYPE="string" VALUE="0040153e" />
<XML NAME="MEMENTO2">
<SAVE_STATE>
<STATE NAME="NAV_ID" TYPE="long" VALUE="3435975333167487854" />
<STATE NAME="_FUNC_ADDRESS" TYPE="string" VALUE="0040153e" />
<STATE NAME="_RETURN_TYPE" TYPE="string" VALUE="undefined8" />
<STATE NAME="_ADDRESS" TYPE="string" VALUE="0040153e" />
<STATE NAME="MEMENTO_CLASS" TYPE="string" VALUE="ghidra.app.plugin.core.codebrowser.CodeViewerLocationMemento" />
<STATE NAME="CURSOR_OFFSET" TYPE="int" VALUE="340" />
<STATE NAME="PROGRAM_ID" TYPE="long" VALUE="3435975204127628155" />
<STATE NAME="_SIGNATURE" TYPE="string" VALUE="undefined8 __stdcall main(undefined8 param_1, undefined4 param_2, undefined4 param_3, undefined4 param_4, undefined4 param_5, undefined4 param_6, undefined4 param_7, undefined4 param_8)" />
<STATE NAME="_CLASSNAME" TYPE="string" VALUE="ghidra.program.util.FunctionReturnTypeFieldLocation" />
<STATE NAME="_COLUMN" TYPE="int" VALUE="0" />
<STATE NAME="_CHAR_OFFSET" TYPE="int" VALUE="0" />
<STATE NAME="_ROW" TYPE="int" VALUE="0" />
<STATE NAME="_BYTE_ADDR" TYPE="string" VALUE="0040153e" />
<STATE NAME="PROGRAM_PATH_" TYPE="string" VALUE="pwn:/mr_snowy" />
</SAVE_STATE>
</XML>
<XML NAME="MEMENTO0">
<SAVE_STATE>
<STATE NAME="NAV_ID" TYPE="long" VALUE="3435975333167487851" />
<STATE NAME="_ADDRESS" TYPE="string" VALUE="0040153e" />
<STATE NAME="Block Num" TYPE="int" VALUE="13" />
<STATE NAME="MEMENTO_CLASS" TYPE="string" VALUE="ghidra.app.plugin.core.byteviewer.ByteViewerLocationMemento" />
<STATE NAME="PROGRAM_ID" TYPE="long" VALUE="3435975204127628155" />
<STATE NAME="_CLASSNAME" TYPE="string" VALUE="ghidra.app.plugin.core.byteviewer.ByteViewerProgramLocation" />
<STATE NAME="_COLUMN" TYPE="int" VALUE="0" />
<STATE NAME="_CHAR_OFFSET" TYPE="int" VALUE="0" />
<STATE NAME="_ROW" TYPE="int" VALUE="0" />
<STATE NAME="_BYTE_ADDR" TYPE="string" VALUE="0040153e" />
<STATE NAME="PROGRAM_PATH_" TYPE="string" VALUE="pwn:/mr_snowy" />
<STATE NAME="INDEX" TYPE="int" VALUE="324" />
<STATE NAME="Y_OFFSET" TYPE="int" VALUE="-1" />
<STATE NAME="X_OFFSET" TYPE="int" VALUE="-1" />
<STATE NAME="Block Offset" TYPE="string" VALUE="2926" />
</SAVE_STATE>
</XML>
<STATE NAME="MEMENTO_CLASS" TYPE="string" VALUE="ghidra.app.plugin.core.gotoquery.DefaultNavigatableLocationMemento" />
<STATE NAME="PROGRAM_ID" TYPE="long" VALUE="3435975204127628155" />
<STATE NAME="_SIGNATURE" TYPE="string" VALUE="undefined8 main(undefined8 param_1, undefined4 param_2, undefined4 param_3, undefined4 param_4, undefined4 param_5, undefined4 param_6, undefined4 param_7, undefined4 param_8)" />
<STATE NAME="_CLASSNAME" TYPE="string" VALUE="ghidra.program.util.FunctionReturnTypeFieldLocation" />
<STATE NAME="_COLUMN" TYPE="int" VALUE="0" />
<STATE NAME="_CHAR_OFFSET" TYPE="int" VALUE="0" />
<STATE NAME="_ROW" TYPE="int" VALUE="0" />
<STATE NAME="_BYTE_ADDR" TYPE="string" VALUE="0040153e" />
<STATE NAME="NUM_MEMENTOS" TYPE="int" VALUE="3" />
<STATE NAME="PROGRAM_PATH_" TYPE="string" VALUE="pwn:/mr_snowy" />
</SAVE_STATE>
</XML>
<XML NAME="MEMENTO_DATA8">
<SAVE_STATE>
<STATE NAME="_FUNC_ADDRESS" TYPE="string" VALUE="00401374" />
<STATE NAME="_RETURN_TYPE" TYPE="string" VALUE="undefined" />
<XML NAME="MEMENTO1">
<SAVE_STATE>
<STATE NAME="NAV_ID" TYPE="long" VALUE="3435975333167487857" />
<STATE NAME="_ADDRESS" TYPE="string" VALUE="004014f1" />
<STATE NAME="MEMENTO_CLASS" TYPE="string" VALUE="ghidra.app.plugin.core.decompile.DecompilerLocationMemento" />
<STATE NAME="PROGRAM_ID" TYPE="long" VALUE="3435975204127628155" />
<STATE NAME="_CLASSNAME" TYPE="string" VALUE="ghidra.program.util.ProgramLocation" />
<STATE NAME="_COLUMN" TYPE="int" VALUE="0" />
<STATE NAME="_CHAR_OFFSET" TYPE="int" VALUE="0" />
<STATE NAME="_ROW" TYPE="int" VALUE="0" />
<STATE NAME="_BYTE_ADDR" TYPE="string" VALUE="004014f1" />
<STATE NAME="PROGRAM_PATH_" TYPE="string" VALUE="pwn:/mr_snowy" />
<STATE NAME="INDEX" TYPE="int" VALUE="0" />
<STATE NAME="X_OFFSET" TYPE="int" VALUE="0" />
<STATE NAME="Y_OFFSET" TYPE="int" VALUE="0" />
</SAVE_STATE>
</XML>
<STATE NAME="_ADDRESS" TYPE="string" VALUE="00401374" />
<XML NAME="MEMENTO2">
<SAVE_STATE>
<STATE NAME="NAV_ID" TYPE="long" VALUE="3435975333167487854" />
<STATE NAME="_FUNC_ADDRESS" TYPE="string" VALUE="00401374" />
<STATE NAME="_RETURN_TYPE" TYPE="string" VALUE="undefined" />
<STATE NAME="_ADDRESS" TYPE="string" VALUE="00401374" />
<STATE NAME="MEMENTO_CLASS" TYPE="string" VALUE="ghidra.app.plugin.core.codebrowser.CodeViewerLocationMemento" />
<STATE NAME="CURSOR_OFFSET" TYPE="int" VALUE="340" />
<STATE NAME="PROGRAM_ID" TYPE="long" VALUE="3435975204127628155" />
<STATE NAME="_SIGNATURE" TYPE="string" VALUE="undefined __stdcall investigate(void)" />
<STATE NAME="_CLASSNAME" TYPE="string" VALUE="ghidra.program.util.FunctionReturnTypeFieldLocation" />
<STATE NAME="_COLUMN" TYPE="int" VALUE="0" />
<STATE NAME="_CHAR_OFFSET" TYPE="int" VALUE="0" />
<STATE NAME="_ROW" TYPE="int" VALUE="0" />
<STATE NAME="_BYTE_ADDR" TYPE="string" VALUE="00401374" />
<STATE NAME="PROGRAM_PATH_" TYPE="string" VALUE="pwn:/mr_snowy" />
</SAVE_STATE>
</XML>
<XML NAME="MEMENTO0">
<SAVE_STATE>
<STATE NAME="NAV_ID" TYPE="long" VALUE="3435975333167487851" />
<STATE NAME="_ADDRESS" TYPE="string" VALUE="00401374" />
<STATE NAME="Block Num" TYPE="int" VALUE="13" />
<STATE NAME="MEMENTO_CLASS" TYPE="string" VALUE="ghidra.app.plugin.core.byteviewer.ByteViewerLocationMemento" />
<STATE NAME="PROGRAM_ID" TYPE="long" VALUE="3435975204127628155" />
<STATE NAME="_CLASSNAME" TYPE="string" VALUE="ghidra.app.plugin.core.byteviewer.ByteViewerProgramLocation" />
<STATE NAME="_COLUMN" TYPE="int" VALUE="0" />
<STATE NAME="_CHAR_OFFSET" TYPE="int" VALUE="0" />
<STATE NAME="_ROW" TYPE="int" VALUE="0" />
<STATE NAME="_BYTE_ADDR" TYPE="string" VALUE="00401374" />
<STATE NAME="PROGRAM_PATH_" TYPE="string" VALUE="pwn:/mr_snowy" />
<STATE NAME="INDEX" TYPE="int" VALUE="325" />
<STATE NAME="Y_OFFSET" TYPE="int" VALUE="-1" />
<STATE NAME="X_OFFSET" TYPE="int" VALUE="-1" />
<STATE NAME="Block Offset" TYPE="string" VALUE="2468" />
</SAVE_STATE>
</XML>
<STATE NAME="MEMENTO_CLASS" TYPE="string" VALUE="ghidra.app.plugin.core.gotoquery.DefaultNavigatableLocationMemento" />
<STATE NAME="PROGRAM_ID" TYPE="long" VALUE="3435975204127628155" />
<STATE NAME="_SIGNATURE" TYPE="string" VALUE="undefined investigate(void)" />
<STATE NAME="_CLASSNAME" TYPE="string" VALUE="ghidra.program.util.FunctionReturnTypeFieldLocation" />
<STATE NAME="_COLUMN" TYPE="int" VALUE="0" />
<STATE NAME="_CHAR_OFFSET" TYPE="int" VALUE="0" />
<STATE NAME="_ROW" TYPE="int" VALUE="0" />
<STATE NAME="_BYTE_ADDR" TYPE="string" VALUE="00401374" />
<STATE NAME="NUM_MEMENTOS" TYPE="int" VALUE="3" />
<STATE NAME="PROGRAM_PATH_" TYPE="string" VALUE="pwn:/mr_snowy" />
</SAVE_STATE>
</XML>
<XML NAME="MEMENTO_DATA9">
<SAVE_STATE>
<STATE NAME="_LINE_NUM" TYPE="int" VALUE="8" />
<STATE NAME="_TOKEN_TEXT" TYPE="string" VALUE="DAT_00401878" />
<STATE NAME="_CHAR_POS" TYPE="int" VALUE="15" />
<XML NAME="MEMENTO1">
<SAVE_STATE>
<STATE NAME="NAV_ID" TYPE="long" VALUE="3435975333167487857" />
<STATE NAME="_LINE_NUM" TYPE="int" VALUE="8" />
<STATE NAME="_TOKEN_TEXT" TYPE="string" VALUE="DAT_00401878" />
<STATE NAME="_CHAR_POS" TYPE="int" VALUE="15" />
<STATE NAME="_ADDRESS" TYPE="string" VALUE="00401392" />
<STATE NAME="MEMENTO_CLASS" TYPE="string" VALUE="ghidra.app.plugin.core.decompile.DecompilerLocationMemento" />
<STATE NAME="PROGRAM_ID" TYPE="long" VALUE="3435975204127628155" />
<STATE NAME="_FUNCTION_ENTRY" TYPE="string" VALUE="00401374" />
<STATE NAME="_CLASSNAME" TYPE="string" VALUE="ghidra.app.decompiler.DecompilerLocation" />
<STATE NAME="_COLUMN" TYPE="int" VALUE="0" />
<STATE NAME="_CHAR_OFFSET" TYPE="int" VALUE="0" />
<STATE NAME="_ROW" TYPE="int" VALUE="0" />
<STATE NAME="_BYTE_ADDR" TYPE="string" VALUE="00401392" />
<STATE NAME="PROGRAM_PATH_" TYPE="string" VALUE="pwn:/mr_snowy" />
<STATE NAME="INDEX" TYPE="int" VALUE="0" />
<STATE NAME="X_OFFSET" TYPE="int" VALUE="0" />
<STATE NAME="Y_OFFSET" TYPE="int" VALUE="0" />
</SAVE_STATE>
</XML>
<STATE NAME="_ADDRESS" TYPE="string" VALUE="00401392" />
<XML NAME="MEMENTO2">
<SAVE_STATE>
<STATE NAME="NAV_ID" TYPE="long" VALUE="3435975333167487854" />
<STATE NAME="_CLASSNAME" TYPE="string" VALUE="ghidra.program.util.AddressFieldLocation" />
<STATE NAME="_COLUMN" TYPE="int" VALUE="0" />
<STATE NAME="_CHAR_OFFSET" TYPE="int" VALUE="0" />
<STATE NAME="_ADDRESS" TYPE="string" VALUE="00401392" />
<STATE NAME="_ROW" TYPE="int" VALUE="0" />
<STATE NAME="_BYTE_ADDR" TYPE="string" VALUE="00401392" />
<STATE NAME="MEMENTO_CLASS" TYPE="string" VALUE="ghidra.app.plugin.core.codebrowser.CodeViewerLocationMemento" />
<STATE NAME="PROGRAM_PATH_" TYPE="string" VALUE="pwn:/mr_snowy" />
<STATE NAME="_ADDR_REP" TYPE="string" VALUE="00401392" />
<STATE NAME="CURSOR_OFFSET" TYPE="int" VALUE="85" />
<STATE NAME="PROGRAM_ID" TYPE="long" VALUE="3435975204127628155" />
</SAVE_STATE>
</XML>
<XML NAME="MEMENTO0">
<SAVE_STATE>
<STATE NAME="NAV_ID" TYPE="long" VALUE="3435975333167487851" />
<STATE NAME="_ADDRESS" TYPE="string" VALUE="00401392" />
<STATE NAME="Block Num" TYPE="int" VALUE="13" />
<STATE NAME="MEMENTO_CLASS" TYPE="string" VALUE="ghidra.app.plugin.core.byteviewer.ByteViewerLocationMemento" />
<STATE NAME="PROGRAM_ID" TYPE="long" VALUE="3435975204127628155" />
<STATE NAME="_CLASSNAME" TYPE="string" VALUE="ghidra.app.plugin.core.byteviewer.ByteViewerProgramLocation" />
<STATE NAME="_COLUMN" TYPE="int" VALUE="0" />
<STATE NAME="_CHAR_OFFSET" TYPE="int" VALUE="0" />
<STATE NAME="_ROW" TYPE="int" VALUE="0" />
<STATE NAME="_BYTE_ADDR" TYPE="string" VALUE="00401392" />
<STATE NAME="PROGRAM_PATH_" TYPE="string" VALUE="pwn:/mr_snowy" />
<STATE NAME="INDEX" TYPE="int" VALUE="325" />
<STATE NAME="Y_OFFSET" TYPE="int" VALUE="-1" />
<STATE NAME="X_OFFSET" TYPE="int" VALUE="-1" />
<STATE NAME="Block Offset" TYPE="string" VALUE="2498" />
</SAVE_STATE>
</XML>
<STATE NAME="MEMENTO_CLASS" TYPE="string" VALUE="ghidra.app.plugin.core.gotoquery.DefaultNavigatableLocationMemento" />
<STATE NAME="PROGRAM_ID" TYPE="long" VALUE="3435975204127628155" />
<STATE NAME="_FUNCTION_ENTRY" TYPE="string" VALUE="00401374" />
<STATE NAME="_CLASSNAME" TYPE="string" VALUE="ghidra.app.decompiler.DecompilerLocation" />
<STATE NAME="_COLUMN" TYPE="int" VALUE="0" />
<STATE NAME="_CHAR_OFFSET" TYPE="int" VALUE="0" />
<STATE NAME="FOCUSED_NAV" TYPE="long" VALUE="3435975333167487857" />
<STATE NAME="_ROW" TYPE="int" VALUE="0" />
<STATE NAME="_BYTE_ADDR" TYPE="string" VALUE="00401392" />
<STATE NAME="NUM_MEMENTOS" TYPE="int" VALUE="3" />
<STATE NAME="PROGRAM_PATH_" TYPE="string" VALUE="pwn:/mr_snowy" />
</SAVE_STATE>
</XML>
<STATE NAME="MEMENTO_CLASS12" TYPE="string" VALUE="ghidra.app.plugin.core.gotoquery.DefaultNavigatableLocationMemento" />
<STATE NAME="MEMENTO_CLASS11" TYPE="string" VALUE="ghidra.app.plugin.core.gotoquery.DefaultNavigatableLocationMemento" />
<STATE NAME="LOCATION_COUNT" TYPE="int" VALUE="14" />
<STATE NAME="MEMENTO_CLASS10" TYPE="string" VALUE="ghidra.app.plugin.core.gotoquery.DefaultNavigatableLocationMemento" />
<STATE NAME="CURRENT_LOC_INDEX" TYPE="int" VALUE="13" />
<STATE NAME="MEMENTO_CLASS13" TYPE="string" VALUE="ghidra.app.plugin.core.gotoquery.DefaultNavigatableLocationMemento" />
<XML NAME="MEMENTO_DATA13">
<SAVE_STATE>
<STATE NAME="_FUNC_ADDRESS" TYPE="string" VALUE="0040146a" />
<STATE NAME="_RETURN_TYPE" TYPE="string" VALUE="undefined" />
<XML NAME="MEMENTO1">
<SAVE_STATE>
<STATE NAME="NAV_ID" TYPE="long" VALUE="3435975333167487857" />
<STATE NAME="_FUNC_ADDRESS" TYPE="string" VALUE="004014f1" />
<STATE NAME="_RETURN_TYPE" TYPE="string" VALUE="undefined" />
<STATE NAME="_ADDRESS" TYPE="string" VALUE="004014f1" />
<STATE NAME="MEMENTO_CLASS" TYPE="string" VALUE="ghidra.app.plugin.core.decompile.DecompilerLocationMemento" />
<STATE NAME="PROGRAM_ID" TYPE="long" VALUE="3435975204127628155" />
<STATE NAME="_SIGNATURE" TYPE="string" VALUE="undefined setup(void)" />
<STATE NAME="_CLASSNAME" TYPE="string" VALUE="ghidra.program.util.FunctionReturnTypeFieldLocation" />
<STATE NAME="_COLUMN" TYPE="int" VALUE="0" />
<STATE NAME="_CHAR_OFFSET" TYPE="int" VALUE="0" />
<STATE NAME="_ROW" TYPE="int" VALUE="0" />
<STATE NAME="_BYTE_ADDR" TYPE="string" VALUE="004014f1" />
<STATE NAME="PROGRAM_PATH_" TYPE="string" VALUE="pwn:/mr_snowy" />
<STATE NAME="INDEX" TYPE="int" VALUE="0" />
<STATE NAME="X_OFFSET" TYPE="int" VALUE="0" />
<STATE NAME="Y_OFFSET" TYPE="int" VALUE="0" />
</SAVE_STATE>
</XML>
<STATE NAME="_ADDRESS" TYPE="string" VALUE="0040146a" />
<XML NAME="MEMENTO2">
<SAVE_STATE>
<STATE NAME="NAV_ID" TYPE="long" VALUE="3435975333167487854" />
<STATE NAME="_FUNC_ADDRESS" TYPE="string" VALUE="0040146a" />
<STATE NAME="_RETURN_TYPE" TYPE="string" VALUE="undefined" />
<STATE NAME="_ADDRESS" TYPE="string" VALUE="0040146a" />
<STATE NAME="MEMENTO_CLASS" TYPE="string" VALUE="ghidra.app.plugin.core.codebrowser.CodeViewerLocationMemento" />
<STATE NAME="CURSOR_OFFSET" TYPE="int" VALUE="340" />
<STATE NAME="PROGRAM_ID" TYPE="long" VALUE="3435975204127628155" />
<STATE NAME="_SIGNATURE" TYPE="string" VALUE="undefined __stdcall snowman(undefined8 param_1, undefined4 param_2, undefined4 param_3, undefined4 param_4, undefined4 param_5, undefined4 param_6, undefined4 param_7, undefined4 param_8)" />
<STATE NAME="_CLASSNAME" TYPE="string" VALUE="ghidra.program.util.FunctionReturnTypeFieldLocation" />
<STATE NAME="_COLUMN" TYPE="int" VALUE="0" />
<STATE NAME="_CHAR_OFFSET" TYPE="int" VALUE="0" />
<STATE NAME="_ROW" TYPE="int" VALUE="0" />
<STATE NAME="_BYTE_ADDR" TYPE="string" VALUE="0040146a" />
<STATE NAME="PROGRAM_PATH_" TYPE="string" VALUE="pwn:/mr_snowy" />
</SAVE_STATE>
</XML>
<XML NAME="MEMENTO0">
<SAVE_STATE>
<STATE NAME="NAV_ID" TYPE="long" VALUE="3435975333167487851" />
<STATE NAME="_ADDRESS" TYPE="string" VALUE="0040146a" />
<STATE NAME="Block Num" TYPE="int" VALUE="13" />
<STATE NAME="MEMENTO_CLASS" TYPE="string" VALUE="ghidra.app.plugin.core.byteviewer.ByteViewerLocationMemento" />
<STATE NAME="PROGRAM_ID" TYPE="long" VALUE="3435975204127628155" />
<STATE NAME="_CLASSNAME" TYPE="string" VALUE="ghidra.app.plugin.core.byteviewer.ByteViewerProgramLocation" />
<STATE NAME="_COLUMN" TYPE="int" VALUE="0" />
<STATE NAME="_CHAR_OFFSET" TYPE="int" VALUE="0" />
<STATE NAME="_ROW" TYPE="int" VALUE="0" />
<STATE NAME="_BYTE_ADDR" TYPE="string" VALUE="0040146a" />
<STATE NAME="PROGRAM_PATH_" TYPE="string" VALUE="pwn:/mr_snowy" />
<STATE NAME="INDEX" TYPE="int" VALUE="320" />
<STATE NAME="Y_OFFSET" TYPE="int" VALUE="-1" />
<STATE NAME="X_OFFSET" TYPE="int" VALUE="-1" />
<STATE NAME="Block Offset" TYPE="string" VALUE="2714" />
</SAVE_STATE>
</XML>
<STATE NAME="MEMENTO_CLASS" TYPE="string" VALUE="ghidra.app.plugin.core.gotoquery.DefaultNavigatableLocationMemento" />
<STATE NAME="PROGRAM_ID" TYPE="long" VALUE="3435975204127628155" />
<STATE NAME="_SIGNATURE" TYPE="string" VALUE="undefined snowman(undefined8 param_1, undefined4 param_2, undefined4 param_3, undefined4 param_4, undefined4 param_5, undefined4 param_6, undefined4 param_7, undefined4 param_8)" />
<STATE NAME="_CLASSNAME" TYPE="string" VALUE="ghidra.program.util.FunctionReturnTypeFieldLocation" />
<STATE NAME="_COLUMN" TYPE="int" VALUE="0" />
<STATE NAME="_CHAR_OFFSET" TYPE="int" VALUE="0" />
<STATE NAME="_ROW" TYPE="int" VALUE="0" />
<STATE NAME="_BYTE_ADDR" TYPE="string" VALUE="0040146a" />
<STATE NAME="NUM_MEMENTOS" TYPE="int" VALUE="3" />
<STATE NAME="PROGRAM_PATH_" TYPE="string" VALUE="pwn:/mr_snowy" />
</SAVE_STATE>
</XML>
<XML NAME="MEMENTO_DATA12">
<SAVE_STATE>
<STATE NAME="_FUNC_ADDRESS" TYPE="string" VALUE="004014f1" />
<STATE NAME="_RETURN_TYPE" TYPE="string" VALUE="undefined" />
<XML NAME="MEMENTO1">
<SAVE_STATE>
<STATE NAME="NAV_ID" TYPE="long" VALUE="3435975333167487857" />
<STATE NAME="_FUNC_ADDRESS" TYPE="string" VALUE="004014f1" />
<STATE NAME="_RETURN_TYPE" TYPE="string" VALUE="undefined" />
<STATE NAME="_ADDRESS" TYPE="string" VALUE="004014f1" />
<STATE NAME="MEMENTO_CLASS" TYPE="string" VALUE="ghidra.app.plugin.core.decompile.DecompilerLocationMemento" />
<STATE NAME="PROGRAM_ID" TYPE="long" VALUE="3435975204127628155" />
<STATE NAME="_SIGNATURE" TYPE="string" VALUE="undefined setup(void)" />
<STATE NAME="_CLASSNAME" TYPE="string" VALUE="ghidra.program.util.FunctionReturnTypeFieldLocation" />
<STATE NAME="_COLUMN" TYPE="int" VALUE="0" />
<STATE NAME="_CHAR_OFFSET" TYPE="int" VALUE="0" />
<STATE NAME="_ROW" TYPE="int" VALUE="0" />
<STATE NAME="_BYTE_ADDR" TYPE="string" VALUE="004014f1" />
<STATE NAME="PROGRAM_PATH_" TYPE="string" VALUE="pwn:/mr_snowy" />
<STATE NAME="INDEX" TYPE="int" VALUE="0" />
<STATE NAME="X_OFFSET" TYPE="int" VALUE="0" />
<STATE NAME="Y_OFFSET" TYPE="int" VALUE="0" />
</SAVE_STATE>
</XML>
<STATE NAME="_ADDRESS" TYPE="string" VALUE="004014f1" />
<XML NAME="MEMENTO2">
<SAVE_STATE>
<STATE NAME="NAV_ID" TYPE="long" VALUE="3435975333167487854" />
<STATE NAME="_FUNC_ADDRESS" TYPE="string" VALUE="004014f1" />
<STATE NAME="_RETURN_TYPE" TYPE="string" VALUE="undefined" />
<STATE NAME="_ADDRESS" TYPE="string" VALUE="004014f1" />
<STATE NAME="MEMENTO_CLASS" TYPE="string" VALUE="ghidra.app.plugin.core.codebrowser.CodeViewerLocationMemento" />
<STATE NAME="CURSOR_OFFSET" TYPE="int" VALUE="340" />
<STATE NAME="PROGRAM_ID" TYPE="long" VALUE="3435975204127628155" />
<STATE NAME="_SIGNATURE" TYPE="string" VALUE="undefined __stdcall setup(void)" />
<STATE NAME="_CLASSNAME" TYPE="string" VALUE="ghidra.program.util.FunctionReturnTypeFieldLocation" />
<STATE NAME="_COLUMN" TYPE="int" VALUE="0" />
<STATE NAME="_CHAR_OFFSET" TYPE="int" VALUE="0" />
<STATE NAME="_ROW" TYPE="int" VALUE="0" />
<STATE NAME="_BYTE_ADDR" TYPE="string" VALUE="004014f1" />
<STATE NAME="PROGRAM_PATH_" TYPE="string" VALUE="pwn:/mr_snowy" />
</SAVE_STATE>
</XML>
<XML NAME="MEMENTO0">
<SAVE_STATE>
<STATE NAME="NAV_ID" TYPE="long" VALUE="3435975333167487851" />
<STATE NAME="_ADDRESS" TYPE="string" VALUE="004014f1" />
<STATE NAME="Block Num" TYPE="int" VALUE="13" />
<STATE NAME="MEMENTO_CLASS" TYPE="string" VALUE="ghidra.app.plugin.core.byteviewer.ByteViewerLocationMemento" />
<STATE NAME="PROGRAM_ID" TYPE="long" VALUE="3435975204127628155" />
<STATE NAME="_CLASSNAME" TYPE="string" VALUE="ghidra.app.plugin.core.byteviewer.ByteViewerProgramLocation" />
<STATE NAME="_COLUMN" TYPE="int" VALUE="0" />
<STATE NAME="_CHAR_OFFSET" TYPE="int" VALUE="0" />
<STATE NAME="_ROW" TYPE="int" VALUE="0" />
<STATE NAME="_BYTE_ADDR" TYPE="string" VALUE="004014f1" />
<STATE NAME="PROGRAM_PATH_" TYPE="string" VALUE="pwn:/mr_snowy" />
<STATE NAME="INDEX" TYPE="int" VALUE="320" />
<STATE NAME="Y_OFFSET" TYPE="int" VALUE="-1" />
<STATE NAME="X_OFFSET" TYPE="int" VALUE="-1" />
<STATE NAME="Block Offset" TYPE="string" VALUE="2849" />
</SAVE_STATE>
</XML>
<STATE NAME="MEMENTO_CLASS" TYPE="string" VALUE="ghidra.app.plugin.core.gotoquery.DefaultNavigatableLocationMemento" />
<STATE NAME="PROGRAM_ID" TYPE="long" VALUE="3435975204127628155" />
<STATE NAME="_SIGNATURE" TYPE="string" VALUE="undefined setup(void)" />
<STATE NAME="_CLASSNAME" TYPE="string" VALUE="ghidra.program.util.FunctionReturnTypeFieldLocation" />
<STATE NAME="_COLUMN" TYPE="int" VALUE="0" />
<STATE NAME="_CHAR_OFFSET" TYPE="int" VALUE="0" />
<STATE NAME="_ROW" TYPE="int" VALUE="0" />
<STATE NAME="_BYTE_ADDR" TYPE="string" VALUE="004014f1" />
<STATE NAME="NUM_MEMENTOS" TYPE="int" VALUE="3" />
<STATE NAME="PROGRAM_PATH_" TYPE="string" VALUE="pwn:/mr_snowy" />
</SAVE_STATE>
</XML>
<XML NAME="MEMENTO_DATA11">
<SAVE_STATE>
<STATE NAME="_FUNC_ADDRESS" TYPE="string" VALUE="00400ab7" />
<STATE NAME="_RETURN_TYPE" TYPE="string" VALUE="undefined" />
<XML NAME="MEMENTO1">
<SAVE_STATE>
<STATE NAME="NAV_ID" TYPE="long" VALUE="3435975333167487857" />
<STATE NAME="_FUNC_ADDRESS" TYPE="string" VALUE="00400ab7" />
<STATE NAME="_RETURN_TYPE" TYPE="string" VALUE="undefined" />
<STATE NAME="_ADDRESS" TYPE="string" VALUE="00400ab7" />
<STATE NAME="MEMENTO_CLASS" TYPE="string" VALUE="ghidra.app.plugin.core.decompile.DecompilerLocationMemento" />
<STATE NAME="PROGRAM_ID" TYPE="long" VALUE="3435975204127628155" />
<STATE NAME="_SIGNATURE" TYPE="string" VALUE="undefined reset(void)" />
<STATE NAME="_CLASSNAME" TYPE="string" VALUE="ghidra.program.util.FunctionReturnTypeFieldLocation" />
<STATE NAME="_COLUMN" TYPE="int" VALUE="0" />
<STATE NAME="_CHAR_OFFSET" TYPE="int" VALUE="0" />
<STATE NAME="_ROW" TYPE="int" VALUE="0" />
<STATE NAME="_BYTE_ADDR" TYPE="string" VALUE="00400ab7" />
<STATE NAME="PROGRAM_PATH_" TYPE="string" VALUE="pwn:/mr_snowy" />
<STATE NAME="INDEX" TYPE="int" VALUE="0" />
<STATE NAME="X_OFFSET" TYPE="int" VALUE="0" />
<STATE NAME="Y_OFFSET" TYPE="int" VALUE="0" />
</SAVE_STATE>
</XML>
<STATE NAME="_ADDRESS" TYPE="string" VALUE="00400ab7" />
<XML NAME="MEMENTO2">
<SAVE_STATE>
<STATE NAME="NAV_ID" TYPE="long" VALUE="3435975333167487854" />
<STATE NAME="_FUNC_ADDRESS" TYPE="string" VALUE="00400ab7" />
<STATE NAME="_RETURN_TYPE" TYPE="string" VALUE="undefined" />
<STATE NAME="_ADDRESS" TYPE="string" VALUE="00400ab7" />
<STATE NAME="MEMENTO_CLASS" TYPE="string" VALUE="ghidra.app.plugin.core.codebrowser.CodeViewerLocationMemento" />
<STATE NAME="CURSOR_OFFSET" TYPE="int" VALUE="340" />
<STATE NAME="PROGRAM_ID" TYPE="long" VALUE="3435975204127628155" />
<STATE NAME="_SIGNATURE" TYPE="string" VALUE="undefined __stdcall reset(void)" />
<STATE NAME="_CLASSNAME" TYPE="string" VALUE="ghidra.program.util.FunctionReturnTypeFieldLocation" />
<STATE NAME="_COLUMN" TYPE="int" VALUE="0" />
<STATE NAME="_CHAR_OFFSET" TYPE="int" VALUE="0" />
<STATE NAME="_ROW" TYPE="int" VALUE="0" />
<STATE NAME="_BYTE_ADDR" TYPE="string" VALUE="00400ab7" />
<STATE NAME="PROGRAM_PATH_" TYPE="string" VALUE="pwn:/mr_snowy" />
</SAVE_STATE>
</XML>
<XML NAME="MEMENTO0">
<SAVE_STATE>
<STATE NAME="NAV_ID" TYPE="long" VALUE="3435975333167487851" />
<STATE NAME="_ADDRESS" TYPE="string" VALUE="00400ab7" />
<STATE NAME="Block Num" TYPE="int" VALUE="13" />
<STATE NAME="MEMENTO_CLASS" TYPE="string" VALUE="ghidra.app.plugin.core.byteviewer.ByteViewerLocationMemento" />
<STATE NAME="PROGRAM_ID" TYPE="long" VALUE="3435975204127628155" />
<STATE NAME="_CLASSNAME" TYPE="string" VALUE="ghidra.app.plugin.core.byteviewer.ByteViewerProgramLocation" />
<STATE NAME="_COLUMN" TYPE="int" VALUE="0" />
<STATE NAME="_CHAR_OFFSET" TYPE="int" VALUE="0" />
<STATE NAME="_ROW" TYPE="int" VALUE="0" />
<STATE NAME="_BYTE_ADDR" TYPE="string" VALUE="00400ab7" />
<STATE NAME="PROGRAM_PATH_" TYPE="string" VALUE="pwn:/mr_snowy" />
<STATE NAME="INDEX" TYPE="int" VALUE="193" />
<STATE NAME="Y_OFFSET" TYPE="int" VALUE="0" />
<STATE NAME="X_OFFSET" TYPE="int" VALUE="0" />
<STATE NAME="Block Offset" TYPE="string" VALUE="231" />
</SAVE_STATE>
</XML>
<STATE NAME="MEMENTO_CLASS" TYPE="string" VALUE="ghidra.app.plugin.core.gotoquery.DefaultNavigatableLocationMemento" />
<STATE NAME="PROGRAM_ID" TYPE="long" VALUE="3435975204127628155" />
<STATE NAME="_SIGNATURE" TYPE="string" VALUE="undefined reset(void)" />
<STATE NAME="_CLASSNAME" TYPE="string" VALUE="ghidra.program.util.FunctionReturnTypeFieldLocation" />
<STATE NAME="_COLUMN" TYPE="int" VALUE="0" />
<STATE NAME="_CHAR_OFFSET" TYPE="int" VALUE="0" />
<STATE NAME="_ROW" TYPE="int" VALUE="0" />
<STATE NAME="_BYTE_ADDR" TYPE="string" VALUE="00400ab7" />
<STATE NAME="NUM_MEMENTOS" TYPE="int" VALUE="3" />
<STATE NAME="PROGRAM_PATH_" TYPE="string" VALUE="pwn:/mr_snowy" />
</SAVE_STATE>
</XML>
<XML NAME="MEMENTO_DATA10">
<SAVE_STATE>
<XML NAME="MEMENTO1">
<SAVE_STATE>
<STATE NAME="NAV_ID" TYPE="long" VALUE="3435975333167487857" />
<STATE NAME="_LINE_NUM" TYPE="int" VALUE="8" />
<STATE NAME="_TOKEN_TEXT" TYPE="string" VALUE="DAT_00401878" />
<STATE NAME="_CHAR_POS" TYPE="int" VALUE="15" />
<STATE NAME="_ADDRESS" TYPE="string" VALUE="00401392" />
<STATE NAME="MEMENTO_CLASS" TYPE="string" VALUE="ghidra.app.plugin.core.decompile.DecompilerLocationMemento" />
<STATE NAME="PROGRAM_ID" TYPE="long" VALUE="3435975204127628155" />
<STATE NAME="_FUNCTION_ENTRY" TYPE="string" VALUE="00401374" />
<STATE NAME="_CLASSNAME" TYPE="string" VALUE="ghidra.app.decompiler.DecompilerLocation" />
<STATE NAME="_COLUMN" TYPE="int" VALUE="0" />
<STATE NAME="_CHAR_OFFSET" TYPE="int" VALUE="0" />
<STATE NAME="_ROW" TYPE="int" VALUE="0" />
<STATE NAME="_BYTE_ADDR" TYPE="string" VALUE="00401392" />
<STATE NAME="PROGRAM_PATH_" TYPE="string" VALUE="pwn:/mr_snowy" />
<STATE NAME="INDEX" TYPE="int" VALUE="0" />
<STATE NAME="X_OFFSET" TYPE="int" VALUE="0" />
<STATE NAME="Y_OFFSET" TYPE="int" VALUE="0" />
</SAVE_STATE>
</XML>
<STATE NAME="_ADDRESS" TYPE="string" VALUE="00401878" />
<XML NAME="MEMENTO2">
<SAVE_STATE>
<STATE NAME="NAV_ID" TYPE="long" VALUE="3435975333167487854" />
<STATE NAME="_ADDRESS" TYPE="string" VALUE="00401878" />
<STATE NAME="MEMENTO_CLASS" TYPE="string" VALUE="ghidra.app.plugin.core.codebrowser.CodeViewerLocationMemento" />
<STATE NAME="CURSOR_OFFSET" TYPE="int" VALUE="340" />
<STATE NAME="PROGRAM_ID" TYPE="long" VALUE="3435975204127628155" />
<STATE NAME="_CLASSNAME" TYPE="string" VALUE="ghidra.program.util.AddressFieldLocation" />
<STATE NAME="_COLUMN" TYPE="int" VALUE="0" />
<STATE NAME="_CHAR_OFFSET" TYPE="int" VALUE="0" />
<STATE NAME="_ROW" TYPE="int" VALUE="0" />
<STATE NAME="_BYTE_ADDR" TYPE="string" VALUE="00401878" />
<STATE NAME="PROGRAM_PATH_" TYPE="string" VALUE="pwn:/mr_snowy" />
<ARRAY NAME="_COMP_PATH" TYPE="int" />
<STATE NAME="_ADDR_REP" TYPE="string" VALUE="00401878" />
</SAVE_STATE>
</XML>
<XML NAME="MEMENTO0">
<SAVE_STATE>
<STATE NAME="NAV_ID" TYPE="long" VALUE="3435975333167487851" />
<STATE NAME="_ADDRESS" TYPE="string" VALUE="00401878" />
<STATE NAME="Block Num" TYPE="int" VALUE="15" />
<STATE NAME="MEMENTO_CLASS" TYPE="string" VALUE="ghidra.app.plugin.core.byteviewer.ByteViewerLocationMemento" />
<STATE NAME="PROGRAM_ID" TYPE="long" VALUE="3435975204127628155" />
<STATE NAME="_CLASSNAME" TYPE="string" VALUE="ghidra.app.plugin.core.byteviewer.ByteViewerProgramLocation" />
<STATE NAME="_COLUMN" TYPE="int" VALUE="0" />
<STATE NAME="_CHAR_OFFSET" TYPE="int" VALUE="0" />
<STATE NAME="_ROW" TYPE="int" VALUE="0" />
<STATE NAME="_BYTE_ADDR" TYPE="string" VALUE="00401878" />
<STATE NAME="PROGRAM_PATH_" TYPE="string" VALUE="pwn:/mr_snowy" />
<STATE NAME="INDEX" TYPE="int" VALUE="379" />
<STATE NAME="Y_OFFSET" TYPE="int" VALUE="-1" />
<STATE NAME="X_OFFSET" TYPE="int" VALUE="-1" />
<STATE NAME="Block Offset" TYPE="string" VALUE="664" />
</SAVE_STATE>
</XML>
<STATE NAME="MEMENTO_CLASS" TYPE="string" VALUE="ghidra.app.plugin.core.gotoquery.DefaultNavigatableLocationMemento" />
<STATE NAME="PROGRAM_ID" TYPE="long" VALUE="3435975204127628155" />
<STATE NAME="_CLASSNAME" TYPE="string" VALUE="ghidra.program.util.ProgramLocation" />
<STATE NAME="_COLUMN" TYPE="int" VALUE="0" />
<STATE NAME="_CHAR_OFFSET" TYPE="int" VALUE="0" />
<STATE NAME="FOCUSED_NAV" TYPE="long" VALUE="3435975333167487857" />
<STATE NAME="_ROW" TYPE="int" VALUE="0" />
<STATE NAME="_BYTE_ADDR" TYPE="string" VALUE="00401878" />
<STATE NAME="NUM_MEMENTOS" TYPE="int" VALUE="3" />
<STATE NAME="PROGRAM_PATH_" TYPE="string" VALUE="pwn:/mr_snowy" />
</SAVE_STATE>
</XML>
<STATE NAME="MEMENTO_CLASS7" TYPE="string" VALUE="ghidra.app.plugin.core.gotoquery.DefaultNavigatableLocationMemento" />
<STATE NAME="MEMENTO_CLASS6" TYPE="string" VALUE="ghidra.app.plugin.core.gotoquery.DefaultNavigatableLocationMemento" />
<STATE NAME="MEMENTO_CLASS9" TYPE="string" VALUE="ghidra.app.plugin.core.gotoquery.DefaultNavigatableLocationMemento" />
<STATE NAME="MEMENTO_CLASS8" TYPE="string" VALUE="ghidra.app.plugin.core.gotoquery.DefaultNavigatableLocationMemento" />
<STATE NAME="MEMENTO_CLASS3" TYPE="string" VALUE="ghidra.app.plugin.core.gotoquery.DefaultNavigatableLocationMemento" />
<STATE NAME="MEMENTO_CLASS2" TYPE="string" VALUE="ghidra.app.plugin.core.gotoquery.DefaultNavigatableLocationMemento" />
<STATE NAME="MEMENTO_CLASS5" TYPE="string" VALUE="ghidra.app.plugin.core.gotoquery.DefaultNavigatableLocationMemento" />
<STATE NAME="MEMENTO_CLASS4" TYPE="string" VALUE="ghidra.app.plugin.core.gotoquery.DefaultNavigatableLocationMemento" />
</SAVE_STATE>
</XML>
<STATE NAME="LIST_COUNT" TYPE="int" VALUE="1" />
</PLUGIN>
<PLUGIN NAME="ProgramManagerPlugin">
<STATE NAME="_FUNC_ADDRESS" TYPE="string" VALUE="0040146a" />
<STATE NAME="_RETURN_TYPE" TYPE="string" VALUE="undefined" />
<STATE NAME="_ADDRESS" TYPE="string" VALUE="0040146a" />
<STATE NAME="PATHNAME_0" TYPE="string" VALUE="/mr_snowy" />
<STATE NAME="CURRENT_FILE" TYPE="string" VALUE="mr_snowy" />
<STATE NAME="PROJECT_NAME_0" TYPE="string" VALUE="pwn" />
<STATE NAME="NUM_PROGRAMS" TYPE="int" VALUE="1" />
<STATE NAME="_SIGNATURE" TYPE="string" VALUE="undefined snowman(undefined8 param_1, undefined4 param_2, undefined4 param_3, undefined4 param_4, undefined4 param_5, undefined4 param_6, undefined4 param_7, undefined4 param_8)" />
<STATE NAME="VERSION_0" TYPE="int" VALUE="-1" />
<STATE NAME="_CLASSNAME" TYPE="string" VALUE="ghidra.program.util.FunctionReturnTypeFieldLocation" />
<STATE NAME="_COLUMN" TYPE="int" VALUE="0" />
<STATE NAME="_CHAR_OFFSET" TYPE="int" VALUE="0" />
<STATE NAME="LOCATION_0" TYPE="string" VALUE="/home/aaron/git/htb-santa-ctf/pwn/ghidra" />
<STATE NAME="_ROW" TYPE="int" VALUE="0" />
<STATE NAME="_BYTE_ADDR" TYPE="string" VALUE="0040146a" />
</PLUGIN>
<PLUGIN NAME="ProgramTreePlugin">
<STATE NAME="NavigationToggleState" TYPE="boolean" VALUE="false" />
<ARRAY NAME="GroupNameProgram Tree0" TYPE="string">
<A VALUE="mr_snowy" />
</ARRAY>
<STATE NAME="Current Viewname" TYPE="string" VALUE="Program Tree" />
<STATE NAME="NumberOfViews" TYPE="int" VALUE="1" />
<STATE NAME="NumberOfGroupsProgram Tree" TYPE="int" VALUE="1" />
<STATE NAME="TreeName-0" TYPE="string" VALUE="Program Tree" />
</PLUGIN>
</DATA_STATE>
</RUNNING_TOOL>
</WORKSPACE>
</TOOL_MANAGER>
</PROJECT>
Reference in New Issue View Git Blame Copy Permalink