The 64-bit time stamp is the time application’s primary thread was created in 100-nanosecond intervals since January 1, 1601 (UTC) (this is known as FILETIME
). The 32-bit timestamp is indeed in time_t
format (it tells the time the module was created and is stored in the module’s header).
I’d say 0x0002d160 is an offset from the module’s load address (it seems too low for an absolute address). Fire up Visual Studio, start the debugger, take a look at the “modules” debug window. Your exe file should be listed there. Find the address where the module is loaded, add 0x0002d160 to that address and take a look at the disassembly at the resulting address. Visual Studio shows source code intermixed with the assembly, you should have no problem figuring out what source line caused the problem.