RVA of exported function is different after load I opened crypt32.dll and looked at its export table using CFF explorer. CFF Explorer