In System Informer, find the startallback process, double-click it, click the Modules tab on the new window opened, find the "StartAllBackX64.dll" and double-click it. Go to the Exports tab, look for "Ordinal101" and remember its RVA. Go to the Sections tab, look for the ".text" section and its "RVA (start)" and "RAW (start)".