title: Disassembly or run-time function address?
body: <p>I have a simple program written in C which outputs the memory address of a specific function. When running this program, the output is: <code>0x00401334</code>. Going to that memory location with a real-time memory editor and disassembler I can prove the function is there. The problem is, when disassembling the Windows executable file instead of the process (with a disassembling library such as diStorm), the same function seems to be at <code>0x00400734</code>.</p>
  
  <p>What's happening? Is there any way to get <code>0x00401334</code> from <code>0x00400734</code>?</p>