filenamesteamclient.dll
size259360 (0x3f520)
md5458fe2c582ffaa08a1ce5ee8b6d1fad8
typePE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xf8

Rich Header

lib idversiontimes used
123507272
2252100571
2232100530
22421005235
2036550115
10148
2284062975
220406291
219210051
222406291

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections3
TimeDateStamp0x5a8f727a
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x2102
Magic0x10b
LinkerVersion12.0
SizeOfCode0x3e000
SizeOfInitializedData0x2000
SizeOfUninitializedData0x71000
AddressOfEntryPoint0xaf650
BaseOfCode0x72000
BaseOfData0xb0000
ImageBase0x10000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.0
ImageVersion0.0
SubsystemVersion6.0
Reserved10
SizeOfImage0xb2000
SizeOfHeaders0x1000
CheckSum0x43e2f
Subsystem2
DllCharacteristics0x140
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

UPX v2.00-V2.90 (Markus Oberhumer & Laszlo Molnar & John Reiser)

This file is packed with UPX. Analysis will be incomplete without unpacking.
We can unpack it for you.

»» Analyze unpacked file

Sections

namevavsizeraw sizeflags
UPX00x10000x710000RWX UDATA
UPX10x720000x3e0000x3da00RWX IDATA
.rsrc0xb00000x20000x1200RW- IDATA

Data Directory

typevasize
EXPORT0xb08c80x7dc
IMPORT0xb06e00x1e8
RESOURCE0xb00000x6e0
EXCEPTION00
SECURITY0x3f0000x520
BASERELOC0xb10a40x10
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0xaf8440x48
Bound_IAT00
IAT00
Delay_IAT00
CLR_Header00
typenamesizecp
VERSION#18800
VERSION#17600
module_namehintordfunction_name
ADVAPI32.dllRegCloseKey
KERNEL32.DLLLoadLibraryA
KERNEL32.DLLGetProcAddress
KERNEL32.DLLVirtualProtect
ntdll.dllRtlUnwind
PSAPI.DLLEnumProcessModules
SHELL32.dllSHGetFolderPathW
SHLWAPI.dllPathFileExistsW
USER32.dllMessageBoxA
WS2_32.dll115
ordentry_vafunction_name
10x4d1e8Breakpad_SteamMiniDumpInit
20x4d1e1Breakpad_SteamSetAppID
30x4d1d7Breakpad_SteamSetSteamID
40x4d1cdBreakpad_SteamWriteMiniDumpSetComment
50x4d1c6Breakpad_SteamWriteMiniDumpUsingExceptionInfoWithBuildId
60x4d19cCreateInterface
70x4d13fSteam_BConnected
80x4d12bSteam_BGetCallback
90x4d121Steam_BLoggedOn
100x4d117Steam_BReleaseSteamPipe
110x4d10cSteam_ConnectToGlobalUser
120x4d0e9Steam_CreateGlobalUser
130x4d0f4Steam_CreateLocalUser
140x4d0deSteam_CreateSteamPipe
150x4d0d7Steam_FreeLastCallback
160x4d0cdSteam_GSBLoggedOn
170x4d0c3Steam_GSBSecure
180x4d0b9Steam_GSGetSteam2GetEncryptionKeyToSendToNewClient
190x4d0abSteam_GSGetSteamID
200x4d0a4Steam_GSLogOff
210x4d09dSteam_GSLogOn
220x4d093Steam_GSRemoveUserConnect
230x4d089Steam_GSSendSteam2UserConnect
240x4d07fSteam_GSSendSteam3UserConnect
250x4d075Steam_GSSendUserDisconnect
260x4d06bSteam_GSSendUserStatusResponse
270x4d061Steam_GSSetServerType
280x4d05aSteam_GSSetSpawnCount
290x4d050Steam_GSUpdateStatus
300x4d02cSteam_GetAPICallResult
310x4d022Steam_GetGSHandle
320x4d018Steam_InitiateGameConnection
330x4d011Steam_LogOff
340x4d00aSteam_LogOn
350x4cfeeSteam_ReleaseThreadLocalMemory
360x4d003Steam_ReleaseUser
370x4cffcSteam_SetLocalIPBinding
380x4cff5Steam_TerminateGameConnection
390x4d192VR_GetGenericInterfaceInternal
400x4d185VR_GetStringForHmdErrorInternal
410x4d15aVR_InitInternal
420x4d149VR_IsHmdPresentInternal
430x4d153VR_ShutdownInternal
440x4cfe7hid_close
450x4cfddhid_enumerate
460x4cfd0hid_error
470x4cfc6hid_exit
480x4cfbfhid_free_enumeration
490x4cfb5hid_get_feature_report
500x4cfabhid_get_indexed_string
510x4cfa1hid_get_manufacturer_string
520x4cf97hid_get_product_string
530x4cf8dhid_get_serial_number_string
540x4cf83hid_init
550x4cf79hid_open
560x4cf6fhid_open_path
570x4cf65hid_read
580x4cf5bhid_read_timeout
590x4cf51hid_send_feature_report
600x4cf47hid_set_nonblocking
610x4cf3dhid_write
module_namesteamclient.dll
flags0
timestamp2018-02-23 01:46:26
version0.0
ordinal_base1
nFunctions61
nNames61
Names(61)0xb09e4
Functions(61)0xb08f0
NameOrdinals(61)0xb0ad8

StringTable 040904B0

LegalCopyrightCopyright (C) NisCkxU544c
InternalNameSteam Client API
FileVersion01.0.1.17
CompanyNameValve Corporation
ProductVersion01.00.00.01
FileDescriptionSteam Client API (buildbot_winslave007@WUS)
Source Control ID1337110
OriginalFilenamesteam_api.dll
ProductNameSteam Client API

StringTable 040904B0

CompanyNameValve Corporation
FileDescriptionSteam Client API
FileVersion1, 0, 0, 1
InternalNameSteam Client API
LegalCopyrightCopyright (C) 2007
OriginalFilenamesteam_api.dll
ProductNameSteam Client API
ProductVersion1, 0, 0, 1

VS_FIXEDFILEINFO

FileVersion1.0.1.17
ProductVersion1.0.0.1
StrucVersion0x10000
FileFlagsMask0x17
FileFlags0
FileOS4
FileType2
FileSubtype0

VS_FIXEDFILEINFO

FileVersion1.0.0.1
ProductVersion1.0.0.1
StrucVersion0x10000
FileFlagsMask0x17
FileFlags0
FileOS4
FileType2
FileSubtype0

Signers (1)

issuer: /CN=\x00W\x00U\x00S\x00!
serial: -2B6C4CE9A4047047B2B1AD41051B986B

Certificates (1)

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
             (Negative)2b:6c:4c:e9:a4:04:70:47:b2:b1:ad:41:05:1b:98:6b
        Signature Algorithm: sha1WithRSA
        Issuer: CN=\x00W\x00U\x00S\x00!
        Validity
            Not Before: Jul  1 08:00:00 2014 GMT
            Not After : Jan  1 08:00:00 2088 GMT
        Subject: CN=\x00W\x00U\x00S\x00!
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    00:ab:57:00:aa:90:aa:de:a5:2c:1e:92:b3:32:c3:
                    74:33:28:60:41:7c:eb:98:76:89:53:97:f5:e0:f5:
                    7d:14:83:d6:01:54:59:1b:f5:1f:dc:dc:a4:19:81:
                    17:f8:74:18:14:ea:6c:94:03:ce:10:ea:f5:1d:37:
                    9b:19:20:d4:cc:e3:e9:c6:8f:33:93:4a:85:e4:44:
                    d0:d7:6d:c2:27:15:4d:3e:e3:cb:4b:84:0f:d7:d3:
                    97:18:ee:28:e8:20:c1:51:d0:20:f2:e0:59:46:01:
                    b3:c4:63:9a:e4:d3:83:fd:e0:65:86:a2:d6:12:3a:
                    ca:35:9c:a0:cf:4a:d5:a8:29:db:a3:8c:68:9b:ab:
                    ca:52:a5:93:e9:72:a1:31:25:6a:03:93:c2:6d:2b:
                    23:f7:78:07:c4:c5:15:52:d4:fa:61:17:5b:25:57:
                    94:bf:5e:49:21:53:5e:f5:fb:be:00:2d:09:7d:f2:
                    1a:8d:93:54:8d:82:ea:75:9e:e8:03:ae:89:5c:49:
                    a0:c7:64:92:5e:22:8e:3d:fe:13:f4:e6:0b:89:5e:
                    60:f3:7e:d9:27:94:c2:37:c2:04:a7:a6:bc:47:c1:
                    12:c9:c9:cb:8d:e1:f2:0c:cb:bb:0f:79:22:95:12:
                    ed:ce:44:83:b4:1c:47:1a:dc:33:8e:88:8e:d5:db:
                    82:87
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            2.5.29.1: 
                0;..\..k..5.nG ..s....0.1.0...U.....W.U.S.!......[...MNR...g.
    Signature Algorithm: sha1WithRSA
         34:5c:8c:64:ec:b5:bf:c3:b5:67:e2:a1:31:31:7b:79:fd:76:
         a3:50:a8:61:a4:fd:73:c6:b7:e2:8c:e5:11:42:14:4f:17:b6:
         8c:db:e1:9f:cf:b7:92:85:d7:31:70:5f:0d:b9:8e:72:45:ac:
         b8:9b:d8:ae:4d:cb:07:d9:d1:f5:64:a4:98:35:f1:cc:d0:03:
         19:8c:ba:32:01:3f:24:fd:e0:e2:e9:53:ed:6d:ea:5f:0f:e9:
         69:6b:c7:d2:a7:f5:3a:5a:74:fa:9e:5a:e1:64:48:f3:e3:fa:
         46:01:e0:34:aa:78:ab:60:82:fd:d9:09:01:5e:a1:79:a1:d1:
         aa:fd:b2:a0:3b:de:8b:45:34:2d:56:8e:14:d4:ce:02:c2:7c:
         a3:35:d6:f4:df:fc:2b:b0:5b:48:ea:37:0c:17:39:6b:f6:d6:
         5e:7c:45:7b:52:b7:04:4d:59:7b:e5:e8:bd:8d:49:84:e6:a3:
         b9:8c:8f:1c:36:cd:0a:3f:07:0c:9c:3f:28:f5:72:5c:c5:65:
         ef:98:83:4f:32:f2:24:49:6f:98:98:7f:a2:bc:be:a3:d0:88:
         67:d5:92:4a:4e:be:76:6c:9d:a4:07:fb:49:b8:b4:e3:80:dc:
         ec:a3:76:d3:4c:b1:95:21:f2:6e:0f:fc:fa:55:32:9c:cd:67:
         3c:23:fb:07
pkcs7-signedData
  • 1
    • SHA1: nil
    • 1.3.6.1.4.1.311.2.1.4
      • #0
        • 1.3.6.1.4.1.311.2.1.15
          • :
        • SHA1
          • 34 9b bd 03 59 1e 35 d3  64 b8 5c 73 58 16 27 e5  |4...Y.5.d.\sX.'.|
b8 46 a1 89                                       |.F..            |
    • #2
      • 2
        • -57719131853525794810908100208052901995
        • RSA-SHA1-2: nil
        • CN: 
          00 57 00 55 00 53 00 21                           |.W.U.S.!        |
        • 2014-07-01 08:00:00 UTC: 2088-01-01 08:00:00 UTC
        • CN: 
          00 57 00 55 00 53 00 21                           |.W.U.S.!        |
        • #5
          • rsaEncryption: nil
          • AB:57:00:AA:90:AA:DE:A5:2C:1E:92:B3:32:C3:74:33:
            28:60:41:7C:EB:98:76:89:53:97:F5:E0:F5:7D:14:83:
            D6:01:54:59:1B:F5:1F:DC:DC:A4:19:81:17:F8:74:18:
            14:EA:6C:94:03:CE:10:EA:F5:1D:37:9B:19:20:D4:CC:
            E3:E9:C6:8F:33:93:4A:85:E4:44:D0:D7:6D:C2:27:15:
            4D:3E:E3:CB:4B:84:0F:D7:D3:97:18:EE:28:E8:20:C1:
            51:D0:20:F2:E0:59:46:01:B3:C4:63:9A:E4:D3:83:FD:
            E0:65:86:A2:D6:12:3A:CA:35:9C:A0:CF:4A:D5:A8:29:
            DB:A3:8C:68:9B:AB:CA:52:A5:93:E9:72:A1:31:25:6A:
            03:93:C2:6D:2B:23:F7:78:07:C4:C5:15:52:D4:FA:61:
            17:5B:25:57:94:BF:5E:49:21:53:5E:F5:FB:BE:00:2D:
            09:7D:F2:1A:8D:93:54:8D:82:EA:75:9E:E8:03:AE:89:
            5C:49:A0:C7:64:92:5E:22:8E:3D:FE:13:F4:E6:0B:89:
            5E:60:F3:7E:D9:27:94:C2:37:C2:04:A7:A6:BC:47:C1:
            12:C9:C9:CB:8D:E1:F2:0C:CB:BB:0F:79:22:95:12:ED:
            CE:44:83:B4:1C:47:1A:DC:33:8E:88:8E:D5:DB:82:87            : 0x010001
        • 2.5.29.1
          • 5c ac 04 6b ce fd 35 e2  6e 47 20 d0 fd 73 d7 cf  |\..k..5.nG ..s..|
            • CN: 
              00 57 00 55 00 53 00 21                           |.W.U.S.!        |
            • d4 93 b3 16 5b fb 8f b8  4d 4e 52 be fa e4 67 95  |....[...MNR...g.|
      • RSA-SHA1-2: 
        34 5c 8c 64 ec b5 bf c3  b5 67 e2 a1 31 31 7b 79  |4\.d.....g..11{y|
fd 76 a3 50 a8 61 a4 fd  73 c6 b7 e2 8c e5 11 42  |.v.P.a..s......B|
14 4f 17 b6 8c db e1 9f  cf b7 92 85 d7 31 70 5f  |.O...........1p_|
0d b9 8e 72 45 ac b8 9b  d8 ae 4d cb 07 d9 d1 f5  |...rE.....M.....|
64 a4 98 35 f1 cc d0 03  19 8c ba 32 01 3f 24 fd  |d..5.......2.?$.|
e0 e2 e9 53 ed 6d ea 5f  0f e9 69 6b c7 d2 a7 f5  |...S.m._..ik....|
3a 5a 74 fa 9e 5a e1 64  48 f3 e3 fa 46 01 e0 34  |:Zt..Z.dH...F..4|
aa 78 ab 60 82 fd d9 09  01 5e a1 79 a1 d1 aa fd  |.x.`.....^.y....|
b2 a0 3b de 8b 45 34 2d  56 8e 14 d4 ce 02 c2 7c  |..;..E4-V......||
a3 35 d6 f4 df fc 2b b0  5b 48 ea 37 0c 17 39 6b  |.5....+.[H.7..9k|
f6 d6 5e 7c 45 7b 52 b7  04 4d 59 7b e5 e8 bd 8d  |..^|E{R..MY{....|
49 84 e6 a3 b9 8c 8f 1c  36 cd 0a 3f 07 0c 9c 3f  |I.......6..?...?|
28 f5 72 5c c5 65 ef 98  83 4f 32 f2 24 49 6f 98  |(.r\.e...O2.$Io.|
98 7f a2 bc be a3 d0 88  67 d5 92 4a 4e be 76 6c  |........g..JN.vl|
9d a4 07 fb 49 b8 b4 e3  80 dc ec a3 76 d3 4c b1  |....I.......v.L.|
95 21 f2 6e 0f fc fa 55  32 9c cd 67 3c 23 fb 07  |.!.n...U2..g<#..|
    • 1
      • #0
        • CN: 
          00 57 00 55 00 53 00 21                           |.W.U.S.!        |
        • -57719131853525794810908100208052901995
      • SHA1: nil
      • #2
        • 1.3.6.1.4.1.311.2.1.12
          • nil
        • contentType: 1.3.6.1.4.1.311.2.1.4
        • messageDigest: 
          3e 56 37 6a 97 9e 7b e2  5d 53 49 70 d5 0e 5c 96  |>V7j..{.]SIp..\.|
c1 f3 25 8b                                       |..%.            |
      • rsaEncryption: 
        47 2a 45 00 b3 a1 6a 6e  8c 41 4c eb b6 43 4c 6c  |G*E...jn.AL..CLl|
14 ef bc 9d c3 b8 f2 b0  73 a8 77 34 8f ea 4f 3b  |........s.w4..O;|
e0 3b cd a0 bf 44 81 2c  fd a7 6c 26 d6 08 96 a5  |.;...D.,..l&....|
dc a2 50 83 81 82 33 97  ad a2 08 fe 2d 22 15 02  |..P...3.....-"..|
05 9a 0f 6d ba 57 4d 05  75 30 3f f0 85 95 5b e9  |...m.WM.u0?...[.|
ba 3f 07 85 3e 63 01 54  86 d9 30 fc 42 2a 11 3e  |.?..>c.T..0.B*.>|
57 d1 cc 18 b0 27 2a 01  c6 7b 72 74 e5 32 6d 2f  |W....'*..{rt.2m/|
79 54 2c f0 c8 dd ee 32  95 9d ec 64 01 c6 f8 18  |yT,....2...d....|
fa cb 98 c7 9a d6 9c 24  b0 7f 9a fe d2 2b 18 51  |.......$.....+.Q|
5c d4 e4 55 cc a0 2f 85  6b ac a7 e3 bd 72 e1 84  |\..U../.k....r..|
9c 51 b5 ed 32 da 9f bd  4a c7 10 36 8c 41 bf 35  |.Q..2...J..6.A.5|
7f 3c ea 9e 84 86 c3 b0  cc eb aa bb 07 bb 68 90  |.<............h.|
c5 2b ce ec b7 2f 33 b1  8c 5b 2e 35 c1 49 20 d9  |.+.../3..[.5.I .|
e8 93 4d f6 26 38 97 c0  60 dc 4e 90 ea d4 4d d3  |..M.&8..`.N...M.|
68 2c c5 89 5b 29 ab a9  dd 07 ce 26 31 44 1e 67  |h,..[).....&1D.g|
ad c3 a4 ef 3f de 1a 59  b1 93 c1 ec 2c f8 2c b9  |....?..Y....,.,.|
offsetsizetypecomment
0258048DLL02/23/2018 01:46:34#
15c115HTM#
3f0001312PKCS7Authenticode Signature#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable







everything is OK