STEP1_FLY-CODE.dll

info
MZ
PE
resources
strings
imports
exports
foremost
7zip
version info
hexdump
disasm
log
discuss
donate

filename	STEP1_FLY-CODE.dll
size	470528 (0x72e00)
md5	63d9524e142476f9cc0400737d540030

type	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, PECompact2 compressed
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x50
blocks_in_file	2
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0xf
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0x1a
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x100

DOS stub

00000000: ba 10 00 0e 1f b4 09 cd  21 b8 01 4c cd 21 90 90  |........!..L.!..|
00000010: 54 68 69 73 20 70 72 6f  67 72 61 6d 20 6d 75 73  |This program mus|
00000020: 74 20 62 65 20 72 75 6e  20 75 6e 64 65 72 20 57  |t be run under W|
00000030: 69 6e 33 32 0d 0a 24 37  00 00 00 00 00 00 00 00  |in32..$7........|
00000040: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
000000c0:

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	3
TimeDateStamp	0x56cce813
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0xa1ae
Magic	0x10b
LinkerVersion	2.25
SizeOfCode	0x35600
SizeOfInitializedData	0xd600
SizeOfUninitializedData	0
AddressOfEntryPoint	0x1000
BaseOfCode	0x1000
BaseOfData	0x37000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	5.0
ImageVersion	0.0
SubsystemVersion	5.0
Reserved1	0
SizeOfImage	0x51200
SizeOfHeaders	0x400
CheckSum	0x12345678
Subsystem	2
DllCharacteristics	0
SizeOfStackReserve	0x1000
SizeOfStackCommit	0x100000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x4e000	0x4e000	R-- CODE
.rsrc	0x4f000	0x2000	0x2000	RWX CODE
.reloc	0x51000	0x1000	0x1000	RW- IDATA

Data Directory

type	va	size
EXPORT	0x4f46c	0x64
IMPORT	0x4f54c	0x2a8
RESOURCE	0x4f000	0x464
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0x51000	0x18
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0	0
Delay_IAT	0x45000	0x1c8
CLR_Header	0	0

show previews

type	name	size
STRING	#4088	256
STRING	#4089	804
STRING	#4090	712
STRING	#4091	184
STRING	#4092	156
STRING	#4093	824
STRING	#4094	1092
STRING	#4095	908
STRING	#4096	700
RCDATA	DVCLAL	16
RCDATA	PACKAGEINFO	548
RCDATA	PLATFORMTARGETS	2
VERSION	#1	324

id	lang	string
65392	0	Windows Server 2003
65393	0	Windows Server 2003 R2
65394	0	Windows Server 2012
65395	0	Windows Server 2012 R2
65396	0	Windows 8
65397	0	Windows 8.1
65398	0	Windows 10
65408	0	List capacity out of bounds (%d)
65409	0	List index out of bounds (%d)
65410	0	Parameter %s cannot be a negative value
65411	0	Input buffer exceeded for %s = %d, %s = %d
65412	0	The specified file was not found
65413	0	%s (Version %d.%d, Build %d, %5:s)
65414	0	%s Service Pack %4:d (Version %1:d.%2:d, Build %3:d, %5:s)
65415	0	32-bit Edition
65416	0	64-bit Edition
65417	0	Windows
65418	0	Windows Vista
65419	0	Windows Server 2008
65420	0	Windows 7
65421	0	Windows Server 2008 R2
65422	0	Windows 2000
65423	0	Windows XP
65424	0	Monday
65425	0	Tuesday
65426	0	Wednesday
65427	0	Thursday
65428	0	Friday
65429	0	Saturday
65430	0	Invalid source array
65431	0	Invalid destination array
65432	0	Character index out of bounds (%d)
65433	0	Start index out of bounds (%d)
65434	0	Invalid count (%d)
65435	0	Invalid destination index (%d)
65436	0	Invalid code page
65437	0	Invalid encoding name
65438	0	No mapping for the Unicode character exists in the target multi-byte code page
65439	0	Invalid file name - %s
65440	0	May
65441	0	June
65442	0	July
65443	0	August
65444	0	September
65445	0	October
65446	0	November
65447	0	December
65448	0	Sun
65449	0	Mon
65450	0	Tue
65451	0	Wed
65452	0	Thu
65453	0	Fri
65454	0	Sat
65455	0	Sunday
65456	0	Jan
65457	0	Feb
65458	0	Mar
65459	0	Apr
65460	0	May
65461	0	Jun
65462	0	Jul
65463	0	Aug
65464	0	Sep
65465	0	Oct
65466	0	Nov
65467	0	Dec
65468	0	January
65469	0	February
65470	0	March
65471	0	April
65472	0	Variant overflow
65473	0	Invalid argument
65474	0	Invalid variant type
65475	0	Operation not supported
65476	0	Unexpected variant error
65477	0	External exception %x
65478	0	Assertion failed
65479	0	Interface not supported
65480	0	Exception in safecall method
65481	0	Object lock not owned
65482	0	Monitor support function not initialized
65483	0	Feature not implemented
65484	0	Method called on disposed object
65485	0	%s (%s, line %d)
65486	0	Abstract Error
65487	0	Access violation at address %p in module '%s'. %s of address %p
65488	0	Read
65489	0	Write
65490	0	Execution
65491	0	Invalid access
65492	0	Error creating variant or safe array
65493	0	Variant or safe array index out of bounds
65494	0	Variant or safe array is locked
65495	0	Invalid variant type conversion
65496	0	Invalid variant operation
65497	0	Invalid variant operation (%s%.8x) %s
65498	0	Custom variant type (%s%.4x) is out of range
65499	0	Custom variant type (%s%.4x) already used by %s
65500	0	Custom variant type (%s%.4x) is not usable
65501	0	Too many custom variant types have been registered
65502	0	Could not convert variant of type (%s) into type (%s)
65503	0	Overflow while converting variant of type (%s) into type (%s)
65504	0	Invalid floating point operation
65505	0	Floating point division by zero
65506	0	Floating point overflow
65507	0	Floating point underflow
65508	0	Invalid pointer operation
65509	0	Invalid class typecast
65510	0	Access violation at address %p. %s of address %p
65511	0	Access violation
65512	0	Stack overflow
65513	0	Control-C hit
65514	0	Privileged instruction
65515	0	Exception %s in module %s at %p. %s%s
65516	0	Application Error
65517	0	Format '%s' invalid or incompatible with argument
65518	0	No argument for format '%s'
65519	0	Variant method calls not supported
65520	0	<unknown>
65521	0	'%s' is not a valid integer value
65522	0	'%d.%d' is not a valid timestamp
65523	0	'%s' is not a valid boolean value
65524	0	Invalid argument to time encode
65525	0	Invalid argument to date encode
65526	0	Out of memory
65527	0	I/O error %d
65528	0	Too many open files
65529	0	File access denied
65530	0	Read beyond end of file
65531	0	Disk full
65532	0	Invalid numeric input
65533	0	Division by zero
65534	0	Range check error
65535	0	Integer overflow

module_name	hint	ord	function_name

ord	entry_va	function_name
1	0x3fc5c	dbkFCallWrapperAddr
2	0xcb34	__dbk_fcall_wrapper

module_name	warpack.dll
flags	0
timestamp	0
version	0.0
ordinal_base	1
nFunctions	2
nNames	2
Names(2)	0x4f498
Functions(2)	0x4f4a0
NameOrdinals(2)	0x4f494

StringTable 040904E4

FileVersion	0.2.1.12
ProductVersion	1.0.0.0

VS_FIXEDFILEINFO

FileVersion	0.2.1.12
ProductVersion	1.0.0.0
StrucVersion	0x10000
FileFlagsMask	0x3f
FileFlags	0
FileOS	4
FileType	2
FileSubtype	0

show previews

offset	size	type	comment
0	335872	DLL	02/23/2016 23:15:31	#
15c1	15	HTM		#
52000	134656	BIN	overlay data past EOF	#

Scanning the drive for archives:
1 file, 470528 bytes (460 KiB)



Errors: 1

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] invalid VA 0x7ff93da0 in OriginalFirstThunk[0] for kernel32.dll

[?] invalid VA 0x7ff93058 in OriginalFirstThunk[1] for kernel32.dll

[?] invalid VA 0x7ff954d4 in OriginalFirstThunk[2] for kernel32.dll

[?] invalid VA 0x7ff95510 in OriginalFirstThunk[3] for kernel32.dll

[?] invalid VA 0x7ff71064 in OriginalFirstThunk[0] for oleaut32.dll

[?] invalid VA 0x7ff536ac in OriginalFirstThunk[0] for advapi32.dll

[?] invalid VA 0x7fed1384 in OriginalFirstThunk[0] for user32.dll

[?] invalid VA 0x7fdc0e65 in OriginalFirstThunk[0] for MSVCR110.dll

[?] invalid VA 0x7fd91118 in OriginalFirstThunk[0] for version.dll

[?] invalid VA 0x7fd72360 in OriginalFirstThunk[0] for netapi32.dll

[?] invalid VA 0x7feb496c in OriginalFirstThunk[0] for msvcrt.dll

[?] invalid VA 0x7fe91168 in OriginalFirstThunk[0] for ole32.dll

[?] invalid VA 0x7fd00450 in OriginalFirstThunk[0] for winhttp.dll