filenameapds.dll
size1739776 (0x1a8c00)
md57d44ee5dbcc3a6e90eb60edf72b66d99
typePE32 executable (DLL) (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xf0

Rich Header

lib idversiontimes used
1493072912
10393
1473072921
146307291
13230729144
13130729100
126507271
148307291
145307291

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections4
TimeDateStamp0x4a5bd996
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x2102
Magic0x10b
LinkerVersion9.0
SizeOfCode0xa9c00
SizeOfInitializedData0x100600
SizeOfUninitializedData0
AddressOfEntryPoint0x1d99
BaseOfCode0x1000
BaseOfData0xaa000
ImageBase0x2a400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.1
ImageVersion6.1
SubsystemVersion5.0
Reserved10
SizeOfImage0x1ad000
SizeOfHeaders0x400
CheckSum0x1a9266
Subsystem2
DllCharacteristics0x140
SizeOfStackReserve0x40000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v7.0 DLL

Sections

namevavsizeraw sizeflags
.text0x10000xa9a550xa9c00R-X CODE
.data0xab0000xb16bc0xafe00RW- IDATA
.rsrc0x15d0000x453700x45400R-- IDATA
.reloc0x1a30000x99f40x9a00R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT0xa0dc0xba
IMPORT0xa92c00xc8
RESOURCE0x15d0000x45370
EXCEPTION00
SECURITY00
BASERELOC0x1a30000x99f4
DEBUG0xaa9f80x38
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x28b380x40
Bound_IAT0x2880xcc
IAT0x10000x4a8
Delay_IAT0xa8ee00xe0
CLR_Header00
typenamesizecp
CSS#50220870
CSS#50377220
MUI#13200
PNG#5071740
PNG#5081770
PNG#50928880
PNG#51027940
PNG#51128940
PNG#5128140
PNG#51330820
PNG#51430840
PNG#5151140
PNG#5161690
PNG#5171920
PNG#5181510
PNG#519940
PNG#5201050
PNG#5212100
PNG#5224330
PNG#5234680
PNG#5245200
PNG#5255420
PNG#5266210
PNG#5276220
PNG#5345870
REGISTRY#1017030
REGISTRY#20348090
REGISTRY#20356860
REGISTRY#20366540
REGISTRY#20376240
REGISTRY#20386720
REGISTRY#20397510
REGISTRY#20436640
REGISTRY#20447590
REGISTRY#20546940
REGISTRY#20567030
REGISTRY#20707190
REGISTRY#20747120
REGISTRY#20756400
REGISTRY#20766960
REGISTRY#20777040
REGISTRY#20787000
REGISTRY#20798000
REGISTRY#20807350
REGISTRY#20817760
REGISTRY#20827010
TYPELIB#1286960
WEVT_TEMPLATE#1144740
XML#60023210
XML#601606640
ICON#17440
ICON#22960
ICON#337520
ICON#437520
ICON#522160
ICON#613840
ICON#796400
ICON#842640
ICON#911280
ICON#1037520
ICON#1122160
ICON#1213840
ICON#1396400
ICON#1442640
ICON#1511280
ICON#1637520
ICON#1722160
ICON#1813840
ICON#1996400
ICON#2042640
ICON#2111280
ICON#2237520
ICON#2322160
ICON#2413840
ICON#2596400
ICON#2642640
ICON#2711280
ICON#287440
ICON#292960
ICON#3022160
ICON#3113840
ICON#3242640
ICON#3311280
ICON#347440
ICON#352960
ICON#3622160
ICON#3713840
ICON#3842640
ICON#3911280
ICON#407440
ICON#412960
ICON#4222160
ICON#4313840
ICON#4442640
ICON#4511280
GROUP_ICONICON!HTMLHELP480
GROUP_ICON#207900
GROUP_ICON#209900
GROUP_ICON#210900
GROUP_ICON#211900
GROUP_ICON#212900
GROUP_ICON#216900
GROUP_ICON#219900
VERSION#19360
module_namehintordfunction_name
msvcrt.dll9public: __thiscall exception::exception(char const * const &)

??0exception@@QAE@ABQBD@Z

msvcrt.dll57public: virtual char const * __thiscall exception::what(void)const

?what@exception@@UBEPBDXZ

msvcrt.dll16public: virtual __thiscall exception::~exception(void)

??1exception@@UAE@XZ

msvcrt.dll866_strlwr
msvcrt.dll1011_wcslwr
msvcrt.dll11public: __thiscall exception::exception(class exception const &)

??0exception@@QAE@ABV0@@Z

msvcrt.dll99_CxxThrowException
msvcrt.dll12public: __thiscall exception::exception(void)

??0exception@@QAE@XZ

msvcrt.dll1255mbtowc
msvcrt.dll1218isleadbyte
msvcrt.dll815_snprintf
msvcrt.dll561_itoa
msvcrt.dll176__mb_cur_max
msvcrt.dll475_iob
msvcrt.dll274_callnewh
msvcrt.dll106_XcptFilter
msvcrt.dll469_initterm
msvcrt.dll257_amsg_exit
msvcrt.dll17public: virtual __thiscall type_info::~type_info(void)

??1type_info@@UAE@XZ

msvcrt.dll55void __cdecl terminate(void)

?terminate@@YAXXZ

msvcrt.dll934_unlock
msvcrt.dll133__badioinfo
msvcrt.dll207__pioinfo
msvcrt.dll367_fileno
msvcrt.dll587_lseeki64
msvcrt.dll1096_write
msvcrt.dll478_isatty
msvcrt.dll141__dllonexit
msvcrt.dll578_lock
msvcrt.dll747_onexit
msvcrt.dll418_gcvt
msvcrt.dll1172ferror
msvcrt.dll113__CxxFrameHandler
msvcrt.dll1366wcscspn
msvcrt.dll974_vsnwprintf
msvcrt.dll926_ultow
msvcrt.dll1380wcsstr
msvcrt.dll1387wcstoul
msvcrt.dll66_CIlog
msvcrt.dll590_ltow
msvcrt.dll1229iswdigit
msvcrt.dll563_itow
msvcrt.dll1381wcstod
msvcrt.dll104_HUGE
msvcrt.dll379_fpclass
msvcrt.dll1234iswspace
msvcrt.dll1371wcsncmp
msvcrt.dll1129_wtoi
msvcrt.dll744_msize
msvcrt.dll1157calloc
msvcrt.dll1017_wcsnicmp
msvcrt.dll1154bsearch
msvcrt.dll1332time
msvcrt.dll1274qsort
msvcrt.dll1279realloc
msvcrt.dll764_purecall
msvcrt.dll1361wcschr
msvcrt.dll1376wcsrchr
msvcrt.dll1258memcpy
msvcrt.dll1153atol
msvcrt.dll1311strncmp
msvcrt.dll1260memmove
msvcrt.dll1007_wcsicmp
msvcrt.dll968_vsnprintf
msvcrt.dll1190free
msvcrt.dll1246malloc
msvcrt.dll992_waccess
msvcrt.dll342_errno
msvcrt.dll1379wcsspn
msvcrt.dll1225iswalpha
msvcrt.dll1323strtoul
msvcrt.dll997_wchdir
msvcrt.dll1375wcspbrk
msvcrt.dll500_ismbblead
msvcrt.dll1222isspace
msvcrt.dll1228iswctype
msvcrt.dll1002_wcsdup
msvcrt.dll1262memset
KERNEL32.dll854MapViewOfFile
KERNEL32.dll517GetLocaleInfoW
KERNEL32.dll1234UnmapViewOfFile
KERNEL32.dll621GetSystemDefaultUILanguage
KERNEL32.dll669GetUserDefaultUILanguage
KERNEL32.dll1050SearchPathW
KERNEL32.dll330FindResourceA
KERNEL32.dll136CreateFileA
KERNEL32.dll210DeleteFileA
KERNEL32.dll515GetLocaleInfoA
KERNEL32.dll284ExpandEnvironmentStringsW
KERNEL32.dll532GetModuleHandleA
KERNEL32.dll484GetFileAttributesA
KERNEL32.dll459GetDiskFreeSpaceA
KERNEL32.dll641GetTempFileNameA
KERNEL32.dll643GetTempPathA
KERNEL32.dll359GetACP
KERNEL32.dll348FormatMessageA
KERNEL32.dll827LoadLibraryA
KERNEL32.dll738InitializeCriticalSectionAndSpinCount
KERNEL32.dll446GetCurrentDirectoryW
KERNEL32.dll618GetSystemDefaultLCID
KERNEL32.dll666GetUserDefaultLCID
KERNEL32.dll530GetModuleFileNameA
KERNEL32.dll1015ReleaseMutex
KERNEL32.dll158CreateMutexW
KERNEL32.dll140CreateFileMappingW
KERNEL32.dll1189SetUnhandledExceptionFilter
KERNEL32.dll1235UnhandledExceptionFilter
KERNEL32.dll1216TerminateProcess
KERNEL32.dll449GetCurrentProcessId
KERNEL32.dll453GetCurrentThreadId
KERNEL32.dll935QueryPerformanceCounter
KERNEL32.dll1048RtlUnwind
KERNEL32.dll905OutputDebugStringA
KERNEL32.dll581GetProcAddress
KERNEL32.dll536GetModuleHandleW
KERNEL32.dll676GetVersionExW
KERNEL32.dll706GlobalSize
KERNEL32.dll702GlobalLock
KERNEL32.dll709GlobalUnlock
KERNEL32.dll1317WriteFile
KERNEL32.dll82CloseHandle
KERNEL32.dll143CreateFileW
KERNEL32.dll643GetTempFileNameW
KERNEL32.dll645GetTempPathW
KERNEL32.dll691GlobalAlloc
KERNEL32.dll214DeleteFileW
KERNEL32.dll514GetLastError
KERNEL32.dll1297WideCharToMultiByte
KERNEL32.dll130CreateEventA
KERNEL32.dll1273WaitForSingleObject
KERNEL32.dll1039ResetEvent
KERNEL32.dll1113SetEvent
KERNEL32.dll871MultiByteToWideChar
KERNEL32.dll698GlobalFree
KERNEL32.dll1358lstrlenW
KERNEL32.dll238EnterCriticalSection
KERNEL32.dll825LeaveCriticalSection
KERNEL32.dll738InitializeCriticalSection
KERNEL32.dll209DeleteCriticalSection
KERNEL32.dll751InterlockedIncrement
KERNEL32.dll747InterlockedDecrement
KERNEL32.dll532GetModuleFileNameW
KERNEL32.dll864MoveFileExW
KERNEL32.dll302FindClose
KERNEL32.dll325FindNextFileW
KERNEL32.dll313FindFirstFileW
KERNEL32.dll960ReadFile
KERNEL32.dll1126SetFilePointer
KERNEL32.dll1107SetEndOfFile
KERNEL32.dll633GetSystemTimeAsFileTime
KERNEL32.dll1357lstrlenA
KERNEL32.dll1202Sleep
KERNEL32.dll1323WritePrivateProfileStringW
KERNEL32.dll778IsValidCodePage
KERNEL32.dll1201SizeofResource
KERNEL32.dll852LockResource
KERNEL32.dll833LoadResource
KERNEL32.dll334FindResourceW
KERNEL32.dll333FindResourceExW
KERNEL32.dll354FreeLibrary
KERNEL32.dll831LoadLibraryW
KERNEL32.dll840LocalFree
KERNEL32.dll906OutputDebugStringW
KERNEL32.dll659GetTickCount
KERNEL32.dll945RaiseException
KERNEL32.dll222DisableThreadLibraryCalls
KERNEL32.dll748InterlockedExchange
KERNEL32.dll1349lstrcmpiW
KERNEL32.dll830LoadLibraryExW
KERNEL32.dll507GetFullPathNameW
KERNEL32.dll448GetCurrentProcess
KERNEL32.dll452GetCurrentThread
KERNEL32.dll129CreateDirectoryW
KERNEL32.dll1121SetFileAttributesW
KERNEL32.dll490GetFileAttributesW
KERNEL32.dll1139SetLastError
KERNEL32.dll206DelayLoadFailureHook
KERNEL32.dll745InterlockedCompareExchange
KERNEL32.dll829LoadLibraryExA
KERNEL32.dll715HeapAlloc
KERNEL32.dll719HeapFree
KERNEL32.dll586GetProcessHeap
KERNEL32.dll813LCMapStringW
KERNEL32.dll1263VirtualProtect
KERNEL32.dll1257VirtualAlloc
KERNEL32.dll627GetSystemInfo
KERNEL32.dll1265VirtualQuery
KERNEL32.dll674GetVersion
KERNEL32.dll675GetVersionExA
KERNEL32.dll718HeapDestroy
KERNEL32.dll722HeapReAlloc
KERNEL32.dll724HeapSize
USER32.dll773UnregisterClassA
USER32.dll49CharNextW
USER32.dll45CharLowerBuffW
USER32.dll382GetSystemMetrics
USER32.dll506LoadStringW
ADVAPI32.dll348GetTraceEnableLevel
ADVAPI32.dll349GetTraceLoggerHandle
ADVAPI32.dll572RegCreateKeyW
ADVAPI32.dll650RegisterTraceGuidsW
ADVAPI32.dll560RegCloseKey
ADVAPI32.dll756TraceEvent
ADVAPI32.dll612RegOpenKeyW
ADVAPI32.dll622RegQueryValueExW
ADVAPI32.dll591RegEnumKeyExW
ADVAPI32.dll609RegOpenKeyExW
ADVAPI32.dll594RegEnumValueW
ADVAPI32.dll770UnregisterTraceGuids
ADVAPI32.dll616RegQueryInfoKeyW
ADVAPI32.dll32AllocateAndInitializeSid
ADVAPI32.dll288FreeSid
ADVAPI32.dll689SetNamedSecurityInfoW
ADVAPI32.dll584RegDeleteValueW
ADVAPI32.dll569RegCreateKeyExW
ADVAPI32.dll638RegSetValueExW
ADVAPI32.dll327GetSecurityDescriptorControl
ADVAPI32.dll333GetSecurityDescriptorSacl
ADVAPI32.dll328GetSecurityDescriptorDacl
ADVAPI32.dll329GetSecurityDescriptorGroup
ADVAPI32.dll331GetSecurityDescriptorOwner
ADVAPI32.dll482MakeSelfRelativeSD
ADVAPI32.dll330GetSecurityDescriptorLength
ADVAPI32.dll222DuplicateToken
ADVAPI32.dll503OpenProcessToken
ADVAPI32.dll508OpenThreadToken
ADVAPI32.dll656RevertToSelf
ADVAPI32.dll705SetThreadToken
ADVAPI32.dll31AdjustTokenPrivileges
ADVAPI32.dll407LookupPrivilegeValueW
ADVAPI32.dll373ImpersonateSelf
ADVAPI32.dll347GetTraceEnableFlags
ADVAPI32.dll322GetNamedSecurityInfoW
ADVAPI32.dll483MapGenericMask
ADVAPI32.dll5AccessCheck
ole32.dll103CoTaskMemAlloc
ole32.dll121CreateBindCtx
ole32.dll377StringFromGUID2
ole32.dll105CoTaskMemRealloc
ole32.dll16CoCreateInstance
ole32.dll376StringFromCLSID
ole32.dll8CLSIDFromString
ole32.dll312OleLockRunning
ole32.dll6CLSIDFromProgID
ole32.dll38CoGetClassObject
ole32.dll129CreateItemMoniker
ole32.dll132CreatePointerMoniker
ole32.dll22CoDisconnectObject
ole32.dll149GetHGlobalFromStream
ole32.dll104CoTaskMemFree
ole32.dll134CreateStreamOnHGlobal
OLEAUT32.dll22
OLEAUT32.dll202
OLEAUT32.dll277
OLEAUT32.dll12
OLEAUT32.dll163
OLEAUT32.dll186
OLEAUT32.dll27
OLEAUT32.dll16
OLEAUT32.dll19
OLEAUT32.dll20
OLEAUT32.dll77
OLEAUT32.dll21
OLEAUT32.dll10
OLEAUT32.dll313
OLEAUT32.dll161
OLEAUT32.dll162
OLEAUT32.dll9
OLEAUT32.dll8
OLEAUT32.dll4
OLEAUT32.dll7
OLEAUT32.dll200
OLEAUT32.dll201
OLEAUT32.dll149
OLEAUT32.dll150
OLEAUT32.dll2
OLEAUT32.dll314
OLEAUT32.dll6
SHLWAPI.dll56PathCanonicalizeW
SHLWAPI.dll12
SHLWAPI.dll99PathIsPrefixW
SHLWAPI.dll101PathIsRelativeW
SHLWAPI.dll363UrlUnescapeW
SHLWAPI.dll348UrlEscapeW
USERENV.dll44UnloadUserProfile
ntdll.dll363NtOpenThreadToken
ntdll.dll355NtOpenProcessToken
ntdll.dll212NtClose
ntdll.dll401NtQueryInformationToken
ordentry_vafunction_name
10x6e2adDllCanUnloadNow
20xa19bDllGetClassObject
30x735bbDllRegisterServer
40x735cfDllUnregisterServer
50x76f0fHxGetObjectCMI
module_namehxds.DLL
flags0
timestamp2009-07-14 00:12:41
version0.0
ordinal_base1
nFunctions5
nNames5
Names(5)0xa118
Functions(5)0xa104
NameOrdinals(5)0xa12c

StringTable 040904B0

CompanyNameMicrosoft Corporation
FileDescriptionMicrosoft® Help Data Services Module
FileVersion6.1.7600.16385 (win7_rtm.090713-1255)
InternalNameAPDS.DLL
LegalCopyright© Microsoft Corporation. All rights reserved.
OriginalFilenameAPDS.DLL
ProductNameMicrosoft® Windows® Operating System
ProductVersion6.1.7600.16385

VS_FIXEDFILEINFO

FileVersion6.1.7600.16385
ProductVersion6.1.7600.16385
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType2
FileSubtype0
offsetsizetypecomment
01739776DLL07/14/2009 01:04:22#
15c115HTM#
18f638174PNG(20 x 10)#
18f6e8177PNG(20 x 10)#
18f7a02888PNG(9 x 9)#
1902e82794PNG(9 x 9)#
190dd82894PNG(9 x 9)#
191928814PNG(16 x 16)#
191c583082PNG(12 x 12)#
1928683084PNG(12 x 12)#
193478114PNG(3 x 11)#
1934f0169PNG(12 x 11)#
1935a0192PNG(13 x 11)#
193660151PNG(4 x 4)#
1936f894PNG(12 x 1)#
193758105PNG(13 x 1)#
1937c8210PNG(2 x 90)#
1938a0433PNG(12 x 90)#
193a58468PNG(13 x 90)#
193c30520PNG(16 x 16)#
193e38542PNG(16 x 16)#
194058621PNG(16 x 16)#
1942c8622PNG(16 x 16)#
194538587PNG(16 x 16)#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable







[?] can't find file_offset of VA 0x288