EOVHHFZB.DLL - King.dll - TotalKing API

info
MZ
PE
resources
imports
exports
foremost
version info
hexdump
disasm
log
discuss
donate

filename	EOVHHFZB.DLL
size	5812224 (0x58b000)
md5	826800aaf22889c3fae2494f6f5681f3

type	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x110

Rich Header

lib id	version	times used
105	2067	13
15	3077	25
95	2179	1
93	2067	2
25	9210	4
1	0	188
93	2179	13
96	3077	14
95	3077	129
92	3077	1
94	3052	1
90	3077	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	9
TimeDateStamp	0x54d64287
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x210e
Magic	0x10b
LinkerVersion	7.10
SizeOfCode	0x25000
SizeOfInitializedData	0x445000
SizeOfUninitializedData	0
AddressOfEntryPoint	0x7bb000
BaseOfCode	0x1000
BaseOfData	0x26000
ImageBase	0x1000000
SectionAlignment	0x1000
FileAlignment	0x1000
OperatingSystemVersion	4.0
ImageVersion	0.0
SubsystemVersion	4.0
Reserved1	0
SizeOfImage	0x7be000
SizeOfHeaders	0x1000
CheckSum	0x596f55
Subsystem	2
DllCharacteristics	0
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

MASM/TASM - sig1(h)

Sections

name	va	vsize	raw size	flags
	0x1000	0x36000	0x19000	RWX IDATA
.rsrc	0x37000	0x432378	0x433000	RW- IDATA
.idata	0x46a000	0x1000	0x1000	RW- IDATA
	0x46b000	0x216000	0x1000	RWX IDATA
mnexwcwf	0x681000	0x135000	0x135000	RWX IDATA
gwictwf	0x7b6000	0x1000	0x1000	RWX IDATA
gwictwf	0x7b7000	0x3000	0x3000	RWX IDATA
.dataAp	0x7ba000	0x1000	0	RWX IDATA
.taggant	0x7bb000	0x3000	0x3000	RWX IDATA

Data Directory

type	va	size
EXPORT	0x7b579c	0xb0
IMPORT	0x46a1bb	0x20b
RESOURCE	0x37000	0x432378
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0x7b7000	0x40
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0	0
Delay_IAT	0	0
CLR_Header	0	0

show previews

type	name	size	cp
BIN	#137	1438384	1252
BIN	#144	74968	1252
BIN	#145	780	1252
BIN	#146	694	1252
BIN	#147	667	1252
BIN	#148	1050104	1252
BIN	#149	58952	1252
BIN	#150	780	1252
BIN	#151	694	1252
BIN	#152	667	1252
BIN	#153	921992	1252
BIN	#154	23824	1252
BIN	#155	48651	1252
BIN	#158	646320	1252
BIN	#159	5120	1252
BIN	#160	14600	1252
BIN	#162	86192	1252
BITMAP	#123	5158	1252
BITMAP	#126	16584	1252
DIALOG	#101	456	1252
DIALOG	#102	580	1252
DIALOG	#112	800	1252
VERSION	#1	1196	1252
MANIFEST	#1	523	1252

module_name	hint	ord	function_name
KERNEL32.dll			GetProcessHeap
KERNEL32.dll			GetVersionExA
KERNEL32.dll			HeapAlloc
KERNEL32.dll			GetModuleHandleA
KERNEL32.dll			LoadLibraryA
KERNEL32.dll			VirtualAlloc
KERNEL32.dll			VirtualFree
KERNEL32.dll			GetCurrentThreadId
KERNEL32.dll			GetCommandLineA
KERNEL32.dll			HeapFree
KERNEL32.dll			FreeLibrary
USER32.dll			MessageBoxA
IMM32.dll			ImmSetCompositionWindow
COMCTL32.dll			ImageList_EndDrag

ord	entry_va	function_name
1	0x188a0	_DllMain@12
2	0xaf20	FLCHKPROTCTION
3	0xb0f0	KINGCHECKPROTECTION
4	0x18750	KINGVER
5	0xaf00	VBKINGCHECKPROTECTION

module_name	King.dll
flags	0
timestamp	2015-02-07 16:51:19
version	0.0
ordinal_base	1
nFunctions	5
nNames	5
Names(5)	0x7b57d8
Functions(5)	0x7b57c4
NameOrdinals(5)	0x7b57ec

StringTable 040904b0

CompanyName	GreenWay Information and Communication Technology - info@greenway.ir
FileDescription	TotalKing API
FileVersion	2, 3, 7, 1
InternalName	TotalKing
LegalCopyright	Copyright © 2003-2015 , GreenWay Information and Communication Technology
LegalTrademarks	HDCS and TotalKing are Trademark of Greenway ICT
OriginalFilename	King.dll
PrivateBuild	HDCS v1.25.1 Included
ProductName	TotalKing
ProductVersion	2, 3, 7, 1
SpecialBuild	7 Feb 2015

VS_FIXEDFILEINFO

FileVersion	2.3.7.1
ProductVersion	2.3.7.1
StrucVersion	0x10000
FileFlagsMask	0x3f
FileFlags	0x28
FileOS	0x40004
FileType	2
FileSubtype	0

show previews

offset	size	type	comment
15c1	15	HTM		#
1a510	1438208	EXE	12/10/2010 16:15:41	#
163de4	29162	BMP	(476 x 59)	#
16b108	3286	BMP	(92 x 24)	#
16be55	3286	BMP	(92 x 24)	#
16cc0f	3286	BMP	(92 x 24)	#
218838	13026	AVI		#
28caf0	50612	EXE	09/28/2010 09:11:56	#
29b998	914944	EXE	05/23/2009 10:15:05	#
3042d8	13026	AVI		#
37cb20	15488	EXE	09/26/2010 07:36:24	#
382830	48649	HTM		#
38e63c	646144	EXE	01/14/2014 17:09:49	#
42c2ec	5120	DLL	07/28/2007 13:04:06	#
42d6ec	1431828	BIN	overlay data past EOF	#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

everything is OK

EOVHHFZB.DLL- King.dll - TotalKing API

MZ Header

Rich Header

DOS stub

PE Header

Packer / Compiler

Sections

Data Directory

StringTable 040904b0

VS_FIXEDFILEINFO

EOVHHFZB.DLL
- King.dll - TotalKing API