filenamepem
size19024 (0x4a50)
md5076758809cb28640d1f51a1ffc1bf833
typePE32 executable (DLL) (console) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x80

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 53 61 6c 66 6f  72 64 20 70 72 6f 67 72  |is Salford progr|
00000020: 61 6d 20 72 65 71 75 69  72 65 73 20 57 69 6e 33  |am requires Win3|
00000030: 32 20 20 20 20 20 20 20  20 20 20 0a 0d 24 00 00  |2          ..$..|

PE Header

SignaturePE
Machine0x14c
NumberOfSections0xd
TimeDateStamp0
PointerToSymbolTable0x306e
NumberOfSymbols0xe4
SizeOfOptionalHeader0xe0
Characteristics0xa182
Magic0x10b
LinkerVersion2.39
SizeOfCode0xe00
SizeOfInitializedData0x1000
SizeOfUninitializedData0x200
AddressOfEntryPoint0x125c
BaseOfCode0x1000
BaseOfData0x2000
ImageBase0x10000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion1.0
ImageVersion0.0
SubsystemVersion4.0
Reserved10
SizeOfImage0xe000
SizeOfHeaders0x400
CheckSum0
Subsystem3
DllCharacteristics0
SizeOfStackReserve0x3200000
SizeOfStackCommit0x4000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Sections

namevavsizeraw sizeflags
.text0x10000xcb60xe00R-X CODE
.bss0x20000x4c0RW- UDATA
.comment0x30000xba0x200---
.data0x40000x1f80x200RW- IDATA
.rdata0x50000x380x200R-- IDATA
.idata0x60000x5cd0x600RW- IDATA
.CRT0x70000xc0x200RW- IDATA
.edata0x80000x400x200R-- IDATA
.salfmap0x90000x57f0x600R-- IDATA
.salfdbg0xa0000x1280x200R-- IDATA DISCARDABLE
.salfsys0xb0000x180x200RW- IDATA
.salfvc0xc0000x2c0x200RW- IDATA
.reloc0xd0000x1f80x200R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT0x80000x40
IMPORT0x60000x5cd
RESOURCE00
EXCEPTION00
SECURITY00
BASERELOC0xd0000x1f0
DEBUG0x50000x38
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT00
Delay_IAT00
CLR_Header00
module_namehintordfunction_name
salflibc.dll10__SALFORD_MAP
salflibc.dll17__throw_temporary_ptr
salflibc.dll3518__undefined_function
salflibc.dll1145OPEN##
salflibc.dll1098WSF2#
salflibc.dll4019__diagnose_bad_address
salflibc.dll1144CLOS##
salflibc.dll1141WSF1##
salflibc.dll3663__undefined_val_interrupt#
salflibc.dll1121I4#WSF
salflibc.dll4018__CHECK95
salflibc.dll3671__UNDEF_R8
salflibc.dll1107D8#WSF
salflibc.dll3935__initialise_sccdll
salflibc.dll3992mprintf0
salflibc.dll3971__init_WindowsType
salflibc.dll3430strerror
salflibc.dll3923__initialise_cpplib
salflibc.dll2GetVersion
salflibc.dll6GetModuleHandleA
salflibc.dll3595__errno_address
salflibc.dll4063strcat
salflibc.dll3594__stdin_address
salflibc.dll4099__salf_exception_handler
salflibc.dll3593__stdout_address
salflibc.dllWinMain
salflibc.dll4035exit
salflibc.dll3592__stderr_address
salflibc.dll3585__ctype_ptr_address
salflibc.dll3591__cout_address
salflibc.dll3590__cin_address
salflibc.dll3584__vd_info_address
salflibc.dll3942__get_virtual_common_block
salflibc.dll3589__cerr_address
salflibc.dll3582__WindowsType_address
salflibc.dll3577__clearwin
salflibc.dll1861__Put_exception_title
salflibc.dll3934__init_cpplib_info
salflibc.dll3578LIBMAIN#
salflibc.dll5GetLastError
salflibc.dll3575__get_main_arguments
salflibc.dll3588____console_stdin_address
salflibc.dll3GetWindow
salflibc.dll4029sprintf
salflibc.dll3587____console_stdout_address
salflibc.dll1860__Put_exception_message
salflibc.dll4030strlwr
salflibc.dll3586____console_stderr_address
salflibc.dll3576main
salflibc.dll3583__special_flags_address
salflibc.dll3581__General_shared_address
salflibc.dll3940__Register_map_info
salflibc.dll3936_scc_lib_version
salflibc.dll4GetModuleFileNameA
ordentry_vafunction_name
10x1000INPUT
module_namepem.dll
flags0
timestamp0
version0.0
ordinal_base1
nFunctions1
nNames1
Names(1)0x802c
Functions(1)0x8028
NameOrdinals(1)0x8030
offsetsizetypecomment
012288DLL01/01/1970 00:00:00#
15c115HTM#
30006736BINoverlay data past EOF#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK