filenamegta5test.dll
size48640 (0xbe00)
md5082b21028838291e0175ae58a7101bd1
typePE32+ executable (DLL) (GUI) x86-64, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x110

Rich Header

lib idversiontimes used
199411181
223208061
2242080611
2252080610
156402192
156212026
221208064
206655011
203655017
10132
2292100512
219210051
222210051

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x8664
NumberOfSections6
TimeDateStamp0x55d2492f
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xf0
Characteristics0x2022
Magic0x20b
LinkerVersion12.0
SizeOfCode0x2a00
SizeOfInitializedData0x9a00
SizeOfUninitializedData0
AddressOfEntryPoint0x30ec
BaseOfCode0x1000
ImageBase0x180000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.0
ImageVersion0.0
SubsystemVersion6.0
Reserved10
SizeOfImage0x11000
SizeOfHeaders0x400
CheckSum0
Subsystem2
DllCharacteristics0x160
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MASM/TASM - sig4

Sections

namevavsizeraw sizeflags
.text0x10000x28af0x2a00R-X CODE
.rdata0x40000x56080x5800R-- IDATA
.data0xa0000x30c80x2800RW- IDATA
.pdata0xe0000x3cc0x400R-- IDATA
.rsrc0xf0000x1e00x200R-- IDATA
.reloc0x100000x8100xa00R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0x8ca40x50
RESOURCE0xf0000x1e0
EXCEPTION0xe0000x3cc
SECURITY00
BASERELOC0x100000x810
DEBUG0x42c00x38
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x6b600x70
Bound_IAT00
IAT0x40000x200
Delay_IAT00
CLR_Header00
typenamesizecp
MANIFEST#23810
module_namehintordfunction_name
KERNEL32.dll1260SetConsoleTitleW
KERNEL32.dll711GetStdHandle
KERNEL32.dll621GetModuleHandleW
KERNEL32.dll1258SetConsoleTextAttribute
KERNEL32.dll733GetSystemTimeAsFileTime
KERNEL32.dll532GetCurrentThreadId
KERNEL32.dll255DecodePointer
KERNEL32.dll21AllocConsole
KERNEL32.dll874IsDebuggerPresent
KERNEL32.dll880IsProcessorFeaturePresent
KERNEL32.dll1072QueryPerformanceCounter
KERNEL32.dll528GetCurrentProcessId
KERNEL32.dll293EncodePointer
MSVCP120.dll1282public: __int64 __cdecl std::basic_streambuf<char, struct std::char_traits<char> >::sputn(char const * __ptr64, __int64) __ptr64

?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z

MSVCP120.dll1279public: int __cdecl std::basic_streambuf<char, struct std::char_traits<char> >::sputc(char) __ptr64

?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z

MSVCP120.dll910public: class std::basic_ostream<char, struct std::char_traits<char> > & __ptr64 __cdecl std::basic_ostream<char, struct std::char_traits<char> >::flush(void) __ptr64

?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ

MSVCP120.dll630public: void __cdecl std::basic_ostream<char, struct std::char_traits<char> >::_Osfx(void) __ptr64

?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ

MSVCP120.dll1369public: char __cdecl std::basic_ios<char, struct std::char_traits<char> >::widen(char)const __ptr64

?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z

MSVCP120.dll267public: class std::basic_ostream<char, struct std::char_traits<char> > & __ptr64 __cdecl std::basic_ostream<char, struct std::char_traits<char> >::operator<<(unsigned __int64) __ptr64

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z

MSVCP120.dll263public: class std::basic_ostream<char, struct std::char_traits<char> > & __ptr64 __cdecl std::basic_ostream<char, struct std::char_traits<char> >::operator<<(class std::ios_base & __ptr64 (__cdecl*)(class std::ios_base & __ptr64)) __ptr64

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z

MSVCP120.dll261public: class std::basic_ostream<char, struct std::char_traits<char> > & __ptr64 __cdecl std::basic_ostream<char, struct std::char_traits<char> >::operator<<(class std::basic_ostream<char, struct std::char_traits<char> > & __ptr64 (__cdecl*)(class std::basic_ostream<char, struct std::char_traits<char> > & __ptr64)) __ptr64

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z

MSVCP120.dll1254public: void __cdecl std::basic_ios<char, struct std::char_traits<char> >::setstate(int, bool) __ptr64

?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z

MSVCP120.dll1154public: class std::basic_ostream<char, struct std::char_traits<char> > & __ptr64 __cdecl std::basic_ostream<char, struct std::char_traits<char> >::put(char) __ptr64

?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z

MSVCP120.dll1347bool __cdecl std::uncaught_exception(void)

?uncaught_exception@std@@YA_NXZ

MSVCP120.dll716void __cdecl std::_Xlength_error(char const * __ptr64)

?_Xlength_error@std@@YAXPEBD@Z

MSVCP120.dll717void __cdecl std::_Xout_of_range(char const * __ptr64)

?_Xout_of_range@std@@YAXPEBD@Z

MSVCP120.dll713void __cdecl std::_Xbad_alloc(void)

?_Xbad_alloc@std@@YAXXZ

MSVCP120.dll744class std::basic_ostream<char, struct std::char_traits<char> > std::cout

?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A

MSVCP120.dll688char const * __ptr64 __cdecl std::_Syserror_map(int)

?_Syserror_map@std@@YAPEBDH@Z

MSVCP120.dll709char const * __ptr64 __cdecl std::_Winerror_map(int)

?_Winerror_map@std@@YAPEBDH@Z

MSVCR120.dll1742printf
MSVCR120.dll1038_purecall
MSVCR120.dll114void __cdecl operator delete(void * __ptr64)

??3@YAXPEAX@Z

MSVCR120.dll1617freopen
MSVCR120.dll112void * __ptr64 __cdecl operator new(unsigned __int64)

??2@YAPEAX_K@Z

MSVCR120.dll1141_stricmp
MSVCR120.dll859_lock
MSVCR120.dll1223_unlock
MSVCR120.dll521_calloc_crt
MSVCR120.dll415__dllonexit
MSVCR120.dll348__C_specific_handler
MSVCR120.dll1026_onexit
MSVCR120.dll349__CppXcptFilter
MSVCR120.dll498_amsg_exit
MSVCR120.dll1616free
MSVCR120.dll876_malloc_crt
MSVCR120.dll737_initterm
MSVCR120.dll738_initterm_e
MSVCR120.dll354__CxxFrameHandler3
MSVCR120.dll413__crt_debugger_hook
MSVCR120.dll412__crtUnhandledException
MSVCR120.dll411__crtTerminateProcess
MSVCR120.dll382__crtCapturePreviousContext
MSVCR120.dll307void __cdecl terminate(void)

?terminate@@YAXXZ

MSVCR120.dll283public: void __cdecl type_info::_type_info_dtor_internal_method(void) __ptr64

?_type_info_dtor_internal_method@type_info@@QEAAXXZ

MSVCR120.dll379__clean_type_info_names_internal
MSVCR120.dll425__iob_func
MSVCR120.dll1719memmove
MSVCR120.dll1717memcpy
MSVCR120.dll325_CxxThrowException
MSVCR120.dll1721memset
offsetsizetypecomment
15c115HTM#
15d043056BINoverlay data past EOF#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK