filenameusp10_new.dll
size801280 (0xc3a00)
md5088cf6afcd5cdd44e40c0acde3c1a5e0
typePE32+ executable (DLL) (GUI) x86-64, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xe0

Rich Header

lib idversiontimes used
149307291
10135
147307299
1313072910
146307291
13830729113
148307291
145307291

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x8664
NumberOfSections6
TimeDateStamp0x5359c98c
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xf0
Characteristics0x2022
Magic0x20b
LinkerVersion9.0
SizeOfCode0x82000
SizeOfInitializedData0x44000
SizeOfUninitializedData0
AddressOfEntryPoint0x7ad74
BaseOfCode0x1000
ImageBase0x7ff760c0000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.1
ImageVersion6.1
SubsystemVersion6.1
Reserved10
SizeOfImage0xc9000
SizeOfHeaders0x400
CheckSum0xce0b6
Subsystem2
DllCharacteristics0x140
SizeOfStackReserve0x40000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Sections

namevavsizeraw sizeflags
.text0x10000x81ffb0x82000R-X CODE
.data0x830000x2a100x200RW- IDATA
.pdata0x860000x45c00x4600R-- IDATA
Shared0x8b0000x29d800x29e00R-- IDATA
.rsrc0xb50000x11a180x11c00R-- IDATA
.reloc0xc70000x12780x1400R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT0x82ac00x53b
IMPORT0x81e200x64
RESOURCE0xb50000x11a18
EXCEPTION0x860000x45c0
SECURITY00
BASERELOC0xc70000xac8
DEBUG0x14200x1c
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT0x2d80x70
IAT0x10000x3f8
Delay_IAT0x81cbc0x40
CLR_Header00
typenamesizecp
SIAMDBSIAMMAIN699240
SIAMDBSIAMSPL10580
VERSION#19680
module_namehintordfunction_name
msvcrt.dll1267wcscpy_s
msvcrt.dll83__C_specific_handler
msvcrt.dll160_amsg_exit
msvcrt.dll1082free
msvcrt.dll364_initterm
msvcrt.dll1140malloc
msvcrt.dll82_XcptFilter
msvcrt.dll1154memmove
msvcrt.dll850_vsnprintf
msvcrt.dll1191sprintf_s
msvcrt.dll1151memcmp
msvcrt.dll1152memcpy
msvcrt.dll1156memset
KERNEL32.dll729HeapFree
KERNEL32.dll1242TlsGetValue
KERNEL32.dll734HeapSize
KERNEL32.dll1243TlsSetValue
KERNEL32.dll338FindResourceA
KERNEL32.dll837LoadResource
KERNEL32.dll855LockResource
KERNEL32.dll728HeapDestroy
KERNEL32.dll833LoadLibraryExA
KERNEL32.dll208DelayLoadFailureHook
KERNEL32.dll1220Sleep
KERNEL32.dll938QueryPerformanceCounter
KERNEL32.dll666GetTickCount
KERNEL32.dll460GetCurrentThreadId
KERNEL32.dll456GetCurrentProcessId
KERNEL32.dll640GetSystemTimeAsFileTime
KERNEL32.dll1235TerminateProcess
KERNEL32.dll455GetCurrentProcess
KERNEL32.dll1256UnhandledExceptionFilter
KERNEL32.dll1206SetUnhandledExceptionFilter
KERNEL32.dll727HeapCreate
KERNEL32.dll1057RtlLookupFunctionEntry
KERNEL32.dll1050RtlCaptureContext
KERNEL32.dll725HeapAlloc
KERNEL32.dll676GetUserDefaultLCID
KERNEL32.dll227DisableThreadLibraryCalls
KERNEL32.dll1241TlsFree
KERNEL32.dll211DeleteCriticalSection
KERNEL32.dll292ExpandEnvironmentStringsW
KERNEL32.dll684GetVersionExA
KERNEL32.dll749InitializeCriticalSection
KERNEL32.dll1240TlsAlloc
KERNEL32.dll832LoadLibraryA
KERNEL32.dll83CloseHandle
KERNEL32.dll964ReadFile
KERNEL32.dll137CreateFileA
KERNEL32.dll1373lstrcmpiA
KERNEL32.dll611GetProfileStringA
KERNEL32.dll607GetProfileIntA
KERNEL32.dll1383lstrlenW
KERNEL32.dll1318WideCharToMultiByte
KERNEL32.dll874MultiByteToWideChar
KERNEL32.dll873MulDiv
KERNEL32.dll519GetLastError
KERNEL32.dll587GetProcAddress
KERNEL32.dll367GetACP
KERNEL32.dll523GetLocaleInfoW
KERNEL32.dll784IsValidLocale
KERNEL32.dll106ConvertDefaultLocale
KERNEL32.dll829LeaveCriticalSection
KERNEL32.dll243EnterCriticalSection
KERNEL32.dll857MapViewOfFile
KERNEL32.dll1255UnmapViewOfFile
KERNEL32.dll144CreateFileW
KERNEL32.dll502GetFileSizeEx
KERNEL32.dll138CreateFileMappingA
KERNEL32.dll839LocalAlloc
KERNEL32.dll361FreeLibrary
KERNEL32.dll1064RtlVirtualUnwind
KERNEL32.dll843LocalFree
USER32.dll60CharUpperW
USER32.dll384GetSystemMetrics
USER32.dll617ReleaseDC
USER32.dll291GetDC
USER32.dll381GetSysColor
USER32.dll692SetRect
GDI32.dll508GetObjectType
GDI32.dll312ExtTextOutW
GDI32.dll550GetTextMetricsW
GDI32.dll60CreateFontA
GDI32.dll64CreateFontIndirectW
GDI32.dll698TranslateCharsetInfo
GDI32.dll440GetCharWidthA
GDI32.dll509GetObjectW
GDI32.dll84CreateSolidBrush
GDI32.dll237Ellipse
GDI32.dll539GetTextExtentExPointW
GDI32.dll311ExtTextOutA
GDI32.dll566LineTo
GDI32.dll75CreatePen
GDI32.dll164DPtoLP
GDI32.dll483GetGlyphOutlineA
GDI32.dll534GetTextCharset
GDI32.dll546GetTextFaceA
GDI32.dll459GetDeviceCaps
GDI32.dll548GetTextFaceW
GDI32.dll511GetOutlineTextMetricsW
GDI32.dll549GetTextMetricsA
GDI32.dll631SelectObject
GDI32.dll61CreateFontIndirectA
GDI32.dll507GetObjectA
GDI32.dll452GetCurrentObject
GDI32.dll552GetViewportExtEx
GDI32.dll555GetWindowExtEx
GDI32.dll473GetFontData
GDI32.dll676SetTextAlign
GDI32.dll678SetTextColor
GDI32.dll638SetBkColor
GDI32.dll453GetCurrentPositionEx
GDI32.dll532GetTextAlign
GDI32.dll230DeleteObject
GDI32.dll639SetBkMode
GDI32.dll570MoveToEx
GDI32.dll48CreateCompatibleDC
GDI32.dll486GetGraphicsMode
GDI32.dll653SetGraphicsMode
GDI32.dll227DeleteDC
GDI32.dll536GetTextColor
GDI32.dll525GetStockObject
GDI32.dll426GetBkMode

StringTable 040904B0

CompanyNameMicrosoft Corporation
FileDescriptionUniscribe Unicode script processor
FileVersion1.0626.7601.18454 (win7sp1_gdr.140424-1533)
InternalNameUniscribe
LegalCopyright© Microsoft Corporation. All rights reserved.
OriginalFilenameUniscribe
ProductNameMicrosoft(R) Uniscribe Unicode script processor
ProductVersion1.0626.7601.18454

VS_FIXEDFILEINFO

FileVersion1.626.7601.18454
ProductVersion1.626.7601.18454
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType2
FileSubtype0
offsetsizetypecomment
15c115HTM#
15d0795696BINoverlay data past EOF#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] can't find file_offset of VA 0x2d8