filenamedmsynth.dll
size103424 (0x19400)
md5089ffa9f17349f500d35eec8305713e5
typePE32 executable (DLL) (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xf0

Rich Header

lib idversiontimes used
1540356
1057
93403511
9240351
9440351
95403510
96403517
9040351

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections4
TimeDateStamp0x480381c2
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x210e
Magic0x10b
LinkerVersion7.10
SizeOfCode0x13200
SizeOfInitializedData0x7800
SizeOfUninitializedData0
AddressOfEntryPoint0x132bd
BaseOfCode0x1000
BaseOfData0x15000
ImageBase0x6cf30000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion5.1
ImageVersion5.1
SubsystemVersion4.0
Reserved10
SizeOfImage0x1e000
SizeOfHeaders0x400
CheckSum0x26785
Subsystem2
DllCharacteristics0
SizeOfStackReserve0x40000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MSVC++ DLL v.8 (typical OEP recognized - h)

Sections

namevavsizeraw sizeflags
.text0x10000x130540x13200R-X CODE
.data0x150000x65a00x4c00RW- IDATA
.rsrc0x1c0000x4580x600R-- IDATA
.reloc0x1d0000xa920xc00R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT0x13fb00xa4
IMPORT0x13a780x78
RESOURCE0x1c0000x458
EXCEPTION00
SECURITY00
BASERELOC0x1d0000x904
DEBUG0x10f00x1c
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x16500x40
Bound_IAT0x2880x7c
IAT0x10000xe4
Delay_IAT00
CLR_Header00
typenamesizecp
VERSION#110160
module_namehintordfunction_name
msvcrt.dll182_adjust_fdiv
msvcrt.dll315_initterm
msvcrt.dll810wcscpy
msvcrt.dll824wcstombs
msvcrt.dll677free
msvcrt.dll728malloc
msvcrt.dll82__CxxFrameHandler
msvcrt.dll65_CIpow
msvcrt.dll280_ftol
KERNEL32.dll822SetUnhandledExceptionFilter
KERNEL32.dll859UnhandledExceptionFilter
KERNEL32.dll315GetCurrentProcess
KERNEL32.dll536InitializeCriticalSection
KERNEL32.dll127DeleteCriticalSection
KERNEL32.dll579LeaveCriticalSection
KERNEL32.dll150EnterCriticalSection
KERNEL32.dll614MulDiv
KERNEL32.dll551IsBadReadPtr
KERNEL32.dll554IsBadWritePtr
KERNEL32.dll540InterlockedDecrement
KERNEL32.dll544InterlockedIncrement
KERNEL32.dll951lstrlenA
KERNEL32.dll936lstrcatA
KERNEL32.dll945lstrcpyA
KERNEL32.dll137DisableThreadLibraryCalls
KERNEL32.dll548IsBadCodePtr
KERNEL32.dll772SetEvent
KERNEL32.dll894WaitForSingleObject
KERNEL32.dll817SetThreadPriority
KERNEL32.dll108CreateThread
KERNEL32.dll842TerminateProcess
KERNEL32.dll49CloseHandle
KERNEL32.dll834Sleep
KERNEL32.dll372GetModuleFileNameA
KERNEL32.dll660QueryPerformanceCounter
KERNEL32.dll661QueryPerformanceFrequency
KERNEL32.dll468GetTickCount
KERNEL32.dll318GetCurrentThreadId
KERNEL32.dll316GetCurrentProcessId
KERNEL32.dll448GetSystemTimeAsFileTime
KERNEL32.dll75CreateEventA
WINMM.dll163timeGetTime
ADVAPI32.dll494RegQueryValueExA
ADVAPI32.dll484RegOpenKeyExA
ADVAPI32.dll471RegEnumKeyA
ADVAPI32.dll465RegDeleteKeyA
ADVAPI32.dll462RegCreateKeyExA
ADVAPI32.dll461RegCreateKeyA
ADVAPI32.dll507RegSetValueExA
ADVAPI32.dll458RegCloseKey
ole32.dll322StringFromCLSID
ole32.dll100CoTaskMemFree
ordentry_vafunction_name
10xcdd0DllCanUnloadNow
20xd270DllGetClassObject
30xcf10DllRegisterServer
40xced0DllUnregisterServer
module_namedmsynth.DLL
flags0
timestamp2008-04-13 17:13:10
version0.0
ordinal_base1
nFunctions4
nNames4
Names(4)0x13fe8
Functions(4)0x13fd8
NameOrdinals(4)0x13ff8

StringTable 040904B0

CompanyNameMicrosoft Corporation
FileDescriptionMicrosoft DirectMusic Software Synthesizer
FileVersion5.3.2600.5512 (xpsp.080413-0845)
InternalNameMicrosoft DirectMusic Software Synthesizer
LegalCopyright© Microsoft Corporation. All rights reserved.
OriginalFilenamedmsynth.dll
ProductNameMicrosoft(R) Windows(R) Operating System
ProductVersion5.3.2600.5512

VS_FIXEDFILEINFO

FileVersion5.3.2600.5512
ProductVersion5.3.2600.5512
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType2
FileSubtype0
offsetsizetypecomment
0103424DLL04/14/2008 16:09:38#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] can't find file_offset of VA 0x288