Gw.xll

info
MZ
PE
imports
exports
foremost
hexdump
disasm
log
discuss
donate

filename	Gw.xll
size	12288 (0x3000)
md5	08f0383f114bf70b816277bbb5e6f388

type	PE32+ executable (DLL) (GUI) x86-64 (stripped to external PDB), for MS Windows
mimetype	application/x-dosexec

clamav	scan pending
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x80

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x8664
NumberOfSections	0xb
TimeDateStamp	0x65129953
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xf0
Characteristics	0x222e
Magic	0x20b
LinkerVersion	2.36
SizeOfCode	0x1600
SizeOfInitializedData	0x2c00
SizeOfUninitializedData	0x200
AddressOfEntryPoint	0x1350
BaseOfCode	0x1000
ImageBase	0x3682e0000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	4.0
ImageVersion	0.0
SubsystemVersion	5.2
Reserved1	0
SizeOfImage	0xd000
SizeOfHeaders	0x400
CheckSum	0xfe60
Subsystem	2
DllCharacteristics	0x160
SizeOfStackReserve	0x200000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x1468	0x1600	R-X CODE IDATA
.data	0x3000	0x40	0x200	RW- IDATA
.rdata	0x4000	0x2b0	0x400	R-- IDATA
.pdata	0x5000	0x1d4	0x200	R-- IDATA
.xdata	0x6000	0x138	0x200	R-- IDATA
.bss	0x7000	0xe0	0	RW- UDATA
.edata	0x8000	0x6b	0x200	R-- IDATA
.idata	0x9000	0x3d4	0x400	RW- IDATA
.CRT	0xa000	0x58	0x200	RW- IDATA
.tls	0xb000	0x10	0x200	RW- IDATA
.reloc	0xc000	0x58	0x200	R-- IDATA DISCARDABLE

Data Directory

type	va	size
EXPORT	0x8000	0x6b
IMPORT	0x9000	0x3d4
RESOURCE	0	0
EXCEPTION	0x5000	0x1d4
SECURITY	0	0
BASERELOC	0xc000	0x58
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0x4080	0x28
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0x9128	0xd8
Delay_IAT	0	0
CLR_Header	0	0

TLS

raw start	raw end	index	callbks	zero fill	flags
0x3682eb000	0x3682eb008	0x3682e704c	0x3682ea030	0	0

module_name	hint	function_name
KERNEL32.dll	283	DeleteCriticalSection
KERNEL32.dll	319	EnterCriticalSection
KERNEL32.dll	630	GetLastError
KERNEL32.dll	892	InitializeCriticalSection
KERNEL32.dll	984	LeaveCriticalSection
KERNEL32.dll	1410	Sleep
KERNEL32.dll	1445	TlsGetValue
KERNEL32.dll	1492	VirtualProtect
KERNEL32.dll	1494	VirtualQuery
KERNEL32.dll	1548	WinExec
msvcrt.dll	84	__iob_func
msvcrt.dll	124	_amsg_exit
msvcrt.dll	331	_initterm
msvcrt.dll	443	_lock
msvcrt.dll	819	_unlock
msvcrt.dll	1038	abort
msvcrt.dll	1055	calloc
msvcrt.dll	1095	free
msvcrt.dll	1109	fwrite
msvcrt.dll	1185	realloc
msvcrt.dll	1219	strlen
msvcrt.dll	1222	strncmp
msvcrt.dll	1258	vfprintf
USER32.dll	613	MessageBoxA

ord	entry_va	function_name
1	0x3000	hash
2	0x13a0	reverseString
3	0x13f0	xlAutoOpen

module_name	57.xll
flags	0
timestamp	2023-09-26 08:41:55
version	0.0
ordinal_base	1
nFunctions	3
nNames	3
Names(3)	0x8034
Functions(3)	0x8028
NameOrdinals(3)	0x8040

show previews

offset	size	type	comment
15c1	15	HTM		#
15d0	6704	BIN	overlay data past EOF	#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] can't find file_offset of VA 0x704c