NPS.dll

info
MZ
PE
resources
imports
exports
foremost
hexdump
disasm
log
discuss
donate

filename	NPS.dll
size	124416 (0x1e600)
md5	1dc0178c5f9869afb0b903758ed2abbc

type	PE32 executable (DLL) (console) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0xf0

Rich Header

lib id	version	times used
223	21005	21
224	21005	118
225	21005	47
206	65501	1
203	65501	11
1	0	99
229	31101	1
220	31101	1
219	21005	1
222	31101	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	5
TimeDateStamp	0x552e0e54
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x2102
Magic	0x10b
LinkerVersion	12.0
SizeOfCode	0x14000
SizeOfInitializedData	0xc000
SizeOfUninitializedData	0
AddressOfEntryPoint	0x81f6
BaseOfCode	0x1000
BaseOfData	0x15000
ImageBase	0x10000000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	6.0
ImageVersion	0.0
SubsystemVersion	6.0
Reserved1	0
SizeOfImage	0x24000
SizeOfHeaders	0x400
CheckSum	0
Subsystem	3
DllCharacteristics	0x140
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

MS Visual C++ 6.0 - 8.0

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x13feb	0x14000	R-X CODE
.rdata	0x15000	0x73d6	0x7400	R-- IDATA
.data	0x1d000	0x3340	0x1600	RW- IDATA
.rsrc	0x21000	0x1e0	0x200	R-- IDATA
.reloc	0x22000	0x1560	0x1600	R-- IDATA DISCARDABLE

Data Directory

type	va	size
EXPORT	0x1bbb0	0x5c
IMPORT	0x1bc0c	0x78
RESOURCE	0x21000	0x1e0
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0x22000	0x1560
DEBUG	0x151b0	0x38
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0x1a8f8	0x40
Bound_IAT	0	0
IAT	0x15000	0x164
Delay_IAT	0	0
CLR_Header	0	0

show previews

type	name	size	cp
MANIFEST	#2	381	0

module_name	hint	ord	function_name
KERNEL32.dll	1485		WideCharToMultiByte
KERNEL32.dll	1362		Sleep
KERNEL32.dll	977		MultiByteToWideChar
KERNEL32.dll	592		GetLastError
KERNEL32.dll	194		CreateFileW
KERNEL32.dll	402		FlushFileBuffers
KERNEL32.dll	1018		OutputDebugStringW
KERNEL32.dll	1504		WriteConsoleW
KERNEL32.dll	1314		SetStdHandle
KERNEL32.dll	822		HeapReAlloc
KERNEL32.dll	935		LoadLibraryExW
KERNEL32.dll	918		LCMapStringW
KERNEL32.dll	709		GetStringTypeW
KERNEL32.dll	611		GetModuleFileNameW
KERNEL32.dll	1277		SetFilePointerEx
KERNEL32.dll	494		GetConsoleMode
KERNEL32.dll	476		GetConsoleCP
KERNEL32.dll	1505		WriteFile
KERNEL32.dll	615		GetModuleHandleW
KERNEL32.dll	289		EncodePointer
KERNEL32.dll	254		DecodePointer
KERNEL32.dll	456		GetCommandLineA
KERNEL32.dll	526		GetCurrentThreadId
KERNEL32.dll	1088		RaiseException
KERNEL32.dll	1197		RtlUnwind
KERNEL32.dll	871		IsDebuggerPresent
KERNEL32.dll	877		IsProcessorFeaturePresent
KERNEL32.dll	819		HeapFree
KERNEL32.dll	815		HeapAlloc
KERNEL32.dll	1291		SetLastError
KERNEL32.dll	882		IsValidCodePage
KERNEL32.dll	420		GetACP
KERNEL32.dll	646		GetOEMCP
KERNEL32.dll	435		GetCPInfo
KERNEL32.dll	337		ExitProcess
KERNEL32.dll	614		GetModuleHandleExW
KERNEL32.dll	669		GetProcAddress
KERNEL32.dll	824		HeapSize
KERNEL32.dll	293		EnterCriticalSection
KERNEL32.dll	930		LeaveCriticalSection
KERNEL32.dll	674		GetProcessHeap
KERNEL32.dll	704		GetStdHandle
KERNEL32.dll	574		GetFileType
KERNEL32.dll	261		DeleteCriticalSection
KERNEL32.dll	702		GetStartupInfoW
KERNEL32.dll	610		GetModuleFileNameA
KERNEL32.dll	1069		QueryPerformanceCounter
KERNEL32.dll	522		GetCurrentProcessId
KERNEL32.dll	726		GetSystemTimeAsFileTime
KERNEL32.dll	551		GetEnvironmentStringsW
KERNEL32.dll	413		FreeEnvironmentStringsW
KERNEL32.dll	1410		UnhandledExceptionFilter
KERNEL32.dll	1347		SetUnhandledExceptionFilter
KERNEL32.dll	840		InitializeCriticalSectionAndSpinCount
KERNEL32.dll	521		GetCurrentProcess
KERNEL32.dll	1377		TerminateProcess
KERNEL32.dll	1395		TlsAlloc
KERNEL32.dll	1397		TlsGetValue
KERNEL32.dll	1398		TlsSetValue
KERNEL32.dll	1396		TlsFree
KERNEL32.dll	127		CloseHandle
USER32.dll	293		GetClientRect
USER32.dll	311		GetDesktopWindow
USER32.dll	788		SetWindowTextW
USER32.dll	595		MoveWindow
USER32.dll	459		GetWindowRect
ole32.dll	127		CoUninitialize
ole32.dll	79		CoInitialize
ole32.dll	26		CoCreateInstance
OLEAUT32.dll		2
OLEAUT32.dll		411
OLEAUT32.dll		23
OLEAUT32.dll		8
OLEAUT32.dll		24
OLEAUT32.dll		6
WINHTTP.dll	19		WinHttpOpen
WINHTTP.dll	36		WinHttpQueryDataAvailable
WINHTTP.dll	39		WinHttpReadData
WINHTTP.dll	7		WinHttpCloseHandle
WINHTTP.dll	8		WinHttpConnect
WINHTTP.dll	43		WinHttpSendRequest
WINHTTP.dll	40		WinHttpReceiveResponse
WINHTTP.dll	20		WinHttpOpenRequest
WINHTTP.dll	48		WinHttpSetTimeouts

ord	entry_va	function_name
1	0x40e0	OpenSurveyA
2	0x3f80	OpenSurveyW

module_name	NPS.dll
flags	0
timestamp	2015-04-15 07:08:04
version	0.0
ordinal_base	1
nFunctions	2
nNames	2
Names(2)	0x1bbe0
Functions(2)	0x1bbd8
NameOrdinals(2)	0x1bbe8

show previews

offset	size	type	comment
0	124416	DLL	04/15/2015 07:08:04	#
15c1	15	HTM		#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

everything is OK