output

info
MZ
PE
imports
exports
foremost
hexdump
disasm
log
discuss
donate

filename	output
size	377856 (0x5c400)
md5	1dffc82f44fd94a24d9fb260f4a3c886

type	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x80

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	9
TimeDateStamp	0x391e390a
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x230e
Magic	0x10b
LinkerVersion	2.24
SizeOfCode	0x48200
SizeOfInitializedData	0x5c000
SizeOfUninitializedData	0x400
AddressOfEntryPoint	0x1420
BaseOfCode	0x1000
BaseOfData	0x4a000
ImageBase	0x6c300000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	4.0
ImageVersion	1.0
SubsystemVersion	4.0
Reserved1	0
SizeOfImage	0x63000
SizeOfHeaders	0x400
CheckSum	0x5efa1
Subsystem	3
DllCharacteristics	0
SizeOfStackReserve	0x200000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x48034	0x48200	R-X CODE IDATA
.data	0x4a000	0x11cb4	0x11e00	RW- IDATA
.bss	0x5c000	0x3c8	0	RW- UDATA
.edata	0x5d000	0xe1	0x200	R-- IDATA
.idata	0x5e000	0x6d0	0x800	RW- IDATA
.CRT	0x5f000	0x2c	0x200	RW- IDATA
.tls	0x60000	0x20	0x200	RW- IDATA
.reloc	0x61000	0x100c	0x1200	R-- IDATA DISCARDABLE
.crash	0x14000000	0	0x10000	---

Data Directory

type	va	size
EXPORT	0x5d000	0xe1
IMPORT	0x5e000	0x6d0
RESOURCE	0	0
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0x61000	0x100c
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0x60004	0x18
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0x5e148	0x10c
Delay_IAT	0	0
CLR_Header	0	0

TLS

raw start	raw end	index	callbks	zero fill	flags
0x6c360000	0x6c36001c	0x6c35c010	0x6c35f018	0	0

module_name	hint	function_name
KERNEL32.dll	212	DeleteCriticalSection
KERNEL32.dll	239	EnterCriticalSection
KERNEL32.dll	452	GetCurrentProcess
KERNEL32.dll	453	GetCurrentProcessId
KERNEL32.dll	457	GetCurrentThreadId
KERNEL32.dll	515	GetLastError
KERNEL32.dll	533	GetModuleHandleA
KERNEL32.dll	581	GetProcAddress
KERNEL32.dll	635	GetSystemTimeAsFileTime
KERNEL32.dll	663	GetTickCount
KERNEL32.dll	747	InitializeCriticalSection
KERNEL32.dll	806	LeaveCriticalSection
KERNEL32.dll	915	QueryPerformanceCounter
KERNEL32.dll	1127	SetUnhandledExceptionFilter
KERNEL32.dll	1140	Sleep
KERNEL32.dll	1154	TerminateProcess
KERNEL32.dll	1161	TlsGetValue
KERNEL32.dll	1174	UnhandledExceptionFilter
KERNEL32.dll	1206	VirtualProtect
KERNEL32.dll	1209	VirtualQuery
msvcrt.dll	55	__dllonexit
msvcrt.dll	107	__setusermatherr
msvcrt.dll	142	_amsg_exit
msvcrt.dll	208	_errno
msvcrt.dll	304	_initterm
msvcrt.dll	308	_iob
msvcrt.dll	405	_lock
msvcrt.dll	562	_onexit
msvcrt.dll	752	_unlock
msvcrt.dll	846	calloc
msvcrt.dll	859	fclose
msvcrt.dll	860	feof
msvcrt.dll	862	fflush
msvcrt.dll	865	fgets
msvcrt.dll	870	fopen
msvcrt.dll	872	fprintf
msvcrt.dll	878	fread
msvcrt.dll	879	free
msvcrt.dll	885	fseek
msvcrt.dll	887	ftell
msvcrt.dll	890	fwrite
msvcrt.dll	894	getchar
msvcrt.dll	934	malloc
msvcrt.dll	941	memcmp
msvcrt.dll	942	memcpy
msvcrt.dll	943	memmove
msvcrt.dll	945	memset
msvcrt.dll	980	strchr
msvcrt.dll	981	strcmp
msvcrt.dll	983	strcpy
msvcrt.dll	989	strlen
msvcrt.dll	992	strncmp
msvcrt.dll	993	strncpy
msvcrt.dll	998	strstr
msvcrt.dll	1088	abort
msvcrt.dll	1090	acos
msvcrt.dll	1093	atan
msvcrt.dll	1094	atan2
msvcrt.dll	1096	atof
msvcrt.dll	1097	atoi
msvcrt.dll	1098	atol
msvcrt.dll	1105	tan
msvcrt.dll	1118	vfprintf
msvcrt.dll	1122	vprintf
msvcrt.dll	1124	vsprintf

ord	entry_va	function_name
1	0x458f0	aacEncClose
2	0x459c0	aacEncEncode
3	0x461b0	aacEncGetLibInfo
4	0x46260	aacEncInfo
5	0x464c0	aacEncOpen
6	0x467f0	aacEncoder_GetParam
7	0x46a30	aacEncoder_SetParam

module_name	libfdk.dll
flags	0
timestamp	0
version	0.0
ordinal_base	1
nFunctions	7
nNames	7
Names(7)	0x5d044
Functions(7)	0x5d028
NameOrdinals(7)	0x5d060

show previews

offset	size	type	comment
15c1	15	HTM		#
15d0	372272	BIN	overlay data past EOF	#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] can't find file_offset of VA 0x5c010