filenameuplay_r1_loader.dll
size398336 (0x61400)
md51e2fc6e3289022a2b2e4ccdab779ef69
typePE32 executable (DLL) (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x118

Rich Header

lib idversiontimes used
2414011611
24340116141
2424011627
2592340622
2612340649
2602340663
147307297
10116
109507279
264235064
2612350621
256235061
258235061

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections6
TimeDateStamp0x56f42508
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x2102
Magic0x10b
LinkerVersion14.0
SizeOfCode0x43800
SizeOfInitializedData0x1ea00
SizeOfUninitializedData0
AddressOfEntryPoint0x2a912
BaseOfCode0x1000
BaseOfData0x45000
ImageBase0x10000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.0
ImageVersion0.0
SubsystemVersion6.0
Reserved10
SizeOfImage0x67000
SizeOfHeaders0x400
CheckSum0
Subsystem2
DllCharacteristics0x140
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ 6.0 - 8.0

Sections

namevavsizeraw sizeflags
.text0x10000x436410x43800R-X CODE
.rdata0x450000x105860x10600R-- IDATA
.data0x560000x9a0c0x8a00RW- IDATA
.gfids0x600000x1800x200R-- IDATA
.tls0x6100090x200RW- IDATA
.reloc0x620000x43000x4400R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT0x53cb00xf6d
IMPORT0x54c200x50
RESOURCE00
EXCEPTION00
SECURITY00
BASERELOC0x620000x4300
DEBUG0x506e00x38
ARCHITECTURE00
GLOBALPTR00
TLS0x507740x18
LOAD_CONFIG0x507180x40
Bound_IAT00
IAT0x450000x1a0
Delay_IAT00
CLR_Header00

TLS

raw
start		raw
end		indexcallbkszero
fill		flags
0x100610000x100610080x1005f0340x1004520800x300000
module_namehintordfunction_name
KERNEL32.dll536GetModuleHandleW
KERNEL32.dll1257VirtualAlloc
KERNEL32.dll1260VirtualFree
KERNEL32.dll738InitializeCriticalSection
KERNEL32.dll238EnterCriticalSection
KERNEL32.dll825LeaveCriticalSection
KERNEL32.dll1317WriteFile
KERNEL32.dll960ReadFile
KERNEL32.dll1126SetFilePointer
KERNEL32.dll82CloseHandle
KERNEL32.dll129CreateDirectoryW
KERNEL32.dll143CreateFileW
KERNEL32.dll490GetFileAttributesW
KERNEL32.dll214DeleteFileW
KERNEL32.dll313FindFirstFileW
KERNEL32.dll325FindNextFileW
KERNEL32.dll1297WideCharToMultiByte
KERNEL32.dll759IsBadReadPtr
KERNEL32.dll748InterlockedExchange
KERNEL32.dll717HeapCreate
KERNEL32.dll581GetProcAddress
KERNEL32.dll719HeapFree
KERNEL32.dll448GetCurrentProcess
KERNEL32.dll745InterlockedCompareExchange
KERNEL32.dll1220Thread32Next
KERNEL32.dll1219Thread32First
KERNEL32.dll453GetCurrentThreadId
KERNEL32.dll1210SuspendThread
KERNEL32.dll1043ResumeThread
KERNEL32.dll190CreateToolhelp32Snapshot
KERNEL32.dll1202Sleep
KERNEL32.dll722HeapReAlloc
KERNEL32.dll715HeapAlloc
KERNEL32.dll646GetThreadContext
KERNEL32.dll449GetCurrentProcessId
KERNEL32.dll344FlushInstructionCache
KERNEL32.dll1169SetThreadContext
KERNEL32.dll901OpenThread
KERNEL32.dll1265VirtualQuery
KERNEL32.dll1263VirtualProtect
KERNEL32.dll871MultiByteToWideChar
KERNEL32.dll617GetStringTypeW
KERNEL32.dll209DeleteCriticalSection
KERNEL32.dll234EncodePointer
KERNEL32.dll202DecodePointer
KERNEL32.dll1139SetLastError
KERNEL32.dll739InitializeCriticalSectionAndSpinCount
KERNEL32.dll133CreateEventW
KERNEL32.dll1221TlsAlloc
KERNEL32.dll1223TlsGetValue
KERNEL32.dll1224TlsSetValue
KERNEL32.dll1222TlsFree
KERNEL32.dll633GetSystemTimeAsFileTime
KERNEL32.dll813LCMapStringW
KERNEL32.dll518GetLocaleInfoW
KERNEL32.dll370GetCPInfo
KERNEL32.dll1113SetEvent
KERNEL32.dll1039ResetEvent
KERNEL32.dll1274WaitForSingleObjectEx
KERNEL32.dll772IsProcessorFeaturePresent
KERNEL32.dll768IsDebuggerPresent
KERNEL32.dll1235UnhandledExceptionFilter
KERNEL32.dll1189SetUnhandledExceptionFilter
KERNEL32.dll611GetStartupInfoW
KERNEL32.dll1216TerminateProcess
KERNEL32.dll935QueryPerformanceCounter
KERNEL32.dll743InitializeSListHead
KERNEL32.dll945RaiseException
KERNEL32.dll1048RtlUnwind
KERNEL32.dll514GetLastError
KERNEL32.dll354FreeLibrary
KERNEL32.dll830LoadLibraryExW
KERNEL32.dll532GetModuleFileNameW
KERNEL32.dll750InterlockedFlushSList
KERNEL32.dll281ExitProcess
KERNEL32.dll535GetModuleHandleExW
KERNEL32.dll360GetACP
KERNEL32.dll428GetConsoleMode
KERNEL32.dll958ReadConsoleW
KERNEL32.dll1127SetFilePointerEx
KERNEL32.dll612GetStdHandle
KERNEL32.dll499GetFileType
KERNEL32.dll780IsValidLocale
KERNEL32.dll667GetUserDefaultLCID
KERNEL32.dll271EnumSystemLocalesW
KERNEL32.dll586GetProcessHeap
KERNEL32.dll778IsValidCodePage
KERNEL32.dll567GetOEMCP
KERNEL32.dll474GetEnvironmentStringsW
KERNEL32.dll353FreeEnvironmentStringsW
KERNEL32.dll390GetCommandLineA
KERNEL32.dll391GetCommandLineW
KERNEL32.dll1159SetStdHandle
KERNEL32.dll343FlushFileBuffers
KERNEL32.dll410GetConsoleCP
KERNEL32.dll724HeapSize
KERNEL32.dll1107SetEndOfFile
KERNEL32.dll1316WriteConsoleW
KERNEL32.dll447GetCurrentDirectoryW
SHELL32.dll225SHGetSpecialFolderPathW
ADVAPI32.dll753SystemFunction036
ordentry_vafunction_name
10x1c7f0CODEX
20x10c90UPLAY_ACH_EarnAchievement
30x10b50UPLAY_ACH_GetAchievementImage
40x10b70UPLAY_ACH_GetAchievements
50x10c70UPLAY_ACH_ReleaseAchievementImage
60x10c70UPLAY_ACH_ReleaseAchievementList
70x10b90UPLAY_ACH_Write
80x10bb0UPLAY_AVATAR_Get
90x10bd0UPLAY_AVATAR_GetAvatarIdForCurrentUser
100x10bf0UPLAY_AVATAR_GetBitmap
110x10c70UPLAY_AVATAR_Release
120x10c10UPLAY_CHAT_GetHistory
130x10c30UPLAY_CHAT_Init
140x10c70UPLAY_CHAT_ReleaseHistoryList
150x10c50UPLAY_CHAT_SendMessage
160x10c70UPLAY_CHAT_SetMessagesRead
170x11090UPLAY_ClearGameSession
180x10c90UPLAY_FRIENDS_AddToBlackList
190x10e80UPLAY_FRIENDS_DisableFriendMenuItem
200x10cb0UPLAY_FRIENDS_EnableFriendMenuItem
210x10db0UPLAY_FRIENDS_GetFriendList
220x10cd0UPLAY_FRIENDS_Init
230x10cf0UPLAY_FRIENDS_InviteToGame
240x10ec0UPLAY_FRIENDS_IsBlackListed
250x10ec0UPLAY_FRIENDS_IsFriend
260x10c90UPLAY_FRIENDS_RequestFriendship
270x10d10UPLAY_FRIENDS_ShowFriendSelectionUI
280x10d30UPLAY_FRIENDS_ShowInviteFriendsToGameUI
290x10e80UPLAY_GetLastError
300x10ec0UPLAY_GetNextEvent
310x10d50UPLAY_GetOverlappedOperationResult
320x10d70UPLAY_HasOverlappedOperationCompleted
330x10d90UPLAY_INSTALLER_AreChunksInstalled
340x10db0UPLAY_INSTALLER_GetChunkIdsFromTag
350x10f00UPLAY_INSTALLER_GetChunks
360x10dd0UPLAY_INSTALLER_GetLanguageUtf8
370x10e80UPLAY_INSTALLER_Init
380x10e80UPLAY_INSTALLER_ReleaseChunkIdList
390x10d30UPLAY_INSTALLER_UpdateInstallOrder
400x10de0UPLAY_Init
410x10e80UPLAY_METADATA_ClearContinuousTag
420x10db0UPLAY_METADATA_SetContinuousTag
430x10db0UPLAY_METADATA_SetSingleEventTag
440x10df0UPLAY_OVERLAY_SetShopUrl
450x10e10UPLAY_OVERLAY_Show
460x10e30UPLAY_OVERLAY_ShowFacebookAuthentication
470x10f00UPLAY_OVERLAY_ShowNotification
480x10f00UPLAY_OVERLAY_ShowShopUrl
490x10e80UPLAY_PARTY_DisablePartyMemberMenuItem
500x10cb0UPLAY_PARTY_EnablePartyMemberMenuItem
510x10e60UPLAY_PARTY_GetFullMemberList
520x10e50UPLAY_PARTY_GetId
530x10e60UPLAY_PARTY_GetInGameMemberList
540x10cd0UPLAY_PARTY_Init
550x10e80UPLAY_PARTY_InvitePartyToGame
560x10ea0UPLAY_PARTY_InviteToParty
570x10ec0UPLAY_PARTY_IsInParty
580x10ec0UPLAY_PARTY_IsPartyLeader
590x10db0UPLAY_PARTY_PromoteToLeader
600x10ee0UPLAY_PARTY_RespondToGameInvite
610x10db0UPLAY_PARTY_SetGuest
620x10e80UPLAY_PARTY_SetUserData
630x10e80UPLAY_PARTY_ShowGameInviteOverlayUI
640x10f00UPLAY_PeekNextEvent
650x111f0UPLAY_Quit
660x10cd0UPLAY_Release
670x10f20UPLAY_SAVE_Close
680x10f40UPLAY_SAVE_GetSavegames
690x10f60UPLAY_SAVE_Open
700x10f80UPLAY_SAVE_Read
710x10fb0UPLAY_SAVE_ReleaseGameList
720x10fd0UPLAY_SAVE_Remove
730x10ff0UPLAY_SAVE_SetName
740x11010UPLAY_SAVE_Write
750x11030UPLAY_SetGameSession
760x10c70UPLAY_SetLanguage
770x11050UPLAY_Start
780x11070UPLAY_Startup
790x11090UPLAY_USER_ClearGameSession
800x110a0UPLAY_USER_ConsumeItem
810x110d0UPLAY_USER_GetAccountId
820x110f0UPLAY_USER_GetAccountIdUtf8
830x11100UPLAY_USER_GetCdKeyUtf8
840x11120UPLAY_USER_GetCdKeys
850x10f00UPLAY_USER_GetConsumableItems
860x11140UPLAY_USER_GetCredentials
870x10e60UPLAY_USER_GetEmail
880x11160UPLAY_USER_GetEmailUtf8
890x11190UPLAY_USER_GetNameUtf8
900x10e60UPLAY_USER_GetPassword
910x11170UPLAY_USER_GetPasswordUtf8
920x11180UPLAY_USER_GetTicketUtf8
930x10e60UPLAY_USER_GetUsername
940x11190UPLAY_USER_GetUsernameUtf8
950x111f0UPLAY_USER_IsConnected
960x111a0UPLAY_USER_IsInOfflineMode
970x111b0UPLAY_USER_IsOwned
980x10c70UPLAY_USER_ReleaseCdKeyList
990x10c70UPLAY_USER_ReleaseConsumeItemResult
1000x111d0UPLAY_USER_SetGameSession
1010x111f0UPLAY_Update
1020x11200UPLAY_WIN_GetActions
1030x11200UPLAY_WIN_GetRewards
1040x11220UPLAY_WIN_GetUnitBalance
1050x11240UPLAY_WIN_RefreshActions
1060x10c70UPLAY_WIN_ReleaseActionList
1070x10c70UPLAY_WIN_ReleaseRewardList
1080x11250UPLAY_WIN_SetActionsCompleted
1090x1000distorm_decode64
1100x1090distorm_version
module_nameuplay_r1_logger.dll
flags0
timestamp2016-03-24 17:34:00
version0.0
ordinal_base1
nFunctions110
nNames110
Names(110)0x53e90
Functions(110)0x53cd8
NameOrdinals(110)0x54048
offsetsizetypecomment
0398336DLL03/24/2016 17:34:00#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] can't find file_offset of VA 0x5f034