filenamepsbase.dll
size50688 (0xc600)
md5274992d0945889a6b56d0e1bd4288a6e
typePE32 executable (DLL) (console) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xe0

Rich Header

lib idversiontimes used
149307293
1085
1473072911
146307291
132307299
1313072920
148307291
145307291

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections4
TimeDateStamp0x4a5bdacf
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x2102
Magic0x10b
LinkerVersion9.0
SizeOfCode0xae00
SizeOfInitializedData0x1400
SizeOfUninitializedData0
AddressOfEntryPoint0x12bc
BaseOfCode0x1000
BaseOfData0xc000
ImageBase0x40980000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.1
ImageVersion6.1
SubsystemVersion6.1
Reserved10
SizeOfImage0xf000
SizeOfHeaders0x400
CheckSum0x105cc
Subsystem3
DllCharacteristics0x140
SizeOfStackReserve0x40000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v7.0 DLL

Sections

namevavsizeraw sizeflags
.text0x10000xac870xae00R-X CODE
.data0xc0000x4280x600RW- IDATA
.rsrc0xd0000x5280x600R-- IDATA
.reloc0xe0000x6280x800R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT0x16bc0x239
IMPORT0xb5fc0x78
RESOURCE0xd0000x528
EXCEPTION00
SECURITY00
BASERELOC0xe0000x628
DEBUG0xbc280x38
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x61500x40
Bound_IAT0x2780xd4
IAT0x10000xf8
Delay_IAT0xb4c80x80
CLR_Header00
typenamesizecp
MUI#12000
VERSION#19400
module_namehintordfunction_name
msvcrt.dll1260memmove
msvcrt.dll1007_wcsicmp
msvcrt.dll1262memset
msvcrt.dll106_XcptFilter
msvcrt.dll1246malloc
msvcrt.dll1190free
msvcrt.dll469_initterm
msvcrt.dll257_amsg_exit
msvcrt.dll1258memcpy
msvcrt.dll345_except_handler4_common
API-MS-Win-Core-LocalRegistry-L1-1-0.dll4RegDeleteKeyExW
API-MS-Win-Core-LocalRegistry-L1-1-0.dll11RegEnumKeyExW
API-MS-Win-Core-LocalRegistry-L1-1-0.dll2RegCreateKeyExW
API-MS-Win-Core-LocalRegistry-L1-1-0.dll25RegOpenKeyExW
API-MS-Win-Core-LocalRegistry-L1-1-0.dll30RegQueryValueExW
API-MS-Win-Core-LocalRegistry-L1-1-0.dllRegCloseKey
API-MS-Win-Core-LocalRegistry-L1-1-0.dll24RegOpenKeyExA
API-MS-Win-Core-LocalRegistry-L1-1-0.dll35RegSetKeySecurity
API-MS-Win-Core-LocalRegistry-L1-1-0.dll10RegEnumKeyExA
API-MS-Win-Core-LocalRegistry-L1-1-0.dll3RegDeleteKeyExA
API-MS-Win-Core-LocalRegistry-L1-1-0.dll37RegSetValueExW
API-MS-Win-Core-ProcessThreads-L1-1-0.dll11GetCurrentProcessId
API-MS-Win-Core-ProcessThreads-L1-1-0.dll42TerminateProcess
API-MS-Win-Core-ProcessThreads-L1-1-0.dll10GetCurrentProcess
API-MS-Win-Core-ProcessThreads-L1-1-0.dll13GetCurrentThreadId
API-MS-Win-Security-Base-L1-1-0.dll45GetLengthSid
API-MS-Win-Security-Base-L1-1-0.dll40FreeSid
API-MS-Win-Security-Base-L1-1-0.dll64InitializeSecurityDescriptor
API-MS-Win-Security-Base-L1-1-0.dll41GetAce
API-MS-Win-Security-Base-L1-1-0.dll7AddAccessAllowedAce
API-MS-Win-Security-Base-L1-1-0.dll63InitializeAcl
API-MS-Win-Security-Base-L1-1-0.dll20AllocateAndInitializeSid
API-MS-Win-Security-Base-L1-1-0.dll91SetSecurityDescriptorDacl
KERNEL32.dll1136SetLastError
KERNEL32.dll208DeleteCriticalSection
KERNEL32.dll237EnterCriticalSection
KERNEL32.dll824LeaveCriticalSection
KERNEL32.dll737InitializeCriticalSection
KERNEL32.dll1185SetUnhandledExceptionFilter
KERNEL32.dll1231UnhandledExceptionFilter
KERNEL32.dll632GetSystemTimeAsFileTime
KERNEL32.dll658GetTickCount
KERNEL32.dll932QueryPerformanceCounter
KERNEL32.dll1198Sleep
KERNEL32.dll747InterlockedExchange
KERNEL32.dll828LoadLibraryExA
KERNEL32.dll839LocalFree
KERNEL32.dll835LocalAlloc
KERNEL32.dll221DisableThreadLibraryCalls
KERNEL32.dll842LocalReAlloc
KERNEL32.dll1354lstrlenW
KERNEL32.dll903OutputDebugStringW
KERNEL32.dll205DelayLoadFailureHook
KERNEL32.dll580GetProcAddress
KERNEL32.dll513GetLastError
KERNEL32.dll353FreeLibrary
KERNEL32.dll744InterlockedCompareExchange
ordentry_vafunction_name
10x8777FPasswordChangeNotify
20x6b61SPCloseItem
30x687bSPOpenItem
40x191dSPAcquireContext
50x6517SPCreateSubtype
60x649eSPCreateType
70x65c6SPDeleteItem
80x6524SPDeleteSubtype
90x64abSPDeleteType
100x6429SPEnumItems
110x6315SPEnumSubtypes
120x61fbSPEnumTypes
130x212eSPGetProvInfo
140x61a1SPGetProvParam
150x6387SPGetSubtypeInfo
160x626aSPGetTypeInfo
170x20c2SPProviderInitialize
180x1d20SPReadItem
190x1965SPReleaseContext
200x61c8SPSetProvParam
210x6593SPWriteItem
module_namePSBASE.dll
flags0
timestamp2009-07-13 23:32:54
version0.0
ordinal_base1
nFunctions21
nNames21
Names(21)0x1738
Functions(21)0x16e4
NameOrdinals(21)0x178c

StringTable 040904B0

CompanyNameMicrosoft Corporation
FileDescriptionProtected Storage default provider
FileVersion6.1.7600.16385 (win7_rtm.090713-1255)
InternalNamepsbase.dll
LegalCopyright© Microsoft Corporation. All rights reserved.
OriginalFilenamepsbase.dll
ProductNameMicrosoft® Windows® Operating System
ProductVersion6.1.7600.16385

VS_FIXEDFILEINFO

FileVersion6.1.7600.16385
ProductVersion6.1.7600.16385
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType2
FileSubtype0
offsetsizetypecomment
050688DLL07/14/2009 01:09:35#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] can't find file_offset of VA 0x278