dllinjector (UnknownCheats Rembrandt).exe

info
MZ
PE
resources
imports
foremost
hexdump
disasm
log
discuss
donate

filename	dllinjector (UnknownCheats Rembrandt).exe
size	226816 (0x37600)
md5	27b277c2e5d2117b3de03e2a66f81c4c

type	PE32+ executable (console) x86-64, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0xf8

Rich Header

lib id	version	times used
147	30729	12
260	28920	10
259	28920	4
261	28920	25
257	28920	6
257	27412	9
1	0	155
265	29110	4
255	29110	1
258	29110	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x8664
NumberOfSections	6
TimeDateStamp	0x5f313f2a
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xf0
Characteristics	0x22
Magic	0x20b
LinkerVersion	14.27
SizeOfCode	0x32c00
SizeOfInitializedData	0x4e00
SizeOfUninitializedData	0
AddressOfEntryPoint	0x32ca4
BaseOfCode	0x1000
ImageBase	0x140000000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	6.0
ImageVersion	0.0
SubsystemVersion	6.0
Reserved1	0
SizeOfImage	0x3c000
SizeOfHeaders	0x400
CheckSum	0
Subsystem	3
DllCharacteristics	0x8160
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

MASM/TASM - sig1(h)

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x32ae7	0x32c00	R-X CODE
.rdata	0x34000	0x35a6	0x3600	R-- IDATA
.data	0x38000	0xa18	0x400	RW- IDATA
.pdata	0x39000	0x60c	0x800	R-- IDATA
.rsrc	0x3a000	0x1e8	0x200	R-- IDATA
.reloc	0x3b000	0xa4	0x200	R-- IDATA DISCARDABLE

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x35e8c	0x118
RESOURCE	0x3a000	0x1e8
EXCEPTION	0x39000	0x60c
SECURITY	0	0
BASERELOC	0x3b000	0xa4
DEBUG	0x34888	0x70
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0x34900	0x130
Bound_IAT	0	0
IAT	0x34000	0x458
Delay_IAT	0	0
CLR_Header	0	0

show previews

type	name	size	cp
MANIFEST	#1	392	0

module_name	hint	function_name
KERNEL32.dll	878	InitializeSListHead
KERNEL32.dll	754	GetSystemTimeAsFileTime
KERNEL32.dll	1243	RtlLookupFunctionEntry
KERNEL32.dll	544	GetCurrentProcessId
KERNEL32.dll	1105	QueryPerformanceCounter
KERNEL32.dll	640	GetModuleHandleW
KERNEL32.dll	766	GetTempPathA
KERNEL32.dll	695	GetProcAddress
KERNEL32.dll	967	LoadLibraryA
KERNEL32.dll	548	GetCurrentThreadId
KERNEL32.dll	1421	Sleep
KERNEL32.dll	900	IsDebuggerPresent
KERNEL32.dll	1250	RtlVirtualUnwind
KERNEL32.dll	1470	UnhandledExceptionFilter
KERNEL32.dll	1405	SetUnhandledExceptionFilter
KERNEL32.dll	543	GetCurrentProcess
KERNEL32.dll	1436	TerminateProcess
KERNEL32.dll	907	IsProcessorFeaturePresent
KERNEL32.dll	1236	RtlCaptureContext
USER32.dll	504	GetWindowThreadProcessId
USER32.dll	945	UnhookWindowsHookEx
USER32.dll	900	SetWindowsHookExW
USER32.dll	273	FindWindowA
USER32.dll	690	PostThreadMessageW
ADVAPI32.dll	680	RegSetValueExA
ADVAPI32.dll	651	RegOpenKeyExA
ADVAPI32.dll	603	RegCloseKey
ADVAPI32.dll	664	RegQueryValueExA
ole32.dll	42	CoCreateGuid
MSVCP140.dll	654	void __cdecl std::_Xlength_error(char const * __ptr64) ?_Xlength_error@std@@YAXPEBD@Z
MSVCP140.dll	1249	public: __int64 __cdecl std::basic_streambuf<char, struct std::char_traits<char> >::sputn(char const * __ptr64, __int64) __ptr64 ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
MSVCP140.dll	580	public: void __cdecl std::basic_ostream<char, struct std::char_traits<char> >::_Osfx(void) __ptr64 ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
MSVCP140.dll	1240	public: int __cdecl std::basic_streambuf<char, struct std::char_traits<char> >::snextc(void) __ptr64 ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
MSVCP140.dll	1246	public: int __cdecl std::basic_streambuf<char, struct std::char_traits<char> >::sputc(char) __ptr64 ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
MSVCP140.dll	872	public: class std::basic_ostream<char, struct std::char_traits<char> > & __ptr64 __cdecl std::basic_ostream<char, struct std::char_traits<char> >::flush(void) __ptr64 ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
MSVCP140.dll	537	public: bool __cdecl std::basic_istream<char, struct std::char_traits<char> >::_Ipfx(bool) __ptr64 ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
MSVCP140.dll	1231	public: int __cdecl std::basic_streambuf<char, struct std::char_traits<char> >::sgetc(void) __ptr64 ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
MSVCP140.dll	1221	public: void __cdecl std::basic_ios<char, struct std::char_traits<char> >::setstate(int, bool) __ptr64 ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
MSVCP140.dll	886	public: int __cdecl std::basic_istream<char, struct std::char_traits<char> >::get(void) __ptr64 ?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ
MSVCP140.dll	1008	public: class std::basic_istream<char, struct std::char_traits<char> > & __ptr64 __cdecl std::basic_istream<char, struct std::char_traits<char> >::ignore(__int64, int) __ptr64 ?ignore@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z
MSVCP140.dll	963	public: class std::locale __cdecl std::ios_base::getloc(void)const __ptr64 ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
MSVCP140.dll	438	public: static unsigned __int64 __cdecl std::ctype<char>::_Getcat(class std::locale::facet const * __ptr64 * __ptr64, class std::locale const * __ptr64) ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
MSVCP140.dll	305	public: __cdecl std::locale::id::operator unsigned __int64(void) __ptr64 ??Bid@locale@std@@QEAA_KXZ
MSVCP140.dll	969	public: static class std::locale::id std::codecvt<char, char, struct _Mbstatet>::id ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
MSVCP140.dll	427	struct _iobuf * __ptr64 __cdecl std::_Fiopen(char const * __ptr64, int, int) ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
MSVCP140.dll	433	public: static unsigned __int64 __cdecl std::codecvt<char, char, struct _Mbstatet>::_Getcat(class std::locale::facet const * __ptr64 * __ptr64, class std::locale const * __ptr64) ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
MSVCP140.dll	1173	public: int __cdecl std::basic_streambuf<char, struct std::char_traits<char> >::sbumpc(void) __ptr64 ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
MSVCP140.dll	1319	public: int __cdecl std::codecvt<char, char, struct _Mbstatet>::unshift(struct _Mbstatet & __ptr64, char * __ptr64, char * __ptr64, char * __ptr64 & __ptr64)const __ptr64 ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
MSVCP140.dll	47	protected: __cdecl std::basic_streambuf<char, struct std::char_traits<char> >::basic_streambuf<char, struct std::char_traits<char> >(void) __ptr64 ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
MSVCP140.dll	960	public: class std::locale __cdecl std::basic_streambuf<char, struct std::char_traits<char> >::getloc(void)const __ptr64 ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
MSVCP140.dll	501	protected: void __cdecl std::basic_streambuf<char, struct std::char_traits<char> >::_Init(void) __ptr64 ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
MSVCP140.dll	1018	public: int __cdecl std::codecvt<char, char, struct _Mbstatet>::in(struct _Mbstatet & __ptr64, char const * __ptr64, char const * __ptr64, char const * __ptr64 & __ptr64, char * __ptr64, char * __ptr64, char * __ptr64 & __ptr64)const __ptr64 ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
MSVCP140.dll	1075	public: int __cdecl std::codecvt<char, char, struct _Mbstatet>::out(struct _Mbstatet & __ptr64, char const * __ptr64, char const * __ptr64, char const * __ptr64 & __ptr64, char * __ptr64, char * __ptr64, char * __ptr64 & __ptr64)const __ptr64 ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
MSVCP140.dll	586	protected: char * __ptr64 __cdecl std::basic_streambuf<char, struct std::char_traits<char> >::_Pninc(void) __ptr64 ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
MSVCP140.dll	12	protected: __cdecl std::basic_ios<char, struct std::char_traits<char> >::basic_ios<char, struct std::char_traits<char> >(void) __ptr64 ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
MSVCP140.dll	37	public: __cdecl std::basic_ostream<char, struct std::char_traits<char> >::basic_ostream<char, struct std::char_traits<char> >(class std::basic_streambuf<char, struct std::char_traits<char> > * __ptr64, bool) __ptr64 ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
MSVCP140.dll	26	public: __cdecl std::basic_istream<char, struct std::char_traits<char> >::basic_istream<char, struct std::char_traits<char> >(class std::basic_streambuf<char, struct std::char_traits<char> > * __ptr64, bool) __ptr64 ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
MSVCP140.dll	137	public: virtual __cdecl std::basic_streambuf<char, struct std::char_traits<char> >::~basic_streambuf<char, struct std::char_traits<char> >(void) __ptr64 ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
MSVCP140.dll	1237	protected: virtual __int64 __cdecl std::basic_streambuf<char, struct std::char_traits<char> >::showmanyc(void) __ptr64 ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
MSVCP140.dll	1347	protected: virtual __int64 __cdecl std::basic_streambuf<char, struct std::char_traits<char> >::xsgetn(char * __ptr64, __int64) __ptr64 ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
MSVCP140.dll	1350	protected: virtual __int64 __cdecl std::basic_streambuf<char, struct std::char_traits<char> >::xsputn(char const * __ptr64, __int64) __ptr64 ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
MSVCP140.dll	125	public: virtual __cdecl std::basic_ios<char, struct std::char_traits<char> >::~basic_ios<char, struct std::char_traits<char> >(void) __ptr64 ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
MSVCP140.dll	134	public: virtual __cdecl std::basic_ostream<char, struct std::char_traits<char> >::~basic_ostream<char, struct std::char_traits<char> >(void) __ptr64 ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
MSVCP140.dll	1343	public: class std::basic_ostream<char, struct std::char_traits<char> > & __ptr64 __cdecl std::basic_ostream<char, struct std::char_traits<char> >::write(char const * __ptr64, __int64) __ptr64 ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
MSVCP140.dll	131	public: virtual __cdecl std::basic_istream<char, struct std::char_traits<char> >::~basic_istream<char, struct std::char_traits<char> >(void) __ptr64 ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
MSVCP140.dll	669	public: bool __cdecl std::codecvt_base::always_noconv(void)const __ptr64 ?always_noconv@codecvt_base@std@@QEBA_NXZ
MSVCP140.dll	675	class std::basic_istream<char, struct std::char_traits<char> > std::cin ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A
MSVCP140.dll	469	private: static class std::locale::_Locimp * __ptr64 __cdecl std::locale::_Getgloballocale(void) ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
MSVCP140.dll	692	class std::basic_ostream<char, struct std::char_traits<char> > std::cout ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
MSVCP140.dll	1311	int __cdecl std::uncaught_exceptions(void) ?uncaught_exceptions@std@@YAHXZ
MSVCP140.dll	109	public: __cdecl std::_Lockit::_Lockit(int) __ptr64 ??0_Lockit@std@@QEAA@H@Z
MSVCP140.dll	165	public: __cdecl std::_Lockit::~_Lockit(void) __ptr64 ??1_Lockit@std@@QEAA@XZ
MSVCP140.dll	975	public: static class std::locale::id std::ctype<char>::id ?id@?$ctype@D@std@@2V0locale@2@A
VCRUNTIME140_1.dll		__CxxFrameHandler4
VCRUNTIME140.dll	62	memset
VCRUNTIME140.dll	28	__current_exception_context
VCRUNTIME140.dll	60	memcpy
VCRUNTIME140.dll	34	__std_exception_destroy
VCRUNTIME140.dll	33	__std_exception_copy
VCRUNTIME140.dll	35	__std_terminate
VCRUNTIME140.dll	8	__C_specific_handler
VCRUNTIME140.dll	1	_CxxThrowException
VCRUNTIME140.dll	27	__current_exception
VCRUNTIME140.dll	61	memmove
api-ms-win-crt-runtime-l1-1-0.dll	66	_set_app_type
api-ms-win-crt-runtime-l1-1-0.dll	64	_seh_filter_exe
api-ms-win-crt-runtime-l1-1-0.dll	40	_get_initial_narrow_environment
api-ms-win-crt-runtime-l1-1-0.dll	22	_cexit
api-ms-win-crt-runtime-l1-1-0.dll	57	_invalid_parameter_noinfo_noreturn
api-ms-win-crt-runtime-l1-1-0.dll	85	exit
api-ms-win-crt-runtime-l1-1-0.dll	35	_exit
api-ms-win-crt-runtime-l1-1-0.dll	4	__p___argc
api-ms-win-crt-runtime-l1-1-0.dll	5	__p___argv
api-ms-win-crt-runtime-l1-1-0.dll	21	_c_exit
api-ms-win-crt-runtime-l1-1-0.dll	61	_register_thread_local_exe_atexit_callback
api-ms-win-crt-runtime-l1-1-0.dll	30	_crt_atexit
api-ms-win-crt-runtime-l1-1-0.dll	55	_initterm_e
api-ms-win-crt-runtime-l1-1-0.dll	103	terminate
api-ms-win-crt-runtime-l1-1-0.dll	60	_register_onexit_function
api-ms-win-crt-runtime-l1-1-0.dll	52	_initialize_onexit_table
api-ms-win-crt-runtime-l1-1-0.dll	51	_initialize_narrow_environment
api-ms-win-crt-runtime-l1-1-0.dll	24	_configure_narrow_argv
api-ms-win-crt-runtime-l1-1-0.dll	54	_initterm
api-ms-win-crt-stdio-l1-1-0.dll	152	setvbuf
api-ms-win-crt-stdio-l1-1-0.dll	121	fgetpos
api-ms-win-crt-stdio-l1-1-0.dll	138	fwrite
api-ms-win-crt-stdio-l1-1-0.dll	157	ungetc
api-ms-win-crt-stdio-l1-1-0.dll	131	fread
api-ms-win-crt-stdio-l1-1-0.dll	1	__p__commode
api-ms-win-crt-stdio-l1-1-0.dll	84	_set_fmode
api-ms-win-crt-stdio-l1-1-0.dll	120	fgetc
api-ms-win-crt-stdio-l1-1-0.dll	136	fsetpos
api-ms-win-crt-stdio-l1-1-0.dll	47	_fseeki64
api-ms-win-crt-stdio-l1-1-0.dll	15	__stdio_common_vsprintf_s
api-ms-win-crt-stdio-l1-1-0.dll	116	fclose
api-ms-win-crt-stdio-l1-1-0.dll	119	fflush
api-ms-win-crt-stdio-l1-1-0.dll	127	fputc
api-ms-win-crt-stdio-l1-1-0.dll	57	_get_stream_buffer_pointers
api-ms-win-crt-filesystem-l1-1-0.dll	22	_lock_file
api-ms-win-crt-filesystem-l1-1-0.dll	36	_unlock_file
api-ms-win-crt-heap-l1-1-0.dll	22	_set_new_mode
api-ms-win-crt-heap-l1-1-0.dll	25	malloc
api-ms-win-crt-heap-l1-1-0.dll	24	free
api-ms-win-crt-heap-l1-1-0.dll	8	_callnewh
api-ms-win-crt-math-l1-1-0.dll	9	__setusermatherr
api-ms-win-crt-locale-l1-1-0.dll	8	_configthreadlocale

show previews

offset	size	type	comment
15c1	15	HTM		#
15d0	221232	BIN	overlay data past EOF	#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

everything is OK