filenamesqmapi.dll
size244736 (0x3bc00)
md527b9e163740a226b65e4b9e186117911
typePE32+ executable (DLL) (GUI) x86-64, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x100

Rich Header

lib idversiontimes used
149307292
10298
1473072917
1313072963
146307291
1383072949
126507278
1323072931
148307291
145307291

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x8664
NumberOfSections6
TimeDateStamp0x4ce7c9d4
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xf0
Characteristics0x2022
Magic0x20b
LinkerVersion9.0
SizeOfCode0x31e00
SizeOfInitializedData0xbe00
SizeOfUninitializedData0
AddressOfEntryPoint0x17e4
BaseOfCode0x1000
ImageBase0x7ff72760000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.1
ImageVersion6.1
SubsystemVersion5.2
Reserved10
SizeOfImage0x42000
SizeOfHeaders0x400
CheckSum0x479ec
Subsystem2
DllCharacteristics0x40
SizeOfStackReserve0x40000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Sections

namevavsizeraw sizeflags
.text0x10000x31de70x31e00R-X CODE
.rdata0x330000x61a00x6200R-- IDATA
.data0x3a0000x2c840xa00RW- IDATA
.pdata0x3d0000x25b00x2600R-- IDATA
.rsrc0x400000x4080x600R-- IDATA
.reloc0x410000x880x200R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT0x336040x6dc
IMPORT0x360540x78
RESOURCE0x400000x408
EXCEPTION0x3d0000x25b0
SECURITY00
BASERELOC0x410000x88
DEBUG0x32d880x38
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT0x2f80x84
IAT0x330000x4a0
Delay_IAT0x35cd00x80
CLR_Header00
typenamesizecp
VERSION#19320
module_namehintordfunction_name
msvcrt.dll1156memset
msvcrt.dll1152memcpy
msvcrt.dll83__C_specific_handler
msvcrt.dll160_amsg_exit
msvcrt.dll364_initterm
msvcrt.dll82_XcptFilter
msvcrt.dll1242towupper
msvcrt.dll1175realloc
msvcrt.dll653_purecall
msvcrt.dll850_vsnprintf
msvcrt.dll1282wcsstr
msvcrt.dll1278wcsrchr
msvcrt.dll899_wcsnicmp
msvcrt.dll1289wcstoul
msvcrt.dll1154memmove
msvcrt.dll889_wcsicmp
msvcrt.dll1263wcschr
msvcrt.dll856_vsnwprintf
msvcrt.dll1082free
msvcrt.dll177_callnewh
msvcrt.dll1140malloc
msvcrt.dll246_errno
msvcrt.dll85__CxxFrameHandler
msvcrt.dll1045ceilf
ADVAPI32.dll621RegQueryValueExA
ADVAPI32.dll608RegOpenKeyExA
ADVAPI32.dll656RevertToSelf
ADVAPI32.dll371ImpersonateLoggedOnUser
ADVAPI32.dll638RegSetValueExW
ADVAPI32.dll560RegCloseKey
ADVAPI32.dll108ConvertSidToStringSidW
ADVAPI32.dll609RegOpenKeyExW
ADVAPI32.dll594RegEnumValueW
ADVAPI32.dll584RegDeleteValueW
ADVAPI32.dll616RegQueryInfoKeyW
ADVAPI32.dll622RegQueryValueExW
ADVAPI32.dll569RegCreateKeyExW
ADVAPI32.dll346GetTokenInformation
ADVAPI32.dll503OpenProcessToken
ADVAPI32.dll114ConvertStringSecurityDescriptorToSecurityDescriptorW
ADVAPI32.dll770UnregisterTraceGuids
ADVAPI32.dll650RegisterTraceGuidsW
ADVAPI32.dll347GetTraceEnableFlags
ADVAPI32.dll348GetTraceEnableLevel
ADVAPI32.dll349GetTraceLoggerHandle
ADVAPI32.dll756TraceEvent
USER32.dll384GetSystemMetrics
USER32.dll544MsgWaitForMultipleObjects
USER32.dll772TranslateMessage
USER32.dll567PeekMessageW
USER32.dll175DispatchMessageW
KERNEL32.dll1048RtlCaptureContext
KERNEL32.dll1055RtlLookupFunctionEntry
KERNEL32.dll1062RtlVirtualUnwind
KERNEL32.dll907OutputDebugStringA
KERNEL32.dll1021ReleaseMutex
KERNEL32.dll895OpenMutexW
KERNEL32.dll158CreateMutexW
KERNEL32.dll180CreateThread
KERNEL32.dll236DuplicateHandle
KERNEL32.dll361FreeLibraryAndExitThread
KERNEL32.dll937QueryPerformanceCounter
KERNEL32.dll891OpenFileMappingW
KERNEL32.dll660GetThreadPriority
KERNEL32.dll1287WaitForMultipleObjects
KERNEL32.dll133CreateEventW
KERNEL32.dll854LockResource
KERNEL32.dll1042ResetEvent
KERNEL32.dll707GlobalFree
KERNEL32.dll1273VirtualAlloc
KERNEL32.dll531GetLongPathNameW
KERNEL32.dll502GetFileSizeEx
KERNEL32.dll651GetTempPathW
KERNEL32.dll1190SetThreadPriority
KERNEL32.dll963ReadFile
KERNEL32.dll495GetFileAttributesW
KERNEL32.dll459GetCurrentThreadId
KERNEL32.dll455GetCurrentProcessId
KERNEL32.dll1231TerminateProcess
KERNEL32.dll1251UnhandledExceptionFilter
KERNEL32.dll1203SetUnhandledExceptionFilter
KERNEL32.dll100CompareStringW
KERNEL32.dll831LoadLibraryA
KERNEL32.dll537GetModuleHandleA
KERNEL32.dll886OpenEventA
KERNEL32.dll683GetVersionExA
KERNEL32.dll1126SetErrorMode
KERNEL32.dll1134SetFileAttributesW
KERNEL32.dll1216SizeofResource
KERNEL32.dll1333WriteFile
KERNEL32.dll639GetSystemTimeAsFileTime
KERNEL32.dll1276VirtualFree
KERNEL32.dll458GetCurrentThread
KERNEL32.dll1127SetEvent
KERNEL32.dll1289WaitForSingleObject
KERNEL32.dll129CreateDirectoryW
KERNEL32.dll1140SetFilePointerEx
KERNEL32.dll833LoadLibraryExW
KERNEL32.dll836LoadResource
KERNEL32.dll340FindResourceW
KERNEL32.dll363FreeResource
KERNEL32.dll501GetFileSize
KERNEL32.dll649GetTempFileNameW
KERNEL32.dll297FileTimeToDosDateTime
KERNEL32.dll291ExpandEnvironmentStringsW
KERNEL32.dll215DeleteFileW
KERNEL32.dll492GetFileAttributesExW
KERNEL32.dll331FindNextFileW
KERNEL32.dll308FindClose
KERNEL32.dll1378lstrlenW
KERNEL32.dll536GetModuleFileNameW
KERNEL32.dll843LocalFree
KERNEL32.dll684GetVersionExW
KERNEL32.dll630GetSystemDirectoryW
KERNEL32.dll665GetTickCount
KERNEL32.dll96CompareFileTime
KERNEL32.dll839LocalAlloc
KERNEL32.dll454GetCurrentProcess
KERNEL32.dll834LoadLibraryW
KERNEL32.dll586GetProcAddress
KERNEL32.dll360FreeLibrary
KERNEL32.dll226DisableThreadLibraryCalls
KERNEL32.dll518GetLastError
KERNEL32.dll832LoadLibraryExA
KERNEL32.dll207DelayLoadFailureHook
KERNEL32.dll1279VirtualProtect
KERNEL32.dll1217Sleep
KERNEL32.dll857MapViewOfFile
KERNEL32.dll1254UnmapViewOfFile
KERNEL32.dll1228SystemTimeToFileTime
KERNEL32.dll749InitializeCriticalSectionAndSpinCount
KERNEL32.dll828LeaveCriticalSection
KERNEL32.dll143CreateFileW
KERNEL32.dll1151SetLastError
KERNEL32.dll242EnterCriticalSection
KERNEL32.dll140CreateFileMappingW
KERNEL32.dll210DeleteCriticalSection
KERNEL32.dll82CloseHandle
KERNEL32.dll637GetSystemTime
KERNEL32.dll319FindFirstFileW
ntdll.dll613RtlAllocateHeap
ntdll.dll843RtlFreeHeap
ntdll.dll428NtQuerySystemTime
ordentry_vafunction_name
10x1f880SqmCheckEscalationAddToStreamDWord64
20x1f7c0SqmCheckEscalationAddToStreamDWord
30x1f934SqmCheckEscalationAddToStreamString
40x1f59cSqmCheckEscalationSetDWord64
50x1f498SqmCheckEscalationSetDWord
60x1f6a0SqmCheckEscalationSetString
70x1f9f8SqmGetEscalationRuleStatus
80x1fab0SqmGetInstrumentationProperty
90xf700SqmLoadEscalationManifest
100x106f0SqmSetEscalationInfo
110xf320SqmUnloadEscalationManifest
120x1e24cSqmAddToAverage
130x1ed64SqmAddToStream
140xd038SqmAddToStreamDWord
150xc958SqmAddToStreamDWord64
160xdab8SqmAddToStreamString
170x1ebacSqmAddToStreamV
180x1d68cSqmCleanup
190x1e350SqmClearFlags
200x1f120SqmCreateNewId
210xee6cSqmEndSession
220x1d9c0SqmFlushSession
230x1db60SqmGetEnabled
240x1e440SqmGetFlags
250x1e910SqmGetMachineId
260x22c0SqmGetSession
270x1d8d0SqmGetSessionStartTime
280x1ea60SqmGetUserId
290x1e148SqmIncrement
300x1d8c0SqmIsWindowsOptedIn
310x1384SqmReadSharedMachineId
320x2e70SqmReadSharedUserId
330x218cSqmSet
340x2cd8SqmSetAppId
350xc808SqmSetAppVersion
360x1de30SqmSetBits
370x1dd28SqmSetBool
380x1f1c8SqmSetCurrentTimeAsUploadTime
390xd430SqmSetDWord64
400xc770SqmSetEnabled
410x2de0SqmSetFlags
420x1df40SqmSetIfMax
430x1e044SqmSetIfMin
440x2a4cSqmSetMachineId
450xd700SqmSetString
460x2b80SqmSetUserId
470x1dc44SqmStartSession
480x116fcSqmStartUpload
490x1d464SqmSysprepCleanup
500x1d23cSqmSysprepGeneralize
510x1d3e4SqmSysprepSpecialize
520x1e734SqmTimerAccumulate
530x1e81cSqmTimerAddToAverage
540x1e64cSqmTimerRecord
550x1e564SqmTimerStart
560x1d47cSqmUnattendedSetup
570x3b88SqmWaitForUploadComplete
580x1edd0SqmWriteSharedMachineId
590x1efbcSqmWriteSharedUserId
module_namesqmapi.dll
flags0
timestamp2010-11-20 09:54:14
version0.0
ordinal_base1
nFunctions59
nNames59
Names(59)0x33718
Functions(59)0x3362c
NameOrdinals(59)0x33804

StringTable 040904B0

CompanyNameMicrosoft Corporation
FileDescriptionSQM Client
FileVersion6.1.7601.17514 (win7sp1_rtm.101119-1850)
InternalNamesqmapi
LegalCopyright© Microsoft Corporation. All rights reserved.
OriginalFilenamesqmapi.dll
ProductNameMicrosoft® Windows® Operating System
ProductVersion6.1.7601.17514
OleSelfRegister

VS_FIXEDFILEINFO

FileVersion6.1.7601.17514
ProductVersion6.1.7601.17514
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType2
FileSubtype0
offsetsizetypecomment
15c115HTM#
15d0239152BINoverlay data past EOF#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] can't find file_offset of VA 0x2f8