filenamedissect_exe.dll
size843776 (0xce000)
md52f41dce9d41abbe82c316c14f945d8da
typePE32 executable (DLL) (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x108

Rich Header

lib idversiontimes used
2414011621
24340116179
2424011631
2592390726
26123907111
2602390737
2036550119
10264
2642391818
256239181
255239181
258239181

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections7
TimeDateStamp0x5841c0bc
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x2102
Magic0x10b
LinkerVersion14.0
SizeOfCode0xa2400
SizeOfInitializedData0x31000
SizeOfUninitializedData0
AddressOfEntryPoint0x640e5
BaseOfCode0x1000
BaseOfData0xa4000
ImageBase0x10000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.0
ImageVersion0.0
SubsystemVersion6.0
Reserved10
SizeOfImage0xd8000
SizeOfHeaders0x400
CheckSum0
Subsystem2
DllCharacteristics0x140
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ 6.0 - 8.0

Sections

namevavsizeraw sizeflags
.text0x10000xa23480xa2400R-X CODE
.rdata0xa40000x20cd40x20e00R-- IDATA
.data0xc50000x8a800x3400RW- IDATA
.tls0xce00090x200RW- IDATA
.gfids0xcf0000xb1c0xc00R-- IDATA
.rsrc0xd00000x1e00x200R-- IDATA
.reloc0xd10000x65780x6600R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT0xc37200x6c
IMPORT0xc378c0xc8
RESOURCE0xd00000x1e0
EXCEPTION00
SECURITY00
BASERELOC0xd10000x6578
DEBUG0xbcf400x38
ARCHITECTURE00
GLOBALPTR00
TLS0xbcfd40x18
LOAD_CONFIG0xbcf780x40
Bound_IAT00
IAT0xa40000x3e0
Delay_IAT00
CLR_Header00

TLS

raw
start		raw
end		indexcallbkszero
fill		flags
0x100ce0000x100ce0080x100c85f00x100a447400x300000
typenamesizecp
MANIFEST#23810
module_namehintordfunction_name
KERNEL32.dll809GlobalUnlock
KERNEL32.dll610GetModuleFileNameA
KERNEL32.dll599GetLogicalDrives
KERNEL32.dll1514WriteProcessMemory
KERNEL32.dll364FindFirstFileA
KERNEL32.dll611GetModuleFileNameW
KERNEL32.dll381FindNextFileA
KERNEL32.dll839InitializeCriticalSection
KERNEL32.dll1546lstrlenA
KERNEL32.dll360FindClose
KERNEL32.dll206CreateMutexA
KERNEL32.dll774GetVolumeInformationA
KERNEL32.dll1451WaitForSingleObject
KERNEL32.dll1006OpenProcess
KERNEL32.dll241CreateToolhelp32Snapshot
KERNEL32.dll738GetTempPathA
KERNEL32.dll1001OpenMutexA
KERNEL32.dll1038Process32Next
KERNEL32.dll232CreateThread
KERNEL32.dll1436VirtualAllocEx
KERNEL32.dll261DeleteCriticalSection
KERNEL32.dll1107ReadProcessMemory
KERNEL32.dll522GetCurrentProcessId
KERNEL32.dll220CreateRemoteThread
KERNEL32.dll462GetComputerNameA
KERNEL32.dll293EnterCriticalSection
KERNEL32.dll930LeaveCriticalSection
KERNEL32.dll977MultiByteToWideChar
KERNEL32.dll1485WideCharToMultiByte
KERNEL32.dll27AreFileApisANSI
KERNEL32.dll1104ReadFile
KERNEL32.dll1404TryEnterCriticalSection
KERNEL32.dll817HeapCreate
KERNEL32.dll819HeapFree
KERNEL32.dll585GetFullPathNameW
KERNEL32.dll1505WriteFile
KERNEL32.dll539GetDiskFreeSpaceW
KERNEL32.dll1017OutputDebugStringA
KERNEL32.dll955LockFile
KERNEL32.dll1276SetFilePointer
KERNEL32.dll582GetFullPathNameA
KERNEL32.dll1258SetEndOfFile
KERNEL32.dll1412UnlockFileEx
KERNEL32.dll739GetTempPathW
KERNEL32.dll209CreateMutexW
KERNEL32.dll194CreateFileW
KERNEL32.dll565GetFileAttributesW
KERNEL32.dll526GetCurrentThreadId
KERNEL32.dll827HeapValidate
KERNEL32.dll824HeapSize
KERNEL32.dll410FormatMessageW
KERNEL32.dll536GetDiskFreeSpaceA
KERNEL32.dll560GetFileAttributesA
KERNEL32.dll562GetFileAttributesExW
KERNEL32.dll1018OutputDebugStringW
KERNEL32.dll405FlushViewOfFile
KERNEL32.dll1452WaitForSingleObjectEx
KERNEL32.dll266DeleteFileW
KERNEL32.dll822HeapReAlloc
KERNEL32.dll720GetSystemInfo
KERNEL32.dll936LoadLibraryW
KERNEL32.dll815HeapAlloc
KERNEL32.dll816HeapCompact
KERNEL32.dll818HeapDestroy
KERNEL32.dll173CreateDirectoryA
KERNEL32.dll956LockFileEx
KERNEL32.dll674GetProcessHeap
KERNEL32.dll1373SystemTimeToFileTime
KERNEL32.dll726GetSystemTimeAsFileTime
KERNEL32.dll724GetSystemTime
KERNEL32.dll409FormatMessageA
KERNEL32.dll191CreateFileMappingW
KERNEL32.dll1069QueryPerformanceCounter
KERNEL32.dll754GetTickCount
KERNEL32.dll402FlushFileBuffers
KERNEL32.dll802GlobalLock
KERNEL32.dll1420UnregisterWaitEx
KERNEL32.dll1060QueryDepthSList
KERNEL32.dll854InterlockedPopEntrySList
KERNEL32.dll1168ReleaseSemaphore
KERNEL32.dll1441VirtualProtect
KERNEL32.dll1438VirtualFree
KERNEL32.dll1435VirtualAlloc
KERNEL32.dll773GetVersionExW
KERNEL32.dll752GetThreadTimes
KERNEL32.dll1419UnregisterWait
KERNEL32.dll1157RegisterWaitForSingleObject
KERNEL32.dll1323SetThreadAffinityMask
KERNEL32.dll670GetProcessAffinityMask
KERNEL32.dll632GetNumaHighestNodeNumber
KERNEL32.dll271DeleteTimerQueueTimer
KERNEL32.dll113ChangeTimerQueueTimer
KERNEL32.dll240CreateTimerQueueTimer
KERNEL32.dll592GetLastError
KERNEL32.dll1362Sleep
KERNEL32.dll716GetSystemDirectoryA
KERNEL32.dll612GetModuleHandleA
KERNEL32.dll521GetCurrentProcess
KERNEL32.dll665GetPrivateProfileStringA
KERNEL32.dll960MapViewOfFile
KERNEL32.dll600GetLogicalProcessorInformation
KERNEL32.dll749GetThreadPriority
KERNEL32.dll1333SetThreadPriority
KERNEL32.dll414FreeLibrary
KERNEL32.dll571GetFileSize
KERNEL32.dll187CreateFileMappingA
KERNEL32.dll669GetProcAddress
KERNEL32.dll127CloseHandle
KERNEL32.dll933LoadLibraryA
KERNEL32.dll186CreateFileA
KERNEL32.dll1413UnmapViewOfFile
KERNEL32.dll698GetShortPathNameA
KERNEL32.dll946LocalFree
KERNEL32.dll1372SwitchToThread
KERNEL32.dll1360SignalObjectAndWait
KERNEL32.dll239CreateTimerQueue
KERNEL32.dll263DeleteFileA
KERNEL32.dll160CopyFileA
KERNEL32.dll1504WriteConsoleW
KERNEL32.dll413FreeEnvironmentStringsW
KERNEL32.dll551GetEnvironmentStringsW
KERNEL32.dll457GetCommandLineW
KERNEL32.dll456GetCommandLineA
KERNEL32.dll646GetOEMCP
KERNEL32.dll882IsValidCodePage
KERNEL32.dll365FindFirstFileExA
KERNEL32.dll1102ReadConsoleW
KERNEL32.dll1314SetStdHandle
KERNEL32.dll761GetTimeZoneInformation
KERNEL32.dll1277SetFilePointerEx
KERNEL32.dll494GetConsoleMode
KERNEL32.dll476GetConsoleCP
KERNEL32.dll1262SetEnvironmentVariableW
KERNEL32.dll1261SetEnvironmentVariableA
KERNEL32.dll327EnumSystemLocalesW
KERNEL32.dll764GetUserDefaultLCID
KERNEL32.dll884IsValidLocale
KERNEL32.dll704GetStdHandle
KERNEL32.dll1250SetCurrentDirectoryA
KERNEL32.dll1411UnlockFile
KERNEL32.dll1410UnhandledExceptionFilter
KERNEL32.dll1347SetUnhandledExceptionFilter
KERNEL32.dll1377TerminateProcess
KERNEL32.dll877IsProcessorFeaturePresent
KERNEL32.dll1264SetEvent
KERNEL32.dll1186ResetEvent
KERNEL32.dll182CreateEventW
KERNEL32.dll615GetModuleHandleW
KERNEL32.dll871IsDebuggerPresent
KERNEL32.dll702GetStartupInfoW
KERNEL32.dll843InitializeSListHead
KERNEL32.dll287DuplicateHandle
KERNEL32.dll525GetCurrentThread
KERNEL32.dll557GetExitCodeThread
KERNEL32.dll289EncodePointer
KERNEL32.dll254DecodePointer
KERNEL32.dll1291SetLastError
KERNEL32.dll840InitializeCriticalSectionAndSpinCount
KERNEL32.dll1395TlsAlloc
KERNEL32.dll1397TlsGetValue
KERNEL32.dll1398TlsSetValue
KERNEL32.dll1396TlsFree
KERNEL32.dll147CompareStringW
KERNEL32.dll918LCMapStringW
KERNEL32.dll596GetLocaleInfoW
KERNEL32.dll709GetStringTypeW
KERNEL32.dll435GetCPInfo
KERNEL32.dll935LoadLibraryExW
KERNEL32.dll1088RaiseException
KERNEL32.dll855InterlockedPushEntrySList
KERNEL32.dll852InterlockedFlushSList
KERNEL32.dll1197RtlUnwind
KERNEL32.dll574GetFileType
KERNEL32.dll338ExitThread
KERNEL32.dll415FreeLibraryAndExitThread
KERNEL32.dll614GetModuleHandleExW
KERNEL32.dll337ExitProcess
KERNEL32.dll420GetACP
USER32.dllActivateKeyboardLayout
USER32.dll340GetKeyboardLayout
USER32.dll341GetKeyboardLayoutList
USER32.dll278GetAsyncKeyState
USER32.dll342GetKeyboardLayoutNameA
USER32.dll339GetKeyState
USER32.dll467GetWindowThreadProcessId
USER32.dll296GetClipboardData
USER32.dll831TranslateMessage
USER32.dll835UnhookWindowsHookEx
USER32.dll463GetWindowTextA
USER32.dll791SetWindowsHookExA
USER32.dll75CloseClipboard
USER32.dll606OpenClipboard
USER32.dll337GetKeyNameTextA
USER32.dll28CallNextHookEx
USER32.dll180DispatchMessageA
USER32.dll367GetMessageA
USER32.dll323GetForegroundWindow
ADVAPI32.dll794SystemFunction036
ADVAPI32.dll644RegOpenKeyExA
ADVAPI32.dll596RegCloseKey
ADVAPI32.dll674RegSetValueExW
ADVAPI32.dll605RegCreateKeyExW
ADVAPI32.dll377GetUserNameA
ADVAPI32.dll657RegQueryValueExA
SHELL32.dll204SHGetFolderPathA
SHELL32.dll242SHGetSpecialFolderPathA
GDI32.dll50CreateDCA
GDI32.dll49CreateCompatibleDC
GDI32.dll54CreateDIBSection
GDI32.dll725SelectObject
GDI32.dll551GetObjectA
GDI32.dll271DeleteObject
GDI32.dll503GetDeviceCaps
GDI32.dll268DeleteDC
GDI32.dll19BitBlt
SHLWAPI.dll71PathFileExistsA
SHLWAPI.dll198SHGetValueA
CRYPT32.dll229CryptUnprotectData
WS2_32.dll17
WS2_32.dll57
WS2_32.dll15
WS2_32.dll5
WS2_32.dll150getaddrinfo
WS2_32.dll9
WS2_32.dll16
WS2_32.dll4
WS2_32.dll23
WS2_32.dll19
WS2_32.dll115
WS2_32.dll52
WS2_32.dll3
WS2_32.dll2
WS2_32.dll1
WS2_32.dll116
WS2_32.dll8
WS2_32.dll11
WS2_32.dll12
WS2_32.dll20
IPHLPAPI.DLL62GetAdaptersInfo
ordentry_vafunction_name
10x3996?KeyEvent@@YGJHIJ@Z
20xab75ShadowPlay
module_namedissect_exe.dll
flags0
timestamp2016-12-02 18:43:07
version0.0
ordinal_base1
nFunctions2
nNames2
Names(2)0xc3750
Functions(2)0xc3748
NameOrdinals(2)0xc3758
offsetsizetypecomment
0843776DLL12/02/2016 18:43:08#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] can't find file_offset of VA 0xc85f0