imaging.dll

info
MZ
PE
resources
strings
imports
exports
foremost
hexdump
disasm
log
discuss
donate

filename	imaging.dll
size	419076 (0x66504)
md5	3b42abc182d08da946a493e9ca0dd569

type	PE32 executable (DLL) (Windows CE) ARM, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0xc0

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|
00000040: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00000080:

PE Header

Signature	PE
Machine	0x1c0
NumberOfSections	4
TimeDateStamp	0x4e94fa2e
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x2123
Magic	0x10b
LinkerVersion	6.1
SizeOfCode	0x60eca
SizeOfInitializedData	0x5180
SizeOfUninitializedData	0
AddressOfEntryPoint	0x42890
BaseOfCode	0x1000
BaseOfData	0x62000
ImageBase	0x40700000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	4.0
ImageVersion	0.0
SubsystemVersion	6.0
Reserved1	0
SizeOfImage	0x6b000
SizeOfHeaders	0x400
CheckSum	0
Subsystem	9
DllCharacteristics	0
SizeOfStackReserve	0x10000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x60eca	0x60eca	R-X CODE
.data	0x62000	0x1f0c	0x1e00	RW- IDATA
.pdata	0x64000	0x2d70	0x2d70	R-- IDATA
.rsrc	0x67000	0x504	0x504	R-- IDATA

Data Directory

type	va	size
EXPORT	0x61e60	0x6a
IMPORT	0x61b70	0x50
RESOURCE	0x67000	0x504
EXCEPTION	0x64000	0x2d70
SECURITY	0	0
BASERELOC	0	0
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0	0
Delay_IAT	0	0
CLR_Header	0	0

show previews

type	name	size
STRING	#126	148
STRING	#127	212
STRING	#128	158
STRING	#129	218
STRING	#130	102
STRING	#131	102

id	lang	string
2010	1033	Built-in BMP Codec
2011	1033	Windows Bitmap
2012	1033	.BMP;.DIB;*.RLE
2013	1033	image/bmp
2020	1033	Built-in JPEG Codec
2021	1033	JPEG
2022	1033	.JPG;.JPEG
2023	1033	image/jpeg
2030	1033	Built-in GIF Codec
2031	1033	Graphics Interchange Format
2032	1033	*.GIF
2033	1033	image/gif
2040	1033	Built-in EMF Codec
2041	1033	Enhanced Metafile
2042	1033	*.EMF
2043	1033	image/emf
2050	1033	Built-in WMF Codec
2051	1033	Windows Metafile
2052	1033	*.WMF
2053	1033	image/wmf
2060	1033	Built-in TIFF Codec
2061	1033	TIFF
2062	1033	.TIF;.TIFF
2063	1033	image/tiff
2070	1033	Built-in PNG Codec
2071	1033	PNG
2072	1033	*.PNG
2073	1033	image/png
2080	1033	Built-in ICO Codec
2081	1033	ICO
2082	1033	*.ICO
2083	1033	image/ico

module_name	hint	ord	function_name
ole32.dll	63		CoTaskMemAlloc
ole32.dll	64		CoTaskMemFree
COREDLL.dll		1043
COREDLL.dll		1756
COREDLL.dll		545
COREDLL.dll		544
COREDLL.dll		1232
COREDLL.dll		10
COREDLL.dll		11
COREDLL.dll		2
COREDLL.dll		3
COREDLL.dll		44
COREDLL.dll		45
COREDLL.dll		523
COREDLL.dll		522
COREDLL.dll		553
COREDLL.dll		36
COREDLL.dll		525
COREDLL.dll		550
COREDLL.dll		4
COREDLL.dll		5
COREDLL.dll		535
COREDLL.dll		496
COREDLL.dll		455
COREDLL.dll		528
COREDLL.dll		530
COREDLL.dll		529
COREDLL.dll		524
COREDLL.dll		516
COREDLL.dll		1667
COREDLL.dll		911
COREDLL.dll		912
COREDLL.dll		921
COREDLL.dll		90
COREDLL.dll		910
COREDLL.dll		263
COREDLL.dll		916
COREDLL.dll		262
COREDLL.dll		170
COREDLL.dll		173
COREDLL.dll		176
COREDLL.dll		172
COREDLL.dll		171
COREDLL.dll		175
COREDLL.dll		549
COREDLL.dll		548
COREDLL.dll		456
COREDLL.dll		461
COREDLL.dll		460
COREDLL.dll		457
COREDLL.dll		464
COREDLL.dll		463
COREDLL.dll		874
COREDLL.dll		168
COREDLL.dll		46
COREDLL.dll		49
COREDLL.dll		47
COREDLL.dll		1177
COREDLL.dll		542
COREDLL.dll		543
COREDLL.dll		2528
COREDLL.dll		1726
COREDLL.dll		2041
COREDLL.dll		1092
COREDLL.dll		87
COREDLL.dll		60
COREDLL.dll		1044
COREDLL.dll		1047
COREDLL.dll		1046
COREDLL.dll		2036
COREDLL.dll		2033
COREDLL.dll		2027
COREDLL.dll		2048
COREDLL.dll		2053
COREDLL.dll		2046
COREDLL.dll		2021
COREDLL.dll		2008
COREDLL.dll		2012
COREDLL.dll		2032
COREDLL.dll		2031
COREDLL.dll		2020
COREDLL.dll		2028
COREDLL.dll		2026
COREDLL.dll		2043
COREDLL.dll		2005
COREDLL.dll		2051
COREDLL.dll		2029
COREDLL.dll		2015
COREDLL.dll		1051
COREDLL.dll		1009
COREDLL.dll		1010
COREDLL.dll		1068
COREDLL.dll		1063
COREDLL.dll		1066
COREDLL.dll		1065
COREDLL.dll		2039
COREDLL.dll		2025
COREDLL.dll		1033
COREDLL.dll		2016
COREDLL.dll		2044
COREDLL.dll		2037
COREDLL.dll		1645
COREDLL.dll		2696
COREDLL.dll		1876
COREDLL.dll		1054
COREDLL.dll		1041
COREDLL.dll		1049
COREDLL.dll		1018
ZLIB.dll	16		uncompress
ZLIB.dll	3		deflateEnd
ZLIB.dll	6		deflateReset
ZLIB.dll	2		deflate
ZLIB.dll	4		deflateInit2_
ZLIB.dll	1		crc32
ZLIB.dll	8		inflate
ZLIB.dll	9		inflateEnd
ZLIB.dll	10		inflateInit2_

ord	entry_va	function_name
1	0x875c	DllCanUnloadNow
2	0x8aa0	DllGetClassObject

module_name	imaging.dll
flags	0
timestamp	2011-10-12 02:23:38
version	0.0
ordinal_base	1
nFunctions	2
nNames	2
Names(2)	0x61e90
Functions(2)	0x61e88
NameOrdinals(2)	0x61e98

show previews

offset	size	type	comment
0	419076	DLL	10/12/2011 02:23:42	#
15c1	15	HTM		#
4894	6441	GIF	(18759 x 14406)	#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

everything is OK