parentocevogyv.dll
filenameocevogyv.unpacked.dll
size8584816 (0x82fe70)
md54a6c47da6c0368056faa6fe5b0494710
typePE32 executable (DLL) (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x108

Rich Header

lib idversiontimes used
126503272
1255072727
10950727154
170303197
93403520
147307293
10299
1713031945
001
1105072796
122507271
124507271
120507271

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections7
TimeDateStamp0x5bab6ee9
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x2d02
Magic0x10b
LinkerVersion8.0
SizeOfCode0x803000
SizeOfInitializedData0x2f000
SizeOfUninitializedData0
AddressOfEntryPoint0x1aa00
BaseOfCode0x1000
BaseOfData0x804000
ImageBase0x10000000
SectionAlignment0x1000
FileAlignment0x1000
OperatingSystemVersion4.0
ImageVersion0.0
SubsystemVersion4.0
Reserved10
SizeOfImage0x833000
SizeOfHeaders0x1000
CheckSum0
Subsystem2
DllCharacteristics0x140
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ 6.0 - 8.0

Sections

namevavsizeraw sizeflags
.text0x10000x340390x35000R-X CODE
.core0x360000x7cd2d00x7ce000R-X CODE
.rdata0x8040000x149180x15000R-- IDATA
.data0x8190000x6fc00x3000RW- IDATA
.tls0x8200000xd0x1000RW- IDATA
.rsrc0x8210000x4a80x1000R-- IDATA
.reloc0x8220000x10f640x11000R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT0x8187300x1e8
IMPORT0x8178040xa0
RESOURCE0x8210000x4a8
EXCEPTION00
SECURITY00
BASERELOC0x8220000x3e90
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS0x80ee400x18
LOAD_CONFIG00
Bound_IAT00
IAT00
Delay_IAT00
CLR_Header00

TLS

raw
start		raw
end		indexcallbkszero
fill		flags
0x108200000x1082000c0x1081e3780x108042e800
typenamesizecp
VERSION#110960
module_namehintordfunction_name
KERNEL32.DLLUnmapViewOfFile
KERNEL32.DLLMapViewOfFile
KERNEL32.DLLCreateFileMappingW
KERNEL32.DLLGetSystemTime
KERNEL32.DLLWaitNamedPipeW
KERNEL32.DLLGetCurrentThread
KERNEL32.DLLGetModuleHandleA
KERNEL32.DLLSetProcessAffinityMask
KERNEL32.DLLSetThreadAffinityMask
KERNEL32.DLLGetProcessAffinityMask
KERNEL32.DLLCreateFileA
KERNEL32.DLLGetLongPathNameW
KERNEL32.DLLFreeLibrary
KERNEL32.DLLCreateEventW
KERNEL32.DLLGetExitCodeThread
KERNEL32.DLLThread32Next
KERNEL32.DLLThread32First
KERNEL32.DLLCreateToolhelp32Snapshot
KERNEL32.DLLInterlockedExchange
KERNEL32.DLLDuplicateHandle
KERNEL32.DLLGetCurrentThreadId
KERNEL32.DLLTerminateThread
KERNEL32.DLLExitProcess
KERNEL32.DLLVirtualAlloc
KERNEL32.DLLMultiByteToWideChar
KERNEL32.DLLVirtualFree
KERNEL32.DLLOpenEventW
KERNEL32.DLLGetCommandLineW
KERNEL32.DLLVirtualQuery
KERNEL32.DLLVirtualProtect
KERNEL32.DLLWaitForSingleObject
KERNEL32.DLLCancelWaitableTimer
KERNEL32.DLLOutputDebugStringA
KERNEL32.DLLCreateMutexW
KERNEL32.DLLReleaseMutex
KERNEL32.DLLQueryPerformanceCounter
KERNEL32.DLLQueryPerformanceFrequency
KERNEL32.DLLCreateThread
KERNEL32.DLLSetWaitableTimer
KERNEL32.DLLCreateWaitableTimerW
KERNEL32.DLLSetLastError
KERNEL32.DLLWriteConsoleW
KERNEL32.DLLGetStdHandle
KERNEL32.DLLGetEnvironmentVariableA
KERNEL32.DLLInitializeCriticalSection
KERNEL32.DLLDeleteCriticalSection
KERNEL32.DLLEnterCriticalSection
KERNEL32.DLLLeaveCriticalSection
KERNEL32.DLLInterlockedIncrement
KERNEL32.DLLInterlockedDecrement
KERNEL32.DLLLCMapStringW
KERNEL32.DLLFlushViewOfFile
KERNEL32.DLLSetEndOfFile
KERNEL32.DLLSetFilePointer
KERNEL32.DLLGetFileInformationByHandle
KERNEL32.DLLGetSystemInfo
KERNEL32.DLLSetEvent
KERNEL32.DLLResetEvent
KERNEL32.DLLWaitForMultipleObjectsEx
KERNEL32.DLLWaitForSingleObjectEx
KERNEL32.DLLGetCPInfo
KERNEL32.DLLWideCharToMultiByte
KERNEL32.DLLFormatMessageA
KERNEL32.DLLGetTimeZoneInformation
KERNEL32.DLLGetModuleFileNameW
KERNEL32.DLLGetVersionExA
KERNEL32.DLLGetVersionExW
KERNEL32.DLLLoadLibraryA
KERNEL32.DLLGetModuleFileNameA
KERNEL32.DLLCreateEventA
KERNEL32.DLLOpenEventA
KERNEL32.DLLCreateFileMappingA
KERNEL32.DLLCreateMutexA
KERNEL32.DLLSetEnvironmentVariableA
KERNEL32.DLLGetEnvironmentStringsW
KERNEL32.DLLCreateProcessA
KERNEL32.DLLCreateProcessW
KERNEL32.DLLGetDateFormatA
KERNEL32.DLLGetTimeFormatA
KERNEL32.DLLLocalAlloc
KERNEL32.DLLAreFileApisANSI
KERNEL32.DLLGetOEMCP
KERNEL32.DLLGetACP
KERNEL32.DLLFreeEnvironmentStringsW
KERNEL32.DLLGetEnvironmentStrings
KERNEL32.DLLFreeEnvironmentStringsA
KERNEL32.DLLGetStartupInfoA
KERNEL32.DLLSetHandleCount
KERNEL32.DLLTlsFree
KERNEL32.DLLTlsSetValue
KERNEL32.DLLTlsAlloc
KERNEL32.DLLTlsGetValue
KERNEL32.DLLHeapCreate
KERNEL32.DLLGetCommandLineA
KERNEL32.DLLGetFileType
KERNEL32.DLLGetSystemTimeAsFileTime
KERNEL32.DLLIsDebuggerPresent
KERNEL32.DLLSetUnhandledExceptionFilter
KERNEL32.DLLUnhandledExceptionFilter
KERNEL32.DLLRtlUnwind
KERNEL32.DLLGetThreadLocale
KERNEL32.DLLGetLocaleInfoA
KERNEL32.DLLRaiseException
KERNEL32.DLLGetProcessHeap
KERNEL32.DLLHeapSize
KERNEL32.DLLHeapReAlloc
KERNEL32.DLLHeapFree
KERNEL32.DLLHeapAlloc
KERNEL32.DLLHeapDestroy
KERNEL32.DLLFlushFileBuffers
KERNEL32.DLLGetStringTypeW
KERNEL32.DLLGetStringTypeA
KERNEL32.DLLSetStdHandle
KERNEL32.DLLGetCurrentProcess
KERNEL32.DLLSleep
KERNEL32.DLLSetNamedPipeHandleState
KERNEL32.DLLReadFile
KERNEL32.DLLCancelIo
KERNEL32.DLLGetOverlappedResult
KERNEL32.DLLPeekNamedPipe
KERNEL32.DLLTerminateProcess
KERNEL32.DLLGetCurrentProcessId
KERNEL32.DLLGetModuleHandleW
KERNEL32.DLLGetTickCount
KERNEL32.DLLCreateFileW
KERNEL32.DLLGetLastError
KERNEL32.DLLWriteFile
KERNEL32.DLLCloseHandle
KERNEL32.DLLFormatMessageW
KERNEL32.DLLLocalFree
KERNEL32.DLLLoadLibraryW
KERNEL32.DLLGetProcAddress
KERNEL32.DLLGetConsoleOutputCP
KERNEL32.DLLCompareStringA
KERNEL32.DLLCompareStringW
KERNEL32.DLLWriteConsoleA
KERNEL32.DLLGetConsoleMode
KERNEL32.DLLLCMapStringA
KERNEL32.DLLGetConsoleCP
ADVAPI32.dllRegQueryValueExA
ADVAPI32.dllRegOpenKeyExA
ADVAPI32.dllSetSecurityDescriptorDacl
ADVAPI32.dllInitializeSecurityDescriptor
ADVAPI32.dllRegQueryValueExW
ADVAPI32.dllRegOpenKeyExW
ADVAPI32.dllRegCloseKey
ADVAPI32.dllReportEventW
ADVAPI32.dllRegisterEventSourceW
ADVAPI32.dllDeregisterEventSource
COMCTL32.dll17
iphlpapi.dllGetAdaptersInfo
SHLWAPI.dllPathFileExistsW
USER32.dllMessageBoxW
USER32.dllAllowSetForegroundWindow
USER32.dllMessageBoxA
USER32.dllUnregisterClassA
VERSION.dllGetFileVersionInfoSizeW
VERSION.dllVerQueryValueW
VERSION.dllGetFileVersionInfoW
ordentry_vafunction_name
10x356bd5PSM_0
20x86b2PSA_DummyFunction
30x4e79PSA_Uninitialize
40x55b3PSC_EnterGlobalCriticalSection
50x51a2PSC_FinishInitializationFailure
60x511cPSC_FinishInitializationSuccess
70x533cPSC_GetErrorInformation
80x561bPSC_LeaveGlobalCriticalSection
90x5705PSC_LoadString
100x52d4PSC_PerformInitializationAtValidLicense
110x500bPSC_StartInitialization
120x5241PSC_Uninitialize
130x819480ProtectSdkVersion
module_nameocevogyv.dll
flags0
timestamp2018-09-26 11:35:05
version0.0
ordinal_base1
nFunctions13
nNames13
Names(13)0x81878c
Functions(13)0x818758
NameOrdinals(13)0x8187c0

StringTable 040904E4

CompanyNameCrytek Unkraine LLC
FileDescriptionHost Library
FileVersion5.91.1807.284
InternalNameocevogyv.dll
LegalCopyright(c) Crytek Unkraine LLC
OriginalFilenameocevogyv.dll
ProductNameWarface
ProductVersion1, 18000, 944, 21500
BuildInfo5.91.1807.284, 26.09.18
ProjectGuidHashD509A45A3BB8B710C411E95055EC802C
ActionGuid{890c0092-8757-4213-9862-c538f852bac8}
TradeNameSF MMOG

VS_FIXEDFILEINFO

FileVersion5.91.1807.284
ProductVersion0.0.0.0
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType2
FileSubtype0
offsetsizetypecomment
15c115HTM#
15d08579232BINoverlay data past EOF#
Scanning the drive for archives:
1 file, 8584816 bytes (8384 KiB)



Errors: 1
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] can't find file_offset of VA 0x81e378