sfArkL.dll

info
MZ
PE
imports
exports
foremost
7zip
hexdump
disasm
log
discuss
donate

filename	sfArkL.dll
size	27676 (0x6c1c)
md5	4a7fdb11c95750dc20dfb03200c575db

type	PE32 executable (DLL) (console) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x80

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	9
TimeDateStamp	0x38408b0e
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x210e
Magic	0x10b
LinkerVersion	1.3
SizeOfCode	0xd000
SizeOfInitializedData	0x3400
SizeOfUninitializedData	0x200
AddressOfEntryPoint	0x16001
BaseOfCode	0x1000
BaseOfData	0xe000
ImageBase	0x10000000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	1.0
ImageVersion	0.0
SubsystemVersion	4.0
Reserved1	0
SizeOfImage	0x19000
SizeOfHeaders	0x400
CheckSum	0
Subsystem	3
DllCharacteristics	0
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

ASPack v2.11c

This file is packed with ASPack. Analysis will be incomplete without unpacking.
We can unpack it for you.

»» Analyze unpacked file

Sections

name	va	vsize	raw size	flags
.text	0x1000	0xd000	0x3c00	RW- IDATA
.bss	0xe000	0xc	0	RW- IDATA
.rdata	0xf000	0x1000	0x200	RW- IDATA
.data	0x10000	0x3000	0xe00	RW- IDATA
.idata	0x13000	0x1000	0x200	RW- IDATA
.reloc	0x14000	0x1000	0x400	RW- IDATA
.edata	0x15000	0x1000	0x200	RW- IDATA
.asp943	0x16000	0x2000	0x1400	RW- IDATA
.data	0x18000	0x1000	0	RW- IDATA

Data Directory

type	va	size
EXPORT	0x15000	0x1e4
IMPORT	0x17248	0x5c
RESOURCE	0	0
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0x170f0	8
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0	0
Delay_IAT	0	0
CLR_Header	0	0
	0	0x100000

module_name	hint	ord	function_name
kernel32.dll			GetProcAddress
kernel32.dll			GetModuleHandleA
kernel32.dll			LoadLibraryA
crtdll.dll			_fdopen

ord	entry_va	function_name
1	0x1434	_x01_memcomp
2	0x14c8	_x02_OpenZip
3	0x14f0	_x03_CreateFileInZip
4	0x157e	_x04_WriteToZip
5	0x1598	_x05_CloseFileInZip
6	0x15ae	_x06_CloseZip
7	0x15c4	_x07_Adler32
8	0x15da	_x08_OpenUnzip
9	0x1608	_x09_CloseUnzip
10	0x1615	_x10_NextUnzipFilename
11	0x1678	_x11_OpenFileForUnzip
12	0x16ae	_x12_CloseFileForUnzip
13	0x16bb	_x13_ReadFromUnzip
14	0x1354	_x14_mmxWDiff
15	0x13ed	_x15_mmxWShift

module_name	sfarkl.dll
flags	0
timestamp	1999-11-28 01:53:18
version	0.0
ordinal_base	1
nFunctions	15
nNames	15
Names(15)	0x15070
Functions(15)	0x15034
NameOrdinals(15)	0x150ac

show previews

offset	size	type	comment
0	27648	DLL	11/28/1999 01:53:18	#
15c1	15	HTM		#
6c00	28	BIN	overlay data past EOF	#

Scanning the drive for archives:
1 file, 27676 bytes (28 KiB)



Errors: 1

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] can't find file_offset of VA 0x0