cheat.dll

info
MZ
PE
imports
foremost
hexdump
disasm
log
discuss
donate

filename	cheat.dll
size	1170432 (0x11dc00)
md5	4be02e92f7243666fbcfd33e6a6b4ac1

type	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x100

Rich Header

lib id	version	times used
147	30729	16
199	41118	1
259	24123	7
260	24123	11
156	21202	2
257	24123	4
261	24123	21
203	65501	9
1	0	188
265	24215	38
258	24215	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	6
TimeDateStamp	0x59407a0b
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x2102
Magic	0x10b
LinkerVersion	14.0
SizeOfCode	0x108a00
SizeOfInitializedData	0x1c200
SizeOfUninitializedData	0
AddressOfEntryPoint	0x1053cd
BaseOfCode	0x1000
BaseOfData	0x10a000
ImageBase	0x10000000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	6.0
ImageVersion	0.0
SubsystemVersion	6.0
Reserved1	0
SizeOfImage	0x129000
SizeOfHeaders	0x400
CheckSum	0
Subsystem	2
DllCharacteristics	0x140
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

MS Visual C++ 6.0 - 8.0

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x1089cf	0x108a00	R-X CODE
.rdata	0x10a000	0xd9e6	0xda00	R-- IDATA
.data	0x118000	0x877c	0x1400	RW- IDATA
.gfids	0x121000	0x50	0x200	R-- IDATA
.tls	0x122000	9	0x200	RW- IDATA
.reloc	0x123000	0x5aac	0x5c00	R-- IDATA DISCARDABLE

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x1166dc	0x140
RESOURCE	0	0
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0x123000	0x5aac
DEBUG	0x112570	0x38
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0x112604	0x18
LOAD_CONFIG	0x1125a8	0x40
Bound_IAT	0	0
IAT	0x10a000	0x290
Delay_IAT	0	0
CLR_Header	0	0

TLS

raw start	raw end	index	callbks	zero fill	flags
0x10122000	0x10122008	0x10119594	0x1010a2f4	0	0x300000

module_name	hint	function_name
KERNEL32.dll	1441	VirtualProtect
KERNEL32.dll	612	GetModuleHandleA
KERNEL32.dll	1362	Sleep
KERNEL32.dll	232	CreateThread
KERNEL32.dll	977	MultiByteToWideChar
KERNEL32.dll	1070	QueryPerformanceFrequency
KERNEL32.dll	1069	QueryPerformanceCounter
KERNEL32.dll	791	GlobalAlloc
KERNEL32.dll	802	GlobalLock
KERNEL32.dll	809	GlobalUnlock
KERNEL32.dll	754	GetTickCount
KERNEL32.dll	669	GetProcAddress
KERNEL32.dll	521	GetCurrentProcess
KERNEL32.dll	859	IsBadCodePtr
KERNEL32.dll	905	K32GetModuleInformation
KERNEL32.dll	665	GetPrivateProfileStringA
KERNEL32.dll	293	EnterCriticalSection
KERNEL32.dll	930	LeaveCriticalSection
KERNEL32.dll	261	DeleteCriticalSection
KERNEL32.dll	1264	SetEvent
KERNEL32.dll	1186	ResetEvent
KERNEL32.dll	1452	WaitForSingleObjectEx
KERNEL32.dll	182	CreateEventW
KERNEL32.dll	615	GetModuleHandleW
KERNEL32.dll	1410	UnhandledExceptionFilter
KERNEL32.dll	1347	SetUnhandledExceptionFilter
KERNEL32.dll	1377	TerminateProcess
KERNEL32.dll	877	IsProcessorFeaturePresent
KERNEL32.dll	871	IsDebuggerPresent
KERNEL32.dll	522	GetCurrentProcessId
KERNEL32.dll	526	GetCurrentThreadId
KERNEL32.dll	726	GetSystemTimeAsFileTime
KERNEL32.dll	843	InitializeSListHead
KERNEL32.dll	173	CreateDirectoryA
KERNEL32.dll	127	CloseHandle
KERNEL32.dll	1510	WritePrivateProfileStringA
USER32.dll	296	GetClipboardData
USER32.dll	710	SetClipboardData
USER32.dll	889	mouse_event
USER32.dll	323	GetForegroundWindow
USER32.dll	800	ShowWindow
USER32.dll	703	SetActiveWindow
USER32.dll	29	CallWindowProcA
USER32.dll	542	LoadCursorA
USER32.dll	713	SetCursor
USER32.dll	606	OpenClipboard
USER32.dll	293	GetClientRect
USER32.dll	75	CloseClipboard
USER32.dll	223	EmptyClipboard
USER32.dll	780	SetWindowLongA
USER32.dll	262	FindWindowA
USER32.dll	278	GetAsyncKeyState
SHELL32.dll	204	SHGetFolderPathA
MSVCP140.dll	654	void __cdecl std::_Xlength_error(char const *) ?_Xlength_error@std@@YAXPBD@Z
MSVCP140.dll	165	public: __thiscall std::_Lockit::~_Lockit(void) ??1_Lockit@std@@QAE@XZ
MSVCP140.dll	109	public: __thiscall std::_Lockit::_Lockit(int) ??0_Lockit@std@@QAE@H@Z
MSVCP140.dll	469	private: static class std::locale::_Locimp * __cdecl std::locale::_Getgloballocale(void) ?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
MSVCP140.dll	406	__int64 const std::_BADOFF ?_BADOFF@std@@3_JB
MSVCP140.dll	969	public: static class std::locale::id std::codecvt<char, char, struct _Mbstatet>::id ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
MSVCP140.dll	655	void __cdecl std::_Xout_of_range(char const *) ?_Xout_of_range@std@@YAXPBD@Z
MSVCP140.dll	433	public: static unsigned int __cdecl std::codecvt<char, char, struct _Mbstatet>::_Getcat(class std::locale::facet const * , class std::locale const ) ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
MSVCP140.dll	47	protected: __thiscall std::basic_streambuf<char, struct std::char_traits<char> >::basic_streambuf<char, struct std::char_traits<char> >(void) ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
MSVCP140.dll	501	protected: void __thiscall std::basic_streambuf<char, struct std::char_traits<char> >::_Init(void) ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
MSVCP140.dll	1319	public: int __thiscall std::codecvt<char, char, struct _Mbstatet>::unshift(struct _Mbstatet &, char , char , char * &)const ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z
MSVCP140.dll	12	protected: __thiscall std::basic_ios<char, struct std::char_traits<char> >::basic_ios<char, struct std::char_traits<char> >(void) ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
MSVCP140.dll	37	public: __thiscall std::basic_ostream<char, struct std::char_traits<char> >::basic_ostream<char, struct std::char_traits<char> >(class std::basic_streambuf<char, struct std::char_traits<char> > *, bool) ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
MSVCP140.dll	1018	public: int __thiscall std::codecvt<char, char, struct _Mbstatet>::in(struct _Mbstatet &, char const , char const , char const * &, char , char , char * &)const ?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
MSVCP140.dll	1075	public: int __thiscall std::codecvt<char, char, struct _Mbstatet>::out(struct _Mbstatet &, char const , char const , char const * &, char , char , char * &)const ?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
MSVCP140.dll	125	public: virtual __thiscall std::basic_ios<char, struct std::char_traits<char> >::~basic_ios<char, struct std::char_traits<char> >(void) ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
MSVCP140.dll	137	public: virtual __thiscall std::basic_streambuf<char, struct std::char_traits<char> >::~basic_streambuf<char, struct std::char_traits<char> >(void) ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
MSVCP140.dll	1237	protected: virtual __int64 __thiscall std::basic_streambuf<char, struct std::char_traits<char> >::showmanyc(void) ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
MSVCP140.dll	1347	protected: virtual __int64 __thiscall std::basic_streambuf<char, struct std::char_traits<char> >::xsgetn(char *, __int64) ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
MSVCP140.dll	1350	protected: virtual __int64 __thiscall std::basic_streambuf<char, struct std::char_traits<char> >::xsputn(char const *, __int64) ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
MSVCP140.dll	134	public: virtual __thiscall std::basic_ostream<char, struct std::char_traits<char> >::~basic_ostream<char, struct std::char_traits<char> >(void) ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
MSVCP140.dll	669	public: bool __thiscall std::codecvt_base::always_noconv(void)const ?always_noconv@codecvt_base@std@@QBE_NXZ
MSVCP140.dll	305	public: __thiscall std::locale::id::operator unsigned int(void) ??Bid@locale@std@@QAEIXZ
MSVCP140.dll	651	void __cdecl std::_Xbad_alloc(void) ?_Xbad_alloc@std@@YAXXZ
d3dx9_43.dll	92	D3DXCreateTexture
d3dx9_43.dll	201	D3DXMatrixOrthoOffCenterLH
IMM32.dll	119	ImmSetCompositionWindow
IMM32.dll	59	ImmGetContext
VCRUNTIME140.dll	37	__std_type_info_destroy_list
VCRUNTIME140.dll	71	memmove
VCRUNTIME140.dll	35	__std_terminate
VCRUNTIME140.dll	72	memset
VCRUNTIME140.dll	53	_except_handler4_common
VCRUNTIME140.dll	1	_CxxThrowException
VCRUNTIME140.dll	48	__vcrt_InitializeCriticalSectionEx
VCRUNTIME140.dll	16	__CxxFrameHandler3
VCRUNTIME140.dll	70	memcpy
VCRUNTIME140.dll	33	__std_exception_copy
VCRUNTIME140.dll	34	__std_exception_destroy
VCRUNTIME140.dll	74	strchr
VCRUNTIME140.dll	76	strstr
VCRUNTIME140.dll	68	memchr
api-ms-win-crt-runtime-l1-1-0.dll	65	_seh_filter_dll
api-ms-win-crt-runtime-l1-1-0.dll	25	_configure_narrow_argv
api-ms-win-crt-runtime-l1-1-0.dll	53	_initialize_narrow_environment
api-ms-win-crt-runtime-l1-1-0.dll	54	_initialize_onexit_table
api-ms-win-crt-runtime-l1-1-0.dll	62	_register_onexit_function
api-ms-win-crt-runtime-l1-1-0.dll	36	_execute_onexit_table
api-ms-win-crt-runtime-l1-1-0.dll	31	_crt_atexit
api-ms-win-crt-runtime-l1-1-0.dll	23	_cexit
api-ms-win-crt-runtime-l1-1-0.dll	56	_initterm
api-ms-win-crt-runtime-l1-1-0.dll	57	_initterm_e
api-ms-win-crt-runtime-l1-1-0.dll	59	_invalid_parameter_noinfo_noreturn
api-ms-win-crt-runtime-l1-1-0.dll	58	_invalid_parameter_noinfo
api-ms-win-crt-runtime-l1-1-0.dll	106	terminate
api-ms-win-crt-runtime-l1-1-0.dll	35	_errno
api-ms-win-crt-stdio-l1-1-0.dll	15	__stdio_common_vsprintf_s
api-ms-win-crt-stdio-l1-1-0.dll	13	__stdio_common_vsprintf
api-ms-win-crt-stdio-l1-1-0.dll	47	_fseeki64
api-ms-win-crt-stdio-l1-1-0.dll	136	fsetpos
api-ms-win-crt-stdio-l1-1-0.dll	157	ungetc
api-ms-win-crt-stdio-l1-1-0.dll	152	setvbuf
api-ms-win-crt-stdio-l1-1-0.dll	121	fgetpos
api-ms-win-crt-stdio-l1-1-0.dll	57	_get_stream_buffer_pointers
api-ms-win-crt-stdio-l1-1-0.dll	138	fwrite
api-ms-win-crt-stdio-l1-1-0.dll	120	fgetc
api-ms-win-crt-stdio-l1-1-0.dll	127	fputc
api-ms-win-crt-stdio-l1-1-0.dll	137	ftell
api-ms-win-crt-stdio-l1-1-0.dll	16	__stdio_common_vsscanf
api-ms-win-crt-stdio-l1-1-0.dll	131	fread
api-ms-win-crt-stdio-l1-1-0.dll	98	_wfopen
api-ms-win-crt-stdio-l1-1-0.dll		__acrt_iob_func
api-ms-win-crt-stdio-l1-1-0.dll	119	fflush
api-ms-win-crt-stdio-l1-1-0.dll	3	__stdio_common_vfprintf
api-ms-win-crt-stdio-l1-1-0.dll	135	fseek
api-ms-win-crt-stdio-l1-1-0.dll	116	fclose
api-ms-win-crt-convert-l1-1-0.dll	80	atoi
api-ms-win-crt-convert-l1-1-0.dll	79	atof
api-ms-win-crt-heap-l1-1-0.dll	24	free
api-ms-win-crt-heap-l1-1-0.dll	25	malloc
api-ms-win-crt-heap-l1-1-0.dll	8	_callnewh
api-ms-win-crt-string-l1-1-0.dll	143	strncpy
api-ms-win-crt-string-l1-1-0.dll	108	isprint
api-ms-win-crt-string-l1-1-0.dll	42	_stricmp
api-ms-win-crt-utility-l1-1-0.dll	27	rand
api-ms-win-crt-utility-l1-1-0.dll	25	qsort
api-ms-win-crt-filesystem-l1-1-0.dll	36	_unlock_file
api-ms-win-crt-filesystem-l1-1-0.dll	22	_lock_file
api-ms-win-crt-math-l1-1-0.dll	33	__libm_sse2_cosf
api-ms-win-crt-math-l1-1-0.dll	35	__libm_sse2_expf
api-ms-win-crt-math-l1-1-0.dll	41	__libm_sse2_powf
api-ms-win-crt-math-l1-1-0.dll	43	__libm_sse2_sinf
api-ms-win-crt-math-l1-1-0.dll	64	_except1
api-ms-win-crt-math-l1-1-0.dll	162	ceil
api-ms-win-crt-math-l1-1-0.dll	26	__libm_sse2_acosf
api-ms-win-crt-math-l1-1-0.dll	7	_CIfmod

show previews

offset	size	type	comment
0	1170432	DLL	06/13/2017 23:49:31	#
15c1	15	HTM		#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] can't find file_offset of VA 0x119594