filename1.dll
size4600595 (0x463313)
md54dfe0d9885c5c1dd8ffe48b2081561d2
typePE32 executable (DLL) (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavscan pending
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x108

Rich Header

lib idversiontimes used
2593079537
26130795176
2603079526
2603242017
2613242074
2593242027
1197822
2573079511
10186
2653254213
258325421

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections4
TimeDateStamp0x653973db
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x2102
Magic0x10b
LinkerVersion14.36
SizeOfCode0x8d400
SizeOfInitializedData0x15fc00
SizeOfUninitializedData0
AddressOfEntryPoint0x613ac
BaseOfCode0x1000
BaseOfData0x8f000
ImageBase0x10000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.0
ImageVersion0.0
SubsystemVersion6.0
Reserved10
SizeOfImage0x1f0000
SizeOfHeaders0x400
CheckSum0
Subsystem2
DllCharacteristics0x140
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v6.0 DLL

Sections

namevavsizeraw sizeflags
.text0x10000x8d22c0x8d400R-X CODE
.rdata0x8f0000x1576200x157800R-- IDATA
.data0x1e70000x2a440x1a00RW- IDATA
.reloc0x1ea0000x56dc0x5800R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0x1e59500x50
RESOURCE00
EXCEPTION00
SECURITY00
BASERELOC0x1ea0000x56dc
DEBUG0x1e0be80x70
ARCHITECTURE00
GLOBALPTR00
TLS0x1e0c800x18
LOAD_CONFIG0x1e0b280x40
Bound_IAT00
IAT0x8f0000x238
Delay_IAT00
CLR_Header00

TLS

raw
start		raw
end		indexcallbkszero
fill		flags
0x101e2aac0x101e2ab40x101e8c400x1008f28c00x300000
module_namehintordfunction_name
KERNEL32.dll447FreeLibrary
KERNEL32.dll1133QueryPerformanceCounter
KERNEL32.dll843GlobalAlloc
KERNEL32.dll850GlobalFree
KERNEL32.dll854GlobalLock
KERNEL32.dll1574WideCharToMultiByte
KERNEL32.dll861GlobalUnlock
KERNEL32.dll1330SetEndOfFile
KERNEL32.dll1593WriteConsoleW
KERNEL32.dll876HeapSize
KERNEL32.dll218CreateFileW
KERNEL32.dll1392SetStdHandle
KERNEL32.dll717GetProcessHeap
KERNEL32.dll1334SetEnvironmentVariableW
KERNEL32.dll446FreeEnvironmentStringsW
KERNEL32.dll588GetEnvironmentStringsW
KERNEL32.dll491GetCommandLineW
KERNEL32.dll490GetCommandLineA
KERNEL32.dll687GetOEMCP
KERNEL32.dll1134QueryPerformanceFrequency
KERNEL32.dll939IsValidCodePage
KERNEL32.dll416FindNextFileW
KERNEL32.dll399FindFirstFileExW
KERNEL32.dll393FindClose
KERNEL32.dll812GetTimeZoneInformation
KERNEL32.dll874HeapReAlloc
KERNEL32.dll609GetFileSizeEx
KERNEL32.dll532GetConsoleOutputCP
KERNEL32.dll1594WriteFile
KERNEL32.dll435FlushFileBuffers
KERNEL32.dll360EnumSystemLocalesW
KERNEL32.dll816GetUserDefaultLCID
KERNEL32.dll941IsValidLocale
KERNEL32.dll635GetLocaleInfoW
KERNEL32.dll977LCMapStringW
KERNEL32.dll170CompareStringW
KERNEL32.dll810GetTimeFormatW
KERNEL32.dll993LoadLibraryA
KERNEL32.dll1039MultiByteToWideChar
KERNEL32.dll655GetModuleHandleW
KERNEL32.dll566GetDateFormatW
KERNEL32.dll1169ReadConsoleW
KERNEL32.dll528GetConsoleMode
KERNEL32.dll1349SetFilePointerEx
KERNEL32.dll710GetProcAddress
KERNEL32.dll260CreateThread
KERNEL32.dll560GetCurrentThread
KERNEL32.dll454GetACP
KERNEL32.dll1524VirtualProtect
KERNEL32.dll1526VirtualQuery
KERNEL32.dll561GetCurrentThreadId
KERNEL32.dll901InterlockedCompareExchange
KERNEL32.dll1263ResumeThread
KERNEL32.dll436FlushInstructionCache
KERNEL32.dll556GetCurrentProcess
KERNEL32.dll1402SetThreadContext
KERNEL32.dll787GetThreadContext
KERNEL32.dll1521VirtualFree
KERNEL32.dll631GetLastError
KERNEL32.dll1453SuspendThread
KERNEL32.dll280DebugBreak
KERNEL32.dll1518VirtualAlloc
KERNEL32.dll1365SetLastError
KERNEL32.dll886InitOnceComplete
KERNEL32.dll885InitOnceBeginInitialize
KERNEL32.dll753GetStringTypeW
KERNEL32.dll898InitializeSRWLock
KERNEL32.dll1236ReleaseSRWLockExclusive
KERNEL32.dllAcquireSRWLockExclusive
KERNEL32.dll1485TryAcquireSRWLockExclusive
KERNEL32.dll325EnterCriticalSection
KERNEL32.dll989LeaveCriticalSection
KERNEL32.dll894InitializeCriticalSectionEx
KERNEL32.dll290DeleteCriticalSection
KERNEL32.dll321EncodePointer
KERNEL32.dll283DecodePointer
KERNEL32.dll976LCMapStringEx
KERNEL32.dll634GetLocaleInfoEx
KERNEL32.dll771GetSystemTimeAsFileTime
KERNEL32.dll168CompareStringEx
KERNEL32.dll469GetCPInfo
KERNEL32.dll148CloseHandle
KERNEL32.dll893InitializeCriticalSectionAndSpinCount
KERNEL32.dll1336SetEvent
KERNEL32.dll1256ResetEvent
KERNEL32.dll1536WaitForSingleObjectEx
KERNEL32.dll206CreateEventW
KERNEL32.dll933IsProcessorFeaturePresent
KERNEL32.dll925IsDebuggerPresent
KERNEL32.dll1493UnhandledExceptionFilter
KERNEL32.dll1428SetUnhandledExceptionFilter
KERNEL32.dll746GetStartupInfoW
KERNEL32.dll557GetCurrentProcessId
KERNEL32.dll897InitializeSListHead
KERNEL32.dll1460TerminateProcess
KERNEL32.dll1269RtlUnwind
KERNEL32.dll1155RaiseException
KERNEL32.dll906InterlockedFlushSList
KERNEL32.dll1478TlsAlloc
KERNEL32.dll1480TlsGetValue
KERNEL32.dll1481TlsSetValue
KERNEL32.dll1479TlsFree
KERNEL32.dll995LoadLibraryExW
KERNEL32.dll1172ReadFile
KERNEL32.dll370ExitProcess
KERNEL32.dll654GetModuleHandleExW
KERNEL32.dll651GetModuleFileNameW
KERNEL32.dll871HeapFree
KERNEL32.dll867HeapAlloc
KERNEL32.dll748GetStdHandle
KERNEL32.dll611GetFileType
USER32.dll888SetWindowLongW
USER32.dll885SetWindowDisplayAffinity
USER32.dll289GetAsyncKeyState
USER32.dll664OpenClipboard
USER32.dll79CloseClipboard
USER32.dll232EmptyClipboard
USER32.dll308GetClipboardData
USER32.dll802SetClipboardData
USER32.dll776ScreenToClient
USER32.dll293GetCapture
USER32.dll77ClientToScreen
USER32.dll936TrackMouseEvent
USER32.dll344GetForegroundWindow
USER32.dll597LoadCursorW
USER32.dll796SetCapture
USER32.dll806SetCursor
USER32.dll305GetClientRect
USER32.dll585IsWindowUnicode
USER32.dll762ReleaseCapture
USER32.dll808SetCursorPos
USER32.dll320GetCursorPos
USER32.dll487GetWindowLongW
USER32.dll360GetKeyState
USER32.dll33CallWindowProcW
IMM32.dll114ImmSetCandidateWindow
IMM32.dll119ImmSetCompositionWindow
IMM32.dll107ImmReleaseContext
IMM32.dll59ImmGetContext
offsetsizetypecomment
02015744DLL10/25/2023 20:00:27#
15c115HTM#
1ec2002584851BINoverlay data past EOF#
Scanning the drive for archives:
1 file, 4600595 bytes (4493 KiB)



Errors: 1
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] can't find file_offset of VA 0x1e8c40