filenameShtrihTemplate.dll
size1174544 (0x11ec10)
md54fa3676f336c8e0e16a82c8376ee85fd
typePE32 executable (DLL) (console) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x80

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections0x12
TimeDateStamp3
PointerToSymbolTable0xc4e00
NumberOfSymbols0x1f12
SizeOfOptionalHeader0xe0
Characteristics0x2106
Magic0x10b
LinkerVersion2.24
SizeOfCode0x22c00
SizeOfInitializedData0x40000
SizeOfUninitializedData0x600
AddressOfEntryPoint0x1420
BaseOfCode0x1000
BaseOfData0x24000
ImageBase0x64240000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion4.0
ImageVersion1.0
SubsystemVersion4.0
Reserved10
SizeOfImage0xcd000
SizeOfHeaders0x600
CheckSum0x125f24
Subsystem3
DllCharacteristics0
SizeOfStackReserve0x200000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Sections

namevavsizeraw sizeflags
.text0x10000x22a800x22c00R-X CODE IDATA
.data0x240000x4ad40x4c00RW- IDATA
.rdata0x290000x4bec0x4c00R-- IDATA
/40x2e0000x106fc0x10800R-- IDATA
.bss0x3f0000x4680RW- UDATA
.edata0x400000x9eb0xa00R-- IDATA
.idata0x410000x9980xa00RW- IDATA
.CRT0x420000x300x200RW- IDATA
.tls0x430000x200x200RW- IDATA
.reloc0x440000x1adc0x1c00R-- IDATA DISCARDABLE
/140x460000xeb00x1000R-- IDATA DISCARDABLE
/290x470000x6bfa40x6c000R-- IDATA DISCARDABLE
/410xb30000x48f20x4a00R-- IDATA DISCARDABLE
/550xb80000x5eea0x6000R-- IDATA DISCARDABLE
/670xbe0000x380x200R-- IDATA DISCARDABLE
/800xbf0000x28510x2a00R-- IDATA DISCARDABLE
/910xc20000x87220x8800R-- IDATA DISCARDABLE
/1020xcb0000x19d80x1a00R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT0x400000x9eb
IMPORT0x410000x998
RESOURCE00
EXCEPTION00
SECURITY00
BASERELOC0x440000x1adc
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS0x430040x18
LOAD_CONFIG00
Bound_IAT00
IAT0x411980x15c
Delay_IAT00
CLR_Header00

TLS

raw
start		raw
end		indexcallbkszero
fill		flags
0x642830000x6428301c0x6427f0300x6428201800
module_namehintordfunction_name
KERNEL32.dll83CloseHandle
KERNEL32.dll132CreateEventA
KERNEL32.dll173CreateSemaphoreA
KERNEL32.dll212DeleteCriticalSection
KERNEL32.dll234DuplicateHandle
KERNEL32.dll239EnterCriticalSection
KERNEL32.dll356FreeLibrary
KERNEL32.dll452GetCurrentProcess
KERNEL32.dll453GetCurrentProcessId
KERNEL32.dll456GetCurrentThread
KERNEL32.dll457GetCurrentThreadId
KERNEL32.dll512GetHandleInformation
KERNEL32.dll515GetLastError
KERNEL32.dll533GetModuleHandleA
KERNEL32.dll581GetProcAddress
KERNEL32.dll582GetProcessAffinityMask
KERNEL32.dll635GetSystemTimeAsFileTime
KERNEL32.dll649GetThreadContext
KERNEL32.dll657GetThreadPriority
KERNEL32.dll663GetTickCount
KERNEL32.dll747InitializeCriticalSection
KERNEL32.dll806LeaveCriticalSection
KERNEL32.dll809LoadLibraryA
KERNEL32.dll915QueryPerformanceCounter
KERNEL32.dll962ReleaseSemaphore
KERNEL32.dll979ResetEvent
KERNEL32.dll982ResumeThread
KERNEL32.dll1038SetCriticalSectionSpinCount
KERNEL32.dll1053SetEvent
KERNEL32.dll1078SetLastError
KERNEL32.dll1089SetProcessAffinityMask
KERNEL32.dll1109SetThreadContext
KERNEL32.dll1117SetThreadPriority
KERNEL32.dll1127SetUnhandledExceptionFilter
KERNEL32.dll1140Sleep
KERNEL32.dll1148SuspendThread
KERNEL32.dll1154TerminateProcess
KERNEL32.dll1159TlsAlloc
KERNEL32.dll1161TlsGetValue
KERNEL32.dll1162TlsSetValue
KERNEL32.dll1169TryEnterCriticalSection
KERNEL32.dll1174UnhandledExceptionFilter
KERNEL32.dll1206VirtualProtect
KERNEL32.dll1209VirtualQuery
KERNEL32.dll1216WaitForMultipleObjects
KERNEL32.dll1218WaitForSingleObject
msvcrt.dll55__dllonexit
msvcrt.dll144_amsg_exit
msvcrt.dll157_beginthreadex
msvcrt.dll218_endthreadex
msvcrt.dll292_ftime
msvcrt.dll349_initterm
msvcrt.dll353_iob
msvcrt.dll458_lock
msvcrt.dll625_onexit
msvcrt.dll688_setjmp3
msvcrt.dll838_unlock
msvcrt.dll1007_write
msvcrt.dll1013_wsetlocale
msvcrt.dll1054abort
msvcrt.dll1067calloc
msvcrt.dll1078exit
msvcrt.dll1094fprintf
msvcrt.dll1096fputc
msvcrt.dll1097fputs
msvcrt.dll1101free
msvcrt.dll1112fwrite
msvcrt.dll1158longjmp
msvcrt.dll1159malloc
msvcrt.dll1162mbstowcs
msvcrt.dll1165memchr
msvcrt.dll1166memcmp
msvcrt.dll1167memcpy
msvcrt.dll1168memmove
msvcrt.dll1170memset
msvcrt.dll1175printf
msvcrt.dll1186realloc
msvcrt.dll1198sprintf
msvcrt.dll1207strcmp
msvcrt.dll1212strerror
msvcrt.dll1215strlen
msvcrt.dll1218strncmp
msvcrt.dll1251vfprintf
msvcrt.dll1274wcslen
msvcrt.dll1290wcstombs
ordentry_vafunction_name
10x16b3DestroyObject
20x16f7GetClassNames
30x165fGetClassObject
40x1d20_ZN12CAddInNative10CallAsFuncElP9_tVariantS1_l@20
50x1c76_ZN12CAddInNative10CallAsProcElP9_tVariantl@16
60x1b10_ZN12CAddInNative10FindMethodEPKw@8
70x1bfe_ZN12CAddInNative10GetNParamsEl@8
80x1a12_ZN12CAddInNative10GetPropValElP9_tVariant@12
90x1a4c_ZN12CAddInNative10SetPropValElP9_tVariant@12
100x1aea_ZN12CAddInNative11GetNMethodsEv@4
110x1952_ZN12CAddInNative11GetPropNameEll@12
120x1b3e_ZN12CAddInNative13GetMethodNameEll@12
130x1e8e_ZN12CAddInNative13setMemManagerEPv@8
140x1a86_ZN12CAddInNative14IsPropReadableEl@8
150x1ab8_ZN12CAddInNative14IsPropWritableEl@8
160x1c30_ZN12CAddInNative16GetParamDefValueEllP9_tVariant@16
170x1dde_ZN12CAddInNative19RegisterExtensionAsEPPw@8
180x18f6_ZN12CAddInNative4DoneEv@4
190x18be_ZN12CAddInNative4InitEPv@8
200x1dd2_ZN12CAddInNative7GetInfoEv@4
210x1924_ZN12CAddInNative8FindPropEPKw@8
220x18fe_ZN12CAddInNative9GetNPropsEv@4
230x1c44_ZN12CAddInNative9HasRetValEl@8
240x1e68_ZN12CAddInNative9SetLocaleEPKw@8
250x17ba_ZN12CAddInNativeC1EPKw
260x17ba_ZN12CAddInNativeC2EPKw
270x1894_ZN12CAddInNativeD0Ev
280x1836_ZN12CAddInNativeD1Ev
290x1836_ZN12CAddInNativeD2Ev
300x1fb0_ZNK12CAddInNative16getMemoryManagerEv
310x1eaa_ZNK12CAddInNative8addErrorEjPKwS1_l
320x1f78_ZNK12CAddInNative8addErrorEjPKwl
330x2b734_ZTI12CAddInNative
340x2c1a0_ZTV12CAddInNative
350x1dc7_ZThn4_N12CAddInNative10CallAsFuncElP9_tVariantS1_l
360x1d16_ZThn4_N12CAddInNative10CallAsProcElP9_tVariantl
370x1b37_ZThn4_N12CAddInNative10FindMethodEPKw
380x1c29_ZThn4_N12CAddInNative10GetNParamsEl
390x1a44_ZThn4_N12CAddInNative10GetPropValElP9_tVariant
400x1a7e_ZThn4_N12CAddInNative10SetPropValElP9_tVariant
410x1b08_ZThn4_N12CAddInNative11GetNMethodsEv
420x1a08_ZThn4_N12CAddInNative11GetPropNameEll
430x1bf4_ZThn4_N12CAddInNative13GetMethodNameEll
440x1ab1_ZThn4_N12CAddInNative14IsPropReadableEl
450x1ae3_ZThn4_N12CAddInNative14IsPropWritableEl
460x1c3c_ZThn4_N12CAddInNative16GetParamDefValueEllP9_tVariant
470x1e5e_ZThn4_N12CAddInNative19RegisterExtensionAsEPPw
480x194b_ZThn4_N12CAddInNative8FindPropEPKw
490x191c_ZThn4_N12CAddInNative9GetNPropsEv
500x1c6f_ZThn4_N12CAddInNative9HasRetValEl
510x18b4_ZThn4_N12CAddInNativeD0Ev
520x1889_ZThn4_N12CAddInNativeD1Ev
530x1e87_ZThn8_N12CAddInNative9SetLocaleEPKw
540x18b9_ZThn8_N12CAddInNativeD0Ev
550x188e_ZThn8_N12CAddInNativeD1Ev
module_nameShtrihTemplate.dll
flags0
timestamp0
version0.0
ordinal_base1
nFunctions55
nNames55
Names(55)0x40104
Functions(55)0x40028
NameOrdinals(55)0x401e0
offsetsizetypecomment
0806400DLL01/01/1970 00:00:03#
15c115HTM#
c4e00368144BINoverlay data past EOF#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] can't find file_offset of VA 0x3f030