filenamewin32spl.dll
size492032 (0x78200)
md5536e06b5a05c6e39c8748e3941fb083d
typePE32 executable (DLL) (console) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xe0

Rich Header

lib idversiontimes used
149307296
10427
1473072935
146307291
13230729195
1313072992
148307291
145307291

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections4
TimeDateStamp0x4ce7ba38
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x2102
Magic0x10b
LinkerVersion9.0
SizeOfCode0x70a00
SizeOfInitializedData0x8400
SizeOfUninitializedData0
AddressOfEntryPoint0x8950
BaseOfCode0x1000
BaseOfData0x73000
ImageBase0x6ea80000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.1
ImageVersion6.1
SubsystemVersion6.1
Reserved10
SizeOfImage0x7c000
SizeOfHeaders0x600
CheckSum0x84341
Subsystem3
DllCharacteristics0x140
SizeOfStackReserve0x40000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v7.0 DLL

Sections

namevavsizeraw sizeflags
.text0x10000x709590x70a00R-X CODE
.data0x720000x21940x1000RW- IDATA
.rsrc0x750000x27080x2800R-- IDATA
.reloc0x780000x39940x3a00R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT0x87580x112
IMPORT0x6f96c0x168
RESOURCE0x750000x2708
EXCEPTION00
SECURITY00
BASERELOC0x780000x3994
DEBUG0x718f80x38
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x194800x40
Bound_IAT0x2780x270
IAT0x10000x548
Delay_IAT0x6f1140x1e0
CLR_Header00
typenamesizecp
MUI#12160
TYPELIB#138120
TYPELIB#246920
VERSION#19600
module_namehintordfunction_name
msvcrt.dll1246malloc
msvcrt.dll106_XcptFilter
msvcrt.dll1274qsort
msvcrt.dll563_itow
msvcrt.dll1365wcscpy_s
msvcrt.dll1383wcstok_s
msvcrt.dll1387wcstoul
msvcrt.dll1376wcsrchr
msvcrt.dll1361wcschr
msvcrt.dll1337tolower
msvcrt.dll764_purecall
msvcrt.dll1380wcsstr
msvcrt.dll1262memset
msvcrt.dll1133_wtol
msvcrt.dll1190free
msvcrt.dll469_initterm
msvcrt.dll257_amsg_exit
msvcrt.dll345_except_handler4_common
msvcrt.dll934_unlock
msvcrt.dll141__dllonexit
msvcrt.dll578_lock
msvcrt.dll747_onexit
msvcrt.dll1299strchr
msvcrt.dll1303strcpy_s
msvcrt.dll1360wcscat_s
msvcrt.dll1011_wcslwr
msvcrt.dll404_ftol2
msvcrt.dll71_CIsqrt
msvcrt.dll115__CxxFrameHandler3
msvcrt.dll1260memmove
msvcrt.dll1199fwprintf
msvcrt.dll1083_wopen
msvcrt.dll586_lseek
msvcrt.dll291_close
msvcrt.dll1096_write
msvcrt.dll772_read
msvcrt.dll748_open
msvcrt.dll342_errno
msvcrt.dll1017_wcsnicmp
msvcrt.dll974_vsnwprintf
msvcrt.dll1371wcsncmp
msvcrt.dll18void * __cdecl operator new(unsigned int)

??2@YAPAXI@Z

msvcrt.dll20void __cdecl operator delete(void *)

??3@YAXPAX@Z

msvcrt.dll1258memcpy
msvcrt.dll1007_wcsicmp
msvcrt.dll1216isdigit
ntdll.dll53EtwEventEnabled
ntdll.dll57EtwEventWrite
ntdll.dll56EtwEventUnregister
ntdll.dll55EtwEventRegister
ntdll.dll1253RtlValidRelativeSecurityDescriptor
ntdll.dll297NtFsControlFile
ntdll.dll943RtlInitializeSRWLock
ntdll.dll1110RtlReleaseSRWLockExclusive
ntdll.dll580RtlAcquireSRWLockExclusive
ntdll.dll1111RtlReleaseSRWLockShared
ntdll.dll581RtlAcquireSRWLockShared
ntdll.dll1351TpReleasePool
ntdll.dll1323TpAllocTimer
ntdll.dll1360TpSetTimer
ntdll.dll1325TpAllocWork
ntdll.dll1345TpPostWork
ntdll.dll1362TpSimpleTryPost
ntdll.dll1324TpAllocWait
ntdll.dll1318TpAllocAlpcCompletion
ntdll.dll1321TpAllocIoCompletion
ntdll.dll1363TpStartAsyncIoOperation
ntdll.dll1044RtlNtStatusToDosError
ntdll.dll1330TpCallbackMayRunLong
ntdll.dll1364TpWaitForAlpcCompletion
ntdll.dll1347TpReleaseAlpcCompletion
ntdll.dll1365TpWaitForIoCompletion
ntdll.dll1350TpReleaseIoCompletion
ntdll.dll1366TpWaitForTimer
ntdll.dll1352TpReleaseTimer
ntdll.dll1361TpSetWait
ntdll.dll1367TpWaitForWait
ntdll.dll1353TpReleaseWait
ntdll.dll1368TpWaitForWork
ntdll.dll924RtlInitUnicodeString
ntdll.dll915RtlInitAnsiString
ntdll.dll1052RtlOemStringToUnicodeString
ntdll.dll1226RtlUnicodeToOemN
ntdll.dll1311RtlxUnicodeStringToOemSize
ntdll.dll161NlsMbOemCodePageTag
ntdll.dll499NtSetInformationThread
ntdll.dll212NtClose
ntdll.dll228NtCreateFile
ntdll.dll309NtImpersonateAnonymousToken
ntdll.dll363NtOpenThreadToken
ntdll.dll1354TpReleaseWork
ntdll.dll81EtwUnregisterTraceGuids
ntdll.dll74EtwRegisterTraceGuidsW
ntdll.dll67EtwGetTraceLoggerHandle
ntdll.dll66EtwGetTraceEnableLevel
ntdll.dll65EtwGetTraceEnableFlags
ntdll.dll79EtwTraceMessage
API-MS-Win-Core-ErrorHandling-L1-1-0.dll1GetLastError
API-MS-Win-Core-ErrorHandling-L1-1-0.dll6UnhandledExceptionFilter
API-MS-Win-Core-ErrorHandling-L1-1-0.dll5SetUnhandledExceptionFilter
API-MS-Win-Core-ErrorHandling-L1-1-0.dll4SetLastError
API-MS-Win-Core-File-L1-1-0.dll58ReadFile
API-MS-Win-Core-File-L1-1-0.dll4CreateFileW
API-MS-Win-Core-File-L1-1-0.dll7DeleteFileW
API-MS-Win-Core-File-L1-1-0.dll37GetFileSize
API-MS-Win-Core-File-L1-1-0.dll73WriteFile
API-MS-Win-Core-File-L1-1-0.dllCompareFileTime
API-MS-Win-Core-File-L1-1-0.dll2CreateDirectoryW
API-MS-Win-Core-Handle-L1-1-0.dllCloseHandle
API-MS-Win-Core-Interlocked-L1-1-0.dll1InterlockedCompareExchange
API-MS-Win-Core-Interlocked-L1-1-0.dll3InterlockedDecrement
API-MS-Win-Core-Interlocked-L1-1-0.dll4InterlockedExchange
API-MS-Win-Core-Interlocked-L1-1-0.dll7InterlockedIncrement
API-MS-Win-Core-LibraryLoader-L1-1-0.dll12GetProcAddress
API-MS-Win-Core-LibraryLoader-L1-1-0.dllDisableThreadLibraryCalls
API-MS-Win-Core-LibraryLoader-L1-1-0.dll13LoadLibraryExA
API-MS-Win-Core-LibraryLoader-L1-1-0.dll7GetModuleFileNameW
API-MS-Win-Core-LibraryLoader-L1-1-0.dll3FreeLibrary
API-MS-Win-Core-Localization-L1-1-0.dll19GetSystemPreferredUILanguages
API-MS-Win-Core-Misc-L1-1-0.dll11LocalFree
API-MS-Win-Core-Misc-L1-1-0.dll27lstrcmpiW
API-MS-Win-Core-Misc-L1-1-0.dll33lstrlenW
API-MS-Win-Core-Misc-L1-1-0.dll19Sleep
API-MS-Win-Core-ProcessThreads-L1-1-0.dll39SetThreadToken
API-MS-Win-Core-ProcessThreads-L1-1-0.dll28OpenThreadToken
API-MS-Win-Core-ProcessThreads-L1-1-0.dll13GetCurrentThreadId
API-MS-Win-Core-ProcessThreads-L1-1-0.dll11GetCurrentProcessId
API-MS-Win-Core-ProcessThreads-L1-1-0.dll42TerminateProcess
API-MS-Win-Core-ProcessThreads-L1-1-0.dll10GetCurrentProcess
API-MS-Win-Core-ProcessThreads-L1-1-0.dll26OpenProcessToken
API-MS-Win-Core-ProcessThreads-L1-1-0.dll12GetCurrentThread
API-MS-Win-Core-Profile-L1-1-0.dllQueryPerformanceCounter
API-MS-Win-Core-SysInfo-L1-1-0.dll14GetTickCount
API-MS-Win-Core-SysInfo-L1-1-0.dll11GetSystemTimeAsFileTime
API-MS-Win-Core-SysInfo-L1-1-0.dll7GetSystemDirectoryW
RPCRT4.dll383RpcEpResolveBinding
RPCRT4.dll366RpcBindingSetAuthInfoExW
RPCRT4.dll368RpcBindingSetObject
RPCRT4.dll139NdrAsyncClientCall
RPCRT4.dll369RpcBindingSetOption
RPCRT4.dll349RpcBindingFree
RPCRT4.dll494RpcStringBindingComposeW
RPCRT4.dll351RpcBindingFromStringBindingW
RPCRT4.dll498RpcStringFreeW
RPCRT4.dll149NdrClientCall2
RPCRT4.dll341RpcAsyncCompleteCall
RPCRT4.dll472RpcSmDestroyClientContext
RPCRT4.dll234NdrMesProcEncodeDecode2
RPCRT4.dll124MesEncodeIncrementalHandleCreate
RPCRT4.dll121MesDecodeIncrementalHandleCreate
RPCRT4.dll125MesHandleFree
RPCRT4.dll343RpcAsyncInitializeHandle
RPCRT4.dll45I_RpcExceptionFilter
OLEAUT32.dll412
OLEAUT32.dll12
OLEAUT32.dll10
OLEAUT32.dll283
OLEAUT32.dll284
OLEAUT32.dll285
OLEAUT32.dll9
OLEAUT32.dll6
OLEAUT32.dll201
OLEAUT32.dll162
OLEAUT32.dll186
OLEAUT32.dll2
OLEAUT32.dll8
OLEAUT32.dll16
OLEAUT32.dll148
OLEAUT32.dll11
OLEAUT32.dll323
OLEAUT32.dll161
OLEAUT32.dll294
OLEAUT32.dll293
OLEAUT32.dll292
OLEAUT32.dll163
OLEAUT32.dll291
OLEAUT32.dll286
OLEAUT32.dll7
OLEAUT32.dll25
OLEAUT32.dll26
OLEAUT32.dll19
OLEAUT32.dll411
SPOOLSS.DLL95IsNamedPipeRpcCall
SPOOLSS.DLL29CallRouterFindFirstPrinterChangeNotification
SPOOLSS.DLL18AllocSplStr
SPOOLSS.DLL96MIDL_user_allocate1
SPOOLSS.DLL97MIDL_user_free1
SPOOLSS.DLL92ImpersonatePrinterClient
SPOOLSS.DLL127RevertToPrinterSelf
SPOOLSS.DLL51DllAllocSplMem
SPOOLSS.DLL53DllFreeSplMem
SPOOLSS.DLL94IsNameTheLocalMachineOrAClusterSpooler
SPOOLSS.DLL28CallDrvDevModeConversion
SPOOLSS.DLL19AllowRemoteCalls
SPOOLSS.DLL54DllFreeSplStr
SPOOLSS.DLL124ReplyPrinterChangeNotificationEx
SPOOLSS.DLL141RouterFreePrinterNotifyInfo
SPOOLSS.DLL20AppendPrinterNotifyInfoData
SPOOLSS.DLL131RouterAllocPrinterNotifyInfo
SPOOLSS.DLL31ClosePrinter
SPOOLSS.DLL182SpoolerFindClosePrinterChangeNotification
SPOOLSS.DLL188SpoolerRefreshPrinterChangeNotification
SPOOLSS.DLL183SpoolerFindFirstPrinterChangeNotification
SPOOLSS.DLL123ReplyPrinterChangeNotification
SPOOLSS.DLL111PartialReplyPrinterChangeNotification
SPOOLSS.DLL105OpenPrinter2W
SPOOLSS.DLL181SplUnregisterForSessionEvents
SPOOLSS.DLL178SplRegisterForSessionEvents
SPOOLSS.DLL134RouterCreatePrintAsyncNotificationChannel
SPOOLSS.DLL27CacheIsNameInNodeList
LocalSpl.dll83SplNotifyServerStatus
LocalSpl.dll31SplCreateSpooler
LocalSpl.dll26SplCloseSpooler
LocalSpl.dll44SplDeleteSpooler
LocalSpl.dll23SplAddPrinter
LocalSpl.dll84SplOpenPrinter
LocalSpl.dll25SplClosePrinter
LocalSpl.dll79SplIsDriverInstalled
LocalSpl.dll51SplEnumPorts
LocalSpl.dll59SplEnumPrinters
LocalSpl.dll78SplIsCompatibleDriver
LocalSpl.dll57SplEnumPrinterDrivers
LocalSpl.dll29SplCopyNumberOfFiles
LocalSpl.dll19SplAddMonitor
LocalSpl.dll91SplSetDriverUpdateStatus
LocalSpl.dll61SplGetDriverUpdateStatus
LocalSpl.dll80SplIsLocalDriverAvailable
LocalSpl.dll24SplAddPrinterDriverEx
LocalSpl.dll49SplEnumJobs
LocalSpl.dll92SplSetForm
LocalSpl.dll17SplAddForm
LocalSpl.dll32SplDeleteForm
LocalSpl.dll94SplSetJobError
LocalSpl.dll43SplDeletePrinterWithJobs
LocalSpl.dll70SplGetPrinter
LocalSpl.dll45SplDriverEvent
LocalSpl.dll63SplGetJob
LocalSpl.dll18SplAddJob
LocalSpl.dll88SplReportJobProcessingProgress
LocalSpl.dll12LocalReadPrinter
LocalSpl.dll16SplAbortPrinter
LocalSpl.dll90SplScheduleJob
LocalSpl.dll103SplStartPagePrinter
LocalSpl.dll47SplEndPagePrinter
LocalSpl.dll46SplEndDocPrinter
LocalSpl.dll104SplWritePrinter
LocalSpl.dll102SplStartDocPrinter
LocalSpl.dll30SplCreatePrinterIC
LocalSpl.dll85SplPlayGdiScriptOnPrinterIC
LocalSpl.dll41SplDeletePrinterIC
LocalSpl.dll55SplEnumPrinterData
LocalSpl.dll56SplEnumPrinterDataEx
LocalSpl.dll58SplEnumPrinterKey
LocalSpl.dll98SplSetPrinterData
LocalSpl.dll99SplSetPrinterDataEx
LocalSpl.dll38SplDeletePrinterData
LocalSpl.dll39SplDeletePrinterDataEx
LocalSpl.dll42SplDeletePrinterKey
LocalSpl.dll89SplResetPrinter
LocalSpl.dll75SplGetPrinterDriverEx
LocalSpl.dll73SplGetPrinterDriver
LocalSpl.dll96SplSetPrintProcCacheData
LocalSpl.dll68SplGetPrintProcCacheData
LocalSpl.dll71SplGetPrinterData
LocalSpl.dll72SplGetPrinterDataEx
LocalSpl.dll65SplGetLocalDevMode
LocalSpl.dll35SplDeletePrintProcCacheData
LocalSpl.dll52SplEnumPrintProcCacheData
LocalSpl.dll82SplMonitorIsInstalled
LocalSpl.dll66SplGetPrintClassObject
LocalSpl.dll62SplGetForm
LocalSpl.dll48SplEnumForms
LocalSpl.dll13LocalSetForm
LocalSpl.dll9LocalAddForm
LocalSpl.dll10LocalDeleteForm
LocalSpl.dll11LocalEnumForms
LocalSpl.dll28SplCopyFileEvent
LocalSpl.dll81SplLoadLibraryTheCopyFileModule
LocalSpl.dll97SplSetPrinter
LocalSpl.dll60SplGetDriverDir
LocalSpl.dll64SplGetJobExtra
LocalSpl.dll95SplSetJobExtra
LocalSpl.dll67SplGetPrintClassObject_4CSR
LocalSpl.dll93SplSetJob
KERNEL32.dll842LocalReAlloc
KERNEL32.dll835LocalAlloc
KERNEL32.dll1125SetFileTime
KERNEL32.dll662GetTimeZoneInformation
KERNEL32.dll1116SetFileAttributesW
KERNEL32.dll312FindFirstFileW
KERNEL32.dll324FindNextFileW
KERNEL32.dll301FindClose
KERNEL32.dll739InitializeCriticalSectionAndSpinCount
KERNEL32.dll824LeaveCriticalSection
KERNEL32.dll237EnterCriticalSection
KERNEL32.dll583GetProcessHeap
KERNEL32.dll714HeapAlloc
KERNEL32.dll718HeapFree
KERNEL32.dll965RegDeleteKeyExW
KERNEL32.dll1000RegSetValueExW
KERNEL32.dll963RegCreateKeyExW
KERNEL32.dll972RegEnumKeyExW
KERNEL32.dll969RegDeleteValueW
KERNEL32.dll398GetComputerNameW
KERNEL32.dll1180SetThreadpoolTimer
KERNEL32.dll1269WaitForSingleObject
KERNEL32.dll830LoadLibraryW
KERNEL32.dll205DelayLoadFailureHook
KERNEL32.dll292FileTimeToSystemTime
KERNEL32.dll133CreateEventW
KERNEL32.dll208DeleteCriticalSection
KERNEL32.dll1270WaitForSingleObjectEx
KERNEL32.dll862MoveFileExW
KERNEL32.dll1023RemoveDirectoryW
KERNEL32.dll625GetSystemInfo
KERNEL32.dll674GetVersionExW
KERNEL32.dll1293WideCharToMultiByte
KERNEL32.dll869MultiByteToWideChar
KERNEL32.dll227DosDateTimeToFileTime
KERNEL32.dll837LocalFileTimeToFileTime
KERNEL32.dll1109SetEvent
ordentry_vafunction_name
10x196caDllCanUnloadNow
20x195e5DllGetClassObject
30x886fDllMain
40x196e9DllRegisterServer
50x1971aDllUnregisterServer
60x3c348InitializePrintMonitor2
70xb8c1InitializePrintProvidor
80x1975eProviderEntryW
module_namecsrspl.dll
flags0
timestamp2010-11-20 11:00:52
version0.0
ordinal_base1
nFunctions8
nNames8
Names(8)0x87a0
Functions(8)0x8780
NameOrdinals(8)0x87c0

StringTable 040904B0

CompanyNameMicrosoft Corporation
FileDescriptionClient Side Rendering Print Provider
FileVersion6.1.7601.17514 (win7sp1_rtm.101119-1850)
InternalNamewin32spl.dll
LegalCopyright© Microsoft Corporation. All rights reserved.
OriginalFilenamewin32spl.dll
ProductNameMicrosoft® Windows® Operating System
ProductVersion6.1.7601.17514

VS_FIXEDFILEINFO

FileVersion6.1.7601.17514
ProductVersion6.1.7601.17514
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType2
FileSubtype0
offsetsizetypecomment
0492032DLL11/20/2010 12:08:24#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] can't find file_offset of VA 0x278