filenameAdmTmpl.dll
size438272 (0x6b000)
md55862a867bb6228d427cb784f610662f7
typePE32 executable (DLL) (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xf0

Rich Header

lib idversiontimes used
1313072917
149307296
10227
1473072923
146307291
1323072956
148307291
145307291

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections4
TimeDateStamp0x4ce7b718
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x2102
Magic0x10b
LinkerVersion9.0
SizeOfCode0x45a00
SizeOfInitializedData0x25800
SizeOfUninitializedData0
AddressOfEntryPoint0x3b3a9
BaseOfCode0x1000
BaseOfData0x47000
ImageBase0x1bc00000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.1
ImageVersion6.1
SubsystemVersion6.1
Reserved10
SizeOfImage0x6f000
SizeOfHeaders0x400
CheckSum0x73c0d
Subsystem2
DllCharacteristics0x140
SizeOfStackReserve0x40000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v7.0 DLL

Sections

namevavsizeraw sizeflags
.text0x10000x458360x45a00R-X CODE
.data0x470000x20e80x1c00RW- IDATA
.rsrc0x4a0000x1e1100x1e200R-- IDATA
.reloc0x690000x527e0x5400R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT0x467900xa6
IMPORT0x456080xdc
RESOURCE0x4a0000x1e110
EXCEPTION00
SECURITY00
BASERELOC0x690000x41bc
DEBUG0x13500x1c
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0xe9000x40
Bound_IAT0x2880xd4
IAT0x10000x314
Delay_IAT00
CLR_Header00
typenamesizecp
MUI#12400
BITMAP#1102800
BITMAP#2410000
BITMAP#330010640
BITMAP#330114920
ICON#17440
ICON#24880
ICON#32960
ICON#422160
ICON#517360
ICON#613840
ICON#742640
ICON#824400
ICON#911280
ICON#107440
ICON#114880
ICON#122960
ICON#1322160
ICON#1417360
ICON#1513840
ICON#1642640
ICON#1724400
ICON#1811280
ICON#197440
ICON#204880
ICON#212960
ICON#2222160
ICON#2317360
ICON#2413840
ICON#2542640
ICON#2624400
ICON#2711280
ICON#287440
ICON#292960
ICON#3022160
ICON#3113840
ICON#3242640
ICON#3311280
ICON#347440
ICON#352960
ICON#3622160
ICON#3713840
ICON#3842640
ICON#3911280
GROUP_ICON#11320
GROUP_ICON#21320
GROUP_ICON#31320
GROUP_ICON#4900
GROUP_ICON#6900
VERSION#19400
MANIFEST#27520
module_namehintordfunction_name
msvcrt.dll9public: __thiscall exception::exception(char const * const &)

??0exception@@QAE@ABQBD@Z

msvcrt.dll57public: virtual char const * __thiscall exception::what(void)const

?what@exception@@UBEPBDXZ

msvcrt.dll1261memmove_s
msvcrt.dll11public: __thiscall exception::exception(class exception const &)

??0exception@@QAE@ABV0@@Z

msvcrt.dll115__CxxFrameHandler3
msvcrt.dll1262memset
msvcrt.dll16public: virtual __thiscall exception::~exception(void)

??1exception@@UAE@XZ

msvcrt.dll1259memcpy_s
msvcrt.dll974_vsnwprintf
msvcrt.dll1387wcstoul
msvcrt.dll1258memcpy
msvcrt.dll1129_wtoi
msvcrt.dll1130_wtoi64
msvcrt.dll405_ftol2_sse
msvcrt.dll12public: __thiscall exception::exception(void)

??0exception@@QAE@XZ

msvcrt.dll1361wcschr
msvcrt.dll764_purecall
msvcrt.dll122__RTDynamicCast
msvcrt.dll1376wcsrchr
msvcrt.dll563_itow
msvcrt.dll1190free
msvcrt.dll99_CxxThrowException
msvcrt.dll274_callnewh
msvcrt.dll1246malloc
msvcrt.dll106_XcptFilter
msvcrt.dll469_initterm
msvcrt.dll257_amsg_exit
msvcrt.dll747_onexit
msvcrt.dll578_lock
msvcrt.dll141__dllonexit
msvcrt.dll934_unlock
msvcrt.dll17public: virtual __thiscall type_info::~type_info(void)

??1type_info@@UAE@XZ

msvcrt.dll345_except_handler4_common
KERNEL32.dll1358lstrlenW
KERNEL32.dll1124SetFilePointer
KERNEL32.dll143CreateFileW
KERNEL32.dll285ExpandEnvironmentStringsW
KERNEL32.dll905OutputDebugStringW
KERNEL32.dll449GetCurrentProcessId
KERNEL32.dll453GetCurrentThreadId
KERNEL32.dll513GetLocalTime
KERNEL32.dll512GetLastError
KERNEL32.dll209DeleteCriticalSection
KERNEL32.dll739InitializeCriticalSection
KERNEL32.dll222DisableThreadLibraryCalls
KERNEL32.dll531GetModuleHandleA
KERNEL32.dll534GetModuleHandleW
KERNEL32.dll579GetProcAddress
KERNEL32.dll488GetFileAttributesW
KERNEL32.dll673GetVersion
KERNEL32.dll831LoadLibraryW
KERNEL32.dll530GetModuleFileNameW
KERNEL32.dll904OutputDebugStringA
KERNEL32.dll354FreeLibrary
KERNEL32.dll350FormatMessageW
KERNEL32.dll100CompareStringW
KERNEL32.dll828LoadLibraryA
KERNEL32.dll825LeaveCriticalSection
KERNEL32.dll238EnterCriticalSection
KERNEL32.dll96CompareFileTime
KERNEL32.dll1349lstrcmpiW
KERNEL32.dll1317WriteFile
KERNEL32.dll1273WaitForSingleObject
KERNEL32.dll840LocalFree
KERNEL32.dll751InterlockedIncrement
KERNEL32.dll836LocalAlloc
KERNEL32.dll1112SetEvent
KERNEL32.dll1038ResetEvent
KERNEL32.dll302FindClose
KERNEL32.dll325FindNextFileW
KERNEL32.dll662GetTimeFormatW
KERNEL32.dll456GetDateFormatW
KERNEL32.dll293FileTimeToSystemTime
KERNEL32.dll292FileTimeToLocalFileTime
KERNEL32.dll313FindFirstFileW
KERNEL32.dll843LocalReAlloc
KERNEL32.dll355FreeLibraryAndExitThread
KERNEL32.dll1202Sleep
KERNEL32.dll133CreateEventW
KERNEL32.dll658GetTickCount
KERNEL32.dll1176SetThreadPriority
KERNEL32.dll181CreateThread
KERNEL32.dll702GlobalLock
KERNEL32.dll705GlobalReAlloc
KERNEL32.dll709GlobalUnlock
KERNEL32.dll698GlobalFree
KERNEL32.dll691GlobalAlloc
KERNEL32.dll667GetUserDefaultLangID
KERNEL32.dll870MultiByteToWideChar
KERNEL32.dll959ReadFile
KERNEL32.dll494GetFileSize
KERNEL32.dll652GetThreadPreferredUILanguages
KERNEL32.dll493GetFileMUIPath
KERNEL32.dll686GetWindowsDirectoryW
KERNEL32.dll748InterlockedExchange
KERNEL32.dll745InterlockedCompareExchange
KERNEL32.dll934QueryPerformanceCounter
KERNEL32.dll632GetSystemTimeAsFileTime
KERNEL32.dll1216TerminateProcess
KERNEL32.dll448GetCurrentProcess
KERNEL32.dll1235UnhandledExceptionFilter
KERNEL32.dll1188SetUnhandledExceptionFilter
KERNEL32.dll82CloseHandle
KERNEL32.dll1137SetLastError
KERNEL32.dll199DebugBreak
KERNEL32.dll284ExpandEnvironmentStringsA
KERNEL32.dll1119SetFileAttributesW
KERNEL32.dll505GetFullPathNameW
KERNEL32.dll129CreateDirectoryW
KERNEL32.dll485GetFileAttributesExW
KERNEL32.dll851LockResource
KERNEL32.dll833LoadResource
KERNEL32.dll333FindResourceExW
KERNEL32.dll747InterlockedDecrement
USER32.dll462IsDlgButtonChecked
USER32.dll216EnableWindow
USER32.dll525MessageBeep
USER32.dll533MessageBoxW
USER32.dll172DialogBoxParamW
USER32.dll491LoadCursorW
USER32.dll648SetCursor
USER32.dll764TranslateMessage
USER32.dll175DispatchMessageW
USER32.dll563PeekMessageW
USER32.dll347GetMessagePos
USER32.dll295GetDlgItem
USER32.dll658SetFocus
USER32.dll218EndDialog
USER32.dll566PostMessageW
USER32.dll636SendMessageW
USER32.dll495LoadImageW
USER32.dll45CharLowerBuffW
USER32.dll506LoadStringW
USER32.dll62CheckDlgButton
USER32.dll621ScreenToClient
USER32.dll611RegisterWindowMessageW
USER32.dll156DefWindowProcW
USER32.dll110CreateWindowExW
USER32.dll590RegisterClassW
USER32.dll166DestroyWindow
USER32.dll592RegisterClipboardFormatW
USER32.dll318GetKeyboardLayout
USER32.dll406GetWindowLongW
USER32.dll708SetWindowLongW
USER32.dll276GetClientRect
USER32.dll540MsgWaitForMultipleObjects
USER32.dll163DestroyIcon
GDI32.dll230DeleteObject
ADVAPI32.dll608RegOpenKeyExA
ADVAPI32.dll621RegQueryValueExA
ADVAPI32.dll591RegEnumKeyExW
ADVAPI32.dll560RegCloseKey
ADVAPI32.dll622RegQueryValueExW
ADVAPI32.dll609RegOpenKeyExW
ADVAPI32.dll638RegSetValueExW
ADVAPI32.dll572RegCreateKeyW
ADVAPI32.dll580RegDeleteKeyW
ADVAPI32.dll594RegEnumValueW
ADVAPI32.dll616RegQueryInfoKeyW
ADVAPI32.dll384IsTextUnicode
ADVAPI32.dll288FreeSid
ADVAPI32.dll694SetSecurityDescriptorDacl
ADVAPI32.dll375InitializeSecurityDescriptor
ADVAPI32.dll291GetAce
ADVAPI32.dll16AddAccessAllowedAce
ADVAPI32.dll374InitializeAcl
ADVAPI32.dll310GetLengthSid
ADVAPI32.dll32AllocateAndInitializeSid
SHELL32.dll172SHFileOperationW
ole32.dll103CoTaskMemAlloc
ole32.dll134CreateStreamOnHGlobal
ole32.dll377StringFromGUID2
ole32.dll63CoInitializeEx
ole32.dll108CoUninitialize
ole32.dll321OleRun
ole32.dll16CoCreateInstance
ole32.dll8CLSIDFromString
OLEAUT32.dll6
OLEAUT32.dll2
XmlLite.dll3CreateXmlWriter
ntdll.dll761RtlDosPathNameToRelativeNtPathName_U
ntdll.dll1108RtlReleaseRelativeName
ntdll.dll840RtlFreeHeap
ntdll.dll228NtCreateFile
ntdll.dll212NtClose
ntdll.dll982RtlIsDosDeviceName_U
ntdll.dll1044RtlNtStatusToDosError
ordentry_vafunction_name
10x38fd0CreateCmtStoreObject
20x32ac9CreateParserObject
30x12ce7DllCanUnloadNow
40x12cf8DllGetClassObject
module_nameADMTMPL.DLL
flags0
timestamp2010-11-20 06:01:45
version0.0
ordinal_base1
nFunctions4
nNames4
Names(4)0x467c8
Functions(4)0x467b8
NameOrdinals(4)0x467d8

StringTable 040904B0

CompanyNameMicrosoft Corporation
FileDescriptionAdministrative Templates Extension
FileVersion6.1.7601.17514 (win7sp1_rtm.101119-1850)
InternalNameAdmTmpl
LegalCopyright© Microsoft Corporation. All rights reserved.
OriginalFilenameAdmTmpl.dll
ProductNameMicrosoft® Windows® Operating System
ProductVersion6.1.7601.17514

VS_FIXEDFILEINFO

FileVersion6.1.7601.17514
ProductVersion6.1.7601.17514
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType1
FileSubtype0
offsetsizetypecomment
0438272DLL11/20/2010 11:55:04#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] can't find file_offset of VA 0x288