RpcRtRemote.dll - Remote RPC Extension

info
MZ
PE
resources
imports
exports
foremost
version info
hexdump
disasm
log
discuss
donate

filename	RpcRtRemote.dll
size	46080 (0xb400)
md5	5997d769cdb108390dcfaebf442bf816

type	PE32 executable (DLL) (console) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0xf8

Rich Header

lib id	version	times used
1	0	158
147	30729	33
149	30729	6
138	30729	13
146	30729	1
132	30729	14
131	30729	10
148	30729	1
145	30729	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	4
TimeDateStamp	0x4ce7992f
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x2102
Magic	0x10b
LinkerVersion	9.0
SizeOfCode	0x9800
SizeOfInitializedData	0x1600
SizeOfUninitializedData	0
AddressOfEntryPoint	0x1235
BaseOfCode	0x1000
BaseOfData	0xb000
ImageBase	0x10000000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	6.1
ImageVersion	6.1
SubsystemVersion	6.1
Reserved1	0
SizeOfImage	0xe000
SizeOfHeaders	0x600
CheckSum	0xd0fe
Subsystem	3
DllCharacteristics	0x1c0
SizeOfStackReserve	0x40000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

MS Visual C++ v7.0 DLL

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x97ec	0x9800	R-X CODE
.data	0xb000	0x624	0x800	RW- IDATA
.rsrc	0xc000	0x408	0x600	R-- IDATA
.reloc	0xd000	0x7ac	0x800	R-- IDATA DISCARDABLE

Data Directory

type	va	size
EXPORT	0x1a48	0x87
IMPORT	0x9afc	0x154
RESOURCE	0xc000	0x408
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0xd000	0x7ac
DEBUG	0xa788	0x38
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0x5008	0x40
Bound_IAT	0x290	0x284
IAT	0x1000	0x1b8
Delay_IAT	0x9248	0x100
CLR_Header	0	0

show previews

type	name	size	cp
VERSION	#1	936	0

module_name	hint	function_name
ntdll.dll	1236	RtlUnwind
ntdll.dll	1811	_alloca_probe
ntdll.dll	779	RtlEnterCriticalSection
ntdll.dll	1004	RtlLeaveCriticalSection
ntdll.dll	1914	memcpy
ntdll.dll	1389	WinSqmIsOptedIn
ntdll.dll	1388	WinSqmIncrementDWORD
ntdll.dll	1091	RtlRaiseException
ntdll.dll	1118	RtlReportException
ntdll.dll	339	NtOpenDirectoryObject
ntdll.dll	388	NtQueryDirectoryObject
ntdll.dll	212	NtClose
ntdll.dll	1225	RtlUnicodeToMultiByteSize
ntdll.dll	840	RtlFreeHeap
ntdll.dll	611	RtlAllocateHeap
ntdll.dll	909	RtlImageNtHeader
ntdll.dll	1224	RtlUnicodeToMultiByteN
ntdll.dll	924	RtlInitUnicodeString
ntdll.dll	1918	memset
ntdll.dll	174	NtAdjustPrivilegesToken
ntdll.dll	374	NtPrivilegeCheck
ntdll.dll	1873	_wcsnicmp
ntdll.dll	1963	wcschr
KERNELBASE.dll	38	BemCreateReference
KERNELBASE.dll	40	BemFreeReference
API-MS-Win-Core-ErrorHandling-L1-1-0.dll	6	UnhandledExceptionFilter
API-MS-Win-Core-ErrorHandling-L1-1-0.dll	5	SetUnhandledExceptionFilter
API-MS-Win-Core-ErrorHandling-L1-1-0.dll	1	GetLastError
API-MS-Win-Core-Handle-L1-1-0.dll		CloseHandle
API-MS-Win-Core-Interlocked-L1-1-0.dll	1	InterlockedCompareExchange
API-MS-Win-Core-Interlocked-L1-1-0.dll	4	InterlockedExchange
API-MS-Win-Core-Interlocked-L1-1-0.dll	7	InterlockedIncrement
API-MS-Win-Core-Interlocked-L1-1-0.dll	3	InterlockedDecrement
API-MS-Win-Core-LibraryLoader-L1-1-0.dll		DisableThreadLibraryCalls
API-MS-Win-Core-LibraryLoader-L1-1-0.dll	12	GetProcAddress
API-MS-Win-Core-LibraryLoader-L1-1-0.dll	11	GetModuleHandleW
API-MS-Win-Core-LibraryLoader-L1-1-0.dll	3	FreeLibrary
API-MS-Win-Core-LibraryLoader-L1-1-0.dll	13	LoadLibraryExA
API-MS-Win-Core-LocalRegistry-L1-1-0.dll	25	RegOpenKeyExW
API-MS-Win-Core-LocalRegistry-L1-1-0.dll		RegCloseKey
API-MS-Win-Core-Misc-L1-1-0.dll	24	lstrcmpW
API-MS-Win-Core-Misc-L1-1-0.dll	11	LocalFree
API-MS-Win-Core-Misc-L1-1-0.dll	19	Sleep
API-MS-Win-Core-ProcessThreads-L1-1-0.dll	11	GetCurrentProcessId
API-MS-Win-Core-ProcessThreads-L1-1-0.dll	41	SwitchToThread
API-MS-Win-Core-ProcessThreads-L1-1-0.dll	10	GetCurrentProcess
API-MS-Win-Core-ProcessThreads-L1-1-0.dll	28	OpenThreadToken
API-MS-Win-Core-ProcessThreads-L1-1-0.dll	12	GetCurrentThread
API-MS-Win-Core-ProcessThreads-L1-1-0.dll	39	SetThreadToken
API-MS-Win-Core-ProcessThreads-L1-1-0.dll	13	GetCurrentThreadId
API-MS-Win-Core-ProcessThreads-L1-1-0.dll	42	TerminateProcess
API-MS-Win-Core-ProcessThreads-L1-1-0.dll	26	OpenProcessToken
API-MS-Win-Core-Profile-L1-1-0.dll		QueryPerformanceCounter
API-MS-Win-Core-String-L1-1-0.dll	2	CompareStringW
API-MS-Win-Core-Synch-L1-1-0.dll	6	CreateEventW
API-MS-Win-Core-Synch-L1-1-0.dll	40	WaitForSingleObject
API-MS-Win-Core-Synch-L1-1-0.dll	30	ResetEvent
API-MS-Win-Core-Synch-L1-1-0.dll	32	SetEvent
API-MS-Win-Core-SysInfo-L1-1-0.dll	11	GetSystemTimeAsFileTime
API-MS-Win-Core-SysInfo-L1-1-0.dll	14	GetTickCount
API-MS-Win-Security-Base-L1-1-0.dll	58	GetTokenInformation
API-MS-Win-Security-Base-L1-1-0.dll	83	RevertToSelf
API-MS-Win-Security-Base-L1-1-0.dll	34	DuplicateToken
RPCRT4.dll	140	NdrAsyncServerCall
RPCRT4.dll	149	NdrClientCall2
RPCRT4.dll	343	RpcAsyncInitializeHandle
RPCRT4.dll	450	RpcServerUnregisterIf
RPCRT4.dll	34	I_RpcBindingInqTransportType
RPCRT4.dll	433	RpcRevertToSelfEx
RPCRT4.dll	399	RpcImpersonateClient
RPCRT4.dll	33	I_RpcBindingInqSecurityContextKeyInfo
RPCRT4.dll	431	RpcRaiseException
RPCRT4.dll	139	NdrAsyncClientCall
RPCRT4.dll	468	RpcServerUseProtseqW
RPCRT4.dll	283	NdrServerCall2
RPCRT4.dll	18	I_RpcAllocate
RPCRT4.dll	47	I_RpcFree
RPCRT4.dll	386	RpcErrorClearInformation
RPCRT4.dll	385	RpcErrorAddRecord
RPCRT4.dll	45	I_RpcExceptionFilter
RPCRT4.dll	349	RpcBindingFree
RPCRT4.dll	345	RpcBindingBind
RPCRT4.dll	348	RpcBindingCreateW
RPCRT4.dll	446	RpcServerRegisterIf2
RPCRT4.dll	448	RpcServerSubscribeForNotification
RPCRT4.dll	341	RpcAsyncCompleteCall
RPCRT4.dll	339	RpcAsyncAbortCall
RPCRT4.dll	452	RpcServerUnsubscribeForNotification
KERNEL32.dll	672	GetVersion
KERNEL32.dll	1261	VirtualQuery
KERNEL32.dll	625	GetSystemInfo
KERNEL32.dll	205	DelayLoadFailureHook
KERNEL32.dll	1259	VirtualProtect
KERNEL32.dll	1253	VirtualAlloc

ord	entry_va	function_name
1	0x3e7c	DllGetContractDescription
2	0x1ad4	I_RpcExtInitializeExtensionPoint

module_name	RpcRtRemote.dll
flags	0
timestamp	2010-11-20 09:47:27
version	0.0
ordinal_base	1
nFunctions	2
nNames	2
Names(2)	0x1a78
Functions(2)	0x1a70
NameOrdinals(2)	0x1a80

StringTable 040904B0

CompanyName	Microsoft Corporation
FileDescription	Remote RPC Extension
FileVersion	6.1.7601.17514 (win7sp1_rtm.101119-1850)
InternalName	RpcRtRemote.dll
LegalCopyright	© Microsoft Corporation. All rights reserved.
OriginalFilename	RpcRtRemote.dll
ProductName	Microsoft® Windows® Operating System
ProductVersion	6.1.7601.17514

VS_FIXEDFILEINFO

FileVersion	6.1.7601.17514
ProductVersion	6.1.7601.17514
StrucVersion	0x10000
FileFlagsMask	0x3f
FileFlags	0
FileOS	0x40004
FileType	2
FileSubtype	0

show previews

offset	size	type	comment
0	46080	DLL	11/20/2010 09:47:27	#
15c1	15	HTM		#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] can't find file_offset of VA 0x290

RpcRtRemote.dll-

MZ Header

Rich Header

DOS stub

PE Header

Packer / Compiler

Sections

Data Directory

StringTable 040904B0

VS_FIXEDFILEINFO

RpcRtRemote.dll
-