appsys (2).dll

info
MZ
PE
imports
exports
foremost
hexdump
disasm
log
discuss
donate

filename	appsys (2).dll
size	49152 (0xc000)
md5	5f9baf0e4431d14e32f2a3f369d95aec

type	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, PECompact2 compressed
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0xe0

Rich Header

lib id	version	times used
14	7299	25
10	8047	122
11	8047	18
19	8034	7
1	0	95
49	9044	6
4	8447	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	3
TimeDateStamp	0x4ef7243a
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x210e
Magic	0x10b
LinkerVersion	6.0
SizeOfCode	0x12000
SizeOfInitializedData	0xb000
SizeOfUninitializedData	0
AddressOfEntryPoint	0x8882
BaseOfCode	0x1000
BaseOfData	0x13000
ImageBase	0x10000000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	4.0
ImageVersion	0.0
SubsystemVersion	4.0
Reserved1	0
SizeOfImage	0x21000
SizeOfHeaders	0x400
CheckSum	0x12987
Subsystem	2
DllCharacteristics	0
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

PeCompact 2.xx (BitSum Technologies / v2.0)

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x1d000	0xa600	RWX CODE
.rsrc	0x1e000	0x2000	0x1400	RWX CODE
.reloc	0x20000	0x1000	0x200	RW- IDATA

Data Directory

type	va	size
EXPORT	0x1e008	0x3a2
IMPORT	0x1e3d4	0x10c
RESOURCE	0	0
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0x20000	0x18
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0	0
Delay_IAT	0	0
CLR_Header	0	0

module_name	hint	ord	function_name
kernel32.dll			LoadLibraryA
kernel32.dll			GetProcAddress
kernel32.dll			VirtualAlloc
kernel32.dll			VirtualFree
USER32.dll			GetWindowTextA
ADVAPI32.dll			RegQueryValueExA

ord	entry_va	function_name
1	0x15c0	_appsys_app_name@0
2	0x1430	_appsys_app_path@0
3	0x1760	_appsys_appsite@0
4	0x17a0	_appsys_buynow@0
5	0x1870	_appsys_check@8
6	0x1cf0	_appsys_check_ok@0
7	0x1c80	_appsys_chk_t@4
8	0x1db0	_appsys_chksum_fun0@0
9	0x1e90	_appsys_chksum_fun1@0
10	0x1f80	_appsys_chksum_fun2@0
11	0x2050	_appsys_chksum_fun3@0
12	0x2120	_appsys_chksum_fun4@0
13	0x21f0	_appsys_chksum_fun5@0
14	0x22f0	_appsys_chksum_fun6@0
15	0x23f0	_appsys_chksum_fun7@0
16	0x1730	_appsys_company@0
17	0x1740	_appsys_email@0
18	0x1830	_appsys_filter@0
19	0x1650	_appsys_fullname@0
20	0x1780	_appsys_helpsite@0
21	0x1750	_appsys_homesite@0
22	0x1490	_appsys_init@0
23	0x1850	_appsys_is_edit@0
24	0x1860	_appsys_is_sub@0
25	0x1610	_appsys_license_code@0
26	0x15d0	_appsys_license_name@0
27	0x2470	_appsys_regdata_ini@0
28	0x1790	_appsys_supportsite@0
29	0x1840	_appsys_trialtime@0
30	0x1770	_appsys_versionsite@0

module_name
flags	0
timestamp	2011-12-25 13:25:14
version	0.0
ordinal_base	1
nFunctions	30
nNames	30
Names(30)	0x1e06c
Functions(30)	0x1e0e4
NameOrdinals(30)	0x1e030

show previews

offset	size	type	comment
0	49152	DLL	12/25/2011 13:25:14	#
15c1	15	HTM		#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] can't find file_offset of VA 0x15624