filenamedata.dll
size90112 (0x16000)
md560cf129258fc49514d145190daf19d34
typePE32+ executable (DLL) (GUI) x86-64, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x110

Rich Header

lib idversiontimes used
156402194
152201152
158402192
1704021911
1714021910
131307291
147307297
156212024
1089
1744021910
155402191
157402191

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x8664
NumberOfSections5
TimeDateStamp0x53475e15
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xf0
Characteristics0x2022
Magic0x20b
LinkerVersion10.0
SizeOfCode0x7a00
SizeOfInitializedData0xec00
SizeOfUninitializedData0
AddressOfEntryPoint0x73d0
BaseOfCode0x1000
ImageBase0x180000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion5.2
ImageVersion0.0
SubsystemVersion5.2
Reserved10
SizeOfImage0x19000
SizeOfHeaders0x400
CheckSum0
Subsystem2
DllCharacteristics0x140
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MASM/TASM - sig1(h)

Sections

namevavsizeraw sizeflags
.text0x10000x78620x7a00R-X CODE
.rdata0x90000x63c20x6400R-- IDATA
.data0x100000x2e100x2600RW- IDATA
.pdata0x130000x7500x800R-- IDATA
.reloc0x140000x4f260x5000R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT0xf3700x52
IMPORT0xea640x78
RESOURCE00
EXCEPTION0x130000x750
SECURITY00
BASERELOC0x140000x7dc
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT0x90000x2a8
Delay_IAT00
CLR_Header00
module_namehintordfunction_name
KERNEL32.dll155CreateMutexA
KERNEL32.dll1278VirtualProtect
KERNEL32.dll180CreateThread
KERNEL32.dll455GetCurrentProcessId
KERNEL32.dll459GetCurrentThreadId
KERNEL32.dll666GetTickCount
KERNEL32.dll539GetModuleHandleA
KERNEL32.dll226DisableThreadLibraryCalls
KERNEL32.dll588GetProcAddress
KERNEL32.dll520GetLastError
KERNEL32.dll937QueryPerformanceCounter
KERNEL32.dll1048RtlCaptureContext
KERNEL32.dll1055RtlLookupFunctionEntry
KERNEL32.dll1062RtlVirtualUnwind
KERNEL32.dll770IsDebuggerPresent
KERNEL32.dll1203SetUnhandledExceptionFilter
KERNEL32.dll1250UnhandledExceptionFilter
KERNEL32.dll454GetCurrentProcess
KERNEL32.dll1230TerminateProcess
KERNEL32.dll203DecodePointer
KERNEL32.dll238EncodePointer
KERNEL32.dll1216Sleep
KERNEL32.dll619GetStdHandle
KERNEL32.dll16AllocConsole
KERNEL32.dll640GetSystemTimeAsFileTime
USER32.dll827wsprintfW
USER32.dll263GetAsyncKeyState
ADVAPI32.dll621RegQueryValueExA
ADVAPI32.dll608RegOpenKeyExA
ADVAPI32.dll560RegCloseKey
MSVCR100.dll1516strtok
MSVCR100.dll1369fopen
MSVCR100.dll1335atof
MSVCR100.dll1356fclose
MSVCR100.dll1374fputs
MSVCR100.dll1115_unlock
MSVCR100.dll328__dllonexit
MSVCR100.dll758_lock
MSVCR100.dll925_onexit
MSVCR100.dll775_malloc_crt
MSVCR100.dll1362fgets
MSVCR100.dll647_initterm_e
MSVCR100.dll1379free
MSVCR100.dll498_encoded_null
MSVCR100.dll414_amsg_exit
MSVCR100.dll287__CppXcptFilter
MSVCR100.dll326__crt_debugger_hook
MSVCR100.dll256void __cdecl terminate(void)

?terminate@@YAXXZ

MSVCR100.dll238public: void __cdecl type_info::_type_info_dtor_internal_method(void) __ptr64

?_type_info_dtor_internal_method@type_info@@QEAAXXZ

MSVCR100.dll320__clean_type_info_names_internal
MSVCR100.dll1546vsprintf_s
MSVCR100.dll1336atoi
MSVCR100.dll646_initterm
MSVCR100.dll1514strstr
MSVCR100.dll1449memcpy
MSVCR100.dll296__CxxFrameHandler3
MSVCR100.dll1438malloc
MSVCR100.dll1486sprintf
MSVCR100.dll518_fdopen
MSVCR100.dll99void * __ptr64 __cdecl operator new(unsigned __int64)

??2@YAPEAX_K@Z

MSVCR100.dll927_open_osfhandle
MSVCR100.dll101void __cdecl operator delete(void * __ptr64)

??3@YAXPEAX@Z

MSVCR100.dll1480setvbuf
MSVCR100.dll1459printf
MSVCR100.dll340__iob_func
MSVCR100.dll1451memmove
MSVCR100.dll36public: __cdecl std::exception::exception(class std::exception const & __ptr64) __ptr64

??0exception@std@@QEAA@AEBV01@@Z

MSVCR100.dll34public: __cdecl std::exception::exception(char const * __ptr64 const & __ptr64) __ptr64

??0exception@std@@QEAA@AEBQEBD@Z

MSVCR100.dll93public: virtual __cdecl std::exception::~exception(void) __ptr64

??1exception@std@@UEAA@XZ

MSVCR100.dll266public: virtual char const * __ptr64 __cdecl std::exception::what(void)const __ptr64

?what@exception@std@@UEBAPEBDXZ

MSVCR100.dll1453memset
MSVCR100.dll1489sqrtf
MSVCR100.dll1332atan2f
MSVCR100.dll286__C_specific_handler
MSVCR100.dll742_itoa
MSVCR100.dll1039_stricmp
MSVCR100.dll270_CxxThrowException
MSVCP100.dll652void __cdecl std::_Xlength_error(char const * __ptr64)

?_Xlength_error@std@@YAXPEBD@Z

MSVCP100.dll654void __cdecl std::_Xout_of_range(char const * __ptr64)

?_Xout_of_range@std@@YAXPEBD@Z

MSVCP100.dll593public: void __cdecl std::_Container_base0::_Orphan_all(void) __ptr64

?_Orphan_all@_Container_base0@std@@QEAAXXZ

ordentry_vafunction_name
10x1010ReflectiveLoader
module_namenxTitan.64.dll
flags0
timestamp2014-04-11 03:14:25
version0.0
ordinal_base1
nFunctions1
nNames1
Names(1)0xf39c
Functions(1)0xf398
NameOrdinals(1)0xf3a0
offsetsizetypecomment
15c115HTM#
15d084528BINoverlay data past EOF#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK