filenamebthutil.dll
size9216 (0x2400)
md560fa49b478d71d99e08ecbecfd8ec8b4
typePE32 executable for MS Windows (DLL) 32-bit
mimetypeapplication/octet-stream
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xd0

Rich Header

lib idversiontimes used
3585694
3283493
1016
3685691
3787001

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x1c0
NumberOfSections6
TimeDateStamp0x445fd33a
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x210e
Magic0x10b
LinkerVersion6.20
SizeOfCode0x1600
SizeOfInitializedData0xa00
SizeOfUninitializedData0
AddressOfEntryPoint0x230c
BaseOfCode0x1000
BaseOfData0x3000
ImageBase0x100000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion4.0
ImageVersion0.0
SubsystemVersion3.0
Reserved10
SizeOfImage0x8000
SizeOfHeaders0x400
CheckSum0
Subsystem9
DllCharacteristics0
SizeOfStackReserve0x10000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

PocketPC ARM

Sections

namevavsizeraw sizeflags
.text0x10000x15040x1600R-X CODE
.rdata0x30000x900x200R-- IDATA
.data0x40000xbc0x200RW- IDATA
.pdata0x50000xe00x200R-- IDATA
.edata0x60000x1ef0x200R-- IDATA
.reloc0x70000x1360x200R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT0x60000x1ef
IMPORT0x30180x28
RESOURCE00
EXCEPTION0x50000xe0
SECURITY00
BASERELOC0x70000x10c
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT0x40000x44
Delay_IAT00
CLR_Header00
module_namehintordfunction_name
COREDLL.dll248
COREDLL.dll1095
COREDLL.dll271
COREDLL.dll1047
COREDLL.dll2005
COREDLL.dll90
COREDLL.dll912
COREDLL.dll1094
COREDLL.dll263
COREDLL.dll911
COREDLL.dll903
COREDLL.dll905
COREDLL.dll921
COREDLL.dll910
COREDLL.dll262
COREDLL.dll36
ordentry_vafunction_name
10x16dc?GXBeginDraw@@YAPAXXZ
20x1660?GXCloseDisplay@@YAHXZ
30x225c?GXCloseInput@@YAHXZ
40x1700?GXEndDraw@@YAHXZ
50x208c?GXGetDefaultKeys@@YA?AUGXKeyList@@H@Z
60x1fc0?GXGetDisplayProperties@@YA?AUGXDisplayProperties@@XZ
70x207c?GXIsDisplayDRAMBuffer@@YAHXZ
80x1000?GXOpenDisplay@@YAHPAUHWND__@@K@Z
90x2254?GXOpenInput@@YAHXZ
100x223c?GXResume@@YAHXZ
110x2024?GXSetViewport@@YAHKKKK@Z
120x21ac?GXSuspend@@YAHXZ
module_nameGAPI_Emu.dll
flags0
timestamp2006-05-08 23:24:42
version0.0
ordinal_base1
nFunctions12
nNames12
Names(12)0x6058
Functions(12)0x6028
NameOrdinals(12)0x6088
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable
everything is OK