filenameasedo64.dll
size320000 (0x4e200)
md56ae56a68d5991c992761df72b2396277
typePE32+ executable (DLL) (GUI) x86-64, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x110

Rich Header

lib idversiontimes used
199411189
223208062
2242080612
225208064
221208064
10176
2036550111
2242100578
229210051
220210051
219210051
222210051

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x8664
NumberOfSections6
TimeDateStamp0x52fddc9a
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xf0
Characteristics0x2022
Magic0x20b
LinkerVersion12.0
SizeOfCode0x3b400
SizeOfInitializedData0x13000
SizeOfUninitializedData0
AddressOfEntryPoint0x3b8cc
BaseOfCode0x1000
ImageBase0x180000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.0
ImageVersion0.0
SubsystemVersion6.0
Reserved10
SizeOfImage0x53000
SizeOfHeaders0x400
CheckSum0
Subsystem2
DllCharacteristics0x160
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MASM/TASM - sig4

Sections

namevavsizeraw sizeflags
.text0x10000x3b20f0x3b400R-X CODE
.rdata0x3d0000xef620xf000R-- IDATA
.data0x4c0000x7b80x200RW- IDATA
.pdata0x4d0000x309c0x3200R-- IDATA
.rsrc0x510000x1e00x200R-- IDATA
.reloc0x520000x2fc0x400R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT0x4b0300x60
IMPORT0x4b0900xa0
RESOURCE0x510000x1e0
EXCEPTION0x4d0000x309c
SECURITY00
BASERELOC0x520000x2fc
DEBUG0x3d5f00x38
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x478000x70
Bound_IAT00
IAT0x3d0000x5a0
Delay_IAT00
CLR_Header00
typenamesizecp
MANIFEST#23810
module_namehintordfunction_name
WS2_32.dll10
WS2_32.dll57
WS2_32.dll13
WS2_32.dll1
WS2_32.dll20
WS2_32.dll17
WS2_32.dll164freeaddrinfo
WS2_32.dll165getaddrinfo
WS2_32.dll58WSAIoctl
WS2_32.dll23
WS2_32.dll21
WS2_32.dll15
WS2_32.dll9
WS2_32.dll7
WS2_32.dll6
WS2_32.dll5
WS2_32.dll4
WS2_32.dll3
WS2_32.dll2
WS2_32.dll19
WS2_32.dll16
WS2_32.dll112
WS2_32.dll18
WS2_32.dll151
WS2_32.dll111
WS2_32.dll116
WS2_32.dll115
WLDAP32.dll211
WLDAP32.dll46
WLDAP32.dll60
WLDAP32.dll50
WLDAP32.dll301
WLDAP32.dll200
WLDAP32.dll30
WLDAP32.dll79
WLDAP32.dll35
WLDAP32.dll33
WLDAP32.dll32
WLDAP32.dll27
WLDAP32.dll26
WLDAP32.dll22
WLDAP32.dll41
WLDAP32.dll143
Normaliz.dllIdnToAscii
ADVAPI32.dll195CryptCreateHash
ADVAPI32.dll212CryptGetHashParam
ADVAPI32.dll219CryptReleaseContext
ADVAPI32.dll192CryptAcquireContextA
ADVAPI32.dll216CryptHashData
ADVAPI32.dll198CryptDestroyHash
KERNEL32.dll1499WideCharToMultiByte
KERNEL32.dll980MultiByteToWideChar
KERNEL32.dll279DisableThreadLibraryCalls
KERNEL32.dll733GetSystemTimeAsFileTime
KERNEL32.dll532GetCurrentThreadId
KERNEL32.dll528GetCurrentProcessId
KERNEL32.dll1072QueryPerformanceCounter
KERNEL32.dll880IsProcessorFeaturePresent
KERNEL32.dll874IsDebuggerPresent
KERNEL32.dll255DecodePointer
KERNEL32.dll293EncodePointer
KERNEL32.dll346ExpandEnvironmentStringsA
KERNEL32.dll1463WaitForMultipleObjects
KERNEL32.dll1030PeekNamedPipe
KERNEL32.dll581GetFileType
KERNEL32.dll711GetStdHandle
KERNEL32.dll1465WaitForSingleObject
KERNEL32.dll127CloseHandle
KERNEL32.dll415FormatMessageA
KERNEL32.dll1378SleepEx
KERNEL32.dll1375Sleep
KERNEL32.dll262DeleteCriticalSection
KERNEL32.dll933LeaveCriticalSection
KERNEL32.dll297EnterCriticalSection
KERNEL32.dll848InitializeCriticalSection
KERNEL32.dll1304SetLastError
KERNEL32.dll598GetLastError
KERNEL32.dll761GetTickCount
KERNEL32.dll1447VerifyVersionInfoA
KERNEL32.dll936LoadLibraryA
KERNEL32.dll676GetProcAddress
KERNEL32.dll420FreeLibrary
KERNEL32.dll1444VerSetConditionMask
KERNEL32.dll1107ReadFile
MSVCP120.dll688char const * __ptr64 __cdecl std::_Syserror_map(int)

?_Syserror_map@std@@YAPEBDH@Z

MSVCP120.dll713void __cdecl std::_Xbad_alloc(void)

?_Xbad_alloc@std@@YAXXZ

MSVCP120.dll717void __cdecl std::_Xout_of_range(char const * __ptr64)

?_Xout_of_range@std@@YAXPEBD@Z

MSVCP120.dll716void __cdecl std::_Xlength_error(char const * __ptr64)

?_Xlength_error@std@@YAXPEBD@Z

MSVCP120.dll709char const * __ptr64 __cdecl std::_Winerror_map(int)

?_Winerror_map@std@@YAPEBDH@Z

MSVCR120.dll658_fstat64
MSVCR120.dll1632getenv
MSVCR120.dll869_lseeki64
MSVCR120.dll1797strcmp
MSVCR120.dll514_beginthreadex
MSVCR120.dll1655isupper
MSVCR120.dll1651islower
MSVCR120.dll1652isprint
MSVCR120.dll1649isgraph
MSVCR120.dll859_lock
MSVCR120.dll1223_unlock
MSVCR120.dll521_calloc_crt
MSVCR120.dll415__dllonexit
MSVCR120.dll348__C_specific_handler
MSVCR120.dll1026_onexit
MSVCR120.dll349__CppXcptFilter
MSVCR120.dll498_amsg_exit
MSVCR120.dll876_malloc_crt
MSVCR120.dll737_initterm
MSVCR120.dll738_initterm_e
MSVCR120.dll413__crt_debugger_hook
MSVCR120.dll412__crtUnhandledException
MSVCR120.dll411__crtTerminateProcess
MSVCR120.dll381__crtCaptureCurrentContext
MSVCR120.dll382__crtCapturePreviousContext
MSVCR120.dll307void __cdecl terminate(void)

?terminate@@YAXXZ

MSVCR120.dll283public: void __cdecl type_info::_type_info_dtor_internal_method(void) __ptr64

?_type_info_dtor_internal_method@type_info@@QEAAXXZ

MSVCR120.dll379__clean_type_info_names_internal
MSVCR120.dll1137_strdup
MSVCR120.dll1141_stricmp
MSVCR120.dll1151_strnicmp
MSVCR120.dll535_close
MSVCR120.dll1027_open
MSVCR120.dll1048_read
MSVCR120.dll1392_write
MSVCR120.dll325_CxxThrowException
MSVCR120.dll1921wprintf
MSVCR120.dll1038_purecall
MSVCR120.dll1719memmove
MSVCR120.dll1715memchr
MSVCR120.dll1462atoi
MSVCR120.dll354__CxxFrameHandler3
MSVCR120.dll114void __cdecl operator delete(void * __ptr64)

??3@YAXPEAX@Z

MSVCR120.dll112void * __ptr64 __cdecl operator new(unsigned __int64)

??2@YAPEAX_K@Z

MSVCR120.dll1754realloc
MSVCR120.dll1706malloc
MSVCR120.dll1477calloc
MSVCR120.dll1616free
MSVCR120.dll1717memcpy
MSVCR120.dll1721memset
MSVCR120.dll1796strchr
MSVCR120.dll1813strrchr
MSVCR120.dll425__iob_func
MSVCR120.dll1570fclose
MSVCR120.dll1606fopen
MSVCR120.dll1614fread
MSVCR120.dll1131_stat64
MSVCR120.dll1808strncmp
MSVCR120.dll1590fgets
MSVCR120.dll1611fputs
MSVCR120.dll1792sscanf
MSVCR120.dll1749qsort
MSVCR120.dll1164_strtoi64
MSVCR120.dll1195_time64
MSVCR120.dll591_errno
MSVCR120.dll1843tolower
MSVCR120.dll1670isxdigit
MSVCR120.dll1809strncpy
MSVCR120.dll1815strstr
MSVCR120.dll1627fwrite
MSVCR120.dll1821strtol
MSVCR120.dll1824strtoul
MSVCR120.dll1648isdigit
MSVCR120.dll1610fputc
MSVCR120.dll1787sprintf
MSVCR120.dll1716memcmp
MSVCR120.dll1654isspace
MSVCR120.dll1622fseek
MSVCR120.dll1587fflush
MSVCR120.dll1645isalpha
MSVCR120.dll1644isalnum
MSVCR120.dll722_gmtime64
MSVCR120.dll1802strerror
MSVCR120.dll468__sys_nerr
ordentry_vafunction_name
10x1e50MSdocPublish
20x12c0docPublish
module_nameasedo64.dll
flags0
timestamp2014-02-14 09:06:34
version0.0
ordinal_base1
nFunctions2
nNames2
Names(2)0x4b060
Functions(2)0x4b058
NameOrdinals(2)0x4b068
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable
everything is OK