ISSetup.dll - iKernel.dll - InstallShield (R) Setup Engine

info
MZ
PE
resources
imports
exports
foremost
version info
hexdump
disasm
log
discuss
donate

filename	ISSetup.dll
size	535552 (0x82c00)
md5	6c48e05107eb494620ab0dc96d3c5b80

type	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, PECompact2 compressed
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x118

Rich Header

lib id	version	times used
12	7291	4
14	7299	32
10	8047	132
11	8047	15
11	8798	3
37	8755	2
28	9178	5
25	9210	19
1	0	428
10	8966	8
11	8966	121
6	1735	1
4	8447	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	3
TimeDateStamp	0x4626b290
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x210e
Magic	0x10b
LinkerVersion	6.0
SizeOfCode	0xe9000
SizeOfInitializedData	0x85000
SizeOfUninitializedData	0
AddressOfEntryPoint	0x18f303
BaseOfCode	0x1000
BaseOfData	0xea000
ImageBase	0x10000000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	4.0
ImageVersion	0.0
SubsystemVersion	4.0
Reserved1	0
SizeOfImage	0x191000
SizeOfHeaders	0x400
CheckSum	0x8d7f3
Subsystem	2
DllCharacteristics	0
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

PeCompact 2.xx (BitSum Technologies / v2.0)

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x16e000	0x61800	RWX CODE IDATA DISCARDABLE
.rsrc	0x16f000	0x21000	0x20e00	RWX CODE
.reloc	0x190000	0x1000	0x200	RW- IDATA

Data Directory

type	va	size
EXPORT	0x18ee70	0xed
IMPORT	0x18f0bc	0x2a3
RESOURCE	0x16f000	0x1fe68
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0x190000	0x10
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0	0
Delay_IAT	0	0
CLR_Header	0	0

show previews

type	name	size
PUBLICKEY	#208	148
TYPELIB	#1	103596
ICON	#1	1640
ICON	#2	744
ICON	#3	296
ICON	#4	3752
ICON	#5	2216
ICON	#6	1384
ICON	#7	9640
ICON	#8	4264
ICON	#9	1128
DIALOG	#205	812
STRING	#7	860
STRING	#8	112
GROUP_ICON	#201	132
VERSION	#1	864

module_name	ord	function_name
kernel32.dll		LoadLibraryA
kernel32.dll		GetProcAddress
kernel32.dll		VirtualAlloc
kernel32.dll		VirtualFree
USER32.dll		WaitForInputIdle
GDI32.dll		CreatePalette
ADVAPI32.dll		LookupPrivilegeValueA
SHELL32.dll		SHGetMalloc
ole32.dll		WriteClassStm
OLEAUT32.dll	286
RPCRT4.dll		UuidCreate
WINMM.dll		mciSendCommandA
VERSION.dll		GetFileVersionInfoA

ord	entry_va	function_name
1	0x88ed4	DllCanUnloadNow
2	0x88ee0	DllGetClassObject
3	0x88ef9	DllRegisterServer
4	0x88ef9	DllUnregisterServer
5	0x88f40	GetProductSKU
6	0x88efc	InstallEngineTypelib
7	0x88f12	RemoveEngineTypelib

module_name
flags	0
timestamp	2007-04-19 00:06:40
version	0.0
ordinal_base	1
nFunctions	7
nNames	7
Names(7)	0x18eea6
Functions(7)	0x18eec2
NameOrdinals(7)	0x18ee98

StringTable 040904B0

CompanyName	Macrovision Corporation
FileDescription	InstallShield (R) Setup Engine
FileVersion	14.0.162
InternalName	Kernel
OriginalFilename	iKernel.dll
LegalCopyright	Copyright (C) 2007 Macrovision Corporation
ProductName	InstallShield
ProductVersion	14.0
Internal Build Number	62562

VS_FIXEDFILEINFO

FileVersion	14.0.0.162
ProductVersion	14.0.0.0
StrucVersion	0x10000
FileFlagsMask	0x3f
FileFlags	1
FileOS	0x40004
FileType	1
FileSubtype	0

show previews

offset	size	type	comment
0	535552	DLL	04/19/2007 00:06:40	#
15c1	15	HTM		#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] can't find file_offset of VA 0x137000

[?] can't find file_offset of VA 0x137098

[?] can't find file_offset of VA 0x1373c8

[?] can't find file_offset of VA 0x137728

[?] can't find file_offset of VA 0x1120ae

ISSetup.dll-