filenamepem_dll.dll
size616448 (0x96800)
md56da26835593079ad905c69a06f144b80
typePE32 executable (DLL) (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x108

Rich Header

lib idversiontimes used
2414011613
24340116150
2424011625
203655017
10131
149210223
2592340622
2612340624
2602340617
0088
256235061
255235061
258235061

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections8
TimeDateStamp0x56fae645
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x2102
Magic0x10b
LinkerVersion14.0
SizeOfCode0x77000
SizeOfInitializedData0x1f400
SizeOfUninitializedData0
AddressOfEntryPoint0x5e9d5
BaseOfCode0x1000
BaseOfData0x78000
ImageBase0x10000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.0
ImageVersion0.0
SubsystemVersion6.0
Reserved10
SizeOfImage0xc1000
SizeOfHeaders0x400
CheckSum0x9b5d5
Subsystem2
DllCharacteristics0x140
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ 6.0 - 8.0

Sections

namevavsizeraw sizeflags
.text0x10000x76f270x77000R-X CODE
.rdata0x780000x1730c0x17400R-- IDATA
.data0x900000x286700x2e00RW- IDATA
.trace0xb90000xab40xc00R-- IDATA
.gfids0xba0000xb00x200R-- IDATA
_RDATA0xbb0000x5400x600R-- IDATA
.rsrc0xbc0000x1b40x200R-- IDATA
.reloc0xbd0000x3bb00x3c00R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT0x8e8400x44
IMPORT0x8e8840x50
RESOURCE0xbc0000x1b4
EXCEPTION00
SECURITY00
BASERELOC0xbd0000x3bb0
DEBUG0x8de100x1c
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x8de300x40
Bound_IAT00
IAT0x780000x1d0
Delay_IAT00
CLR_Header00
typenamesizecp
MANIFEST#23461252
module_namehintordfunction_name
KERNEL32.dll1435VirtualAlloc
KERNEL32.dll1438VirtualFree
KERNEL32.dll1505WriteFile
KERNEL32.dll574GetFileType
KERNEL32.dll552GetEnvironmentVariableA
KERNEL32.dll409FormatMessageA
KERNEL32.dll127CloseHandle
KERNEL32.dll704GetStdHandle
KERNEL32.dll933LoadLibraryA
KERNEL32.dll747GetThreadLocale
KERNEL32.dll871IsDebuggerPresent
KERNEL32.dll669GetProcAddress
KERNEL32.dll612GetModuleHandleA
KERNEL32.dll414FreeLibrary
KERNEL32.dll186CreateFileA
KERNEL32.dll206CreateMutexA
KERNEL32.dll1164ReleaseMutex
KERNEL32.dll1451WaitForSingleObject
KERNEL32.dll526GetCurrentThreadId
KERNEL32.dll261DeleteCriticalSection
KERNEL32.dll930LeaveCriticalSection
KERNEL32.dll293EnterCriticalSection
KERNEL32.dll338ExitThread
KERNEL32.dll839InitializeCriticalSection
KERNEL32.dll179CreateEventA
KERNEL32.dll1264SetEvent
KERNEL32.dll1378TerminateThread
KERNEL32.dll1362Sleep
KERNEL32.dll567GetFileInformationByHandle
KERNEL32.dll738GetTempPathA
KERNEL32.dll736GetTempFileNameA
KERNEL32.dll582GetFullPathNameA
KERNEL32.dll585GetFullPathNameW
KERNEL32.dll713GetSystemDefaultLangID
KERNEL32.dll765GetUserDefaultLangID
KERNEL32.dll850InterlockedExchange
KERNEL32.dll1276SetFilePointer
KERNEL32.dll1104ReadFile
KERNEL32.dll1398TlsSetValue
KERNEL32.dll1397TlsGetValue
KERNEL32.dll1396TlsFree
KERNEL32.dll1291SetLastError
KERNEL32.dll1395TlsAlloc
KERNEL32.dll960MapViewOfFile
KERNEL32.dll187CreateFileMappingA
KERNEL32.dll997OpenFileMappingA
KERNEL32.dll1413UnmapViewOfFile
KERNEL32.dll589GetHandleInformation
KERNEL32.dll862IsBadReadPtr
KERNEL32.dll263DeleteFileA
KERNEL32.dll772GetVersionExA
KERNEL32.dll1333SetThreadPriority
KERNEL32.dll215CreateProcessA
KERNEL32.dll1263SetErrorMode
KERNEL32.dll456GetCommandLineA
KERNEL32.dll420GetACP
KERNEL32.dll1219SetConsoleCtrlHandler
KERNEL32.dll402FlushFileBuffers
KERNEL32.dll726GetSystemTimeAsFileTime
KERNEL32.dll521GetCurrentProcess
KERNEL32.dll1069QueryPerformanceCounter
KERNEL32.dll522GetCurrentProcessId
KERNEL32.dll843InitializeSListHead
KERNEL32.dll1410UnhandledExceptionFilter
KERNEL32.dll1347SetUnhandledExceptionFilter
KERNEL32.dll702GetStartupInfoW
KERNEL32.dll877IsProcessorFeaturePresent
KERNEL32.dll615GetModuleHandleW
KERNEL32.dll1377TerminateProcess
KERNEL32.dll610GetModuleFileNameA
KERNEL32.dll1443VirtualQuery
KERNEL32.dll525GetCurrentThread
KERNEL32.dll1258SetEndOfFile
KERNEL32.dll1088RaiseException
KERNEL32.dll254DecodePointer
KERNEL32.dll611GetModuleFileNameW
KERNEL32.dll852InterlockedFlushSList
KERNEL32.dll1197RtlUnwind
KERNEL32.dll840InitializeCriticalSectionAndSpinCount
KERNEL32.dll935LoadLibraryExW
KERNEL32.dll337ExitProcess
KERNEL32.dll614GetModuleHandleExW
KERNEL32.dll1314SetStdHandle
KERNEL32.dll1485WideCharToMultiByte
KERNEL32.dll476GetConsoleCP
KERNEL32.dll494GetConsoleMode
KERNEL32.dll1070QueryPerformanceFrequency
KERNEL32.dll977MultiByteToWideChar
KERNEL32.dll819HeapFree
KERNEL32.dll815HeapAlloc
KERNEL32.dll822HeapReAlloc
KERNEL32.dll824HeapSize
KERNEL32.dll147CompareStringW
KERNEL32.dll918LCMapStringW
KERNEL32.dll709GetStringTypeW
KERNEL32.dll562GetFileAttributesExW
KERNEL32.dll1277SetFilePointerEx
KERNEL32.dll1504WriteConsoleW
KERNEL32.dll882IsValidCodePage
KERNEL32.dll646GetOEMCP
KERNEL32.dll435GetCPInfo
KERNEL32.dll551GetEnvironmentStringsW
KERNEL32.dll413FreeEnvironmentStringsW
KERNEL32.dll1261SetEnvironmentVariableA
KERNEL32.dll674GetProcessHeap
KERNEL32.dll457GetCommandLineW
KERNEL32.dll194CreateFileW
KERNEL32.dll1102ReadConsoleW
KERNEL32.dll592GetLastError
imagehlp.dll54SymCleanup
imagehlp.dll51StackWalk64
imagehlp.dll115SymInitialize
ADVAPI32.dll794SystemFunction036
ordentry_vafunction_name
10x1000input
module_namepem_dll.dll
flags0
timestamp2016-03-29 20:32:05
version0.0
ordinal_base1
nFunctions1
nNames1
Names(1)0x8e86c
Functions(1)0x8e868
NameOrdinals(1)0x8e870
offsetsizetypecomment
0616448DLL03/29/2016 20:32:05#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK