cracked.vmp.dll

info
MZ
PE
imports
foremost
hexdump
disasm
log
discuss
donate

filename	cracked.vmp.dll
size	6270464 (0x5fae00)
md5	72d8ff003c9b2e7749672e3a75cb214b

type	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	scan pending
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x80

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	6
TimeDateStamp	0x653973db
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x2102
Magic	0x10b
LinkerVersion	14.36
SizeOfCode	0x8d400
SizeOfInitializedData	0x15fc00
SizeOfUninitializedData	0
AddressOfEntryPoint	0x89e344
BaseOfCode	0x1000
BaseOfData	0x8f000
ImageBase	0x10000000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	6.0
ImageVersion	0.0
SubsystemVersion	6.0
Reserved1	0
SizeOfImage	0xb20000
SizeOfHeaders	0x400
CheckSum	0
Subsystem	2
DllCharacteristics	0x140
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x8d22c	0	R-X CODE
.rdata	0x8f000	0x157620	0	R-- IDATA
.data	0x1e7000	0x2a44	0	RW- IDATA
.fuck0	0x1ea000	0x339696	0	R-X CODE IDATA
.fuck1	0x524000	0x5fa030	0x5fa200	R-X CODE IDATA
.reloc	0xb1f000	0x608	0x800	R-- IDATA DISCARDABLE

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x91a7c8	0xb4
RESOURCE	0	0
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0xb1f000	0x608
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0xabba40	0x20
LOAD_CONFIG	0xb1df70	0x40
Bound_IAT	0	0
IAT	0x9b0000	0x70
Delay_IAT	0	0
CLR_Header	0	0

TLS

raw start	raw end	index	callbks	zero fill	flags
0x10abba58	0x10abba60	0x101e8c40	0	0	0x300000

module_name	hint	ord	function_name
KERNEL32.dll			FreeLibrary
USER32.dll			SetWindowLongW
IMM32.dll			ImmSetCandidateWindow
WTSAPI32.dll			WTSSendMessageW
KERNEL32.dll			VirtualQuery
USER32.dll			GetProcessWindowStation
KERNEL32.dll			LocalAlloc
KERNEL32.dll			LocalFree
KERNEL32.dll			GetModuleFileNameW
KERNEL32.dll			GetProcessAffinityMask
KERNEL32.dll			SetProcessAffinityMask
KERNEL32.dll			SetThreadAffinityMask
KERNEL32.dll			Sleep
KERNEL32.dll			ExitProcess
KERNEL32.dll			FreeLibrary
KERNEL32.dll			LoadLibraryA
KERNEL32.dll			GetModuleHandleA
KERNEL32.dll			GetProcAddress
USER32.dll			GetProcessWindowStation
USER32.dll			GetUserObjectInformationW

show previews

offset	size	type	comment
15c1	15	HTM		#
15d0	6264880	BIN	overlay data past EOF	#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] can't find file_offset of VA 0x1e8c40