filenamewbemdisp.dll
size266752 (0x41200)
md5754a0c324eca95ae4f708d01ef27060e
typePE32+ executable (DLL) (console) x86-64, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xe8

Rich Header

lib idversiontimes used
149307291
10142
1473072915
132307293
1313072920
146307291
1383072947
148307291
145307291

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x8664
NumberOfSections5
TimeDateStamp0x4a5be089
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xf0
Characteristics0x2022
Magic0x20b
LinkerVersion9.0
SizeOfCode0x3c600
SizeOfInitializedData0x4e00
SizeOfUninitializedData0
AddressOfEntryPoint0x33b14
BaseOfCode0x1000
ImageBase0x7ff328e0000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.1
ImageVersion6.1
SubsystemVersion6.1
Reserved10
SizeOfImage0x45000
SizeOfHeaders0x400
CheckSum0x41ec8
Subsystem3
DllCharacteristics0x140
SizeOfStackReserve0x40000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Sections

namevavsizeraw sizeflags
.text0x10000x3c4c50x3c600R-X CODE
.data0x3e0000xb800x600RW- IDATA
.pdata0x3f0000x31140x3200R-- IDATA
.rsrc0x430000x3e80x400R-- IDATA
.reloc0x440000xaf20xc00R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT0x3d4200xa5
IMPORT0x3c79c0x8c
RESOURCE0x430000x3e8
EXCEPTION0x3f0000x3114
SECURITY00
BASERELOC0x440000x82c
DEBUG0x14700x1c
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT0x2b80x9c
IAT0x10000x440
Delay_IAT00
CLR_Header00
typenamesizecp
VERSION#19040
module_namehintordfunction_name
msvcrt.dll889_wcsicmp
msvcrt.dll12public: __cdecl exception::exception(class exception const & __ptr64) __ptr64

??0exception@@QEAA@AEBV0@@Z

msvcrt.dll1153memcpy_s
msvcrt.dll50public: virtual char const * __ptr64 __cdecl exception::what(void)const __ptr64

?what@exception@@UEBAPEBDXZ

msvcrt.dll17public: virtual __cdecl exception::~exception(void) __ptr64

??1exception@@UEAA@XZ

msvcrt.dll10public: __cdecl exception::exception(char const * __ptr64 const & __ptr64) __ptr64

??0exception@@QEAA@AEBQEBD@Z

msvcrt.dll1155memmove_s
msvcrt.dll13public: __cdecl exception::exception(void) __ptr64

??0exception@@QEAA@XZ

msvcrt.dll903_wcsnset
msvcrt.dll653_purecall
msvcrt.dll1126iswspace
msvcrt.dll1286wcstol
msvcrt.dll259_fcvt
msvcrt.dll1147mbstowcs
msvcrt.dll1140malloc
msvcrt.dll1082free
msvcrt.dll1175realloc
msvcrt.dll1278wcsrchr
msvcrt.dll899_wcsnicmp
msvcrt.dll856_vsnwprintf
msvcrt.dll1121iswdigit
msvcrt.dll805_ui64tow
msvcrt.dll1263wcschr
msvcrt.dll76_CxxThrowException
msvcrt.dll87__CxxFrameHandler3
msvcrt.dll82_XcptFilter
msvcrt.dll364_initterm
msvcrt.dll160_amsg_exit
msvcrt.dll83__C_specific_handler
msvcrt.dll18public: virtual __cdecl type_info::~type_info(void) __ptr64

??1type_info@@UEAA@XZ

msvcrt.dll1069floor
msvcrt.dll1156memset
msvcrt.dll1151memcmp
msvcrt.dll1044ceil
KERNEL32.dll815LCMapStringW
KERNEL32.dll683GetVersionExA
KERNEL32.dll1203SetUnhandledExceptionFilter
KERNEL32.dll1250UnhandledExceptionFilter
KERNEL32.dll1230TerminateProcess
KERNEL32.dll640GetSystemTimeAsFileTime
KERNEL32.dll455GetCurrentProcessId
KERNEL32.dll666GetTickCount
KERNEL32.dll937QueryPerformanceCounter
KERNEL32.dll1048RtlCaptureContext
KERNEL32.dll1055RtlLookupFunctionEntry
KERNEL32.dll1062RtlVirtualUnwind
KERNEL32.dll907OutputDebugStringA
KERNEL32.dll1216Sleep
KERNEL32.dll671GetTimeZoneInformation
KERNEL32.dll96CompareFileTime
KERNEL32.dll299FileTimeToSystemTime
KERNEL32.dll1227SystemTimeToFileTime
KERNEL32.dll520GetLastError
KERNEL32.dll747InitializeCriticalSectionAndSpinCount
KERNEL32.dll210DeleteCriticalSection
KERNEL32.dll242EnterCriticalSection
KERNEL32.dll827LeaveCriticalSection
KERNEL32.dll459GetCurrentThreadId
KERNEL32.dll684GetVersionExW
KERNEL32.dll631GetSystemDirectoryW
KERNEL32.dll832LoadLibraryExW
KERNEL32.dll588GetProcAddress
KERNEL32.dll360FreeLibrary
KERNEL32.dll838LocalAlloc
KERNEL32.dll458GetCurrentThread
KERNEL32.dll454GetCurrentProcess
KERNEL32.dll82CloseHandle
KERNEL32.dll842LocalFree
KERNEL32.dll627GetSystemDefaultLangID
KERNEL32.dll1237TlsGetValue
KERNEL32.dll1238TlsSetValue
KERNEL32.dll1235TlsAlloc
KERNEL32.dll1236TlsFree
KERNEL32.dll746InitializeCriticalSection
KERNEL32.dll538GetModuleFileNameW
ADVAPI32.dll503OpenProcessToken
ADVAPI32.dll580RegDeleteKeyW
ADVAPI32.dll612RegOpenKeyW
ADVAPI32.dll638RegSetValueExW
ADVAPI32.dll572RegCreateKeyW
ADVAPI32.dll705SetThreadToken
ADVAPI32.dll346GetTokenInformation
ADVAPI32.dll609RegOpenKeyExW
ADVAPI32.dll508OpenThreadToken
ADVAPI32.dll309GetKernelObjectSecurity
ADVAPI32.dll31AdjustTokenPrivileges
ADVAPI32.dll403LookupPrivilegeDisplayNameW
ADVAPI32.dll407LookupPrivilegeValueW
ADVAPI32.dll560RegCloseKey
ADVAPI32.dll622RegQueryValueExW
OLEAUT32.dll149
OLEAUT32.dll185
OLEAUT32.dll184
OLEAUT32.dll163
OLEAUT32.dll161
OLEAUT32.dll274
OLEAUT32.dll147
OLEAUT32.dll15
OLEAUT32.dll17
OLEAUT32.dll3
OLEAUT32.dll40
OLEAUT32.dll201
OLEAUT32.dll202
OLEAUT32.dll30
OLEAUT32.dll29
OLEAUT32.dll162
OLEAUT32.dll27
OLEAUT32.dll16
OLEAUT32.dll20
OLEAUT32.dll19
OLEAUT32.dll26
OLEAUT32.dll25
OLEAUT32.dll12
OLEAUT32.dll10
OLEAUT32.dll200
OLEAUT32.dll4
OLEAUT32.dll7
OLEAUT32.dll6
OLEAUT32.dll9
OLEAUT32.dll8
OLEAUT32.dll2
ole32.dll107CoTaskMemAlloc
ole32.dll108CoTaskMemFree
ole32.dll20CoCreateInstance
ole32.dll136CreatePointerMoniker
ole32.dll437StringFromGUID2
wbemcomn.dll1198public: static int __cdecl CWin32DefaultArena::WbemMemFree(void * __ptr64)

?WbemMemFree@CWin32DefaultArena@@SAHPEAX@Z

wbemcomn.dll1197public: static void * __ptr64 __cdecl CWin32DefaultArena::WbemMemAlloc(unsigned __int64)

?WbemMemAlloc@CWin32DefaultArena@@SAPEAX_K@Z

wbemcomn.dll452unsigned long __cdecl BreakOnDbgAndRenterLoop(void)

?BreakOnDbgAndRenterLoop@@YAKXZ

wbemcomn.dll1229void __cdecl _ThrowMemoryException_(void)

?_ThrowMemoryException_@@YAXXZ

ordentry_vafunction_name
10x28aa4DllCanUnloadNow
20x287c0DllGetClassObject
30x2943cDllRegisterServer
40x29b14DllUnregisterServer
module_namewbemdisp.dll
flags0
timestamp2009-07-13 21:36:39
version0.0
ordinal_base1
nFunctions4
nNames4
Names(4)0x3d458
Functions(4)0x3d448
NameOrdinals(4)0x3d468

StringTable 040904B0

CompanyNameMicrosoft Corporation
FileDescriptionWMI Scripting
FileVersion6.1.7600.16385 (win7_rtm.090713-1255)
InternalNameWBEMDISP.DLL
LegalCopyright© Microsoft Corporation. All rights reserved.
OriginalFilenameWBEMDISP.DLL
ProductNameMicrosoft® Windows® Operating System
ProductVersion6.1.7600.16385

VS_FIXEDFILEINFO

FileVersion6.1.7600.16385
ProductVersion6.1.7600.16385
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType2
FileSubtype0
offsetsizetypecomment
15c115HTM#
15d0261168BINoverlay data past EOF#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] can't find file_offset of VA 0x2b8