Dumped01~Rip.dll

info
MZ
PE
imports
foremost
7zip
hexdump
disasm
log
discuss
donate

filename	Dumped01~Rip.dll
size	29785096 (0x1c67c08)
md5	7793d333ef06ef651319134750add8f4

type	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	scan pending
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0xf8

Rich Header

lib id	version	times used
259	27412	38
261	27412	175
260	27412	28
259	26706	24
261	26706	111
260	26706	34
257	27412	11
1	0	180
261	27043	3
265	27049	36
258	27049	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	6
TimeDateStamp	0x652f22bd
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x2102
Magic	0x10b
LinkerVersion	14.16
SizeOfCode	0x60e00
SizeOfInitializedData	0x36400
SizeOfUninitializedData	0
AddressOfEntryPoint	0x3c68c
BaseOfCode	0x1000
BaseOfData	0x62000
ImageBase	0x10000000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	6.0
ImageVersion	0.0
SubsystemVersion	6.0
Reserved1	0
SizeOfImage	0x9b000
SizeOfHeaders	0x400
CheckSum	0
Subsystem	2
DllCharacteristics	0x140
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

MS Visual C++ 6.0 - 8.0

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x60cdf	0x60e00	R-X CODE
.rdata	0x62000	0x183c4	0x18400	R-- IDATA
.data	0x7b000	0x18b3c	0x17600	RW- IDATA
.detourc	0x94000	0x11b0	0x1200	R-- IDATA
.detourd	0x96000	0xc	0x200	RW- IDATA
.reloc	0x97000	0x3e68	0x4000	R-- IDATA DISCARDABLE

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x79850	0x50
RESOURCE	0	0
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0x97000	0x3e68
DEBUG	0x77b70	0x38
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0x77c48	0x18
LOAD_CONFIG	0x77ba8	0x40
Bound_IAT	0	0
IAT	0x62000	0x208
Delay_IAT	0	0
CLR_Header	0	0

TLS

raw start	raw end	index	callbks	zero fill	flags
0x10078670	0x10078678	0x1009298c	0x10062264	0	0x300000

module_name	hint	function_name
KERNEL32.dll	1103	QueryPerformanceCounter
KERNEL32.dll	1011	MultiByteToWideChar
KERNEL32.dll	816	GlobalAlloc
KERNEL32.dll	823	GlobalFree
KERNEL32.dll	827	GlobalLock
KERNEL32.dll	1538	WideCharToMultiByte
KERNEL32.dll	834	GlobalUnlock
KERNEL32.dll	1488	VirtualProtect
KERNEL32.dll	538	GetCurrentProcess
KERNEL32.dll	542	GetCurrentThread
KERNEL32.dll	936	K32GetModuleInformation
KERNEL32.dll	419	FlushInstructionCache
KERNEL32.dll	431	FreeLibraryAndExitThread
KERNEL32.dll	289	DisableThreadLibraryCalls
KERNEL32.dll	246	CreateThread
KERNEL32.dll	612	GetLastError
KERNEL32.dll	543	GetCurrentThreadId
KERNEL32.dll	1417	SuspendThread
KERNEL32.dll	1231	ResumeThread
KERNEL32.dll	762	GetThreadContext
KERNEL32.dll	1368	SetThreadContext
KERNEL32.dll	1482	VirtualAlloc
KERNEL32.dll	1485	VirtualFree
KERNEL32.dll	1490	VirtualQuery
KERNEL32.dll	1332	SetLastError
KERNEL32.dll	967	LoadLibraryExW
KERNEL32.dll	1298	SetEndOfFile
KERNEL32.dll	849	HeapSize
KERNEL32.dll	206	CreateFileW
KERNEL32.dll	1358	SetStdHandle
KERNEL32.dll	695	GetProcessHeap
KERNEL32.dll	429	FreeEnvironmentStringsW
KERNEL32.dll	570	GetEnvironmentStringsW
KERNEL32.dll	474	GetCommandLineW
KERNEL32.dll	473	GetCommandLineA
KERNEL32.dll	666	GetOEMCP
KERNEL32.dll	437	GetACP
KERNEL32.dll	911	IsValidCodePage
KERNEL32.dll	399	FindNextFileW
KERNEL32.dll	382	FindFirstFileExW
KERNEL32.dll	376	FindClose
KERNEL32.dll	847	HeapReAlloc
KERNEL32.dll	591	GetFileSizeEx
KERNEL32.dll	515	GetConsoleOutputCP
KERNEL32.dll	1558	WriteFile
KERNEL32.dll	418	FlushFileBuffers
KERNEL32.dll	343	EnumSystemLocalesW
KERNEL32.dll	789	GetUserDefaultLCID
KERNEL32.dll	913	IsValidLocale
KERNEL32.dll	430	FreeLibrary
KERNEL32.dll	689	GetProcAddress
KERNEL32.dll	1104	QueryPerformanceFrequency
KERNEL32.dll	840	HeapAlloc
KERNEL32.dll	593	GetFileType
KERNEL32.dll	725	GetStdHandle
KERNEL32.dll	1138	ReadConsoleW
KERNEL32.dll	965	LoadLibraryA
KERNEL32.dll	635	GetModuleHandleW
KERNEL32.dll	1557	WriteConsoleW
KERNEL32.dll	1409	Sleep
KERNEL32.dll	730	GetStringTypeW
KERNEL32.dll	304	EncodePointer
KERNEL32.dll	268	DecodePointer
KERNEL32.dll	1124	RaiseException
KERNEL32.dll	137	CloseHandle
KERNEL32.dll	1500	WaitForSingleObjectEx
KERNEL32.dll	1419	SwitchToThread
KERNEL32.dll	308	EnterCriticalSection
KERNEL32.dll	961	LeaveCriticalSection
KERNEL32.dll	275	DeleteCriticalSection
KERNEL32.dll	426	FormatMessageW
KERNEL32.dll	866	InitializeCriticalSectionAndSpinCount
KERNEL32.dll	194	CreateEventW
KERNEL32.dll	1442	TlsAlloc
KERNEL32.dll	1444	TlsGetValue
KERNEL32.dll	1445	TlsSetValue
KERNEL32.dll	1443	TlsFree
KERNEL32.dll	748	GetSystemTimeAsFileTime
KERNEL32.dll	949	LCMapStringW
KERNEL32.dll	616	GetLocaleInfoW
KERNEL32.dll	452	GetCPInfo
KERNEL32.dll	1304	SetEvent
KERNEL32.dll	1224	ResetEvent
KERNEL32.dll	898	IsDebuggerPresent
KERNEL32.dll	1457	UnhandledExceptionFilter
KERNEL32.dll	1393	SetUnhandledExceptionFilter
KERNEL32.dll	723	GetStartupInfoW
KERNEL32.dll	905	IsProcessorFeaturePresent
KERNEL32.dll	539	GetCurrentProcessId
KERNEL32.dll	870	InitializeSListHead
KERNEL32.dll	1424	TerminateProcess
KERNEL32.dll	776	GetThreadTimes
KERNEL32.dll	631	GetModuleFileNameW
KERNEL32.dll	879	InterlockedFlushSList
KERNEL32.dll	1237	RtlUnwind
KERNEL32.dll	1141	ReadFile
KERNEL32.dll	634	GetModuleHandleExW
KERNEL32.dll	353	ExitProcess
KERNEL32.dll	844	HeapFree
KERNEL32.dll	1317	SetFilePointerEx
KERNEL32.dll	511	GetConsoleMode
USER32.dll	319	GetCursorPos
USER32.dll	804	SetCursorPos
USER32.dll	641	MessageBoxA
USER32.dll	485	GetWindowLongW
USER32.dll	33	CallWindowProcW
USER32.dll	881	SetWindowLongW
USER32.dll	289	GetAsyncKeyState
USER32.dll	665	OpenClipboard
USER32.dll	79	CloseClipboard
USER32.dll	232	EmptyClipboard
USER32.dll	308	GetClipboardData
USER32.dll	798	SetClipboardData
USER32.dll	358	GetKeyState
USER32.dll	773	ScreenToClient
USER32.dll	293	GetCapture
USER32.dll	77	ClientToScreen
USER32.dll	553	IsChild
USER32.dll	342	GetForegroundWindow
USER32.dll	596	LoadCursorW
USER32.dll	792	SetCapture
USER32.dll	802	SetCursor
USER32.dll	305	GetClientRect
USER32.dll	759	ReleaseCapture
IMM32.dll	119	ImmSetCompositionWindow
IMM32.dll	107	ImmReleaseContext
IMM32.dll	59	ImmGetContext

show previews

offset	size	type	comment
0	614400	DLL	10/18/2023 00:11:41	#
15c1	15	HTM		#
3dafa8	1429504	DLL	03/27/2023 17:54:01	#
5197f0	1758	PNG	(32 x 32)	#
519ed0	957	PNG	(32 x 32)	#
537fa8	138752	DLL	03/01/2023 08:47:29	#
559da8	1278976	EXE	01/18/2021 17:00:00	#
64d300	2178	PNG	(256 x 256)	#
681f3f	106	BMP	(9 x 11)	#
682020	106	BMP	(9 x 11)	#
684c4b	106	BMP	(9 x 11)	#
684d31	106	BMP	(9 x 11)	#
6861d7	106	BMP	(9 x 11)	#
6862bd	106	BMP	(9 x 11)	#
686788	106	BMP	(9 x 11)	#
68686f	106	BMP	(9 x 11)	#
686f20	106	BMP	(9 x 11)	#
687008	106	BMP	(9 x 11)	#
6879b3	106	BMP	(9 x 11)	#
687a99	106	BMP	(9 x 11)	#
687f38	106	BMP	(9 x 11)	#
68801c	106	BMP	(9 x 11)	#
6885b1	106	BMP	(9 x 11)	#
688697	106	BMP	(9 x 11)	#
688b36	106	BMP	(9 x 11)	#
688c1a	106	BMP	(9 x 11)	#
68c30a	106	BMP	(9 x 11)	#
68c3fe	106	BMP	(9 x 11)	#
690f2f	106	BMP	(9 x 11)	#
69100a	106	BMP	(9 x 11)	#
6921a8	153088	DLL	07/15/2021 19:33:55	#
6df3e8	125440	DLL	10/02/2021 13:02:39	#
6fdde8	137216	DLL	01/22/2022 04:25:32	#
775490	294912	DLL	03/13/2021 13:38:30	#
7bd490	21669752	BIN	overlay data past EOF	#

Scanning the drive for archives:
1 file, 29785096 bytes (29 MiB)



Errors: 1

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] can't find file_offset of VA 0x9298c