filenamed3d8thk.dll
size11264 (0x2c00)
md577b1471a490b53b24efe136f09f76550
typePE32 executable (DLL) (console) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xd8

Rich Header

lib idversiontimes used
149307291
1313072912
147307297
1078
146307291
148307291
145307291

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections4
TimeDateStamp0x4a5bd9a8
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x2102
Magic0x10b
LinkerVersion9.0
SizeOfCode0x1c00
SizeOfInitializedData0xe00
SizeOfUninitializedData0
AddressOfEntryPoint0x11f0
BaseOfCode0x1000
BaseOfData0x3000
ImageBase0x41000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.1
ImageVersion6.1
SubsystemVersion6.1
Reserved10
SizeOfImage0x6000
SizeOfHeaders0x400
CheckSum0x9663
Subsystem3
DllCharacteristics0x140
SizeOfStackReserve0x40000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v7.0 DLL

Sections

namevavsizeraw sizeflags
.text0x10000x1abc0x1c00R-X CODE
.data0x30000x3480x200RW- IDATA
.rsrc0x40000x6c00x800R-- IDATA
.reloc0x50000x15c0x200R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT0x1cf80x7b3
IMPORT0x24ac0x50
RESOURCE0x40000x6c0
EXCEPTION00
SECURITY00
BASERELOC0x50000x15c
DEBUG0x2a5c0x38
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x17d00x40
Bound_IAT0x2700x44
IAT0x10000x134
Delay_IAT00
CLR_Header00
typenamesizecp
VERSION#116320
module_namehintordfunction_name
GDI32.dll168DdEntry1
GDI32.dll179DdEntry2
GDI32.dll190DdEntry3
GDI32.dll212DdEntry5
GDI32.dll201DdEntry4
GDI32.dll221DdEntry7
GDI32.dll222DdEntry8
GDI32.dll223DdEntry9
GDI32.dll169DdEntry10
GDI32.dll170DdEntry11
GDI32.dll172DdEntry13
GDI32.dll171DdEntry12
GDI32.dll173DdEntry14
GDI32.dll176DdEntry17
GDI32.dll174DdEntry15
GDI32.dll177DdEntry18
GDI32.dll175DdEntry16
GDI32.dll213DdEntry50
GDI32.dll178DdEntry19
GDI32.dll180DdEntry20
GDI32.dll181DdEntry21
GDI32.dll184DdEntry24
GDI32.dll182DdEntry22
GDI32.dll183DdEntry23
GDI32.dll185DdEntry25
GDI32.dll186DdEntry26
GDI32.dll187DdEntry27
GDI32.dll188DdEntry28
GDI32.dll189DdEntry29
GDI32.dll191DdEntry30
GDI32.dll192DdEntry31
GDI32.dll220DdEntry6
GDI32.dll193DdEntry32
GDI32.dll194DdEntry33
GDI32.dll195DdEntry34
GDI32.dll196DdEntry35
GDI32.dll198DdEntry37
GDI32.dll197DdEntry36
GDI32.dll199DdEntry38
GDI32.dll200DdEntry39
GDI32.dll202DdEntry40
GDI32.dll203DdEntry41
GDI32.dll204DdEntry42
GDI32.dll205DdEntry43
GDI32.dll206DdEntry44
GDI32.dll207DdEntry45
GDI32.dll208DdEntry46
GDI32.dll209DdEntry47
GDI32.dll210DdEntry48
GDI32.dll211DdEntry49
GDI32.dll214DdEntry51
GDI32.dll215DdEntry52
GDI32.dll216DdEntry53
GDI32.dll217DdEntry54
GDI32.dll218DdEntry55
GDI32.dll219DdEntry56
msvcrt.dll345_except_handler4_common
msvcrt.dll257_amsg_exit
msvcrt.dll469_initterm
msvcrt.dll1190free
msvcrt.dll1246malloc
msvcrt.dll106_XcptFilter
KERNEL32.dll1202Sleep
KERNEL32.dll1189SetUnhandledExceptionFilter
KERNEL32.dll1235UnhandledExceptionFilter
KERNEL32.dll448GetCurrentProcess
KERNEL32.dll1216TerminateProcess
KERNEL32.dll633GetSystemTimeAsFileTime
KERNEL32.dll449GetCurrentProcessId
KERNEL32.dll453GetCurrentThreadId
KERNEL32.dll659GetTickCount
KERNEL32.dll935QueryPerformanceCounter
KERNEL32.dll745InterlockedCompareExchange
KERNEL32.dll748InterlockedExchange
ordentry_vafunction_name
10x1821OsThunkD3dContextCreate
20x182cOsThunkD3dContextDestroy
30x1837OsThunkD3dContextDestroyAll
40x1842OsThunkD3dDrawPrimitives2
50x184dOsThunkD3dValidateTextureStageState
60x1858OsThunkDdAddAttachedSurface
70x1863OsThunkDdAlphaBlt
80x186eOsThunkDdAttachSurface
90x1879OsThunkDdBeginMoCompFrame
100x1884OsThunkDdBlt
110x188fOsThunkDdCanCreateD3DBuffer
120x189aOsThunkDdCanCreateSurface
130x18a5OsThunkDdColorControl
140x18b0OsThunkDdCreateD3DBuffer
150x18bbOsThunkDdCreateDirectDrawObject
160x18c6OsThunkDdCreateMoComp
170x18d1OsThunkDdCreateSurface
180x18dcOsThunkDdCreateSurfaceEx
190x18e7OsThunkDdCreateSurfaceObject
200x18f2OsThunkDdDeleteDirectDrawObject
210x18fdOsThunkDdDeleteSurfaceObject
220x1908OsThunkDdDestroyD3DBuffer
230x1913OsThunkDdDestroyMoComp
240x191eOsThunkDdDestroySurface
250x1929OsThunkDdEndMoCompFrame
260x1934OsThunkDdFlip
270x193fOsThunkDdFlipToGDISurface
280x194aOsThunkDdGetAvailDriverMemory
290x1955OsThunkDdGetBltStatus
300x1960OsThunkDdGetDC
310x196bOsThunkDdGetDriverInfo
320x1976OsThunkDdGetDriverState
330x1981OsThunkDdGetDxHandle
340x198cOsThunkDdGetFlipStatus
350x1997OsThunkDdGetInternalMoCompInfo
360x19a2OsThunkDdGetMoCompBuffInfo
370x19adOsThunkDdGetMoCompFormats
380x19b8OsThunkDdGetMoCompGuids
390x19c3OsThunkDdGetScanLine
400x19ceOsThunkDdLock
410x19d9OsThunkDdLockD3D
420x19e4OsThunkDdQueryDirectDrawObject
430x19efOsThunkDdQueryMoCompStatus
440x19faOsThunkDdReenableDirectDrawObject
450x1a05OsThunkDdReleaseDC
460x1a10OsThunkDdRenderMoComp
470x1a1bOsThunkDdResetVisrgn
480x1a26OsThunkDdSetColorKey
490x1a31OsThunkDdSetExclusiveMode
500x1a3cOsThunkDdSetGammaRamp
510x1a47OsThunkDdSetOverlayPosition
520x1a52OsThunkDdUnattachSurface
530x1a5dOsThunkDdUnlock
540x1a68OsThunkDdUnlockD3D
550x1a73OsThunkDdUpdateOverlay
560x1a7eOsThunkDdWaitForVerticalBlank
module_named3d8thk.dll
flags0
timestamp2009-07-13 23:27:45
version0.0
ordinal_base1
nFunctions56
nNames56
Names(56)0x1e00
Functions(56)0x1d20
NameOrdinals(56)0x1ee0

StringTable 040904B0

CompanyNameMicrosoft Corporation
FileDescriptionMicrosoft Direct3D OS Thunk Layer
FileVersion6.1.7600.16385 (win7_rtm.090713-1255)
InternalNameD3D8THK.dll
LegalCopyright© Microsoft Corporation. All rights reserved.
OriginalFilenameD3D8THK.dll
ProductNameMicrosoft® Windows® Operating System
ProductVersion6.1.7600.16385

StringTable 0c0904E4

CompanyNameMicrosoft Corporation
FileDescriptionMicrosoft Direct3D OS Thunk Layer
FileVersion6.1.7600.16385
InternalNameD3D8THK.dll
LegalCopyright© Microsoft Corporation. All rights reserved.
OriginalFilenameD3D8THK.dll
ProductNameMicrosoft® Windows® Operating System
ProductVersion6.1.7600.16385

VS_FIXEDFILEINFO

FileVersion6.1.7600.16385
ProductVersion6.1.7600.16385
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType2
FileSubtype0
offsetsizetypecomment
011264DLL07/14/2009 01:04:40#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] can't find file_offset of VA 0x270