parentocevogyv.dll
filenameocevogyv.unpacked.dll
size22763928 (0x15b5998)
md582eff6405e82a9447d9173c92ad4f36f
typePE32 executable (DLL) (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x110

Rich Header

lib idversiontimes used
1255072720
126503272
10950727126
170303197
93403516
147307293
10292
1714021945
001
1105072788
122507271
124507271
120507271

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections6
TimeDateStamp0x52456348
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x2d02
Magic0x10b
LinkerVersion8.0
SizeOfCode0x1582000
SizeOfInitializedData0x35000
SizeOfUninitializedData0
AddressOfEntryPoint0x15b4e
BaseOfCode0x1000
BaseOfData0x1583000
ImageBase0x10000000
SectionAlignment0x1000
FileAlignment0x1000
OperatingSystemVersion4.0
ImageVersion0.0
SubsystemVersion4.0
Reserved10
SizeOfImage0x15b8000
SizeOfHeaders0x1000
CheckSum0
Subsystem2
DllCharacteristics0x140
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ 6.0 - 8.0

Sections

namevavsizeraw sizeflags
.text0x10000x29b190x2a000R-X CODE
.core0x2b0000x1557a200x1558000R-X CODE
.rdata0x15830000x13a5c0x14000R-- IDATA
.data0x15970000x6b440x3000RW- IDATA
.rsrc0x159e0000x4580x1000R-- IDATA
.reloc0x159f0000x18a7a0x19000R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT0x15968500x20c
IMPORT0x15959440x78
RESOURCE0x159e0000x458
EXCEPTION00
SECURITY00
BASERELOC0x159f0000x3890
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT00
Delay_IAT00
CLR_Header00
typenamesizecp
VERSION#110160
module_namehintordfunction_name
KERNEL32.DLLUnmapViewOfFile
KERNEL32.DLLMapViewOfFile
KERNEL32.DLLCreateFileMappingW
KERNEL32.DLLGetSystemTime
KERNEL32.DLLWaitNamedPipeW
KERNEL32.DLLGetCurrentThread
KERNEL32.DLLGetProcAddress
KERNEL32.DLLGetModuleHandleA
KERNEL32.DLLSetProcessAffinityMask
KERNEL32.DLLSetThreadAffinityMask
KERNEL32.DLLGetProcessAffinityMask
KERNEL32.DLLCreateFileA
KERNEL32.DLLGetLongPathNameW
KERNEL32.DLLFreeLibrary
KERNEL32.DLLLoadLibraryW
KERNEL32.DLLCreateEventW
KERNEL32.DLLGetExitCodeThread
KERNEL32.DLLThread32Next
KERNEL32.DLLThread32First
KERNEL32.DLLCreateToolhelp32Snapshot
KERNEL32.DLLDuplicateHandle
KERNEL32.DLLGetCurrentThreadId
KERNEL32.DLLTerminateThread
KERNEL32.DLLExitProcess
KERNEL32.DLLVirtualAlloc
KERNEL32.DLLMultiByteToWideChar
KERNEL32.DLLVirtualFree
KERNEL32.DLLAddVectoredExceptionHandler
KERNEL32.DLLRemoveVectoredExceptionHandler
KERNEL32.DLLOpenEventW
KERNEL32.DLLGetCommandLineW
KERNEL32.DLLVirtualProtect
KERNEL32.DLLVirtualQuery
KERNEL32.DLLSetLastError
KERNEL32.DLLWriteConsoleW
KERNEL32.DLLGetStdHandle
KERNEL32.DLLGetEnvironmentVariableA
KERNEL32.DLLInitializeCriticalSection
KERNEL32.DLLDeleteCriticalSection
KERNEL32.DLLEnterCriticalSection
KERNEL32.DLLLeaveCriticalSection
KERNEL32.DLLInterlockedExchange
KERNEL32.DLLInterlockedIncrement
KERNEL32.DLLInterlockedDecrement
KERNEL32.DLLLCMapStringW
KERNEL32.DLLFlushViewOfFile
KERNEL32.DLLSetEndOfFile
KERNEL32.DLLSetFilePointer
KERNEL32.DLLGetFileInformationByHandle
KERNEL32.DLLGetSystemInfo
KERNEL32.DLLSetEvent
KERNEL32.DLLResetEvent
KERNEL32.DLLWaitForMultipleObjectsEx
KERNEL32.DLLReleaseMutex
KERNEL32.DLLWaitForSingleObjectEx
KERNEL32.DLLGetCPInfo
KERNEL32.DLLWideCharToMultiByte
KERNEL32.DLLFormatMessageA
KERNEL32.DLLGetVersionExA
KERNEL32.DLLGetVersionExW
KERNEL32.DLLGetModuleFileNameW
KERNEL32.DLLGetModuleFileNameA
KERNEL32.DLLCreateEventA
KERNEL32.DLLOpenEventA
KERNEL32.DLLCreateFileMappingA
KERNEL32.DLLCreateMutexA
KERNEL32.DLLCreateMutexW
KERNEL32.DLLWriteConsoleA
KERNEL32.DLLCreateProcessA
KERNEL32.DLLCreateProcessW
KERNEL32.DLLGetConsoleCP
KERNEL32.DLLLocalAlloc
KERNEL32.DLLCreateThread
KERNEL32.DLLAreFileApisANSI
KERNEL32.DLLGetOEMCP
KERNEL32.DLLGetACP
KERNEL32.DLLGetSystemTimeAsFileTime
KERNEL32.DLLQueryPerformanceCounter
KERNEL32.DLLGetEnvironmentStringsW
KERNEL32.DLLFreeEnvironmentStringsW
KERNEL32.DLLGetEnvironmentStrings
KERNEL32.DLLFreeEnvironmentStringsA
KERNEL32.DLLGetStartupInfoA
KERNEL32.DLLGetFileType
KERNEL32.DLLSetHandleCount
KERNEL32.DLLTlsFree
KERNEL32.DLLTlsSetValue
KERNEL32.DLLTlsAlloc
KERNEL32.DLLTlsGetValue
KERNEL32.DLLHeapCreate
KERNEL32.DLLGetCommandLineA
KERNEL32.DLLIsDebuggerPresent
KERNEL32.DLLSetUnhandledExceptionFilter
KERNEL32.DLLUnhandledExceptionFilter
KERNEL32.DLLRtlUnwind
KERNEL32.DLLGetThreadLocale
KERNEL32.DLLGetLocaleInfoA
KERNEL32.DLLRaiseException
KERNEL32.DLLGetProcessHeap
KERNEL32.DLLHeapSize
KERNEL32.DLLHeapReAlloc
KERNEL32.DLLHeapFree
KERNEL32.DLLHeapAlloc
KERNEL32.DLLHeapDestroy
KERNEL32.DLLLCMapStringA
KERNEL32.DLLGetStringTypeW
KERNEL32.DLLGetStringTypeA
KERNEL32.DLLSetStdHandle
KERNEL32.DLLFlushFileBuffers
KERNEL32.DLLGetCurrentProcess
KERNEL32.DLLSleep
KERNEL32.DLLSetNamedPipeHandleState
KERNEL32.DLLReadFile
KERNEL32.DLLCancelIo
KERNEL32.DLLGetOverlappedResult
KERNEL32.DLLPeekNamedPipe
KERNEL32.DLLTerminateProcess
KERNEL32.DLLGetCurrentProcessId
KERNEL32.DLLGetModuleHandleW
KERNEL32.DLLGetTickCount
KERNEL32.DLLCreateFileW
KERNEL32.DLLGetLastError
KERNEL32.DLLWriteFile
KERNEL32.DLLCloseHandle
KERNEL32.DLLFormatMessageW
KERNEL32.DLLFindResourceExW
KERNEL32.DLLFindResourceW
KERNEL32.DLLLoadResource
KERNEL32.DLLLockResource
KERNEL32.DLLSizeofResource
KERNEL32.DLLLocalFree
KERNEL32.DLLGetConsoleOutputCP
KERNEL32.DLLLoadLibraryA
KERNEL32.DLLGetConsoleMode
ADVAPI32.dllRegQueryValueExA
ADVAPI32.dllRegOpenKeyExA
ADVAPI32.dllSetSecurityDescriptorDacl
ADVAPI32.dllInitializeSecurityDescriptor
ADVAPI32.dllRegQueryValueExW
ADVAPI32.dllRegOpenKeyExW
ADVAPI32.dllRegCloseKey
ADVAPI32.dllReportEventW
ADVAPI32.dllRegisterEventSourceW
ADVAPI32.dllDeregisterEventSource
iphlpapi.dllGetAdaptersInfo
USER32.dllMessageBoxW
USER32.dllGetWindow
USER32.dllSetWindowPos
USER32.dllAllowSetForegroundWindow
USER32.dllMessageBoxA
USER32.dllwsprintfW
USER32.dllDefWindowProcW
USER32.dllLoadCursorW
USER32.dllRegisterClassExW
USER32.dllFindWindowW
USER32.dllCreateWindowExW
USER32.dllSendInput
USER32.dllSetForegroundWindow
USER32.dllUnregisterClassA
VERSION.dllGetFileVersionInfoSizeW
VERSION.dllVerQueryValueW
VERSION.dllGetFileVersionInfoW
ordentry_vafunction_name
10xd6888bPSM_0
20x22f6b4PSM_1
30x57bbPSA_CheckSuspiciousVectoredExceptions
40x1c316PSA_DummyFunction
50x57c0PSA_Uninitialize
60x5ef0PSC_EnterGlobalCriticalSection
70x5adfPSC_FinishInitializationFailure
80x5a59PSC_FinishInitializationSuccess
90x5c79PSC_GetErrorInformation
100x5f58PSC_LeaveGlobalCriticalSection
110x6042PSC_LoadString
120x5c11PSC_PerformInitializationAtValidLicense
130x5948PSC_StartInitialization
140x5b7ePSC_Uninitialize
module_nameocevogyv.dll
flags0
timestamp2013-09-27 10:51:52
version0.0
ordinal_base1
nFunctions14
nNames14
Names(14)0x15968b0
Functions(14)0x1596878
NameOrdinals(14)0x15968e8

StringTable 040904E4

CompanyNameCrytek
FileDescriptionHost Library
FileVersion5.70.046.004
InternalNameocevogyv.dll
LegalCopyright(c) Crytek
OriginalFilenameocevogyv.dll
ProductNameWarface
ProductVersion5.70
BuildInfo5.70.046.004, 27.09.13
ProjectGuidHashD509A45A3BB8B710C411E95055EC802C
ActionGuid{93f6cbfc-07c2-4ec1-8702-90711a9f2b5d}
TradeNameSF MMOG

VS_FIXEDFILEINFO

FileVersion5.70.46.4
ProductVersion5.70.0.0
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType2
FileSubtype0
offsetsizetypecomment
15c115HTM#
15d022758344BINoverlay data past EOF#
Scanning the drive for archives:
1 file, 22763928 bytes (22 MiB)



Errors: 1
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK