filenamerdpcore.dll
size826880 (0xc9e00)
md586f34e7288da428e38e2d8c7e806a871
typePE32 executable (DLL) (console) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xe8

Rich Header

lib idversiontimes used
1493072914
10445
1473072937
13130729118
146307291
13230729239
126507271
148307291
145307291

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections4
TimeDateStamp0x4f3de555
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x2102
Magic0x10b
LinkerVersion9.0
SizeOfCode0xbc800
SizeOfInitializedData0x10800
SizeOfUninitializedData0
AddressOfEntryPoint0x1db27
BaseOfCode0x1000
BaseOfData0xbe000
ImageBase0x1ad60000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.1
ImageVersion6.1
SubsystemVersion5.1
Reserved10
SizeOfImage0xd0000
SizeOfHeaders0x400
CheckSum0xd0002
Subsystem3
DllCharacteristics0x140
SizeOfStackReserve0x40000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v8.0 DLL

Sections

namevavsizeraw sizeflags
.text0x10000xbc6440xbc800R-X CODE
.data0xbe0000x5c3c0x2800RW- IDATA
.rsrc0xc40000x3e80x400R-- IDATA
.reloc0xc50000xa4220xa600R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT0xbd5f00x54
IMPORT0xbb2c40x17c
RESOURCE0xc40000x3e8
EXCEPTION00
SECURITY00
BASERELOC0xc50000x901c
DEBUG0x16a00x1c
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x1d0700x40
Bound_IAT0x2800x178
IAT0x10000x674
Delay_IAT00
CLR_Header00
typenamesizecp
VERSION#19040
module_namehintordfunction_name
msvcrt.dll862_stricmp
msvcrt.dll968_vsnprintf
msvcrt.dll872_strnicmp
msvcrt.dll1361wcschr
msvcrt.dll588_ltoa
msvcrt.dll974_vsnwprintf
msvcrt.dll1017_wcsnicmp
msvcrt.dll764_purecall
msvcrt.dll1007_wcsicmp
msvcrt.dll18void * __cdecl operator new(unsigned int)

??2@YAPAXI@Z

msvcrt.dll20void __cdecl operator delete(void *)

??3@YAXPAX@Z

msvcrt.dll866_strlwr
msvcrt.dll106_XcptFilter
msvcrt.dll1311strncmp
msvcrt.dll1253mbstowcs
msvcrt.dll1267printf
msvcrt.dll1380wcsstr
msvcrt.dll1376wcsrchr
msvcrt.dll1246malloc
msvcrt.dll478_isatty
msvcrt.dll1096_write
msvcrt.dll587_lseeki64
msvcrt.dll367_fileno
msvcrt.dll207__pioinfo
msvcrt.dll133__badioinfo
msvcrt.dll1385wcstombs
msvcrt.dll1172ferror
msvcrt.dll561_itoa
msvcrt.dll1190free
msvcrt.dll815_snprintf
msvcrt.dll475_iob
msvcrt.dll1218isleadbyte
msvcrt.dll176__mb_cur_max
msvcrt.dll1255mbtowc
msvcrt.dll1216isdigit
msvcrt.dll747_onexit
msvcrt.dll578_lock
msvcrt.dll141__dllonexit
msvcrt.dll934_unlock
msvcrt.dll1260memmove
msvcrt.dll1258memcpy
msvcrt.dll1262memset
msvcrt.dll342_errno
msvcrt.dll257_amsg_exit
msvcrt.dll469_initterm
KERNEL32.dll674GetVersion
KERNEL32.dll1191SetUnhandledExceptionFilter
KERNEL32.dll1238UnhandledExceptionFilter
KERNEL32.dll773IsProcessorFeaturePresent
KERNEL32.dll449GetCurrentProcess
KERNEL32.dll1219TerminateProcess
KERNEL32.dll633GetSystemTimeAsFileTime
KERNEL32.dll450GetCurrentProcessId
KERNEL32.dll454GetCurrentThreadId
KERNEL32.dll659GetTickCount
KERNEL32.dll935QueryPerformanceCounter
KERNEL32.dll1049RtlUnwind
KERNEL32.dll905OutputDebugStringA
KERNEL32.dll746InterlockedCompareExchange
KERNEL32.dll1205Sleep
KERNEL32.dll749InterlockedExchange
KERNEL32.dll223DisableThreadLibraryCalls
KERNEL32.dll130CreateDirectoryW
KERNEL32.dll215DeleteFileW
KERNEL32.dll643GetTempFileNameW
KERNEL32.dll303FindClose
KERNEL32.dll752InterlockedIncrement
KERNEL32.dll748InterlockedDecrement
KERNEL32.dll1115SetEvent
KERNEL32.dll239EnterCriticalSection
KERNEL32.dll826LeaveCriticalSection
KERNEL32.dll1274WaitForMultipleObjects
KERNEL32.dll513GetLastError
KERNEL32.dll1040ResetEvent
KERNEL32.dll83CloseHandle
KERNEL32.dll210DeleteCriticalSection
KERNEL32.dll1276WaitForSingleObject
KERNEL32.dll182CreateThread
KERNEL32.dll491GetFileInformationByHandle
KERNEL32.dll741InitializeCriticalSectionAndSpinCount
KERNEL32.dll841LocalFree
KERNEL32.dll871MultiByteToWideChar
KERNEL32.dll1300WideCharToMultiByte
KERNEL32.dll1216SystemTimeToFileTime
KERNEL32.dll631GetSystemTime
KERNEL32.dll676GetVersionExW
KERNEL32.dll921ProcessIdToSessionId
KERNEL32.dll896OpenProcess
KERNEL32.dll580GetProcAddress
KERNEL32.dll832LoadLibraryW
KERNEL32.dll355FreeLibrary
KERNEL32.dll1198SetWaitableTimer
KERNEL32.dll195CreateWaitableTimerW
KERNEL32.dll1022ReleaseSemaphore
KERNEL32.dll175CreateSemaphoreW
KERNEL32.dll72CancelWaitableTimer
KERNEL32.dll1349lstrcmpW
KERNEL32.dll1224TlsAlloc
KERNEL32.dll1225TlsFree
KERNEL32.dll1226TlsGetValue
KERNEL32.dll1227TlsSetValue
KERNEL32.dll1283WaitNamedPipeW
KERNEL32.dll144CreateFileW
KERNEL32.dll102ConnectNamedPipe
KERNEL32.dll67CancelIo
KERNEL32.dll567GetOverlappedResult
KERNEL32.dll161CreateNamedPipeW
KERNEL32.dll960ReadFile
KERNEL32.dll226DisconnectNamedPipe
KERNEL32.dll1320WriteFile
KERNEL32.dll58BindIoCompletionCallback
KERNEL32.dll1271WTSGetActiveConsoleSessionId
KERNEL32.dll1361lstrlenW
KERNEL32.dll1352lstrcmpiW
KERNEL32.dll1259VerifyVersionInfoW
KERNEL32.dll535GetModuleHandleW
KERNEL32.dll837LocalAlloc
KERNEL32.dll740InitializeCriticalSection
KERNEL32.dll534GetModuleHandleExW
KERNEL32.dll1215SwitchToThread
KERNEL32.dll901OpenThread
KERNEL32.dll664GetTimeZoneInformation
KERNEL32.dll906OutputDebugStringW
KERNEL32.dll200DebugBreak
KERNEL32.dll829LoadLibraryA
KERNEL32.dll55Beep
KERNEL32.dll400GetComputerNameW
KERNEL32.dll531GetModuleFileNameW
KERNEL32.dll627GetSystemInfo
KERNEL32.dll720HeapFree
KERNEL32.dll716HeapAlloc
KERNEL32.dll585GetProcessHeap
KERNEL32.dll356FreeLibraryAndExitThread
KERNEL32.dll532GetModuleHandleA
KERNEL32.dll691GlobalAddAtomW
KERNEL32.dll694GlobalDeleteAtom
KERNEL32.dll1140SetLastError
KERNEL32.dll1127SetFilePointer
KERNEL32.dll489GetFileAttributesW
KERNEL32.dll314FindFirstFileW
KERNEL32.dll326FindNextFileW
KERNEL32.dll699GlobalFree
KERNEL32.dll710GlobalUnlock
KERNEL32.dll692GlobalAlloc
KERNEL32.dll703GlobalLock
KERNEL32.dll707GlobalSize
KERNEL32.dll134CreateEventW
ADVAPI32.dll118CopySid
ADVAPI32.dll638RegSetValueExW
ADVAPI32.dll569RegCreateKeyExW
ADVAPI32.dll622RegQueryValueExW
ADVAPI32.dll609RegOpenKeyExW
ADVAPI32.dll203CryptReleaseContext
ADVAPI32.dll193CryptGenRandom
ADVAPI32.dll177CryptAcquireContextW
ADVAPI32.dll758TraceMessage
ADVAPI32.dll706SetTokenInformation
ADVAPI32.dll503OpenProcessToken
ADVAPI32.dll560RegCloseKey
ADVAPI32.dll310GetLengthSid
ADVAPI32.dll346GetTokenInformation
ADVAPI32.dll16AddAccessAllowedAce
ADVAPI32.dll374InitializeAcl
ADVAPI32.dll694SetSecurityDescriptorDacl
ADVAPI32.dll375InitializeSecurityDescriptor
ADVAPI32.dll124CreateProcessAsUserW
ADVAPI32.dll223DuplicateTokenEx
ADVAPI32.dll584RegDeleteValueW
ADVAPI32.dll770UnregisterTraceGuids
ADVAPI32.dll650RegisterTraceGuidsW
ADVAPI32.dll349GetTraceLoggerHandle
ADVAPI32.dll348GetTraceEnableLevel
ADVAPI32.dll347GetTraceEnableFlags
ntdll.dll873RtlGetLastNtStatus
ntdll.dll274NtDuplicateObject
ntdll.dll1369VerSetConditionMask
PSAPI.DLL14GetModuleBaseNameW
ole32.dll303OleGetClipboard
ole32.dll308OleIsCurrentClipboard
ole32.dll344ReleaseStgMedium
ole32.dll50CoGetMalloc
ole32.dll16CoCreateInstance
ole32.dll6CLSIDFromProgID
ole32.dll205IIDFromString
ole32.dll329OleUninitialize
ole32.dll306OleInitialize
ole32.dll325OleSetClipboard
OLEAUT32.dll4
OLEAUT32.dll7
OLEAUT32.dll10
OLEAUT32.dll150
OLEAUT32.dll149
OLEAUT32.dll2
OLEAUT32.dll6
OLEAUT32.dll8
OLEAUT32.dll9
OLEAUT32.dll12
CRYPT32.dll53CertFindCertificateInStore
CRYPT32.dll64CertFreeCertificateContext
CRYPT32.dll219CryptUnprotectData
CRYPT32.dll189CryptProtectData
CRYPT32.dll87CertOpenStore
CRYPT32.dll18CertCloseStore
USER32.dll307GetIconInfo
USER32.dll491LoadCursorW
USER32.dll163DestroyIcon
USER32.dll200DrawIconEx
USER32.dll100CreateIcon
USER32.dll85CopyRect
USER32.dll708SetWindowLongW
USER32.dll156DefWindowProcW
USER32.dll406GetWindowLongW
USER32.dll589RegisterClassExW
USER32.dll269GetClassInfoExW
USER32.dll243EqualRect
USER32.dll110CreateWindowExW
USER32.dll166DestroyWindow
USER32.dll412GetWindowRect
USER32.dll420GetWindowThreadProcessId
USER32.dll274GetClassNameW
USER32.dll480IsWindowVisible
USER32.dll398GetWindow
USER32.dll735ShowWindow
USER32.dll411GetWindowPlacement
USER32.dll686SetRect
USER32.dll260GetAncestor
USER32.dll242EnumWindows
USER32.dll377GetShellWindow
USER32.dll812WindowFromPoint
USER32.dll301GetForegroundWindow
USER32.dll246FillRect
USER32.dll71ClientToScreen
USER32.dll302GetGUIThreadInfo
USER32.dll284GetComboBoxInfo
USER32.dll766UnhookWinEvent
USER32.dll703SetWinEventHook
USER32.dll475IsWindow
USER32.dll658SetFocus
USER32.dll457IsChild
USER32.dll300GetFocus
USER32.dll636SendMessageW
USER32.dll276GetClientRect
USER32.dll234EnumDisplaySettingsW
USER32.dll569PostThreadMessageW
USER32.dll774UnregisterClassW
USER32.dll220EndPaint
USER32.dll14BeginPaint
USER32.dll710SetWindowPos
USER32.dll404GetWindowInfo
USER32.dll699SetTimer
USER32.dll483KillTimer
USER32.dll175DispatchMessageW
USER32.dll764TranslateMessage
USER32.dll349GetMessageW
USER32.dll229EnumDisplayDevicesW
USER32.dll563PeekMessageW
USER32.dll541MsgWaitForMultipleObjectsEx
USER32.dll659SetForegroundWindow
USER32.dll598RegisterHotKey
USER32.dll776UnregisterHotKey
USER32.dll263GetAsyncKeyState
USER32.dll590RegisterClassW
USER32.dll647SetClipboardViewer
USER32.dll283GetClipboardViewer
USER32.dll34ChangeClipboardChain
USER32.dll73CloseClipboard
USER32.dll224EnumClipboardFormats
USER32.dll86CountClipboardFormats
USER32.dll550OpenClipboard
USER32.dll592RegisterClipboardFormatW
USER32.dll646SetClipboardData
USER32.dll213EmptyClipboard
USER32.dll278GetClipboardData
USER32.dll458IsClipboardFormatAvailable
USER32.dll445IntersectRect
USER32.dll103CreateIconIndirect
USER32.dll468IsRectEmpty
USER32.dll520MapVirtualKeyW
USER32.dll630SendInput
USER32.dll510LockWorkStation
USER32.dll250FindWindowW
USER32.dll280GetClipboardFormatNameW
USER32.dll566PostMessageW
USER32.dll395GetUserObjectInformationW
USER32.dll554OpenInputDesktop
USER32.dll552OpenDesktopW
USER32.dll698SetThreadDesktop
USER32.dll74CloseDesktop
USER32.dll37ChangeDisplaySettingsExW
USER32.dll586RedrawWindow
USER32.dll15BlockInput
USER32.dll289GetDC
USER32.dll613ReleaseDC
USER32.dll325GetLastInputInfo
USER32.dll382GetSystemMetrics
USER32.dll291GetDesktopWindow
GDI32.dll662SetMetaFileBitsEx
GDI32.dll71CreateMetaFileW
GDI32.dll587PlayMetaFile
GDI32.dll31CloseMetaFile
GDI32.dll498GetMetaFileBitsEx
GDI32.dll229DeleteMetaFile
GDI32.dll73CreatePalette
GDI32.dll512GetPaletteEntries
GDI32.dll460GetDeviceGammaRamp
GDI32.dll582PatBlt
GDI32.dll48CreateCompatibleDC
GDI32.dll672SetRectRgn
GDI32.dll525GetStockObject
GDI32.dll530GetSystemPaletteEntries
GDI32.dll79CreateRectRgn
GDI32.dll34CombineRgn
GDI32.dll373GdiFlush
GDI32.dll674SetStretchBltMode
GDI32.dll691StretchBlt
GDI32.dll19BitBlt
GDI32.dll227DeleteDC
GDI32.dll308ExtEscape
GDI32.dll650SetDeviceGammaRamp
GDI32.dll50CreateDCW
GDI32.dll509GetObjectW
GDI32.dll458GetDIBits
GDI32.dll631SelectObject
GDI32.dll53CreateDIBSection
GDI32.dll230DeleteObject
GDI32.dll41CreateBitmap
WS2_32.dll21
WS2_32.dll23
WS2_32.dll19
WS2_32.dll39WSAEnumNetworkEvents
WS2_32.dll7
WS2_32.dll4
WS2_32.dll136freeaddrinfo
WS2_32.dll137getaddrinfo
WS2_32.dll15WSAAddressToStringW
WS2_32.dll59WSALookupServiceEnd
WS2_32.dll61WSALookupServiceNextW
WS2_32.dll58WSALookupServiceBeginW
WS2_32.dll62WSANSPIoctl
WS2_32.dll2
WS2_32.dll13
WS2_32.dll86WSAStringToAddressW
WS2_32.dll54WSAIoctl
WS2_32.dll141getnameinfo
WS2_32.dll5
WS2_32.dll83WSASocketW
WS2_32.dll1
WS2_32.dll42WSAEventSelect
WS2_32.dll9
WS2_32.dll16
WS2_32.dll111
WS2_32.dll18
WS2_32.dll3
WS2_32.dll115
WS2_32.dll116
WS2_32.dll6
WS2_32.dll15
Secur32.dll35InitSecurityInterfaceW
Secur32.dll2147483647
SHELL32.dll172SHFileOperationW
SHELL32.dll31DragQueryFileW
WTSAPI32.dll34WTSQueryUserToken
WTSAPI32.dll31WTSQuerySessionInformationW
WTSAPI32.dll18WTSFreeMemory
RPCRT4.dll349RpcBindingFree
RPCRT4.dll366RpcBindingSetAuthInfoExW
RPCRT4.dll351RpcBindingFromStringBindingW
RPCRT4.dll45I_RpcExceptionFilter
RPCRT4.dll149NdrClientCall2
RPCRT4.dll283NdrServerCall2
RPCRT4.dll461RpcServerUseProtseqEpW
RPCRT4.dll494RpcStringBindingComposeW
RPCRT4.dll447RpcServerRegisterIfEx
RPCRT4.dll498RpcStringFreeW
RPCRT4.dll442RpcServerListen
RPCRT4.dll451RpcServerUnregisterIfEx
SETUPAPI.dll430SetupDiSetDeviceInstallParamsW
SETUPAPI.dll275SetupCopyOEMInfW
SETUPAPI.dll291SetupDiBuildDriverInfoList
SETUPAPI.dll325SetupDiEnumDriverInfoW
SETUPAPI.dll440SetupDiSetSelectedDriverW
SETUPAPI.dll396SetupDiInstallDriverFiles
SETUPAPI.dll309SetupDiCreateDeviceInfoW
SETUPAPI.dll410SetupDiRegisterDeviceInfo
SETUPAPI.dll435SetupDiSetDeviceRegistryPropertyW
SETUPAPI.dll411SetupDiRemoveDevice
SETUPAPI.dll361SetupDiGetDeviceInstallParamsW
SETUPAPI.dll342SetupDiGetClassDevsW
SETUPAPI.dll322SetupDiEnumDeviceInfo
SETUPAPI.dll372SetupDiGetDeviceRegistryPropertyW
SETUPAPI.dll84CM_Get_DevNode_Status
SETUPAPI.dll438SetupDiSetSelectedDevice
SETUPAPI.dll319SetupDiDestroyDeviceInfoList
SETUPAPI.dll306SetupDiCreateDeviceInfoList
SETUPAPI.dll2147483647
newdev.dll12UpdateDriverForPlugAndPlayDevicesW
SHLWAPI.dll179SHDeleteKeyW
ordentry_vafunction_name
10x1d6b5RDPAPI_CreateInstance
module_nameRDPCORE.dll
flags0
timestamp2012-02-17 02:11:19
version0.0
ordinal_base1
nFunctions1
nNames1
Names(1)0xbd61c
Functions(1)0xbd618
NameOrdinals(1)0xbd620

StringTable 040904B0

CompanyNameMicrosoft Corporation
FileDescriptionRDP Core DLL
FileVersion6.1.7601.17779 (win7sp1_gdr.120216-1503)
InternalNameRdpCore.dll
LegalCopyright© Microsoft Corporation. All rights reserved.
OriginalFilenameRdpCore.dll
ProductNameMicrosoft® Windows® Operating System
ProductVersion6.1.7601.17779

VS_FIXEDFILEINFO

FileVersion6.1.7601.17779
ProductVersion6.1.7601.17779
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType1
FileSubtype0
offsetsizetypecomment
0826880DLL02/17/2012 05:27:49#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] can't find file_offset of VA 0x280