de4dot.exe - de4dot.dll

info
MZ
PE
resources
imports
foremost
version info
hexdump
disasm
log
discuss
donate

filename	de4dot.exe
size	169984 (0x29800)
md5	8ff52673ad4ab300b1a30c3a26155d6f

type	PE32+ executable (console) x86-64, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0xe0

Rich Header

lib id	version	times used
259	26706	8
261	26706	63
260	26706	28
147	30729	18
257	25711	9
1	0	169
261	27034	13
258	27034	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x8664
NumberOfSections	6
TimeDateStamp	0x5e222541
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xf0
Characteristics	0x22
Magic	0x20b
LinkerVersion	14.16
SizeOfCode	0x17200
SizeOfInitializedData	0x12200
SizeOfUninitializedData	0
AddressOfEntryPoint	0x13b60
BaseOfCode	0x1000
ImageBase	0x140000000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	6.0
ImageVersion	0.0
SubsystemVersion	6.0
Reserved1	0
SizeOfImage	0x2e000
SizeOfHeaders	0x400
CheckSum	0
Subsystem	3
DllCharacteristics	0xc160
SizeOfStackReserve	0x180000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

MASM/TASM - sig4

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x171fc	0x17200	R-X CODE
.rdata	0x19000	0xef44	0xf000	R-- IDATA
.data	0x28000	0x19e8	0xe00	RW- IDATA
.pdata	0x2a000	0x15fc	0x1600	R-- IDATA
.rsrc	0x2c000	0x5bc	0x600	R-- IDATA
.reloc	0x2d000	0x6dc	0x800	R-- IDATA DISCARDABLE

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x26f9c	0x118
RESOURCE	0x2c000	0x5bc
EXCEPTION	0x2a000	0x15fc
SECURITY	0	0
BASERELOC	0x2d000	0x6dc
DEBUG	0x22630	0x54
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0x22790	0x28
LOAD_CONFIG	0x22690	0x100
Bound_IAT	0	0
IAT	0x19000	0x468
Delay_IAT	0	0
CLR_Header	0	0

TLS

raw start	raw end	index	callbks	zero fill	flags
0x140023d88	0x140023d98	0x1400292b8	0x140019520	0	0x400000

show previews

type	name	size	cp
VERSION	#1	814	1252
MANIFEST	#1	490	1252

module_name	hint	function_name
KERNEL32.dll	377	FindClose
KERNEL32.dll	383	FindFirstFileExW
KERNEL32.dll	400	FindNextFileW
KERNEL32.dll	581	GetFileAttributesExW
KERNEL32.dll	604	GetFullPathNameW
KERNEL32.dll	761	GetTempPathW
KERNEL32.dll	611	GetLastError
KERNEL32.dll	866	InitializeCriticalSection
KERNEL32.dll	307	EnterCriticalSection
KERNEL32.dll	955	LeaveCriticalSection
KERNEL32.dll	572	GetEnvironmentVariableW
KERNEL32.dll	539	GetCurrentProcess
KERNEL32.dll	911	IsWow64Process
KERNEL32.dll	630	GetModuleFileNameW
KERNEL32.dll	633	GetModuleHandleExW
KERNEL32.dll	689	GetProcAddress
KERNEL32.dll	961	LoadLibraryExW
KERNEL32.dll	959	LoadLibraryA
KERNEL32.dll	1003	MultiByteToWideChar
KERNEL32.dll	1541	WideCharToMultiByte
KERNEL32.dll	431	FreeLibrary
KERNEL32.dll	1240	RtlUnwindEx
KERNEL32.dll	1119	RaiseException
KERNEL32.dll	1045	OutputDebugStringW
KERNEL32.dll	634	GetModuleHandleW
KERNEL32.dll	540	GetCurrentProcessId
KERNEL32.dll	1411	Sleep
KERNEL32.dll	1206	RemoveDirectoryW
KERNEL32.dll	271	DeleteCriticalSection
KERNEL32.dll	185	CreateDirectoryW
KERNEL32.dll	1236	RtlPcToFileHeader
KERNEL32.dll	871	InitializeSListHead
KERNEL32.dll	544	GetCurrentThreadId
KERNEL32.dll	1097	QueryPerformanceCounter
KERNEL32.dll	893	IsDebuggerPresent
KERNEL32.dll	900	IsProcessorFeaturePresent
KERNEL32.dll	1426	TerminateProcess
KERNEL32.dll	1395	SetUnhandledExceptionFilter
KERNEL32.dll	1460	UnhandledExceptionFilter
KERNEL32.dll	1241	RtlVirtualUnwind
KERNEL32.dll	1234	RtlLookupFunctionEntry
KERNEL32.dll	1227	RtlCaptureContext
KERNEL32.dll	943	LCMapStringW
KERNEL32.dll	748	GetSystemTimeAsFileTime
KERNEL32.dll	1445	TlsFree
KERNEL32.dll	1447	TlsSetValue
KERNEL32.dll	1446	TlsGetValue
KERNEL32.dll	1444	TlsAlloc
KERNEL32.dll	1421	SwitchToThread
KERNEL32.dll	867	InitializeCriticalSectionAndSpinCount
KERNEL32.dll	1335	SetLastError
KERNEL32.dll	264	DecodePointer
KERNEL32.dll	303	EncodePointer
KERNEL32.dll	730	GetStringTypeW
USER32.dll	663	MessageBoxW
SHELL32.dll	438	ShellExecuteW
ADVAPI32.dll	652	RegOpenKeyExW
ADVAPI32.dll	603	RegCloseKey
ADVAPI32.dll	704	ReportEventW
ADVAPI32.dll	686	RegisterEventSourceW
ADVAPI32.dll	237	DeregisterEventSource
ADVAPI32.dll	641	RegGetValueW
api-ms-win-crt-runtime-l1-1-0.dll	53	_initialize_wide_environment
api-ms-win-crt-runtime-l1-1-0.dll	66	_set_app_type
api-ms-win-crt-runtime-l1-1-0.dll	57	_invalid_parameter_noinfo_noreturn
api-ms-win-crt-runtime-l1-1-0.dll	64	_seh_filter_exe
api-ms-win-crt-runtime-l1-1-0.dll	22	_cexit
api-ms-win-crt-runtime-l1-1-0.dll	30	_crt_atexit
api-ms-win-crt-runtime-l1-1-0.dll	60	_register_onexit_function
api-ms-win-crt-runtime-l1-1-0.dll	103	terminate
api-ms-win-crt-runtime-l1-1-0.dll	25	_configure_wide_argv
api-ms-win-crt-runtime-l1-1-0.dll	85	exit
api-ms-win-crt-runtime-l1-1-0.dll	35	_exit
api-ms-win-crt-runtime-l1-1-0.dll	4	__p___argc
api-ms-win-crt-runtime-l1-1-0.dll	6	__p___wargv
api-ms-win-crt-runtime-l1-1-0.dll	21	_c_exit
api-ms-win-crt-runtime-l1-1-0.dll	61	_register_thread_local_exe_atexit_callback
api-ms-win-crt-runtime-l1-1-0.dll	84	abort
api-ms-win-crt-runtime-l1-1-0.dll	41	_get_initial_wide_environment
api-ms-win-crt-runtime-l1-1-0.dll	33	_errno
api-ms-win-crt-runtime-l1-1-0.dll	54	_initterm
api-ms-win-crt-runtime-l1-1-0.dll	52	_initialize_onexit_table
api-ms-win-crt-runtime-l1-1-0.dll	55	_initterm_e
api-ms-win-crt-heap-l1-1-0.dll	25	malloc
api-ms-win-crt-heap-l1-1-0.dll	23	calloc
api-ms-win-crt-heap-l1-1-0.dll	24	free
api-ms-win-crt-heap-l1-1-0.dll	8	_callnewh
api-ms-win-crt-heap-l1-1-0.dll	22	_set_new_mode
api-ms-win-crt-math-l1-1-0.dll	9	__setusermatherr
api-ms-win-crt-math-l1-1-0.dll	203	frexp
api-ms-win-crt-stdio-l1-1-0.dll	98	_wfopen
api-ms-win-crt-stdio-l1-1-0.dll	17	__stdio_common_vswprintf
api-ms-win-crt-stdio-l1-1-0.dll	116	fclose
api-ms-win-crt-stdio-l1-1-0.dll	131	fread
api-ms-win-crt-stdio-l1-1-0.dll	135	fseek
api-ms-win-crt-stdio-l1-1-0.dll	138	fwrite
api-ms-win-crt-stdio-l1-1-0.dll		__acrt_iob_func
api-ms-win-crt-stdio-l1-1-0.dll	84	_set_fmode
api-ms-win-crt-stdio-l1-1-0.dll	129	fputwc
api-ms-win-crt-stdio-l1-1-0.dll	130	fputws
api-ms-win-crt-stdio-l1-1-0.dll	7	__stdio_common_vfwprintf
api-ms-win-crt-stdio-l1-1-0.dll	119	fflush
api-ms-win-crt-stdio-l1-1-0.dll	1	__p__commode
api-ms-win-crt-stdio-l1-1-0.dll	15	__stdio_common_vsprintf_s
api-ms-win-crt-string-l1-1-0.dll	74	_wcsicmp
api-ms-win-crt-string-l1-1-0.dll	73	_wcsdup
api-ms-win-crt-string-l1-1-0.dll	84	_wcsnicmp
api-ms-win-crt-string-l1-1-0.dll	166	wcsncmp
api-ms-win-crt-string-l1-1-0.dll	138	strcspn
api-ms-win-crt-string-l1-1-0.dll	169	wcsnlen
api-ms-win-crt-string-l1-1-0.dll	131	memset
api-ms-win-crt-string-l1-1-0.dll	137	strcpy_s
api-ms-win-crt-locale-l1-1-0.dll	15	_unlock_locales
api-ms-win-crt-locale-l1-1-0.dll	6	__pctype_func
api-ms-win-crt-locale-l1-1-0.dll	2	___lc_locale_name_func
api-ms-win-crt-locale-l1-1-0.dll	3	___mb_cur_max_func
api-ms-win-crt-locale-l1-1-0.dll	19	setlocale
api-ms-win-crt-locale-l1-1-0.dll	8	_configthreadlocale
api-ms-win-crt-locale-l1-1-0.dll	13	_lock_locales
api-ms-win-crt-locale-l1-1-0.dll	18	localeconv
api-ms-win-crt-locale-l1-1-0.dll		___lc_codepage_func
api-ms-win-crt-filesystem-l1-1-0.dll	53	_wremove
api-ms-win-crt-filesystem-l1-1-0.dll	54	_wrename
api-ms-win-crt-convert-l1-1-0.dll	71	_wtoi
api-ms-win-crt-convert-l1-1-0.dll	115	wcstoul
api-ms-win-crt-time-l1-1-0.dll	71	wcsftime
api-ms-win-crt-time-l1-1-0.dll	31	_gmtime64
api-ms-win-crt-time-l1-1-0.dll	48	_time64

StringTable 000004b0

CompanyName	de4dot
FileDescription	de4dot
FileVersion	3.2.50001.4000
InternalName	de4dot.dll
LegalCopyright	Copyright (C) 2011-2020 de4dot@gmail.com
OriginalFilename	de4dot.dll
ProductName	de4dot
ProductVersion	3.2.50001.4000
Assembly Version	3.2.50001.4000

VS_FIXEDFILEINFO

FileVersion	3.2.50001.4000
ProductVersion	3.2.50001.4000
StrucVersion	0x10000
FileFlagsMask	0x3f
FileFlags	0
FileOS	4
FileType	1
FileSubtype	0

show previews

offset	size	type	comment
15c1	15	HTM		#
15d0	164400	BIN	overlay data past EOF	#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] can't find file_offset of VA 0x292b8

de4dot.exe-

MZ Header

Rich Header

DOS stub

PE Header

Packer / Compiler

Sections

Data Directory

TLS

StringTable 000004b0

VS_FIXEDFILEINFO

de4dot.exe
-