filenamedxgi (MFT cheat, gamehack).dll
size33280 (0x8200)
md5937e30aebd140c8ecc7b088398fa5358
typePE32 executable (DLL) (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x108

Rich Header

lib idversiontimes used
147307296
2612861920
2602861910
259286193
257286194
257274127
10101
265288067
256288061
255288061
258288061

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections5
TimeDateStamp0x5f10420f
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x2102
Magic0x10b
LinkerVersion14.26
SizeOfCode0x5400
SizeOfInitializedData0x2e00
SizeOfUninitializedData0
AddressOfEntryPoint0x59b6
BaseOfCode0x1000
BaseOfData0x7000
ImageBase0x10000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.0
ImageVersion0.0
SubsystemVersion6.0
Reserved10
SizeOfImage0xc000
SizeOfHeaders0x400
CheckSum0
Subsystem2
DllCharacteristics0x140
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Sections

namevavsizeraw sizeflags
.text0x10000x536e0x5400R-X CODE
.rdata0x70000x1bda0x1c00R-- IDATA
.data0x90000x7ec0x400RW- IDATA
.rsrc0xa0000xf80x200R-- IDATA
.reloc0xb0000x7980x800R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT0x7f300x294
IMPORT0x81c40xb4
RESOURCE0xa0000xf8
EXCEPTION00
SECURITY00
BASERELOC0xb0000x798
DEBUG0x77b00x38
ARCHITECTURE00
GLOBALPTR00
TLS0x78a00x18
LOAD_CONFIG0x77e80x40
Bound_IAT00
IAT0x70000x190
Delay_IAT00
CLR_Header00

TLS

raw
start		raw
end		indexcallbkszero
fill		flags
0x10007d280x10007d300x100096f80x100071b800x300000
typenamesizecp
MANIFEST#21450
module_namehintordfunction_name
KERNEL32.dll542GetCurrentThreadId
KERNEL32.dll1415SuspendThread
KERNEL32.dll1230ResumeThread
KERNEL32.dll631GetModuleHandleA
KERNEL32.dll254CreateToolhelp32Snapshot
KERNEL32.dll1407Sleep
KERNEL32.dll136CloseHandle
KERNEL32.dll935K32GetModuleInformation
KERNEL32.dll1497WaitForSingleObject
KERNEL32.dll19AddVectoredExceptionHandler
KERNEL32.dll761GetThreadContext
KERNEL32.dll538GetCurrentProcessId
KERNEL32.dll1366SetThreadContext
KERNEL32.dll1045OpenThread
KERNEL32.dll846HeapReAlloc
KERNEL32.dll843HeapFree
KERNEL32.dll1486VirtualProtect
KERNEL32.dll841HeapCreate
KERNEL32.dll1438Thread32First
KERNEL32.dll1439Thread32Next
KERNEL32.dll537GetCurrentProcess
KERNEL32.dll1216RemoveVectoredExceptionHandler
KERNEL32.dll352ExitProcess
KERNEL32.dll688GetProcAddress
KERNEL32.dll964LoadLibraryA
KERNEL32.dll245CreateThread
KERNEL32.dll737GetSystemDirectoryA
KERNEL32.dll634GetModuleHandleW
KERNEL32.dll418FlushInstructionCache
KERNEL32.dll1483VirtualFree
KERNEL32.dll1480VirtualAlloc
KERNEL32.dll839HeapAlloc
KERNEL32.dll1488VirtualQuery
KERNEL32.dll307EnterCriticalSection
KERNEL32.dll960LeaveCriticalSection
KERNEL32.dll865InitializeCriticalSectionAndSpinCount
KERNEL32.dll274DeleteCriticalSection
KERNEL32.dll1303SetEvent
KERNEL32.dll1223ResetEvent
KERNEL32.dll1498WaitForSingleObjectEx
KERNEL32.dll193CreateEventW
KERNEL32.dll1455UnhandledExceptionFilter
KERNEL32.dll1391SetUnhandledExceptionFilter
KERNEL32.dll1422TerminateProcess
KERNEL32.dll904IsProcessorFeaturePresent
KERNEL32.dll869InitializeSListHead
KERNEL32.dll747GetSystemTimeAsFileTime
KERNEL32.dll1102QueryPerformanceCounter
KERNEL32.dll897IsDebuggerPresent
USER32.dll289GetAsyncKeyState
USER32.dll640MessageBeep
ADVAPI32.dll664RegQueryValueExA
ADVAPI32.dll611RegCreateKeyExA
ADVAPI32.dll680RegSetValueExA
ADVAPI32.dll651RegOpenKeyExA
ADVAPI32.dll603RegCloseKey
MSVCP140.dll628void __cdecl std::_Throw_C_error(int)

?_Throw_C_error@std@@YAXH@Z

MSVCP140.dll1358_Cnd_do_broadcast_at_thread_exit
MSVCP140.dll1456_Thrd_detach
MSVCP140.dll654void __cdecl std::_Xlength_error(char const *)

?_Xlength_error@std@@YAXPBD@Z

MSVCP140.dll629void __cdecl std::_Throw_Cpp_error(int)

?_Throw_Cpp_error@std@@YAXH@Z

VCRUNTIME140.dll33__std_exception_copy
VCRUNTIME140.dll16__CxxFrameHandler3
VCRUNTIME140.dll1_CxxThrowException
VCRUNTIME140.dll53_except_handler4_common
VCRUNTIME140.dll37__std_type_info_destroy_list
VCRUNTIME140.dll70memcpy
VCRUNTIME140.dll68memchr
VCRUNTIME140.dll72memset
VCRUNTIME140.dll34__std_exception_destroy
VCRUNTIME140.dll71memmove
api-ms-win-crt-runtime-l1-1-0.dll56_initterm
api-ms-win-crt-runtime-l1-1-0.dll23_cexit
api-ms-win-crt-runtime-l1-1-0.dll57_initterm_e
api-ms-win-crt-runtime-l1-1-0.dll36_execute_onexit_table
api-ms-win-crt-runtime-l1-1-0.dll62_register_onexit_function
api-ms-win-crt-runtime-l1-1-0.dll54_initialize_onexit_table
api-ms-win-crt-runtime-l1-1-0.dll53_initialize_narrow_environment
api-ms-win-crt-runtime-l1-1-0.dll25_configure_narrow_argv
api-ms-win-crt-runtime-l1-1-0.dll65_seh_filter_dll
api-ms-win-crt-runtime-l1-1-0.dll21_beginthreadex
api-ms-win-crt-runtime-l1-1-0.dll31_crt_atexit
api-ms-win-crt-runtime-l1-1-0.dll59_invalid_parameter_noinfo_noreturn
api-ms-win-crt-runtime-l1-1-0.dll106terminate
api-ms-win-crt-stdio-l1-1-0.dll125fopen
api-ms-win-crt-stdio-l1-1-0.dll13__stdio_common_vsprintf
api-ms-win-crt-stdio-l1-1-0.dll116fclose
api-ms-win-crt-stdio-l1-1-0.dll3__stdio_common_vfprintf
api-ms-win-crt-stdio-l1-1-0.dll138fwrite
api-ms-win-crt-heap-l1-1-0.dll25malloc
api-ms-win-crt-heap-l1-1-0.dll24free
api-ms-win-crt-heap-l1-1-0.dll8_callnewh
ordentry_vafunction_name
10x1240ApplyCompatResolutionQuirking
20x1250CompatString
30x1260CompatValue
40x1270CreateDXGIFactory
50x1280CreateDXGIFactory1
60x1290CreateDXGIFactory2
70x12a0DXGID3D10CreateDevice
80x12b0DXGID3D10CreateLayeredDevice
90x12c0DXGID3D10GetLayeredDeviceSize
100x12d0DXGID3D10RegisterLayers
110x12e0DXGIDeclareAdapterRemovalSupport
120x12f0DXGIDumpJournal
130x1300DXGIGetDebugInterface1
140x1310DXGIReportAdapterConfiguration
150x1320PIXBeginCapture
160x1330PIXEndCapture
170x1340PIXGetCaptureState
180x1350SetAppCompatStringPointer
190x1360UpdateHMDEmulationStatus
module_namedxgi.dll
flags0
timestamp2106-02-07 06:28:15
version0.0
ordinal_base1
nFunctions19
nNames19
Names(19)0x7fa4
Functions(19)0x7f58
NameOrdinals(19)0x7ff0
offsetsizetypecomment
033280DLL07/16/2020 12:03:27#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] can't find file_offset of VA 0x96f8