accelerator.dll

info
MZ
PE
resources
imports
exports
foremost
hexdump
disasm
log
discuss
donate

filename	accelerator.dll
size	61440 (0xf000)
md5	97626f7e5bb4d886911c43ff5a16139b

type	PE32+ executable (DLL) (console) x86-64, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x110

Rich Header

lib id	version	times used
147	30729	8
257	23013	3
199	41118	4
259	23013	2
261	23013	14
260	23013	10
206	65501	1
203	65501	2
1	0	53
261	23026	2
260	23026	15
256	23026	1
255	23026	1
258	23026	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x8664
NumberOfSections	6
TimeDateStamp	0x55f6881e
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xf0
Characteristics	0x2022
Magic	0x20b
LinkerVersion	14.0
SizeOfCode	0x8400
SizeOfInitializedData	0x6e00
SizeOfUninitializedData	0
AddressOfEntryPoint	0x876c
BaseOfCode	0x1000
ImageBase	0x180000000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	6.0
ImageVersion	0.0
SubsystemVersion	6.0
Reserved1	0
SizeOfImage	0x14000
SizeOfHeaders	0x400
CheckSum	0
Subsystem	3
DllCharacteristics	0x160
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

MASM/TASM - sig1(h)

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x8333	0x8400	R-X CODE
.rdata	0xa000	0x58c2	0x5a00	R-- IDATA
.data	0x10000	0x7f0	0x200	RW- IDATA
.pdata	0x11000	0x690	0x800	R-- IDATA
.rsrc	0x12000	0x1e0	0x200	R-- IDATA
.reloc	0x13000	0xa8	0x200	R-- IDATA DISCARDABLE

Data Directory

type	va	size
EXPORT	0xf330	0x54
IMPORT	0xf384	0x64
RESOURCE	0x12000	0x1e0
EXCEPTION	0x11000	0x690
SECURITY	0	0
BASERELOC	0x13000	0xa8
DEBUG	0xe3c0	0x1c
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0xe3e0	0x94
Bound_IAT	0	0
IAT	0xa000	0x150
Delay_IAT	0	0
CLR_Header	0	0

show previews

type	name	size	cp
MANIFEST	#2	381	0

module_name	hint	function_name
VCRUNTIME140.dll	37	__std_type_info_destroy_list
VCRUNTIME140.dll	1	_CxxThrowException
VCRUNTIME140.dll	34	__std_exception_destroy
VCRUNTIME140.dll	33	__std_exception_copy
VCRUNTIME140.dll	8	__C_specific_handler
VCRUNTIME140.dll	41	__telemetry_main_return_trigger
VCRUNTIME140.dll	40	__telemetry_main_invoke_trigger
VCRUNTIME140.dll	62	memset
VCRUNTIME140.dll	60	memcpy
VCRUNTIME140.dll	54	_purecall
api-ms-win-crt-heap-l1-1-0.dll	24	free
api-ms-win-crt-heap-l1-1-0.dll	25	malloc
api-ms-win-crt-heap-l1-1-0.dll	26	realloc
api-ms-win-crt-heap-l1-1-0.dll	8	_callnewh
api-ms-win-crt-runtime-l1-1-0.dll	22	_cexit
api-ms-win-crt-runtime-l1-1-0.dll	34	_execute_onexit_table
api-ms-win-crt-runtime-l1-1-0.dll	60	_register_onexit_function
api-ms-win-crt-runtime-l1-1-0.dll	52	_initialize_onexit_table
api-ms-win-crt-runtime-l1-1-0.dll	51	_initialize_narrow_environment
api-ms-win-crt-runtime-l1-1-0.dll	63	_seh_filter_dll
api-ms-win-crt-runtime-l1-1-0.dll	55	_initterm_e
api-ms-win-crt-runtime-l1-1-0.dll	54	_initterm
api-ms-win-crt-runtime-l1-1-0.dll	30	_crt_atexit
KERNEL32.dll	1205	RtlLookupFunctionEntry
KERNEL32.dll	1212	RtlVirtualUnwind
KERNEL32.dll	1426	UnhandledExceptionFilter
KERNEL32.dll	1362	SetUnhandledExceptionFilter
KERNEL32.dll	527	GetCurrentProcess
KERNEL32.dll	1392	TerminateProcess
KERNEL32.dll	880	IsProcessorFeaturePresent
KERNEL32.dll	1072	QueryPerformanceCounter
KERNEL32.dll	528	GetCurrentProcessId
KERNEL32.dll	532	GetCurrentThreadId
KERNEL32.dll	733	GetSystemTimeAsFileTime
KERNEL32.dll	874	IsDebuggerPresent
KERNEL32.dll	852	InitializeSListHead
KERNEL32.dll	279	DisableThreadLibraryCalls
KERNEL32.dll	1198	RtlCaptureContext

ord	entry_va	function_name
1	0x10b0	CreateAccelerator

module_name	ACCELERATOR.dll
flags	0
timestamp	2015-09-14 08:41:02
version	0.0
ordinal_base	1
nFunctions	1
nNames	1
Names(1)	0xf35c
Functions(1)	0xf358
NameOrdinals(1)	0xf360

show previews

offset	size	type	comment
15c1	15	HTM		#
15d0	55856	BIN	overlay data past EOF	#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

everything is OK