filenamerdpencom.dll
size186368 (0x2d800)
md59d30a820eab9c146bb59557ca0236875
typePE32 executable (DLL) (console) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xe8

Rich Header

lib idversiontimes used
149307299
10236
1473072929
1313072969
146307291
1323072939
126507271
148307291
145307291

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections4
TimeDateStamp0x4ce7b9b2
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x2102
Magic0x10b
LinkerVersion9.0
SizeOfCode0x24200
SizeOfInitializedData0x9600
SizeOfUninitializedData0
AddressOfEntryPoint0x23313
BaseOfCode0x1000
BaseOfData0x26000
ImageBase0xac80000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.1
ImageVersion6.1
SubsystemVersion5.1
Reserved10
SizeOfImage0x30000
SizeOfHeaders0x400
CheckSum0x33a4e
Subsystem3
DllCharacteristics0x140
SizeOfStackReserve0x40000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v7.0 DLL

Sections

namevavsizeraw sizeflags
.text0x10000x240b60x24200R-X CODE
.data0x260000xc6c0xa00RW- IDATA
.rsrc0x270000x5b380x5c00R-- IDATA
.reloc0x2d0000x2b640x2c00R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT0x250100xa6
IMPORT0x23fc40x12c
RESOURCE0x270000x5b38
EXCEPTION00
SECURITY00
BASERELOC0x2d0000x23fc
DEBUG0x13500x1c
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x90680x40
Bound_IAT0x2800x130
IAT0x10000x330
Delay_IAT00
CLR_Header00
typenamesizecp
REGISTRY#1009010
REGISTRY#1016530
TYPELIB#1205440
VERSION#19280
module_namehintordfunction_name
msvcrt.dll106_XcptFilter
msvcrt.dll469_initterm
msvcrt.dll257_amsg_exit
msvcrt.dll20void __cdecl operator delete(void *)

??3@YAXPAX@Z

msvcrt.dll974_vsnwprintf
msvcrt.dll1009_wcsicoll
msvcrt.dll1253mbstowcs
msvcrt.dll1007_wcsicmp
msvcrt.dll41void * __cdecl operator new[](unsigned int)

??_U@YAPAXI@Z

msvcrt.dll1258memcpy
msvcrt.dll18void * __cdecl operator new(unsigned int)

??2@YAPAXI@Z

msvcrt.dll1279realloc
msvcrt.dll764_purecall
msvcrt.dll1190free
msvcrt.dll1246malloc
msvcrt.dll1262memset
msvcrt.dll43void __cdecl operator delete[](void *)

??_V@YAXPAX@Z

PSAPI.DLL16GetModuleFileNameExW
PSAPI.DLL14GetModuleBaseNameW
PSAPI.DLL4EnumProcessModules
KERNEL32.dll449GetCurrentProcessId
KERNEL32.dll1216TerminateProcess
KERNEL32.dll632GetSystemTimeAsFileTime
KERNEL32.dll1188SetUnhandledExceptionFilter
KERNEL32.dll658GetTickCount
KERNEL32.dll934QueryPerformanceCounter
KERNEL32.dll1047RtlUnwind
KERNEL32.dll745InterlockedCompareExchange
KERNEL32.dll1202Sleep
KERNEL32.dll748InterlockedExchange
KERNEL32.dll1260VirtualFree
KERNEL32.dll828LoadLibraryA
KERNEL32.dll715HeapAlloc
KERNEL32.dll584GetProcessHeap
KERNEL32.dll719HeapFree
KERNEL32.dll895OpenProcess
KERNEL32.dll158CreateMutexW
KERNEL32.dll1137SetLastError
KERNEL32.dll691GlobalAlloc
KERNEL32.dll675GetVersionExW
KERNEL32.dll1263VirtualProtect
KERNEL32.dll1257VirtualAlloc
KERNEL32.dll626GetSystemInfo
KERNEL32.dll1265VirtualQuery
KERNEL32.dll870MultiByteToWideChar
KERNEL32.dll1358lstrlenW
KERNEL32.dll1352lstrcpyW
KERNEL32.dll512GetLastError
KERNEL32.dll739InitializeCriticalSection
KERNEL32.dll209DeleteCriticalSection
KERNEL32.dll751InterlockedIncrement
KERNEL32.dll747InterlockedDecrement
KERNEL32.dll82CloseHandle
KERNEL32.dll831LoadLibraryW
KERNEL32.dll579GetProcAddress
KERNEL32.dll534GetModuleHandleW
KERNEL32.dll1349lstrcmpiW
KERNEL32.dll825LeaveCriticalSection
KERNEL32.dll238EnterCriticalSection
KERNEL32.dll718HeapDestroy
KERNEL32.dll222DisableThreadLibraryCalls
KERNEL32.dll1355lstrcpynW
KERNEL32.dll530GetModuleFileNameW
KERNEL32.dll354FreeLibrary
KERNEL32.dll1343lstrcatW
KERNEL32.dll1357lstrlenA
KERNEL32.dll1201SizeofResource
KERNEL32.dll833LoadResource
KERNEL32.dll334FindResourceW
KERNEL32.dll830LoadLibraryExW
KERNEL32.dll344FlushInstructionCache
KERNEL32.dll448GetCurrentProcess
KERNEL32.dll944RaiseException
KERNEL32.dll453GetCurrentThreadId
KERNEL32.dll709GlobalUnlock
KERNEL32.dll702GlobalLock
KERNEL32.dll1235UnhandledExceptionFilter
ole32.dll131CreateOleAdviseHolder
ole32.dll123CreateDataAdviseHolder
ole32.dll319OleRegGetMiscStatus
ole32.dll320OleRegGetUserType
ole32.dll318OleRegEnumVerbs
ole32.dll323OleSaveToStream
ole32.dll390WriteClassStm
ole32.dll311OleLoadFromStream
ole32.dll16CoCreateInstance
ole32.dll105CoTaskMemRealloc
ole32.dll103CoTaskMemAlloc
ole32.dll104CoTaskMemFree
OLEAUT32.dll2
OLEAUT32.dll161
OLEAUT32.dll163
OLEAUT32.dll7
OLEAUT32.dll277
OLEAUT32.dll162
OLEAUT32.dll149
OLEAUT32.dll150
OLEAUT32.dll9
OLEAUT32.dll12
OLEAUT32.dll16
OLEAUT32.dll417
OLEAUT32.dll4
OLEAUT32.dll8
OLEAUT32.dll10
OLEAUT32.dll314
OLEAUT32.dll146
OLEAUT32.dll6
ADVAPI32.dll196CryptGetHashParam
ADVAPI32.dll758TraceMessage
ADVAPI32.dll347GetTraceEnableFlags
ADVAPI32.dll348GetTraceEnableLevel
ADVAPI32.dll349GetTraceLoggerHandle
ADVAPI32.dll650RegisterTraceGuidsW
ADVAPI32.dll770UnregisterTraceGuids
ADVAPI32.dll584RegDeleteValueW
ADVAPI32.dll560RegCloseKey
ADVAPI32.dll569RegCreateKeyExW
ADVAPI32.dll609RegOpenKeyExW
ADVAPI32.dll638RegSetValueExW
ADVAPI32.dll616RegQueryInfoKeyW
ADVAPI32.dll594RegEnumValueW
ADVAPI32.dll591RegEnumKeyExW
ADVAPI32.dll203CryptReleaseContext
ADVAPI32.dll182CryptDestroyHash
ADVAPI32.dll177CryptAcquireContextW
ADVAPI32.dll179CryptCreateHash
ADVAPI32.dll200CryptHashData
ADVAPI32.dll193CryptGenRandom
CRYPT32.dll125CryptBinaryToStringW
USER32.dll412GetWindowRect
USER32.dll274GetClassNameW
USER32.dll686SetRect
USER32.dll566PostMessageW
USER32.dll539MoveWindow
USER32.dll163DestroyIcon
USER32.dll420GetWindowThreadProcessId
USER32.dll317GetKeyState
USER32.dll446InvalidateRect
USER32.dll475IsWindow
USER32.dll160DestroyAcceleratorTable
USER32.dll356GetParent
USER32.dll658SetFocus
USER32.dll300GetFocus
USER32.dll457IsChild
USER32.dll110CreateWindowExW
USER32.dll406GetWindowLongW
USER32.dll708SetWindowLongW
USER32.dll14BeginPaint
USER32.dll276GetClientRect
USER32.dll220EndPaint
USER32.dll445IntersectRect
USER32.dll243EqualRect
USER32.dll549OffsetRect
USER32.dll711SetWindowRgn
USER32.dll710SetWindowPos
USER32.dll289GetDC
USER32.dll613ReleaseDC
USER32.dll269GetClassInfoExW
USER32.dll491LoadCursorW
USER32.dll819wsprintfW
USER32.dll589RegisterClassExW
USER32.dll735ShowWindow
USER32.dll30CallWindowProcW
USER32.dll156DefWindowProcW
USER32.dll769UnionRect
USER32.dll576PtInRect
USER32.dll52CharPrevW
USER32.dll635SendMessageTimeoutW
USER32.dll166DestroyWindow
USER32.dll49CharNextW
GDI32.dll31CloseMetaFile
GDI32.dll617RestoreDC
GDI32.dll684SetWindowExtEx
GDI32.dll685SetWindowOrgEx
GDI32.dll229DeleteMetaFile
GDI32.dll71CreateMetaFileW
GDI32.dll227DeleteDC
GDI32.dll681SetViewportOrgEx
GDI32.dll660SetMapMode
GDI32.dll564LPtoDP
GDI32.dll80CreateRectRgnIndirect
GDI32.dll50CreateDCW
GDI32.dll459GetDeviceCaps
GDI32.dll624SaveDC
WS2_32.dll3
SHELL32.dll189SHGetFileInfoW
ATL.DLL42
ATL.DLL41
SHLWAPI.dll73PathFindFileNameW
RDPCORE.dllRDPAPI_CreateInstance
ordentry_vafunction_name
10x99daDllCanUnloadNow
20xa7ebDllGetClassObject
30xc1f5DllRegisterServer
40xc209DllUnregisterServer
module_namerdpcomapi.DLL
flags0
timestamp2010-11-20 07:01:10
version0.0
ordinal_base1
nFunctions4
nNames4
Names(4)0x25048
Functions(4)0x25038
NameOrdinals(4)0x25058

StringTable 040904B0

CompanyNameMicrosoft Corporation
FileDescriptionRDPSRAPI COM Objects
FileVersion6.1.7601.17514 (win7sp1_rtm.101119-1850)
InternalNamerdpencom.dll
LegalCopyright© Microsoft Corporation. All rights reserved.
OriginalFilenamerdpencom.dll
ProductNameMicrosoft® Windows® Operating System
ProductVersion6.1.7601.17514

VS_FIXEDFILEINFO

FileVersion6.1.7601.17514
ProductVersion6.1.7601.17514
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType1
FileSubtype0
offsetsizetypecomment
0186368DLL11/20/2010 12:06:10#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] can't find file_offset of VA 0x280