filenametermmgr.dll
size352768 (0x56200)
md59fc4d46f7bcad9ee8517171195917776
typePE32 executable (DLL) (console) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xe0

Rich Header

lib idversiontimes used
1313072924
149307297
10221
1473072919
146307291
1323072947
148307291
145307291

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections4
TimeDateStamp0x4ce7ba18
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x2102
Magic0x10b
LinkerVersion9.0
SizeOfCode0x4c600
SizeOfInitializedData0x9800
SizeOfUninitializedData0
AddressOfEntryPoint0x145e
BaseOfCode0x1000
BaseOfData0x4e000
ImageBase0xedc0000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.1
ImageVersion6.1
SubsystemVersion6.1
Reserved10
SizeOfImage0x59000
SizeOfHeaders0x400
CheckSum0x57085
Subsystem3
DllCharacteristics0x140
SizeOfStackReserve0x40000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v7.0 DLL

Sections

namevavsizeraw sizeflags
.text0x10000x4c52c0x4c600R-X CODE
.data0x4e0000x13b40x1400RW- IDATA
.rsrc0x500000x39e00x3a00R-- IDATA
.reloc0x540000x4a000x4a00R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT0x4c8500xa4
IMPORT0x4c8f40xc8
RESOURCE0x500000x39e0
EXCEPTION00
SECURITY00
BASERELOC0x540000x4a00
DEBUG0x4d4cc0x38
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x45600x40
Bound_IAT0x2780xc8
IAT0x10000x24c
Delay_IAT00
CLR_Header00
typenamesizecp
MUI#12320
REGISTRYIDR_TSTORAGEUNITAVI5530
REGISTRY#1025590
REGISTRY#1035700
REGISTRY#1045850
REGISTRY#1115530
REGISTRY#1125150
REGISTRY#1206300
REGISTRY#1306310
TYPELIB#182680
VERSION#19440
module_namehintordfunction_name
msvcrt.dll934_unlock
msvcrt.dll43void __cdecl operator delete[](void *)

??_V@YAXPAX@Z

msvcrt.dll115__CxxFrameHandler3
msvcrt.dll764_purecall
msvcrt.dll1260memmove
msvcrt.dll1279realloc
msvcrt.dll1190free
msvcrt.dll41void * __cdecl operator new[](unsigned int)

??_U@YAPAXI@Z

msvcrt.dll1258memcpy
msvcrt.dll18void * __cdecl operator new(unsigned int)

??2@YAPAXI@Z

msvcrt.dll404_ftol2
msvcrt.dll974_vsnwprintf
msvcrt.dll1129_wtoi
msvcrt.dll1262memset
msvcrt.dll1246malloc
msvcrt.dll106_XcptFilter
msvcrt.dll469_initterm
msvcrt.dll345_except_handler4_common
msvcrt.dll968_vsnprintf
msvcrt.dll17public: virtual __thiscall type_info::~type_info(void)

??1type_info@@UAE@XZ

msvcrt.dll747_onexit
msvcrt.dll578_lock
msvcrt.dll141__dllonexit
msvcrt.dll20void __cdecl operator delete(void *)

??3@YAXPAX@Z

msvcrt.dll55void __cdecl terminate(void)

?terminate@@YAXXZ

msvcrt.dll257_amsg_exit
ATL.DLL15
ATL.DLL23
ATL.DLL22
ATL.DLL18
ATL.DLL21
ATL.DLL16
ATL.DLL32
ATL.DLL30
ADVAPI32.dll622RegQueryValueExW
ADVAPI32.dll608RegOpenKeyExA
ADVAPI32.dll621RegQueryValueExA
ADVAPI32.dll612RegOpenKeyW
ADVAPI32.dll569RegCreateKeyExW
ADVAPI32.dll638RegSetValueExW
ADVAPI32.dll591RegEnumKeyExW
ADVAPI32.dll560RegCloseKey
ADVAPI32.dll609RegOpenKeyExW
ADVAPI32.dll580RegDeleteKeyW
ADVAPI32.dll595RegFlushKey
KERNEL32.dll1202Sleep
KERNEL32.dll745InterlockedCompareExchange
KERNEL32.dll904OutputDebugStringA
KERNEL32.dll513GetLocalTime
KERNEL32.dll1137SetLastError
KERNEL32.dll935QueryPerformanceFrequency
KERNEL32.dll934QueryPerformanceCounter
KERNEL32.dll658GetTickCount
KERNEL32.dll449GetCurrentProcessId
KERNEL32.dll632GetSystemTimeAsFileTime
KERNEL32.dll1346lstrcmpW
KERNEL32.dll354FreeLibrary
KERNEL32.dll1012RegisterWaitForSingleObject
KERNEL32.dll740InitializeCriticalSectionAndSpinCount
KERNEL32.dll214DeleteFileW
KERNEL32.dll143CreateFileW
KERNEL32.dll1243UnregisterWaitEx
KERNEL32.dll1216TerminateProcess
KERNEL32.dll1235UnhandledExceptionFilter
KERNEL32.dll1188SetUnhandledExceptionFilter
KERNEL32.dll739InitializeCriticalSection
KERNEL32.dll209DeleteCriticalSection
KERNEL32.dll238EnterCriticalSection
KERNEL32.dll825LeaveCriticalSection
KERNEL32.dll751InterlockedIncrement
KERNEL32.dll1021ReleaseSemaphore
KERNEL32.dll82CloseHandle
KERNEL32.dll174CreateSemaphoreW
KERNEL32.dll1273WaitForSingleObject
KERNEL32.dll512GetLastError
KERNEL32.dll181CreateThread
KERNEL32.dll747InterlockedDecrement
KERNEL32.dll1271WaitForMultipleObjects
KERNEL32.dll1176SetThreadPriority
KERNEL32.dll452GetCurrentThread
KERNEL32.dll626GetSystemInfo
KERNEL32.dll232DuplicateHandle
KERNEL32.dll448GetCurrentProcess
KERNEL32.dll1038ResetEvent
KERNEL32.dll942QueueUserAPC
KERNEL32.dll1112SetEvent
KERNEL32.dll133CreateEventW
KERNEL32.dll579GetProcAddress
KERNEL32.dll534GetModuleHandleW
KERNEL32.dll453GetCurrentThreadId
KERNEL32.dll222DisableThreadLibraryCalls
KERNEL32.dll748InterlockedExchange
ole32.dll378StringFromIID
ole32.dll16CoCreateInstance
ole32.dll14CoCreateFreeThreadedMarshaler
ole32.dll8CLSIDFromString
ole32.dll104CoTaskMemFree
ole32.dll376StringFromCLSID
ole32.dll377StringFromGUID2
ole32.dll103CoTaskMemAlloc
ole32.dll108CoUninitialize
ole32.dll63CoInitializeEx
ole32.dll29CoFreeUnusedLibraries
ole32.dll62CoInitialize
ole32.dll134CreateStreamOnHGlobal
OLEAUT32.dll26
OLEAUT32.dll201
OLEAUT32.dll162
OLEAUT32.dll19
OLEAUT32.dll20
OLEAUT32.dll17
OLEAUT32.dll25
OLEAUT32.dll10
OLEAUT32.dll8
OLEAUT32.dll15
OLEAUT32.dll16
OLEAUT32.dll7
OLEAUT32.dll6
OLEAUT32.dll2
OLEAUT32.dll9
rtutils.dll38TraceRegisterExW
rtutils.dll39TraceVprintfExA
rtutils.dll26TraceDeregisterW
USER32.dll166DestroyWindow
USER32.dll175DispatchMessageW
USER32.dll764TranslateMessage
USER32.dll563PeekMessageW
USER32.dll775UnregisterDeviceNotification
USER32.dll541MsgWaitForMultipleObjectsEx
USER32.dll594RegisterDeviceNotificationW
USER32.dll590RegisterClassW
USER32.dll708SetWindowLongW
USER32.dll774UnregisterClassW
USER32.dll156DefWindowProcW
USER32.dll110CreateWindowExW
USER32.dll506LoadStringW
USER32.dll406GetWindowLongW
WINMM.dll148timeGetTime
ordentry_vafunction_name
10x19c0eDllCanUnloadNow
20x19c1fDllGetClassObject
30x19c41DllRegisterServer
40x19c6bDllUnregisterServer
module_nametermmgr.DLL
flags0
timestamp2010-11-20 11:03:28
version0.0
ordinal_base1
nFunctions4
nNames4
Names(4)0x4c888
Functions(4)0x4c878
NameOrdinals(4)0x4c898

StringTable 040904B0

CompanyNameMicrosoft Corporation
FileDescriptionMicrosoft TAPI3 Terminal Manager
FileVersion6.1.7601.17514 (win7sp1_rtm.101119-1850)
InternalNametermmgr.dll
LegalCopyright© Microsoft Corporation. All rights reserved.
OriginalFilenametermmgr.dll
ProductNameMicrosoft® Windows® Operating System
ProductVersion6.1.7601.17514

VS_FIXEDFILEINFO

FileVersion6.1.7601.17514
ProductVersion6.1.7601.17514
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType2
FileSubtype0
offsetsizetypecomment
0352768DLL11/20/2010 12:07:52#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] can't find file_offset of VA 0x278