1.vmp.dll

info
MZ
PE
resources
imports
exports
foremost
hexdump
disasm
log
discuss
donate

filename	1.vmp.dll
size	2698240 (0x292c00)
md5	a099dc7f4b28e1a466731d637f46defa

type	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0xf8

Rich Header

lib id	version	times used
147	30729	20
259	26131	8
260	26131	10
261	26131	23
257	26131	4
257	25711	7
1	0	246
261	26431	47
256	26431	1
255	26431	1
258	26431	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	7
TimeDateStamp	0x5c585982
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x2102
Magic	0x10b
LinkerVersion	14.14
SizeOfCode	0x6a000
SizeOfInitializedData	0xe6e00
SizeOfUninitializedData	0
AddressOfEntryPoint	0x379ff9
BaseOfCode	0x1000
BaseOfData	0x6b000
ImageBase	0x10000000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	6.0
ImageVersion	0.0
SubsystemVersion	6.0
Reserved1	0
SizeOfImage	0x597000
SizeOfHeaders	0x400
CheckSum	0
Subsystem	2
DllCharacteristics	0x140
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

MS WAV Audio file

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x69f99	0	R-X CODE
.rdata	0x6b000	0x55080	0x55200	R-- IDATA
.data	0xc1000	0x8b674	0	RW- IDATA
.vmp0	0x14d000	0x20a3bb	0	R-X CODE IDATA
.vmp1	0x358000	0x23bfe0	0x23c000	R-X CODE IDATA
.reloc	0x594000	0x12b8	0x1400	R-- IDATA
.rsrc	0x596000	0x1d5	0x200	R-- IDATA

Data Directory

type	va	size
EXPORT	0x38f750	0x51
IMPORT	0x364b7c	0x1a4
RESOURCE	0x596000	0x1d5
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0x594000	0x12b8
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0x39709c	0x18
LOAD_CONFIG	0x593b10	0x40
Bound_IAT	0	0
IAT	0x35a000	0xe8
Delay_IAT	0	0
CLR_Header	0	0

TLS

raw start	raw end	index	callbks	zero fill	flags
0x100b9c40	0x100b9c48	0x1014c308	0	0	0x300000

show previews

type	name	size	cp
MANIFEST	#2	381	0

module_name	hint	ord	function_name
KERNEL32.dll			CreateDirectoryA
USER32.dll			FlashWindowEx
MSVCP140.dll			public: bool __thiscall std::codecvt_base::always_noconv(void)const ?always_noconv@codecvt_base@std@@QBE_NXZ
WINMM.dll			PlaySoundA
VCRUNTIME140.dll			__std_type_info_destroy_list
api-ms-win-crt-runtime-l1-1-0.dll			_errno
api-ms-win-crt-math-l1-1-0.dll			_CIatan2
api-ms-win-crt-heap-l1-1-0.dll			malloc
api-ms-win-crt-stdio-l1-1-0.dll			ftell
api-ms-win-crt-filesystem-l1-1-0.dll			_lock_file
api-ms-win-crt-convert-l1-1-0.dll			strtoul
api-ms-win-crt-utility-l1-1-0.dll			rand
api-ms-win-crt-time-l1-1-0.dll			_localtime64
api-ms-win-crt-string-l1-1-0.dll			isspace
WTSAPI32.dll			WTSSendMessageW
KERNEL32.dll			GetCurrentProcess
USER32.dll			CharUpperBuffW
ADVAPI32.dll			RegQueryValueExA
KERNEL32.dll			LocalAlloc
KERNEL32.dll			GetCurrentProcess
KERNEL32.dll			GetCurrentThread
KERNEL32.dll			LocalFree
KERNEL32.dll			GetModuleFileNameW
KERNEL32.dll			GetProcessAffinityMask
KERNEL32.dll			SetProcessAffinityMask
KERNEL32.dll			SetThreadAffinityMask
KERNEL32.dll			Sleep
KERNEL32.dll			ExitProcess
KERNEL32.dll			GetLastError
KERNEL32.dll			FreeLibrary
KERNEL32.dll			LoadLibraryA
KERNEL32.dll			GetModuleHandleA
KERNEL32.dll			GetProcAddress
ADVAPI32.dll			OpenSCManagerW
ADVAPI32.dll			EnumServicesStatusExW
ADVAPI32.dll			OpenServiceW
ADVAPI32.dll			QueryServiceConfigW
ADVAPI32.dll			CloseServiceHandle

ord	entry_va	function_name
1	0x33500	?ReflectiveLoader@@YGKXZ

module_name	1.dll
flags	0
timestamp	2106-02-07 06:28:15
version	0.0
ordinal_base	1
nFunctions	1
nNames	1
Names(1)	0x38f77e
Functions(1)	0x38f778
NameOrdinals(1)	0x38f77c

show previews

offset	size	type	comment
0	2698240	DLL	02/04/2019 15:25:54	#
15c1	15	HTM		#
9468	11744	WAV		#
c250	32804	WAV		#
14288	62832	WAV		#
23800	76956	WAV		#
364b8	70552	WAV		#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] can't find file_offset of VA 0x14c308