filenamesteam_api.dll
size249664 (0x3cf40)
md5a34c0240a60d822cf09800bdf240ea53
typePE32 executable (DLL) (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xe8

Rich Header

lib idversiontimes used
2252100571
2232100530
22421005232
2036550117
10134
2294062951
220406291
219210051
222406291

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections3
TimeDateStamp0x566d75ac
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x2102
Magic0x10b
LinkerVersion12.0
SizeOfCode0x3b000
SizeOfInitializedData0x2000
SizeOfUninitializedData0x6d000
AddressOfEntryPoint0xa8810
BaseOfCode0x6e000
BaseOfData0xa9000
ImageBase0x10000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.0
ImageVersion0.0
SubsystemVersion6.0
Reserved10
SizeOfImage0xab000
SizeOfHeaders0x1000
CheckSum0x40e21
Subsystem2
DllCharacteristics0x140
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

UPX v2.00-V2.90 (Markus Oberhumer & Laszlo Molnar & John Reiser)

This file is packed with UPX. Analysis will be incomplete without unpacking.
We can unpack it for you.

»» Analyze unpacked file

Sections

namevavsizeraw sizeflags
WUS00x10000x6d0000RWX UDATA
WUS10x6e0000x3b0000x3ac00RWX IDATA
.rsrc0xa90000x20000x1a00RW- IDATA

Data Directory

typevasize
EXPORT0xa98ec0xf84
IMPORT0xa96e00x20c
RESOURCE0xa90000x6e0
EXCEPTION00
SECURITY0x3ca000x540
BASERELOC0xaa8700x10
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0xa8a040x48
Bound_IAT00
IAT00
Delay_IAT00
CLR_Header00
typenamesizecp
VERSION#18800
VERSION#17600
module_namehintordfunction_name
KERNEL32.DLLLoadLibraryA
KERNEL32.DLLGetProcAddress
KERNEL32.DLLVirtualProtect
KERNEL32.DLLVirtualAlloc
KERNEL32.DLLVirtualFree
ADVAPI32.dllRegOpenKeyExA
ntdll.dllRtlUnwind
PSAPI.DLLEnumProcessModules
SHELL32.dllSHGetFolderPathA
SHLWAPI.dllPathFileExistsW
USER32.dllMessageBoxA
WS2_32.dll115
ordentry_vafunction_name
10x47073Breakpad_SteamMiniDumpInit
20x4706cBreakpad_SteamSetAppID
30x47062Breakpad_SteamSetSteamID
40x47058Breakpad_SteamWriteMiniDumpSetComment
50x47051Breakpad_SteamWriteMiniDumpUsingExceptionInfoWithBuildId
60x47028CreateInterface
70x4733dGetHSteamPipe
80x4735eGetHSteamUser
90x4701eOPENSSL_Applink
100x47348SteamAPI_GetHSteamPipe
110x47369SteamAPI_GetHSteamUser
120x4737fSteamAPI_GetSteamInstallPath
130x475d0SteamAPI_Init
140x475c2SteamAPI_InitSafe
150x47615SteamAPI_IsSteamRunning
160x473bcSteamAPI_RegisterCallResult
170x473efSteamAPI_RegisterCallback
180x475aeSteamAPI_RestartApp
190x475b8SteamAPI_RestartAppIfNecessary
200x47406SteamAPI_RunCallbacks
210x475deSteamAPI_SetBreakpadAppID
220x475ecSteamAPI_SetMiniDumpComment
230x47412SteamAPI_SetTryCatchCallbacks
240x4761fSteamAPI_Shutdown
250x4739fSteamAPI_UnregisterCallResult
260x473dbSteamAPI_UnregisterCallback
270x475e5SteamAPI_UseBreakpadCrashHandler
280x475f3SteamAPI_WriteMiniDump
290x47157SteamAppList
300x474d6SteamApps
310x47578SteamClient
320x47262SteamContentServer
330x47247SteamContentServerUtils
340x4723dSteamContentServer_Init
350x4722fSteamContentServer_RunCallbacks
360x47236SteamContentServer_Shutdown
370x471a8SteamController
380x470f2SteamEncryptedAppTicket_BDecryptTicket
390x470e8SteamEncryptedAppTicket_BIsTicketForApp
400x470deSteamEncryptedAppTicket_BUserIsVacBanned
410x470d4SteamEncryptedAppTicket_BUserOwnsAppInTicket
420x470fcSteamEncryptedAppTicket_GetTicketAppID
430x470c0SteamEncryptedAppTicket_GetTicketIssueTime
440x470b9SteamEncryptedAppTicket_GetTicketSteamID
450x470caSteamEncryptedAppTicket_GetUserVariableData
460x4755dSteamFriends
470x472ceSteamGameServer
480x471f9SteamGameServerHTTP
490x47485SteamGameServerInventory
500x4744fSteamGameServerNetworking
510x4727dSteamGameServerStats
520x47172SteamGameServerUGC
530x472b3SteamGameServerUtils
540x47315SteamGameServer_BSecure
550x47332SteamGameServer_GetHSteamPipe
560x47353SteamGameServer_GetHSteamUser
570x472fdSteamGameServer_GetIPCCallCount
580x47307SteamGameServer_GetSteamID
590x472f3SteamGameServer_Init
600x472e9SteamGameServer_InitSafe
610x4731fSteamGameServer_RunCallbacks
620x4732bSteamGameServer_Shutdown
630x47106SteamHTMLSurface
640x47214SteamHTTP
650x474a0SteamInventory
660x47298SteamMasterServerUpdater
670x47527SteamMatchmaking
680x4750cSteamMatchmakingServers
690x4713cSteamMusic
700x47121SteamMusicRemote
710x474bbSteamNetworking
720x47434SteamNetworkingUpdater
730x47419SteamRemoteStorage
740x471deSteamScreenshots
750x4718dSteamUGC
760x471c3SteamUnifiedMessages
770x47593SteamUser
780x474f1SteamUserStats
790x47542SteamUtils
800x4746aSteamVideo
810x47014Steam_BConnected
820x47000Steam_BGetCallback
830x46ff6Steam_BLoggedOn
840x46fecSteam_BReleaseSteamPipe
850x46fe1Steam_ConnectToGlobalUser
860x46fc9Steam_CreateLocalUser
870x46fbeSteam_CreateSteamPipe
880x46fb7Steam_FreeLastCallback
890x46fadSteam_GSBLoggedOn
900x46fa3Steam_GSBSecure
910x46f99Steam_GSGetSteam2GetEncryptionKeyToSendToNewClient
920x46f8bSteam_GSGetSteamID
930x46f84Steam_GSLogOff
940x46f7dSteam_GSLogOn
950x46f73Steam_GSRemoveUserConnect
960x46f69Steam_GSSendSteam3UserConnect
970x46f5fSteam_GSSendUserDisconnect
980x46f55Steam_GSSendUserStatusResponse
990x46f4bSteam_GSSetServerType
1000x46f44Steam_GSSetSpawnCount
1010x46f3aSteam_GSUpdateStatus
1020x46f30Steam_GetAPICallResult
1030x46f26Steam_GetGSHandle
1040x47374Steam_GetHSteamUserCurrent
1050x46f1cSteam_InitiateGameConnection
1060x46f15Steam_LogOff
1070x46f0eSteam_LogOn
1080x4738cSteam_RegisterInterfaceFuncs
1090x46f07Steam_ReleaseUser
1100x47393Steam_RunCallbacks
1110x46f00Steam_SetLocalIPBinding
1120x46ef9Steam_TerminateGameConnection
1130x4707aVR_GetGenericInterface
1140x47084VR_GetStringForHmdError
1150x470a2VR_Init
1160x47091VR_IsHmdPresent
1170x4709bVR_Shutdown
1180x475fag_pSteamClientGameServer
module_namesteam_api.dll
flags0
timestamp2015-12-13 13:42:01
version0.0
ordinal_base1
nFunctions118
nNames118
Names(118)0xa9aec
Functions(118)0xa9914
NameOrdinals(118)0xa9cc4

StringTable 040904B0

LegalCopyrightCopyright (C) NisCkxU544c
InternalNameSteam Client API
FileVersion01.0.0.90
CompanyNameValve Corporation
ProductVersion01.00.00.01
FileDescriptionSteam Client API (buildbot_winslave007@WUS)
Source Control ID1337110
OriginalFilenamesteam_api.dll
ProductNameSteam Client API

StringTable 040904B0

CompanyNameValve Corporation
FileDescriptionSteam Client API
FileVersion1, 0, 0, 1
InternalNameSteam Client API
LegalCopyrightCopyright (C) 2007
OriginalFilenamesteam_api.dll
ProductNameSteam Client API
ProductVersion1, 0, 0, 1

VS_FIXEDFILEINFO

FileVersion1.0.0.90
ProductVersion1.0.0.1
StrucVersion0x10000
FileFlagsMask0x17
FileFlags0
FileOS4
FileType2
FileSubtype0

VS_FIXEDFILEINFO

FileVersion1.0.0.1
ProductVersion1.0.0.1
StrucVersion0x10000
FileFlagsMask0x17
FileFlags0
FileOS4
FileType2
FileSubtype0

Signers (1)

issuer: /CN=\x00W\x00U\x00S\x00!
serial: 473D2A7861AD04BD4C92C8C2DFE090AD

Certificates (1)

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            47:3d:2a:78:61:ad:04:bd:4c:92:c8:c2:df:e0:90:ad
        Signature Algorithm: sha1WithRSA
        Issuer: CN=\x00W\x00U\x00S\x00!
        Validity
            Not Before: Jun 30 22:00:00 2014 GMT
            Not After : Dec 31 22:00:00 2087 GMT
        Subject: CN=\x00W\x00U\x00S\x00!
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    00:8d:be:b6:99:cc:dc:bd:e1:b8:e7:de:08:a2:a4:
                    54:41:e5:39:d0:3e:2f:53:21:49:4d:64:c6:e8:f5:
                    c7:51:2d:ab:71:12:ea:02:99:a7:b0:14:11:84:e1:
                    fe:e4:8d:b7:ff:91:cb:ab:f1:d3:2e:ba:3b:39:a8:
                    bf:55:5b:71:05:9d:6f:e2:eb:a9:84:73:6b:cc:69:
                    f2:0e:d3:ed:24:0c:2e:64:da:1b:f4:ea:a6:e9:a1:
                    38:71:39:0c:23:57:6a:fb:40:d4:db:15:54:e2:63:
                    da:92:fa:94:ad:d1:fe:6a:8a:b3:fd:28:73:62:08:
                    12:01:b7:5d:89:cc:30:b7:aa:63:10:ce:68:5c:05:
                    b5:37:b2:07:33:e9:cb:54:7b:13:e8:f9:4d:dd:31:
                    e6:ec:45:e1:5d:6b:a3:88:97:cd:c7:b6:64:fa:11:
                    d0:08:85:35:9c:20:54:c7:f4:85:85:c9:78:8c:4a:
                    1f:94:97:f8:a1:dd:97:9b:0c:88:f7:f4:bd:85:24:
                    cd:11:4a:82:ce:4a:19:d9:12:b0:ea:a5:61:f8:0a:
                    52:40:68:10:e9:ce:69:4c:17:9f:23:e8:1b:e2:b4:
                    9b:35:40:0d:3b:d4:bc:fe:bb:fb:96:4e:07:82:3d:
                    b8:b8:75:95:5c:5d:98:6a:a3:40:2e:5e:8c:7d:55:
                    7b:c5
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            2.5.29.1: 
                0;..Q.;...s.$.........0.1.0...U.....W.U.S.!..G=*xa...L.......
    Signature Algorithm: sha1WithRSA
         0b:15:42:90:d8:8e:b1:4c:98:ef:b3:8b:5f:d7:23:1b:db:02:
         c7:db:d3:4c:48:ac:36:72:7f:7f:81:96:98:31:ae:0b:5e:8f:
         84:9f:d9:b8:6d:62:e8:a4:3f:68:05:5c:9b:10:2f:00:25:e7:
         70:ab:11:79:e0:0c:d4:8e:94:76:a0:8b:75:eb:b7:3b:8e:03:
         86:cd:7c:2f:06:e1:65:9f:c8:88:08:59:bb:bf:d2:e8:56:33:
         a9:96:84:c4:e1:3c:44:f0:09:67:f3:10:3f:05:0b:b7:8b:7e:
         15:fe:41:0a:96:27:7a:fe:f9:cc:da:6f:41:53:da:89:ff:12:
         42:eb:e3:85:25:84:4a:a6:77:14:94:20:2d:d7:6e:be:56:7d:
         02:7b:b0:51:63:e3:9c:29:20:9a:d9:c0:e9:c2:74:95:6d:a0:
         b0:7e:df:70:2a:6c:29:a1:d9:9a:1f:57:c8:19:d7:9d:31:34:
         bf:23:10:65:fd:c2:9a:0e:86:77:8c:fa:07:29:25:3c:9e:70:
         5d:03:9e:0d:a5:02:44:11:27:9c:42:89:3e:e9:9d:e2:4a:01:
         9c:d3:32:6c:43:47:67:6f:b6:af:6b:42:6f:3c:d0:97:2b:b7:
         2f:75:21:06:4d:8f:2e:8c:f9:08:ca:d5:3f:2c:c7:29:b0:c4:
         b1:be:d8:79
pkcs7-signedData
  • 1
    • SHA1: nil
    • 1.3.6.1.4.1.311.2.1.4
      • #0
        • 1.3.6.1.4.1.311.2.1.15
          • : 
            00 3c 00 3c 00 3c 00 4f  00 62 00 73 00 6f 00 6c  |.<.<.<.O.b.s.o.l|
00 65 00 74 00 65 00 3e  00 3e 00 3e              |.e.t.e.>.>.>    |
        • SHA1
          • 0e 08 0c ed eb ee 40 48  42 5c 88 55 4c b1 7c a8  |......@HB\.UL.|.|
13 13 f3 fa                                       |....            |
    • #2
      • 2
        • 47:3D:2A:78:61:AD:04:BD:4C:92:C8:C2:DF:E0:90:AD
        • RSA-SHA1-2: nil
        • CN: 
          00 57 00 55 00 53 00 21                           |.W.U.S.!        |
        • 2014-06-30 22:00:00 UTC: 2087-12-31 22:00:00 UTC
        • CN: 
          00 57 00 55 00 53 00 21                           |.W.U.S.!        |
        • #5
          • rsaEncryption: nil
          • 8D:BE:B6:99:CC:DC:BD:E1:B8:E7:DE:08:A2:A4:54:41:
            E5:39:D0:3E:2F:53:21:49:4D:64:C6:E8:F5:C7:51:2D:
            AB:71:12:EA:02:99:A7:B0:14:11:84:E1:FE:E4:8D:B7:
            FF:91:CB:AB:F1:D3:2E:BA:3B:39:A8:BF:55:5B:71:05:
            9D:6F:E2:EB:A9:84:73:6B:CC:69:F2:0E:D3:ED:24:0C:
            2E:64:DA:1B:F4:EA:A6:E9:A1:38:71:39:0C:23:57:6A:
            FB:40:D4:DB:15:54:E2:63:DA:92:FA:94:AD:D1:FE:6A:
            8A:B3:FD:28:73:62:08:12:01:B7:5D:89:CC:30:B7:AA:
            63:10:CE:68:5C:05:B5:37:B2:07:33:E9:CB:54:7B:13:
            E8:F9:4D:DD:31:E6:EC:45:E1:5D:6B:A3:88:97:CD:C7:
            B6:64:FA:11:D0:08:85:35:9C:20:54:C7:F4:85:85:C9:
            78:8C:4A:1F:94:97:F8:A1:DD:97:9B:0C:88:F7:F4:BD:
            85:24:CD:11:4A:82:CE:4A:19:D9:12:B0:EA:A5:61:F8:
            0A:52:40:68:10:E9:CE:69:4C:17:9F:23:E8:1B:E2:B4:
            9B:35:40:0D:3B:D4:BC:FE:BB:FB:96:4E:07:82:3D:B8:
            B8:75:95:5C:5D:98:6A:A3:40:2E:5E:8C:7D:55:7B:C5            : 0x010001
        • 2.5.29.1
          • 51 d9 3b f4 ad e9 73 c8  24 e9 af 14 10 a9 02 b2  |Q.;...s.$.......|
            • CN: 
              00 57 00 55 00 53 00 21                           |.W.U.S.!        |
            • 47 3d 2a 78 61 ad 04 bd  4c 92 c8 c2 df e0 90 ad  |G=*xa...L.......|
      • RSA-SHA1-2: 
        0b 15 42 90 d8 8e b1 4c  98 ef b3 8b 5f d7 23 1b  |..B....L...._.#.|
db 02 c7 db d3 4c 48 ac  36 72 7f 7f 81 96 98 31  |.....LH.6r.....1|
ae 0b 5e 8f 84 9f d9 b8  6d 62 e8 a4 3f 68 05 5c  |..^.....mb..?h.\|
9b 10 2f 00 25 e7 70 ab  11 79 e0 0c d4 8e 94 76  |../.%.p..y.....v|
a0 8b 75 eb b7 3b 8e 03  86 cd 7c 2f 06 e1 65 9f  |..u..;....|/..e.|
c8 88 08 59 bb bf d2 e8  56 33 a9 96 84 c4 e1 3c  |...Y....V3.....<|
44 f0 09 67 f3 10 3f 05  0b b7 8b 7e 15 fe 41 0a  |D..g..?....~..A.|
96 27 7a fe f9 cc da 6f  41 53 da 89 ff 12 42 eb  |.'z....oAS....B.|
e3 85 25 84 4a a6 77 14  94 20 2d d7 6e be 56 7d  |..%.J.w.. -.n.V}|
02 7b b0 51 63 e3 9c 29  20 9a d9 c0 e9 c2 74 95  |.{.Qc..) .....t.|
6d a0 b0 7e df 70 2a 6c  29 a1 d9 9a 1f 57 c8 19  |m..~.p*l)....W..|
d7 9d 31 34 bf 23 10 65  fd c2 9a 0e 86 77 8c fa  |..14.#.e.....w..|
07 29 25 3c 9e 70 5d 03  9e 0d a5 02 44 11 27 9c  |.)%<.p].....D.'.|
42 89 3e e9 9d e2 4a 01  9c d3 32 6c 43 47 67 6f  |B.>...J...2lCGgo|
b6 af 6b 42 6f 3c d0 97  2b b7 2f 75 21 06 4d 8f  |..kBo<..+./u!.M.|
2e 8c f9 08 ca d5 3f 2c  c7 29 b0 c4 b1 be d8 79  |......?,.).....y|
    • 1
      • #0
        • CN: 
          00 57 00 55 00 53 00 21                           |.W.U.S.!        |
        • 47:3D:2A:78:61:AD:04:BD:4C:92:C8:C2:DF:E0:90:AD
      • SHA1: nil
      • #2
        • 1.3.6.1.4.1.311.2.1.12
          • nil
        • contentType: 1.3.6.1.4.1.311.2.1.4
        • messageDigest: 
          d2 3e c7 1a 0c 51 3e 38  96 51 5f 48 2b d2 b2 05  |.>...Q>8.Q_H+...|
c2 8b d8 c7                                       |....            |
      • rsaEncryption: 
        7a b2 58 c9 53 55 60 4e  47 bd 52 5f 38 93 41 bf  |z.X.SU`NG.R_8.A.|
fb 60 de e9 0f 80 d5 98  5e c9 1a 76 af d4 4d 09  |.`......^..v..M.|
aa 38 ad a2 28 de 1c e2  04 97 6d 30 fd 03 2c 1a  |.8..(.....m0..,.|
0c 8f 50 30 b2 67 cf 2c  9e 38 81 81 58 1b 57 d7  |..P0.g.,.8..X.W.|
aa 6e 2d 28 b5 16 0b 45  ca 57 c6 aa 37 87 bd 0e  |.n-(...E.W..7...|
9e 16 68 d7 e8 a2 ff 93  2c b0 bc b2 fb 25 a3 bd  |..h.....,....%..|
bc e0 3b 56 d4 5e 9a e3  6d b9 74 db 60 8e 9a c2  |..;V.^..m.t.`...|
dd 07 45 97 ec 9e 68 30  e4 81 50 06 97 7b 46 92  |..E...h0..P..{F.|
a2 24 a3 e4 70 1f d2 06  75 06 e8 1a 43 fa 1a 85  |.$..p...u...C...|
0d 1a b8 19 c9 2a a2 e0  8e bf 2e 05 cd 06 94 d6  |.....*..........|
3a d8 f0 ad 6b 81 86 6b  c9 64 75 aa 03 6b ac 9d  |:...k..k.du..k..|
e1 45 5d 19 27 9f 84 4c  3d 43 7d 89 6e cf 24 06  |.E].'..L=C}.n.$.|
c6 14 24 26 76 47 4c cd  71 9f 74 23 d3 37 51 f8  |..$&vGL.q.t#.7Q.|
b2 a6 95 bb 0c de 9f 4e  e0 2b 27 78 b6 c0 dc 1d  |.......N.+'x....|
48 ba 24 0d 0a df 15 3b  f6 00 8c 70 4e 83 d2 49  |H.$....;...pN..I|
24 88 45 ac e6 18 ea 25  cf 50 ab 6a 22 c5 fb 4b  |$.E....%.P.j"..K|
offsetsizetypecomment
0248320DLL12/13/2015 13:42:04#
15c115HTM#
3ca001344PKCS7Authenticode Signature#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable







everything is OK