cereg400.dll

info
MZ
PE
imports
exports
foremost
hexdump
disasm
log
discuss
donate

filename	cereg400.dll
size	53248 (0xd000)
md5	a3ad06c2d0ab32a021631bfd64d6ded7

type	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	scan pending
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0xf0

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|
00000040: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
000000b0:

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	3
TimeDateStamp	0x41785338
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x212e
Magic	0x10b
LinkerVersion	7.10
SizeOfCode	0xa000
SizeOfInitializedData	0x4000
SizeOfUninitializedData	0
AddressOfEntryPoint	0x3173
BaseOfCode	0x1000
BaseOfData	0xb000
ImageBase	0x10000000
SectionAlignment	0x1000
FileAlignment	0x1000
OperatingSystemVersion	4.0
ImageVersion	0.0
SubsystemVersion	4.0
Reserved1	0
SizeOfImage	0xf000
SizeOfHeaders	0x1000
CheckSum	0
Subsystem	2
DllCharacteristics	0
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

MS Visual C++ v6.0 DLL

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x9f0a	0xa000	R-X CODE
.data	0xb000	0x2910	0x1000	RW- IDATA
.reloc	0xe000	0x8ee	0x1000	R-- IDATA DISCARDABLE

Data Directory

type	va	size
EXPORT	0xac40	0x2ca
IMPORT	0xa7d0	0x50
RESOURCE	0	0
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0xe000	0x5b0
DEBUG	0x10e0	0x1c
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0x2588	0x40
Bound_IAT	0	0
IAT	0x1000	0xd8
Delay_IAT	0	0
CLR_Header	0	0

module_name	hint	function_name
ole32.dll	15	CoCreateGuid
MSVCR71.dll	590	_wfopen
MSVCR71.dll	681	fputwc
MSVCR71.dll	666	fclose
MSVCR71.dll	682	fputws
MSVCR71.dll	691	fwprintf
MSVCR71.dll	817	wcscpy
MSVCR71.dll	821	wcsncat
MSVCR71.dll	822	wcsncmp
MSVCR71.dll	835	wprintf
MSVCR71.dll	563	_wcsnicmp
MSVCR71.dll	820	wcslen
MSVCR71.dll	241	_except_handler3
MSVCR71.dll	559	_wcsicmp
KERNEL32.dll	53	CompareStringW
KERNEL32.dll	771	SetEndOfFile
KERNEL32.dll	229	FlushFileBuffers
KERNEL32.dll	706	ResetEvent
KERNEL32.dll	667	RaiseException
KERNEL32.dll	327	GetDiskFreeSpaceExW
KERNEL32.dll	231	FlushViewOfFile
KERNEL32.dll	867	UnmapViewOfFile
KERNEL32.dll	443	GetSystemInfo
KERNEL32.dll	883	VirtualAlloc
KERNEL32.dll	886	VirtualFree
KERNEL32.dll	681	ReadFile
KERNEL32.dll	782	SetFilePointer
KERNEL32.dll	916	WriteFile
KERNEL32.dll	590	LocalAlloc
KERNEL32.dll	594	LocalFree
KERNEL32.dll	314	GetCurrentProcess
KERNEL32.dll	347	GetFileSize
KERNEL32.dll	795	SetLastError
KERNEL32.dll	537	InitializeCriticalSection
KERNEL32.dll	518	HeapAlloc
KERNEL32.dll	520	HeapCreate
KERNEL32.dll	524	HeapFree
KERNEL32.dll	777	SetEvent
KERNEL32.dll	315	GetCurrentProcessId
KERNEL32.dll	583	LeaveCriticalSection
KERNEL32.dll	143	EnterCriticalSection
KERNEL32.dll	79	CreateFileMappingW
KERNEL32.dll	74	CreateEventW
KERNEL32.dll	781	SetFileAttributesW
KERNEL32.dll	345	GetFileAttributesW
KERNEL32.dll	361	GetLastError
KERNEL32.dll	46	CloseHandle
KERNEL32.dll	80	CreateFileW
KERNEL32.dll	839	Sleep
KERNEL32.dll	606	MapViewOfFile
KERNEL32.dll	899	WaitForSingleObject

ord	entry_va	function_name
1	0x62ac	CEREG_RegCloseKey
2	0x6800	CEREG_RegCompactHive
3	0x4bc9	CEREG_RegCreateKeyEx
4	0x543b	CEREG_RegDeleteKey
5	0x5195	CEREG_RegDeleteValue
6	0x5a70	CEREG_RegEnumKeyEx
7	0x56bd	CEREG_RegEnumValue
8	0x7b7a	CEREG_RegFlushKey
9	0x724b	CEREG_RegMountHive
10	0x4da6	CEREG_RegOpenKeyEx
11	0x5f9f	CEREG_RegQueryInfoKey
12	0x5e14	CEREG_RegQueryValueEx
13	0x77ab	CEREG_RegSaveDeltaRGUFile
14	0x66f2	CEREG_RegSetHKEYActiveHive
15	0x50dc	CEREG_RegSetValueEx
16	0x958d	CEREG_RegTrimHive
17	0x6e68	CEREG_RegUnmountHive
18	0x62ac	RegCloseKey
19	0x4bc9	RegCreateKeyEx
20	0x724b	RegMountHive
21	0x50dc	RegSetValueEx
22	0x958d	RegTrimHive
23	0x6e68	RegUnmountHive

module_name	CEREG400.dll
flags	0
timestamp	2004-10-22 00:24:23
version	0.0
ordinal_base	1
nFunctions	23
nNames	23
Names(23)	0xacc4
Functions(23)	0xac68
NameOrdinals(23)	0xad20

show previews

offset	size	type	comment
0	53248	DLL	10/22/2004 00:24:24	#
15c1	15	HTM		#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

everything is OK