filenameversion.dll
size69632 (0x11000)
md5aae33125f1e174f7f5791b710a2f773b
typePE32+ executable (DLL) (GUI) x86-64, for MS Windows
mimetypeapplication/x-dosexec
clamavscan pending
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xf8

Rich Header

lib idversiontimes used
1473072910
2613303018
260330308
259330304
257330306
257307955
1091
265331352
256331351
255331351
258331351

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x8664
NumberOfSections6
TimeDateStamp0x65e9fde6
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xf0
Characteristics0x2022
Magic0x20b
LinkerVersion14.38
SizeOfCode0xd800
SizeOfInitializedData0x3a00
SizeOfUninitializedData0
AddressOfEntryPoint0xd76c
BaseOfCode0x1000
ImageBase0x180000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.0
ImageVersion0.0
SubsystemVersion6.0
Reserved10
SizeOfImage0x16000
SizeOfHeaders0x400
CheckSum0
Subsystem2
DllCharacteristics0x160
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MASM/TASM - sig4

Sections

namevavsizeraw sizeflags
.text0x10000xd6690xd800R-X CODE
.rdata0xf0000x26b00x2800R-- IDATA
.data0x120000x7200x200RW- IDATA
.pdata0x130000x5040x600R-- IDATA
.rsrc0x140000xf80x200R-- IDATA
.reloc0x150000x940x200R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT0x108000x22c
IMPORT0x10a2c0xc8
RESOURCE0x140000xf8
EXCEPTION0x130000x504
SECURITY00
BASERELOC0x150000x94
DEBUG0xf9a00x70
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0xf8600x140
Bound_IAT00
IAT0xf0000x2b8
Delay_IAT00
CLR_Header00
typenamesizecp
MANIFEST#21450
module_namehintordfunction_name
KERNEL32.dll996LoadLibraryA
KERNEL32.dll717GetProcAddress
KERNEL32.dll1541VirtualProtect
KERNEL32.dll658GetModuleHandleA
KERNEL32.dll967K32GetModuleInformation
KERNEL32.dll562GetCurrentProcess
KERNEL32.dll1535VirtualAlloc
KERNEL32.dll22AllocConsole
KERNEL32.dll1334SetConsoleTitleW
KERNEL32.dll450FreeConsole
KERNEL32.dll148CloseHandle
KERNEL32.dll661GetModuleHandleW
KERNEL32.dll1460Sleep
KERNEL32.dll454FreeLibraryAndExitThread
KERNEL32.dll308DisableThreadLibraryCalls
KERNEL32.dll259CreateThread
KERNEL32.dll1277RtlLookupFunctionEntry
KERNEL32.dll1284RtlVirtualUnwind
KERNEL32.dll1510UnhandledExceptionFilter
KERNEL32.dll1444SetUnhandledExceptionFilter
KERNEL32.dll1476TerminateProcess
KERNEL32.dll936IsProcessorFeaturePresent
KERNEL32.dll1136QueryPerformanceCounter
KERNEL32.dll563GetCurrentProcessId
KERNEL32.dll567GetCurrentThreadId
KERNEL32.dll778GetSystemTimeAsFileTime
KERNEL32.dll906InitializeSListHead
KERNEL32.dll928IsDebuggerPresent
KERNEL32.dll1269RtlCaptureContext
MSVCP140.dll1332public: char __cdecl std::basic_ios<char, struct std::char_traits<char> >::widen(char)const __ptr64

?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z

MSVCP140.dll1221public: void __cdecl std::basic_ios<char, struct std::char_traits<char> >::setstate(int, bool) __ptr64

?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z

MSVCP140.dll872public: class std::basic_ostream<char, struct std::char_traits<char> > & __ptr64 __cdecl std::basic_ostream<char, struct std::char_traits<char> >::flush(void) __ptr64

?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ

MSVCP140.dll1246public: int __cdecl std::basic_streambuf<char, struct std::char_traits<char> >::sputc(char) __ptr64

?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z

MSVCP140.dll262public: class std::basic_ostream<char, struct std::char_traits<char> > & __ptr64 __cdecl std::basic_ostream<char, struct std::char_traits<char> >::operator<<(class std::basic_ostream<char, struct std::char_traits<char> > & __ptr64 (__cdecl*)(class std::basic_ostream<char, struct std::char_traits<char> > & __ptr64)) __ptr64

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z

MSVCP140.dll965public: bool __cdecl std::ios_base::good(void)const __ptr64

?good@ios_base@std@@QEBA_NXZ

MSVCP140.dll654void __cdecl std::_Xlength_error(char const * __ptr64)

?_Xlength_error@std@@YAXPEBD@Z

MSVCP140.dll653void __cdecl std::_Xinvalid_argument(char const * __ptr64)

?_Xinvalid_argument@std@@YAXPEBD@Z

MSVCP140.dll655void __cdecl std::_Xout_of_range(char const * __ptr64)

?_Xout_of_range@std@@YAXPEBD@Z

MSVCP140.dll674class std::basic_ostream<char, struct std::char_traits<char> > std::cerr

?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A

MSVCP140.dll692class std::basic_ostream<char, struct std::char_traits<char> > std::cout

?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A

MSVCP140.dll1310bool __cdecl std::uncaught_exception(void)

?uncaught_exception@std@@YA_NXZ

MSVCP140.dll1121public: class std::basic_ostream<char, struct std::char_traits<char> > & __ptr64 __cdecl std::basic_ostream<char, struct std::char_traits<char> >::put(char) __ptr64

?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z

MSVCP140.dll580public: void __cdecl std::basic_ostream<char, struct std::char_traits<char> >::_Osfx(void) __ptr64

?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ

MSVCP140.dll1249public: __int64 __cdecl std::basic_streambuf<char, struct std::char_traits<char> >::sputn(char const * __ptr64, __int64) __ptr64

?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z

VCRUNTIME140_1.dll__CxxFrameHandler4
VCRUNTIME140.dll27__current_exception
VCRUNTIME140.dll37__std_type_info_destroy_list
VCRUNTIME140.dll33__std_exception_copy
VCRUNTIME140.dll35__std_terminate
VCRUNTIME140.dll60memcpy
VCRUNTIME140.dll28__current_exception_context
VCRUNTIME140.dll1_CxxThrowException
VCRUNTIME140.dll62memset
VCRUNTIME140.dll34__std_exception_destroy
VCRUNTIME140.dll59memcmp
VCRUNTIME140.dll8__C_specific_handler
VCRUNTIME140.dll61memmove
api-ms-win-crt-runtime-l1-1-0.dll63_seh_filter_dll
api-ms-win-crt-runtime-l1-1-0.dll24_configure_narrow_argv
api-ms-win-crt-runtime-l1-1-0.dll22_cexit
api-ms-win-crt-runtime-l1-1-0.dll54_initterm
api-ms-win-crt-runtime-l1-1-0.dll103terminate
api-ms-win-crt-runtime-l1-1-0.dll52_initialize_onexit_table
api-ms-win-crt-runtime-l1-1-0.dll102system
api-ms-win-crt-runtime-l1-1-0.dll34_execute_onexit_table
api-ms-win-crt-runtime-l1-1-0.dll51_initialize_narrow_environment
api-ms-win-crt-runtime-l1-1-0.dll57_invalid_parameter_noinfo_noreturn
api-ms-win-crt-runtime-l1-1-0.dll56_invalid_parameter_noinfo
api-ms-win-crt-runtime-l1-1-0.dll33_errno
api-ms-win-crt-runtime-l1-1-0.dll55_initterm_e
api-ms-win-crt-stdio-l1-1-0.dll134freopen_s
api-ms-win-crt-stdio-l1-1-0.dll3__stdio_common_vfprintf
api-ms-win-crt-stdio-l1-1-0.dll__acrt_iob_func
api-ms-win-crt-convert-l1-1-0.dll97strtol
api-ms-win-crt-conio-l1-1-0.dll14_getch
api-ms-win-crt-heap-l1-1-0.dll25malloc
api-ms-win-crt-heap-l1-1-0.dll8_callnewh
api-ms-win-crt-heap-l1-1-0.dll24free
ordentry_vafunction_name
10x1010GetFileVersionInfoA
20x1030GetFileVersionInfoByHandle
30x1050GetFileVersionInfoExA
40x1070GetFileVersionInfoExW
50x1090GetFileVersionInfoSizeA
60x10b0GetFileVersionInfoSizeExA
70x10d0GetFileVersionInfoSizeExW
80x10f0GetFileVersionInfoSizeW
90x1110GetFileVersionInfoW
100x1130VerFindFileA
110x1150VerFindFileW
120x1170VerInstallFileA
130x1190VerInstallFileW
140x11b0VerLanguageNameA
150x11d0VerLanguageNameW
160x11f0VerQueryValueA
170x1210VerQueryValueW
module_nameversion.dll
flags0
timestamp2106-02-07 06:28:15
version0.0
ordinal_base1
nFunctions17
nNames17
Names(17)0x1086c
Functions(17)0x10828
NameOrdinals(17)0x108b0
offsetsizetypecomment
15c115HTM#
15d064048BINoverlay data past EOF#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK