api-ms-win-core-processthreads-l1-1-0.dll - apisetstub

info
MZ
PE
resources
exports
foremost
version info
hexdump
disasm
log
discuss
donate

filename	api-ms-win-core-processthreads-l1-1-0.dll
size	4608 (0x1200)
md5	ab67f89d8e497ffae3d549308a253316

type	PE32+ executable (DLL) (console) x86-64, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0xd0

Rich Header

lib id	version	times used
146	30729	1
131	30729	2
148	30729	1
145	30729	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x8664
NumberOfSections	3
TimeDateStamp	0x4dce29a3
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xf0
Characteristics	0x2022
Magic	0x20b
LinkerVersion	9.0
SizeOfCode	0x800
SizeOfInitializedData	0x600
SizeOfUninitializedData	0
AddressOfEntryPoint	0x1080
BaseOfCode	0x1000
ImageBase	0x7ff2c800000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	6.1
ImageVersion	6.1
SubsystemVersion	6.1
Reserved1	0
SizeOfImage	0x4000
SizeOfHeaders	0x400
CheckSum	0xa0bf
Subsystem	3
DllCharacteristics	0x140
SizeOfStackReserve	0x40000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x643	0x800	R-X CODE
.rsrc	0x2000	0x3f0	0x400	R-- IDATA
.reloc	0x3000	0x1a	0x200	R-- IDATA DISCARDABLE

Data Directory

type	va	size
EXPORT	0x1090	0x5b3
IMPORT	0	0
RESOURCE	0x2000	0x3f0
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0x3000	8
DEBUG	0x1000	0x1c
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0	0
Delay_IAT	0	0
CLR_Header	0	0

show previews

type	name	size	cp
VERSION	#1	908	0

ord	entry_va	function_name
1	0x1068	CreateProcessA
2	0x1068	CreateProcessAsUserW
3	0x1068	CreateProcessW
4	0x1068	CreateRemoteThread
5	0x1068	CreateRemoteThreadEx
6	0x1068	CreateThread
7	0x1074	DeleteProcThreadAttributeList
8	0x1074	ExitProcess
9	0x1074	ExitThread
10	0x1074	FlushProcessWriteBuffers
11	0x1068	GetCurrentProcess
12	0x1068	GetCurrentProcessId
13	0x1068	GetCurrentThread
14	0x1068	GetCurrentThreadId
15	0x1068	GetExitCodeProcess
16	0x1068	GetExitCodeThread
17	0x1068	GetPriorityClass
18	0x1068	GetProcessId
19	0x1068	GetProcessIdOfThread
20	0x1068	GetProcessTimes
21	0x1068	GetProcessVersion
22	0x1074	GetStartupInfoW
23	0x1068	GetThreadId
24	0x1068	GetThreadPriority
25	0x1068	GetThreadPriorityBoost
26	0x1068	InitializeProcThreadAttributeList
27	0x1068	OpenProcessToken
28	0x1068	OpenThread
29	0x1068	OpenThreadToken
30	0x1068	ProcessIdToSessionId
31	0x1068	QueryProcessAffinityUpdateMode
32	0x1068	QueueUserAPC
33	0x1068	ResumeThread
34	0x1068	SetPriorityClass
35	0x1068	SetProcessAffinityUpdateMode
36	0x1068	SetProcessShutdownParameters
37	0x1068	SetThreadPriority
38	0x1068	SetThreadPriorityBoost
39	0x1068	SetThreadStackGuarantee
40	0x1068	SetThreadToken
41	0x1068	SuspendThread
42	0x1068	SwitchToThread
43	0x1068	TerminateProcess
44	0x1068	TerminateThread
45	0x1068	TlsAlloc
46	0x1068	TlsFree
47	0x1068	TlsGetValue
48	0x1068	TlsSetValue
49	0x1068	UpdateProcThreadAttribute

module_name	API-MS-Win-Core-ProcessThreads-L1-1-0.dll
flags	0
timestamp	2011-05-14 01:43:37
version	0.0
ordinal_base	1
nFunctions	49
nNames	49
Names(49)	0x117c
Functions(49)	0x10b8
NameOrdinals(49)	0x1240

StringTable 040904B0

CompanyName	Microsoft Corporation
FileDescription	ApiSet Stub DLL
FileVersion	6.1.7601.17617 (win7sp1_gdr.110513-1659)
InternalName	apisetstub
LegalCopyright	© Microsoft Corporation. All rights reserved.
OriginalFilename	apisetstub
ProductName	Microsoft® Windows® Operating System
ProductVersion	6.1.7601.17617

VS_FIXEDFILEINFO

FileVersion	6.1.7601.17617
ProductVersion	6.1.7601.17617
StrucVersion	0x10000
FileFlagsMask	0x3f
FileFlags	0
FileOS	0x40004
FileType	2
FileSubtype	0

show previews

offset	size	type	comment
15c1	15	HTM		#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

everything is OK

api-ms-win-core-processthreads-l1-1-0.dll-

MZ Header

Rich Header

DOS stub

PE Header

Sections

Data Directory

StringTable 040904B0

VS_FIXEDFILEINFO

api-ms-win-core-processthreads-l1-1-0.dll
-