| filename | user32.dll | |
|---|---|---|
| size | 616448 (0x96800) | |
| md5 | b188f9f05344144fb8b833e7f5571dcb | |
| type | PE32 executable (DLL) (GUI) Intel 80386, for MS Windows | |
| mimetype | application/x-dosexec | |
| clamav | OK | |
| virustotal | → scan with virustotal.com | |
| histogram | ||
MZ Header
| signature | MZ |
| bytes_in_last_block | 0x90 |
| blocks_in_file | 3 |
| num_relocs | 0 |
| header_paragraphs | 4 |
| min_extra_paragraphs | 0 |
| max_extra_paragraphs | 0xffff |
| ss | 0 |
| sp | 0xb8 |
| checksum | 0 |
| ip | 0 |
| cs | 0 |
| reloc_table_offset | 0x40 |
| overlay_number | 0 |
| reserved0 | 0 |
| oem_id | 0 |
| oem_info | 0 |
| reserved2 | 0 |
| reserved3 | 0 |
| reserved4 | 0 |
| reserved5 | 0 |
| reserved6 | 0 |
| lfanew | 0xd8 |
DOS stub
00000000: 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 |........!..L.!Th| 00000010: 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f |is program canno| 00000020: 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 |t be run in DOS | 00000030: 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 |mode....$.......|
PE Header
Packer / Compiler
Sections
| name | va | vsize | raw size | flags | |
|---|---|---|---|---|---|
| .text | 0x1000 | 0x5f283 | 0x5f400 | R-X CODE | |
| .data | 0x61000 | 0x1180 | 0xc00 | RW- IDATA | |
| .rsrc | 0x63000 | 0x33488 | 0x33600 | R-- IDATA | |
| .reloc | 0x97000 | 0x2de4 | 0x2e00 | R-- IDATA DISCARDABLE |
Data Directory
| id | lang | string |
|---|---|---|
| 2 | 1033 | Error |
| 13 | 1033 | &More Windows... |
| 14 | 1033 | Insufficient memory to create the bitmap. Close one or more applications to increase available memory. |
| 700 | 1033 | &Open IME |
| 701 | 1033 | C&lose IME |
| 702 | 1033 | Op&en Soft Keyboard |
| 703 | 1033 | Close So&ft Keyboard |
| 705 | 1033 | &Reconversion |
| 706 | 1033 | shutdown |
| 707 | 1033 | power off |
| 708 | 1033 | reboot |
| 709 | 1033 | unknown |
| 710 | 1033 | Windows |
| 711 | 1033 | If you shut down this remote computer, no one can use it until someone at the remote location manually restarts it. Do you want to continue shutting down? |
| 712 | 1033 | Other people are logged on to this remote computer. Shutting down Windows might cause them to lose data. Also, someone at the remote location will have to restart the computer manually. Do you want to continue shutting down? |
| 713 | 1033 | Other people are logged on to this computer. Shutting down Windows might cause them to lose data. Do you want to continue shutting down? |
| 714 | 1033 | Other people are logged on to this computer. Restarting Windows might cause them to lose data. Do you want to continue restarting? |
| 800 | 1033 | OK |
| 801 | 1033 | Cancel |
| 802 | 1033 | &Abort |
| 803 | 1033 | &Retry |
| 804 | 1033 | &Ignore |
| 805 | 1033 | &Yes |
| 806 | 1033 | &No |
| 807 | 1033 | &Close |
| 808 | 1033 | Help |
| 809 | 1033 | &Try Again |
| 810 | 1033 | &Continue |
| 900 | 1033 | Minimize |
| 901 | 1033 | Maximize |
| 902 | 1033 | Restore Up |
| 903 | 1033 | Restore Down |
| 904 | 1033 | Help |
| 905 | 1033 | Close |
| 8250 | 1033 | Hardware: Maintenance (Unplanned) |
| 8251 | 1033 | Hardware: Maintenance (Planned) |
| 8252 | 1033 | Hardware: Installation (Unplanned) |
| 8253 | 1033 | Hardware: Installation (Planned) |
| 8254 | 1033 | Operating System: Upgrade (Unplanned) |
| 8255 | 1033 | Operating System: Upgrade (Planned) |
| 8256 | 1033 | Operating System: Reconfiguration (Unplanned) |
| 8257 | 1033 | Operating System: Reconfiguration (Planned) |
| 8258 | 1033 | Application: Unresponsive |
| 8259 | 1033 | Application: Unstable |
| 8260 | 1033 | Application: Maintenance (Unplanned) |
| 8261 | 1033 | Other (Unplanned) |
| 8262 | 1033 | Other (Planned) |
| 8263 | 1033 | System Failure: Stop error |
| 8264 | 1033 | Power Failure: Cord Unplugged |
| 8265 | 1033 | Power Failure: Environment |
| 8266 | 1033 | Other Failure: System Unresponsive |
| 8267 | 1033 | Unknown |
| 8268 | 1033 | Application: Maintenance (Planned) |
| 8269 | 1033 | No title for this reason could be found |
| 8275 | 1033 | A restart or shutdown to service hardware on the system. |
| 8276 | 1033 | A restart or shutdown to begin or complete hardware installation. |
| 8277 | 1033 | A restart or shutdown to upgrade the operating system. |
| 8278 | 1033 | A restart or shutdown to change the operating system configuration. |
| 8279 | 1033 | A restart or shutdown to troubleshoot an unresponsive application. |
| 8280 | 1033 | A restart or shutdown to troubleshoot an unstable application. |
| 8281 | 1033 | A restart or shutdown to service an application. |
| 8282 | 1033 | A shutdown or restart for an unknown reason |
| 8283 | 1033 | The computer displayed a blue screen crash event. |
| 8284 | 1033 | The computer was unplugged. |
| 8285 | 1033 | There was a power outage. |
| 8286 | 1033 | The system became unresponsive. |
| 8287 | 1033 | A restart or shutdown to perform planned maintenance on an application. |
StringTable 040904B0
| CompanyName | Microsoft Corporation |
| FileDescription | Windows XP USER API Client DLL |
| FileVersion | 5.1.2600.5512 (xpsp.080413-2105) |
| InternalName | user32 |
| LegalCopyright | © Microsoft Corporation. All rights reserved. |
| OriginalFilename | user32 |
| ProductName | Microsoft® Windows® Operating System |
| ProductVersion | 5.1.2600.5512 |
VS_FIXEDFILEINFO
| FileVersion | 5.1.2600.5512 |
| ProductVersion | 5.1.2600.5512 |
| StrucVersion | 0x10000 |
| FileFlagsMask | 0x3f |
| FileFlags | 0 |
| FileOS | 0x40004 |
| FileType | 2 |
| FileSubtype | 0 |
 |
| Please donate some bucks to keep this site up and running: | |
| Ko-fi | |
|---|---|
| Yandex.Money | |
| Thank you! | |
[?] can't find file_offset of VA 0x270