dsetup.dll

info
MZ
PE
imports
exports
foremost
hexdump
disasm
log
discuss
donate

filename	dsetup.dll
size	677376 (0xa5600)
md5	c62a978b9ce4377c75918cfc7e448d8b

type	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x50
blocks_in_file	2
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0xf
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0x1a
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x100

DOS stub

00000000: ba 10 00 0e 1f b4 09 cd  21 b8 01 4c cd 21 90 90  |........!..L.!..|
00000010: 54 68 69 73 20 70 72 6f  67 72 61 6d 20 6d 75 73  |This program mus|
00000020: 74 20 62 65 20 72 75 6e  20 75 6e 64 65 72 20 57  |t be run under W|
00000030: 69 6e 33 32 0d 0a 24 37  00 00 00 00 00 00 00 00  |in32..$7........|
00000040: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
000000c0:

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	9
TimeDateStamp	0x508ee4ca
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0xa38e
Magic	0x10b
LinkerVersion	2.25
SizeOfCode	0x5a00
SizeOfInitializedData	0x1c00
SizeOfUninitializedData	0
AddressOfEntryPoint	0xb08de
BaseOfCode	0x1000
BaseOfData	0x8000
ImageBase	0x15080000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	5.0
ImageVersion	0.0
SubsystemVersion	5.0
Reserved1	0
SizeOfImage	0x154000
SizeOfHeaders	0x400
CheckSum	0
Subsystem	2
DllCharacteristics	0
SizeOfStackReserve	0
SizeOfStackCommit	0
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

UPX?

This file is packed with UPX. Analysis will be incomplete without unpacking.
We can unpack it for you.

»» Analyze unpacked file

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x5464	0	R-X CODE
.itext	0x7000	0x358	0	R-X CODE
.data	0x8000	0x7c4	0	RW- IDATA
.bss	0x9000	0x2840	0	RW-
.idata	0xc000	0x6ba	0	RW- IDATA
.edata	0xd000	0x279	0	R-- IDATA
.UPX0	0xe000	0x9f09e	0	RWX CODE IDATA
.UPX1	0xae000	0xa4e7f	0xa5000	RWX CODE IDATA DISCARDABLE
.reloc	0x153000	0xb0	0x200	R-- IDATA DISCARDABLE

Data Directory

type	va	size
EXPORT	0x14e8c0	0x279
IMPORT	0x146ed4	0x78
RESOURCE	0	0
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0x153000	0xb0
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0x144cf0	0x3c
Delay_IAT	0	0
CLR_Header	0	0

module_name	hint	ord	function_name
user32.dll			CharUpperBuffW
kernel32.dll			HeapCreate
ws2_32.dll			WSAGetLastError
kernel32.dll			GetModuleFileNameW
kernel32.dll			GetModuleHandleA
kernel32.dll			LoadLibraryA
kernel32.dll			LocalAlloc
kernel32.dll			LocalFree
kernel32.dll			GetModuleFileNameA
kernel32.dll			ExitProcess

ord	entry_va	function_name
1	0x63a8	DirectXSetupGetEULAW
2	0x63a8	DirectXSetupGetEULAA
3	0x63a8	DirectXSetupShowEULA
4	0x63a8	DirectXSetupIsEng
5	0x63a8	DirectXLoadString
6	0x63a8	DirectXSetupGetFileVersion
7	0x63a8	DirectXSetupCallback
8	0x6380	DirectXSetupGetVersion
9	0x63a8	DirectXSetupSetCallback
10	0x63a8	DirectXUnRegisterApplication
11	0x63a8	DirectXSetupW
12	0x63a8	DirectXSetupIsJapanNec
13	0x63a8	DirectXSetupIsJapan
14	0x63a8	DirectXSetupA
15	0x63a8	DirectXRegisterApplicationW
16	0x63a8	DirectXRegisterApplicationA
17	0x63a8	DirectXDeviceDriverSetupW
18	0x63a8	DirectXDeviceDriverSetupA

module_name	dsetup.dll
flags	0
timestamp	0
version	0.0
ordinal_base	1
nFunctions	18
nNames	18
Names(18)	0x14e954
Functions(18)	0x14e8e8
NameOrdinals(18)	0x14e930

show previews

offset	size	type	comment
0	677376	DLL	10/29/2012 20:19:22	#
15c1	15	HTM		#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

everything is OK