filenameprofapi.dll
size31744 (0x7c00)
md5c733d233b623b7ffce5031e4b756ee26
typePE32 executable (DLL) (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xe0

Rich Header

lib idversiontimes used
149307291
1092
1473072935
146307291
132307297
1313072913
148307291
145307291

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections4
TimeDateStamp0x4a5bbf41
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x2102
Magic0x10b
LinkerVersion9.0
SizeOfCode0x6800
SizeOfInitializedData0xe00
SizeOfUninitializedData0
AddressOfEntryPoint0x1992
BaseOfCode0x1000
BaseOfData0x8000
ImageBase0x10000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.1
ImageVersion6.1
SubsystemVersion6.1
Reserved10
SizeOfImage0xb000
SizeOfHeaders0x600
CheckSum0x126fb
Subsystem2
DllCharacteristics0x140
SizeOfStackReserve0x40000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v7.0 DLL

Sections

namevavsizeraw sizeflags
.text0x10000x676c0x6800R-X CODE
.data0x80000x3f80x400RW- IDATA
.rsrc0x90000x3f80x400R-- IDATA
.reloc0xa0000x4400x600R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT0x11900x4c
IMPORT0x6bb00x168
RESOURCE0x90000x3f8
EXCEPTION00
SECURITY00
BASERELOC0xa0000x440
DEBUG0x770c0x38
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x4f080x40
Bound_IAT0x2780x2cc
IAT0x10000x190
Delay_IAT0x69a40xa0
CLR_Header00
typenamesizecp
VERSION#19160
module_namehintordfunction_name
msvcrt.dll1380wcsstr
msvcrt.dll974_vsnwprintf
msvcrt.dll345_except_handler4_common
msvcrt.dll1262memset
msvcrt.dll106_XcptFilter
msvcrt.dll1246malloc
msvcrt.dll1190free
msvcrt.dll469_initterm
msvcrt.dll257_amsg_exit
ntdll.dll65EtwGetTraceEnableFlags
ntdll.dll66EtwGetTraceEnableLevel
ntdll.dll67EtwGetTraceLoggerHandle
ntdll.dll74EtwRegisterTraceGuidsW
ntdll.dll81EtwUnregisterTraceGuids
ntdll.dll79EtwTraceMessage
ntdll.dll1043RtlNtStatusToDosError
ntdll.dll800RtlExpandEnvironmentStrings
ntdll.dll1069RtlQueryEnvironmentVariable
ntdll.dll607RtlAdjustPrivilege
ntdll.dll687RtlCreateEnvironment
ntdll.dll1149RtlSetEnvironmentVar
ntdll.dll744RtlDestroyEnvironment
KERNELBASE.dll39BemFreeContract
KERNELBASE.dll37BemCreateContractFrom
API-MS-Win-Core-ErrorHandling-L1-1-0.dll6UnhandledExceptionFilter
API-MS-Win-Core-ErrorHandling-L1-1-0.dll5SetUnhandledExceptionFilter
API-MS-Win-Core-ErrorHandling-L1-1-0.dll1GetLastError
API-MS-Win-Core-File-L1-1-0.dll2CreateDirectoryW
API-MS-Win-Core-File-L1-1-0.dll49GetShortPathNameW
API-MS-Win-Core-File-L1-1-0.dll73WriteFile
API-MS-Win-Core-File-L1-1-0.dll35GetFileAttributesW
API-MS-Win-Core-File-L1-1-0.dll18FindFirstFileW
API-MS-Win-Core-File-L1-1-0.dll58ReadFile
API-MS-Win-Core-File-L1-1-0.dll22FindNextFileW
API-MS-Win-Core-File-L1-1-0.dll11FindClose
API-MS-Win-Core-File-L1-1-0.dll65SetFileAttributesW
API-MS-Win-Core-File-L1-1-0.dll4CreateFileW
API-MS-Win-Core-Handle-L1-1-0.dllCloseHandle
API-MS-Win-Core-Heap-L1-1-0.dll2HeapAlloc
API-MS-Win-Core-Heap-L1-1-0.dll9HeapReAlloc
API-MS-Win-Core-Heap-L1-1-0.dll6HeapFree
API-MS-Win-Core-Heap-L1-1-0.dllGetProcessHeap
API-MS-Win-Core-Interlocked-L1-1-0.dll4InterlockedExchange
API-MS-Win-Core-Interlocked-L1-1-0.dll1InterlockedCompareExchange
API-MS-Win-Core-LibraryLoader-L1-1-0.dllDisableThreadLibraryCalls
API-MS-Win-Core-LibraryLoader-L1-1-0.dll3FreeLibrary
API-MS-Win-Core-LibraryLoader-L1-1-0.dll13LoadLibraryExA
API-MS-Win-Core-LibraryLoader-L1-1-0.dll12GetProcAddress
API-MS-Win-Core-LocalRegistry-L1-1-0.dll25RegOpenKeyExW
API-MS-Win-Core-LocalRegistry-L1-1-0.dll28RegQueryInfoKeyW
API-MS-Win-Core-LocalRegistry-L1-1-0.dll30RegQueryValueExW
API-MS-Win-Core-LocalRegistry-L1-1-0.dll11RegEnumKeyExW
API-MS-Win-Core-LocalRegistry-L1-1-0.dll35RegSetKeySecurity
API-MS-Win-Core-LocalRegistry-L1-1-0.dll37RegSetValueExW
API-MS-Win-Core-LocalRegistry-L1-1-0.dll13RegEnumValueW
API-MS-Win-Core-LocalRegistry-L1-1-0.dll2RegCreateKeyExW
API-MS-Win-Core-LocalRegistry-L1-1-0.dll19RegLoadKeyW
API-MS-Win-Core-LocalRegistry-L1-1-0.dllRegCloseKey
API-MS-Win-Core-Misc-L1-1-0.dll19Sleep
API-MS-Win-Core-Misc-L1-1-0.dll33lstrlenW
API-MS-Win-Core-Misc-L1-1-0.dll11LocalFree
API-MS-Win-Core-ProcessThreads-L1-1-0.dll26OpenProcessToken
API-MS-Win-Core-ProcessThreads-L1-1-0.dll42TerminateProcess
API-MS-Win-Core-ProcessThreads-L1-1-0.dll11GetCurrentProcessId
API-MS-Win-Core-ProcessThreads-L1-1-0.dll13GetCurrentThreadId
API-MS-Win-Core-ProcessThreads-L1-1-0.dll39SetThreadToken
API-MS-Win-Core-ProcessThreads-L1-1-0.dll12GetCurrentThread
API-MS-Win-Core-ProcessThreads-L1-1-0.dll28OpenThreadToken
API-MS-Win-Core-ProcessThreads-L1-1-0.dll10GetCurrentProcess
API-MS-Win-Core-Profile-L1-1-0.dllQueryPerformanceCounter
API-MS-Win-Core-String-L1-1-0.dll1CompareStringOrdinal
API-MS-Win-Core-SysInfo-L1-1-0.dll1GetComputerNameExW
API-MS-Win-Core-SysInfo-L1-1-0.dll11GetSystemTimeAsFileTime
API-MS-Win-Core-SysInfo-L1-1-0.dll14GetTickCount
API-MS-Win-Security-Base-L1-1-0.dll71IsWellKnownSid
API-MS-Win-Security-Base-L1-1-0.dll62ImpersonateSelf
API-MS-Win-Security-Base-L1-1-0.dll26CopySid
API-MS-Win-Security-Base-L1-1-0.dll58GetTokenInformation
API-MS-Win-Security-Base-L1-1-0.dll61ImpersonateLoggedOnUser
API-MS-Win-Security-Base-L1-1-0.dll80PrivilegeCheck
API-MS-Win-Security-Base-L1-1-0.dll83RevertToSelf
API-MS-Win-Security-Base-L1-1-0.dll45GetLengthSid
API-MS-Win-Core-DelayLoad-L1-1-0.dllDelayLoadFailureHook
ordentry_vafunction_name
1010x2223
1020x1769
1030x30c4
1040x147a
1050x3a97
1060x41e2
module_nameprofapi.dll
flags0
timestamp2009-07-13 23:12:01
version0.0
ordinal_base101
nFunctions6
nNames0
Names(0)0
Functions(6)0x11b8
NameOrdinals(0)0

StringTable 040904B0

CompanyNameMicrosoft Corporation
FileDescriptionUser Profile Basic API
FileVersion6.1.7600.16385 (win7_rtm.090713-1255)
InternalNamePROFAPI.DLL
LegalCopyright© Microsoft Corporation. All rights reserved.
OriginalFilenamePROFAPI.DLL
ProductNameMicrosoft® Windows® Operating System
ProductVersion6.1.7600.16385

VS_FIXEDFILEINFO

FileVersion6.1.7600.16385
ProductVersion6.1.7600.16385
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType2
FileSubtype0
offsetsizetypecomment
031744DLL07/13/2009 23:12:01#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] can't find file_offset of VA 0x278
[?] can't find file_offset of VA 0x0