filenameOSVolOSVol--Windows--SysWOW64--userenv.dll.fullextract
size81920 (0x14000)
md5d15618a0ff8dbc2c5bf3726bacc75a0b
typePE32 executable (DLL) (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xf0

Rich Header

lib idversiontimes used
149307293
10208
1473072943
146307291
1323072915
1313072921
148307291
145307291

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections5
TimeDateStamp0x4ce7ba28
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x2102
Magic0x10b
LinkerVersion9.0
SizeOfCode0x10e00
SizeOfInitializedData0x2c00
SizeOfUninitializedData0
AddressOfEntryPoint0x1c9d
BaseOfCode0x1000
BaseOfData0x13000
ImageBase0x406a0000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.1
ImageVersion6.1
SubsystemVersion6.1
Reserved10
SizeOfImage0x17000
SizeOfHeaders0x600
CheckSum0x1bf8b
Subsystem2
DllCharacteristics0x1c0
SizeOfStackReserve0x40000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v7.0 DLL

Sections

namevavsizeraw sizeflags
.text0x10000x10a1c0x10c00R-X CODE
.orpc0x120000x330x200R-X CODE
.data0x130000x5840x600RW- IDATA
.rsrc0x140000x15d80x1600R-- IDATA
.reloc0x160000xf9c0x1000R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT0x12c00x73c
IMPORT0x106dc0x1b8
RESOURCE0x140000x15d8
EXCEPTION00
SECURITY00
BASERELOC0x160000xf9c
DEBUG0x119bc0x38
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0xa0380x40
Bound_IAT0x2b00x334
IAT0x10000x2c0
Delay_IAT0xfe600x1a0
CLR_Header00
typenamesizecp
JPEG#123150
MUI#12480
WEVT_TEMPLATE#117780
VERSION#18840
module_namehintordfunction_name
msvcrt.dll1260memmove
msvcrt.dll106_XcptFilter
msvcrt.dll469_initterm
msvcrt.dll257_amsg_exit
msvcrt.dll345_except_handler4_common
msvcrt.dll974_vsnwprintf
msvcrt.dll20void __cdecl operator delete(void *)

??3@YAXPAX@Z

msvcrt.dll18void * __cdecl operator new(unsigned int)

??2@YAPAXI@Z

msvcrt.dll1258memcpy
msvcrt.dll1246malloc
msvcrt.dll1190free
msvcrt.dll1262memset
ntdll.dll1044RtlNtStatusToDosError
ntdll.dll607RtlAdjustPrivilege
ntdll.dll57EtwEventWrite
ntdll.dll81EtwUnregisterTraceGuids
ntdll.dll801RtlExpandEnvironmentStrings
ntdll.dll212NtClose
ntdll.dll982RtlIsDosDeviceName_U
ntdll.dll614RtlAnsiCharToUnicodeChar
ntdll.dll951RtlIntegerToChar
ntdll.dll925RtlInitUnicodeStringEx
ntdll.dll55EtwEventRegister
ntdll.dll68EtwLogTraceEvent
ntdll.dll56EtwEventUnregister
ntdll.dll79EtwTraceMessage
ntdll.dll65EtwGetTraceEnableFlags
ntdll.dll66EtwGetTraceEnableLevel
ntdll.dll74EtwRegisterTraceGuidsW
ntdll.dll67EtwGetTraceLoggerHandle
KERNELBASE.dll40BemFreeReference
KERNELBASE.dll38BemCreateReference
KERNELBASE.dll305GetSystemDefaultUILanguage
API-MS-Win-Core-ErrorHandling-L1-1-0.dll1GetLastError
API-MS-Win-Core-ErrorHandling-L1-1-0.dll6UnhandledExceptionFilter
API-MS-Win-Core-ErrorHandling-L1-1-0.dll5SetUnhandledExceptionFilter
API-MS-Win-Core-ErrorHandling-L1-1-0.dll4SetLastError
API-MS-Win-Core-File-L1-1-0.dll35GetFileAttributesW
API-MS-Win-Core-File-L1-1-0.dll4CreateFileW
API-MS-Win-Core-File-L1-1-0.dllCompareFileTime
API-MS-Win-Core-File-L1-1-0.dll2CreateDirectoryW
API-MS-Win-Core-File-L1-1-0.dll62RemoveDirectoryW
API-MS-Win-Core-File-L1-1-0.dll34GetFileAttributesExW
API-MS-Win-Core-File-L1-1-0.dll7DeleteFileW
API-MS-Win-Core-File-L1-1-0.dll22FindNextFileW
API-MS-Win-Core-File-L1-1-0.dll65SetFileAttributesW
API-MS-Win-Core-File-L1-1-0.dll11FindClose
API-MS-Win-Core-File-L1-1-0.dll69SetFileTime
API-MS-Win-Core-File-L1-1-0.dll28GetDiskFreeSpaceExW
API-MS-Win-Core-File-L1-1-0.dll25FlushFileBuffers
API-MS-Win-Core-File-L1-1-0.dll18FindFirstFileW
API-MS-Win-Core-Handle-L1-1-0.dllCloseHandle
API-MS-Win-Core-Heap-L1-1-0.dll2HeapAlloc
API-MS-Win-Core-Heap-L1-1-0.dllGetProcessHeap
API-MS-Win-Core-Heap-L1-1-0.dll9HeapReAlloc
API-MS-Win-Core-Heap-L1-1-0.dll6HeapFree
API-MS-Win-Core-Interlocked-L1-1-0.dll7InterlockedIncrement
API-MS-Win-Core-Interlocked-L1-1-0.dll1InterlockedCompareExchange
API-MS-Win-Core-Interlocked-L1-1-0.dll4InterlockedExchange
API-MS-Win-Core-IO-L1-1-0.dll2DeviceIoControl
API-MS-Win-Core-LibraryLoader-L1-1-0.dllDisableThreadLibraryCalls
API-MS-Win-Core-LibraryLoader-L1-1-0.dll18LockResource
API-MS-Win-Core-LibraryLoader-L1-1-0.dll1FindResourceExW
API-MS-Win-Core-LibraryLoader-L1-1-0.dll7GetModuleFileNameW
API-MS-Win-Core-LibraryLoader-L1-1-0.dll12GetProcAddress
API-MS-Win-Core-LibraryLoader-L1-1-0.dll3FreeLibrary
API-MS-Win-Core-LibraryLoader-L1-1-0.dll13LoadLibraryExA
API-MS-Win-Core-LibraryLoader-L1-1-0.dll17LoadStringW
API-MS-Win-Core-LibraryLoader-L1-1-0.dll15LoadResource
API-MS-Win-Core-LocalRegistry-L1-1-0.dll25RegOpenKeyExW
API-MS-Win-Core-LocalRegistry-L1-1-0.dllRegCloseKey
API-MS-Win-Core-LocalRegistry-L1-1-0.dll30RegQueryValueExW
API-MS-Win-Core-LocalRegistry-L1-1-0.dll17RegGetValueW
API-MS-Win-Core-Misc-L1-1-0.dll10LocalAlloc
API-MS-Win-Core-Misc-L1-1-0.dll13LocalReAlloc
API-MS-Win-Core-Misc-L1-1-0.dll19Sleep
API-MS-Win-Core-Misc-L1-1-0.dll33lstrlenW
API-MS-Win-Core-Misc-L1-1-0.dll4FormatMessageW
API-MS-Win-Core-Misc-L1-1-0.dll11LocalFree
API-MS-Win-Core-ProcessThreads-L1-1-0.dll12GetCurrentThread
API-MS-Win-Core-ProcessThreads-L1-1-0.dll42TerminateProcess
API-MS-Win-Core-ProcessThreads-L1-1-0.dll11GetCurrentProcessId
API-MS-Win-Core-ProcessThreads-L1-1-0.dll13GetCurrentThreadId
API-MS-Win-Core-ProcessThreads-L1-1-0.dll10GetCurrentProcess
API-MS-Win-Core-ProcessThreads-L1-1-0.dll26OpenProcessToken
API-MS-Win-Core-ProcessThreads-L1-1-0.dll5CreateThread
API-MS-Win-Core-ProcessThreads-L1-1-0.dll39SetThreadToken
API-MS-Win-Core-ProcessThreads-L1-1-0.dll28OpenThreadToken
API-MS-Win-Core-Profile-L1-1-0.dllQueryPerformanceCounter
API-MS-Win-Core-String-L1-1-0.dll1CompareStringOrdinal
API-MS-Win-Core-String-L1-1-0.dll7WideCharToMultiByte
API-MS-Win-Core-String-L1-1-0.dll6MultiByteToWideChar
API-MS-Win-Core-Synch-L1-1-0.dll32SetEvent
API-MS-Win-Core-Synch-L1-1-0.dll13DeleteCriticalSection
API-MS-Win-Core-Synch-L1-1-0.dll40WaitForSingleObject
API-MS-Win-Core-Synch-L1-1-0.dll6CreateEventW
API-MS-Win-Core-Synch-L1-1-0.dll14EnterCriticalSection
API-MS-Win-Core-Synch-L1-1-0.dll16InitializeCriticalSectionAndSpinCount
API-MS-Win-Core-Synch-L1-1-0.dll19LeaveCriticalSection
API-MS-Win-Core-SysInfo-L1-1-0.dll14GetTickCount
API-MS-Win-Core-SysInfo-L1-1-0.dll11GetSystemTimeAsFileTime
API-MS-Win-Security-Base-L1-1-0.dll7AddAccessAllowedAce
API-MS-Win-Security-Base-L1-1-0.dll80PrivilegeCheck
API-MS-Win-Security-Base-L1-1-0.dll38EqualSid
API-MS-Win-Security-Base-L1-1-0.dll51GetSecurityDescriptorOwner
API-MS-Win-Security-Base-L1-1-0.dll43GetFileSecurityW
API-MS-Win-Security-Base-L1-1-0.dll62ImpersonateSelf
API-MS-Win-Security-Base-L1-1-0.dll20AllocateAndInitializeSid
API-MS-Win-Security-Base-L1-1-0.dll45GetLengthSid
API-MS-Win-Security-Base-L1-1-0.dll63InitializeAcl
API-MS-Win-Security-Base-L1-1-0.dll10AddAccessDeniedAce
API-MS-Win-Security-Base-L1-1-0.dll40FreeSid
API-MS-Win-Security-Base-L1-1-0.dll26CopySid
API-MS-Win-Security-Base-L1-1-0.dll58GetTokenInformation
API-MS-Win-Security-Base-L1-1-0.dll83RevertToSelf
API-MS-Win-Security-Base-L1-1-0.dll61ImpersonateLoggedOnUser
RPCRT4.dll256NdrOleAllocate
RPCRT4.dll257NdrOleFree
RPCRT4.dll16IUnknown_QueryInterface_Proxy
RPCRT4.dll15IUnknown_AddRef_Proxy
RPCRT4.dll17IUnknown_Release_Proxy
RPCRT4.dll8CStdStubBuffer_QueryInterface
RPCRT4.dllCStdStubBuffer_AddRef
RPCRT4.dll1CStdStubBuffer_Connect
RPCRT4.dll5CStdStubBuffer_Disconnect
RPCRT4.dll6CStdStubBuffer_Invoke
RPCRT4.dll7CStdStubBuffer_IsIIDSupported
RPCRT4.dll2CStdStubBuffer_CountRefs
RPCRT4.dll3CStdStubBuffer_DebugServerQueryInterface
RPCRT4.dll4CStdStubBuffer_DebugServerRelease
RPCRT4.dll201NdrDllUnregisterProxy
RPCRT4.dll200NdrDllRegisterProxy
RPCRT4.dll146NdrCStdStubBuffer_Release
RPCRT4.dll198NdrDllCanUnloadNow
RPCRT4.dll199NdrDllGetClassObject
RPCRT4.dll149NdrClientCall2
RPCRT4.dll45I_RpcExceptionFilter
RPCRT4.dll366RpcBindingSetAuthInfoExW
RPCRT4.dll349RpcBindingFree
RPCRT4.dll494RpcStringBindingComposeW
RPCRT4.dll351RpcBindingFromStringBindingW
RPCRT4.dll498RpcStringFreeW
RPCRT4.dll432RpcRevertToSelf
profapi.dll103
profapi.dll102
profapi.dll101
profapi.dll104
profapi.dll105
KERNEL32.dll862MoveFileExW
KERNEL32.dll205DelayLoadFailureHook
KERNEL32.dll333FindResourceW
KERNEL32.dll1049SearchPathW
KERNEL32.dll1267WaitForMultipleObjects
KERNEL32.dll178CreateSymbolicLinkW
KERNEL32.dll911PrivCopyFileExW
ordentry_vafunction_name
1040xd720
1050xa2b7RsopLoggingEnabled
1060x1a7aCreateEnvironmentBlock
1070xcde1CreateProfile
1080xe18dDeleteProfileA
1090xc7d3DeleteProfileW
1100x1a4eDestroyEnvironmentBlock
1110x1a36DllCanUnloadNow
1120x2d13DllGetClassObject
1130xa089DllGetContractDescription
1140xa1f3DllRegisterServer
1150xa1fdDllUnregisterServer
1160x270cEnterCriticalPolicySection
1170xe53dExpandEnvironmentStringsForUserA
1180x1a01ExpandEnvironmentStringsForUserW
1190xa2e5ForceSyncFgPolicy
1200xa207FreeGPOListA
1210xa247FreeGPOListW
1220x6ac1
1230xe459GetAllUsersProfileDirectoryA
1240x2772GetAllUsersProfileDirectoryW
1250xa217GetAppliedGPOListA
1260xa257GetAppliedGPOListW
1270xe375GetDefaultUserProfileDirectoryA
1280xe274GetDefaultUserProfileDirectoryW
1290xa227GetGPOListA
1300x3284GetGPOListW
1310x2724GetNextFgPolicyRefreshInfo
1320xa2d5GetPreviousFgPolicyRefreshInfo
1330x2a1fGetProfileType
1340xe291GetProfilesDirectoryA
1350xeed9
1360xe257GetProfilesDirectoryW
1370xd4d3
1380x69d1GetUserProfileDirectoryA
1390xda23
1400x25b2GetUserProfileDirectoryW
1410x26f4LeaveCriticalPolicySection
1420xe071LoadUserProfileA
1430x1aacLoadUserProfileW
1440xa267ProcessGroupPolicyCompleted
1450x275aProcessGroupPolicyCompletedEx
1460x326cRefreshPolicy
1470xa237RefreshPolicyEx
1480x26a5RegisterGPNotification
1490xa277RsopAccessCheckByType
1500xa287RsopFileAccessCheck
1510xa2a7RsopResetPolicySettingStatus
1520xa297RsopSetPolicySettingStatus
1530x3e6fUnloadUserProfile
1540x26d5UnregisterGPNotification
1550xa2c1WaitForMachinePolicyForegroundProcessing
1560xa2cbWaitForUserPolicyForegroundProcessing
1750x3049
2020xc4cd
2030xb21d
2060xa679
2070x5a6b
2080xcb19
2090x465c
module_nameUSERENV.dll
flags0
timestamp2010-11-20 09:26:06
version0.0
ordinal_base104
nFunctions106
nNames48
Names(48)0x1490
Functions(106)0x12e8
NameOrdinals(48)0x1550

StringTable 040904B0

CompanyNameMicrosoft Corporation
FileDescriptionUserenv
FileVersion6.1.7601.17514 (win7sp1_rtm.101119-1850)
InternalNameuserenv
LegalCopyright© Microsoft Corporation. All rights reserved.
OriginalFilenameuserenv.dll
ProductNameMicrosoft® Windows® Operating System
ProductVersion6.1.7601.17514

VS_FIXEDFILEINFO

FileVersion6.1.7601.17514
ProductVersion6.1.7601.17514
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType1
FileSubtype0
offsetsizetypecomment
081920DLL11/20/2010 12:08:08#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] can't find file_offset of VA 0x2b0