filenamelark_crashpad.dll
size1529856 (0x175800)
md5d2b1eec218ea4791f7b1f887b7254808
typePE32 executable (DLL) (console) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavscan pending
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x78
blocks_in_file1
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0
ss0
sp0
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x78

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 24 00 00                           |mode.$..        |

PE Header

SignaturePE
Machine0x14c
NumberOfSections8
TimeDateStamp0x5c54bc76
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x2122
Magic0x10b
LinkerVersion14.0
SizeOfCode0x142600
SizeOfInitializedData0x32c00
SizeOfUninitializedData0
AddressOfEntryPoint0xc3840
BaseOfCode0x1000
BaseOfData0
ImageBase0x10000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion5.1
ImageVersion0.0
SubsystemVersion5.1
Reserved10
SizeOfImage0x18c000
SizeOfHeaders0x400
CheckSum0
Subsystem3
DllCharacteristics0x4140
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ 6.0 - 8.0

Sections

namevavsizeraw sizeflags
.text0x10000x14244f0x142600R-X CODE
.rdata0x1440000x234380x23600R-- IDATA
.data0x1680000x134f00x3c00RW- IDATA
.00cfg0x17c00040x200R-- IDATA
.tls0x17d0000x950x200RW- IDATA
.voltbl0x17e0000x1500x200---
CPADinfo0x17f0000x280x200RW- IDATA
.reloc0x1800000xb3440xb400R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT0x1629df0x10e
IMPORT0x162aed0xdc
RESOURCE00
EXCEPTION00
SECURITY00
BASERELOC0x1800000xb344
DEBUG0x160ecc0x38
ARCHITECTURE00
GLOBALPTR00
TLS0x160dd00x18
LOAD_CONFIG0x1441680xbc
Bound_IAT00
IAT0x16300c0x440
Delay_IAT0x16296c0x40
CLR_Header00

TLS

raw
start		raw
end		indexcallbkszero
fill		flags
0x1017d0000x1017d0940x1016bb380x1016293c00x400000
module_namehintordfunction_name
KERNEL32.dllAcquireSRWLockExclusive
KERNEL32.dll113CallbackMayRunLong
KERNEL32.dll137CloseHandle
KERNEL32.dll143CloseThreadpool
KERNEL32.dll149CloseThreadpoolWork
KERNEL32.dll158CompareStringW
KERNEL32.dll159ConnectNamedPipe
KERNEL32.dll189CreateDirectoryW
KERNEL32.dll194CreateEventW
KERNEL32.dll203CreateFileMappingW
KERNEL32.dll206CreateFileW
KERNEL32.dll211CreateIoCompletionPort
KERNEL32.dll223CreateNamedPipeW
KERNEL32.dll232CreateProcessW
KERNEL32.dll239CreateSemaphoreW
KERNEL32.dll246CreateThread
KERNEL32.dll247CreateThreadpool
KERNEL32.dll252CreateThreadpoolWork
KERNEL32.dll255CreateToolhelp32Snapshot
KERNEL32.dll268DecodePointer
KERNEL32.dll275DeleteCriticalSection
KERNEL32.dll280DeleteFileW
KERNEL32.dll293DisconnectNamedPipe
KERNEL32.dll302DuplicateHandle
KERNEL32.dll304EncodePointer
KERNEL32.dll308EnterCriticalSection
KERNEL32.dll343EnumSystemLocalesW
KERNEL32.dll353ExitProcess
KERNEL32.dll354ExitThread
KERNEL32.dll357ExpandEnvironmentStringsW
KERNEL32.dll365FileTimeToSystemTime
KERNEL32.dll376FindClose
KERNEL32.dll382FindFirstFileExW
KERNEL32.dll399FindNextFileW
KERNEL32.dll413FlsAlloc
KERNEL32.dll416FlsSetValue
KERNEL32.dll418FlushFileBuffers
KERNEL32.dll421FlushViewOfFile
KERNEL32.dll425FormatMessageA
KERNEL32.dll429FreeEnvironmentStringsW
KERNEL32.dll430FreeLibrary
KERNEL32.dll431FreeLibraryAndExitThread
KERNEL32.dll437GetACP
KERNEL32.dll452GetCPInfo
KERNEL32.dll473GetCommandLineA
KERNEL32.dll474GetCommandLineW
KERNEL32.dll511GetConsoleMode
KERNEL32.dll515GetConsoleOutputCP
KERNEL32.dll532GetCurrentDirectoryW
KERNEL32.dll538GetCurrentProcess
KERNEL32.dll539GetCurrentProcessId
KERNEL32.dll542GetCurrentThread
KERNEL32.dll543GetCurrentThreadId
KERNEL32.dll548GetDateFormatW
KERNEL32.dll562GetDriveTypeW
KERNEL32.dll570GetEnvironmentStringsW
KERNEL32.dll572GetEnvironmentVariableW
KERNEL32.dll584GetFileAttributesW
KERNEL32.dll586GetFileInformationByHandle
KERNEL32.dll587GetFileInformationByHandleEx
KERNEL32.dll591GetFileSizeEx
KERNEL32.dll592GetFileTime
KERNEL32.dll593GetFileType
KERNEL32.dll604GetFullPathNameW
KERNEL32.dll612GetLastError
KERNEL32.dll613GetLocalTime
KERNEL32.dll616GetLocaleInfoW
KERNEL32.dll631GetModuleFileNameW
KERNEL32.dll632GetModuleHandleA
KERNEL32.dll634GetModuleHandleExW
KERNEL32.dll635GetModuleHandleW
KERNEL32.dll648GetNativeSystemInfo
KERNEL32.dll666GetOEMCP
KERNEL32.dll689GetProcAddress
KERNEL32.dll695GetProcessHeap
KERNEL32.dll697GetProcessId
KERNEL32.dll705GetProcessTimes
KERNEL32.dll710GetProductInfo
KERNEL32.dll717GetQueuedCompletionStatus
KERNEL32.dll723GetStartupInfoW
KERNEL32.dll725GetStdHandle
KERNEL32.dll730GetStringTypeW
KERNEL32.dll734GetSystemDefaultLCID
KERNEL32.dll739GetSystemDirectoryW
KERNEL32.dll742GetSystemInfo
KERNEL32.dll748GetSystemTimeAsFileTime
KERNEL32.dll761GetTempPathW
KERNEL32.dll762GetThreadContext
KERNEL32.dll767GetThreadId
KERNEL32.dll770GetThreadLocale
KERNEL32.dll772GetThreadPriority
KERNEL32.dll778GetTickCount
KERNEL32.dll783GetTimeFormatW
KERNEL32.dll785GetTimeZoneInformation
KERNEL32.dll789GetUserDefaultLCID
KERNEL32.dll798GetVersionExW
KERNEL32.dll809GetWindowsDirectoryW
KERNEL32.dll829GlobalMemoryStatusEx
KERNEL32.dll848HeapSetInformation
KERNEL32.dll860InitOnceExecuteOnce
KERNEL32.dll862InitializeConditionVariable
KERNEL32.dll865InitializeCriticalSection
KERNEL32.dll866InitializeCriticalSectionAndSpinCount
KERNEL32.dll870InitializeSListHead
KERNEL32.dll879InterlockedFlushSList
KERNEL32.dll898IsDebuggerPresent
KERNEL32.dll905IsProcessorFeaturePresent
KERNEL32.dll911IsValidCodePage
KERNEL32.dll913IsValidLocale
KERNEL32.dll917IsWow64Process
KERNEL32.dll949LCMapStringW
KERNEL32.dll961LeaveCriticalSection
KERNEL32.dll966LoadLibraryExA
KERNEL32.dll967LoadLibraryExW
KERNEL32.dll968LoadLibraryW
KERNEL32.dll979LocalFree
KERNEL32.dll990LockFileEx
KERNEL32.dll994MapViewOfFile
KERNEL32.dll1007MoveFileW
KERNEL32.dll1011MultiByteToWideChar
KERNEL32.dll1039OpenProcess
KERNEL32.dll1046OpenThread
KERNEL32.dll1050OutputDebugStringA
KERNEL32.dll1060PeekNamedPipe
KERNEL32.dll1061PostQueuedCompletionStatus
KERNEL32.dll1103QueryPerformanceCounter
KERNEL32.dll1104QueryPerformanceFrequency
KERNEL32.dll1108QueryThreadCycleTime
KERNEL32.dll1124RaiseException
KERNEL32.dll1138ReadConsoleW
KERNEL32.dll1141ReadFile
KERNEL32.dll1144ReadProcessMemory
KERNEL32.dll1195RegisterWaitForSingleObject
KERNEL32.dll1204ReleaseSRWLockExclusive
KERNEL32.dll1206ReleaseSemaphore
KERNEL32.dll1211RemoveDirectoryW
KERNEL32.dll1220ReplaceFileW
KERNEL32.dll1224ResetEvent
KERNEL32.dll1231ResumeThread
KERNEL32.dll1233RtlCaptureStackBackTrace
KERNEL32.dll1237RtlUnwind
KERNEL32.dll1259SetConsoleCtrlHandler
KERNEL32.dll1291SetCurrentDirectoryW
KERNEL32.dll1298SetEndOfFile
KERNEL32.dll1302SetEnvironmentVariableW
KERNEL32.dll1304SetEvent
KERNEL32.dll1311SetFileAttributesW
KERNEL32.dll1317SetFilePointerEx
KERNEL32.dll1332SetLastError
KERNEL32.dll1341SetNamedPipeHandleState
KERNEL32.dll1353SetProcessShutdownParameters
KERNEL32.dll1358SetStdHandle
KERNEL32.dll1378SetThreadPriority
KERNEL32.dll1385SetThreadpoolThreadMaximum
KERNEL32.dll1386SetThreadpoolThreadMinimum
KERNEL32.dll1393SetUnhandledExceptionFilter
KERNEL32.dll1409Sleep
KERNEL32.dll1411SleepConditionVariableSRW
KERNEL32.dll1412SleepEx
KERNEL32.dll1416SubmitThreadpoolWork
KERNEL32.dll1417SuspendThread
KERNEL32.dll1421SystemTimeToTzSpecificLocalTime
KERNEL32.dll1424TerminateProcess
KERNEL32.dll1440Thread32First
KERNEL32.dll1441Thread32Next
KERNEL32.dll1442TlsAlloc
KERNEL32.dll1443TlsFree
KERNEL32.dll1444TlsGetValue
KERNEL32.dll1445TlsSetValue
KERNEL32.dll1447TransactNamedPipe
KERNEL32.dll1449TryAcquireSRWLockExclusive
KERNEL32.dll1457UnhandledExceptionFilter
KERNEL32.dll1459UnlockFileEx
KERNEL32.dll1460UnmapViewOfFile
KERNEL32.dll1467UnregisterWaitEx
KERNEL32.dll1477VerSetConditionMask
KERNEL32.dll1481VerifyVersionInfoW
KERNEL32.dll1482VirtualAlloc
KERNEL32.dll1485VirtualFree
KERNEL32.dll1488VirtualProtect
KERNEL32.dll1490VirtualQuery
KERNEL32.dll1491VirtualQueryEx
KERNEL32.dll1499WaitForSingleObject
KERNEL32.dll1500WaitForSingleObjectEx
KERNEL32.dll1504WaitForThreadpoolWorkCallbacks
KERNEL32.dll1506WaitNamedPipeW
KERNEL32.dll1507WakeAllConditionVariable
KERNEL32.dll1508WakeConditionVariable
KERNEL32.dll1538WideCharToMultiByte
KERNEL32.dll1557WriteConsoleW
KERNEL32.dll1558WriteFile
ADVAPI32.dll74BuildExplicitAccessWithNameW
ADVAPI32.dll80BuildSecurityDescriptorW
ADVAPI32.dll129ConvertStringSecurityDescriptorToSecurityDescriptorW
ADVAPI32.dll289EventRegister
ADVAPI32.dll291EventUnregister
ADVAPI32.dll292EventWrite
ADVAPI32.dll369GetTraceEnableFlags
ADVAPI32.dll370GetTraceEnableLevel
ADVAPI32.dll371GetTraceLoggerHandle
ADVAPI32.dll396ImpersonateNamedPipeClient
ADVAPI32.dll603RegCloseKey
ADVAPI32.dll652RegOpenKeyExW
ADVAPI32.dll664RegQueryValueExA
ADVAPI32.dll665RegQueryValueExW
ADVAPI32.dll693RegisterTraceGuidsW
ADVAPI32.dll705RevertToSelf
ADVAPI32.dll803SystemFunction036
ADVAPI32.dll806TraceEvent
ADVAPI32.dll821UnregisterTraceGuids
dbghelp.dll53SymCleanup
dbghelp.dll90SymFromAddr
dbghelp.dll109SymGetLineFromAddr64
dbghelp.dll134SymGetSearchPathW
dbghelp.dll160SymInitialize
dbghelp.dll189SymSetOptions
dbghelp.dll195SymSetSearchPathW
SHELL32.dll8CommandLineToArgvW
SHELL32.dll335SHGetFolderPathW
SHELL32.dll345SHGetKnownFolderPath
WINMM.dll144timeBeginPeriod
WINMM.dll145timeEndPeriod
WINMM.dll148timeGetTime
ole32.dll94CoInitializeEx
ole32.dll116CoRegisterInitializeSpy
ole32.dll128CoRevokeInitializeSpy
ole32.dll137CoTaskMemFree
ole32.dll141CoUninitialize
SHLWAPI.dll127PathMatchSpecW
USER32.dll118CreateWindowExW
USER32.dll167DefWindowProcW
USER32.dll181DestroyWindow
USER32.dll189DispatchMessageW
USER32.dll391GetMessageW
USER32.dll432GetQueueStatus
USER32.dll485GetWindowLongW
USER32.dll588KillTimer
USER32.dll656MsgWaitForMultipleObjectsEx
USER32.dll679PeekMessageW
USER32.dll683PostMessageW
USER32.dll684PostQuitMessage
USER32.dll730RegisterClassExW
USER32.dll731RegisterClassW
USER32.dll869SetTimer
USER32.dll881SetWindowLongW
USER32.dll933TranslateMessage
USER32.dll944UnregisterClassW
VERSION.dll7GetFileVersionInfoSizeW
VERSION.dll8GetFileVersionInfoW
VERSION.dll16VerQueryValueW
WINHTTP.dll4WinHttpAddRequestHeaders
WINHTTP.dll8WinHttpCloseHandle
WINHTTP.dll9WinHttpConnect
WINHTTP.dll21WinHttpCrackUrl
WINHTTP.dll38WinHttpOpen
WINHTTP.dll39WinHttpOpenRequest
WINHTTP.dll44WinHttpQueryHeaders
WINHTTP.dll46WinHttpReadData
WINHTTP.dll49WinHttpReceiveResponse
WINHTTP.dll52WinHttpSendRequest
WINHTTP.dll58WinHttpSetTimeouts
WINHTTP.dll67WinHttpWriteData
ordentry_vafunction_name
10x67380GetHandleVerifier
20x52950lark_add_handler
30x52920lark_crashpad_create_dmp_by_handle
40x52910lark_crashpad_get_version
50x52380lark_crashpad_init_client
60x526b0lark_crashpad_init_server
module_namelark_crashpad.dll
flags0
timestamp0
version0.0
ordinal_base0
nFunctions7
nNames6
Names(6)0x162a35
Functions(7)0x162a19
NameOrdinals(6)0x162a4d
offsetsizetypecomment
01529856DLL02/01/2019 21:39:02#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK