Assistant.dll

info
MZ
PE
resources
imports
exports
foremost
hexdump
disasm
log
discuss
donate

filename	Assistant.dll
size	4296192 (0x418e00)
md5	d4d1cc69e363813c14f289694756aa1e

type	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0xf0

Rich Header

lib id	version	times used
205	50929	38
207	50929	82
206	50929	227
147	30729	5
1	0	202
0	0	3
211	60610	49
202	60610	1
201	60610	1
204	60610	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	5
TimeDateStamp	0x52fbb6d9
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x2102
Magic	0x10b
LinkerVersion	11.0
SizeOfCode	0x27ca00
SizeOfInitializedData	0x1bfa00
SizeOfUninitializedData	0
AddressOfEntryPoint	0x1e9c5f
BaseOfCode	0x1000
BaseOfData	0x27e000
ImageBase	0x10000000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	6.0
ImageVersion	0.0
SubsystemVersion	6.0
Reserved1	0
SizeOfImage	0x43f000
SizeOfHeaders	0x400
CheckSum	0x419cfd
Subsystem	2
DllCharacteristics	0x140
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x27c9a1	0x27ca00	R-X CODE
.rdata	0x27e000	0x3cbaf	0x3cc00	R-- IDATA
.data	0x2bb000	0x40744	0x1ce00	RW- IDATA
.rsrc	0x2fc000	0x124f30	0x125000	R-- IDATA
.reloc	0x421000	0x1d446	0x1d600	R-- IDATA DISCARDABLE

Data Directory

type	va	size
EXPORT	0x2baad0	0xdf
IMPORT	0x2b99ec	0x3c
RESOURCE	0x2fc000	0x124f30
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0x421000	0x143e8
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0x28edf0	0x40
Bound_IAT	0	0
IAT	0x27e000	0x2f4
Delay_IAT	0	0
CLR_Header	0	0

show previews

type	name	size
ICON	#1	1128
ICON	#2	1128
RCDATA	#111	1017
RCDATA	#112	2307
RCDATA	#113	2481
RCDATA	#114	1375
GROUP_ICON	#101	20
GROUP_ICON	#102	20
MANIFEST	#1	383
#1032	#120	3533
#1032	#121	20
#1032	#122	20
#1032	#123	20
#1032	#124	20
#1064	#164	1123060
#1064	#166	62403

module_name	hint	function_name
KERNEL32.dll	1202	Sleep
KERNEL32.dll	836	LocalAlloc
KERNEL32.dll	759	IsBadReadPtr
KERNEL32.dll	1217	TerminateThread
KERNEL32.dll	825	LeaveCriticalSection
KERNEL32.dll	1022	ReleaseSemaphore
KERNEL32.dll	238	EnterCriticalSection
KERNEL32.dll	174	CreateSemaphoreW
KERNEL32.dll	181	CreateThread
KERNEL32.dll	549	GetNativeSystemInfo
KERNEL32.dll	751	InterlockedIncrement
KERNEL32.dll	864	MoveFileExW
KERNEL32.dll	747	InterlockedDecrement
KERNEL32.dll	668	GetUserDefaultLangID
KERNEL32.dll	675	GetVersionExA
KERNEL32.dll	1043	ResumeThread
KERNEL32.dll	514	GetLastError
KERNEL32.dll	449	GetCurrentProcessId
KERNEL32.dll	354	FreeLibrary
KERNEL32.dll	1260	VirtualFree
KERNEL32.dll	581	GetProcAddress
KERNEL32.dll	1257	VirtualAlloc
KERNEL32.dll	828	LoadLibraryA
KERNEL32.dll	1263	VirtualProtect
KERNEL32.dll	313	FindFirstFileW
KERNEL32.dll	129	CreateDirectoryW
KERNEL32.dll	302	FindClose
KERNEL32.dll	325	FindNextFileW
KERNEL32.dll	281	ExitProcess
KERNEL32.dll	496	GetFileSize
KERNEL32.dll	855	MapViewOfFile
KERNEL32.dll	1238	UnmapViewOfFile
KERNEL32.dll	168	CreateProcessW
KERNEL32.dll	1130	SetFileTime
KERNEL32.dll	1317	WriteFile
KERNEL32.dll	738	InitializeCriticalSection
KERNEL32.dll	624	GetSystemDirectoryW
KERNEL32.dll	479	GetExitCodeProcess
KERNEL32.dll	143	CreateFileW
KERNEL32.dll	475	GetEnvironmentVariableA
KERNEL32.dll	515	GetLocalTime
KERNEL32.dll	140	CreateFileMappingW
KERNEL32.dll	1027	RemoveDirectoryW
KERNEL32.dll	209	DeleteCriticalSection
KERNEL32.dll	609	GetShortPathNameW
KERNEL32.dll	214	DeleteFileW
KERNEL32.dll	334	FindResourceW
KERNEL32.dll	833	LoadResource
KERNEL32.dll	745	InterlockedCompareExchange
KERNEL32.dll	1201	SizeofResource
KERNEL32.dll	852	LockResource
KERNEL32.dll	533	GetModuleHandleA
KERNEL32.dll	536	GetModuleHandleW
KERNEL32.dll	863	MoveFileExA
KERNEL32.dll	867	MoveFileW
KERNEL32.dll	453	GetCurrentThreadId
KERNEL32.dll	211	DeleteFileA
KERNEL32.dll	504	GetFullPathNameA
KERNEL32.dll	722	HeapReAlloc
KERNEL32.dll	136	CreateFileA
KERNEL32.dll	1126	SetFilePointer
KERNEL32.dll	1107	SetEndOfFile
KERNEL32.dll	715	HeapAlloc
KERNEL32.dll	1213	SystemTimeToFileTime
KERNEL32.dll	935	QueryPerformanceCounter
KERNEL32.dll	719	HeapFree
KERNEL32.dll	1236	UnlockFile
KERNEL32.dll	850	LockFile
KERNEL32.dll	906	OutputDebugStringW
KERNEL32.dll	1237	UnlockFileEx
KERNEL32.dll	1224	TlsSetValue
KERNEL32.dll	633	GetSystemTimeAsFileTime
KERNEL32.dll	349	FormatMessageA
KERNEL32.dll	1297	WideCharToMultiByte
KERNEL32.dll	831	LoadLibraryW
KERNEL32.dll	350	FormatMessageW
KERNEL32.dll	676	GetVersionExW
KERNEL32.dll	718	HeapDestroy
KERNEL32.dll	485	GetFileAttributesA
KERNEL32.dll	717	HeapCreate
KERNEL32.dll	727	HeapValidate
KERNEL32.dll	490	GetFileAttributesW
KERNEL32.dll	960	ReadFile
KERNEL32.dll	871	MultiByteToWideChar
KERNEL32.dll	343	FlushFileBuffers
KERNEL32.dll	645	GetTempPathW
KERNEL32.dll	724	HeapSize
KERNEL32.dll	851	LockFileEx
KERNEL32.dll	463	GetDiskFreeSpaceW
KERNEL32.dll	137	CreateFileMappingA
KERNEL32.dll	460	GetDiskFreeSpaceA
KERNEL32.dll	627	GetSystemInfo
KERNEL32.dll	487	GetFileAttributesExW
KERNEL32.dll	905	OutputDebugStringA
KERNEL32.dll	644	GetTempPathA
KERNEL32.dll	840	LocalFree
KERNEL32.dll	631	GetSystemTime
KERNEL32.dll	21	AreFileApisANSI
KERNEL32.dll	448	GetCurrentProcess
KERNEL32.dll	531	GetModuleFileNameA
KERNEL32.dll	391	GetCommandLineW
KERNEL32.dll	476	GetEnvironmentVariableW
KERNEL32.dll	643	GetTempFileNameW
KERNEL32.dll	535	GetModuleHandleExW
KERNEL32.dll	390	GetCommandLineA
KERNEL32.dll	351	FreeConsole
KERNEL32.dll	1358	lstrlenW
KERNEL32.dll	612	GetStdHandle
KERNEL32.dll	893	OpenMutexW
KERNEL32.dll	447	GetCurrentDirectoryW
KERNEL32.dll	527	GetLongPathNameW
KERNEL32.dll	1139	SetLastError
KERNEL32.dll	687	GetWindowsDirectoryW
KERNEL32.dll	1121	SetFileAttributesW
KERNEL32.dll	1113	SetEvent
KERNEL32.dll	117	CopyFileW
KERNEL32.dll	843	LocalReAlloc
KERNEL32.dll	1039	ResetEvent
KERNEL32.dll	133	CreateEventW
KERNEL32.dll	1101	SetCurrentDirectoryW
KERNEL32.dll	1271	WaitForMultipleObjects
KERNEL32.dll	462	GetDiskFreeSpaceExW
KERNEL32.dll	845	LocalSize
KERNEL32.dll	889	OpenFileMappingW
KERNEL32.dll	1221	TlsAlloc
KERNEL32.dll	1032	RemoveVectoredExceptionHandler
KERNEL32.dll	524	GetLongPathNameA
KERNEL32.dll	14	AddVectoredExceptionHandler
KERNEL32.dll	642	GetTempFileNameA
KERNEL32.dll	749	InterlockedExchangeAdd
KERNEL32.dll	492	GetFileInformationByHandle
KERNEL32.dll	659	GetTickCount
KERNEL32.dll	1223	TlsGetValue
KERNEL32.dll	82	CloseHandle
KERNEL32.dll	1018	ReleaseMutex
KERNEL32.dll	1323	WritePrivateProfileStringW
KERNEL32.dll	532	GetModuleFileNameW
KERNEL32.dll	578	GetPrivateProfileStringW
KERNEL32.dll	1273	WaitForSingleObject
KERNEL32.dll	158	CreateMutexW
KERNEL32.dll	586	GetProcessHeap
KERNEL32.dll	507	GetFullPathNameW
KERNEL32.dll	617	GetStringTypeW
KERNEL32.dll	664	GetTimeZoneInformation
KERNEL32.dll	370	GetCPInfo
KERNEL32.dll	945	RaiseException
KERNEL32.dll	1048	RtlUnwind
KERNEL32.dll	739	InitializeCriticalSectionAndSpinCount
KERNEL32.dll	772	IsProcessorFeaturePresent
KERNEL32.dll	1235	UnhandledExceptionFilter
KERNEL32.dll	1189	SetUnhandledExceptionFilter
KERNEL32.dll	1216	TerminateProcess
KERNEL32.dll	1222	TlsFree
KERNEL32.dll	611	GetStartupInfoW
KERNEL32.dll	100	CompareStringW
KERNEL32.dll	813	LCMapStringW
KERNEL32.dll	518	GetLocaleInfoW
KERNEL32.dll	780	IsValidLocale
KERNEL32.dll	667	GetUserDefaultLCID
KERNEL32.dll	271	EnumSystemLocalesW
KERNEL32.dll	768	IsDebuggerPresent
KERNEL32.dll	778	IsValidCodePage
KERNEL32.dll	360	GetACP
KERNEL32.dll	567	GetOEMCP
KERNEL32.dll	428	GetConsoleMode
KERNEL32.dll	958	ReadConsoleW
KERNEL32.dll	410	GetConsoleCP
KERNEL32.dll	499	GetFileType
KERNEL32.dll	474	GetEnvironmentStringsW
KERNEL32.dll	353	FreeEnvironmentStringsW
KERNEL32.dll	830	LoadLibraryExW
KERNEL32.dll	1127	SetFilePointerEx
KERNEL32.dll	1159	SetStdHandle
KERNEL32.dll	164	CreateProcessA
KERNEL32.dll	1316	WriteConsoleW
KERNEL32.dll	1110	SetEnvironmentVariableA
KERNEL32.dll	1265	VirtualQuery
ADVAPI32.dll	594	RegEnumValueW
ADVAPI32.dll	580	RegDeleteKeyW
ADVAPI32.dll	591	RegEnumKeyExW
ADVAPI32.dll	609	RegOpenKeyExW
ADVAPI32.dll	622	RegQueryValueExW
ADVAPI32.dll	638	RegSetValueExW
ADVAPI32.dll	560	RegCloseKey
ADVAPI32.dll	584	RegDeleteValueW
ADVAPI32.dll	569	RegCreateKeyExW
ADVAPI32.dll	616	RegQueryInfoKeyW

ord	entry_va	function_name
1	0x200c10	__apicall
2	0x184830	__cb
3	0x211200	__install
4	0x211140	__uninstall
5	0x211380	_info
6	0x95c45	_init
7	0x211070	_install
8	0x1d7000	_ui
9	0x210fa0	_uninstall

module_name	cr2a427128_7280.dll
flags	0
timestamp	2014-02-12 18:00:50
version	0.0
ordinal_base	1
nFunctions	9
nNames	9
Names(9)	0x2bab1c
Functions(9)	0x2baaf8
NameOrdinals(9)	0x2bab40

show previews

offset	size	type	comment
15c1	15	HTM		#
15d0	4290608	BIN	overlay data past EOF	#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

everything is OK