filenameatdll (apsun-AbsoluteTouchEx).dll
size87552 (0x15600)
md5dd66483a9a5c7a1a3b25f0f1e1bd4424
typePE32+ executable (DLL) (GUI) x86-64, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x110

Rich Header

lib idversiontimes used
1473072910
2612892022
260289208
259289203
257289206
261267304
257274127
10107
265290161
256290161
255290161
258290161

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x8664
NumberOfSections8
TimeDateStamp0x5f107487
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xf0
Characteristics0x2022
Magic0x20b
LinkerVersion14.27
SizeOfCode0xde00
SizeOfInitializedData0x7c00
SizeOfUninitializedData0
AddressOfEntryPoint0xde80
BaseOfCode0x1000
ImageBase0x180000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.0
ImageVersion0.0
SubsystemVersion6.0
Reserved10
SizeOfImage0x1b000
SizeOfHeaders0x400
CheckSum0
Subsystem2
DllCharacteristics0x160
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MASM/TASM - sig1(h)

Sections

namevavsizeraw sizeflags
.text0x10000xdc0d0xde00R-X CODE
.rdata0xf0000x37d00x3800R-- IDATA
.data0x130000x8900x200RW- IDATA
.pdata0x140000xd500xe00R-- IDATA
.detourc0x150000x21c00x2200R-- IDATA
.detourd0x180000x180x200RW- IDATA
.rsrc0x190000x1e00x200R-- IDATA
.reloc0x1a0000x4c40x600R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT0x11bd00x38
IMPORT0x11c080xf0
RESOURCE0x190000x1e0
EXCEPTION0x140000xd50
SECURITY00
BASERELOC0x1a0000x4c4
DEBUG0xfe980x70
ARCHITECTURE00
GLOBALPTR00
TLS0x100400x28
LOAD_CONFIG0xff100x130
Bound_IAT00
IAT0xf0000x318
Delay_IAT00
CLR_Header00

TLS

raw
start		raw
end		indexcallbkszero
fill		flags
0x1800108c00x180010a700x1800132240x18000f3b800x500000
typenamesizecp
MANIFEST#23810
module_namehintordfunction_name
HID.DLL32HidP_GetValueCaps
HID.DLL21HidP_GetCaps
HID.DLL25HidP_GetScaledUsageValue
HID.DLL20HidP_GetButtonCaps
HID.DLL28HidP_GetUsageValue
HID.DLL35HidP_MaxUsageListLength
HID.DLL30HidP_GetUsages
KERNEL32.dll617GetLastError
KERNEL32.dll547GetCurrentThread
KERNEL32.dll432FreeConsole
KERNEL32.dll21AllocConsole
KERNEL32.dll640GetModuleHandleW
KERNEL32.dll1344SetLastError
KERNEL32.dll1504VirtualQueryEx
KERNEL32.dll1502VirtualProtectEx
KERNEL32.dll1503VirtualQuery
KERNEL32.dll1498VirtualFree
KERNEL32.dll1501VirtualProtect
KERNEL32.dll1495VirtualAlloc
KERNEL32.dll424FlushInstructionCache
KERNEL32.dll1379SetThreadContext
KERNEL32.dll768GetThreadContext
KERNEL32.dll1234ResumeThread
KERNEL32.dll1429SuspendThread
KERNEL32.dll548GetCurrentThreadId
KERNEL32.dll543GetCurrentProcess
KERNEL32.dll358ExitProcess
KERNEL32.dll1436TerminateProcess
KERNEL32.dll1041OpenProcess
KERNEL32.dll1496VirtualAllocEx
KERNEL32.dll878InitializeSListHead
KERNEL32.dll754GetSystemTimeAsFileTime
KERNEL32.dll544GetCurrentProcessId
KERNEL32.dll1105QueryPerformanceCounter
KERNEL32.dll1147ReadProcessMemory
KERNEL32.dll900IsDebuggerPresent
KERNEL32.dll1580WriteProcessMemory
KERNEL32.dll907IsProcessorFeaturePresent
KERNEL32.dll1405SetUnhandledExceptionFilter
KERNEL32.dll1470UnhandledExceptionFilter
KERNEL32.dll1250RtlVirtualUnwind
KERNEL32.dll919IsWow64Process
KERNEL32.dll1243RtlLookupFunctionEntry
KERNEL32.dll1236RtlCaptureContext
USER32.dll436GetRawInputData
USER32.dll438GetRawInputDeviceInfoW
USER32.dll751RegisterRawInputDevices
USER32.dll439GetRawInputDeviceList
USER32.dll744RegisterHotKey
USER32.dll33CallWindowProcW
USER32.dll488GetWindowLongPtrW
USER32.dll118CreateWindowExW
USER32.dll888SetWindowLongPtrW
MSVCP140.dll655void __cdecl std::_Xout_of_range(char const * __ptr64)

?_Xout_of_range@std@@YAXPEBD@Z

MSVCP140.dll654void __cdecl std::_Xlength_error(char const * __ptr64)

?_Xlength_error@std@@YAXPEBD@Z

VCRUNTIME140_1.dll__CxxFrameHandler4
VCRUNTIME140.dll60memcpy
VCRUNTIME140.dll33__std_exception_copy
VCRUNTIME140.dll34__std_exception_destroy
VCRUNTIME140.dll1_CxxThrowException
VCRUNTIME140.dll37__std_type_info_destroy_list
VCRUNTIME140.dll62memset
VCRUNTIME140.dll61memmove
VCRUNTIME140.dll8__C_specific_handler
api-ms-win-crt-stdio-l1-1-0.dll133freopen
api-ms-win-crt-stdio-l1-1-0.dll125fopen
api-ms-win-crt-stdio-l1-1-0.dll3__stdio_common_vfprintf
api-ms-win-crt-stdio-l1-1-0.dll6__stdio_common_vfscanf
api-ms-win-crt-stdio-l1-1-0.dll116fclose
api-ms-win-crt-stdio-l1-1-0.dll145putc
api-ms-win-crt-stdio-l1-1-0.dll__acrt_iob_func
api-ms-win-crt-heap-l1-1-0.dll25malloc
api-ms-win-crt-heap-l1-1-0.dll8_callnewh
api-ms-win-crt-heap-l1-1-0.dll24free
api-ms-win-crt-runtime-l1-1-0.dll63_seh_filter_dll
api-ms-win-crt-runtime-l1-1-0.dll57_invalid_parameter_noinfo_noreturn
api-ms-win-crt-runtime-l1-1-0.dll34_execute_onexit_table
api-ms-win-crt-runtime-l1-1-0.dll55_initterm_e
api-ms-win-crt-runtime-l1-1-0.dll54_initterm
api-ms-win-crt-runtime-l1-1-0.dll22_cexit
api-ms-win-crt-runtime-l1-1-0.dll30_crt_atexit
api-ms-win-crt-runtime-l1-1-0.dll60_register_onexit_function
api-ms-win-crt-runtime-l1-1-0.dll52_initialize_onexit_table
api-ms-win-crt-runtime-l1-1-0.dll51_initialize_narrow_environment
api-ms-win-crt-runtime-l1-1-0.dll24_configure_narrow_argv
api-ms-win-crt-string-l1-1-0.dll139strlen
api-ms-win-crt-string-l1-1-0.dll134strcmp
api-ms-win-crt-math-l1-1-0.dll125ceilf
ordentry_vafunction_name
10xbd80
module_nameatdll.dll
flags0
timestamp2106-02-07 06:28:15
version0.0
ordinal_base1
nFunctions1
nNames0
Names(0)0
Functions(1)0x11bf8
NameOrdinals(0)0
offsetsizetypecomment
15c115HTM#
15d081968BINoverlay data past EOF#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable







[?] can't find file_offset of VA 0x13224
[?] can't find file_offset of VA 0x0