filenametemplate_man.dll
size77824 (0x13000)
md5e63e359508518611a5c23f63a192d02e
typePE32 executable (DLL) (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xf8

Rich Header

lib idversiontimes used
199411181
205509297
2065092914
203509294
2075092910
1473072913
10175
2076121917
202610301
204610301

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections3
TimeDateStamp0x5c41e89d
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x2102
Magic0x10b
LinkerVersion11.0
SizeOfCode0x12000
SizeOfInitializedData0x2000
SizeOfUninitializedData0x27000
AddressOfEntryPoint0x384e0
BaseOfCode0x28000
BaseOfData0x3a000
ImageBase0x10000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion5.1
ImageVersion0.0
SubsystemVersion5.1
Reserved10
SizeOfImage0x3c000
SizeOfHeaders0x1000
CheckSum0
Subsystem2
DllCharacteristics0x140
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

UPX v2.00-V2.90 (Markus Oberhumer & Laszlo Molnar & John Reiser)

This file is packed with UPX. Analysis will be incomplete without unpacking.
We can unpack it for you.

»» Analyze unpacked file

Sections

namevavsizeraw sizeflags
.text0x10000x270000RWX UDATA
.data0x280000x120000x11200RWX IDATA
UPX20x3a0000x20000x1a00RW- IDATA

Data Directory

typevasize
EXPORT0x3a1f40x1648
IMPORT0x3a0000x1f4
RESOURCE00
EXCEPTION00
SECURITY00
BASERELOC0x3b83c0x18
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x390c00x48
Bound_IAT00
IAT00
Delay_IAT00
CLR_Header00
module_namehintordfunction_name
KERNEL32.DLLLoadLibraryA
KERNEL32.DLLGetProcAddress
KERNEL32.DLLVirtualProtect
MPR.dllWNetGetUniversalNameA
MSVCP110.dllvoid __cdecl std::_Xbad_alloc(void)

?_Xbad_alloc@std@@YAXXZ

MSVCR110.dllfree
OLEAUT32.dll201
SHELL32.dllSHGetMalloc
SHLWAPI.dllPathGetDriveNumberA
USER32.dllLoadImageA
ordentry_vafunction_name
10x21b10_GET_BUILD_VERSION@0
20x22420_build@0
30x21f60_create_section@16
40x21fa0_create_specific_section@20
50x22010_create_specific_tag_man@4
60x22070_create_specific_template@8
70x22110_create_specific_template_manager@12
80x22170_create_tag_man@0
90x221c0_create_template@4
100x22210_create_template_manager@8
110x22300_current_item_value_interface_is_compatible_with@4
120x22260_current_section_interface_is_compatible_with@4
130x222a0_current_section_line_interface_is_compatible_with@4
140x222e0_current_tag_interface_is_compatible_with@4
150x22300_current_tag_man_interface_is_compatible_with@4
160x22330_current_template_interface_is_compatible_with@4
170x22390_current_template_manager_client_interface_is_compatible_with@4
180x223a0_current_template_manager_interface_is_compatible_with@4
190x223d0_desc@0
200x223e0_get_current_item_value_interface_version@0
210xc3b0_get_current_section_interface_version@0
220x223f0_get_current_section_line_interface_version@0
230x22400_get_current_tag_interface_version@0
240x223e0_get_current_tag_man_interface_version@0
250x22410_get_current_template_interface_version@0
260x22420_get_current_template_manager_client_interface_version@0
270x22430_get_current_template_manager_interface_version@0
280x22440_id@0
290x22450_item_value_Aget_svalue@4
300x22c20_item_value_compare@8
310x227e0_item_value_copy@8
320x224a0_item_value_get_dvalue@4
330x224d0_item_value_get_ivalue@4
340x22500_item_value_get_svalue@4
350x22f40_item_value_get_type@4
360x22530_kill_section@4
370x22560_kill_tag_man@4
380x22590_kill_template@4
390x225c0_kill_template_manager@4
400x22d30_section_Aget_desc@4
410x225f0_section_add_line@4
420x22620_section_allocate@8
430x22650_section_compare@8
440x22e80_section_copy@8
450x231a0_section_delete_line@8
460x22b90_section_get_aux_info@8
470x22f10_section_get_desc@4
480x224d0_section_get_id@4
490x22680_section_get_line@8
500x226b0_section_get_store_always@4
510x226e0_section_insert_line@8
520x22710_section_line_add_dvalue@12
530x22750_section_line_add_ivalue@8
540x22bf0_section_line_add_svalue@8
550x22780_section_line_allocate@8
560x227b0_section_line_compare@8
570x232c0_section_line_copy@8
580x22e80_section_line_delete_value@8
590x227e0_section_line_get_value@8
600x22810_section_line_insert_dvalue@16
610x22850_section_line_insert_ivalue@12
620x22880_section_line_insert_svalue@12
630x22f10_section_line_n_levels@4
640x228b0_section_line_reset@4
650x228e0_section_line_set_dvalue@16
660x22c80_section_line_set_ivalue@12
670x22920_section_line_set_svalue@12
680x22950_section_line_swap@12
690x22f40_section_n_aux_infos@4
700x22980_section_n_lines@4
710x229b0_section_remove_duplications@4
720x229e0_section_reset@4
730x22a10_section_set_aux_info@12
740x22a40_section_set_desc@8
750x22a70_section_set_id@8
760x22aa0_section_set_store_always@8
770x22ad0_section_swap@12
780x22b00_tag_Aget_desc@4
790x22b50_tag_add_dvalue@12
800x22b90_tag_add_ivalue@8
810x22c20_tag_add_svalue@8
820x22bc0_tag_compare@8
830x231a0_tag_copy@8
840x232c0_tag_delete_item@8
850x224d0_tag_get_desc@4
860x22bf0_tag_get_value@8
870x22b90_tag_man_add_tag@8
880x22e80_tag_man_compare@8
890x231a0_tag_man_copy@8
900x232c0_tag_man_delete_tag@8
910x22bc0_tag_man_find_tag@8
920x22c20_tag_man_find_tag_idx@8
930x227e0_tag_man_get_tag@8
940x22f40_tag_man_n_tags@4
950x22750_tag_man_read_from_file@8
960x22c50_tag_man_reset@4
970x22c80_tag_man_save_to_file@12
980x22500_tag_n_values@4
990x22cb0_tag_reset@4
1000x22ce0_template_Aget_current_checksum@4
1010x22d30_template_Aget_description@4
1020x22d80_template_Aget_file_name@4
1030x22dd0_template_Aget_saved_checksum@4
1040x22620_template_accept_id_string@8
1050x22e20_template_add_section@20
1060x22e50_template_compare@8
1070x227e0_template_copy@8
1080x22e80_template_delete_section@8
1090x22eb0_template_discard_empty_sections@4
1100x22ee0_template_get_current_checksum@4
1110x22f10_template_get_description@4
1120x22f40_template_get_file_name@4
1130x22f70_template_get_read_header_only@4
1140x22fa0_template_get_saved_checksum@4
1150x231a0_template_get_section@8
1160x22fd0_template_get_tag_man@4
1170x23000_template_is_encrypted@4
1180x227b0_template_is_id_string_accepted@8
1190x23030_template_lookup_section_idx@16
1200x23060_template_lookup_section_idx_by_desc@8
1210x22450_template_manager_Aget_directory@4
1220x23090_template_manager_Aget_file_extension@4
1230x230e0_template_manager_client_on_save_to_file@12
1240x22680_template_manager_copy_template@8
1250x23110_template_manager_delete_template@8
1260x22bc0_template_manager_find_template_idx@8
1270x22500_template_manager_get_directory@4
1280x23140_template_manager_get_file_extension@4
1290x23170_template_manager_get_read_header_only@4
1300x231a0_template_manager_get_template@8
1310x231d0_template_manager_n_templates@4
1320x232c0_template_manager_new_template@8
1330x226e0_template_manager_remove_template@8
1340x227e0_template_manager_reset@8
1350x22f10_template_manager_save_templates@4
1360x22750_template_manager_set_directory@8
1370x22bf0_template_manager_set_file_extension@8
1380x23200_template_manager_set_read_header_only@8
1390x23230_template_n_sections@4
1400x23140_template_need_to_save@4
1410x22750_template_read_from_file@8
1420x23260_template_reset@4
1430x23290_template_save_to_file@8
1440x232c0_template_set_description@8
1450x232f0_template_set_encrypted@8
1460x226e0_template_set_file_name@8
1470x23320_template_set_need_to_save@8
1480x23350_template_set_read_header_only@8
1490x23380_template_set_saved_checksum@8
1500x233b0_template_store_current_checksum@4
module_nametemplate_man.dll
flags0
timestamp2019-01-18 14:54:21
version0.0
ordinal_base1
nFunctions150
nNames150
Names(150)0x3a474
Functions(150)0x3a21c
NameOrdinals(150)0x3a6cc
offsetsizetypecomment
077824DLL01/18/2019 14:54:21#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK